Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-58300 State: PUBLISHED Published: 2025-10-11T09:09:57.678Z Last Updated: 2025-10-14T18:46:13.862Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Huawei Products: HarmonyOS Problem Types: CWE-121 Description: Buffer overflow vulnerability in the device management module. Successful exploitation of this vulnerability may affect availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/10/
CVE ID: CVE-2025-58301 State: PUBLISHED Published: 2025-10-11T09:18:01.117Z Last Updated: 2025-10-14T18:46:08.569Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Huawei Products: HarmonyOS Problem Types: CWE-121 Description: Buffer overflow vulnerability in the device management module. Successful exploitation of this vulnerability may affect availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/10/
CVE ID: CVE-2025-58313 State: PUBLISHED Published: 2025-09-05T07:58:39.735Z Last Updated: 2025-09-05T12:20:44.006Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Huawei Products: HarmonyOS Problem Types: CWE-362 Description: Race condition vulnerability in the device standby module. Impact: Successful exploitation of this vulnerability may cause feature exceptions of the device standby module. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2025/9/
CVE ID: CVE-2025-58317 State: PUBLISHED Published: 2025-09-24T06:38:43.161Z Last Updated: 2025-09-24T13:13:34.500Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: CNCSoft-G2 Problem Types: CWE-121 Description: Delta Electronics CNCSoft-G2 lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2025-00017_CNCSoft-G2_File%20Parsing%20Stack-based%20Buffer%20Overflow%20Vulnerability.pdf
CVE ID: CVE-2025-58318 State: PUBLISHED Published: 2025-09-01T07:23:20.880Z Last Updated: 2025-09-02T19:29:38.432Z Vendors: Delta Electronics Products: DIAView Problem Types: CWE-306 Description: Delta Electronics DIAView has an authentication bypass vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2025-00015_DIAView%20Authentication%20%20Bypass%20Vulnerability.pdf
CVE ID: CVE-2025-58319 State: PUBLISHED Published: 2025-09-24T06:42:08.525Z Last Updated: 2025-09-24T13:10:05.302Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: CNCSoft-G2 Problem Types: CWE-121 Description: Delta Electronics CNCSoft-G2 lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2025-00017_CNCSoft-G2_File%20Parsing%20Stack-based%20Buffer%20Overflow%20Vulnerability.pdf
CVE ID: CVE-2025-58320 State: PUBLISHED Published: 2025-09-11T08:51:49.981Z Last Updated: 2025-09-11T14:36:13.786Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Delta Electronics Products: DIALink Problem Types: CWE-22 Description: Delta Electronics DIALink has an Directory Traversal Authentication Bypass Vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2025-00016_DIALink%20-%20Directory%20Traversal%20Authentication%20Bypass%20Vulnerability.pdf
CVE ID: CVE-2025-58321 State: PUBLISHED Published: 2025-09-11T08:50:12.379Z Last Updated: 2025-09-11T14:36:18.886Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Delta Electronics Products: DIALink Problem Types: CWE-22 Description: Delta Electronics DIALink has an Directory Traversal Authentication Bypass Vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2025-00016_DIALink%20-%20Directory%20Traversal%20Authentication%20Bypass%20Vulnerability.pdf
CVE ID: CVE-2025-58322 State: PUBLISHED Published: 2025-08-28T08:02:35.726Z Last Updated: 2025-08-29T01:40:58.236Z Vendors: NAVER Products: NAVER MYBOX Explorer Problem Types: CWE-266 Description: NAVER MYBOX Explorer for Windows before 3.0.8.133 allows a local attacker to escalate privileges to NT AUTHORITY\SYSTEM by invoking arbitrary DLLs due to improper privilege checks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cve.naver.com/detail/cve-2025-58322.html
CVE ID: CVE-2025-58323 State: PUBLISHED Published: 2025-08-29T01:41:14.338Z Last Updated: 2025-08-29T17:10:33.171Z Vendors: NAVER Products: NAVER MYBOX Explorer Problem Types: CWE-266 Description: NAVER MYBOX Explorer for Windows before 3.0.8.133 allows a local attacker to escalate privileges to NT AUTHORITY\SYSTEM by executing arbitrary files due to improper privilege checks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cve.naver.com/detail/cve-2025-58323.html
