Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-62661 State: PUBLISHED Published: 2025-10-21T19:33:26.399Z Last Updated: 2025-10-21T19:51:42.777Z Vendors: The Wikimedia Foundation Products: Mediawiki - Thanks Extension, Mediawiki - Growth Experiments Extension Problem Types: CWE-276 Description: Incorrect Default Permissions vulnerability in The Wikimedia Foundation Mediawiki - Thanks Extension, Mediawiki - Growth Experiments Extension allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Mediawiki - Thanks Extension, Mediawiki - Growth Experiments Extension: from 1.43 before 1.44. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T397497 - http
1.44. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T397497 - https://gerrit.wikimedia.org/r/q/Idbc1b5a288ffaa7074eedcbac066358a8ec649dc - https://gerrit.wikimedia.org/r/q/Ia584966bb7d4d707eef50529293aa3d468470f18
CVE ID: CVE-2025-62662 State: PUBLISHED Published: 2025-10-18T04:19:31.193Z Last Updated: 2025-10-20T16:31:09.792Z Vendors: The Wikimedia Foundation Products: Mediawiki - AdvancedSearch Extension Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - AdvancedSearch Extension allows Stored XSS.This issue affects Mediawiki - AdvancedSearch Extension: from master before 1.39. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T402146 - https://gerrit.wikimedia.org/r/q/I91bba2b570643ef74e6c210e7250e05cd2aa388e
CVE ID: CVE-2025-62663 State: PUBLISHED Published: 2025-10-18T04:16:00.908Z Last Updated: 2025-10-20T16:31:44.248Z Vendors: The Wikimedia Foundation Products: Mediawiki - UploadWizard Extension Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - UploadWizard Extension allows Stored XSS.This issue affects Mediawiki - UploadWizard Extension: from master before 1.39. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T402095 - https://gerrit.wikimedia.org/r/q/I37ea7c8825e9de776e207b3919b451ba2b905369
CVE ID: CVE-2025-62664 State: PUBLISHED Published: 2025-10-18T04:13:27.379Z Last Updated: 2025-10-20T16:01:31.862Z Vendors: The Wikimedia Foundation Products: Mediawiki - ImageRating Extension Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - ImageRating Extension allows Stored XSS.This issue affects Mediawiki - ImageRating Extension: from master before 1.39. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T402002 - https://gerrit.wikimedia.org/r/q/Ie42bba0d80bace319cf88d71233db1f598ac613b
CVE ID: CVE-2025-62665 State: PUBLISHED Published: 2025-10-18T04:10:27.081Z Last Updated: 2025-10-20T16:01:06.277Z Vendors: Wikimedia Foundation Products: Mediawiki - Skin:BlueSky Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Skin:BlueSky allows Stored XSS.This issue affects Mediawiki - Skin:BlueSky: from master before 1.39. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T401046 - https://gerrit.wikimedia.org/r/q/I64c9e2983ed6629505f72ef9449c09137b3c69ae
CVE ID: CVE-2025-62666 State: PUBLISHED Published: 2025-10-18T04:47:52.437Z Last Updated: 2025-10-20T16:02:54.874Z Vendors: The Wikimedia Foundation Products: Mediawiki - CirrusSearch Extension Problem Types: CWE-770 Description: Allocation of Resources Without Limits or Throttling vulnerability in The Wikimedia Foundation Mediawiki - CirrusSearch Extension allows HTTP DoS.This issue affects Mediawiki - CirrusSearch Extension: from master before 1.43. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gerrit.wikimedia.org/r/q/I3e8d819868c0491b18368af8e543180e747023c2 - https://phabricator.wikimedia.org/T401220
CVE ID: CVE-2025-62667 State: PUBLISHED Published: 2025-10-18T04:42:30.610Z Last Updated: 2025-10-20T16:02:21.267Z Vendors: The Wikimedia Foundation Products: Mediawiki - GrowthExperiments Extension Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments Extension allows Stored XSS.This issue affects Mediawiki - GrowthExperiments Extension: from master before 1.39. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T402698 - https://gerrit.wikimedia.org/r/q/Iafd0acccf9a5c20d9e955d7bc3de1304968401ec
