Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-52480 State: PUBLISHED Published: 2025-06-25T16:37:32.944Z Last Updated: 2025-06-26T14:37:18.399Z Vendors: JuliaRegistries Products: Registrator.jl Problem Types: CWE-88 Description: Registrator is a GitHub app that automates creation of registration pull requests for julia packages to the General registry. Prior to version 1.9.5, if the clone URL returned by GitHub is malicious (or can be injected using upstream vulnerabilities), an argument injection is possible in the `gettreesha()` function. This can then lead to a potential remote code execution. Users should upgrade immediately to v1.9.5 to receive a patch. All prior versions are vulnerable. No known workarounds are av
should upgrade immediately to v1.9.5 to receive a patch. All prior versions are vulnerable. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/JuliaRegistries/Registrator.jl/security/advisories/GHSA-w8jv-rg3h-fc68 - https://github.com/JuliaRegistries/Registrator.jl/pull/449
CVE ID: CVE-2025-52483 State: PUBLISHED Published: 2025-06-25T16:39:45.707Z Last Updated: 2025-06-26T14:38:03.142Z Vendors: JuliaRegistries Products: Registrator.jl Problem Types: CWE-77 Description: Registrator is a GitHub app that automates creation of registration pull requests for julia packages to the General registry. Prior to version 1.9.5, if the clone URL returned by GitHub is malicious (or can be injected using upstream vulnerabilities) a shell script injection can occur within the `withpasswd` function. Alternatively, an argument injection is possible in the `gettreesha `function. either of these can then lead to a potential RCE. Users should upgrade immediately to v1.9.5 to recei
treesha `function. either of these can then lead to a potential RCE. Users should upgrade immediately to v1.9.5 to receive a fix. All prior versions are vulnerable. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/JuliaRegistries/Registrator.jl/security/advisories/GHSA-589r-g8hf-xx59 - https://github.com/JuliaRegistries/Registrator.jl/pull/448
CVE ID: CVE-2025-52484 State: PUBLISHED Published: 2025-06-20T17:21:28.392Z Last Updated: 2025-06-23T15:28:43.485Z Vendors: risc0 Products: risc0 Problem Types: CWE-345 Description: RISC Zero is a general computing platform based on zk-STARKs and the RISC-V microarchitecture. Due to a missing constraint in the rv32im circuit, any 3-register RISC-V instruction (including remu and divu) in risc0-zkvm 2.0.0, 2.0.1, and 2.0.2 are vulnerable to an attack by a malicious prover. The main idea for the attack is to confuse the RISC-V virtual machine into treating the value of the rs1 register as the same as the rs2 register due to a lack of constraints in the rv32im circuit. Rust applications using t
1 register as the same as the rs2 register due to a lack of constraints in the rv32im circuit. Rust applications using the risc0-zkvm crate at versions 2.0.0, 2.0.1, and 2.0.2 should upgrade to version 2.1.0. Smart contract applications using the official RISC Zero Verifier Router do not need to take any action: zkVM version 2.1 is active on all official routers, and version 2.0 has been disabled. Smart contract applications not using the verifier router should update their contracts to send verification calls to the 2.1 version of the verifier. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/risc0/risc0/security/advisories/GHSA-g3qg-6746-3mg9 - https://gi
CISA ADP Vulnrichment: References: - https://github.com/risc0/risc0/security/advisories/GHSA-g3qg-6746-3mg9 - https://github.com/risc0/risc0/pull/3181 - https://github.com/risc0/zirgen/pull/238 - https://github.com/risc0/risc0/commit/006d86c363b16d2b2ac42d32d832a209ff8ab4c9 - https://github.com/risc0/risc0/commit/1873bbb8a56793edd1f6195242d184cf6cc5175d - https://github.com/risc0/risc0/commit/67f2d81c638bff5f4fcfe11a084ebb34799b7a89 - https://github.com/risc0/zirgen/commit/e0e2918302c93e956f73ca2e44aef2b861d8c3ae
CVE ID: CVE-2025-52485 State: PUBLISHED Published: 2025-06-21T02:40:38.257Z Last Updated: 2025-06-23T17:43:25.380Z Vendors: dnnsoftware Products: Dnn.Platform Problem Types: CWE-79 Description: DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted request to inject scripts in the Activity Feed Attachments endpoint which will then render in the feed. This issue has been patched in version 10.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-wwc9-wmm3-2pmf
