Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
2019/ 2022), ETERNUS SF Express (for Windows Server 2016/ 2019/ 2022), ETERNUS SF Storage Cruiser (for Windows Server 2016/ 2019/ 2022) Problem Types: CWE-276 Description: ETERNUS SF provided by Fsas Technologies Inc. contains an incorrect default permissions vulnerability. A low-privileged user with access to the management server may obtain database credentials, potentially allowing execution of OS commands with administrator privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.fujitsu.com/global/support/products/computing/storage/20251020/index.html - https://www.fsastech.com/ja-jp/resources/security/2025/1020.html - https://jvn
s/computing/storage/20251020/index.html - https://www.fsastech.com/ja-jp/resources/security/2025/1020.html - https://jvn.jp/en/jp/JVN44266462/
CVE ID: CVE-2025-62579 State: PUBLISHED Published: 2025-10-16T01:31:38.135Z Last Updated: 2025-10-21T08:41:23.980Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: ASDA-Soft Problem Types: CWE-121 Description: ASDA-Soft Stack-based Buffer Overflow Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2025-00019_ASDA-Soft%20Stack-based%20Buffer%20Overflow%20Vulnerabilities.pdf
CVE ID: CVE-2025-62580 State: PUBLISHED Published: 2025-10-16T01:33:35.691Z Last Updated: 2025-10-21T08:41:46.790Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: ASDA-Soft Problem Types: CWE-121 Description: ASDA-Soft Stack-based Buffer Overflow Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2025-00019_ASDA-Soft%20Stack-based%20Buffer%20Overflow%20Vulnerabilities.pdf
CVE ID: CVE-2025-62583 State: PUBLISHED Published: 2025-10-16T06:52:12.797Z Last Updated: 2025-10-16T14:09:03.582Z Vendors: NAVER Products: NAVER Whale browser Problem Types: CWE-358 Description: Whale Browser before 4.33.325.17 allows an attacker to escape the iframe sandbox in a dual-tab environment. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cve.naver.com/detail/cve-2025-62583.html
CVE ID: CVE-2025-62584 State: PUBLISHED Published: 2025-10-16T06:52:25.232Z Last Updated: 2025-10-16T13:38:54.575Z Vendors: NAVER Products: NAVER Whale browser Problem Types: CWE-346 Description: Whale browser before 4.33.325.17 allows an attacker to bypass the Same-Origin Policy in a dual-tab environment. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cve.naver.com/detail/cve-2025-62584.html
CVE ID: CVE-2025-62585 State: PUBLISHED Published: 2025-10-16T06:52:34.974Z Last Updated: 2025-10-16T13:36:56.579Z Vendors: NAVER Products: NAVER Whale browser Problem Types: CWE-358 Description: Whale browser before 4.33.325.17 allows an attacker to bypass the Content Security Policy via a specific scheme in a dual-tab environment. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cve.naver.com/detail/cve-2025-62585.html
CVE ID: CVE-2025-62586 State: PUBLISHED Published: 2025-10-16T17:20:09.156Z Last Updated: 2025-10-17T15:07:20.435Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: OPEXUS Products: FOIAXpress Problem Types: CWE-306 Description: OPEXUS FOIAXpress allows a remote, unauthenticated attacker to reset the administrator password. Fixed in FOIAXpress version 11.13.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.opexustech.com/docs/foiaxpress/11.13.0/FOIAXpress_Release_Notes_11.13.2.0.pdf - https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-289-01.json - https://www.cve.org/CVERecord?id=CVE-2025-6
ontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-289-01.json - https://www.cve.org/CVERecord?id=CVE-2025-62586
CVE ID: CVE-2025-62587 State: PUBLISHED Published: 2025-10-21T20:03:19.290Z Last Updated: 2025-10-23T03:55:29.065Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Oracle Corporation Products: Oracle VM VirtualBox Problem Types: Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. Description: Vulnerability in the Oracle VM VirtualBox produ
lnerability can result in takeover of Oracle VM VirtualBox. Description: Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.12 and 7.2.2. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (C
of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.oracle.com/security-alerts/cpuoct2025.html
CVE ID: CVE-2025-62588 State: PUBLISHED Published: 2025-10-21T20:03:19.656Z Last Updated: 2025-10-23T03:55:29.960Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Oracle Corporation Products: Oracle VM VirtualBox Problem Types: Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. Description: Vulnerability in the Oracle VM VirtualBox produ
CVE ID: CVE-2025-62589 State: PUBLISHED Published: 2025-10-21T20:03:20.024Z Last Updated: 2025-10-23T03:55:30.756Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Oracle Corporation Products: Oracle VM VirtualBox Problem Types: Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. Description: Vulnerability in the Oracle VM VirtualBox produ
