Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
nd-line). Therefore, to exploit this vulnerability, the malicious payload would have to be provided by an attacker and trusted by an administrator (who would trigger the import). The fix is included in DSpace 7.6.4, 8.2 and 9.1. For those who cannot upgrade immediately, it is possible to manually patch the DSpace backend. (No changes are necessary to the frontend.) A pull request exists which can be used to patch systems running DSpace 7.6.x, 8.x or 9.0. Although it is not possible to fully protect the system via workarounds, one may can apply a best practice. Administrators must carefully inspect any SAF archives (they did not construct themselves) before importing, paying close attention t
s must carefully inspect any SAF archives (they did not construct themselves) before importing, paying close attention to the `contents` file to validate it does not reference files outside of the SAF archives. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/DSpace/DSpace/security/advisories/GHSA-vhvx-8xgc-99wf - https://github.com/DSpace/DSpace/pull/11036 - https://github.com/DSpace/DSpace/pull/11036.patch - https://github.com/DSpace/DSpace/pull/11037 - https://github.com/DSpace/DSpace/pull/11037.patch - https://github.com/DSpace/DSpace/pull/11038 - https://github.com/DSpace/DSpace/pull/11038.patch
CVE ID: CVE-2025-53623 State: PUBLISHED Published: 2025-07-14T19:56:54.995Z Last Updated: 2025-07-15T19:51:01.752Z Vendors: Shopify Products: job-iteration Problem Types: CWE-78 Description: The Job Iteration API is an an extension for ActiveJob that make jobs interruptible and resumable Versions prior to 1.11.0 have an arbitrary code execution vulnerability in the `CsvEnumerator` class. This vulnerability can be exploited by an attacker to execute arbitrary commands on the system where the application is running, potentially leading to unauthorized access, data leakage, or complete system compromise. The issue is fixed in versions `1.11.0` and above. Users can mitigate the risk by avoiding
complete system compromise. The issue is fixed in versions `1.11.0` and above. Users can mitigate the risk by avoiding the use of untrusted input in the `CsvEnumerator` class and ensuring that any file paths are properly sanitized and validated before being passed to the class methods. Users should avoid using the `count_of_rows_in_file` method with untrusted CSV filenames. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Shopify/job-iteration/security/advisories/GHSA-6qjf-g333-pv38 - https://github.com/Shopify/job-iteration/pull/595 - https://github.com/Shopify/job-iteration/commit/1a7adfdd041105a5e45e774cadc6b973a292ba55 - https://github.com/Shopify/job-
tps://github.com/Shopify/job-iteration/commit/1a7adfdd041105a5e45e774cadc6b973a292ba55 - https://github.com/Shopify/job-iteration/releases/tag/v1.11.0
CVE ID: CVE-2025-53624 State: PUBLISHED Published: 2025-07-09T21:08:14.595Z Last Updated: 2025-07-10T15:18:11.559Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: webbertakken Products: docusaurus-plugin-content-gists Problem Types: CWE-200 Description: The Docusaurus gists plugin adds a page to your Docusaurus instance, displaying all public gists of a GitHub user. docusaurus-plugin-content-gists versions prior to 4.0.0 are vulnerable to exposing GitHub Personal Access Tokens in production build artifacts when passed through plugin configuration options. The token, intended for build-time API access only, is inadvertently included in client-side JavaScript
uration options. The token, intended for build-time API access only, is inadvertently included in client-side JavaScript bundles, making it accessible to anyone who can view the website's source code. This vulnerability is fixed in 4.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/webbertakken/docusaurus-plugin-content-gists/security/advisories/GHSA-qf34-qpr4-5pph - https://github.com/webbertakken/docusaurus-plugin-content-gists/commit/8d4230b82412edb215ddfa9e609d178510a5fe31
CVE ID: CVE-2025-53625 State: PUBLISHED Published: 2025-07-10T18:31:22.996Z Last Updated: 2025-07-10T19:01:40.977Z Vendors: Universal-Omega Products: DynamicPageList3 Problem Types: CWE-359 Description: The DynamicPageList3 extension is a reporting tool for MediaWiki, listing category members and intersections with various formats and details. Several #dpl parameters can leak usernames that have been hidden using revision deletion, suppression, or the hideuser block flag. The vulnerability is fixed in 3.6.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Universal-Omega/DynamicPageList3/security/advisories/GHSA-7pgw-q3qp-6pgq - https://github.com/Universa
