Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-6022 State: REJECTED Published: N/A Last Updated: 2025-07-05T22:16:40.653Z Description: No description available.
CVE ID: CVE-2025-6023 State: PUBLISHED Published: 2025-07-18T07:48:15.972Z Last Updated: 2025-07-18T13:46:45.354Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L) Vendors: Grafana Products: Grafana Problem Types: CWE-601, CWE-79 Description: An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks. The vulnerability was introduced in Grafana v11.5.0. The open redirect can be chained with path traversal vulnerabilities to achieve XSS. Fixed in versions 12.0.2+security-01, 11.6.3+security-01, 11.5.6+security-01, 11.4.6+security-01 and 11.3.8+security-01 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - h
ecurity-01, 11.4.6+security-01 and 11.3.8+security-01 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://grafana.com/security/security-advisories/cve-2025-6023/ - https://grafana.com/blog/2025/07/17/grafana-security-release-medium-and-high-severity-fixes-for-cve-2025-6197-and-cve-2025-6023/
CVE ID: CVE-2025-6025 State: PUBLISHED Published: 2025-08-15T02:24:22.653Z Last Updated: 2025-08-15T12:43:56.428Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: railmedia Products: Order Tip for WooCommerce Problem Types: CWE-602 Description: The Order Tip for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Improper Input Validation in all versions up to, and including, 1.5.4. This is due to lack of server-side validation on the `data-tip` attribute, which makes it possible for unauthenticated attackers to apply an excessive or even negative tip amount, resulting in unauthorized discount up to free orders depending on the value submitted. Ad
e or even negative tip amount, resulting in unauthorized discount up to free orders depending on the value submitted. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9bcd18bd-032e-4a97-83aa-a377f9b1f435?source=cve - https://plugins.trac.wordpress.org/browser/order-tip-woo/trunk/frontend/views/tip-form.php#L49 - https://plugins.trac.wordpress.org/browser/order-tip-woo/trunk/assets/build/front.bundle.js - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3318615%40order-tip-woo&new=3318615%40order-tip-woo&sfp_email=&sfph_mail=
CVE ID: CVE-2025-6026 State: PUBLISHED Published: 2025-10-15T14:25:29.294Z Last Updated: 2025-10-21T12:22:42.749Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Lenovo Products: Universal Device Client Problem Types: CWE-295 Description: An improper certificate validation vulnerability was reported in the Lenovo Universal Device Client (UDC) that could allow a user capable of intercepting network traffic to obtain application metadata, including device information, geolocation, and telemetry data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-198727
CVE ID: CVE-2025-6027 State: PUBLISHED Published: 2025-11-05T06:00:07.919Z Last Updated: 2025-11-05T18:35:20.331Z Vendors: Unknown Products: Ace User Management Problem Types: CWE-287 Improper Authentication Description: The Ace User Management WordPress plugin through 2.0.3 does not properly validate that a password reset token is associated with the user who requested it, allowing any authenticated users, such as subscriber to reset the password of arbitrary accounts, including administrators. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/06fb8088-10e3-424e-a3ac-4673bac49467/
CVE ID: CVE-2025-6029 State: PUBLISHED Published: 2025-06-13T14:25:50.597Z Last Updated: 2025-06-13T14:52:13.217Z Vendors: KIA Products: Aftermarket Generic Smart Keyless Entry System Problem Types: CWE-307, CWE-294 Description: Use of fixed learning codes, one code to lock the car and the other code to unlock it, the Key Fob Transmitter in KIA-branded Aftermarket Generic Smart Keyless Entry System, primarily distributed in Ecuador, which allows a replay attack. Manufacture is unknown at the time of release. CVE Record will be updated once this is clarified. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://revers3everything.com/unlocking-thousands-of-cars-by-exploitin
yst Notes: - CISA ADP Vulnrichment: References: - https://revers3everything.com/unlocking-thousands-of-cars-by-exploiting-learning-codes-from-key-fobs/ - https://asrg.io/security-advisories/cve-2025-6029-kia-branded-aftermarket-generic-smart-keyless-entry-system-replay-attack/
CVE ID: CVE-2025-6030 State: PUBLISHED Published: 2025-06-13T14:38:58.103Z Last Updated: 2025-06-13T14:51:37.000Z Vendors: Autoeastern Products: Cyclone Matrix TRF Problem Types: CWE-307, CWE-294 Description: Use of fixed learning codes, one code to lock the car and the other code to unlock it, in the Key Fob Transmitter in Cyclone Matrix TRF Smart Keyless Entry System, which allows a replay attack. Research was completed on the 2024 KIA Soluto. Attack confirmed on other KIA Models in Ecuador. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://revers3everything.com/unlocking-thousands-of-cars-by-exploiting-learning-codes-from-key-fobs/ - https://asrg.io/security-advisor
