deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-54324
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

dm: fix a race condition in retrieve_deps

There's a race condition in the multipath target when retrieve_deps
races with multipath_message calling dm_get_device and dm_put_device.
retrieve_deps walks the list of open devices without holding any lock
but multipath may add or remove devices to the list while it is
running. The end result may be memory corruption or use-after-free
memory access.

See this description of a UAF with multipath_message():
https://listman.redhat.com/archives/dm-devel/2022-October/052373.html

Fix this bug by introducing a new rw semaphore "devices_lock". We grab
devices_lock for read in retrieve_deps and we grab it for write in
dm_get_device and dm_put_device.
References: https://git.kernel.org/stable/c/38f6e5ae5d9ff4a4050ea6f7b543d5d5a4e087cf; https://git.kernel.org/stable/c/dbf1a719850577bb51fc7512a3972994b797a17b; https://git.kernel.org/stable/c/f6007dce0cd35d634d9be91ef3515a6385dcee16
CVE: CVE-2023-54325
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

crypto: qat - fix out-of-bounds read

When preparing an AER-CTR request, the driver copies the key provided by
the user into a data structure that is accessible by the firmware.
If the target device is QAT GEN4, the key size is rounded up by 16 since
a rounded up size is expected by the device.
If the key size is rounded up before the copy, the size used for copying
the key might be bigger than the size of the region containing the key,
causing an out-of-bounds read.

Fix by doing the copy first and then update the keylen.

This is to fix the following warning reported by KASAN:

	[  138.150574] BUG: KASAN: global-out-of-bounds in qat_alg_skcipher_init_com.isra.0+0x197/0x250 [intel_qat]
	[  138.150641] Read of size 32 at addr ffffffff88c402c0 by task cryptomgr_test/2340

	[  138.150651] CPU: 15 PID: 2340 Comm: cryptomgr_test Not tainted 6.2.0-rc1+ #45
	[  138.150659] Hardware name: Intel Corporation ArcherCity/ArcherCity, BIOS EGSDCRB1.86B.0087.D13[PII_REDACTED] 08/26/2022
	[  138.150663] Call Trace:
	[  138.150668]  <TASK>
	[  138.150922]  kasan_check_range+0x13a/0x1c0
	[  138.150931]  memcpy+0x1f/0x60
	[  138.150940]  qat_alg_skcipher_init_com.isra.0+0x197/0x250 [intel_qat]
	[  138.151006]  qat_alg_skcipher_init_sessions+0xc1/0x240 [intel_qat]
	[  138.151073]  crypto_skcipher_setkey+0x82/0x160
	[  138.151085]  ? prepare_keybuf+0xa2/0xd0
	[  138.151095]  test_skcipher_vec_cfg+0x2b8/0x800
References: https://git.kernel.org/stable/c/2b1501f058245573a3aa6bf234d205dde1196184; https://git.kernel.org/stable/c/7697139d5dfd491f4c495a914a1dd68f6e827a0f; https://git.kernel.org/stable/c/dc3809f390357c8992f0a23083da934a20fef9af
CVE: CVE-2023-54326
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

misc: pci_endpoint_test: Free IRQs before removing the device

In pci_endpoint_test_remove(), freeing the IRQs after removing the device
creates a small race window for IRQs to be received with the test device
memory already released, causing the IRQ handler to access invalid memory,
resulting in an oops.