ttps://github.com/Universal-Omega/DynamicPageList3/security/advisories/GHSA-7pgw-q3qp-6pgq - https://github.com/Universal-Omega/DynamicPageList3/commit/a3dae0c89fb4214390c29ceffa23bbe2099986d6
CVE ID: CVE-2025-53626 State: PUBLISHED Published: 2025-07-10T18:49:22.602Z Last Updated: 2025-07-10T19:08:40.237Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: pdfme Products: pdfme Problem Types: CWE-94, CWE-1321, CWE-79 Description: pdfme is a TypeScript-based PDF generator and React-based UI. The expression evaluation feature in pdfme 5.2.0 to 5.4.0 contains critical vulnerabilities allowing sandbox escape leading to XSS and prototype pollution attacks. This vulnerability is fixed in 5.4.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pdfme/pdfme/security/advisories/GHSA-54xv-94qv-2gfg - https://github.com/pdfme/p
hment: References: - https://github.com/pdfme/pdfme/security/advisories/GHSA-54xv-94qv-2gfg - https://github.com/pdfme/pdfme/commit/0dd54739acff2c249ed68c001a896bee38f0fd85
CVE ID: CVE-2025-53628 State: PUBLISHED Published: 2025-07-10T19:45:54.960Z Last Updated: 2025-07-10T20:26:28.864Z Vendors: yhirose Products: cpp-httplib Problem Types: CWE-835, CWE-770 Description: cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.20.1, cpp-httplib does not have a limit for a unique line, permitting an attacker to explore this to allocate memory arbitrarily. This vulnerability is fixed in 0.20.1. NOTE: This vulnerability is related to CVE-2025-53629. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-j6p8-779x-p5pw - https://github.com/yhirose/cpp-httplib
https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-j6p8-779x-p5pw - https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-qjmq-h3cc-qv6w - https://github.com/yhirose/cpp-httplib/commit/7b752106ac42bd5b907793950d9125a0972c8e8e
CVE ID: CVE-2025-53629 State: PUBLISHED Published: 2025-07-10T19:46:01.872Z Last Updated: 2025-07-10T20:19:21.578Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: yhirose Products: cpp-httplib Problem Types: CWE-770 Description: cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.23.0, incoming requests using Transfer-Encoding: chunked in the header can allocate memory arbitrarily in the server, potentially leading to its exhaustion. This vulnerability is fixed in 0.23.0. NOTE: This vulnerability is related to CVE-2025-53628. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/yhirose/cpp
lated to CVE-2025-53628. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-qjmq-h3cc-qv6w - https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-j6p8-779x-p5pw - https://github.com/yhirose/cpp-httplib/commit/17ba303889b8d4d719be3879a70639ab653efb99
CVE ID: CVE-2025-53630 State: PUBLISHED Published: 2025-07-10T19:32:45.296Z Last Updated: 2025-07-10T20:31:07.240Z Vendors: ggml-org Products: llama.cpp Problem Types: CWE-122, CWE-680 Description: llama.cpp is an inference of several LLM models in C/C++. Integer Overflow in the gguf_init_from_file_impl function in ggml/src/gguf.cpp can lead to Heap Out-of-Bounds Read/Write. This vulnerability is fixed in commit 26a48ad699d50b6268900062661bd22f3e792579. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ggml-org/llama.cpp/security/advisories/GHSA-vgg9-87g3-85w8 - https://github.com/ggml-org/llama.cpp/commit/26a48ad699d50b6268900062661bd22f3e792579
CVE ID: CVE-2025-53631 State: PUBLISHED Published: 2025-08-14T15:26:32.758Z Last Updated: 2025-08-14T15:43:29.962Z Vendors: DogukanUrker Products: flaskBlog Problem Types: CWE-79 Description: flaskBlog is a blog app built with Flask. In versions 2.8.1 and prior, improper sanitization of postContent when submitting POST requests to /createpost leads to arbitrary JavaScript execution (XSS) on all pages the post is reflected on including /, /post/[ID], /admin/posts, and /user/[ID] of the user that made the post. At time of publication, there are no public patches available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/DogukanUrker/flaskBlog/security/adviso
ditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/DogukanUrker/flaskBlog/security/advisories/GHSA-cj43-h8qf-7rw7
