Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-26476 State: PUBLISHED Published: 2025-08-04T18:44:50.332Z Last Updated: 2025-08-07T03:55:23.355Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: ECS, ObjectScale Problem Types: CWE-321 Description: Dell ECS versions prior to 3.8.1.5/ ObjectScale version 4.0.0.0, contain a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000339134/dsa-2025-154-security-update-for-dell-ecs-and-objectscale-use-of-hard-c
tps://www.dell.com/support/kbdoc/en-us/000339134/dsa-2025-154-security-update-for-dell-ecs-and-objectscale-use-of-hard-coded-ssh-cryptographic-key-vulnerability
CVE ID: CVE-2025-26477 State: PUBLISHED Published: 2025-04-17T11:45:19.319Z Last Updated: 2025-04-22T03:55:17.606Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Dell Products: ECS Problem Types: CWE-20 Description: Dell ECS version 3.8.1.4 and prior contain an Improper Input Validation vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-in/000300068/dsa-2025-097-security-update-for-dell-objectscale-4-0-multiple-vulnerabilities
CVE ID: CVE-2025-26478 State: PUBLISHED Published: 2025-04-17T11:37:44.401Z Last Updated: 2025-04-17T13:15:12.492Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Dell Products: ECS Problem Types: CWE-295 Description: Dell ECS version 3.8.1.4 and prior contain an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-in/000300068/dsa-2025-097-security-update-for-dell-objectscale-4-0-multiple-vulnerabilities
CVE ID: CVE-2025-26479 State: PUBLISHED Published: 2025-04-10T02:32:40.194Z Last Updated: 2025-04-10T14:25:19.915Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Dell Products: PowerScale OneFS Problem Types: CWE-787 Description: Dell PowerScale OneFS, versions 9.4.0.0 through 9.10.0.0, contains an out-of-bounds write vulnerability. An attacker could potentially exploit this vulnerability in NFS workflows, leading to data integrity issues. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000300860/dsa-2025-119-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities
CVE ID: CVE-2025-26480 State: PUBLISHED Published: 2025-04-10T02:22:08.401Z Last Updated: 2025-04-10T14:27:18.677Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Dell Products: PowerScale OneFS Problem Types: CWE-770 Description: Dell PowerScale OneFS, versions 9.5.0.0 through 9.10.0.0, contains an uncontrolled resource consumption vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000300860/dsa-2025-119-security-update-for-dell-powerscale-onefs-for-multiple-security-
www.dell.com/support/kbdoc/en-us/000300860/dsa-2025-119-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities
CVE ID: CVE-2025-26481 State: PUBLISHED Published: 2025-05-15T19:03:18.635Z Last Updated: 2025-05-16T18:26:16.650Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Dell Products: PowerScale OneFS Problem Types: CWE-400 Description: Dell PowerScale OneFS, versions 9.4.0.0 through 9.9.0.0, contains an uncontrolled resource consumption vulnerability. A remote unprivileged attacker could potentially exploit this vulnerability, leading to denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000256645/dsa-2024-453-security-update-for-dell-powerscale-onefs-multiple-security-vulnerabilities
CVE ID: CVE-2025-26482 State: PUBLISHED Published: 2025-09-25T21:11:43.372Z Last Updated: 2025-09-26T17:39:20.743Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Dell Products: PowerEdge R770, PowerEdge R670, PowerEdge R570, PowerEdge R470, PowerEdge R6715, PowerEdge R7715, PowerEdge R6725, PowerEdge R7725, PowerEdge R660, PowerEdge R760, PowerEdge C6620, PowerEdge MX760c, PowerEdge R860, PowerEdge R960, PowerEdge HS5610, PowerEdge HS5620, PowerEdge R660xs, PowerEdge R760xs, PowerEdge R760xd2, PowerEdge T560, PowerEdge R760xa, PowerEdge XE9680, PowerEdge XE9680L, PowerEdge XR5610, PowerEdge XR8610t, PowerEdge XR8620t, PowerEdge XR7620, PowerEdge XE8640, Pow