CVE ID: CVE-2025-52486 State: PUBLISHED Published: 2025-06-21T02:42:47.816Z Last Updated: 2025-06-23T17:46:16.027Z Vendors: dnnsoftware Products: Dnn.Platform Problem Types: CWE-79 Description: DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows specially crafted content in URLs to be used with TokenReplace and not be properly sanitized by some SkinObjects. This issue has been patched in version 10.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-pf4h-vrv6-cmvr - https://github.com/dnnsoftwa
es: - https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-pf4h-vrv6-cmvr - https://github.com/dnnsoftware/Dnn.Platform/commit/74f6de68da1572c1d7e9c6e30e9f77f7c5596b1b
CVE ID: CVE-2025-52487 State: PUBLISHED Published: 2025-06-21T02:44:58.636Z Last Updated: 2025-06-23T17:46:51.567Z Vendors: dnnsoftware Products: Dnn.Platform Problem Types: CWE-863 Description: DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 7.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted request or proxy to be created that could bypass the design of DNN Login IP Filters allowing login attempts from IP Addresses not in the allow list. This issue has been patched in version 10.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dnnsoftware/Dnn.Platform/security/advis
itional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-fjhg-3mrh-mm7h
CVE ID: CVE-2025-52488 State: PUBLISHED Published: 2025-06-21T02:51:25.252Z Last Updated: 2025-06-23T17:47:24.661Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: dnnsoftware Products: Dnn.Platform Problem Types: CWE-200 Description: DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted series of malicious interaction to potentially expose NTLM hashes to a third party SMB server. This issue has been patched in version 10.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dnnsoftware/Dnn.Platfo
rsion 10.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-mgfv-2362-jq96
CVE ID: CVE-2025-52490 State: PUBLISHED Published: 2025-07-29T00:00:00.000Z Last Updated: 2025-07-29T20:27:03.220Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Couchbase Sync Gateway before 3.2.6. In sgcollect_info_options.log and sync_gateway.log, there are cleartext passwords in redacted and unredacted output. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.couchbase.com/tags/security - https://docs.couchbase.com/server/current/release-notes/relnotes.html - https://www.couchbase.com/alerts/
CVE ID: CVE-2025-52491 State: PUBLISHED Published: 2025-06-30T00:00:00.000Z Last Updated: 2025-07-02T14:14:52.986Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) Vendors: Akamai Products: CloudTest Problem Types: CWE-918 Description: Akamai CloudTest before 60 2025.06.09 (12989) allows SSRF. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.akamai.com/products/cloudtest - https://techdocs.akamai.com/cloudtest/changelog/june-9-2025-enhancements-and-bug-fixes
CVE ID: CVE-2025-52492 State: PUBLISHED Published: 2025-07-07T00:00:00.000Z Last Updated: 2025-07-08T17:37:23.903Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability has been discovered in the firmware of Paxton Paxton10 before 4.6 SR6. The firmware file, rootfs.tar.gz, contains hard-coded credentials for the Twilio API. A remote attacker who obtains a copy of the firmware can extract these credentials. This could allow the attacker to gain unauthorized access to the associated Twilio account, leading to information disclosure, potential service disruption, and unauthorized use of the Twilio services. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
uption, and unauthorized use of the Twilio services. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://paxton-access.co.uk - https://gist.github.com/jackcaplin/0dfb7ef428b8ade5de4396dd753cd894
CVE ID: CVE-2025-52494 State: PUBLISHED Published: 2025-09-03T00:00:00.000Z Last Updated: 2025-09-03T17:54:40.897Z Vendors: n/a Products: n/a Problem Types: n/a Description: Adacore Ada Web Server (AWS) before 25.2 is vulnerable to a denial-of-service (DoS) condition due to improper handling of SSL handshakes during connection initialization. When a client initiates an HTTPS connection, the server performs the SSL handshake before assigning the connection to a processing slot. However, there is no specific timeout set for this phase, and the server uses the default socket timeout, which is effectively infinite. An attacker can exploit this by sending a malformed TLS ClientHello message with
