Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
wordpress-suretriggers-1-0-82-privilege-escalation-vulnerability?_s_id=cve - https://patchstack.com/articles/additional-critical-ottokit-formerly-suretriggers-vulnerability-patched?_s_id=cve
CVE ID: CVE-2025-27008 State: PUBLISHED Published: 2025-04-15T21:53:13.855Z Last Updated: 2025-04-16T15:05:39.796Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: NotFound Products: Unlimited Timeline Problem Types: CWE-862 Description: Missing Authorization vulnerability in NotFound Unlimited Timeline allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Unlimited Timeline: from n/a through n/a. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/unlimited-timeline/vulnerability/wordpress-unlimited-timeline-1-6-1-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-27009 State: PUBLISHED Published: 2025-04-14T11:05:34.699Z Last Updated: 2025-04-14T11:52:37.540Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: wphocus Products: My auctions allegro Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in wphocus My auctions allegro allows Stored XSS.This issue affects My auctions allegro: from n/a through 3.6.20. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/my-auctions-allegro-free-edition/vulnerability/wordpress-my-auctions-allegro-plugin-3-6-20-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-27010 State: PUBLISHED Published: 2025-05-19T18:08:53.393Z Last Updated: 2025-05-19T19:01:15.335Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: bslthemes Products: Tastyc Problem Types: CWE-35 Description: Path Traversal: '.../...//' vulnerability in bslthemes Tastyc allows PHP Local File Inclusion.This issue affects Tastyc: from n/a before 2.5.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/tastyc/vulnerability/wordpress-tastyc-2-5-2-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-27011 State: PUBLISHED Published: 2025-04-15T21:53:14.148Z Last Updated: 2025-04-16T15:05:28.215Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: magepeopleteam Products: Booking and Rental Manager Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magepeopleteam Booking and Rental Manager allows PHP Local File Inclusion. This issue affects Booking and Rental Manager: from n/a through 2.2.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/booking-and-rental-manager-for-woocom
A ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/booking-and-rental-manager-for-woocommerce/vulnerability/wordpress-booking-and-rental-manager-plugin-2-2-8-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-27012 State: PUBLISHED Published: 2025-02-22T15:52:12.071Z Last Updated: 2025-02-24T14:29:31.185Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: a1post Products: A1POST.BG Shipping for Woo Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in a1post A1POST.BG Shipping for Woo allows Privilege Escalation. This issue affects A1POST.BG Shipping for Woo: from n/a through 1.5.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/a1post-bg-shipping-for-woocommerce/vulnerability/wordpress-a1post-bg-shipping-for-woo-plugin-1-5-1-csrf-to-privilege-escalatio
-bg-shipping-for-woocommerce/vulnerability/wordpress-a1post-bg-shipping-for-woo-plugin-1-5-1-csrf-to-privilege-escalation-vulnerability?_s_id=cve
CVE ID: CVE-2025-27013 State: PUBLISHED Published: 2025-02-18T19:53:35.669Z Last Updated: 2025-02-18T20:37:18.282Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: EPC Products: MediCenter - Health Medical Clinic WordPress Theme Problem Types: CWE-862 Description: Missing Authorization vulnerability in EPC MediCenter - Health Medical Clinic WordPress Theme allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MediCenter - Health Medical Clinic WordPress Theme: from n/a through n/a. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/medicenter/vulnerability/word
es: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/medicenter/vulnerability/wordpress-medicenter-theme-14-7-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2025-27014 State: PUBLISHED Published: 2025-03-26T14:36:13.709Z Last Updated: 2025-03-26T14:52:22.683Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: designingmedia Products: Hostiko Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designingmedia Hostiko allows Reflected XSS.This issue affects Hostiko: from n/a before 30.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/hostiko/vulnerability/wordpress-hostiko-theme-30-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-27015 State: PUBLISHED Published: 2025-03-26T14:35:07.556Z Last Updated: 2025-03-26T14:52:53.122Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: designingmedia Products: Hostiko Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in designingmedia Hostiko allows PHP Local File Inclusion.This issue affects Hostiko: from n/a before 30.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/hostiko/vulnerability/wordpress-hostiko-theme-30-1-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-27016 State: PUBLISHED Published: 2025-02-18T19:53:35.901Z Last Updated: 2025-02-18T20:16:42.552Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: awsm.in Products: Drivr Lite – Google Drive Plugin Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in awsm.in Drivr Lite – Google Drive Plugin allows Stored XSS. This issue affects Drivr Lite – Google Drive Plugin: from n/a through 1.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/drivr-google-drive-file-picker/vulnerability/wordpress-drivr-lit
