Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-46776 State: PUBLISHED Published: 2025-11-18T17:01:17.437Z Last Updated: 2025-11-18T18:34:05.679Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:U/RC:C) Vendors: Fortinet Products: FortiExtender Problem Types: CWE-120 Description: A buffer copy without checking size of input ('classic buffer overflow') in Fortinet FortiExtender 7.6.0 through 7.6.1, FortiExtender 7.4.0 through 7.4.6, FortiExtender 7.2 all versions, FortiExtender 7.0 all versions may allow an authenticated user to execute arbitrary code or commands via crafted CLI commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-
CLI commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-25-251
CVE ID: CVE-2025-46777 State: PUBLISHED Published: 2025-05-28T07:56:03.616Z Last Updated: 2025-05-28T13:30:23.832Z Severity: LOW (CVSS 2.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:U/RC:C) Vendors: Fortinet Products: FortiPortal Problem Types: CWE-532 Description: A insertion of sensitive information into log file in Fortinet FortiPortal versions 7.4.0, versions 7.2.0 through 7.2.5, and versions 7.0.0 through 7.0.9 may allow an authenticated attacker with at least read-only admin permissions to view encrypted secrets via the FortiPortal System Log. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-380
CVE ID: CVE-2025-46778 State: REJECTED Published: N/A Last Updated: 2025-04-30T02:55:07.528Z Description: No description available.
CVE ID: CVE-2025-46779 State: REJECTED Published: N/A Last Updated: 2025-04-30T02:55:06.996Z Description: No description available.
CVE ID: CVE-2025-46780 State: REJECTED Published: N/A Last Updated: 2025-04-30T02:55:06.500Z Description: No description available.
CVE ID: CVE-2025-46781 State: REJECTED Published: N/A Last Updated: 2025-04-30T02:55:06.012Z Description: No description available.
CVE ID: CVE-2025-46782 State: REJECTED Published: N/A Last Updated: 2025-04-30T02:55:05.217Z Description: No description available.
CVE ID: CVE-2025-46783 State: PUBLISHED Published: 2025-06-13T08:18:58.850Z Last Updated: 2025-06-13T15:12:51.000Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Ricoh Company, Ltd. Products: RICOH Streamline NX V3 PC Client Problem Types: CWE-22 Description: Path traversal vulnerability exists in RICOH Streamline NX V3 PC Client versions 3.5.0 to 3.242.0. If this vulnerability is exploited, arbitrary code may be executed on the PC where the product is running by tampering with specific files used on the product. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ricoh.com/products/security/vulnerabilities/vul?id=ricoh-2025-00000
: - CISA ADP Vulnrichment: References: - https://www.ricoh.com/products/security/vulnerabilities/vul?id=ricoh-2025-000005 - https://jvn.jp/en/jp/JVN27937557/
CVE ID: CVE-2025-46784 State: PUBLISHED Published: 2025-11-05T14:56:57.782Z Last Updated: 2025-11-05T22:34:21.323Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Entr'ouvert Products: Lasso Problem Types: CWE-401 Description: A denial of service vulnerability exists in the lasso_node_init_from_message_with_format functionality of Entr&#39;ouvert Lasso 2.5.1. A specially crafted SAML response can lead to a memory depletion, resulting in denial of service. An attacker can send a malformed SAML response to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerabil
Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2025-2195
CVE ID: CVE-2025-46785 State: PUBLISHED Published: 2025-05-14T17:41:06.374Z Last Updated: 2025-05-14T19:00:08.453Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Zoom Communications, Inc Products: Zoom Workplace Apps Problem Types: CWE-120 Description: Buffer over-read in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/zsb-25021
CVE ID: CVE-2025-46786 State: PUBLISHED Published: 2025-05-14T17:42:30.374Z Last Updated: 2025-10-02T20:59:29.011Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Zoom Communications, Inc Products: Zoom Workplace Apps Problem Types: CWE-79 Description: Cross-site scripting in some Zoom Workplace Apps may allow an authenticated user to impact app integrity via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zoom.com/en/trust/security-bulletin/zsb-25022