9680, PowerEdge XE9680L, PowerEdge XR5610, PowerEdge XR8610t, PowerEdge XR8620t, PowerEdge XR7620, PowerEdge XE8640, PowerEdge XE9640, PowerEdge T160, PowerEdge T360, PowerEdge R260, PowerEdge R360, PowerEdge R650, PowerEdge R750, PowerEdge R750XA, PowerEdge C6520, PowerEdge MX750C, PowerEdge R550, PowerEdge R450, PowerEdge R650XS, PowerEdge R750XS, PowerEdge T550, PowerEdge XR11, PowerEdge XR12, PowerEdge XR4510c, PowerEdge XR4520c, PowerEdge T150, PowerEdge T350, PowerEdge R250, PowerEdge R350, PowerEdge R740, PowerEdge R740XD, PowerEdge R640, PowerEdge R940, PowerEdge R540, PowerEdge R440, PowerEdge T440, PowerEdge XR2, PowerEdge R740XD2, PowerEdge R840, PowerEdge R940XA, PowerEdge T640,
40, PowerEdge R440, PowerEdge T440, PowerEdge XR2, PowerEdge R740XD2, PowerEdge R840, PowerEdge R940XA, PowerEdge T640, PowerEdge C6420, PowerEdge FC640, PowerEdge M640, PowerEdge M640 (for PE VRTX), PowerEdge MX740C, PowerEdge MX840C, PowerEdge C4140, DSS 8440, PowerEdge XE2420, PowerEdge XE7420, PowerEdge XE7440, PowerEdge T140, PowerEdge T340, PowerEdge R240, PowerEdge R340, Dell EMC Storage NX3240, Dell EMC Storage NX3340, Dell EMC NX440, Dell XC Core XC660, Dell XC Core XC760, Dell XC Core XC660xs, Dell XC Core XC760xa, Dell EMC XC Core XC450, Dell EMC XC Core XC650, Dell EMC XC Core XC750, Dell EMC XC Core XC750xa, Dell EMC XC Core XC6520, Dell EMC XC Core 6420 System, Dell EMC XC Core
ell EMC XC Core XC750, Dell EMC XC Core XC750xa, Dell EMC XC Core XC6520, Dell EMC XC Core 6420 System, Dell EMC XC Core XC640 System, Dell EMC XC Core XC740xd System, Dell EMC XC Core XC740xd2, Dell EMC XC Core XC940 System, Dell EMC XC Core XCXR2, PowerEdge R6615, PowerEdge R7615, PowerEdge R6625, PowerEdge R7625, PowerEdge C6615, PowerEdge R6515, PowerEdge R6525, PowerEdge R7515, PowerEdge R7525, PowerEdge C6525, PowerEdge XE8545, Dell EMC XC Core XC7525, Dell XC Core XC7625, PowerEdge R6415, PowerEdge R7415, PowerEdge R7425, iDRAC9 Problem Types: CWE-1258 Description: Dell PowerEdge Server BIOS and Dell iDRAC9, all versions, contains an Information Disclosure vulnerability. A high privil
ell PowerEdge Server BIOS and Dell iDRAC9, all versions, contains an Information Disclosure vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information Disclosure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000370138/dsa-2025-046-security-update-for-dell-poweredge-server-and-dell-idrac9-for-information-disclosure-vulnerability
CVE ID: CVE-2025-26484 State: PUBLISHED Published: 2025-08-14T14:24:13.765Z Last Updated: 2025-08-14T14:48:08.369Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H) Vendors: Dell Products: CloudLink Problem Types: CWE-611 Description: Dell CloudLink, versions 8.0 through 8.1.1, contains an Improper Restriction of XML External Entity Reference vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000356343/dsa-2025-321-security-update-for-dell-cloudlink-vulnerability
CVE ID: CVE-2025-26485 State: PUBLISHED Published: 2025-03-19T15:27:55.960Z Last Updated: 2025-07-02T14:20:20.635Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: Beta80 Products: Life 1st Problem Types: CWE-200 Description: A vulnerability in Beta80 Life 1st enables the retrieval of different error messages for failed authentication attempts (in case of the usage of a wrong password or a non existent user). The difference in the returned error messages could be used by attackers to understand whether a certain user is registered in the Identity Manager. This issue affects Life 1st: 1.5.2.14234. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
ntity Manager. This issue affects Life 1st: 1.5.2.14234. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cvcn.gov.it/cvcn/cve/CVE-2025-26485 - https://euvd.enisa.europa.eu/vulnerability/CVE-2025-26485
CVE ID: CVE-2025-26486 State: PUBLISHED Published: 2025-03-19T15:46:34.309Z Last Updated: 2025-07-02T14:34:15.470Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: Beta80 Products: Life 1st Problem Types: CWE-327, CWE-916, CWE-328, CWE-760 Description: Broken or Risky Cryptographic Algorithm, Use of Password Hash With Insufficient Computational Effort, Use of Weak Hash, Use of a One-Way Hash with a Predictable Salt vulnerabilities in Beta80 "Life 1st Identity Manager" enable an attacker with access to password hashes to bruteforce user passwords or find a collision to ultimately while attempting to gain access to a target application that uses "Life 1st Identit