ces: - https://patchstack.com/database/wordpress/plugin/drivr-google-drive-file-picker/vulnerability/wordpress-drivr-lite-google-drive-plugin-plugin-1-0-1-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-27017 State: PUBLISHED Published: 2025-03-12T16:19:45.206Z Last Updated: 2025-03-12T17:56:14.825Z Vendors: Apache Software Foundation Products: Apache NiFi Problem Types: CWE-538 Description: Apache NiFi 1.13.0 through 2.2.0 includes the username and password used to authenticate with MongoDB in the NiFi provenance events that MongoDB components generate during processing. An authorized user with read access to the provenance events of those processors may see the credentials information. Upgrading to Apache NiFi 2.3.0 is the recommended mitigation, which removes the credentials from provenance event records. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vuln
emoves the credentials from provenance event records. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/d4n5474jkhp82dvnht13pjtlfx7bhn5q
CVE ID: CVE-2025-27018 State: PUBLISHED Published: 2025-03-19T09:06:07.220Z Last Updated: 2025-03-25T17:45:20.580Z Vendors: Apache Software Foundation Products: Apache Airflow MySQL Provider Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Airflow MySQL Provider. When user triggered a DAG with dump_sql or load_sql functions they could pass a table parameter from a UI, that could cause SQL injection by running SQL that was not intended. It could lead to data corruption, modification and others. This issue affects Apache Airflow MySQL Provider: before 6.2.0. Users are recommended to upgrade to versio
n and others. This issue affects Apache Airflow MySQL Provider: before 6.2.0. Users are recommended to upgrade to version 6.2.0, which fixes the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/airflow/pull/47254 - https://github.com/apache/airflow/pull/47255 - https://lists.apache.org/thread/m8ohgkwz4mq9njohf66sjwqjdy28gvzf
CVE ID: CVE-2025-27021 State: PUBLISHED Published: 2025-07-02T08:45:05.475Z Last Updated: 2025-07-02T14:32:53.922Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Infinera Products: G42 Description: The misconfiguration in the sudoers configuration of the operating system in Infinera G42 version R6.1.3 allows low privileged OS users to read/write physical memory via devmem command line tool. This could allow sensitive information disclosure, denial of service, and privilege escalation by tampering with kernel memory. Details: The output of "sudo -l" reports the presence of "devmem" command executable as super user without using a password. This command allows to
o -l" reports the presence of "devmem" command executable as super user without using a password. This command allows to read and write an arbitrary memory area of the target device, specifying an absolute address. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cvcn.gov.it/cvcn/cve/CVE-2025-27021 - https://euvd.enisa.europa.eu/vulnerability/CVE-2025-27021
CVE ID: CVE-2025-27022 State: PUBLISHED Published: 2025-07-02T08:52:54.406Z Last Updated: 2025-07-02T13:14:45.299Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Infinera Products: G42 Problem Types: CWE-22 Description: A path traversal vulnerability of the WebGUI HTTP endpoint in Infinera G42 version R6.1.3 allows remote authenticated users to download all OS files via HTTP requests. Details: Lack or insufficient validation of user-supplied input allows authenticated users to access all files on the target machine file system that are readable to the user account used to run the httpd service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
ble to the user account used to run the httpd service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cvcn.gov.it/cvcn/cve/CVE-2025-27022 - https://euvd.enisa.europa.eu/vulnerability/CVE-2025-27022
CVE ID: CVE-2025-27023 State: PUBLISHED Published: 2025-07-02T09:07:06.957Z Last Updated: 2025-07-02T13:14:35.310Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Infinera Products: G42 Problem Types: CWE-20 Description: Lack or insufficent input validation in WebGUI CLI web in Infinera G42 version R6.1.3 allows remote authenticated users to read all OS files via crafted CLI commands. Details: The web interface based management of the Infinera G42 appliance enables the feature of executing a restricted set of commands. This feature also offers the option to execute a script-file already present on the target device. When a non-script or incorrect file is spe