CVE ID: CVE-2025-58324 State: PUBLISHED Published: 2025-10-14T15:22:35.310Z Last Updated: 2025-10-16T03:57:08.043Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiSIEM Problem Types: CWE-79 Description: An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiSIEM 7.2.0 through 7.2.2, 7.1 all versions, 7.0 all versions, 6.7 all versions, 6.6 all versions, 6.5 all versions, 6.4 all versions, 6.3 all versions, 6.2 all versions may allow an authenticated attacker to perform a stored cross site scripting (XSS) attack via crafted HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrich
form a stored cross site scripting (XSS) attack via crafted HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-280
CVE ID: CVE-2025-58325 State: PUBLISHED Published: 2025-10-14T15:22:39.254Z Last Updated: 2025-10-16T03:57:08.843Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiOS Problem Types: CWE-684 Description: An Incorrect Provision of Specified Functionality vulnerability [CWE-684] in FortiOS 7.6.0, 7.4.0 through 7.4.5, 7.2.5 through 7.2.10, 7.0.0 through 7.0.15, 6.4 all versions may allow a local authenticated attacker to execute system commands via crafted CLI commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-361
CVE ID: CVE-2025-58326 State: REJECTED Published: N/A Last Updated: 2025-08-29T02:55:09.324Z Description: No description available.
CVE ID: CVE-2025-58327 State: REJECTED Published: N/A Last Updated: 2025-08-29T02:55:08.831Z Description: No description available.
CVE ID: CVE-2025-58328 State: REJECTED Published: N/A Last Updated: 2025-08-29T02:55:08.372Z Description: No description available.
CVE ID: CVE-2025-58329 State: REJECTED Published: N/A Last Updated: 2025-08-29T02:55:07.840Z Description: No description available.
CVE ID: CVE-2025-58330 State: REJECTED Published: N/A Last Updated: 2025-08-29T02:55:07.357Z Description: No description available.
CVE ID: CVE-2025-58331 State: REJECTED Published: N/A Last Updated: 2025-08-29T02:55:06.894Z Description: No description available.
CVE ID: CVE-2025-58332 State: REJECTED Published: N/A Last Updated: 2025-08-29T02:55:06.426Z Description: No description available.
CVE ID: CVE-2025-58333 State: REJECTED Published: N/A Last Updated: 2025-08-29T02:55:05.821Z Description: No description available.
CVE ID: CVE-2025-58334 State: PUBLISHED Published: 2025-08-28T16:48:56.800Z Last Updated: 2025-08-29T03:55:27.892Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: JetBrains Products: IDE Services Problem Types: CWE-862 Description: In JetBrains IDE Services before 2025.5.0.1086, 2025.4.2.2164 users without appropriate permissions could assign high-privileged role for themselves Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2025-58335 State: PUBLISHED Published: 2025-08-28T16:48:57.463Z Last Updated: 2025-08-28T17:14:56.678Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N) Vendors: JetBrains Products: Junie Problem Types: CWE-356 Description: In JetBrains Junie before 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61, 252.284.50, 252.284.54, 251.284.54, 251.284.50, 243.284.54, 243.284.50 information disclosure was possible via search_project function Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2025-58337 State: PUBLISHED Published: 2025-11-05T09:26:36.573Z Last Updated: 2025-11-06T15:55:05.901Z Vendors: Apache Software Foundation Products: Apache Doris-MCP-Server Problem Types: CWE-284 Description: An attacker with a valid read-only account can bypass Doris MCP Server’s read-only mode due to improper access control, allowing modifications that should have been prevented by read-only restrictions. Impact: Bypasses read-only mode; attackers with read-only access may perform unauthorized modifications. Recommended action for operators: Upgrade to version 0.6.0 as soon as possible (this release contains the fix). Additional Analyst Notes: - CVE Program Container: - CISA AD
0.6.0 as soon as possible (this release contains the fix). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/6tswlphj0pqn9zf25594r3c1vzvfj40h