CVE ID: CVE-2025-62668 State: PUBLISHED Published: 2025-10-18T04:39:28.390Z Last Updated: 2025-10-20T16:27:08.378Z Vendors: The Wikimedia Foundation Products: Mediawiki - GrowthExperiments Extension Problem Types: CWE-276 Description: Incorrect Default Permissions vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments Extension allows Resource Leak Exposure.This issue affects Mediawiki - GrowthExperiments Extension: from master before 1.39. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T402600 - https://gerrit.wikimedia.org/r/q/I29a18dbbaf7e2ce2a713233dbc6880032fec3628
CVE ID: CVE-2025-62669 State: PUBLISHED Published: 2025-10-18T04:34:34.614Z Last Updated: 2025-10-20T16:28:10.550Z Vendors: The Wikimedia Foundation Products: Mediawiki - CentralAuth Extension Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth Extension allows Resource Leak Exposure.This issue affects Mediawiki - CentralAuth Extension: from master before 1.39. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T400892 - https://gerrit.wikimedia.org/r/q/I15b14cbff28ba769e72e4d037306d2395e74ad85
CVE ID: CVE-2025-62670 State: PUBLISHED Published: 2025-10-18T04:29:48.409Z Last Updated: 2025-10-20T16:29:12.204Z Vendors: The Wikimedia Foundation Products: Mediawiki - FlexDiagrams Extension Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - FlexDiagrams Extension allows Stored XSS.This issue affects Mediawiki - FlexDiagrams Extension: master. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gerrit.wikimedia.org/r/c/mediawiki/extensions/FlexDiagrams/+/1179692 - https://phabricator.wikimedia.org/T402149
CVE ID: CVE-2025-62671 State: PUBLISHED Published: 2025-10-18T04:24:35.915Z Last Updated: 2025-10-20T16:30:37.642Z Vendors: The Wikimedia Foundation Products: Mediawiki - Cargo Extension Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: master. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T402147 - https://gerrit.wikimedia.org/r/1179707
CVE ID: CVE-2025-62672 State: PUBLISHED Published: 2025-10-19T00:00:00.000Z Last Updated: 2025-10-20T15:54:26.396Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: boyns Products: rplay Problem Types: CWE-770 Description: rplay through 3.3.2 allows attackers to cause a denial of service (SIGSEGV and daemon crash) or possibly have unspecified other impact. This occurs in memcpy in the RPLAY_DATA case in rplay_unpack in librplay/rplay.c, potentially reachable via packet data with no authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.openwall.com/lists/oss-security/2025/10/18/4 - https://salsa.debian.org/alteholz/rplay -
ment: References: - https://www.openwall.com/lists/oss-security/2025/10/18/4 - https://salsa.debian.org/alteholz/rplay - https://web.archive.org/web/20171109100411/http://rplay.doit.org
CVE ID: CVE-2025-62674 State: PUBLISHED Published: 2025-11-20T20:37:27.482Z Last Updated: 2025-11-21T16:02:31.684Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) Vendors: iCam365 Products: P201, QC021 Problem Types: CWE-306 Description: The affected product allows unauthenticated access to Real Time Streaming Protocol (RTSP) services, which may allow an attacker unauthorized access to camera configuration information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-324-02 - https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-324-02.json - https://icam365.net/en/aboutUs
tps://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-324-02.json - https://icam365.net/en/aboutUs/
CVE ID: CVE-2025-62677 State: REJECTED Published: N/A Last Updated: 2025-10-21T02:55:08.247Z Description: No description available.
CVE ID: CVE-2025-62678 State: REJECTED Published: N/A Last Updated: 2025-10-21T02:55:07.762Z Description: No description available.
CVE ID: CVE-2025-62679 State: REJECTED Published: N/A Last Updated: 2025-10-21T02:55:07.310Z Description: No description available.
CVE ID: CVE-2025-62680 State: REJECTED Published: N/A Last Updated: 2025-10-21T02:55:06.837Z Description: No description available.
CVE ID: CVE-2025-62681 State: REJECTED Published: N/A Last Updated: 2025-10-21T02:55:06.367Z Description: No description available.