imeout, which is effectively infinite. An attacker can exploit this by sending a malformed TLS ClientHello message with incorrect length values. This causes the server to wait indefinitely for data that never arrives, blocking the worker thread (Line) handling the connection. By opening multiple such connections, up to the server's maximum limit, the attacker can exhaust all available working threads, preventing the server from handling new, legitimate requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://adacore.com - https://docs.adacore.com/corp/security-advisories/SEC.AWS-0095-v1.pdf
CVE ID: CVE-2025-52496 State: PUBLISHED Published: 2025-07-04T00:00:00.000Z Last Updated: 2025-11-03T20:05:50.713Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: Mbed Products: mbedtls Problem Types: CWE-733 Description: Mbed TLS before 3.6.4 has a race condition in AESNI detection if certain compiler optimizations occur. An attacker may be able to extract an AES key from a multithreaded program, or perform a GCM forgery. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Mbed-TLS/mbedtls-docs/blob/main/security-advisories/mbedtls-security-advisory-2025-06-1.md
CVE ID: CVE-2025-52497 State: PUBLISHED Published: 2025-07-04T00:00:00.000Z Last Updated: 2025-11-03T20:05:52.109Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: Mbed Products: mbedtls Problem Types: CWE-193 Description: Mbed TLS before 3.6.4 has a PEM parsing one-byte heap-based buffer underflow, in mbedtls_pem_read_buffer and two mbedtls_pk_parse functions, via untrusted PEM input. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Mbed-TLS/mbedtls-docs/blob/main/security-advisories/mbedtls-security-advisory-2025-06-2.md
CVE ID: CVE-2025-52512 State: PUBLISHED Published: 2025-11-04T00:00:00.000Z Last Updated: 2025-11-04T21:21:10.214Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Samsung Mobile Processor Exynos 2400, 1580, 2500. A race condition in the HTS driver results in out-of-bounds memory access, leading to a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-52512/
CVE ID: CVE-2025-52513 State: PUBLISHED Published: 2025-11-04T00:00:00.000Z Last Updated: 2025-11-04T20:37:11.807Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Samsung Mobile Processor Exynos 2400, 1580, 2500. A race condition in the HTS driver results in an out-of-bounds write, leading to a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-52513/
CVE ID: CVE-2025-52520 State: PUBLISHED Published: 2025-07-10T19:05:41.637Z Last Updated: 2025-11-04T21:11:39.773Z Vendors: Apache Software Foundation Products: Apache Tomcat Problem Types: CWE-190 Description: For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to vers
fected: 8.5.0 through 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5
CVE ID: CVE-2025-52521 State: PUBLISHED Published: 2025-07-10T18:57:25.462Z Last Updated: 2025-07-11T03:55:31.259Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Trend Micro, Inc. Products: Trend Micro Security (Consumer) Problem Types: CWE-64 Description: Trend Micro Security 17.8 (Consumer) is vulnerable to a link following local privilege escalation vulnerability that could allow a local attacker to unintentionally delete privileged Trend Micro files including its own. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpcenter.trendmicro.com/en-us/article/tmka-18876 - https://www.zerodayinitiative.com/advisories/ZDI-25-585/
CVE ID: CVE-2025-52538 State: PUBLISHED Published: 2025-11-24T20:38:06.450Z Last Updated: 2025-11-24T20:53:39.846Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H) Vendors: AMD Products: Xilinx Run Time (XRT) Problem Types: CWE-190 Description: Improper input validation within the XOCL driver may allow a local attacker to generate an integer overflow condition, potentially resulting in loss of confidentiality or availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8014.html
CVE ID: CVE-2025-52539 State: PUBLISHED Published: 2025-11-24T19:42:46.919Z Last Updated: 2025-11-24T20:31:53.040Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: AMD Products: Xilinx Run Time (XRT) Problem Types: CWE-121 Description: A buffer overflow with Xilinx Run Time Environment may allow a local attacker to read or corrupt data from the advanced extensible interface (AXI), potentially resulting in loss of confidentiality, integrity, and/or availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8014.html
CVE ID: CVE-2025-52542 State: REJECTED Published: 2025-06-23T13:23:57.509Z Last Updated: 2025-06-23T13:28:35.576Z Description: No description available.