CVE ID: CVE-2025-62590 State: PUBLISHED Published: 2025-10-21T20:03:20.343Z Last Updated: 2025-10-23T03:55:31.793Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Oracle Corporation Products: Oracle VM VirtualBox Problem Types: Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. Description: Vulnerability in the Oracle VM VirtualBox produ
CVE ID: CVE-2025-62591 State: PUBLISHED Published: 2025-10-21T20:03:20.706Z Last Updated: 2025-10-21T20:24:34.928Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: Oracle Corporation Products: Oracle VM VirtualBox Problem Types: Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible
lnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. Description: Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.12 and 7.2.2. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to al
e). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.oracle.com/security-alerts/cpuoct2025.html
CVE ID: CVE-2025-62592 State: PUBLISHED Published: 2025-10-21T20:03:21.072Z Last Updated: 2025-10-22T14:10:39.024Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: Oracle Corporation Products: Oracle VM VirtualBox Problem Types: Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible
CVE ID: CVE-2025-62594 State: PUBLISHED Published: 2025-10-27T20:00:33.205Z Last Updated: 2025-10-27T20:23:20.526Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: ImageMagick Products: ImageMagick Problem Types: CWE-119, CWE-369, CWE-191 Description: ImageMagick is a software suite to create, edit, compose, or convert bitmap images. ImageMagick versions prior to 7.1.2-8 are vulnerable to denial-of-service due to unsigned integer underflow and division-by-zero in the CLAHEImage function. When tile width or height is zero, unsigned underflow occurs in pointer arithmetic, leading to out-of-bounds memory access, and division-by-zero causes immediate crashes. Thi
occurs in pointer arithmetic, leading to out-of-bounds memory access, and division-by-zero causes immediate crashes. This issue has been patched in version 7.1.2-8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wpp4-vqfq-v4hp - https://github.com/ImageMagick/ImageMagick/commit/7b47fe369eda90483402fcd3d78fa4167d3bb129
CVE ID: CVE-2025-62595 State: PUBLISHED Published: 2025-10-21T16:20:43.809Z Last Updated: 2025-10-21T16:35:48.461Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: koajs Products: koa Problem Types: CWE-601 Description: Koa is expressive middleware for Node.js using ES2017 async functions. In versions 2.16.2 to before 2.16.3 and 3.0.1 to before 3.0.3, a bypass to CVE-2025-8129 was discovered in the Koa.js framework affecting its back redirect functionality. In certain circumstances, an attacker can manipulate the Referer header to force a user’s browser to navigate to an external, potentially malicious website. This occurs because the implementation incorrect
er’s browser to navigate to an external, potentially malicious website. This occurs because the implementation incorrectly treats some specially crafted URLs as safe relative paths. Exploiting this vulnerability could allow attackers to perform phishing, social engineering, or other redirect-based attacks on users of affected applications. This issue has been patched in version 3.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/koajs/koa/security/advisories/GHSA-g8mr-fgfg-5qpc - https://github.com/koajs/koa/commit/769fd75cc6b30d72493b370b5a3ae2332ca03c5b
CVE ID: CVE-2025-62596 State: PUBLISHED Published: 2025-11-05T23:14:37.167Z Last Updated: 2025-11-06T16:54:15.942Z Vendors: youki-dev Products: youki Problem Types: CWE-61, CWE-363 Description: Youki is a container runtime written in Rust. In versions 0.5.6 and below, youki’s apparmor handling performs insufficiently strict write-target validation, and when combined with path substitution during pathname resolution, can allow writes to unintended procfs locations. While resolving a path component-by-component, a shared-mount race can substitute intermediate components and redirect the final target. This issue is fixed in version 0.5.7. Additional Analyst Notes: - CISA ADP Vulnrichment: Refer
edirect the final target. This issue is fixed in version 0.5.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/youki-dev/youki/security/advisories/GHSA-vf95-55w6-qmrf - https://github.com/youki-dev/youki/commit/5886c91073b9be748bd8d5aed49c4a820548030a - https://pkg.go.dev/github.com/cyphar/filepath-securejoin/pathrs-lite/procfs - https://youtu.be/tGseJW_uBB8 - https://youtu.be/y1PaBzxwRWQ
