Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-26404 State: PUBLISHED Published: 2025-08-12T16:59:18.667Z Last Updated: 2025-08-13T20:16:01.618Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) DSA software Problem Types: Escalation of Privilege, CWE-427 Description: Uncontrolled search path for some Intel(R) DSA software before version 25.2.15.9 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01347.html
CVE ID: CVE-2025-26405 State: PUBLISHED Published: 2025-11-11T16:50:15.261Z Last Updated: 2025-11-12T20:00:50.994Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:H) Vendors: n/a Products: Intel(R) NPU Drivers Problem Types: Denial of Service, CWE-913 Description: Improper control of dynamically-managed code resources for some Intel(R) NPU Drivers within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requir
otentially occur via local access when attack requirements are not present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01304.html
CVE ID: CVE-2025-26408 State: PUBLISHED Published: 2025-02-11T09:14:28.700Z Last Updated: 2025-11-03T21:12:50.335Z Vendors: Wattsense Products: Wattsense Bridge Problem Types: CWE-1191 Description: The JTAG interface of Wattsense Bridge devices can be accessed with physical access to the PCB. After connecting to the interface, full access to the device is possible. This enables an attacker to extract information, modify and debug the device's firmware. All known versions are affected. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-consult.com/wattsense - https://support.wattsense.com/hc/en-150/articles/13366066529437-Release-Notes
CVE ID: CVE-2025-26409 State: PUBLISHED Published: 2025-02-11T09:15:30.131Z Last Updated: 2025-11-03T21:12:51.730Z Vendors: Wattsense Products: Wattsense Bridge Problem Types: CWE-1299, CWE-1191 Description: A serial interface can be accessed with physical access to the PCB of Wattsense Bridge devices. After connecting to the interface, access to the bootloader is possible, as well as a Linux login prompt. The bootloader access can be used to gain a root shell on the device. This issue is fixed in recent firmware versions BSP >= 6.4.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-consult.com/wattsense - https://support.wattsense.com/
ulnrichment: - CVE Program Container: References: - https://r.sec-consult.com/wattsense - https://support.wattsense.com/hc/en-150/articles/13366066529437-Release-Notes
CVE ID: CVE-2025-26410 State: PUBLISHED Published: 2025-02-11T09:20:22.708Z Last Updated: 2025-11-03T21:12:53.153Z Vendors: Wattsense Products: Wattsense Bridge Problem Types: CWE-798 Description: The firmware of all Wattsense Bridge devices contain the same hard-coded user and root credentials. The user password can be easily recovered via password cracking attempts. The recovered credentials can be used to log into the device via the login shell that is exposed by the serial interface. The backdoor user has been removed in firmware BSP >= 6.4.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-consult.com/wattsense - https://support.wa
- CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-consult.com/wattsense - https://support.wattsense.com/hc/en-150/articles/13366066529437-Release-Notes
CVE ID: CVE-2025-26411 State: PUBLISHED Published: 2025-02-11T09:21:16.571Z Last Updated: 2025-11-03T21:12:54.561Z Vendors: Wattsense Products: Wattsense Bridge Problem Types: CWE-434 Description: An authenticated attacker is able to use the Plugin Manager of the web interface of the Wattsense Bridge devices to upload malicious Python files to the device. This enables an attacker to gain remote root access to the device. An attacker needs a valid user account on the Wattsense web interface to be able to conduct this attack. This issue is fixed in recent firmware versions BSP >= 6.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-cons
P >= 6.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-consult.com/wattsense - https://support.wattsense.com/hc/en-150/articles/13366066529437-Release-Notes