CVE ID: CVE-2025-52543 State: PUBLISHED Published: 2025-09-02T11:24:32.443Z Last Updated: 2025-09-02T13:43:02.830Z Vendors: Copeland LP Products: E3 Supervisory Control Problem Types: CWE-836 Description: E3 Site Supervisor Control (firmware version < 2.31F01) application services (MGW and RCI) uses client side hashing for authentication. An attacker can authenticate by obtaining only the password hash. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.armis.com/research/frostbyte10/
CVE ID: CVE-2025-52544 State: PUBLISHED Published: 2025-09-02T11:25:01.106Z Last Updated: 2025-09-02T13:36:13.634Z Vendors: Copeland LP Products: E3 Supervisory Control Problem Types: CWE-20 Description: E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenticated attacker to upload floor plan files. By uploading a specially crafted floor plan file, an attacker can access any file from the E3 file system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.armis.com/research/frostbyte10/
CVE ID: CVE-2025-52545 State: PUBLISHED Published: 2025-09-02T11:25:22.792Z Last Updated: 2025-09-02T13:33:29.926Z Vendors: Copeland LP Products: E3 Supervisory Control Problem Types: CWE-522 Description: E3 Site Supervisor Control (firmware version < 2.31F01) RCI service contains an API call to read users info, which returns all usernames and password hashes for the application services. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.armis.com/research/frostbyte10/
CVE ID: CVE-2025-52546 State: PUBLISHED Published: 2025-09-02T11:25:39.864Z Last Updated: 2025-09-02T13:30:49.398Z Vendors: Copeland LP Products: E3 Supervisory Control Problem Types: CWE-434 Description: E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenticated attacker to upload floor plan files. By uploading a specially crafted floor plan file, an attacker can inject a stored XSS to the floorplan web page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.armis.com/research/frostbyte10/
CVE ID: CVE-2025-52547 State: PUBLISHED Published: 2025-09-02T11:25:54.718Z Last Updated: 2025-09-02T13:29:17.409Z Vendors: Copeland LP Products: E3 Supervisory Control Problem Types: CWE-20 Description: E3 Site Supervisor Control (firmware version < 2.31F01) MGW contains an API call that lacks input validation. An attacker can use this command to continuously crash the application services. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.armis.com/research/frostbyte10/
CVE ID: CVE-2025-52548 State: PUBLISHED Published: 2025-09-02T11:26:08.636Z Last Updated: 2025-09-02T13:28:08.207Z Vendors: Copeland LP Products: E3 Supervisory Control Problem Types: CWE-1242 Description: E3 Site Supervisor Control (firmware version < 2.31F01) contains a hidden API call in the application services that enables SSH and Shellinabox, which exist but are disabled by default. An attacker with admin access to the application services can utilize this API to enable remote access to the underlying OS. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.armis.com/research/frostbyte10/
CVE ID: CVE-2025-52549 State: PUBLISHED Published: 2025-09-02T11:26:23.423Z Last Updated: 2025-09-02T13:43:26.506Z Vendors: Copeland LP Products: E3 Supervisory Control Problem Types: CWE-522 Description: E3 Site Supervisor Control (firmware version < 2.31F01) generates the root linux password on each boot. An attacker can generate the root linux password for a vulnerable device based on known or easy to fetch parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.armis.com/research/frostbyte10/
CVE ID: CVE-2025-52550 State: PUBLISHED Published: 2025-09-02T11:26:35.207Z Last Updated: 2025-09-02T13:40:43.018Z Vendors: Copeland LP Products: E3 Supervisory Control Problem Types: CWE-347 Description: E3 Site Supervisor Control (firmware version < 2.31F01) firmware upgrade packages are unsigned. An attacker can forge malicious firmware upgrade packages. An attacker with admin access to the application services can install a malicious firmware upgrade. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.armis.com/research/frostbyte10/