ds or find a collision to ultimately while attempting to gain access to a target application that uses "Life 1st Identity Manager" as a service for authentication. This issue affects Life 1st: 1.5.2.14234. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cvcn.gov.it/cvcn/cve/CVE-2025-26486 - https://euvd.enisa.europa.eu/vulnerability/CVE-2025-26486
CVE ID: CVE-2025-26490 State: REJECTED Published: 2025-02-11T10:29:19.643Z Last Updated: 2025-02-14T19:20:14.569Z Description: No description available.
CVE ID: CVE-2025-26491 State: REJECTED Published: 2025-02-11T10:29:20.922Z Last Updated: 2025-02-14T19:21:30.933Z Description: No description available.
CVE ID: CVE-2025-26492 State: PUBLISHED Published: 2025-02-11T13:56:48.411Z Last Updated: 2025-02-11T14:19:06.191Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-522 Description: In JetBrains TeamCity before 2024.12.2 improper Kubernetes connection settings could expose sensitive resources Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2025-26493 State: PUBLISHED Published: 2025-02-11T13:56:47.898Z Last Updated: 2025-02-11T14:20:07.724Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-79 Description: In JetBrains TeamCity before 2024.12.2 several DOM-based XSS were possible on the Code Inspection Report tab Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2025-26494 State: PUBLISHED Published: 2025-02-11T17:33:53.360Z Last Updated: 2025-02-19T21:16:20.388Z Vendors: Salesforce Products: Tableau Server Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server allows Authentication Bypass.This issue affects Tableau Server: from 2023.3 through 2023.3.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://help.salesforce.com/s/articleView?id=001534936&type=1
CVE ID: CVE-2025-26495 State: PUBLISHED Published: 2025-02-11T17:56:38.732Z Last Updated: 2025-03-04T20:15:58.653Z Vendors: Salesforce Products: Tableau Server Problem Types: CWE-312 Description: Cleartext Storage of Sensitive Information vulnerability in Salesforce Tableau Server can record the Personal Access Token (PAT) into logging repositories.This issue affects Tableau Server: before 2022.1.3, before 2021.4.8, before 2021.3.13, before 2021.2.14, before 2021.1.16, before 2020.4.19. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://help.salesforce.com/s/articleView?id=000390611&type=1
CVE ID: CVE-2025-26496 State: PUBLISHED Published: 2025-08-22T20:10:41.238Z Last Updated: 2025-08-26T03:55:24.389Z Vendors: Salesforce Products: Tableau Server, Tableau Desktop Problem Types: CWE-843 Description: Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Salesforce Tableau Server, Tableau Desktop on Windows, Linux (File Upload modules) allows Local Code Inclusion.This issue affects Tableau Server, Tableau Desktop: before 2025.1.3, before 2024.2.12, before 2023.3.19. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://help.salesforce.com/s/articleView?id=005132575&type=1 - https://www.cve.org/CVERecord?id=CVE-2022-1364
CVE ID: CVE-2025-26497 State: PUBLISHED Published: 2025-08-22T20:13:13.441Z Last Updated: 2025-08-25T20:41:21.628Z Vendors: Salesforce Products: Tableau Server Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (Flow Editor modules) allows Absolute Path Traversal.This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://help.salesforce.com/s/articleView?id=005132575&type=1
CVE ID: CVE-2025-26498 State: PUBLISHED Published: 2025-08-22T20:16:04.606Z Last Updated: 2025-08-25T20:40:42.621Z Vendors: Salesforce Products: Tableau Server Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (establish-connection-no-undo modules) allows Absolute Path Traversal.This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://help.salesforce.com/s/articleView?id=005132575&type=1