CVE ID: CVE-2025-58351 State: PUBLISHED Published: 2025-09-03T03:20:54.579Z Last Updated: 2025-09-03T15:44:28.350Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N) Vendors: outline Products: outline Problem Types: CWE-79 Description: Outline is a service that allows for collaborative documentation. In versions 0.72.0 through 0.83.0, Outline introduced a feature which facilitates local file system storage capabilities as an optional file storage strategy. This feature allowed a CSP bypass as well as a ContentType bypass that might facilitate further attacks. In the case of self-hosting and using Outline FILE_STORAGE=local on the same domain as the Outline application,
ttacks. In the case of self-hosting and using Outline FILE_STORAGE=local on the same domain as the Outline application, a malicious payload can be uploaded as a file attachment and bypass those CSP restrictions, allowing script execution within the context of another user. This is fixed in version 0.84.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/outline/outline/security/advisories/GHSA-gcj7-c9jv-fhgf - https://github.com/outline/outline/commit/18bc93c9c207329244c6909606a2393e863892a3 - https://github.com/outline/outline/releases/tag/v0.84.0
CVE ID: CVE-2025-58352 State: PUBLISHED Published: 2025-09-04T23:28:26.035Z Last Updated: 2025-09-05T15:18:03.858Z Vendors: WeblateOrg Products: weblate Problem Types: CWE-613 Description: Weblate is a web based localization tool. Versions lower than 5.13.1 contain a vulnerability that causes long session expiry during the second factor verification. The long session expiry could be used to circumvent rate limiting of the second factor. This issue is fixed in version 5.13.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/WeblateOrg/weblate/security/advisories/GHSA-377j-wj38-4728 - https://github.com/WeblateOrg/weblate/pull/16002 - https://github.com/Webla
te/security/advisories/GHSA-377j-wj38-4728 - https://github.com/WeblateOrg/weblate/pull/16002 - https://github.com/WeblateOrg/weblate/commit/0b46fe596231dd456283ead66699ae5516f23908
CVE ID: CVE-2025-58353 State: PUBLISHED Published: 2025-09-04T19:39:23.567Z Last Updated: 2025-09-04T20:13:09.147Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N) Vendors: MarceloTessaro Products: promptcraft-forge-studio Problem Types: CWE-79, CWE-20, CWE-184 Description: Promptcraft Forge Studio is a toolkit for evaluating, optimizing, and maintaining LLM-powered applications. All versions of Promptcraft Forge Studio sanitize user input using regex blacklists such as r`eplace(/javascript:/gi, '')`. Because the package uses multi-character tokens and each replacement is applied only once, removing one occurrence can create a new dangerous token due to overlap. The “sa
each replacement is applied only once, removing one occurrence can create a new dangerous token due to overlap. The “sanitized” value may still contain an executable payload when used in href/src (or injected into the DOM). There is currently no fix for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MarceloTessaro/promptcraft-forge-studio/security/advisories/GHSA-mv25-7v95-q3pf
CVE ID: CVE-2025-58354 State: PUBLISHED Published: 2025-09-23T21:08:47.147Z Last Updated: 2025-09-24T13:22:15.628Z Vendors: kata-containers Products: kata-containers Problem Types: CWE-754 Description: Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. In Kata Containers versions from 3.20.0 and before, a malicious host can circumvent initdata verification. On TDX systems running confidential guests, a malicious host can selectively fail IO operations to skip initdata verification. This allows an attacker to launch arbitrary workloads while being able to attest successfully to Trustee impersonati
on. This allows an attacker to launch arbitrary workloads while being able to attest successfully to Trustee impersonating any benign workload. This issue has been patched in Kata Containers version 3.21.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/kata-containers/kata-containers/security/advisories/GHSA-989w-4xr2-ww9m - https://github.com/kata-containers/kata-containers/commit/3e67f92e34be974e792c153add76e4e4baac9de0
CVE ID: CVE-2025-58355 State: PUBLISHED Published: 2025-09-03T23:52:23.555Z Last Updated: 2025-09-04T14:05:53.888Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N) Vendors: charmbracelet Products: soft-serve Problem Types: CWE-22 Description: Soft Serve is a self-hostable Git server for the command line. In versions 0.9.1 and below, attackers can create or override arbitrary files with uncontrolled data through its SSH API. This issue is fixed in version 0.10.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-33pr-m977-5w97