CVE ID: CVE-2025-52551 State: PUBLISHED Published: 2025-09-02T11:30:14.832Z Last Updated: 2025-09-02T13:33:54.672Z Vendors: Copeland LP Products: E2 Facility Management System Problem Types: CWE-306 Description: E2 Facility Management Systems use a proprietary protocol that allows for unauthenticated file operations on any file in the file system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.armis.com/research/frostbyte10/
CVE ID: CVE-2025-52552 State: PUBLISHED Published: 2025-06-21T02:15:07.026Z Last Updated: 2025-06-23T17:42:33.181Z Vendors: labring Products: FastGPT Problem Types: CWE-601, CWE-79 Description: FastGPT is an AI Agent building platform. Prior to version 4.9.12, the LastRoute Parameter on login page is vulnerable to open redirect and DOM-based XSS. Improper validation and lack of sanitization of this parameter allows attackers execute malicious JavaScript or redirect them to attacker-controlled sites. This issue has been patched in version 4.9.12. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/labring/FastGPT/security/advisories/GHSA-r976-rfrv-q24m - https:
CISA ADP Vulnrichment: References: - https://github.com/labring/FastGPT/security/advisories/GHSA-r976-rfrv-q24m - https://github.com/labring/FastGPT/commit/095b75ee27746004106eddeaa4840688a61ff6eb
CVE ID: CVE-2025-52553 State: PUBLISHED Published: 2025-06-27T15:03:13.015Z Last Updated: 2025-06-27T15:50:17.417Z Vendors: goauthentik Products: authentik Problem Types: CWE-287 Description: authentik is an open-source identity provider. After authorizing access to a RAC endpoint, authentik creates a token which is used for a single connection and is sent to the client in the URL. This token is intended to only be valid for the session of the user who authorized the connection, however this check is missing in versions prior to 2025.6.3 and 2025.4.3. When, for example, using RAC during a screenshare, a malicious user could access the same session by copying the URL from the shown browser. a
ng RAC during a screenshare, a malicious user could access the same session by copying the URL from the shown browser. authentik 2025.4.3 and 2025.6.3 fix this issue. As a workaround, it is recommended to decrease the duration a token is valid for (in the RAC Provider settings, set Connection expiry to `minutes=5` for example). The maintainers of authentik also recommend enabling the option Delete authorization on disconnect. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/goauthentik/authentik/security/advisories/GHSA-wr3v-9p2c-chx7 - https://github.com/goauthentik/authentik/commit/0e07414e9739b318cff9401a413a5fe849545325 - https://github.com/goauthentik/
tps://github.com/goauthentik/authentik/commit/0e07414e9739b318cff9401a413a5fe849545325 - https://github.com/goauthentik/authentik/commit/65373ab21711d58147b5cb9276c5b5876baaa5eb - https://github.com/goauthentik/authentik/commit/7100d3c6741853f1cfe3ea2073ba01823ab55caa
CVE ID: CVE-2025-52554 State: PUBLISHED Published: 2025-07-03T20:08:54.093Z Last Updated: 2025-07-03T20:18:25.270Z Vendors: n8n-io Products: n8n Problem Types: CWE-862 Description: n8n is a workflow automation platform. Prior to version 1.99.1, an authorization vulnerability was discovered in the /rest/executions/:id/stop endpoint of n8n. An authenticated user can stop workflow executions that they do not own or that have not been shared with them, leading to potential business disruption. This issue has been patched in version 1.99.1. A workaround involves restricting access to the /rest/executions/:id/stop endpoint via reverse proxy or API gateway. Additional Analyst Notes: - CISA ADP Vuln