CVE ID: CVE-2025-26499 State: PUBLISHED Published: 2025-09-11T16:46:28.575Z Last Updated: 2025-09-11T20:37:54.876Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: Wind River Studio Developer Products: Wind River Studio Developer Problem Types: CWE-270 Description: Under heavy system utilization a random race condition can occur during authentication or token refresh operation. This flaw allows one user to be granted a token intended for another user, resulting in impersonation until the session is ended. This flaw cannot be intentionally exploited due to the required concurring action by two users. However, if the event occurs a user would be inadvertently exp
oited due to the required concurring action by two users. However, if the event occurs a user would be inadvertently exposed to another user’s system rights and data access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.windriver.com/security/vulnerability-responses/CVE-2025-26499 - https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2025-26499
CVE ID: CVE-2025-26500 State: PUBLISHED Published: 2025-03-21T22:20:36.101Z Last Updated: 2025-03-24T13:19:36.412Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Wind River Systems Products: VxWorks 7 Problem Types: CWE-400 Description: : Uncontrolled Resource Consumption vulnerability in Wind River Systems VxWorks 7 on VxWorks allows Excessive Allocation. Specifically crafted USB packets may lead to the system becoming unavailable This issue affects VxWorks 7: from 22.06 through 24.03. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2025-26500
CVE ID: CVE-2025-26503 State: PUBLISHED Published: 2025-09-18T18:46:44.962Z Last Updated: 2025-09-20T03:55:42.625Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Wind River Systems Inc Products: VxWorks 7 Problem Types: CWE-119 Description: A crafted system call argument can cause memory corruption. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2025-26503
CVE ID: CVE-2025-26506 State: PUBLISHED Published: 2025-02-14T16:58:09.823Z Last Updated: 2025-02-14T17:23:15.086Z Vendors: HP, Inc. Products: Certain HP LaserJet Pro, HP LaserJet Enterprise, HP LaserJet Managed Printers Problem Types: CWE-121 Description: Certain HP LaserJet Pro, HP LaserJet Enterprise, and HP LaserJet Managed Printers may potentially be vulnerable to Remote Code Execution and Elevation of Privilege when processing a PostScript print job. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hp.com/us-en/document/ish_11953771-11953793-16/hpsbpi04007
CVE ID: CVE-2025-26507 State: PUBLISHED Published: 2025-02-14T17:01:13.314Z Last Updated: 2025-02-14T18:11:19.821Z Vendors: HP, Inc. Products: Certain HP LaserJet Pro, HP LaserJet Enterprise, HP LaserJet Managed Printers Problem Types: CWE-121 Description: Certain HP LaserJet Pro, HP LaserJet Enterprise, and HP LaserJet Managed Printers may potentially be vulnerable to Remote Code Execution and Elevation of Privilege when processing a PostScript print job. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hp.com/us-en/document/ish_11953771-11953793-16/hpsbpi04007
CVE ID: CVE-2025-26508 State: PUBLISHED Published: 2025-02-14T17:03:12.468Z Last Updated: 2025-02-14T18:06:52.751Z Vendors: HP, Inc. Products: Certain HP LaserJet Pro, HP LaserJet Enterprise, HP LaserJet Managed Printers Problem Types: CWE-787 Description: Certain HP LaserJet Pro, HP LaserJet Enterprise, and HP LaserJet Managed Printers may potentially be vulnerable to Remote Code Execution and Elevation of Privilege when processing a PostScript print job. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hp.com/us-en/document/ish_11953771-11953793-16/hpsbpi04007
CVE ID: CVE-2025-26511 State: PUBLISHED Published: 2025-02-13T15:44:06.315Z Last Updated: 2025-02-13T23:33:06.482Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: NetApp Products: Instaclustr fork of Stratio's Cassandra-Lucene-Index plugin Problem Types: CWE-863 Description: Systems running the Instaclustr fork of Stratio's Cassandra-Lucene-Index plugin versions 4.0-rc1-1.0.0 through 4.0.16-1.0.0 and 4.1.2-1.0.0 through 4.1.8-1.0.0, installed into Apache Cassandra version 4.x, are susceptible to a vulnerability which when successfully exploited could allow authenticated Cassandra users to remotely bypass RBAC and escalate their privileges. Additional Analyst N