CVE ID: CVE-2025-58356 State: PUBLISHED Published: 2025-10-27T19:33:23.969Z Last Updated: 2025-10-27T19:44:45.350Z Vendors: edgelesssys Products: constellation Problem Types: CWE-347 Description: Constellation is the first Confidential Kubernetes. The Constellation CVM image uses LUKS2-encrypted volumes for persistent storage. When opening an encrypted storage device, the CVM uses the libcryptsetup function crypt_activate_by_passhrase. If the VM is successful in opening the partition with the disk encryption key, it treats the volume as confidential. However, due to the unsafe handling of null keyslot algorithms in the cryptsetup 2.8.1, it is possible that the opened volume is not encrypted
afe handling of null keyslot algorithms in the cryptsetup 2.8.1, it is possible that the opened volume is not encrypted at all. Cryptsetup prior to version 2.8.1 does not report an error when processing LUKS2-formatted disks that use the cipher_null-ecb algorithm in the keyslot encryption field. This vulnerability is fixed in 2.24.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/edgelesssys/constellation/security/advisories/GHSA-hq76-6gh2-5g4q - https://github.com/edgelesssys/constellation/pull/3927 - https://github.com/edgelesssys/constellation/releases/tag/v2.24.0
CVE ID: CVE-2025-58357 State: PUBLISHED Published: 2025-09-04T00:30:09.292Z Last Updated: 2025-09-04T14:02:28.135Z Severity: CRITICAL (CVSS 9.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: nanbingxyz Products: 5ire Problem Types: CWE-79 Description: 5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. Version 0.13.2 contains a vulnerability in the chat page's script gadgets that enables content injection attacks through multiple vectors: malicious prompt injection pages, compromised MCP servers, and exploited tool integrations. This is fixed in version 0.14.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://g
ntegrations. This is fixed in version 0.14.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nanbingxyz/5ire/security/advisories/GHSA-8527-3cch-95gf - https://github.com/nanbingxyz/5ire/releases/tag/v0.14.0
CVE ID: CVE-2025-58358 State: PUBLISHED Published: 2025-09-04T00:34:33.819Z Last Updated: 2025-09-04T17:55:09.521Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: zcaceres Products: markdownify-mcp Problem Types: CWE-77 Description: Markdownify is a Model Context Protocol server for converting almost anything to Markdown. Versions below 0.0.2 contain a command injection vulnerability, caused by the unsanitized use of input parameters within a call to child_process.exec, enabling an attacker to inject arbitrary system commands. Successful exploitation can lead to remote code execution under the server process's privileges. The server constructs and executes she
oitation can lead to remote code execution under the server process's privileges. The server constructs and executes shell commands using unvalidated user input directly within command-line strings. This introduces the possibility of shell metacharacter injection (|, >, &&, etc.). This issue is fixed in version 0.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zcaceres/markdownify-mcp/security/advisories/GHSA-45qj-4xq3-3c45 - https://github.com/zcaceres/markdownify-mcp/commit/a31204de058b22a47e1dcc24508993cfe97e5bb3
CVE ID: CVE-2025-58359 State: PUBLISHED Published: 2025-09-04T23:50:45.746Z Last Updated: 2025-09-05T16:06:05.432Z Vendors: ZcashFoundation Products: frost Problem Types: CWE-325 Description: ZF FROST is a Rust implementation of FROST (Flexible Round-Optimised Schnorr Threshold signatures). In versions 2.0.0 through 2.1.0, refresh shares with smaller min_signers will reduce security of group. The inability to change min_signers (i.e. the threshold) with the refresh share functionality (frost_core::keys::refresh module) was not made clear to users. Using a smaller value would not decrease the threshold, and attempts to sign using a smaller threshold would fail. Additionally, after refreshing
