Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
-of-bounds read. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310254 - https://vuldb.com/?ctiid.310254 - https://vuldb.com/?submit.578001 - https://github.com/assimp/assimp/issues/6168 - https://github.com/assimp/assimp/issues/6128 - https://github.com/user-attachments/files/20208318/reproducer.zip
CVE ID: CVE-2025-5167 State: PUBLISHED Published: 2025-05-26T03:31:05.586Z Last Updated: 2025-05-28T17:36:59.316Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Open Asset Import Library Products: Assimp Problem Types: CWE-125, CWE-119 Description: A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been declared as problematic. Affected by this vulnerability is the function LWOImporter::GetS0 in the library assimp/code/AssetLib/LWO/LWOLoader.h. The manipulation of the argument out leads to out-of-bounds read. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The project decided to
ck needs to be approached locally. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310255 - https://vuldb.com/?ctiid.310255 - https://vuldb.com/?submit.578002 - https://github.com/assimp/assimp/issues/6169 - https://github.com/assimp/assimp/issues/6128 - https://github.com/user-attachments/files/20208666/reproducer.zip
CVE ID: CVE-2025-5168 State: PUBLISHED Published: 2025-05-26T04:00:10.764Z Last Updated: 2025-05-28T17:36:53.627Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Open Asset Import Library Products: Assimp Problem Types: CWE-125, CWE-119 Description: A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been rated as problematic. Affected by this issue is the function MDLImporter::ImportUVCoordinate_3DGS_MDL345 of the file assimp/code/AssetLib/MDL/MDLLoader.cpp. The manipulation of the argument iIndex leads to out-of-bounds read. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The projec
s read. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310256 - https://vuldb.com/?ctiid.310256 - https://vuldb.com/?submit.578003 - https://github.com/assimp/assimp/issues/6170 - https://github.com/assimp/assimp/issues/6128 - https://github.com/user-attachments/files/20208878/reproducer.zip
CVE ID: CVE-2025-5169 State: PUBLISHED Published: 2025-05-26T04:31:06.070Z Last Updated: 2025-05-28T17:36:48.390Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Open Asset Import Library Products: Assimp Problem Types: CWE-125, CWE-119 Description: A vulnerability classified as problematic has been found in Open Asset Import Library Assimp 5.4.3. This affects the function MDLImporter::InternReadFile_3DGS_MDL345 of the file assimp/code/AssetLib/MDL/MDLLoader.cpp. The manipulation leads to out-of-bounds read. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer b
h this attack. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310257 - https://vuldb.com/?ctiid.310257 - https://vuldb.com/?submit.578004 - https://github.com/assimp/assimp/issues/6171 - https://github.com/assimp/assimp/issues/6128 - https://github.com/user-attachments/files/20208891/reproducer.zip
CVE ID: CVE-2025-5170 State: PUBLISHED Published: 2025-05-26T05:00:10.873Z Last Updated: 2025-05-28T17:36:42.674Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: llisoft Products: MTA Maita Training System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in llisoft MTA Maita Training System 4.5. This vulnerability affects the function AdminShitiListRequestVo of the file com\llisoft\controller\admin\shiti\AdminShitiController.java. The manipulation of the argument stTypeIds leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this
iated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310258 - https://vuldb.com/?ctiid.310258 - https://vuldb.com/?submit.579069 - https://wx.mail.qq.com/s?k=oVXdxVkeZQAlUQwVe2
CVE ID: CVE-2025-5171 State: PUBLISHED Published: 2025-05-26T05:31:06.173Z Last Updated: 2025-05-28T17:36:37.353Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: llisoft Products: MTA Maita Training System Problem Types: CWE-434, CWE-284 Description: A vulnerability, which was classified as critical, has been found in llisoft MTA Maita Training System 4.5. This issue affects the function this.fileService.download of the file com\llisoft\controller\OpenController.java. The manipulation of the argument url leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this discl
remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310259 - https://vuldb.com/?ctiid.310259 - https://vuldb.com/?submit.579088 - https://wx.mail.qq.com/s?k=o3X5wV0ZZH0nuusQdO
