Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
of astro allows an attacker to bypass the third-party domain restrictions by using a protocol-relative URL as the image source, e.g. /_image?href=//example.com/image.png. This vulnerability is fixed in 5.13.2 and 4.16.18. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/withastro/astro/security/advisories/GHSA-xf8x-j4p2-f749 - https://github.com/withastro/astro/commit/4d16de7f95db5d1ec1ce88610d2a95e606e83820
CVE ID: CVE-2025-55304 State: PUBLISHED Published: 2025-08-29T15:00:05.975Z Last Updated: 2025-08-29T15:27:17.130Z Vendors: Exiv2 Products: exiv2 Problem Types: CWE-407 Description: Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A denial-of-service was found in Exiv2 version 0.28.5: a quadratic algorithm in the ICC profile parsing code in jpegBase::readMetadata() can cause Exiv2 to run for a long time. The denial-of-service is triggered when Exiv2 is used to read the metadata of a crafted jpg image file. The bug is fixed in version 0.28.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gith
file. The bug is fixed in version 0.28.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Exiv2/exiv2/security/advisories/GHSA-m54q-mm9w-fp6g - https://github.com/Exiv2/exiv2/issues/3333 - https://github.com/Exiv2/exiv2/pull/3335 - https://github.com/Exiv2/exiv2/pull/3345
CVE ID: CVE-2025-55305 State: PUBLISHED Published: 2025-09-04T23:05:07.274Z Last Updated: 2025-09-05T15:44:54.628Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L) Vendors: electron Products: electron Problem Types: CWE-94, CWE-829 Description: Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions below 35.7.5, 36.0.0-alpha.1 through 36.8.0, 37.0.0-alpha.1 through 37.3.1 and 38.0.0-alpha.1 through 38.0.0-beta.6, ASAR Integrity Bypass via resource modification. This only impacts apps that have the embeddedAsarIntegrityValidation and onlyLoadAppFromAsar fuses enabled. Apps without these fuses enabled are not
ave the embeddedAsarIntegrityValidation and onlyLoadAppFromAsar fuses enabled. Apps without these fuses enabled are not impacted. This issue is fixed in versions 35.7.5, 36.8.1, 37.3.1 and 38.0.0-beta.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/electron/electron/security/advisories/GHSA-vmqv-hx8q-j7mg - https://github.com/electron/electron/pull/48101 - https://github.com/electron/electron/pull/48102 - https://github.com/electron/electron/pull/48103 - https://github.com/electron/electron/pull/48104 - https://github.com/electron/electron/commit/23a02934510fcf951428e14573d9b2d2a3c4f28b - https://github.com/electron/electron/commit/2e5a0b7220ebf955c6785
tron/commit/23a02934510fcf951428e14573d9b2d2a3c4f28b - https://github.com/electron/electron/commit/2e5a0b7220ebf955c6785cc5adb2e2b1cf77dac1 - https://github.com/electron/electron/commit/3f92511cdecc39f46b0e86cce40a0c691e301c9d - https://github.com/electron/electron/commit/fdf29ce83870109d403f5c23ae529dbd0e8f4fee
CVE ID: CVE-2025-55306 State: PUBLISHED Published: 2025-08-19T18:19:15.839Z Last Updated: 2025-08-19T20:50:19.199Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Mouy-leng Products: GenX_FX Problem Types: CWE-522 Description: GenX_FX is an advance IA trading platform that will focus on forex trading. A vulnerability was identified in the GenX FX backend where API keys and authentication tokens may be exposed if environment variables are misconfigured. Unauthorized users could gain access to cloud resources (Google Cloud, Firebase, GitHub, etc.). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Mouy-leng/GenX_FX/security/
, etc.). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Mouy-leng/GenX_FX/security/advisories/GHSA-2xjq-pvwj-mvm6
CVE ID: CVE-2025-55315 State: PUBLISHED Published: 2025-10-14T17:00:10.371Z Last Updated: 2025-11-22T04:08:19.199Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L/E:U/RL:O/RC:C) Vendors: Microsoft Products: ASP.NET Core 8.0, ASP.NET Core 9.0, ASP.NET Core 2.3, Microsoft Visual Studio 2022 version 17.12, Microsoft Visual Studio 2022 version 17.10, Microsoft Visual Studio 2022 version 17.14 Problem Types: CWE-444 Description: Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container
to bypass a security feature over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55315
CVE ID: CVE-2025-55316 State: PUBLISHED Published: 2025-09-09T17:01:07.205Z Last Updated: 2025-11-21T18:18:15.963Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Azure Connected Machine Agent Problem Types: CWE-73 Description: External control of file name or path in Azure Arc allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55316