d not decrease the threshold, and attempts to sign using a smaller threshold would fail. Additionally, after refreshing the shares with a smaller threshold, it would still be possible to sign with the original threshold, potentially causing a security loss to the participant's shares. This issue is fixed in version 2.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ZcashFoundation/frost/security/advisories/GHSA-wgq8-vr6r-mqxm - https://github.com/ZcashFoundation/frost/commit/379ef689c733b3d9c80fd409071d4f3af4dafed2 - https://github.com/ZcashFoundation/frost/releases/tag/frost-core%2Fv2.2.0
CVE ID: CVE-2025-58361 State: PUBLISHED Published: 2025-09-04T19:43:43.852Z Last Updated: 2025-09-04T20:07:02.787Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: MarceloTessaro Products: promptcraft-forge-studio Problem Types: CWE-20, CWE-79, CWE-184 Description: Promptcraft Forge Studio is a toolkit for evaluating, optimizing, and maintaining LLM-powered applications. All versions contain an non-exhaustive URL scheme check that does not protect against XSS. User-controlled URLs pass through src/utils/validation.ts, but the check only strips `javascript:` and a few patterns. `data:` URLs (for example data:image/svg+xml,…) still pass. If a sanitized value
rips `javascript:` and a few patterns. `data:` URLs (for example data:image/svg+xml,…) still pass. If a sanitized value is used in href/src, an attacker can execute a script. There is currently no fix for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MarceloTessaro/promptcraft-forge-studio/security/advisories/GHSA-fjch-4g87-g4p4
CVE ID: CVE-2025-58362 State: PUBLISHED Published: 2025-09-04T23:56:13.983Z Last Updated: 2025-09-05T16:05:20.545Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: honojs Products: hono Problem Types: CWE-706 Description: Hono is a Web application framework that provides support for any JavaScript runtime. Versions 4.8.0 through 4.9.5 contain a flaw in the getPath utility function which could allow path confusion and potential bypass of proxy-level ACLs (e.g. Nginx location blocks). The original implementation relied on fixed character offsets when parsing request URLs. Under certain malformed absolute-form Request-URIs, this could lead to incorrect path extrac
when parsing request URLs. Under certain malformed absolute-form Request-URIs, this could lead to incorrect path extraction depending on the application and environment. If proxy ACLs are used to protect sensitive endpoints such as /admin, this flaw could have allowed unauthorized access. The confidentiality impact depends on what data is exposed: if sensitive administrative data is exposed, the impact may be high, otherwise it may be moderate. This issue is fixed in version 4.9.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/honojs/hono/security/advisories/GHSA-9hp6-4448-45g2 - https://github.com/honojs/hono/commit/1d79aedc3f82d8c9969b115fe61bc4bd705e
ono/security/advisories/GHSA-9hp6-4448-45g2 - https://github.com/honojs/hono/commit/1d79aedc3f82d8c9969b115fe61bc4bd705ec8de - https://github.com/honojs/hono/releases/tag/v4.9.6
CVE ID: CVE-2025-58364 State: PUBLISHED Published: 2025-09-11T17:26:25.282Z Last Updated: 2025-11-04T21:13:40.752Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: OpenPrinting Products: cups Problem Types: CWE-20, CWE-476 Description: OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.12 and earlier, an unsafe deserialization and validation of printer attributes causes null dereference in the libcups library. This is a remote DoS vulnerability available in local subnet in default configurations. It can cause the cups & cups-browsed to crash, on all the machines in local network who are listeni
ault configurations. It can cause the cups & cups-browsed to crash, on all the machines in local network who are listening for printers (so by default for all regular linux machines). On systems where the vulnerability CVE-2024-47176 (cups-filters 1.x/cups-browsed 2.x vulnerability) was not fixed, and the firewall on the machine does not reject incoming communication to IPP port, and the machine is set to be available to public internet, attack vector "Network" is possible. The current versions of CUPS and cups-browsed projects have the attack vector "Adjacent" in their default configurations. Version 2.4.13 contains a patch for CVE-2025-58364. Additional Analyst Notes: - CISA ADP Vulnrichme