CVE ID: CVE-2025-26412 State: PUBLISHED Published: 2025-06-11T08:21:31.679Z Last Updated: 2025-06-18T04:08:24.730Z Vendors: SIMCom Products: SIM7600G Modem Problem Types: CWE-912 Description: The SIMCom SIM7600G modem supports an undocumented AT command, which allows an attacker to execute system commands with root permission on the modem. An attacker needs either physical access or remote shell access to a device that interacts directly with the modem via AT commands. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-consult.com/simcom
CVE ID: CVE-2025-26413 State: PUBLISHED Published: 2025-04-22T07:07:49.985Z Last Updated: 2025-05-12T15:47:39.924Z Vendors: Apache Software Foundation Products: Apache Kvrocks Problem Types: CWE-20 Description: Improper Input Validation vulnerability in Apache Kvrocks. The SETRANGE command didn't check if the `offset` input is a positive integer and use it as an index of a string. So it will cause the server to crash due to its index is out of range. This issue affects Apache Kvrocks: through 2.11.1. Users are recommended to upgrade to version 2.12.0, which fixes the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thre
Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/388743qrr8yq8qm0go8tls6rf1kog8dw
CVE ID: CVE-2025-26416 State: PUBLISHED Published: 2025-09-02T22:11:27.751Z Last Updated: 2025-09-04T03:55:42.835Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In initializeSwizzler of SkBmpStandardCodec.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/external/skia/+/fc2ebb312c5898486776df981a51c2bb90e3756d - https://source.android.com/security/bulletin/2025-04-01
CVE ID: CVE-2025-26417 State: PUBLISHED Published: 2025-08-26T22:48:58.986Z Last Updated: 2025-08-27T14:13:41.118Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In checkWhetherCallingAppHasAccess of DownloadProvider.java, there is a possible bypass of user consent when opening files in shared storage due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/providers/DownloadProvider/+/ed764e06106adef1cff5178c6df038fd054e7bec -
ps://android.googlesource.com/platform/packages/providers/DownloadProvider/+/ed764e06106adef1cff5178c6df038fd054e7bec - https://source.android.com/security/bulletin/2025-03-01
CVE ID: CVE-2025-26419 State: PUBLISHED Published: 2025-09-04T19:28:08.789Z Last Updated: 2025-09-09T03:55:17.387Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In initPhoneSwitch of SystemSettingsFragment.java, there is a possible FRP bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/wear/2025-05-01
CVE ID: CVE-2025-26420 State: PUBLISHED Published: 2025-09-04T17:11:44.171Z Last Updated: 2025-09-06T03:55:37.840Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In multiple functions of GrantPermissionsActivity.java , there is a possible way to trick the user into granting the incorrect permission due to permission overload. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/modules/Permission/+/6bed47f63ec0600b3c57388449db37405c68dc58 - https://
ps://android.googlesource.com/platform/packages/modules/Permission/+/6bed47f63ec0600b3c57388449db37405c68dc58 - https://source.android.com/security/bulletin/2025-05-01
CVE ID: CVE-2025-26421 State: PUBLISHED Published: 2025-09-04T17:11:45.166Z Last Updated: 2025-09-06T03:55:38.576Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In multiple locations, there is a possible lock screen bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/b66817d2ed3b6ef29873bfe9857081cdef63681f - https://android.googlesource.com/platform/packages/apps/Settings/+/f16fa58405ed94703ea1886
ef29873bfe9857081cdef63681f - https://android.googlesource.com/platform/packages/apps/Settings/+/f16fa58405ed94703ea1886c483a2e2ce1c2b176 - https://source.android.com/security/bulletin/2025-05-01
CVE ID: CVE-2025-26422 State: PUBLISHED Published: 2025-09-04T17:11:46.184Z Last Updated: 2025-09-06T03:55:39.435Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In dump of WindowManagerService.java, there is a possible way of running dumpsys without the required permission due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/63ae789499395abc2b71fd46f57cac3c4ba1bd9d - https://source.android.com/security/bu
esource.com/platform/frameworks/base/+/63ae789499395abc2b71fd46f57cac3c4ba1bd9d - https://source.android.com/security/bulletin/2025-05-01