CVE ID: CVE-2025-62597 State: PUBLISHED Published: 2025-10-21T16:34:19.775Z Last Updated: 2025-10-21T17:25:11.277Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-79 Description: WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to version 3.5.1, a reflected cross-site scripting (XSS) vulnerability was identified in the editar_info_pessoal.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the sql parameter. The vulnerable endpoint is GET /WeGIA/html/pessoa/editar_info_pessoal.php?sql=1. This issue has been patched in version 3.5.1. Additional Analyst Notes: - CISA ADP Vulnr
/editar_info_pessoal.php?sql=1. This issue has been patched in version 3.5.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-wqjv-fhc9-h7hm - https://github.com/LabRedesCefetRJ/WeGIA/commit/e41395fe6a7b4f428b1797a8d5b52e0e3dbbb3d9 - https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.5.1
CVE ID: CVE-2025-62598 State: PUBLISHED Published: 2025-10-21T16:34:57.351Z Last Updated: 2025-10-21T17:55:53.913Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-79 Description: WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to version 3.5.1, a reflected cross-site scripting (XSS) vulnerability was identified in the editar_info_pessoal.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the action parameter. The vulnerable endpoint is GET /WeGIA/html/pessoa/editar_info_pessoal.php?action=1. This issue has been patched in version 3.5.1. Additional Analyst Notes: - CISA ADP
soa/editar_info_pessoal.php?action=1. This issue has been patched in version 3.5.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-jmm7-rr7w-f223 - https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.5.1
CVE ID: CVE-2025-62604 State: PUBLISHED Published: 2025-10-22T15:03:40.178Z Last Updated: 2025-10-27T13:34:02.720Z Vendors: metersphere Products: metersphere Problem Types: CWE-200 Description: MeterSphere is an open source continuous testing platform. Prior to version 2.10.25-lts, a logic flaw allows retrieval of arbitrary user information. This allows an unauthenticated attacker to log in to the system as any user. This issue has been patched in version 2.10.25-lts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/metersphere/metersphere/security/advisories/GHSA-vj5x-7374-rf96 - https://github.com/metersphere/metersphere/commit/b984fe74e84711ff326b0a34880
/security/advisories/GHSA-vj5x-7374-rf96 - https://github.com/metersphere/metersphere/commit/b984fe74e84711ff326b0a348807c31fadf134af - https://github.com/metersphere/metersphere/releases/tag/v2.10.25-lts
CVE ID: CVE-2025-62605 State: PUBLISHED Published: 2025-10-21T16:46:37.879Z Last Updated: 2025-10-21T18:00:16.343Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: mastodon Products: mastodon Problem Types: CWE-754 Description: Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon version 4.4, support for verifiable quote posts with quote controls was added, but it is possible for an attacker to bypass these controls in Mastodon versions prior to 4.4.8 and 4.5.0-beta.2. Mastodon internally treats reblogs as statuses. Since they were not special-treated, an attacker could reblog any post, then quote their reblog, technically q
statuses. Since they were not special-treated, an attacker could reblog any post, then quote their reblog, technically quoting themselves, but having the quote feature a preview of the post they did not get authorization for with all of the affordances that would be otherwise denied by the quote controls. This issue has been patched in versions 4.4.8 and 4.5.0-beta.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mastodon/mastodon/security/advisories/GHSA-8h43-rcqj-wpc6 - https://github.com/mastodon/mastodon/commit/2dc4552229b55e2e4adaef675e68ed7ae123d78e - https://github.com/mastodon/mastodon/commit/405a49df44033e7d179f3d44d59fb68a67d54789 - https://git
f675e68ed7ae123d78e - https://github.com/mastodon/mastodon/commit/405a49df44033e7d179f3d44d59fb68a67d54789 - https://github.com/mastodon/mastodon/releases/tag/v4.4.8 - https://github.com/mastodon/mastodon/releases/tag/v4.5.0-beta.2
CVE ID: CVE-2025-62606 State: PUBLISHED Published: 2025-10-22T15:11:16.114Z Last Updated: 2025-10-22T17:21:38.838Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: My-Little-Forum Products: mylittleforum Problem Types: CWE-89 Description: my little forum is a PHP and MySQL based internet forum that displays the messages in classical threaded view. Prior to version 2.5.12, an authenticated SQL injection vulnerability in the bookmark reordering feature allows any logged-in user to execute arbitrary SQL commands. This can lead to a full compromise of the application's database, including reading, modifying, or deleting all data. This issue has been patched in vers
e of the application's database, including reading, modifying, or deleting all data. This issue has been patched in version 2.5.12. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/My-Little-Forum/mylittleforum/security/advisories/GHSA-m8hj-c6gr-6h6v - https://github.com/My-Little-Forum/mylittleforum/releases/tag/20251021.1