ers the option to execute a script-file already present on the target device. When a non-script or incorrect file is specified, the content of the file is shown along with an error message. Due to an execution of the http service with a privileged user all files on the file system can be viewed this way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cvcn.gov.it/cvcn/cve/CVE-2025-27023 - https://euvd.enisa.europa.eu/vulnerability/CVE-2025-27023
CVE ID: CVE-2025-27024 State: PUBLISHED Published: 2025-07-02T09:38:32.141Z Last Updated: 2025-07-02T13:07:51.401Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Infinera Products: G42 Problem Types: CWE-280 Description: Unrestricted access to OS file system in SFTP service in Infinera G42 version R6.1.3 allows remote authenticated users to read/write OS files via SFTP connections. Details: Account members of the Network Administrator profile can access the target machine via SFTP with the same credentials used for SSH CLI access and are able to read all files according to the OS permission instead of remaining inside the chrooted directory position. Additi
ble to read all files according to the OS permission instead of remaining inside the chrooted directory position. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cvcn.gov.it/cvcn/cve/CVE-2025-27024 - https://euvd.enisa.europa.eu/vulnerability/CVE-2025-27024
CVE ID: CVE-2025-27025 State: PUBLISHED Published: 2025-07-02T09:52:05.812Z Last Updated: 2025-07-02T13:07:42.554Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Infinera Products: G42 Problem Types: CWE-280 Description: The target device exposes a service on a specific TCP port with a configured endpoint. The access to that endpoint is granted using a Basic Authentication method. The endpoint accepts also the PUT method and it is possible to write files on the target device file system. Files are written as root. Using Postman it is possible to perform a Directory Traversal attack and write files into any location of the device file system. Similarly to the
e to perform a Directory Traversal attack and write files into any location of the device file system. Similarly to the PUT method, it is possible to leverage the same mechanism to read any file from the file system by using the GET method. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cvcn.gov.it/cvcn/cve/CVE-2025-27025 - https://euvd.enisa.europa.eu/vulnerability/CVE-2025-27025
CVE ID: CVE-2025-27026 State: PUBLISHED Published: 2025-07-02T13:42:42.068Z Last Updated: 2025-07-02T20:22:57.416Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Infinera Products: G42 Problem Types: CWE-1220 Description: A missing double-check feature in the WebGUI for CLI deactivation in Infinera G42 version R6.1.3 allows an authenticated administrator to make other management interfaces unavailable via local and network interfaces. The CLI deactivation via the WebGUI does not only stop CLI interface but deactivates also Linux Shell, WebGUI and Physical Serial Console access. No confirmation is asked at deactivation time. Loosing access to these services
GUI and Physical Serial Console access. No confirmation is asked at deactivation time. Loosing access to these services device administrators are at risk of completely loosing device control. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cvcn.gov.it/cvcn/cve/CVE-2025-27026 - https://euvd.enisa.europa.eu/vulnerability/CVE-2025-27026
CVE ID: CVE-2025-27027 State: PUBLISHED Published: 2025-07-09T08:31:29.320Z Last Updated: 2025-07-09T13:34:00.352Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N) Vendors: Radiflow Products: iSAP Smart Collector Problem Types: CWE-653 Description: A user with vpuser credentials that opens an SSH connection to the device, gets a restricted shell rbash that allows only a small list of allowed commands. This vulnerability enables the user to get a full-featured Linux shell, bypassing the rbash restrictions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cvcn.gov.it/cvcn/cve/CVE-2025-27027
CVE ID: CVE-2025-27028 State: PUBLISHED Published: 2025-07-09T08:38:21.462Z Last Updated: 2025-07-09T13:31:33.386Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: Radiflow Products: iSAP Smart Collector Problem Types: CWE-266 Description: The Linux deprivileged user vpuser in Radiflow iSAP Smart Collector (CentOS 7 - VSAP 1.20) can read the entire file system content, including files belonging to other users and having restricted access (like, for example, the root password hash). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cvcn.gov.it/cvcn/cve/CVE-2025-27028