CVE ID: CVE-2025-55317 State: PUBLISHED Published: 2025-09-09T17:01:07.872Z Last Updated: 2025-11-21T18:18:16.553Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft AutoUpdate for Mac Problem Types: CWE-59 Description: Improper link resolution before file access ('link following') in Microsoft AutoUpdate (MAU) allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55317
CVE ID: CVE-2025-55319 State: PUBLISHED Published: 2025-09-12T00:49:27.731Z Last Updated: 2025-11-21T18:18:17.109Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Visual Studio Code Problem Types: Remote Code Execution Description: Ai command injection in Agentic AI and Visual Studio Code allows an unauthorized attacker to execute code over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55319
CVE ID: CVE-2025-55320 State: PUBLISHED Published: 2025-10-14T17:00:12.346Z Last Updated: 2025-11-22T04:08:20.918Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Configuration Manager, Microsoft Configuration Manager 2409 Problem Types: CWE-89 Description: Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over an adjacent network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55320
CVE ID: CVE-2025-55321 State: PUBLISHED Published: 2025-10-09T21:04:12.117Z Last Updated: 2025-11-22T04:09:55.731Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Azure Monitor Problem Types: CWE-79 Description: Improper neutralization of input during web page generation ('cross-site scripting') in Azure Monitor allows an unauthorized attacker to perform spoofing over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55321
CVE ID: CVE-2025-55322 State: PUBLISHED Published: 2025-09-24T19:03:47.718Z Last Updated: 2025-11-21T18:18:48.149Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C) Vendors: Microsoft Products: OmniParser Problem Types: CWE-1327 Description: Binding to an unrestricted ip address in GitHub allows an unauthorized attacker to execute code over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55322
CVE ID: CVE-2025-55325 State: PUBLISHED Published: 2025-10-14T17:00:13.200Z Last Updated: 2025-11-22T04:08:21.474Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 11 Version 25H2, Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607
erver Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation) Problem Types: CWE-126 Description: Buffer over-read in Windows Storage Management Provider allows an authorized attacker to disclose information locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55325
CVE ID: CVE-2025-55326 State: PUBLISHED Published: 2025-10-14T17:00:59.637Z Last Updated: 2025-11-22T04:09:06.089Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-416 Description: Use after free in Connected Devices Plat
indows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-416 Description: Use after free in Connected Devices Platform Service (Cdpsvc) allows an unauthorized attacker to execute code over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55326
CVE ID: CVE-2025-55328 State: PUBLISHED Published: 2025-10-14T17:01:00.396Z Last Updated: 2025-11-22T04:09:06.726Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 11 Version 25H2, Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607,
ver Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation) Problem Types: CWE-362 Description: Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hyper-V allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55328
CVE ID: CVE-2025-55330 State: PUBLISHED Published: 2025-10-14T17:01:00.988Z Last Updated: 2025-11-22T04:09:07.355Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 11 Version 25H2, Windows 11 version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-841 Description: Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. Additional Analyst Notes: -
Locker allows an unauthorized attacker to bypass a security feature with a physical attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55330
CVE ID: CVE-2025-55331 State: PUBLISHED Published: 2025-10-14T17:01:01.646Z Last Updated: 2025-11-22T04:09:07.846Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 11 Version 25H2, Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-416 Description: Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally. Add
ription: Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55331
CVE ID: CVE-2025-55332 State: PUBLISHED Published: 2025-10-14T17:01:02.669Z Last Updated: 2025-11-22T04:09:08.384Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 11 Version 25H2, Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-841 Description: Improper enfo
erver Core installation), Windows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-841 Description: Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55332