Free the device IRQs before removing the device to avoid this issue.
References: https://git.kernel.org/stable/c/14bdee38e96c7d37ca15e7bea50411eee25fe315; https://git.kernel.org/stable/c/38d12bcf4e2ce3d285eb29644a79a54f42040fab; https://git.kernel.org/stable/c/c2dba13bc0c62b79a3cbe4bfe5faa32231bf9b55
CVE: CVE-2024-58242
Published: 2025-12-30
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was in a CNA pool that was not assigned to any issues during 2024. Notes: none.
CVE: CVE-2024-58243
Published: 2025-12-30
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was in a CNA pool that was not assigned to any issues during 2024. Notes: none.
CVE: CVE-2024-58244
Published: 2025-12-30
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was in a CNA pool that was not assigned to any issues during 2024. Notes: none.
CVE: CVE-2024-58245
Published: 2025-12-30
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was in a CNA pool that was not assigned to any issues during 2024. Notes: none.
CVE: CVE-2024-58246
Published: 2025-12-30
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was in a CNA pool that was not assigned to any issues during 2024. Notes: none.
CVE: CVE-2024-58247
Published: 2025-12-30
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was in a CNA pool that was not assigned to any issues during 2024. Notes: none.
CVE: CVE-2025-14426
Published: 2025-12-30
Description: The Strong Testimonials plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in the 'edit_rating' function in all versions up to, and including, 3.2.18. This makes it possible for authenticated attackers with Contributor-level access and above to modify or delete the rating meta on any testimonial post, including those created by other users, by reusing a valid nonce obtained from their own testimonial edit screen.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/strong-testimonials/tags/3.2.18/admin/class-strong-testimonials-post-editor.php#L29; https://plugins.trac.wordpress.org/browser/strong-testimonials/tags/3.2.18/admin/class-strong-testimonials-post-editor.php#L379; https://plugins.trac.wordpress.org/changeset/3416480/
CVE: CVE-2025-15248
Published: 2025-12-30
Description: A security flaw has been discovered in sunhailin12315 product-review 商品评价系统 up to 91ead6890b4065bb45b7602d0d73348e75cb4639. This affects an unknown part of the component Write a Review. Performing manipulation of the argument content results in cross site scripting. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited. This product adopts a rolling release strategy to maintain continuous delivery The project was informed of the problem early through an issue report but has not responded yet.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://gitee.com/sunhailin12315/product-review/issues/ICK775; https://vuldb.com/?ctiid.338638; https://vuldb.com/?id.338638
CVE: CVE-2025-15249
Published: 2025-12-30
Description: A weakness has been identified in zhujunliang3 work_platform up to 6bc5a50bb527ce27f7906d11ea6ec139beb79c31. This vulnerability affects unknown code of the component Content Handler. Executing manipulation can lead to cross site scripting. The attack may be performed from remote. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://gitee.com/zhujunliang3/work_platform/issues/ICLUJ2; https://vuldb.com/?ctiid.338639; https://vuldb.com/?id.338639
CVE: CVE-2025-15250
Published: 2025-12-30
Description: A security vulnerability has been detected in 08CMS Novel System up to 3.4. This issue affects some unknown processing of the file admina/mtpls.inc.php of the component Template Handler. The manipulation leads to code injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-94
References: https://gitee.com/keneny/cve/issues/ID3DEM; https://vuldb.com/?ctiid.338640; https://vuldb.com/?id.338640
CVE: CVE-2025-15251
Published: 2025-12-30
Description: A vulnerability was detected in beecue FastBee up to 2.1. Impacted is the function getRootElement of the file springboot/fastbee-server/sip-server/src/main/java/com/fastbee/sip/handler/req/ReqAbstractHandler.java of the component SIP Message Handler. The manipulation results in xml external entity reference. It is possible to launch the attack remotely. A high complexity level is associated with this attack. The exploitability is considered difficult. The project owner replied to the issue report: "Okay, we'll handle it as soon as possible."
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-610, CWE-611
References: https://gitee.com/beecue/fastbee/issues/ID7HNZ; https://gitee.com/beecue/fastbee/issues/ID7HNZ#note_47777408_link; https://vuldb.com/?ctiid.338641
CVE: CVE-2025-15252
Published: 2025-12-30
Description: A flaw has been found in Tenda M3 1.0.0.13(4903). The affected element is the function formSetRemoteDhcpForAp of the file /goform/setDhcpAP. This manipulation of the argument startip/endip/leasetime/gateway/dns1/dns2 causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/dwBruijn/CVEs/blob/main/Tenda/setRemoteDhcpForAp.md; https://vuldb.com/?ctiid.338642; https://vuldb.com/?id.338642
CVE: CVE-2025-15253
Published: 2025-12-30
Description: A vulnerability has been found in Tenda M3 1.0.0.13(4903). The impacted element is an unknown function of the file /goform/exeCommand. Such manipulation of the argument cmdinput leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/dwBruijn/CVEs/blob/main/Tenda/execCommand.md; https://vuldb.com/?ctiid.338643; https://vuldb.com/?id.338643
CVE: CVE-2025-15254
Published: 2025-12-30
Description: A vulnerability was found in Tenda W6-S 1.0.0.4(510). This affects the function TendaAte of the file /goform/ate of the component ATE Service. Performing a manipulation results in os command injection. The attack may be initiated remotely. The exploit has been made public and could be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77, CWE-78
References: https://github.com/dwBruijn/CVEs/blob/main/Tenda/ate.md; https://vuldb.com/?ctiid.338644; https://vuldb.com/?id.338644
CVE: CVE-2025-15255
Published: 2025-12-30
Description: A vulnerability was determined in Tenda W6-S 1.0.0.4(510). This impacts an unknown function of the file /bin/httpd of the component R7websSsecurityHandler. Executing a manipulation of the argument Cookie can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119, CWE-121
References: https://github.com/dwBruijn/CVEs/blob/main/Tenda/R7WebsSecurityHandler.md; https://vuldb.com/?ctiid.338645; https://vuldb.com/?id.338645
CVE: CVE-2025-61557
Published: 2025-12-30
Description: nixseparatedebuginfod before v0.4.1 is vulnerable to Directory Traversal.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/symphorien/nixseparatedebuginfod; https://github.com/symphorien/nixseparatedebuginfod/blob/05ff4edf6953d0bcfedc3f448ed0ad9c4f279ee9/advisories/CVE-2025-61557.md; https://urldefense.us/v2/url?u=https-3A__github.com_symphorien_nixseparatedebuginfod_commit_57ac448324bfa11a8d8e8f9bea04ae9205ad18b2&d=DwIFaQ&c=Al8V6E3U0yBSSEuVtdZbGtsvjPA49U3WmtZAsdW0D_Q&r=Nrzxo0WDF_OE-Sa1wccaFKpKc1i6Uzf32ZZrlnVhmbk&m=dtk61i_OKshHyBz6nYW1Xx-pK5y9qdHl8ipsEqB31N2lKuU5GtTeg0C21yVO5M_W&s=wMjbc-B-uuwViJamR0q794vsOHExyt0nbnOuAZfxoGk&e=
CVE: CVE-2025-62746
Published: 2025-12-30
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeFlavors Featured Video for WordPress – VideographyWP videographywp allows Stored XSS.This issue affects Featured Video for WordPress – VideographyWP: from n/a through <= 1.0.18.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/videographywp/vulnerability/wordpress-featured-video-for-wordpress-videographywp-plugin-1-0-18-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-63027
Published: 2025-12-30
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webcreations907 WBC907 Core wbc907-core allows Stored XSS.This issue affects WBC907 Core: from n/a through <= 3.4.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wbc907-core/vulnerability/wordpress-wbc907-core-plugin-3-4-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-64190
Published: 2025-12-30
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore Core et-core-plugin allows DOM-Based XSS.This issue affects XStore Core: from n/a through < 5.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/et-core-plugin/vulnerability/wordpress-xstore-core-plugin-5-6-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE: CVE-2025-64528
Published: 2025-12-30
Description: Discourse is an open source discussion platform. Prior to versions 3.5.3, 2025.11.1, and 2025.12.0, an attacker who knows part of a username can find the user and their full name via UI or API, even when `enable_names` is disabled. Versions 3.5.3, 2025.11.1, and 2025.12.0 contain a fix.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-202
References: https://github.com/discourse/discourse/commit/1cb45b8b287597085e3514596ffb1d9b41938f81; https://github.com/discourse/discourse/commit/6192f[PII_REDACTED]5595dae14364fd86cac0f09df; https://github.com/discourse/discourse/commit/e936a523b5900a9d866d23ea3da904ba12bb0fb2
CVE: CVE-2025-66080
Published: 2025-12-30
Description: Missing Authorization vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent gdpr-cookie-consent allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: from n/a through <= 4.0.3.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/gdpr-cookie-consent/vulnerability/wordpress-wp-cookie-notice-for-gdpr-ccpa-eprivacy-consent-plugin-4-0-3-broken-access-control-vulnerability-2?_s_id=cve
CVE: CVE-2025-67746
Published: 2025-12-30
Description: Composer is a dependency manager for PHP. In versions on the 2.x branch prior to 2.2.26 and 2.9.3, attackers controlling remote sources that Composer downloads from might in some way inject ANSI control characters in the terminal output of various Composer commands, causing mangled output and potentially leading to confusion or DoS of the terminal application. There is no proven exploit and this has thus a low severity but we still publish a CVE as it has potential for abuse, and we want to be on the safe side informing users that they should upgrade. Versions 2.2.26 and 2.9.3 contain a patch for the issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-74
References: https://github.com/composer/composer/commit/1d40a95c9d39a6b7f80d404ab30336c586da9917; https://github.com/composer/composer/commit/5db1876a76fdef76d3c4f8a27995c434c7a43e71; https://github.com/composer/composer/releases/tag/2.2.26
CVE: CVE-2025-15256
Published: 2025-12-30
Description: A vulnerability was identified in Edimax BR-6208AC 1.02/1.03. Affected is the function formStaDrvSetup of the file /goform/formStaDrvSetup of the component Web-based Configuration Interface. The manipulation of the argument rootAPmac leads to command injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. Edimax confirms this issue: "The product mentioned, EDIMAX BR-6208AC V2, has reached its End of Life (EOL) status. It is no longer supported or maintained by Edimax, and it is no longer available for purchase in the market. Consequently, there will be no further firmware updates or patches for this device. We recommend users upgrade to newer models for better security." This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-77, CWE-77
References: https://tzh00203.notion.site/EDIMAX-BR-6208AC-V2_1-02-Command-Injection-Vulnerability-in-Web-formStaDrvSetup-handler-2d2b5c52018a803ebd91c200b3e2925b?source=copy_link; https://vuldb.com/?ctiid.338646; https://vuldb.com/?id.338646
CVE: CVE-2025-15257
Published: 2025-12-30
Description: A security flaw has been discovered in Edimax BR-6208AC 1.02/1.03. Affected by this vulnerability is the function formRoute of the file /gogorm/formRoute of the component Web-based Configuration Interface. The manipulation of the argument strIp/strMask/strGateway results in command injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. Edimax confirms this issue: "The product mentioned, EDIMAX BR-6208AC V2, has reached its End of Life (EOL) status. It is no longer supported or maintained by Edimax, and it is no longer available for purchase in the market. Consequently, there will be no further firmware updates or patches for this device. We recommend users upgrade to newer models for better security." This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-77, CWE-77
References: https://tzh00203.notion.site/EDIMAX-BR-6208AC-V2_1-02-Command-Injection-Vulnerability-in-Web-formRoute-handler-2d3b5c52018a805983d3cf0780b28407?source=copy_link; https://vuldb.com/?ctiid.338647; https://vuldb.com/?id.338647
CVE: CVE-2025-52835
Published: 2025-12-30
Description: Cross-Site Request Forgery (CSRF) vulnerability in ConoHa by GMO WING WordPress Migrator wing-migrator allows Upload a Web Shell to a Web Server.This issue affects WING WordPress Migrator: from n/a through <= 1.2.0.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wing-migrator/vulnerability/wordpress-wing-wordpress-migrator-plugin-1-1-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-59129
Published: 2025-12-30
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in appointify Appointify appointify allows Blind SQL Injection.This issue affects Appointify: from n/a through <= 1.0.8.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/appointify/vulnerability/wordpress-appointify-plugin-1-0-8-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-62112
Published: 2025-12-30
Description: Cross-Site Request Forgery (CSRF) vulnerability in Merv Barrett Import into Easy Property Listings easy-property-listings-xml-csv-import allows Cross Site Request Forgery.This issue affects Import into Easy Property Listings: from n/a through <= 2.2.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/easy-property-listings-xml-csv-import/vulnerability/wordpress-import-into-easy-property-listings-plugin-2-2-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-62128
Published: 2025-12-30
Description: Missing Authorization vulnerability in SiteLock SiteLock Security – WP Hardening, Login Security & Malware Scans sitelock allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SiteLock Security – WP Hardening, Login Security & Malware Scans: from n/a through <= 5.0.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/sitelock/vulnerability/wordpress-sitelock-security-plugin-5-0-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-65925
Published: 2025-12-30
Description: An issue was discovered in Zeroheight (SaaS) prior to 2025-06-13. A legacy user creation API pathway allowed accounts to be created without completing the intended email verification step. While unverified accounts could not access product functionality, the behavior bypassed intended verification controls and allowed unintended account creation. This could have enabled spam/fake account creation or resource usage impact. No data exposure or unauthorized access to existing accounts was reported.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: https://github.com/Sneden/zeroheight-account-verification-bypass-CVE-2025-65925
CVE: CVE-2025-66094
Published: 2025-12-30
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dmccan Yada Wiki yada-wiki allows Stored XSS.This issue affects Yada Wiki: from n/a through <= 3.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/yada-wiki/vulnerability/wordpress-yada-wiki-plugin-3-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-66103
Published: 2025-12-30
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in revmakx WPCal.io wpcal allows DOM-Based XSS.This issue affects WPCal.io: from n/a through <= 0.9.5.9.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wpcal/vulnerability/wordpress-wpcal-io-plugin-0-9-5-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-66848
Published: 2025-12-30
Description: JD Cloud NAS routers AX1800 (4.3.1.r4308 and earlier), AX3000 (4.3.1.r4318 and earlier), AX6600 (4.5.1.r4533 and earlier), BE6500 (4.4.1.r4308 and earlier), ER1 (4.5.1.r4518 and earlier), and ER2 (4.5.1.r4518 and earlier) contain an unauthorized remote command execution vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://jd.com; https://www.notion.so/JD-Cloud-Unauth-RCE-2d22b76e8e0c802c975bf186b208d0c2; https://www.jdcloud.com/cn/
CVE: CVE-2025-68618
Published: 2025-12-30
Description: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, using Magick to read a malicious SVG file resulted in a DoS attack. Version 7.1.2-12 fixes the issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-674
References: https://github.com/ImageMagick/ImageMagick/commit/6f431d445f3ddd609c004a1dde617b0a73e60beb; https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p27m-hp98-6637
CVE: CVE-2025-68926
Published: 2025-12-30
Description: RustFS is a distributed object storage system built in Rust. In versions prior to 1.0.0-alpha.78, RustFS implements gRPC authentication using a hardcoded static token `"rustfs rpc"` that is publicly exposed in the source code repository, hardcoded on both client and server sides, non-configurable with no mechanism for token rotation, and universally valid across all RustFS deployments. Any attacker with network access to the gRPC port can authenticate using this publicly known token and execute privileged operations including data destruction, policy manipulation, and cluster configuration changes. Version 1.0.0-alpha.78 contains a fix for the issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-798
References: https://github.com/rustfs/rustfs/security/advisories/GHSA-h956-rh7x-ppgj
CVE: CVE-2025-68950
Published: 2025-12-30
Description: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, Magick fails to check for circular references between two MVGs, leading to a stack overflow. This is a DoS vulnerability, and any situation that allows reading the mvg file will be affected. Version 7.1.2-12 fixes the issue.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-674
References: https://github.com/ImageMagick/ImageMagick/commit/204718c[PII_REDACTED]dcfc0df8e65ed066b008dec; https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7rvh-xqp3-pr8j