CVE ID: CVE-2025-27029 State: PUBLISHED Published: 2025-06-03T05:53:04.451Z Last Updated: 2025-06-03T14:49:01.250Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-126 Description: Transient DOS while processing the tone measurement response buffer when the response buffer is out of range. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2025-bulletin.html
CVE ID: CVE-2025-27030 State: PUBLISHED Published: 2025-09-24T15:33:37.296Z Last Updated: 2025-09-25T15:49:02.050Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-126 Description: information disclosure while invoking calibration data from user space to update firmware size. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2025-bulletin.html
CVE ID: CVE-2025-27031 State: PUBLISHED Published: 2025-06-03T05:53:05.590Z Last Updated: 2025-06-03T14:48:40.556Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-416 Description: memory corruption while processing IOCTL commands, when the buffer in write loopback mode is accessed after being freed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2025-bulletin.html
CVE ID: CVE-2025-27032 State: PUBLISHED Published: 2025-09-24T15:33:38.574Z Last Updated: 2025-09-25T15:48:55.849Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-1257 Description: memory corruption while loading a PIL authenticated VM, when authenticated VM image is loaded without maintaining cache coherency. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2025-bulletin.html
CVE ID: CVE-2025-27033 State: PUBLISHED Published: 2025-09-24T15:33:39.804Z Last Updated: 2025-09-25T13:51:44.063Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-126 Description: Information disclosure while running video usecase having rogue firmware. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2025-bulletin.html
CVE ID: CVE-2025-27034 State: PUBLISHED Published: 2025-09-24T15:33:40.998Z Last Updated: 2025-09-25T03:55:34.618Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-129 Description: Memory corruption while selecting the PLMN from SOR failed list. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2025-bulletin.html
CVE ID: CVE-2025-27036 State: PUBLISHED Published: 2025-09-24T15:33:42.243Z Last Updated: 2025-09-25T13:51:30.067Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-126 Description: Information disclosure when Video engine escape input data is less than expected minimum size. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2025-bulletin.html
CVE ID: CVE-2025-27037 State: PUBLISHED Published: 2025-09-24T15:33:43.572Z Last Updated: 2025-09-25T03:55:47.012Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-416 Description: Memory corruption while processing config_dev IOCTL when camera kernel driver drops its reference to CPU buffers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2025-bulletin.html
CVE ID: CVE-2025-27038 State: PUBLISHED Published: 2025-06-03T05:53:06.692Z Last Updated: 2025-10-21T22:55:13.504Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-416 Description: Memory corruption while rendering graphics using Adreno GPU drivers in Chrome. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2025-bulletin.html
CVE ID: CVE-2025-27039 State: PUBLISHED Published: 2025-10-09T03:17:52.973Z Last Updated: 2025-10-10T03:55:18.955Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-390 Description: Memory corruption may occur while processing IOCTL call for DMM/WARPNCC CONFIG request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2025-bulletin.html
CVE ID: CVE-2025-27040 State: PUBLISHED Published: 2025-10-09T03:17:54.304Z Last Updated: 2025-10-09T14:33:13.151Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-20 Description: Information disclosure may occur while processing the hypervisor log. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2025-bulletin.html
CVE ID: CVE-2025-27041 State: PUBLISHED Published: 2025-10-09T03:17:55.597Z Last Updated: 2025-10-09T14:33:07.421Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-126 Description: Transient DOS while processing video packets received from video firmware. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2025-bulletin.html
CVE ID: CVE-2025-27042 State: PUBLISHED Published: 2025-07-08T12:49:04.998Z Last Updated: 2025-07-08T14:16:03.369Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-131 Description: Memory corruption while processing video packets received from video firmware. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2025-bulletin.html
CVE ID: CVE-2025-27043 State: PUBLISHED Published: 2025-07-08T12:49:06.668Z Last Updated: 2025-07-08T14:04:18.866Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-120 Description: Memory corruption while processing manipulated payload in video firmware. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2025-bulletin.html