CVE ID: CVE-2025-5172 State: PUBLISHED Published: 2025-05-26T06:00:07.891Z Last Updated: 2025-05-28T17:36:32.065Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: n/a Products: Econtrata Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in Econtrata up to 20250516. Affected is an unknown function of the file /valida. The manipulation of the argument usuario leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: Refere
ed early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310260 - https://vuldb.com/?ctiid.310260 - https://vuldb.com/?submit.579248 - https://github.com/yago3008/cves
CVE ID: CVE-2025-5173 State: PUBLISHED Published: 2025-05-26T06:31:05.025Z Last Updated: 2025-05-28T17:36:26.724Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: HumanSignal Products: label-studio-ml-backend Problem Types: CWE-502, CWE-20 Description: A vulnerability has been found in HumanSignal label-studio-ml-backend up to 9fb7f4aa186612806af2becfb621f6ed8d9fdbaf and classified as problematic. Affected by this vulnerability is the function load of the file label-studio-ml-backend/label_studio_ml/examples/yolo/utils/neural_nets.py of the component PT File Handler. The manipulation of the argument path leads to deserialization. An attack has to be approache
component PT File Handler. The manipulation of the argument path leads to deserialization. An attack has to be approached locally. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310261 - https://vuldb.com/?ctiid.310261 - https://vuldb.com/?submit.578126 - https://github.com/HumanSignal/label-studio-ml-backend/issues/765
CVE ID: CVE-2025-5174 State: PUBLISHED Published: 2025-05-26T07:00:12.974Z Last Updated: 2025-05-28T17:36:21.298Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: erdogant Products: pypickle Problem Types: CWE-502, CWE-20 Description: A vulnerability was found in erdogant pypickle up to 1.1.5 and classified as problematic. Affected by this issue is the function load of the file pypickle/pypickle.py. The manipulation leads to deserialization. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The patch is identified as 14b4cae704a0bb4eb6723e23
y be used. Upgrading to version 2.0.0 is able to address this issue. The patch is identified as 14b4cae704a0bb4eb6723e238f25382d847a1917. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310262 - https://vuldb.com/?ctiid.310262 - https://vuldb.com/?submit.579157 - https://github.com/erdogant/pypickle/issues/2 - https://github.com/erdogant/pypickle/issues/2#issuecomment-2889146579 - https://github.com/erdogant/pypickle/commit/14b4cae704a0bb4eb6723e238f25382d847a1917 - https://github.com/erdogant/pypickle/releases/tag/2.0.0
CVE ID: CVE-2025-5175 State: PUBLISHED Published: 2025-05-26T07:31:06.272Z Last Updated: 2025-05-28T17:36:15.929Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: erdogant Products: pypickle Problem Types: CWE-285, CWE-266 Description: A vulnerability was found in erdogant pypickle up to 1.1.5. It has been classified as critical. This affects the function Save of the file pypickle/pypickle.py. The manipulation leads to improper authorization. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The patch is named 14b4cae704a0bb4eb6723e238f25382d847a1917. It
grading to version 2.0.0 is able to address this issue. The patch is named 14b4cae704a0bb4eb6723e238f25382d847a1917. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310263 - https://vuldb.com/?ctiid.310263 - https://vuldb.com/?submit.579824 - https://github.com/erdogant/pypickle/issues/3 - https://github.com/erdogant/pypickle/issues/3#issuecomment-2888589652 - https://github.com/erdogant/pypickle/issues/3#issue-3070689116 - https://github.com/erdogant/pypickle/commit/14b4cae704a0bb4eb6723e238f25382d847a1917 - https://github.com/erdogant/pypickle/releases/tag/2.0.0
CVE ID: CVE-2025-5176 State: PUBLISHED Published: 2025-05-26T08:00:10.708Z Last Updated: 2025-05-28T17:36:10.001Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Realce Tecnologia Products: Queue Ticket Kiosk Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Realce Tecnologia Queue Ticket Kiosk up to 20250517. It has been declared as critical. This vulnerability affects unknown code of the file /adm/index.php of the component Admin Login Page. The manipulation of the argument Usuário leads to sql injection. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - C
tely. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310264 - https://vuldb.com/?ctiid.310264 - https://vuldb.com/?submit.579849
CVE ID: CVE-2025-5177 State: PUBLISHED Published: 2025-05-26T08:31:03.490Z Last Updated: 2025-05-28T17:36:04.549Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: Realce Tecnologia Products: Queue Ticket Kiosk Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in Realce Tecnologia Queue Ticket Kiosk up to 20250517. It has been rated as problematic. This issue affects some unknown processing of the file /adm/index.php of the component Admin Login Page. The manipulation of the argument Usuário leads to cross site scripting. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst No
ted remotely. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310265 - https://vuldb.com/?ctiid.310265 - https://vuldb.com/?submit.579850
CVE ID: CVE-2025-5178 State: PUBLISHED Published: 2025-05-26T09:00:08.875Z Last Updated: 2025-05-27T13:30:41.486Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Realce Tecnologia Products: Queue Ticket Kiosk Problem Types: CWE-434, CWE-284 Description: A vulnerability classified as critical has been found in Realce Tecnologia Queue Ticket Kiosk up to 20250517. Affected is an unknown function of the file /adm/ajax.php of the component Image File Handler. The manipulation of the argument files[] leads to unrestricted upload. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes:
emotely. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310266 - https://vuldb.com/?ctiid.310266 - https://vuldb.com/?submit.579851
CVE ID: CVE-2025-5179 State: PUBLISHED Published: 2025-05-26T09:31:04.315Z Last Updated: 2025-05-28T17:35:56.280Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: Realce Tecnologia Products: Queue Ticket Kiosk Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic was found in Realce Tecnologia Queue Ticket Kiosk up to 20250517. Affected by this vulnerability is an unknown functionality of the file /adm/index.php of the component Cadastro de Administrador Page. The manipulation of the argument Name/Usuário leads to cross site scripting. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in an
ing. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310267 - https://vuldb.com/?ctiid.310267 - https://vuldb.com/?submit.579852
CVE ID: CVE-2025-5180 State: PUBLISHED Published: 2025-05-26T10:00:07.551Z Last Updated: 2025-05-28T17:35:50.771Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Wondershare Products: Filmora Problem Types: CWE-427, CWE-426 Description: A vulnerability, which was classified as critical, has been found in Wondershare Filmora 14.5.16. Affected by this issue is some unknown functionality in the library CRYPTBASE.dll of the file NFWCHK.exe of the component Installer. The manipulation leads to uncontrolled search path. Attacking locally is a requirement. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclo
ment. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310268 - https://vuldb.com/?ctiid.310268 - https://vuldb.com/?submit.580226 - https://gist.github.com/shellkraft/aa66561e984e83052bd080f195a3ec80
CVE ID: CVE-2025-5181 State: PUBLISHED Published: 2025-05-26T10:31:04.786Z Last Updated: 2025-05-28T17:35:45.146Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Summer Pearl Group Products: Vacation Rental Management Platform Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, was found in Summer Pearl Group Vacation Rental Management Platform up to 1.0.1. This affects an unknown part of the file /spgpm/updateListing. The manipulation of the argument spgLsTitle leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.2 is able t
the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.2 is able to address this issue. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310269 - https://vuldb.com/?ctiid.310269 - https://vuldb.com/?submit.581383 - https://github.com/Stolichnayer/Summer-Pearl-Group-IDOR-XSS - https://github.com/Stolichnayer/Summer-Pearl-Group-IDOR-XSS?tab=readme-ov-file#4%EF%B8%8F%E2%83%A3-inject-xss - https://summerpearlgroup.gr/spgpm/releases - https://www.youtube.com/watch?v=0wwuatTa6sU
CVE ID: CVE-2025-5182 State: PUBLISHED Published: 2025-05-26T11:00:08.192Z Last Updated: 2025-05-28T17:35:39.456Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Summer Pearl Group Products: Vacation Rental Management Platform Problem Types: CWE-639, CWE-285 Description: A vulnerability has been found in Summer Pearl Group Vacation Rental Management Platform up to 1.0.1 and classified as critical. This vulnerability affects unknown code of the component Listing Handler. The manipulation leads to authorization bypass. The attack can be initiated remotely. Upgrading to version 1.0.2 is able to address this issue. It is recommended to upgrade the affected compo
ated remotely. Upgrading to version 1.0.2 is able to address this issue. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310270 - https://vuldb.com/?ctiid.310270 - https://github.com/Stolichnayer/Summer-Pearl-Group-IDOR-XSS - https://summerpearlgroup.gr/spgpm/releases - https://www.youtube.com/watch?v=0wwuatTa6sU
CVE ID: CVE-2025-5183 State: PUBLISHED Published: 2025-05-26T11:31:04.460Z Last Updated: 2025-05-28T17:35:33.960Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Summer Pearl Group Products: Vacation Rental Management Platform Problem Types: CWE-601 Description: A vulnerability was found in Summer Pearl Group Vacation Rental Management Platform up to 1.0.1 and classified as problematic. This issue affects some unknown processing of the component Header Handler. The manipulation of the argument Host leads to open redirect. The attack may be initiated remotely. Upgrading to version 1.0.2 is able to address this issue. It is recommended to upgrade the affected component. Additional A
rading to version 1.0.2 is able to address this issue. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310271 - https://vuldb.com/?ctiid.310271 - https://summerpearlgroup.gr/spgpm/releases
CVE ID: CVE-2025-5184 State: PUBLISHED Published: 2025-05-26T12:00:11.846Z Last Updated: 2025-05-28T17:35:28.281Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Summer Pearl Group Products: Vacation Rental Management Platform Problem Types: CWE-200, CWE-284 Description: A vulnerability was found in Summer Pearl Group Vacation Rental Management Platform up to 1.0.1. It has been classified as problematic. Affected is an unknown function of the component HTTP Response Header Handler. The manipulation leads to information disclosure. It is possible to launch the attack remotely. Upgrading to version 1.0.2 is able to address this issue. It is recommended to upgr
sible to launch the attack remotely. Upgrading to version 1.0.2 is able to address this issue. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310272 - https://vuldb.com/?ctiid.310272 - https://summerpearlgroup.gr/spgpm/releases
CVE ID: CVE-2025-5185 State: PUBLISHED Published: 2025-05-26T12:31:04.270Z Last Updated: 2025-05-27T13:26:46.879Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: Summer Pearl Group Products: Vacation Rental Management Platform Problem Types: CWE-352, CWE-862 Description: A vulnerability was found in Summer Pearl Group Vacation Rental Management Platform up to 1.0.1. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross-site request forgery. The attack can be launched remotely. Upgrading to version 1.0.2 is able to address this issue. It is recommended to upgrade the affected component. Additional Analyst No
version 1.0.2 is able to address this issue. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310273 - https://vuldb.com/?ctiid.310273 - https://summerpearlgroup.gr/spgpm/releases
CVE ID: CVE-2025-5186 State: PUBLISHED Published: 2025-05-26T13:00:08.937Z Last Updated: 2025-05-28T17:35:22.492Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: thinkgem Products: JeeSite Problem Types: CWE-918 Description: A vulnerability was found in thinkgem JeeSite up to 5.11.1. It has been rated as critical. Affected by this issue is the function ResourceLoader.getResource of the file /cms/fileTemplate/form of the component URI Scheme Handler. The manipulation of the argument Name leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Referen
The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310274 - https://vuldb.com/?ctiid.310274 - https://vuldb.com/?submit.581704 - https://github.com/xiaoyangsec/JeeSite_SSRF/blob/main/jeesite5-ssrf-file-read.md
CVE ID: CVE-2025-5187 State: PUBLISHED Published: 2025-08-27T16:20:56.778Z Last Updated: 2025-08-28T03:55:26.841Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L) Vendors: Kubernetes Products: Kubernetes Problem Types: CWE-863 Description: A vulnerability exists in the NodeRestriction admission controller in Kubernetes clusters where node users can delete their corresponding node object by patching themselves with an OwnerReference to a cluster-scoped resource. If the OwnerReference resource does not exist or is subsequently deleted, the given node object will be deleted via garbage collection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://g
bject will be deleted via garbage collection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/kubernetes/kubernetes/issues/133471 - https://groups.google.com/g/kubernetes-security-announce/c/znSNY7XCztE
CVE ID: CVE-2025-5190 State: PUBLISHED Published: 2025-05-30T11:15:10.217Z Last Updated: 2025-05-30T12:16:17.522Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: sorich87 Products: Browse As Problem Types: CWE-288 Description: The Browse As plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 0.2. This is due to incorrect authentication checking in the 'IS_BA_Browse_As::notice' function with the 'is_ba_original_user_COOKIEHASH' cookie value. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to log in as any existing user on the site, such as an administrator, if they have a