CVE ID: CVE-2025-26423 State: PUBLISHED Published: 2025-09-04T17:11:47.202Z Last Updated: 2025-09-06T03:55:40.177Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In validateIpConfiguration of WifiConfigurationUtil.java, there is a possible way to trigger a permanent DoS due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/modules/Wifi/+/01e708a7a9af970b3aa40cdca2cbde71d07a859b - https://source.android.com/security/bull
com/platform/packages/modules/Wifi/+/01e708a7a9af970b3aa40cdca2cbde71d07a859b - https://source.android.com/security/bulletin/2025-05-01
CVE ID: CVE-2025-26424 State: PUBLISHED Published: 2025-09-04T17:11:48.204Z Last Updated: 2025-09-04T19:53:35.883Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In multiple functions of VpnManager.java, there is a possible cross-user data leak due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/1b4ee554c8234d1ac16105c92fee2ea0803b8a39 - https://source.android.com/security/bulletin/2025-05-01
CVE ID: CVE-2025-26425 State: PUBLISHED Published: 2025-09-04T17:11:49.190Z Last Updated: 2025-09-06T03:55:40.958Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In multiple functions of RoleService.java, there is a possible permission squatting vulnerability due to a logic error in the code. This could lead to local escalation of privilege on versions of Android where android.permission.MANAGE_DEFAULT_APPLICATIONS was not defined with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/modules/Permis
Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/modules/Permission/+/850ce9ea3ac72540ce310722633d9c893a32dfdd - https://source.android.com/security/bulletin/2025-05-01
CVE ID: CVE-2025-26426 State: PUBLISHED Published: 2025-09-04T17:11:50.204Z Last Updated: 2025-09-06T03:55:41.718Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In BroadcastController.java of registerReceiverWithFeatureTraced, there is a possible way to receive broadcasts meant for the "android" package due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/475f9914f71641f0eedc4a8412cf48f49290a60c - https://
ences: - https://android.googlesource.com/platform/frameworks/base/+/475f9914f71641f0eedc4a8412cf48f49290a60c - https://android.googlesource.com/platform/frameworks/base/+/99aae825ded253fe58695ceb853f2f631137f1c4 - https://source.android.com/security/bulletin/2025-05-01
CVE ID: CVE-2025-26427 State: PUBLISHED Published: 2025-09-04T17:11:51.207Z Last Updated: 2025-09-06T03:55:42.553Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In multiple locations, there is a possible Android/data access due to a path traversal error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/providers/DownloadProvider/+/5acd646e0cf63e2c9c0862da7e03531ef0074394 - https://android.googlesource.com/platform/frameworks/base/+/4af5db76f2534884
/5acd646e0cf63e2c9c0862da7e03531ef0074394 - https://android.googlesource.com/platform/frameworks/base/+/4af5db76f25348849252e0b8a08f4a517ef842b7 - https://source.android.com/security/bulletin/2025-05-01
CVE ID: CVE-2025-26428 State: PUBLISHED Published: 2025-09-04T17:11:52.227Z Last Updated: 2025-09-04T19:56:38.539Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In startLockTaskMode of LockTaskController.java, there is a possible lock screen bypass due to a logic error in the code. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/afd05dc17e027734f665ac978ad6fb4584b6fd40 - https://source.android.com/security/bulletin/2025-05-01
CVE ID: CVE-2025-26429 State: PUBLISHED Published: 2025-09-04T17:11:53.241Z Last Updated: 2025-09-04T20:29:27.190Z Vendors: Google Products: Android Problem Types: Denial of service Description: In collectOps of AppOpsService.java, there is a possible way to cause permanent DoS due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/0f3c01c326b6966590c652adec5baa61351756e4 - https://source.android.com/security/bulletin/2025-05-01
CVE ID: CVE-2025-26430 State: PUBLISHED Published: 2025-09-04T17:11:54.225Z Last Updated: 2025-09-06T03:55:43.306Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In getDestinationForApp of SpaAppBridgeActivity, there is a possible cross-user file reveal due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/apps/Settings/+/484b4be8f3634fa0d0fed53729490b9135c644b5 - https://source.android.com/security/bulletin/2025-05-