CVE ID: CVE-2025-53632 State: PUBLISHED Published: 2025-07-10T19:36:47.463Z Last Updated: 2025-07-10T20:31:48.462Z Vendors: ctfer-io Products: chall-manager Problem Types: CWE-22 Description: Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. When decoding a scenario (i.e. a zip archive), the path of the file to write is not checked, potentially leading to zip slips. Exploitation does not require authentication nor authorization, so anyone can exploit it. It should nonetheless not be exploitable as it is highly recommended to bury Chall-Manager deep within the infrastructure due to its large capabilities, so no users could reach the system. Patch has
all-Manager deep within the infrastructure due to its large capabilities, so no users could reach the system. Patch has been implemented by commit 47d188f and shipped in v0.1.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ctfer-io/chall-manager/security/advisories/GHSA-3gv2-v3jx-r9fh - https://github.com/ctfer-io/chall-manager/commit/47d188fda5e3f86285e820f12ad9fb6f9930662c - https://github.com/ctfer-io/chall-manager/releases/tag/v0.1.4
CVE ID: CVE-2025-53633 State: PUBLISHED Published: 2025-07-10T19:38:19.564Z Last Updated: 2025-07-10T20:02:40.218Z Vendors: ctfer-io Products: chall-manager Problem Types: CWE-405 Description: Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. When decoding a scenario (i.e. a zip archive), the size of the decoded content is not checked, potentially leading to zip bombs decompression. Exploitation does not require authentication nor authorization, so anyone can exploit it. It should nonetheless not be exploitable as it is highly recommended to bury Chall-Manager deep within the infrastructure due to its large capabilities, so no users could reach the s
mended to bury Chall-Manager deep within the infrastructure due to its large capabilities, so no users could reach the system. Patch has been implemented by commit 14042aa and shipped in v0.1.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ctfer-io/chall-manager/security/advisories/GHSA-r7fm-3pqm-ww5w - https://github.com/ctfer-io/chall-manager/commit/14042aa66a577caee777e10fe09adcf2587d20dd - https://github.com/ctfer-io/chall-manager/releases/tag/v0.1.4
CVE ID: CVE-2025-53634 State: PUBLISHED Published: 2025-07-10T19:39:57.816Z Last Updated: 2025-07-10T20:26:58.612Z Vendors: ctfer-io Products: chall-manager Problem Types: CWE-770 Description: Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. The HTTP Gateway processes headers, but with no timeout set. With a slow loris attack, an attacker could cause Denial of Service (DoS). Exploitation does not require authentication nor authorization, so anyone can exploit it. It should nonetheless not be exploitable as it is highly recommended to bury Chall-Manager deep within the infrastructure due to its large capabilities, so no users could reach the system.
to bury Chall-Manager deep within the infrastructure due to its large capabilities, so no users could reach the system. Patch has been implemented by commit 1385bd8 and shipped in v0.1.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ctfer-io/chall-manager/security/advisories/GHSA-ggmv-j932-q89q - https://github.com/ctfer-io/chall-manager/commit/1385bd869142651146cd0b123085f91cec698636 - https://github.com/ctfer-io/chall-manager/releases/tag/v0.1.4
CVE ID: CVE-2025-53636 State: PUBLISHED Published: 2025-07-11T21:20:14.261Z Last Updated: 2025-07-14T20:13:13.885Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: OSC Products: ondemand Problem Types: CWE-400, CWE-779 Description: Open OnDemand is an open-source HPC portal. Users can flood logs by interacting with the shell app and generating many errors. Users who flood logs can create very large log files causing a Denial of Service (DoS) to the ondemand system. This vulnerability is fixed in 3.1.14 and 4.0.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/OSC/ondemand/security/advisories/GHSA-x5xv-fw37-v524 - https://g
CISA ADP Vulnrichment: References: - https://github.com/OSC/ondemand/security/advisories/GHSA-x5xv-fw37-v524 - https://github.com/OSC/ondemand/commit/40800d68cd019c5f1c48b2deafebba6dff4abee2 - https://github.com/OSC/ondemand/commit/96f29b995e1add7562516614e4dc8d961987e8b4