ed could allow authenticated Cassandra users to remotely bypass RBAC and escalate their privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/instaclustr/cassandra-lucene-index/security/advisories/GHSA-mrqp-q7vx-v2cx
CVE ID: CVE-2025-26512 State: PUBLISHED Published: 2025-03-24T22:06:00.720Z Last Updated: 2025-03-27T03:55:12.579Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: NetApp Products: SnapCenter Problem Types: CWE-266 Description: SnapCenter versions prior to 6.0.1P1 and 6.1P1 are susceptible to a vulnerability which may allow an authenticated SnapCenter Server user to become an admin user on a remote system where a SnapCenter plug-in has been installed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.netapp.com/advisory/NTAP-20250324-0001
CVE ID: CVE-2025-26513 State: PUBLISHED Published: 2025-08-07T20:29:07.044Z Last Updated: 2025-08-12T03:55:11.543Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: NetApp Products: SAN Host Utilities for Windows Problem Types: 267 Description: The installer for SAN Host Utilities for Windows versions prior to 8.0 is susceptible to a vulnerability which when successfully exploited could allow a local user to escalate their privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.netapp.com/advisory/NTAP-20250806-0001
CVE ID: CVE-2025-26514 State: PUBLISHED Published: 2025-09-19T18:31:54.948Z Last Updated: 2025-09-19T18:49:58.274Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L) Vendors: NetApp Products: StorageGRID Problem Types: CWE-79 Description: StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are susceptible to a Reflected Cross-Site Scripting vulnerability. Successful exploit could allow an attacker to view or modify configuration settings or add or modify user accounts but requires the attacker to know specific information about the target instance and then trick a privileged user into clicking a specially crafted link. Additional Analyst
on about the target instance and then trick a privileged user into clicking a specially crafted link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.netapp.com/advisory/NTAP-20250910-0001
CVE ID: CVE-2025-26515 State: PUBLISHED Published: 2025-09-19T18:34:17.283Z Last Updated: 2025-09-19T18:46:37.919Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: NetApp Products: StorageGRID Problem Types: CWE-918 Description: StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 without Single Sign-on enabled are susceptible to a Server-Side Request Forgery (SSRF) vulnerability. Successful exploit could allow an unauthenticated attacker to change the password of any Grid Manager or Tenant Manager non-federated user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.netapp.com/advisory/NTAP-202509
user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.netapp.com/advisory/NTAP-20250910-0002
CVE ID: CVE-2025-26516 State: PUBLISHED Published: 2025-09-19T18:51:12.609Z Last Updated: 2025-09-19T19:06:24.828Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: NetApp Products: StorageGRID Problem Types: CWE-405 Description: StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are susceptible to a Denial of Service vulnerability. Successful exploit could allow an unauthenticated attacker to cause a Denial of Service on the Admin node. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.netapp.com/advisory/NTAP-20250910-0003
CVE ID: CVE-2025-26517 State: PUBLISHED Published: 2025-09-19T18:53:07.531Z Last Updated: 2025-09-19T19:07:36.019Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: NetApp Products: StorageGRID Problem Types: CWE-266 Description: StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are susceptible to a privilege escalation vulnerability. Successful exploit could allow an unauthorized authenticated attacker to discover Grid node names and IP addresses or modify Storage Grades. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.netapp.com/advisory/NTAP-20250910-0004