CVE ID: CVE-2025-62682 State: REJECTED Published: N/A Last Updated: 2025-10-21T02:55:05.898Z Description: No description available.
CVE ID: CVE-2025-62683 State: REJECTED Published: N/A Last Updated: 2025-10-21T02:55:05.353Z Description: No description available.
CVE ID: CVE-2025-62684 State: REJECTED Published: N/A Last Updated: 2025-10-21T02:55:04.789Z Description: No description available.
CVE ID: CVE-2025-62687 State: PUBLISHED Published: 2025-11-21T06:17:59.189Z Last Updated: 2025-11-21T14:58:03.683Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: LogStare Inc. Products: LogStare Collector (for Windows), LogStare Collector (for Linux) Problem Types: CWE-352 Description: Cross-site request forgery vulnerability exists in LogStare Collector. If a user views a crafted page while logged, unintended operations may be performed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.logstare.com/vulnerability/2025-001/ - https://jvn.jp/en/jp/JVN77560819/
CVE ID: CVE-2025-62688 State: PUBLISHED Published: 2025-10-23T21:58:16.532Z Last Updated: 2025-10-24T14:32:15.375Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: AutomationDirect Products: Productivity Suite, Productivity 3000 P3-622 CPU, Productivity 3000 P3-550E CPU, Productivity 3000 P3-530 CPU, Productivity 2000 P2-622 CPU, Productivity 2000 P2-550 CPU, Productivity 1000 P1-550 CPU, Productivity 1000 P1-540 CPU Problem Types: CWE-732 Description: An incorrect permission assignment for a critical resource vulnerability was discovered in Productivity Suite software version 4.4.1.19. The vulnerability allows an attacker with low-privileged credentials to cha
roductivity Suite software version 4.4.1.19. The vulnerability allows an attacker with low-privileged credentials to change their role, gaining full control access to the project. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-296-01 - https://www.automationdirect.com/support/software-downloads - https://support.automationdirect.com/docs/securityconsiderations.pdf - https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-296-01.json
CVE ID: CVE-2025-62689 State: PUBLISHED Published: 2025-11-10T04:10:57.970Z Last Updated: 2025-11-14T18:01:56.011Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: GNU Project Products: GNU libbmicrohttpd Problem Types: CWE-122 Description: NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The vulnerability was fixed in commit ff13abc on the master branch of the libmicrohttpd Git repository, after the v1.0.2 tag. A specially crafted packet sent by an attacker could cause a denial-of-service (DoS) condition. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gnu.org/software/libmicrohttpd/ - https://
CVE ID: CVE-2025-62691 State: PUBLISHED Published: 2025-11-25T07:21:02.412Z Last Updated: 2025-11-25T07:21:02.412Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Intercom, Inc. Products: Security Point (Windows) of MaLion, Security Point (Windows) of MaLionCloud Problem Types: CWE-121 Description: Security Point (Windows) of MaLion and MaLionCloud contains a stack-based buffer overflow vulnerability in processing HTTP headers. Receiving a specially crafted request from a remote unauthenticated attacker could lead to arbitrary code execution with SYSTEM privilege. References: - https://www.intercom.co.jp/information/2025/1125.html - https://jvn.jp/en/jp/JV
ion with SYSTEM privilege. References: - https://www.intercom.co.jp/information/2025/1125.html - https://jvn.jp/en/jp/JVN76298784/
CVE ID: CVE-2025-62693 State: PUBLISHED Published: 2025-10-20T17:51:29.226Z Last Updated: 2025-10-20T20:25:20.263Z Vendors: The Wikimedia Foundation Products: Mediawiki - LastModified Extension Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - LastModified Extension allows Stored XSS.This issue affects Mediawiki - LastModified Extension: from master before 1.39. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T399583 - https://gerrit.wikimedia.org/r/q/Ia406630dbac5ef9a9aed3f402f0ba6e434a6bcf2
CVE ID: CVE-2025-62694 State: PUBLISHED Published: 2025-10-21T04:28:14.618Z Last Updated: 2025-10-21T19:49:02.351Z Vendors: The Wikimedia Foundation Products: Mediawiki - WikiLove Extension Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - WikiLove Extension allows Stored XSS.This issue affects Mediawiki - WikiLove Extension: 1.39. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T400525 - https://gerrit.wikimedia.org/r/c/1191439 - https://gerrit.wikimedia.org/r/q/I17fc061112f61b4c37b772410b265df060819416
CVE ID: CVE-2025-62695 State: PUBLISHED Published: 2025-10-21T04:02:00.666Z Last Updated: 2025-10-21T14:08:56.363Z Vendors: The Wikimedia Foundation Products: Mediawiki - WikiLambda Extension Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension allows Stored XSS.This issue affects Mediawiki - WikiLambda Extension: master. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T400500 - https://gerrit.wikimedia.org/r/c/mediawiki/extensions/WikiLambda/+/1173952
CVE ID: CVE-2025-62696 State: PUBLISHED Published: 2025-10-21T03:58:05.542Z Last Updated: 2025-10-21T14:09:02.070Z Vendors: The Wikimedia Foundation Products: Mediawiki Foundation - Springboard Extension Problem Types: CWE-77 Description: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in The Wikimedia Foundation Mediawiki Foundation - Springboard Extension allows Command Injection.This issue affects Mediawiki Foundation - Springboard Extension: master. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T400422 - https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Springboard/+/1174003
CVE ID: CVE-2025-62697 State: PUBLISHED Published: 2025-10-20T19:27:03.654Z Last Updated: 2025-10-20T19:38:21.714Z Vendors: The Wikimedia Foundation Products: Mediawiki - LanguageSelector Extension Problem Types: CWE-74 Description: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in The Wikimedia Foundation Mediawiki - LanguageSelector Extension allows Code Injection.This issue affects Mediawiki - LanguageSelector Extension: from master before 1.39. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gerrit.wikimedia.org/r/q/I338288e756de4e58a3f1f02a9c205b37f4927935 - https://phabricator.wikimedia.org/T3997
: - https://gerrit.wikimedia.org/r/q/I338288e756de4e58a3f1f02a9c205b37f4927935 - https://phabricator.wikimedia.org/T399724
CVE ID: CVE-2025-62698 State: PUBLISHED Published: 2025-10-20T18:07:45.699Z Last Updated: 2025-10-20T18:27:23.705Z Vendors: The Wikimedia Foundation Products: Mediawiki - ExternalGuidance Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - ExternalGuidance allows Stored XSS.This issue affects Mediawiki - ExternalGuidance: from master before 1.39. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gerrit.wikimedia.org/r/q/I8bfb3c2766982f6633f47ed35720d4d9f51da71d - https://phabricator.wikimedia.org/T399662
CVE ID: CVE-2025-62699 State: PUBLISHED Published: 2025-10-21T03:48:50.423Z Last Updated: 2025-10-21T19:22:21.373Z Vendors: The Wikimedia Foundation Products: Mediawiki - Translate Extension Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - Translate Extension allows Footprinting. Translate extension appears to use jobs to make edits to translation pages. This causes the CheckUser tool to log the wrong IP and User-Agent making these edits un-auditable via the CheckUser tool.This issue affects Mediawiki - Translate Extension: from master before 1.39. Additional Analyst Notes: - CISA ADP Vulnrich
is issue affects Mediawiki - Translate Extension: from master before 1.39. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T399627 - https://gerrit.wikimedia.org/r/q/Idac164418362c65d0ad37055fe9e0ad134197da3 - https://gerrit.wikimedia.org/r/q/I65c740c8ca5130b40463d687e2f0775951abbf22
CVE ID: CVE-2025-62700 State: PUBLISHED Published: 2025-10-20T17:53:52.683Z Last Updated: 2025-10-20T20:26:50.425Z Vendors: The Wikimedia Foundation Products: Mediawiki - MultiBoilerplate Extensionmaste Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - MultiBoilerplate Extensionmaste allows Stored XSS.This issue affects Mediawiki - MultiBoilerplate Extensionmaste: from master before 1.39. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T399658 - https://gerrit.wikimedia.org/r/q/I10e205e3027d4772b2cd9801647fc6c171
nces: - https://phabricator.wikimedia.org/T399658 - https://gerrit.wikimedia.org/r/q/I10e205e3027d4772b2cd9801647fc6c171e4b35b
CVE ID: CVE-2025-62701 State: PUBLISHED Published: 2025-10-21T04:45:05.263Z Last Updated: 2025-10-21T14:08:40.141Z Vendors: The Wikimedia Foundation Products: Mediawiki - Wikistories Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Wikistories allows Stored XSS.This issue affects Mediawiki - Wikistories: from master before 1.44. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T400545 - https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Wikistories/+/1189218
CVE ID: CVE-2025-62702 State: PUBLISHED Published: 2025-10-21T04:42:28.217Z Last Updated: 2025-10-21T14:08:45.483Z Vendors: The Wikimedia Foundation Products: Mediawiki - PageTriage Extension Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - PageTriage Extension allows Stored XSS.This issue affects Mediawiki - PageTriage Extension: from master before 1.44. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T400526 - https://gerrit.wikimedia.org/r/q/I86c5f17364c7351e7c06ce4cc6e5592467bc8dc3
CVE ID: CVE-2025-62705 State: PUBLISHED Published: 2025-10-22T21:23:51.631Z Last Updated: 2025-10-23T15:48:48.248Z Vendors: openbao Products: openbao Problem Types: CWE-532 Description: OpenBao is an open source identity-based secrets management system. Prior to version 2.4.2, OpenBao's audit log did not appropriately redact fields when relevant subsystems sent []byte response parameters rather than strings. This includes, but is not limited to sys/raw with use of encoding=base64, all data would be emitted unredacted to the audit log, and Transit, when performing a signing operation with a derived Ed25519 key, would emit public keys to the audit log. This issue has been patched in OpenBao 2.
operation with a derived Ed25519 key, would emit public keys to the audit log. This issue has been patched in OpenBao 2.4.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/openbao/openbao/security/advisories/GHSA-rc54-2g2c-g36g - https://github.com/openbao/openbao/commit/cc2c476bac66e1d94776c2629793daec3af625f8
CVE ID: CVE-2025-62706 State: PUBLISHED Published: 2025-10-22T21:31:10.997Z Last Updated: 2025-11-03T17:45:27.594Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: authlib Products: authlib Problem Types: CWE-400, CWE-770 Description: Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.5, Authlib’s JWE zip=DEF path performs unbounded DEFLATE decompression. A very small ciphertext can expand into tens or hundreds of megabytes on decrypt, allowing an attacker who can supply decryptable tokens to exhaust memory and CPU and cause denial of service. This issue has been patched in version 1.6.5. Workarounds for this issue
ust memory and CPU and cause denial of service. This issue has been patched in version 1.6.5. Workarounds for this issue involve rejecting or stripping zip=DEF for inbound JWEs at the application boundary, forking and add a bounded decompression guard via decompressobj().decompress(data, MAX_SIZE)) and returning an error when output exceeds a safe limit, or enforcing strict maximum token sizes and fail fast on oversized inputs; combine with rate limiting. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/authlib/authlib/security/advisories/GHSA-g7f3-828f-7h7m - https://github.com/authlib/authlib/commit/e0863d5129316b1790eee5f14cece32
hlib/security/advisories/GHSA-g7f3-828f-7h7m - https://github.com/authlib/authlib/commit/e0863d5129316b1790eee5f14cece32a03b8184d
CVE ID: CVE-2025-62707 State: PUBLISHED Published: 2025-10-22T21:36:32.754Z Last Updated: 2025-10-23T15:41:41.081Z Vendors: py-pdf Products: pypdf Problem Types: CWE-834 Description: pypdf is a free and open-source pure-python PDF library. Prior to version 6.1.3, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page which has an inline image using the DCTDecode filter. This has been fixed in pypdf version 6.1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/py-pdf/pypdf/security/advisories/GHSA-vr63-x8vc-m265 - https://github.com/py-pdf/pypdf/pull/3501 - https://github.