CVE ID: CVE-2025-46788 State: PUBLISHED Published: 2025-07-10T15:48:04.711Z Last Updated: 2025-07-10T20:17:26.324Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Zoom Communications Inc. Products: Zoom Workplace for Linux Problem Types: CWE-295 Description: Improper certificate validation in Zoom Workplace for Linux before version 6.4.13 may allow an unauthorized user to conduct an information disclosure via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://https://www.zoom.com/en/trust/security-bulletin/zsb-25023/
CVE ID: CVE-2025-46789 State: PUBLISHED Published: 2025-07-10T15:50:54.986Z Last Updated: 2025-07-10T20:17:43.587Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Zoom Communications Inc. Products: Zoom Clients for Windows Problem Types: CWE-120 Description: Classic buffer overflow in certain Zoom Clients for Windows may allow an authorized user to conduct a denial of service via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://https://www.zoom.com/en/trust/security-bulletin/zsb-25024/
CVE ID: CVE-2025-46801 State: PUBLISHED Published: 2025-05-19T07:14:45.304Z Last Updated: 2025-11-03T17:44:50.344Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: PgPool Global Development Group Products: Pgpool-II Problem Types: CWE-305 Description: Pgpool-II provided by PgPool Global Development Group contains an authentication bypass by primary weakness vulnerability. if the vulnerability is exploited, an attacker may be able to log in to the system as an arbitrary user, allowing them to read or tamper with data in the database, and/or disable the database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https:/
disable the database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.pgpool.net/mediawiki/index.php/Main_Page#News - https://jvn.jp/en/jp/JVN06238225/
CVE ID: CVE-2025-46802 State: PUBLISHED Published: 2025-05-26T15:10:38.460Z Last Updated: 2025-05-27T14:11:53.805Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: SUSE Products: SUSE Linux Enterprise Micro 5.3, SUSE Linux Enterprise Micro 5.4, SUSE Linux Enterprise Micro 5.5, SUSE Linux Enterprise Module for Basesystem 15 SP6, SUSE Linux Enterprise Server 15 SP6, SUSE Linux Enterprise Desktop 15 SP6, SUSE Linux Enterprise Server for SAP Applications 15 SP6, SUSE Linux Enterprise High Performance Computing 15 SP6 Description: For a short time they PTY is set to mode 666, allowing any user on the system to connect to the screen session. Additional Analyst Notes:
they PTY is set to mode 666, allowing any user on the system to connect to the screen session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-46802 - https://www.openwall.com/lists/oss-security/2025/05/12/1
CVE ID: CVE-2025-46803 State: PUBLISHED Published: 2025-05-26T15:06:04.339Z Last Updated: 2025-05-27T14:12:42.420Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N) Problem Types: CWE-276 Description: The default mode of pseudo terminals (PTYs) allocated by Screen was changed from 0620 to 0622, thereby allowing anyone to write to any Screen PTYs in the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-46803 - https://www.openwall.com/lists/oss-security/2025/05/12/1
CVE ID: CVE-2025-46804 State: PUBLISHED Published: 2025-05-26T13:31:17.792Z Last Updated: 2025-05-28T13:48:38.991Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Problem Types: CWE-203 Description: A minor information leak when running Screen with setuid-root privileges allows unprivileged users to deduce information about a path that would otherwise not be available. Affected are older Screen versions, as well as version 5.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-46804 - https://www.openwall.com/lists/oss-security/2025/05/12/1
CVE ID: CVE-2025-46805 State: PUBLISHED Published: 2025-05-26T13:16:40.969Z Last Updated: 2025-05-27T14:10:49.034Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Problem Types: CWE-367 Description: Screen version 5.0.0 and older version 4 releases have a TOCTOU race potentially allowing to send SIGHUP, SIGCONT to privileged processes when installed setuid-root. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-46805 - https://www.openwall.com/lists/oss-security/2025/05/12/1