verything.com/unlocking-thousands-of-cars-by-exploiting-learning-codes-from-key-fobs/ - https://asrg.io/security-advisories/cve-2025-6030-autoeastern-smart-keyless-entry-system-replay-attack/
CVE ID: CVE-2025-6031 State: PUBLISHED Published: 2025-06-12T19:29:11.082Z Last Updated: 2025-10-14T18:01:10.993Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Amazon Products: Cloud Cam Problem Types: CWE-672 Description: Amazon Cloud Cam is a home security camera that was deprecated on December 2, 2022, is end of life, and is no longer actively supported. When a user powers on the Amazon Cloud Cam, the device attempts to connect to a remote service infrastructure that has been deprecated due to end-of-life status. The device defaults to a pairing status in which an arbitrary user can bypass SSL pinning to associate the device to an arbitrary network, allow
pairing status in which an arbitrary user can bypass SSL pinning to associate the device to an arbitrary network, allowing for network traffic interception and modification. We recommend customers discontinue usage of any remaining Amazon Cloud Cams. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://aws.amazon.com/security/security-bulletins/AWS-2025-013/
CVE ID: CVE-2025-6032 State: PUBLISHED Published: 2025-06-24T13:50:47.955Z Last Updated: 2025-11-10T13:52:43.825Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat OpenShift Container Platform 4.16, Red Hat OpenShift Container Platform 4.17, Red Hat OpenShift Container Platform 4.18, Red Hat OpenShift Container Platform 4.19, Red Hat OpenShift Container Platform 4.20, Red Hat OpenShift Container Platform 4 Problem Types: CWE-295 Description: A flaw was found in Podman. The podman machine init command
ift Container Platform 4 Problem Types: CWE-295 Description: A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry. This issue results in a Man In The Middle attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:10295 - https://access.redhat.com/errata/RHSA-2025:10549 - https://access.redhat.com/errata/RHSA-2025:10550 - https://access.redhat.com/errata/RHSA-2025:10551 - https://access.redhat.com/errata/RHSA-2025:10668 - https://access.redhat.com/errata/RHSA-2025:11363 - https://access.redhat.com/errata/RHSA-2025:11677 - https://access.red
https://access.redhat.com/errata/RHSA-2025:11363 - https://access.redhat.com/errata/RHSA-2025:11677 - https://access.redhat.com/errata/RHSA-2025:11681 - https://access.redhat.com/errata/RHSA-2025:15397 - https://access.redhat.com/errata/RHSA-2025:9726 - https://access.redhat.com/errata/RHSA-2025:9751 - https://access.redhat.com/errata/RHSA-2025:9766 - https://access.redhat.com/security/cve/CVE-2025-6032 - https://bugzilla.redhat.com/show_bug.cgi?id=2372501 - https://github.com/containers/podman/commit/726b506acc8a00d99f1a3a1357ecf619a1f798c3 - https://github.com/containers/podman/security/advisories/GHSA-65gg-3w2w-hr4h
CVE ID: CVE-2025-6033 State: PUBLISHED Published: 2025-09-30T16:05:53.142Z Last Updated: 2025-10-01T03:56:00.283Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: NI Products: Circuit Design Suite Problem Types: CWE-787 Description: There is a memory corruption vulnerability due to an out of bounds write in XML_Serialize() when using SymbolEditor in NI Circuit Design Suite. This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted .sym file. This vulnerability affects NI Circuit Design Suite 14.3.1 and prior versions. Additional Analyst Notes: - CIS
.sym file. This vulnerability affects NI Circuit Design Suite 14.3.1 and prior versions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/improper-input-validation-causes-memory-corruption-vulnerabilities-in-circuit-design-suite.html
CVE ID: CVE-2025-6034 State: PUBLISHED Published: 2025-09-30T16:07:21.551Z Last Updated: 2025-10-01T03:56:01.137Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: NI Products: Circuit Design Suite Problem Types: CWE-125 Description: There is a memory corruption vulnerability due to an out of bounds read in DefaultFontOptions() when using SymbolEditor in NI Circuit Design Suite. This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted .sym file. This vulnerability affects NI Circuit Design Suite 14.3.1 and prior versions. Additional Analyst Notes: -
ted .sym file. This vulnerability affects NI Circuit Design Suite 14.3.1 and prior versions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/improper-input-validation-causes-memory-corruption-vulnerabilities-in-circuit-design-suite.html
CVE ID: CVE-2025-6035 State: PUBLISHED Published: 2025-06-13T15:21:17.439Z Last Updated: 2025-11-07T18:33:48.630Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 Problem Types: CWE-190 Description: A flaw was found in GIMP. An integer overflow vulnerability exists in the GIMP "Despeckle" plug-in. The issue occurs due to unchecked multiplication of image dimensions, such as width, height, and bytes-per-pixel (img_bpp), which can result in allocating insufficient memory and subsequently performing out-of-bounds writes. This issue cou
pp), which can result in allocating insufficient memory and subsequently performing out-of-bounds writes. This issue could lead to heap corruption, a potential denial of service (DoS), or arbitrary code execution in certain scenarios. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2025-6035 - https://bugzilla.redhat.com/show_bug.cgi?id=2372515
CVE ID: CVE-2025-6037 State: PUBLISHED Published: 2025-08-01T17:52:48.778Z Last Updated: 2025-08-02T03:55:53.155Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: HashiCorp Products: Vault, Vault Enterprise Problem Types: CWE-295 Description: Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as [+trusted certificate+|https://developer.hashicorp.com/vault/api-docs/auth/cert#certificate]. In this configuration, an attacker may be able to craft a malicious certificate that could be used to impersonate another user. Fixed in Vault Community Edition 1.20.1 and V
ft a malicious certificate that could be used to impersonate another user. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discuss.hashicorp.com/t/hcsec-2025-18-vault-certificate-auth-method-did-not-validate-common-name-for-non-ca-certificates/76037
CVE ID: CVE-2025-6038 State: PUBLISHED Published: 2025-10-09T03:23:30.369Z Last Updated: 2025-10-09T13:34:25.509Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: pebas Products: Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity WordPress theme Problem Types: CWE-639 Description: The Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity WordPress theme plugin for WordPress is vulnerable to privilege escalation via password update in all versions up to, and including, 1.4.0. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for authenticated attackers, with Subsc
ating a user's identity prior to updating their password. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary user's passwords, including those of administrators. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a3cd1c3e-5bb0-4653-8764-2ca38d9a7c77?source=cve - https://themeforest.net/item/lisfinity-classified-ads-wordpress-theme/26342611
CVE ID: CVE-2025-6039 State: PUBLISHED Published: 2025-07-04T01:44:06.031Z Last Updated: 2025-07-07T15:01:56.876Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: cageehv Products: ProcessingJS for WordPress Problem Types: CWE-79 Description: The ProcessingJS for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pjs4wp' shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute wheneve
d attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fcda8a7a-40e3-416e-940a-ba0245dcaa7d?source=cve - https://plugins.trac.wordpress.org/browser/processingjs-for-wp/trunk/processingjs-for-wp.php
CVE ID: CVE-2025-6040 State: PUBLISHED Published: 2025-06-14T08:23:23.104Z Last Updated: 2025-06-17T18:39:39.651Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: sagesony Products: Easy Flashcards Problem Types: CWE-79 Description: The Easy Flashcards plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1. This is due to missing or incorrect nonce validation on the 'ef_settings_submenu' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a
cripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1ff97ee8-9732-4d26-b5e8-b744730e9c5a?source=cve - https://wordpress.org/plugins/easy-flashcards/#developers
CVE ID: CVE-2025-6041 State: PUBLISHED Published: 2025-07-04T01:44:01.931Z Last Updated: 2025-07-08T14:28:52.014Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: yonisink Products: yContributors Problem Types: CWE-352 Description: The yContributors plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5. This is due to missing or incorrect nonce validation on the 'yContributors' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Add
a a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1bd61124-d4af-4c88-be96-579c735b7b49?source=cve - https://plugins.trac.wordpress.org/browser/ycontributors/trunk/ycontributors_admin.php#L19
CVE ID: CVE-2025-6042 State: PUBLISHED Published: 2025-10-15T05:23:48.703Z Last Updated: 2025-10-15T18:12:56.171Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: pebas Products: Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity WordPress theme Problem Types: CWE-269 Description: The Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity WordPress theme plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.4.0. This is due to the plugin assigning the editor role by default. While limitations with respect to capabilities are put in place, use of the API is not restricted. This vulnerability ca
While limitations with respect to capabilities are put in place, use of the API is not restricted. This vulnerability can be leveraged together with CVE-2025-6038 to obtain admin privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/afffd5e2-798b-42b5-b0b9-ac7d6d06edbb?source=cve - https://themeforest.net/item/lisfinity-classified-ads-wordpress-theme/26342611
CVE ID: CVE-2025-6043 State: PUBLISHED Published: 2025-07-16T06:40:42.687Z Last Updated: 2025-07-16T14:40:34.095Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: malcure Products: Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal Problem Types: CWE-862 Description: The Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal plugin for WordPress is vulnerable to Arbitrary File Deletion due to a missing capability check on the wpmr_delete_file() function in all versions up to, and including, 16.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files making remote code ex
ble for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files making remote code execution possible. This is only exploitable when advanced mode is enabled on the site. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d44fe4d7-1af5-4e26-a33c-43a9cce4174c?source=cve - https://plugins.trac.wordpress.org/browser/wp-malware-removal/tags/16.8/wpmr.php#L6401 - https://plugins.trac.wordpress.org/browser/wp-malware-removal/tags/16.8/wpmr.php#L6304 - https://plugins.trac.wordpress.org/browser/wp-malware-removal/tags/16.8/wpmr.php#L4570
CVE ID: CVE-2025-6044 State: PUBLISHED Published: 2025-07-07T18:58:45.456Z Last Updated: 2025-07-09T18:35:08.612Z Vendors: Google Products: ChromeOS Problem Types: Files or Directories Accessible to External Parties Description: An Improper Access Control vulnerability in the Stylus Tools component of Google ChromeOS version 16238.64.0 on the garaged stylus devices allows a physical attacker to bypass the lock screen and access user files by removing the stylus while the device is closed and using the screen capture feature. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://issuetracker.google.com/issues/421184743 - https://issues.chromium.org/issues/b/421184743
CVE ID: CVE-2025-6046 State: REJECTED Published: N/A Last Updated: 2025-10-07T22:19:11.021Z Description: No description available.
CVE ID: CVE-2025-6050 State: PUBLISHED Published: 2025-06-17T11:06:12.360Z Last Updated: 2025-07-24T15:30:10.501Z Vendors: jupo Products: mezzanine Problem Types: CWE-79 Description: Mezzanine CMS, in versions prior to 6.1.1, contains a Stored Cross-Site Scripting (XSS) vulnerability in the admin interface. The vulnerability exists in the "displayable_links_js" function, which fails to properly sanitize blog post titles before including them in JSON responses served via "/admin/displayable_links.js". An authenticated admin user can create a blog post with a malicious JavaScript payload in the title field, then trick another admin user into clicking a direct link to the "/admin/displayable_li
ript payload in the title field, then trick another admin user into clicking a direct link to the "/admin/displayable_links.js" endpoint, causing the malicious script to execute in their browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/stephenmcd/mezzanine/discussions/2080 - https://github.com/stephenmcd/mezzanine/commit/898630d8df48cf3ddb8b9942f59168b93216e3f8 - https://advisory.checkmarx.net/advisory/CVE-2025-6050/
CVE ID: CVE-2025-6051 State: PUBLISHED Published: 2025-09-14T17:03:02.953Z Last Updated: 2025-09-15T15:59:54.371Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: huggingface Products: huggingface/transformers Problem Types: CWE-1333 Description: A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically within the `normalize_numbers()` method of the `EnglishNormalizer` class. This vulnerability affects versions up to 4.52.4 and is fixed in version 4.53.0. The issue arises from the method's handling of numeric strings, which can be exploited using crafted input strings containing long seq
es from the method's handling of numeric strings, which can be exploited using crafted input strings containing long sequences of digits, leading to excessive CPU consumption. This vulnerability impacts text-to-speech and number normalization tasks, potentially causing service disruption, resource exhaustion, and API vulnerabilities. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/af929523-7b59-418a-bf55-301830b2ac9d - https://github.com/huggingface/transformers/commit/ba8eaba9865618253f997784aa565b96206426f0
CVE ID: CVE-2025-6052 State: PUBLISHED Published: 2025-06-13T15:40:38.541Z Last Updated: 2025-11-07T00:42:01.009Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 Problem Types: CWE-190 Description: A flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesn’t. As a result, data may be written past the end o
ation. This makes the system think it has enough memory when it doesn’t. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corruption. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-6052 - https://bugzilla.redhat.com/show_bug.cgi?id=2372666