CVE ID: CVE-2025-53637 State: PUBLISHED Published: 2025-07-10T21:31:44.006Z Last Updated: 2025-07-11T16:50:38.545Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N) Vendors: meshtastic Products: firmware Problem Types: CWE-78 Description: Meshtastic is an open source mesh networking solution. The main_matrix.yml GitHub Action is triggered by the pull_request_target event, which has extensive permissions, and can be initiated by an attacker who forked the repository and created a pull request. In the shell code execution part, user-controlled input is interpolated unsafely into the code. If this were to be exploited, attackers could inject unauthorized code into the rep
interpolated unsafely into the code. If this were to be exploited, attackers could inject unauthorized code into the repository. This vulnerability is fixed in 2.6.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/meshtastic/firmware/security/advisories/GHSA-6mwm-v2vv-pp96 - https://github.com/meshtastic/firmware/blob/3fd47d9713e7d1b6866c48cf218e2435741651a2/.github/workflows/main_matrix.yml#L34-L41
CVE ID: CVE-2025-53638 State: PUBLISHED Published: 2025-07-17T17:54:40.666Z Last Updated: 2025-07-17T20:22:29.683Z Vendors: Vectorized Products: solady Problem Types: CWE-754 Description: Solady is software that provides Solidity snippets with APIs. Starting in version 0.0.125 and prior to version 0.1.24, when an account is deployed via a proxy, using regular Solidity to call its initialization function may result in a silent failure, if the initialization function does not return a `bool` or some other return data. This is because regular Solidity uses `extcodesize(proxy)` to decide if call succeeds. This is insufficient in the case when the proxy points to an empty implementation. Users sh
to decide if call succeeds. This is insufficient in the case when the proxy points to an empty implementation. Users should upgrade to Solady v0.1.24 or later to receive a patch. Deploy any affected implementations and their factories on new EVM chains as soon as possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Vectorized/solady/security/advisories/GHSA-8xvx-4mvg-m9v8 - https://github.com/Vectorized/solady/releases/tag/v0.1.24
CVE ID: CVE-2025-53639 State: PUBLISHED Published: 2025-07-14T20:04:29.479Z Last Updated: 2025-07-15T19:50:55.001Z Vendors: metersphere Products: metersphere Problem Types: CWE-89 Description: MeterSphere is an open source continuous testing platform. Prior to version 3.6.5-lts, the sortField parameter in certain API endpoints is not properly validated or sanitized. An attacker can supply crafted input to inject and execute arbitrary SQL statements through the sorting functionality. This could result in modification or deletion of database contents, with a potential full compromise of the application’s database integrity and availability. Version 3.6.5-lts fixes the issue. Additional Analyst
mpromise of the application’s database integrity and availability. Version 3.6.5-lts fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/metersphere/metersphere/security/advisories/GHSA-vcm3-5w3f-9f45
CVE ID: CVE-2025-53640 State: PUBLISHED Published: 2025-07-14T20:14:27.041Z Last Updated: 2025-07-22T15:29:26.173Z Vendors: indico Products: indico Problem Types: CWE-200, CWE-639, CWE-862 Description: Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Starting in version 2.2 and prior to version 3.3.7, an endpoint used to display details of users listed in certain fields (such as ACLs) could be misused to dump basic user details (such as name, affiliation and email) in bulk. Version 3.3.7 fixes the issue. Owners of instances that allow everyone to create a user account, who wish to truly restrict access to these user details, sho
of instances that allow everyone to create a user account, who wish to truly restrict access to these user details, should consider restricting user search to managers. As a workaround, it is possible to restrict access to the affected endpoints (e.g. in the webserver config), but doing so would break certain form fields which could no longer show the details of the users listed in those fields, so upgrading instead is highly recommended. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/indico/indico/security/advisories/GHSA-q28v-664f-q6wj - https://docs.getindico.io/en/stable/config/settings/#ALLOW_PUBLIC_USER_SEARCH - https://doc
sories/GHSA-q28v-664f-q6wj - https://docs.getindico.io/en/stable/config/settings/#ALLOW_PUBLIC_USER_SEARCH - https://docs.getindico.io/en/stable/installation/upgrade - https://github.com/indico/indico/releases/tag/v3.3.7