CVE ID: CVE-2025-55333 State: PUBLISHED Published: 2025-10-14T17:00:13.952Z Last Updated: 2025-11-22T04:08:22.148Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 11 Version 25H2, Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607
erver Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation) Problem Types: CWE-1023 Description: Incomplete comparison with missing factors in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55333
CVE ID: CVE-2025-55334 State: PUBLISHED Published: 2025-10-14T17:01:03.852Z Last Updated: 2025-11-22T04:09:08.917Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 11 Version 25H2, Windows 11 version 22H2, Windows 11 version 22H3, Windows 11 Version 23H2, Windows 11 Version 24H2 Problem Types: CWE-312 Description: Cleartext storage of sensitive information in Windows Kernel allows an unauthorized attacker to bypass a security feature locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55334
CVE ID: CVE-2025-55335 State: PUBLISHED Published: 2025-10-14T17:00:14.740Z Last Updated: 2025-11-22T04:08:22.766Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Wind
indows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation), Windows 11 Version 25H2 Problem Types: CWE-416, CWE-362 Description: Use after free in Windows NTFS allows an unauthorized attacker to elevate privileges locally. Additional Analyst Notes:
Use after free in Windows NTFS allows an unauthorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55335
CVE ID: CVE-2025-55336 State: PUBLISHED Published: 2025-10-14T17:00:15.367Z Last Updated: 2025-11-22T04:08:23.265Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 11 Version 25H2, Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-200 Description: Exposure of s
erver Core installation), Windows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-200 Description: Exposure of sensitive information to an unauthorized actor in Windows Cloud Files Mini Filter Driver allows an authorized attacker to disclose information locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55336
CVE ID: CVE-2025-55337 State: PUBLISHED Published: 2025-10-14T17:01:04.426Z Last Updated: 2025-11-22T04:09:09.476Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 11 Version 25H2, Windows Server 2025 (Server Core installation), Windows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-841 Description: Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55337
CVE ID: CVE-2025-55338 State: PUBLISHED Published: 2025-10-14T17:00:16.093Z Last Updated: 2025-11-22T04:08:23.832Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 11 Version 25H2, Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607
erver Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation) Problem Types: Security Feature Bypass Description: Missing Ability to Patch ROM Code in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55338
CVE ID: CVE-2025-55339 State: PUBLISHED Published: 2025-10-14T17:00:16.751Z Last Updated: 2025-11-22T04:08:24.582Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 11 Version 25H2, Windows Server 2022, Windows 11 version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-125 Description: Out-of-bounds read in Windows NDIS allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
ws an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55339
CVE ID: CVE-2025-55340 State: PUBLISHED Published: 2025-10-14T17:00:17.330Z Last Updated: 2025-11-22T04:08:25.186Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 11 Version 25H2, Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-287 Description: Improper authentication in Windows Remote Desktop Protocol allows an authorized attacker to bypass a security f
ription: Improper authentication in Windows Remote Desktop Protocol allows an authorized attacker to bypass a security feature locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55340
CVE ID: CVE-2025-55341 State: PUBLISHED Published: 2025-11-05T00:00:00.000Z Last Updated: 2025-11-06T17:03:33.164Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Quipux 4.0.1 through e1774ac allows anexos/anexos_nuevo.php asocImgRad. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://minka.gob.ec/quipux-comunitario/quipux-comunitario - https://seguridaddigital.ec/research/20251101/report-20251101.en.pdf
CVE ID: CVE-2025-55342 State: PUBLISHED Published: 2025-11-05T00:00:00.000Z Last Updated: 2025-11-06T17:01:19.835Z Vendors: n/a Products: n/a Problem Types: n/a Description: Quipux 4.0.1 through e1774ac allows enumeration of usernames, and accessing the Ecuadorean identification number for all registered users via the Administracion/usuarios/cambiar_password_olvido_validar.php txt_login parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://minka.gob.ec/quipux-comunitario/quipux-comunitario - https://seguridaddigital.ec/research/20251101/report-20251101.en.pdf