CVE ID: CVE-2025-46806 State: PUBLISHED Published: 2025-06-02T12:11:20.267Z Last Updated: 2025-06-02T16:27:11.300Z Vendors: https://github.com/yrutschle/sslh/releases/tag/v2.2.4 Products: sslh Problem Types: CWE-823 Description: A Use of Out-of-range Pointer Offset vulnerability in sslh leads to denial of service on some architectures.This issue affects sslh before 2.2.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/yrutschle/sslh/releases/tag/v2.2.4 - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-46806
CVE ID: CVE-2025-46807 State: PUBLISHED Published: 2025-06-02T11:29:13.603Z Last Updated: 2025-06-02T16:30:22.046Z Vendors: https://github.com/yrutschle/sslh/releases/tag/v2.2.4 Products: sslh Problem Types: CWE-770 Description: A Allocation of Resources Without Limits or Throttling vulnerability in sslh allows attackers to easily exhaust the file descriptors in sslh and deny legitimate users service.This issue affects sslh before 2.2.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/yrutschle/sslh/releases/tag/v2.2.4 - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-46807
CVE ID: CVE-2025-46809 State: PUBLISHED Published: 2025-07-31T15:24:41.890Z Last Updated: 2025-09-03T07:12:41.584Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: SUSE Products: Container suse/manager/4.3/proxy-httpd:4.3.16.9.67.1, Container suse/manager/5.0/x86_64/proxy-httpd:5.0.5.7.23.1, Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1, Image SLES15-SP4-Manager-Proxy-4-3-BYOS, Image SLES15-SP4-Manager-Proxy-4-3-BYOS-Azure, Image SLES15-SP4-Manager-Proxy-4-3-BYOS-EC2, Image SLES15-SP4-Manager-Proxy-4-3-BYOS-GCE, Image SLES15-SP4-Manager-Server-4-3-BYOS, Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure, Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2, Image
ger-Server-4-3-BYOS, Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure, Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2, Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE, SUSE Manager Proxy Module 4.3, SUSE Manager Server Module 4.3 Problem Types: CWE-256 Description: A Plaintext Storage of a Password vulnerability in SUSE exposes the credentials for the HTTP proxy in the log files. This issue affects Container suse/manager/4.3/proxy-httpd:4.3.16.9.67.1: from ? before 4.3.33-150400.3.55.2; Container suse/manager/5.0/x86_64/proxy-httpd:5.0.5.7.23.1: from ? before 5.0.14-150600.4.17.1; Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1: from ? before 5.0.14-150600.4.17.1; Image SLES15-SP4-Manager-Pro
Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1: from ? before 5.0.14-150600.4.17.1; Image SLES15-SP4-Manager-Proxy-4-3-BYOS: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Proxy-4-3-BYOS-Azure: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Proxy-4-3-BYOS-EC2: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Proxy-4-3-BYOS-GCE: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-G
e SLES15-SP4-Manager-Server-4-3-BYOS-EC2: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE: from ? before 4.3.33-150400.3.55.2; SUSE Manager Proxy Module 4.3: from ? before 4.3.33-150400.3.55.2; SUSE Manager Server Module 4.3: from ? before 4.3.33-150400.3.55.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-46809
CVE ID: CVE-2025-46810 State: PUBLISHED Published: 2025-09-02T11:34:32.138Z Last Updated: 2025-09-03T03:55:31.087Z Vendors: openSUSE Products: Tumbleweed Problem Types: CWE-61 Description: A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of openSUSE Tumbleweed traefik2 allows the traefik user to escalate to root. This issue affects Tumbleweed: from ? before 2.11.29. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=1245204
CVE ID: CVE-2025-46811 State: PUBLISHED Published: 2025-07-30T14:20:53.828Z Last Updated: 2025-09-03T07:03:41.669Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SUSE Products: Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1, Image SLES15-SP4-Manager-Server-4-3-BYOS, Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure, Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2, Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE, SUSE Manager Server Module 4.3 Problem Types: CWE-862 Description: A Missing Authorization vulnerability in SUSE Linux Manager allows anyone with the ability to connect to port 443 of SUSE Manager is able to run any command as root on any client. Th