CVE ID: CVE-2025-53641 State: PUBLISHED Published: 2025-07-11T17:28:20.001Z Last Updated: 2025-07-11T17:56:30.605Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: gitroomhq Products: postiz-app Problem Types: CWE-918 Description: Postiz is an AI social media scheduling tool. From 1.45.1 to 1.62.3, the Postiz frontend application allows an attacker to inject arbitrary HTTP headers into the middleware pipeline. This flaw enables a server-side request forgery (SSRF) condition, which can be exploited to initiate unauthorized outbound requests from the server hosting the Postiz application. This vulnerability is fixed in 1.62.3. Additional Analyst Notes: - CISA ADP
m the server hosting the Postiz application. This vulnerability is fixed in 1.62.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-48c8-25jq-m55f - https://github.com/gitroomhq/postiz-app/commit/65eca0e2f22155b43c78724ca43617ee52e42753
CVE ID: CVE-2025-53642 State: PUBLISHED Published: 2025-07-11T17:33:05.861Z Last Updated: 2025-07-14T14:17:55.724Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: haxtheweb Products: issues Problem Types: CWE-613 Description: haxcms-nodejs and haxcms-php are backends for HAXcms. The logout function within the application does not terminate a user's session or clear their cookies. Additionally, the application issues a refresh token when logging out. This vulnerability is fixed in 11.0.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/haxtheweb/issues/security/advisories/GHSA-g4f5-5w5j-p5jg
CVE ID: CVE-2025-53643 State: PUBLISHED Published: 2025-07-14T20:17:18.247Z Last Updated: 2025-07-15T19:50:40.717Z Vendors: aio-libs Products: aiohttp Problem Types: CWE-444 Description: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.12.14, the Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.12.14 contains a patch for this
e a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.12.14 contains a patch for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9548-qrrj-x5pj - https://github.com/aio-libs/aiohttp/commit/e8d774f635dc6d1cd3174d0e38891da5de0e2b6a
CVE ID: CVE-2025-53644 State: PUBLISHED Published: 2025-07-17T17:58:26.493Z Last Updated: 2025-09-26T21:56:54.102Z Vendors: opencv Products: opencv Problem Types: CWE-457 Description: OpenCV is an Open Source Computer Vision Library. Versions 4.10.0 and 4.11.0 have an uninitialized pointer variable on stack that may lead to arbitrary heap buffer write when reading crafted JPEG images. Version 4.12.0 fixes the vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2025-057_OpenCV/ - https://github.com/opencv/opencv/issues/27271 - https://github.com/opencv/opencv/commit/a39db41390de546d18962ee1278bd6dbb715f466 - https://gi
encv/opencv/issues/27271 - https://github.com/opencv/opencv/commit/a39db41390de546d18962ee1278bd6dbb715f466 - https://github.com/opencv/opencv/releases/tag/4.12.0
CVE ID: CVE-2025-53645 State: PUBLISHED Published: 2025-07-09T00:00:00.000Z Last Updated: 2025-07-22T15:38:23.411Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zimbra Collaboration (ZCS) before 9.0.0 Patch 46, 10.0.x before 10.0.15, and 10.1.x before 10.1.9 is vulnerable to a denial of service condition due to improper handling of excessive, comma-separated path segments in the Admin Console. An unauthenticated remote attacker can send specially crafted GET requests that trigger redundant processing and inflated responses. This leads to uncontrolled resource consumption, resulting in denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wik
onsumption, resulting in denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories - https://wiki.zimbra.com/wiki/Security_Center - https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy - https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.9#Security_Fixes - https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.15#Security_Fixes - https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P46#Security_Fixes
CVE ID: CVE-2025-53649 State: PUBLISHED Published: 2025-07-29T04:41:35.880Z Last Updated: 2025-07-29T13:58:10.661Z Severity: MEDIUM (CVSS 5.1 CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: SwitchBot Products: SwitchBot App for iOS/Android Problem Types: CWE-532 Description: "SwitchBot" App for iOS/Android contains an insertion of sensitive information into log file vulnerability in versions V6.24 through V9.12. If this vulnerability is exploited, sensitive user information may be exposed to an attacker who has access to the application logs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.switchbot.jp/pages/switchbot-app-vulnerability-fix202507 - https://