Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-55155 State: PUBLISHED Published: 2025-11-04T20:48:03.428Z Last Updated: 2025-11-04T21:03:12.088Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: mantisbt Products: mantisbt Problem Types: CWE-201, CWE-354 Description: Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.27.1 and below, when a user edits their profile to change their e-mail address, the system saves it without validating that it actually belongs to the user. This could result in storing an invalid email address, preventing the user from receiving system notifications. Notifications sent to another person's email address could lead to information discl
rom receiving system notifications. Notifications sent to another person's email address could lead to information disclosure. This issue is fixed in version 2.27.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mantisbt/mantisbt/security/advisories/GHSA-q747-c74m-69pr - https://github.com/mantisbt/mantisbt/commit/21e9fbedde8553c29c0d3156e84f78157fc4f22e - https://mantisbt.org/bugs/view.php?id=36005
CVE ID: CVE-2025-55156 State: PUBLISHED Published: 2025-08-11T22:21:52.225Z Last Updated: 2025-08-12T15:49:56.057Z Vendors: pyload Products: pyload Problem Types: CWE-89 Description: pyLoad is the free and open-source Download Manager written in pure Python. Prior to version 0.5.0b3.dev91, the parameter add_links in API /json/add_package is vulnerable to SQL Injection. Attackers can modify or delete data in the database, causing data errors or loss. This issue has been patched in version 0.5.0b3.dev91. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pyload/pyload/security/advisories/GHSA-pwh4-6r3m-j2rf - https://github.com/pyload/pyload/commit/134edcdf6e2a
/github.com/pyload/pyload/security/advisories/GHSA-pwh4-6r3m-j2rf - https://github.com/pyload/pyload/commit/134edcdf6e2a10c393743c254da3d9d90b74258f - https://github.com/pyload/pyload/blob/develop/src/pyload/core/database/file_database.py#L271
CVE ID: CVE-2025-55157 State: PUBLISHED Published: 2025-08-11T22:54:27.302Z Last Updated: 2025-08-12T15:52:20.470Z Vendors: vim Products: vim Problem Types: CWE-416 Description: Vim is an open source, command line text editor. In versions from 9.1.1231 to before 9.1.1400, When processing nested tuples in Vim script, an error during evaluation can trigger a use-after-free in Vim’s internal tuple reference management. Specifically, the tuple_unref() function may access already freed memory due to improper lifetime handling, leading to memory corruption. The exploit requires direct user interaction, as the script must be explicitly executed within Vim. This issue has been patched in version 9.1
irect user interaction, as the script must be explicitly executed within Vim. This issue has been patched in version 9.1.1400. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vim/vim/security/advisories/GHSA-3r4f-mm4w-wgg6 - https://github.com/vim/vim/commit/1307743697bbc46e1518abfea7f89caa95bcaf97 - https://github.com/vim/vim/releases/tag/v9.1.1400
CVE ID: CVE-2025-55158 State: PUBLISHED Published: 2025-08-11T22:54:12.015Z Last Updated: 2025-08-12T15:51:41.020Z Vendors: vim Products: vim Problem Types: CWE-415 Description: Vim is an open source, command line text editor. In versions from 9.1.1231 to before 9.1.1406, when processing nested tuples during Vim9 script import operations, an error during evaluation can trigger a double-free in Vim’s internal typed value (typval_T) management. Specifically, the clear_tv() function may attempt to free memory that has already been deallocated, due to improper lifetime handling in the handle_import / ex_import code paths. The vulnerability can only be triggered if a user explicitly opens and exe
in the handle_import / ex_import code paths. The vulnerability can only be triggered if a user explicitly opens and executes a specially crafted Vim script. This issue has been patched in version 9.1.1406. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vim/vim/security/advisories/GHSA-5fg8-wvx3-583x - https://github.com/vim/vim/commit/9772025d24e939fd84b85748ce35c26874c05775 - https://github.com/vim/vim/releases/tag/v9.1.1406
CVE ID: CVE-2025-55159 State: PUBLISHED Published: 2025-08-11T23:00:58.915Z Last Updated: 2025-08-12T14:07:00.276Z Vendors: tokio-rs Products: slab Problem Types: CWE-119 Description: slab is a pre-allocated storage for a uniform data type. In version 0.4.10, the get_disjoint_mut method incorrectly checked if indices were within the slab's capacity instead of its length, allowing access to uninitialized memory. This could lead to undefined behavior or potential crashes. This has been fixed in slab 0.4.11. A workaround for this issue involves to avoid using get_disjoint_mut with indices that might be beyond the slab's actual length. Additional Analyst Notes: - CISA ADP Vulnrichment: Reference
with indices that might be beyond the slab's actual length. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/tokio-rs/slab/security/advisories/GHSA-qx2v-8332-m4fv - https://github.com/tokio-rs/slab/pull/152 - https://github.com/tokio-rs/slab/commit/2d65c514bc964b192bab212ddf3c1fcea4ae96b8
CVE ID: CVE-2025-55160 State: PUBLISHED Published: 2025-08-13T14:00:53.826Z Last Updated: 2025-08-13T14:26:49.201Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L) Vendors: ImageMagick Products: ImageMagick Problem Types: CWE-758 Description: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1, there is undefined behavior (function-type-mismatch) in splay tree cloning callback. This results in a deterministic abort under UBSan (DoS in sanitizer builds), with no crash in a non-sanitized build. This issue has been patched in versions 6.9.13-27 and 7.1.2-1. Additional Analyst Notes: - CISA
n a non-sanitized build. This issue has been patched in versions 6.9.13-27 and 7.1.2-1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6hgw-6x87-578x
CVE ID: CVE-2025-55161 State: PUBLISHED Published: 2025-08-11T22:28:30.152Z Last Updated: 2025-08-12T15:50:45.183Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: Stirling-Tools Products: Stirling-PDF Problem Types: CWE-918 Description: Stirling-PDF is a locally hosted web application that performs various operations on PDF files. Prior to version 1.1.0, when using the /api/v1/convert/markdown/pdf endpoint to convert Markdown to PDF, the backend calls a third-party tool to process it and includes a sanitizer for security sanitization which can be bypassed and result in SSRF. This issue has been patched in version 1.1.0. Additional Analyst Notes: - CISA ADP Vul
n be bypassed and result in SSRF. This issue has been patched in version 1.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-ff33-grr6-rmvp - https://github.com/Stirling-Tools/Stirling-PDF/commit/7d6b70871bad2a3ff810825f7382c49f55293943
CVE ID: CVE-2025-55162 State: PUBLISHED Published: 2025-09-03T19:51:51.024Z Last Updated: 2025-09-04T14:29:49.494Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N) Vendors: envoyproxy Products: envoy Problem Types: CWE-613 Description: Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In versions below 1.32.10 and 1.33.0 through 1.33.6, 1.34.0 through 1.34.4 and 1.35.0, insufficient Session Expiration in the Envoy OAuth2 filter leads to failed logout operations. When configured with __Secure- or __Host- prefixed cookie names, the filter fails to append the required Secure attribute to the Set-Cookie header
ure- or __Host- prefixed cookie names, the filter fails to append the required Secure attribute to the Set-Cookie header during deletion. Modern browsers ignore this invalid request, causing the session cookie to persist. This allows a user to remain logged in after they believe they have logged out, creating a session hijacking risk on shared computers. The current implementation iterates through the configured cookie names to generate deletion headers but does not check for these prefixes. This failure to properly construct the deletion header means the user's session cookies are never removed by the browser, leaving the session active and allowing the next user of the same browser to gain
kies are never removed by the browser, leaving the session active and allowing the next user of the same browser to gain unauthorized access to the original user's account and data. This is fixed in versions 1.32.10, 1.33.7, 1.34.5 and 1.35.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/envoyproxy/envoy/security/advisories/GHSA-95j4-hw7f-v2rh - https://github.com/envoyproxy/envoy/releases/tag/v1.35.1
CVE ID: CVE-2025-55163 State: PUBLISHED Published: 2025-08-13T14:17:36.111Z Last Updated: 2025-11-04T21:13:02.288Z Vendors: netty Products: netty Problem Types: CWE-770 Description: Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit - which results in resource exhaustion and distributed denial of service. This issue has been patched in versions 4.1.124.Final and 4.2.4.Final. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Progra
been patched in versions 4.1.124.Final and 4.2.4.Final. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/netty/netty/security/advisories/GHSA-prj3-ccx8-p6x4
CVE ID: CVE-2025-55164 State: PUBLISHED Published: 2025-08-12T16:02:44.952Z Last Updated: 2025-08-20T19:39:47.679Z Vendors: helmetjs Products: content-security-policy-parser Problem Types: CWE-1321 Description: content-security-policy-parser parses content security policy directives. A prototype pollution vulnerability exists in versions 0.5.0 and earlier, wherein if a policy name is called __proto__, one can override the Object prototype. This issue has been patched in version 0.6.0. A workaround involves disabling prototype method in NodeJS, neutralizing all possible prototype pollution attacks. Provide either --disable-proto=delete (recommended) or --disable-proto=throw as an argument to
otype pollution attacks. Provide either --disable-proto=delete (recommended) or --disable-proto=throw as an argument to node to enable this feature. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/helmetjs/content-security-policy-parser/security/advisories/GHSA-w2cq-g8g3-gm83 - https://github.com/helmetjs/content-security-policy-parser/issues/11 - https://github.com/helmetjs/content-security-policy-parser/commit/b13a52554f0168af393e3e38ed4a94e9e6aea9dc
CVE ID: CVE-2025-55165 State: PUBLISHED Published: 2025-08-12T20:52:41.789Z Last Updated: 2025-08-13T20:01:53.112Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: gelbphoenix Products: autocaliweb Problem Types: CWE-200 Description: Autocaliweb is a web app that offers an interface for browsing, reading, and downloading eBooks using a valid Calibre database. Prior to version 0.8.3, the debug pack generated by Autocaliweb can expose sensitive configuration data, including API keys. This occurs because the to_dict() method, used to serialize configuration for the debug pack, doesn't adequately filter out sensitive fields such as API tokens. Users, unaware of the
nfiguration for the debug pack, doesn't adequately filter out sensitive fields such as API tokens. Users, unaware of the full contents, might share these debug packs, inadvertently leaking their private API keys. This issue has been patched in version 0.8.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/gelbphoenix/autocaliweb/security/advisories/GHSA-44vp-wgh9-9535 - https://github.com/gelbphoenix/autocaliweb/commit/f455051f7c758ae8490186718b73e449f353b702 - https://github.com/gelbphoenix/autocaliweb/releases/tag/v0.8.3
CVE ID: CVE-2025-55166 State: PUBLISHED Published: 2025-08-12T16:25:17.220Z Last Updated: 2025-08-12T17:48:05.000Z Vendors: darylldoyle Products: svg-sanitizer Problem Types: CWE-79, CWE-601 Description: savg-sanitizer is a PHP SVG/XML sanitizer. Prior to version 0.22.0, the sanitization logic in the cleanXlinkHrefs method only searches for lower-case attribute name, which allows to by-pass the isHrefSafeValue check. As a result this allows cross-site scripting or linking to external domains. This issue has been patched in version 0.22.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-22wq-q86m-83fh - htt
P Vulnrichment: References: - https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-22wq-q86m-83fh - https://github.com/darylldoyle/svg-sanitizer/commit/5a0a1eaf0c6b0b540dc945fe30c93cf106b357c1
CVE ID: CVE-2025-55167 State: PUBLISHED Published: 2025-08-12T16:33:15.458Z Last Updated: 2025-08-12T17:42:46.954Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-89 Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, a SQL Injection vulnerability was identified in the /html/funcionario/dependente_remover.php endpoint, specifically in the id_dependente parameter. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. This issue has been patched in version 3.4.8. Additional Analyst Notes: - CISA ADP
ty, and availability of the database. This issue has been patched in version 3.4.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-4fqm-ww3v-6mwv - https://github.com/LabRedesCefetRJ/WeGIA/commit/cb7f5e2b98ef6087b80659627f368612e3c535f3
CVE ID: CVE-2025-55168 State: PUBLISHED Published: 2025-08-12T18:56:45.239Z Last Updated: 2025-08-12T19:28:34.701Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-89 Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, a SQL Injection vulnerability was identified in the /html/saude/aplicar_medicamento.php endpoint, specifically in the id_fichamedica parameter. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. This issue has been patched in version 3.4.8. Additional Analyst Notes: - CISA ADP Vul
and availability of the database. This issue has been patched in version 3.4.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-6wjm-c879-pjf6 - https://github.com/LabRedesCefetRJ/WeGIA/issues/245 - https://github.com/LabRedesCefetRJ/WeGIA/commit/766f9f07ff6faee394e0f85d0650f86f8a9248a7https://github.com/LabRedesCefetRJ/WeGIA/commit/766f9f07ff6faee394e0f85d0650f86f8a9248a7
CVE ID: CVE-2025-55169 State: PUBLISHED Published: 2025-08-12T19:01:40.482Z Last Updated: 2025-08-12T19:24:39.679Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-287, CWE-22 Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, a path traversal vulnerability was discovered in the WeGIA application, html/socio/sistema/download_remessa.php endpoint. This vulnerability could allow an attacker to gain unauthorized access to local files in the server and sensitive information stored in config.php. config.php contains information that could allow direct access to the database. This issue has been p
red in config.php. config.php contains information that could allow direct access to the database. This issue has been patched in version 3.4.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-mm3p-7573-4x4j - https://github.com/LabRedesCefetRJ/WeGIA/issues/177 - https://github.com/LabRedesCefetRJ/WeGIA/commit/e8476168171de2f3e047ed92bbc264c981b416b1
CVE ID: CVE-2025-55170 State: PUBLISHED Published: 2025-08-12T20:12:33.796Z Last Updated: 2025-08-12T20:29:01.054Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-79 Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, a reflected cross-site scripting (XSS) vulnerability was identified in the /html/alterar_senha.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the verificacao and redir_config parameter. This issue has been patched in version 3.4.8. Additional Analy