lows anyone with the ability to connect to port 443 of SUSE Manager is able to run any command as root on any client. This issue affects Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1: from ? before 5.0.27-150600.3.33.1; Image SLES15-SP4-Manager-Server-4-3-BYOS: from ? before 4.3.87-150400.3.110.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure: from ? before 4.3.87-150400.3.110.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2: from ? before 4.3.87-150400.3.110.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE: from ? before 4.3.87-150400.3.110.2; SUSE Manager Server Module 4.3: from ? before 4.3.87-150400.3.110.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://
dule 4.3: from ? before 4.3.87-150400.3.110.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-46811
CVE ID: CVE-2025-46812 State: PUBLISHED Published: 2025-05-08T19:27:22.573Z Last Updated: 2025-05-08T20:00:42.604Z Vendors: basecamp Products: trix Problem Types: CWE-79 Description: Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Versions prior to 2.1.15 are vulnerable to XSS attacks when pasting malicious code. An attacker could trick a user to copy and paste malicious code that would execute arbitrary JavaScript code within the context of the user's session, potentially leading to unauthorized actions being performed or sensitive information being disclosed. This issue has been patched in version 2.1.15. Additional Analyst Notes: - CISA ADP Vulnrichment: Refe
being disclosed. This issue has been patched in version 2.1.15. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/basecamp/trix/security/advisories/GHSA-mcrw-746g-9q8h - https://github.com/basecamp/trix/commit/75226089646841b0f774d8b152e5ec27d2d9e191
CVE ID: CVE-2025-46813 State: PUBLISHED Published: 2025-05-05T20:03:46.289Z Last Updated: 2025-05-06T13:44:48.303Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: discourse Products: discourse Problem Types: CWE-200 Description: Discourse is an open-source community platform. A data leak vulnerability affects sites deployed between commits 10df7fdee060d44accdee7679d66d778d1136510 and 82d84af6b0efbd9fa2aeec3e91ce7be1a768511b. On login-required sites, the leak meant that some content on the site's homepage could be visible to unauthenticated users. Only login-required sites that got deployed during this timeframe are affected, roughly between April 30 2025 noo
users. Only login-required sites that got deployed during this timeframe are affected, roughly between April 30 2025 noon EDT and May 2 2025, noon EDT. Sites on the stable branch are unaffected. Private content on an instance's homepage could be visible to unauthenticated users on login-required sites. Versions of 3.5.0.beta4 after commit 82d84af6b0efbd9fa2aeec3e91ce7be1a768511b are not vulnerable to the issue. No workarounds are available. Sites must upgrade to a non-vulnerable version of Discourse. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-v3h7-c287-pfg9 - https://github.com/discourse/discourse/commit/10
ithub.com/discourse/discourse/security/advisories/GHSA-v3h7-c287-pfg9 - https://github.com/discourse/discourse/commit/10df7fdee060d44accdee7679d66d778d1136510 - https://github.com/discourse/discourse/commit/82d84af6b0efbd9fa2aeec3e91ce7be1a768511b
CVE ID: CVE-2025-46814 State: PUBLISHED Published: 2025-05-06T14:55:48.766Z Last Updated: 2025-05-06T19:51:34.278Z Severity: LOW (CVSS 3.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N) Vendors: rennf93 Products: fastapi-guard Problem Types: CWE-74 Description: FastAPI Guard is a security library for FastAPI that provides middleware to control IPs, log requests, and detect penetration attempts. An HTTP header injection vulnerability has been identified in versions prior to 2.0.0. By manipulating the X-Forwarded-For header, an attacker can potentially inject arbitrary IP addresses into the request. This vulnerability can allow attackers to bypass IP-based access controls, mislead logging syste
esses into the request. This vulnerability can allow attackers to bypass IP-based access controls, mislead logging systems, and impersonate trusted clients. It is especially impactful when the application relies on the X-Forwarded-For header for IP-based authorization or authentication. Users should upgrade to FastAPI Guard version 2.0.0 to receive a fix. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rennf93/fastapi-guard/security/advisories/GHSA-77q8-qmj7-x7pp - https://github.com/rennf93/fastapi-guard/commit/0b003fda4c678c1b514e95f319aee88113e9bf4b
CVE ID: CVE-2025-46815 State: PUBLISHED Published: 2025-05-06T17:13:53.878Z Last Updated: 2025-05-06T18:21:14.384Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: zitadel Products: zitadel Problem Types: CWE-613, CWE-294, CWE-384 Description: The identity infrastructure software ZITADEL offers developers the ability to manage user sessions using the Session API. This API enables the use of IdPs for authentication, known as idp intents. Following a successful idp intent, the client receives an id and token on a predefined URI. These id and token can then be used to authenticate the user or their session. However, prior to versions 3.0.0, 2.71.9, and 2.70.10, it w
can then be used to authenticate the user or their session. However, prior to versions 3.0.0, 2.71.9, and 2.70.10, it was possible to exploit this feature by repeatedly using intents. This allowed an attacker with access to the application’s URI to retrieve the id and token, enabling them to authenticate on behalf of the user. It's important to note that the use of additional factors (MFA) prevents a complete authentication process and, consequently, access to the ZITADEL API. Versions 3.0.0, 2.71.9, and 2.70.10 contain a fix for the issue. No known workarounds other than upgrading are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zitadel/zit
upgrading are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zitadel/zitadel/security/advisories/GHSA-g4r8-mp7g-85fq - https://github.com/zitadel/zitadel/commit/b1e60e7398d677f08b06fd7715227f70b7ca1162 - https://github.com/zitadel/zitadel/releases/tag/v2.70.10 - https://github.com/zitadel/zitadel/releases/tag/v2.71.9 - https://github.com/zitadel/zitadel/releases/tag/v3.0.0
CVE ID: CVE-2025-46816 State: PUBLISHED Published: 2025-05-06T18:41:58.035Z Last Updated: 2025-05-06T19:23:18.087Z Severity: CRITICAL (CVSS 9.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: patrickhener Products: goshs Problem Types: CWE-284, CWE-77 Description: goshs is a SimpleHTTPServer written in Go. Starting in version 0.3.4 and prior to version 1.0.5, running goshs without arguments makes it possible for anyone to execute commands on the server. The function `dispatchReadPump` does not checks the option cli `-c`, thus allowing anyone to execute arbitrary command through the use of websockets. Version 1.0.5 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: Ref
and through the use of websockets. Version 1.0.5 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/patrickhener/goshs/security/advisories/GHSA-rwj2-w85g-5cmm - https://github.com/patrickhener/goshs/commit/160220974576afe5111485b8d12fd36058984cfa
CVE ID: CVE-2025-46817 State: PUBLISHED Published: 2025-10-03T17:52:48.478Z Last Updated: 2025-10-03T18:32:16.521Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: redis Products: redis Problem Types: CWE-190 Description: Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to cause an integer overflow and potentially lead to remote code execution The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/redis/redis/security/advisorie
.2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/redis/redis/security/advisories/GHSA-m8fj-85cg-7vhp - https://github.com/redis/redis/commit/fc9abc775e308374f667fdf3e723ef4b7eb0e3ca - https://github.com/redis/redis/releases/tag/8.2.2
CVE ID: CVE-2025-46818 State: PUBLISHED Published: 2025-10-03T18:38:57.170Z Last Updated: 2025-10-03T19:14:19.668Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: redis Products: redis Problem Types: CWE-94 Description: Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate different LUA objects and potentially run their own code in the context of another user. The problem exists in all versions of Redis with LUA scripting. This issue is fixed in version 8.2.2. A workaround to mitigate the problem without patching the redis-server executable is