CVE ID: CVE-2025-62607 State: PUBLISHED Published: 2025-10-22T15:40:46.355Z Last Updated: 2025-10-22T16:05:50.810Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: nautobot Products: nautobot-app-ssot Problem Types: CWE-306 Description: Nautobot Single Source of Truth (SSoT) is an app for Nautobot. Prior to version 3.10.0, an unauthenticated attacker could access this page to view the Service Now public instance name e.g. companyname.service-now.com. This is considered low-value information. This does not expose the Secret, the Secret Name, or the Secret Value for the Username/Password for Service-Now.com. An unauthenticated member would not be able to change
or the Secret Value for the Username/Password for Service-Now.com. An unauthenticated member would not be able to change the instance name, nor set a Secret. There is not a way to gain access to other pages Nautobot through the unauthenticated Configuration page. This issue has been patched in version 3.10.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nautobot/nautobot-app-ssot/security/advisories/GHSA-535g-62r7-cx6v - https://github.com/nautobot/nautobot-app-ssot/commit/1530d25cdeb929641ec47644f9a0a1d9d41e1cb8 - https://github.com/nautobot/nautobot-app-ssot/releases/tag/v3.10.0
CVE ID: CVE-2025-62608 State: PUBLISHED Published: 2025-11-21T18:56:03.939Z Last Updated: 2025-11-21T19:10:00.724Z Vendors: ml-explore Products: mlx Problem Types: CWE-122 Description: MLX is an array framework for machine learning on Apple silicon. Prior to version 0.29.4, there is a heap buffer overflow in mlx::core::load() when parsing malicious NumPy .npy files. Attacker-controlled file causes 13-byte out-of-bounds read, leading to crash or information disclosure. This issue has been patched in version 0.29.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ml-explore/mlx/security/advisories/GHSA-w6vg-jg77-2qg6 - https://github.com/ml-explore/mlx/pull/
s: - https://github.com/ml-explore/mlx/security/advisories/GHSA-w6vg-jg77-2qg6 - https://github.com/ml-explore/mlx/pull/1 - https://github.com/ml-explore/mlx/pull/2
CVE ID: CVE-2025-62609 State: PUBLISHED Published: 2025-11-21T18:57:45.930Z Last Updated: 2025-11-21T19:09:33.874Z Vendors: ml-explore Products: mlx Problem Types: CWE-476 Description: MLX is an array framework for machine learning on Apple silicon. Prior to version 0.29.4, there is a segmentation fault in mlx::core::load_gguf() when loading malicious GGUF files. Untrusted pointer from external gguflib library is dereferenced without validation, causing application crash. This issue has been patched in version 0.29.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ml-explore/mlx/security/advisories/GHSA-j842-xgm4-wf88
CVE ID: CVE-2025-62610 State: PUBLISHED Published: 2025-10-22T19:24:08.138Z Last Updated: 2025-10-23T17:31:49.209Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: honojs Products: hono Problem Types: CWE-285 Description: Hono is a Web application framework that provides support for any JavaScript runtime. In versions from 1.1.0 to before 4.10.2, Hono’s JWT Auth Middleware does not provide a built-in aud (Audience) verification option, which can cause confused-deputy / token-mix-up issues: an API may accept a valid token that was issued for a different audience (e.g., another service) when multiple services share the same issuer/keys. This can lead to unintende
different audience (e.g., another service) when multiple services share the same issuer/keys. This can lead to unintended cross-service access. Hono’s docs list verification options for iss/nbf/iat/exp only, with no aud support; RFC 7519 requires that when an aud claim is present, tokens MUST be rejected unless the processing party identifies itself in that claim. This issue has been patched in version 4.10.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/honojs/hono/security/advisories/GHSA-m732-5p4w-x69g - https://github.com/honojs/hono/commit/45ba3bf9e3dff8e4bd85d6b47d4b71c8d6c66bef
CVE ID: CVE-2025-62611 State: PUBLISHED Published: 2025-10-22T19:29:26.708Z Last Updated: 2025-10-22T19:44:02.865Z Vendors: aio-libs Products: aiomysql Problem Types: CWE-73 Description: aiomysql is a library for accessing a MySQL database from the asyncio. Prior to version 0.3.0, the client-side settings are not checked before sending local files to MySQL server, which allows obtaining arbitrary files from the client using a rogue server. It is possible to create a rogue MySQL server that emulates authorization, ignores client flags and requests arbitrary files from the client by sending a LOAD_LOCAL instruction packet. This issue has been patched in version 0.3.0. Additional Analyst Notes: