Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-54284 State: PUBLISHED Published: 2025-10-14T19:28:25.502Z Last Updated: 2025-10-16T03:56:13.167Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Illustrator Problem Types: CWE-787 Description: Illustrator versions 29.7, 28.7.9 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/illustrator/apsb25-102.html
CVE ID: CVE-2025-54286 State: PUBLISHED Published: 2025-10-02T09:12:49.044Z Last Updated: 2025-10-03T03:55:38.219Z Vendors: Canonical Products: LXD Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) in LXD-UI in Canonical LXD versions >= 5.0 on Linux allows an attacker to create and start container instances without user consent via crafted HTML form submissions exploiting client certificate authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/canonical/lxd/security/advisories/GHSA-p8hw-rfjg-689h
CVE ID: CVE-2025-54287 State: PUBLISHED Published: 2025-10-02T09:16:02.241Z Last Updated: 2025-10-02T13:27:42.957Z Vendors: Canonical Products: LXD Problem Types: CWE-1336 Description: Template Injection in instance snapshot creation component in Canonical LXD (>= 4.0) allows an attacker with instance configuration permissions to read arbitrary files on the host system via specially crafted snapshot pattern templates using the Pongo2 template engine. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/canonical/lxd/security/advisories/GHSA-w2hg-2v4p-vmh6
CVE ID: CVE-2025-54288 State: PUBLISHED Published: 2025-10-02T09:20:33.135Z Last Updated: 2025-10-02T13:22:55.575Z Vendors: Canonical Products: LXD Problem Types: CWE-290 Description: Information Spoofing in devLXD Server in Canonical LXD versions 4.0 and above on Linux container platforms allows attackers with root privileges within any container to impersonate other containers and obtain their metadata, configuration, and device information via spoofed process names in the command line. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/canonical/lxd/security/advisories/GHSA-7232-97c6-j525
CVE ID: CVE-2025-54289 State: PUBLISHED Published: 2025-10-02T09:23:03.238Z Last Updated: 2025-10-03T13:15:54.374Z Vendors: Canonical Products: LXD Problem Types: CWE-1385 Description: Privilege Escalation in operations API in Canonical LXD <6.5 on multiple platforms allows attacker with read permissions to hijack terminal or console sessions and execute arbitrary commands via WebSocket connection hijacking format Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/canonical/lxd/security/advisories/GHSA-3g72-chj4-2228
CVE ID: CVE-2025-54290 State: PUBLISHED Published: 2025-10-02T09:24:12.894Z Last Updated: 2025-10-02T17:31:02.699Z Vendors: Canonical Products: LXD Problem Types: CWE-200 Description: Information disclosure in image export API in Canonical LXD before 6.5 and 5.21.4 on Linux allows network attackers to determine project existence without authentication via crafted requests using wildcard fingerprints. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/canonical/lxd/security/advisories/GHSA-p3x5-mvmp-5f35
CVE ID: CVE-2025-54291 State: PUBLISHED Published: 2025-10-02T09:25:42.466Z Last Updated: 2025-10-02T17:29:54.196Z Vendors: Canonical Products: LXD Problem Types: CWE-209 Description: Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project existence via differing HTTP status code responses. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/canonical/lxd/security/advisories/GHSA-xch9-h8qw-85c7
CVE ID: CVE-2025-54292 State: PUBLISHED Published: 2025-10-02T09:26:39.228Z Last Updated: 2025-10-02T15:53:35.597Z Vendors: Canonical Products: LXD Problem Types: CWE-22 Description: Path traversal in Canonical LXD LXD-UI versions before 6.5 and 5.21.4 on all platforms allows remote authenticated attackers to access or modify unintended resources via crafted resource names embedded in URL paths. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/canonical/lxd/security/advisories/GHSA-7425-4qpj-v4w3
CVE ID: CVE-2025-54293 State: PUBLISHED Published: 2025-10-02T10:43:58.246Z Last Updated: 2025-10-02T15:53:20.364Z Vendors: Canonical Products: LXD Problem Types: CWE-22 Description: Path Traversal in the log file retrieval function in Canonical LXD 5.0 LTS on Linux allows authenticated remote attackers to read arbitrary files on the host system via crafted log file names or symbolic links. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/canonical/lxd/security/advisories/GHSA-472f-vmf2-pr3h
CVE ID: CVE-2025-54294 State: PUBLISHED Published: 2025-07-23T11:15:59.659Z Last Updated: 2025-07-24T04:41:19.427Z Vendors: stackideas.com Products: Komento component for Joomla Problem Types: CWE-89 Description: A SQLi vulnerability in Komento component 4.0.0-4.0.7for Joomla was discovered. The issue allows unprivileged users to execute arbitrary SQL commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://stackideas.com/
CVE ID: CVE-2025-54295 State: PUBLISHED Published: 2025-07-23T11:15:23.575Z Last Updated: 2025-07-24T04:41:14.871Z Vendors: dj-extensions.com Products: DJ-Reviews component for Joomla Problem Types: CWE-79 Description: A Reflected XSS vulnerability in DJ-Reviews component 1.0-1.3.6 for Joomla was discovered. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://dj-extensions.com/
CVE ID: CVE-2025-54296 State: PUBLISHED Published: 2025-07-23T11:15:01.946Z Last Updated: 2025-07-24T04:41:12.334Z Vendors: mooj.org Products: ProFiles component for Joomla Problem Types: CWE-79 Description: A stored XSS vulnerability in ProFiles component 1.0-1.5.0 for Joomla was discovered. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mooj.org/
CVE ID: CVE-2025-54297 State: PUBLISHED Published: 2025-07-23T11:16:12.527Z Last Updated: 2025-07-24T04:41:21.065Z Vendors: compojoom.com Products: CComment component for Joomla Problem Types: CWE-79 Description: A stored XSS vulnerability in CComment component 5.0.0-6.1.14 for Joomla was discovered. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://compojoom.com/
CVE ID: CVE-2025-54298 State: PUBLISHED Published: 2025-07-28T17:29:32.441Z Last Updated: 2025-07-31T16:18:02.912Z Vendors: firecoders.com Products: CommentBox component for Joomla Problem Types: CWE-79 Description: A stored XSS vulnerability in CommentBox component 1.0.0-1.1.0 for Joomla was discovered. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://firecoders.com/
CVE ID: CVE-2025-54299 State: PUBLISHED Published: 2025-07-28T17:30:00.460Z Last Updated: 2025-08-05T04:44:35.757Z Vendors: nobossextensions.com Products: No Boss Testimonials component for Joomla Problem Types: CWE-79 Description: A stored XSS vulnerability in No Boss Testimonials component 1.0.0-3.0.0 and 4.0.0-4.0.2 for Joomla was discovered. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://nobossextensions.com/
CVE ID: CVE-2025-54300 State: PUBLISHED Published: 2025-08-25T06:54:47.229Z Last Updated: 2025-08-25T13:49:11.336Z Vendors: norrnext.com Products: Quantum Mamanger component for Joomla Problem Types: CWE-79 Description: A stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for Joomla was discovered. The SVG upload feature does not sanitize uploads. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://norrnext.com/
CVE ID: CVE-2025-54301 State: PUBLISHED Published: 2025-08-25T06:54:43.633Z Last Updated: 2025-08-25T13:52:39.469Z Vendors: norrnext.com Products: Quantum Mamanger component for Joomla Problem Types: CWE-79 Description: A stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for Joomla was discovered. File names are not properly escaped. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://norrnext.com/
CVE ID: CVE-2025-54309 State: PUBLISHED Published: 2025-07-18T00:00:00.000Z Last Updated: 2025-10-21T22:45:21.853Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: CrushFTP Products: CrushFTP Problem Types: CWE-420 Description: CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CompromiseJuly2025 - https://www.rapid7.com/blog/post/crushftp-zero-day-exploited-in-the-wil
m/crush11wiki/Wiki.jsp?page=CompromiseJuly2025 - https://www.rapid7.com/blog/post/crushftp-zero-day-exploited-in-the-wild/ - https://www.bleepingcomputer.com/news/security/crushftp-zero-day-exploited-in-attacks-to-gain-admin-access-on-servers/ - https://www.vicarius.io/vsociety/posts/cve-2025-54309-detect-crushftp-vulnerability - https://www.vicarius.io/vsociety/posts/cve-2025-54309-mitigate-crushftp-vulnerability
CVE ID: CVE-2025-54310 State: PUBLISHED Published: 2025-07-18T00:00:00.000Z Last Updated: 2025-07-22T15:01:34.591Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: qBittorrent Products: qBittorrent Problem Types: CWE-669 Description: qBittorrent before 5.1.2 does not prevent access to a local file that is referenced in a link URL. This affects rsswidget.cpp and searchjobwidget.cpp. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qbittorrent.org/news#wed-jul-02nd-2025---qbittorrent-v5.1.2-release - https://github.com/qbittorrent/qBittorrent/commit/6ad073e0bc26c1f9d3530490ece611b49f5bfcab - https://github.com/qbittorrent/qBittorrent/c
m/qbittorrent/qBittorrent/commit/6ad073e0bc26c1f9d3530490ece611b49f5bfcab - https://github.com/qbittorrent/qBittorrent/commit/ad68813fe879ba245a4f41f105ed8d2114a92971
CVE ID: CVE-2025-54313 State: PUBLISHED Published: 2025-07-19T00:00:00.000Z Last Updated: 2025-07-23T15:16:25.225Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N) Vendors: prettier Products: eslint-config-prettier Problem Types: CWE-506 Description: eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://socket.dev/blog/npm-phishing-campaign-leads-to-prettier-tooling-packages-compromise - https://www.bleep
ences: - https://socket.dev/blog/npm-phishing-campaign-leads-to-prettier-tooling-packages-compromise - https://www.bleepingcomputer.com/news/security/popular-npm-linter-packages-hijacked-via-phishing-to-drop-malware/ - https://github.com/prettier/eslint-config-prettier/issues/339 - https://www.npmjs.com/package/eslint-config-prettier?activeTab=versions - https://www.stepsecurity.io/blog/supply-chain-security-alert-eslint-config-prettier-package-shows-signs-of-compromise - https://news.ycombinator.com/item?id=44609732 - https://news.ycombinator.com/item?id=44608811
CVE ID: CVE-2025-54314 State: PUBLISHED Published: 2025-07-20T00:00:00.000Z Last Updated: 2025-08-10T00:19:19.943Z Severity: LOW (CVSS 2.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N) Vendors: rubyonrails Products: Thor Problem Types: CWE-78 Description: Thor before 1.4.0 can construct an unsafe shell command from library input. NOTE: this is disputed by the Supplier because "the method that was fixed can only be used with arguments that are controlled by Thor, and there is no way an attacker can take control of those arguments." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rails/thor/commit/536b79036a0efb765c1899233412e7b1ca94abfa - https://hackerone.
chment: References: - https://github.com/rails/thor/commit/536b79036a0efb765c1899233412e7b1ca94abfa - https://hackerone.com/reports/3260153 - https://github.com/rails/thor/pull/897 - https://github.com/rails/thor/releases/tag/v1.4.0 - https://github.com/github/advisory-database/pull/5912#issuecomment-3169255309
CVE ID: CVE-2025-54315 State: PUBLISHED Published: 2025-10-02T00:00:00.000Z Last Updated: 2025-10-02T19:33:55.972Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:L) Vendors: Matrix Products: Matrix specification Problem Types: CWE-837 Description: The Matrix specification before 1.16 (i.e., with a room version before 12) lacks create event uniqueness. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/matrix-org/matrix-spec/releases/tag/v1.16 - https://matrix.org/blog/2025/08/project-hydra-improving-state-res/
CVE ID: CVE-2025-54316 State: PUBLISHED Published: 2025-07-20T00:00:00.000Z Last Updated: 2025-07-30T15:48:29.616Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Logpoint Products: Logpoint Problem Types: CWE-79 Description: An issue was discovered in Logpoint before 7.6.0. When creating reports, attackers can create custom Jinja templates that chained built-in filter functions to generate XSS payloads. These payloads can be rendered by the Logpoint Report Template engine, making it vulnerable to cross-site scripting (XSS) attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://servicedesk.logpoint.com/hc/en-us/articles/28685383084
nal Analyst Notes: - CISA ADP Vulnrichment: References: - https://servicedesk.logpoint.com/hc/en-us/articles/28685383084317-XSS-vulnerability-in-Report-Templates-using-built-in-Jinja-filter-functions - https://servicedesk.logpoint.com/hc/en-us/sections/7201103730845-Product-Security
CVE ID: CVE-2025-54317 State: PUBLISHED Published: 2025-07-20T00:00:00.000Z Last Updated: 2025-07-30T15:48:58.857Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: Logpoint Products: Logpoint Problem Types: CWE-23 Description: An issue was discovered in Logpoint before 7.6.0. An attacker with operator privileges can exploit a path traversal vulnerability when creating a Layout Template, which can lead to remote code execution (RCE). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://servicedesk.logpoint.com/hc/en-us/articles/28685507675549-Path-Traversal-in-Layout-Templates-Allows-Remote-Code-Execution - https://servicedesk.logpoint.com/hc
les/28685507675549-Path-Traversal-in-Layout-Templates-Allows-Remote-Code-Execution - https://servicedesk.logpoint.com/hc/en-us/sections/7201103730845-Product-Security
CVE ID: CVE-2025-54319 State: PUBLISHED Published: 2025-07-20T00:00:00.000Z Last Updated: 2025-07-22T14:21:05.539Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Westermo Products: WeOS Problem Types: CWE-532 Description: An issue was discovered in Westermo WeOS 5 (5.24 through 5.24.4). A threat actor potentially can gain unauthorized access to sensitive information via system logging information (syslog verbose logging that includes credentials). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.westermo.com/-/media/Files/Cyber-security/westermo_sa_25-08_sensitive_information_in_logging.pdf?rev=40c4e78bd1524f639a89cd1b005e0f23&ha
edia/Files/Cyber-security/westermo_sa_25-08_sensitive_information_in_logging.pdf?rev=40c4e78bd1524f639a89cd1b005e0f23&hash=64987A18FFECA633F23DB11FE5EAFA9A - https://www.westermo.com/uk/support/security-advisories
CVE ID: CVE-2025-54320 State: PUBLISHED Published: 2025-11-18T00:00:00.000Z Last Updated: 2025-11-19T13:32:35.878Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Ascertia SigningHub through 8.6.8, there is a lack of rate limiting on the invite user function, leading to an email bombing vulnerability. An authenticated attacker can exploit this by automating invite requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ascertia.com/company/vulnerability-disclosure-policy/ - https://github.com/saykino/CVE-2025-54320
CVE ID: CVE-2025-54321 State: PUBLISHED Published: 2025-11-18T00:00:00.000Z Last Updated: 2025-11-19T16:49:48.558Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Ascertia SigningHub through 8.6.8, there is a lack of rate limiting on the reset password function, leading to an email bombing vulnerability. An authenticated attacker can exploit this by automating reset password requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ascertia.com/company/vulnerability-disclosure-policy/ - https://github.com/saykino/CVE-2025-54321
CVE ID: CVE-2025-54323 State: PUBLISHED Published: 2025-11-04T00:00:00.000Z Last Updated: 2025-11-04T20:27:01.989Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the camera in Samsung Mobile Processor Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, and 1580. Improper debug printing leads to information leakage. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-54323/
CVE ID: CVE-2025-54325 State: PUBLISHED Published: 2025-11-04T00:00:00.000Z Last Updated: 2025-11-04T20:36:14.961Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in VTS in Samsung Mobile Processor and Wearable Processor Exynos 1080, 1280, 2200, 1380, 1480, 2400, 1580, 2500, W920, W930, W1000. A race condition in the VTS driver results in an out-of-bounds read, leading to an information leak. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-54325/
CVE ID: CVE-2025-54327 State: PUBLISHED Published: 2025-11-04T00:00:00.000Z Last Updated: 2025-11-04T21:23:00.335Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in VTS in Samsung Mobile Processor and Wearable Processor Exynos 1280, 2200, 1380, W920, W930, W1000. Improper input validation in the VTS driver leads to an arbitrary write. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-54327/
CVE ID: CVE-2025-54329 State: PUBLISHED Published: 2025-11-04T00:00:00.000Z Last Updated: 2025-11-04T16:58:31.436Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in NAS in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, W920, W930, W1000, Modem 5123, Modem 5300, and Modem 5400. The function used to send a multiple-payloads message (including an SMS message) lacks bounds checking, which can lead to a heap overflow. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://sem
ichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-54329/
CVE ID: CVE-2025-54330 State: PUBLISHED Published: 2025-11-04T00:00:00.000Z Last Updated: 2025-11-05T19:54:36.141Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in NPU in Samsung Mobile Processor Exynos 1380 through July 2025. There is an Out-of-bounds Read of q->bufs[] in the __is_done_for_me function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-54330/
CVE ID: CVE-2025-54331 State: PUBLISHED Published: 2025-11-04T00:00:00.000Z Last Updated: 2025-11-05T19:57:07.265Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in NPU in Samsung Mobile Processor Exynos 1380 through July 2025. There is an Untrusted Pointer Dereference of src_hdr in the copy_ncp_header function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-54331/
CVE ID: CVE-2025-54332 State: PUBLISHED Published: 2025-11-04T00:00:00.000Z Last Updated: 2025-11-05T19:59:59.474Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in NPU in Samsung Mobile Processor Exynos 1380 through July 2025. There is a NULL Pointer Dereference of profiler.node in the npu_vertex_profileoff function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-54332/
CVE ID: CVE-2025-54333 State: PUBLISHED Published: 2025-11-04T00:00:00.000Z Last Updated: 2025-11-05T20:02:17.865Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in NPU in Samsung Mobile Processor Exynos 1380 through July 2025. There is an Invalid Pointer Dereference of node in the get_vs4l_profiler_node function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-54333/
CVE ID: CVE-2025-54334 State: PUBLISHED Published: 2025-11-04T00:00:00.000Z Last Updated: 2025-11-04T20:38:20.142Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the NPU driver in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500. There is a NULL Pointer Dereference of hdev in the __npu_vertex_bootup function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-54334/
CVE ID: CVE-2025-54335 State: PUBLISHED Published: 2025-11-04T00:00:00.000Z Last Updated: 2025-11-04T21:27:24.521Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the GPU driver in Samsung Mobile Processor Exynos 1480, 2400, 1580, 2500. There is a use-after-free in the Xclipse GPU Driver. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-54335/
CVE ID: CVE-2025-54336 State: PUBLISHED Published: 2025-08-19T00:00:00.000Z Last Updated: 2025-08-29T15:10:56.485Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Plesk Obsidian 18.0.70, _isAdminPasswordValid uses an == comparison. Thus, if the correct password is "0e" followed by any digit string, then an attacker can login with any other string that evaluates to 0.0 (such as the 0e0 string). This occurs in admin/plib/LoginManager.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.plesk.com/blog/plesk-news-announcements/introducing-plesk-obsidian-18-0-70-anniversary-edition/ - https://support.plesk.com/hc/en-us/articles/33785727869847-Vulnerabili