Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ss below the beginning of the stack buffer, resulting in a stack overflow through `vsnprintf()`. Versions 7.1.2-0 and 6.9.13-26 fix the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qh3h-j545-h8c9 - https://github.com/ImageMagick/ImageMagick/commit/66dc8f51c11b0ae1f1cdeacd381c3e9a4de69774
CVE ID: CVE-2025-53102 State: PUBLISHED Published: 2025-07-29T19:24:06.076Z Last Updated: 2025-07-29T19:33:43.304Z Vendors: discourse Products: discourse Problem Types: CWE-384 Description: Discourse is an open-source community discussion platform. Prior to version 3.4.7 on the `stable` branch and version 3.5.0.beta.8 on the `tests-passed` branch, upon issuing a physical security key for 2FA, the server generates a WebAuthn challenge, which the client signs. The challenge is not cleared from the user’s session after authentication, potentially allowing reuse and increasing security risk. This is fixed in versions 3.4.7 and 3.5.0.beta.8. Additional Analyst Notes: - CISA ADP Vulnrichment: Refe
security risk. This is fixed in versions 3.4.7 and 3.5.0.beta.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-hv49-93h5-4wcv - https://github.com/discourse/discourse/commit/20bf65099bb861a141bc10e8a4eab65329d91802 - https://github.com/discourse/discourse/commit/8bc0cee2c00a514ea60f33ea6172da2ce5a05beb
CVE ID: CVE-2025-53103 State: PUBLISHED Published: 2025-07-01T18:02:39.060Z Last Updated: 2025-07-01T18:50:18.904Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N) Vendors: junit-team Products: junit-framework Problem Types: CWE-312 Description: JUnit is a testing framework for Java and the JVM. From version 5.12.0 to 5.13.1, JUnit's support for writing Open Test Reporting XML files can leak Git credentials. The impact depends on the level of the access token exposed through the OpenTestReportGeneratingListener. If these test reports are published or stored anywhere public, then there is the possibility that a rouge attacker can steal the token and perform elevated ac
stored anywhere public, then there is the possibility that a rouge attacker can steal the token and perform elevated actions by impersonating the user or app. This issue as been patched in version 5.13.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/junit-team/junit-framework/security/advisories/GHSA-m43g-m425-p68x - https://github.com/junit-team/junit-framework/commit/d4fc834c8c1c0b3168cd030c13551d1d041f51bc
CVE ID: CVE-2025-53104 State: PUBLISHED Published: 2025-07-01T18:17:01.667Z Last Updated: 2025-07-01T19:18:51.273Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: gluestack Products: gluestack-ui Problem Types: CWE-77 Description: gluestack-ui is a library of copy-pasteable components & patterns crafted with Tailwind CSS (NativeWind). Prior to commit e6b4271, a command injection vulnerability was discovered in the discussion-to-slack.yml GitHub Actions workflow. Untrusted discussion fields (title, body, etc.) were directly interpolated into shell commands in a run: block. An attacker could craft a malicious GitHub Discussion title or body (e.g., $(curl ...
to shell commands in a run: block. An attacker could craft a malicious GitHub Discussion title or body (e.g., $(curl ...)) to execute arbitrary shell commands on the Actions runner. This issue has been fixed in commit e6b4271 where the discussion-to-slack.yml workflow was removed. Users should remove the discussion-to-slack.yml workflow if using a fork or derivative of this repository. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/gluestack/gluestack-ui/security/advisories/GHSA-432r-9455-7f9x - https://github.com/gluestack/gluestack-ui/commit/e6b427150b35e97a089ea10409de8c5c52f8a7b9
CVE ID: CVE-2025-53105 State: PUBLISHED Published: 2025-08-27T14:40:36.061Z Last Updated: 2025-08-27T14:53:44.518Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: glpi-project Products: glpi Problem Types: CWE-269 Description: GLPI, which stands for Gestionnaire Libre de Parc Informatique, is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 10.0.0 to before 10.0.19, a connected user without administration rights can change the rules execution order. This issue has been patched in version 10.0.19. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:
This issue has been patched in version 10.0.19. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-334r-2682-95wc - https://github.com/glpi-project/glpi/releases/tag/10.0.19
CVE ID: CVE-2025-53106 State: PUBLISHED Published: 2025-07-02T13:28:08.825Z Last Updated: 2025-07-02T20:22:11.030Z Vendors: Graylog2 Products: graylog2-server Problem Types: CWE-285 Description: Graylog is a free and open log management platform. In versions 6.2.0 to before 6.2.4 and 6.3.0-alpha.1 to before 6.3.0-rc.2, Graylog users can gain elevated privileges by creating and using API tokens for the local Administrator or any other user for whom the malicious user knows the ID. For the attack to succeed, the attacker needs a user account in Graylog. They can then proceed to issue hand-crafted requests to the Graylog REST API and exploit a weak permission check for token creation. This issu
to issue hand-crafted requests to the Graylog REST API and exploit a weak permission check for token creation. This issue has been patched in versions 6.2.4 and 6.3.0-rc.2. A workaround involves disabling the respective configuration found in System > Configuration > Users > "Allow users to create personal access tokens". Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-3m86-c9x3-vwm9 - https://github.com/Graylog2/graylog2-server/commit/6936bd16a783c2944a3d2f1e83902062520f90e3 - https://github.com/Graylog2/graylog2-server/commit/9215b8f1fd32566c31e6f7447ed864df3590c157
CVE ID: CVE-2025-53107 State: PUBLISHED Published: 2025-07-01T17:55:30.726Z Last Updated: 2025-07-01T18:48:11.222Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: cyanheads Products: git-mcp-server Problem Types: CWE-77 Description: @cyanheads/git-mcp-server is an MCP server designed to interact with Git repositories. Prior to version 2.1.5, there is a command injection vulnerability caused by the unsanitized use of input parameters within a call to child_process.exec, enabling an attacker to inject arbitrary system commands. Successful exploitation can lead to remote code execution under the server process's privileges. The server constructs and executes shel
itation can lead to remote code execution under the server process's privileges. The server constructs and executes shell commands using unvalidated user input directly within command-line strings. This introduces the possibility of shell metacharacter injection (|, >, &&, etc.). An MCP Client can be instructed to execute additional actions for example via indirect prompt injection when asked to read git logs. This issue has been patched in version 2.1.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cyanheads/git-mcp-server/security/advisories/GHSA-3q26-f695-pp76 - https://github.com/cyanheads/git-mcp-server/commit/0dbd6995ccdf76ab770b58013034365b2d06c4
visories/GHSA-3q26-f695-pp76 - https://github.com/cyanheads/git-mcp-server/commit/0dbd6995ccdf76ab770b58013034365b2d06c4d9 - https://github.com/cyanheads/git-mcp-server/releases/tag/v2.1.5
CVE ID: CVE-2025-53108 State: PUBLISHED Published: 2025-07-02T14:45:27.651Z Last Updated: 2025-07-02T16:09:50.634Z Vendors: sysadminsmedia Products: homebox Problem Types: CWE-862 Description: HomeBox is a home inventory and organization system. Prior to 0.20.1, HomeBox contains a missing authorization check in the API endpoints responsible for updating and deleting inventory item attachments. This flaw allows authenticated users to perform unauthorized actions on inventory item attachments that they do not own. This issue could lead to unauthorized data manipulation or loss of critical inventory data. This issue has been patched in version 0.20.1. There are no workarounds, users must upgrad
s of critical inventory data. This issue has been patched in version 0.20.1. There are no workarounds, users must upgrade. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-m6vx-pg9q-vq6m - https://github.com/sysadminsmedia/homebox/commit/e159dd8a0b5d01d7225795bfba5634781181df20
CVE ID: CVE-2025-53109 State: PUBLISHED Published: 2025-07-02T14:30:57.647Z Last Updated: 2025-07-02T14:50:18.562Z Vendors: modelcontextprotocol Products: servers Problem Types: CWE-59 Description: Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). Versions of Filesystem prior to 0.6.4 or 2025.7.01 could allow access to unintended files via symlinks within allowed directories. Users are advised to upgrade to 0.6.4 or 2025.7.01 resolve. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-q66q-fx2p-7w4m - https://github.com/modelcontextprotocol/se
ub.com/modelcontextprotocol/servers/security/advisories/GHSA-q66q-fx2p-7w4m - https://github.com/modelcontextprotocol/servers/commit/d00c60df9d74dba8a3bb13113f8904407cda594f
CVE ID: CVE-2025-53110 State: PUBLISHED Published: 2025-07-02T14:30:39.947Z Last Updated: 2025-07-02T15:13:59.600Z Vendors: modelcontextprotocol Products: servers Problem Types: CWE-22 Description: Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). Versions of Filesystem prior to 0.6.4 or 2025.7.01 could allow access to unintended files in cases where the prefix matches an allowed directory. Users are advised to upgrade to 0.6.4 or 2025.7.01 resolve. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-hc55-p739-j48w - https://github.com/modelcon
- https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-hc55-p739-j48w - https://github.com/modelcontextprotocol/servers/commit/cc99bdabdcad93a58877c5f3ab20e21d4394423d
CVE ID: CVE-2025-53111 State: PUBLISHED Published: 2025-07-30T14:14:25.821Z Last Updated: 2025-07-30T19:29:10.968Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: glpi-project Products: glpi Problem Types: CWE-284, CWE-862 Description: GLPI is a Free Asset and IT Management Software package. In versions 0.80 through 10.0.18, a lack of permission checks can result in unauthorized access to some resources. This is fixed in version 10.0.19. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-p665-mqcr-j96j
CVE ID: CVE-2025-53112 State: PUBLISHED Published: 2025-07-30T14:15:22.000Z Last Updated: 2025-07-30T19:29:35.826Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: glpi-project Products: glpi Problem Types: CWE-284, CWE-862 Description: GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 9.1.0 through 10.0.18, a lack of permission checks can result in unauthorized removal of some specific resources. This is fixed in version 10.0.19. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-rp7
Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-rp7w-6343-3m2r
CVE ID: CVE-2025-53113 State: PUBLISHED Published: 2025-07-30T14:16:36.631Z Last Updated: 2025-07-30T19:30:40.525Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: glpi-project Products: glpi Problem Types: CWE-284, CWE-862 Description: GLPI, which stands for Gestionnaire Libre de Parc Informatique, is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 0.65 through 10.0.18, a technician can use the external links feature to fetch information on items they do not have the right to see. This is fixed in version 10.0.19. Additional Analyst Notes: - CISA ADP Vulnrichment: Re
ey do not have the right to see. This is fixed in version 10.0.19. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-r2mm-6499-4m8j
CVE ID: CVE-2025-53118 State: PUBLISHED Published: 2025-08-25T16:06:03.962Z Last Updated: 2025-08-25T20:32:32.947Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Securden Products: Unified PAM Problem Types: CWE-306 Description: An authentication bypass vulnerability exists which allows an unauthenticated attacker to control administrator backup functions, leading to compromise of passwords, secrets, and application session tokens stored by the Unified PAM. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rapid7.com/blog/post/securden-unified-pam-multiple-critical-vulnerabilities-fixed/
CVE ID: CVE-2025-53119 State: PUBLISHED Published: 2025-08-25T16:09:19.528Z Last Updated: 2025-08-25T20:32:56.975Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Securden Products: Unified PAM Problem Types: CWE-434 Description: An unauthenticated unrestricted file upload vulnerability allows an attacker to upload malicious binaries and scripts to the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rapid7.com/blog/post/securden-unified-pam-multiple-critical-vulnerabilities-fixed/
CVE ID: CVE-2025-53120 State: PUBLISHED Published: 2025-08-25T16:11:38.645Z Last Updated: 2025-08-25T19:01:33.022Z Severity: CRITICAL (CVSS 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: Securden Products: Unified PAM Problem Types: CWE-22 Description: A path traversal vulnerability in unauthenticated upload functionality allows a malicious actor to upload binaries and scripts to the server’s configuration and web root directories, achieving remote code execution on the Unified PAM server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rapid7.com/blog/post/securden-unified-pam-multiple-critical-vulnerabilities-fixed/
CVE ID: CVE-2025-53121 State: PUBLISHED Published: 2025-06-26T18:51:35.158Z Last Updated: 2025-06-26T19:07:31.107Z Vendors: The OpenNMS Group Products: Horizon, Meridian Problem Types: CWE-79 Description: Multiple stored XSS were found on different nodes with unsanitized parameters in OpenMNS Horizon 33.0.8 and versions earlier than 33.1.6 on multiple platforms that allow an attacker to store on database and then inject HTML and/or Javascript on the page. The solution is to upgrade to Horizon 33.1.6, 33.1.7 or Meridian 2024.2.6, 2024.2.7 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should
llation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Fábio Tomé for reporting this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/OpenNMS/opennms - https://github.com/OpenNMS/opennms/pull/7708
CVE ID: CVE-2025-53122 State: PUBLISHED Published: 2025-06-26T19:49:43.682Z Last Updated: 2025-06-26T20:03:46.578Z Vendors: The OpenNMS Group Products: Horizon, Meridian Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in OpenNMS Horizon and Meridian applications allows SQL Injection. Users should upgrade to Meridian 2024.2.6 or newer, or Horizon 33.16 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. Additional Analyst Notes: - CISA ADP Vulnrichment: Referen
orks and should not be directly accessible from the Internet. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/OpenNMS/opennms/pull/7709 - https://docs.opennms.com/meridian/2024/releasenotes/changelog.html#releasenotes-changelog-Meridian-2024.2.6
CVE ID: CVE-2025-53131 State: PUBLISHED Published: 2025-08-12T17:10:10.843Z Last Updated: 2025-11-10T00:12:15.365Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-122 Description: Heap-based buffer overflow in Windows Me
indows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-122 Description: Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53131
CVE ID: CVE-2025-53132 State: PUBLISHED Published: 2025-08-12T17:10:11.377Z Last Updated: 2025-11-10T00:12:15.884Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Wind
indows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-362, CWE-416 Description: Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attack
ng shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53132
CVE ID: CVE-2025-53133 State: PUBLISHED Published: 2025-08-12T17:10:12.025Z Last Updated: 2025-11-10T00:12:16.438Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows Server 2025 (Server Core installation), Windows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-416 Description: Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53133
CVE ID: CVE-2025-53134 State: PUBLISHED Published: 2025-08-12T17:10:12.533Z Last Updated: 2025-11-10T00:12:16.929Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Window
dows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-367, CWE-200 Description: Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allow
shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53134
CVE ID: CVE-2025-53135 State: PUBLISHED Published: 2025-08-12T17:10:13.050Z Last Updated: 2025-11-10T00:12:17.605Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Window
dows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-362 Description: Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DirectX allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53135
CVE ID: CVE-2025-53136 State: PUBLISHED Published: 2025-08-12T17:10:13.644Z Last Updated: 2025-11-10T00:12:18.410Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Wi