ackages/apps/Settings/+/484b4be8f3634fa0d0fed53729490b9135c644b5 - https://source.android.com/security/bulletin/2025-05-01
CVE ID: CVE-2025-26431 State: PUBLISHED Published: 2025-09-04T19:28:09.809Z Last Updated: 2025-09-09T03:55:18.219Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In setupAccessibilityServices of AccessibilityFragment.java, there is a possible way to hide an enabled accessibility service due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/wear/2025-05-01
CVE ID: CVE-2025-26432 State: PUBLISHED Published: 2025-09-04T17:14:52.661Z Last Updated: 2025-09-05T17:13:21.582Z Vendors: Google Products: Android Problem Types: Denial of service Description: In multiple locations, there is a possible way to persistently DoS the device due to a missing length check. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/a928f327359247449c214dbc0504b8af3648bacf - https://source.android.com/security/bulletin/2025-06-01
CVE ID: CVE-2025-26434 State: PUBLISHED Published: 2025-09-05T16:10:02.497Z Last Updated: 2025-09-05T16:45:05.233Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In libxml2, there is a possible out of bounds read due to a buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/android-16
CVE ID: CVE-2025-26435 State: PUBLISHED Published: 2025-09-04T17:11:55.213Z Last Updated: 2025-09-06T03:55:44.075Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In updateState of ContentProtectionTogglePreferenceController.java, there is a possible way for a secondary user to disable the primary user's deceptive app scanning setting due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/apps/Settings/+/9dc0dd2c50ceb3
- CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/apps/Settings/+/9dc0dd2c50ceb30ca5062ff3a02e48a8b4165863 - https://source.android.com/security/bulletin/2025-05-01
CVE ID: CVE-2025-26436 State: PUBLISHED Published: 2025-09-04T17:11:56.198Z Last Updated: 2025-09-06T03:55:44.884Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In clearAllowBgActivityStarts of PendingIntentRecord.java, there is a possible way for an application to launch an activity from the background due to BAL Bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/bba26504af51d2dd3b8eddeb96e59cac8fcb9070 - https://android.googles
//android.googlesource.com/platform/frameworks/base/+/bba26504af51d2dd3b8eddeb96e59cac8fcb9070 - https://android.googlesource.com/platform/frameworks/base/+/ccba6717779fea0a86b6326f9925c36fc837738c - https://source.android.com/security/bulletin/2025-05-01
CVE ID: CVE-2025-26437 State: PUBLISHED Published: 2025-09-04T17:14:53.688Z Last Updated: 2025-09-05T17:13:58.055Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In CredentialManagerServiceStub of CredentialManagerService.java, there is a possible way to retrieve candidate credentials due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/c623bbe683082b602ecff0f33fbb439ffc1d2da3 - https://source.android.com/s
roid.googlesource.com/platform/frameworks/base/+/c623bbe683082b602ecff0f33fbb439ffc1d2da3 - https://source.android.com/security/bulletin/2025-06-01
CVE ID: CVE-2025-26438 State: PUBLISHED Published: 2025-09-04T17:11:57.204Z Last Updated: 2025-09-06T03:55:45.730Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In smp_process_secure_connection_oob_data of smp_act.cc, there is a possible way to bypass SMP authentication due to Incorrect implementation of a protocol. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e6130675c04752947ac4779c178ce70eb959a97f - https://source.an
roid.googlesource.com/platform/packages/modules/Bluetooth/+/e6130675c04752947ac4779c178ce70eb959a97f - https://source.android.com/security/bulletin/2025-05-01
CVE ID: CVE-2025-26439 State: PUBLISHED Published: 2025-09-04T19:28:10.842Z Last Updated: 2025-09-06T03:56:17.470Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In getComponentName of AccessibilitySettingsUtils.java, there is a possible way to for a malicious Talkback service to be enabled instead of the system component due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/wear/2025-05-01