us scripts in the verificacao and redir_config parameter. This issue has been patched in version 3.4.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-77hc-c8f4-p3hc - https://github.com/LabRedesCefetRJ/WeGIA/issues/141 - https://github.com/LabRedesCefetRJ/WeGIA/commit/c2bd4121a2b2a076c9f2ef0bdbb46231389993c8
CVE ID: CVE-2025-55171 State: PUBLISHED Published: 2025-08-12T20:17:19.932Z Last Updated: 2025-08-12T20:27:35.508Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-287 Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, the application does not check authentication at endpoint /html/personalizacao_remover.php allowing anonymous attacker (without login) to delete any Image files at endpoint /html/personalizacao_remover.php by defining imagem_0 as image id to delete. This issue has been patched in version 3.4.8. Additional A
zacao_remover.php by defining imagem_0 as image id to delete. This issue has been patched in version 3.4.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-8rm5-3jvx-hcxv - https://github.com/LabRedesCefetRJ/WeGIA/issues/109 - https://github.com/LabRedesCefetRJ/WeGIA/commit/aa63f499a285bf91795b9836eec0425e7eafe570
CVE ID: CVE-2025-55173 State: PUBLISHED Published: 2025-08-29T22:00:05.765Z Last Updated: 2025-09-02T19:22:57.504Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: vercel Products: next.js Problem Types: CWE-20 Description: Next.js is a React framework for building full-stack web applications. In versions before 14.2.31 and from 15.0.0 to before 15.4.5, Next.js Image Optimization is vulnerable to content injection. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary content and filenames under specific configurations. This behavior could be abused for phishing or malicious file delivery. This vulnerability has
r specific configurations. This behavior could be abused for phishing or malicious file delivery. This vulnerability has been fixed in Next.js versions 14.2.31 and 15.4.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vercel/next.js/security/advisories/GHSA-xv57-4mr9-wg8v - https://github.com/vercel/next.js/commit/6b12c60c61ee80cb0443ccd20de82ca9b4422ddd - https://vercel.com/changelog/cve-2025-55173
CVE ID: CVE-2025-55175 State: PUBLISHED Published: 2025-08-28T10:12:44.014Z Last Updated: 2025-08-28T13:30:08.805Z Vendors: OpenSolution Products: QuickCMS Problem Types: CWE-79 Description: QuickCMS is vulnerable to Reflected XSS via sLangEdit parameter in admin's panel functionality. A malicious attacker can craft a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable. Additional Analy
.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/posts/2025/08/CVE-2025-54540 - https://opensolution.org
CVE ID: CVE-2025-55177 State: PUBLISHED Published: 2025-08-29T15:50:28.578Z Last Updated: 2025-10-21T22:45:20.172Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:F/RL:O/RC:C) Vendors: Facebook Products: WhatsApp Desktop for Mac, WhatsApp Business for iOS, WhatsApp for iOS Problem Types: Incorrect Authorization (CWE-863) Description: Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target’s device. We assess that this vulnerability, in combi
to trigger processing of content from an arbitrary URL on a target’s device. We assess that this vulnerability, in combination with an OS-level vulnerability on Apple platforms (CVE-2025-43300), may have been exploited in a sophisticated attack against specific targeted users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.facebook.com/security/advisories/cve-2025-55177 - https://www.whatsapp.com/security/advisories/2025/
CVE ID: CVE-2025-55178 State: PUBLISHED Published: 2025-09-24T18:31:28.309Z Last Updated: 2025-09-24T18:50:01.680Z Vendors: Meta Platforms, Inc Products: Llama Stack Problem Types: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Description: Llama Stack prior to version v0.2.20 accepted unverified parameters in the resolve_ast_by_type function which could potentially allow for remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.facebook.com/security/advisories/cve-2025-55178 - https://github.com/llamastack/llama-stack/pull/3281 - https://github.com/llamastack/llama-stack/releases/tag/v0.2.20
CVE ID: CVE-2025-55179 State: PUBLISHED Published: 2025-11-18T13:56:31.598Z Last Updated: 2025-11-18T14:25:08.232Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:F/RL:O/RC:C) Vendors: Facebook Products: WhatsApp Business for iOS, WhatsApp for iOS, WhatsApp Desktop for Mac Problem Types: Incorrect Authorization (CWE-863) Description: Incomplete validation of rich response messages in WhatsApp for iOS prior to v2.25.23.73, WhatsApp Business for iOS v2.25.23.82, and WhatsApp for Mac v2.25.23.83 could have allowed a user to trigger processing of media content from an arbitrary URL on another user’s device. We have not seen evidence of exploitation in the wild. Addition
content from an arbitrary URL on another user’s device. We have not seen evidence of exploitation in the wild. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.facebook.com/security/advisories/cve-2025-55179 - https://www.whatsapp.com/security/advisories/2025/