deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-43768
Published: 2025-10-24
Description: In Malwarebytes For Teams v.1.0.990 and before and fixed in v.1.0.1003 and later a privilege escalation can occur via the COM interface running in mbamservice.exe.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-269
References: https://hackerone.com/reports/895316; https://www.malwarebytes.com/secure/cves/cve-2021-43768
CVE: CVE-2025-46183
Published: 2025-10-24
Description: The Utils.deserialize function in pgCodeKeeper 10.12.0 processes serialized data from untrusted sources. If an attacker provides a specially crafted .ser file, deserialization may result in unintended code execution or other malicious behavior on the target system.
CVSS Score: 8.2 (HIGH)
CWE: CWE-502
References: https://github.com/hacktimepro/vulnerabilities/blob/main/Disclosure_CVE-2025-46183_pgcodekeeper.md
CVE: CVE-2025-46185
Published: 2025-10-24
Description: An Insecure Permission vulnerability in pgcodekeeper 10.12.0 allows a local attacker to obtain sensitive information via the plaintext storage of passwords and usernames.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-276
References: https://github.com/hacktimepro/vulnerabilities/blob/main/Disclosure_CVE-2025-46185_pgcodekeeper.md
CVE: CVE-2025-46425
Published: 2025-10-24
Description: Dell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-611
References: https://www.dell.com/support/kbdoc/en-us/000382899/dsa-2025-393-security-update-for-storage-center-dell-storage-manager-vulnerabilities
CVE: CVE-2025-11145
Published: 2025-10-24
Description: Observable Discrepancy, Exposure of Sensitive Information to an Unauthorized Actor, Exposure of Private Personal Information to an Unauthorized Actor vulnerability in CBK Soft Software Hardware Electronic Computer Systems Industry and Trade Inc. EnVision allows Account Footprinting.This issue affects enVision: before 250566.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-203, CWE-359
References: https://www.usom.gov.tr/bildirim/tr-25-0361
CVE: CVE-2025-43994
Published: 2025-10-24
Description: Dell Storage Center - Dell Storage Manager, version(s) DSM 20.1.21, contain(s) a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
CVSS Score: 8.6 (HIGH)
CWE: CWE-306
References: https://www.dell.com/support/kbdoc/en-us/000382899/dsa-2025-393-security-update-for-storage-center-dell-storage-manager-vulnerabilities
CVE: CVE-2025-43995
Published: 2025-10-24
Description: Dell Storage Center - Dell Storage Manager, version(s) 20.1.21, contain(s) an Improper Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass. Authentication Bypass in DSM Data Collector. An unauthenticated remote attacker can access APIs exposed by ApiProxy.war in DataCollectorEar.ear by using a special SessionKey and UserId. These userid are special users created in compellentservicesapi for special purposes.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://www.dell.com/support/kbdoc/en-us/000382899/dsa-2025-393-security-update-for-storage-center-dell-storage-manager-vulnerabilities
CVE: CVE-2025-56438
Published: 2025-10-24
Description: An issue in the firmware update mechanism of Nous W3 Smart WiFi Camera v1.33.50.82 allows unauthenticated and physically proximate attackers to escalate privileges to root via supplying a crafted update.tar archive file stored on a FAT32-formatted SD card.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-345
References: http://nous.com; https://github.com/MMarble21/Smart-camera-privilege-escalation/blob/main/ADVISORY.md
CVE: CVE-2025-60568
Published: 2025-10-24
Description: D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formAdvFirewall.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121
References: https://github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/main/23-buffer%20overflow-formAdvFirewall.md
CVE: CVE-2025-60569
Published: 2025-10-24
Description: D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetRoute.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121
References: https://github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/main/25-buffer%20overflow-formSetRoute.md; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2025-60570
Published: 2025-10-24
Description: D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formLogDnsquery.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121
References: https://github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/main/26-buffer%20overflow-formLogDnsquery.md
CVE: CVE-2025-60571
Published: 2025-10-24
Description: D-Link DIR600LAx FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetQoS.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121
References: https://github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/main/24-buffer%20overflow-formSetQoS.md
CVE: CVE-2025-60572
Published: 2025-10-24
Description: D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formAdvNetwork.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121
References: https://github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/main/22-buffer%20overflow-formAdvNetwork.md
CVE: CVE-2025-60936
Published: 2025-10-24
Description: Emoncms 11.7.3 is vulnerable to Cross Site in the input handling mechanism. This vulnerability allows authenticated attackers with API access to inject malicious JavaScript code that executes when administrators view the application logs.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/emoncms/emoncms/issues/1940
CVE: CVE-2025-60938
Published: 2025-10-24
Description: Emoncms 11.7.3 has a remote code execution vulnerability in the firmware upload feature that allows authenticated users to execute arbitrary commands on the target system. The vulnerability stems from insufficient input validation of user-controlled parameters including filename, port, baud_rate, core, and autoreset within the /admin/upload-custom-firmware endpoint.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/emoncms/emoncms/issues/1941
CVE: CVE-2025-61430
Published: 2025-10-24
Description: Improper handling of DNS over TCP in Simple DNS Plus v9 allows a remote attacker with querying access to the DNS server to cause the server to return request payloads from other clients. This happens when the TCP length prefix is malformed (len differs from actual packet len), and due to a concurrency/buffering issue, even when the lengths match. A length prefix that is smaller than the actual packet size increases information leakage. In summary, this vulnerability allows an attacker to see DNS queries of other clients.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-350
References: https://ma-personal.notion.site/simpledns-vuln?source=copy_link; https://www.incognitotgt.me/blog/simpledns-vuln
CVE: CVE-2025-8536
Published: 2025-10-24
Description: A SQL injection vulnerability has been identified in DobryCMS. Improper neutralization of input provided by user into language functionality allows for SQL Injection attacks.

This issue affects older branches of this software.
CWE: CWE-89
References: https://cert.pl/posts/2025/10/CVE-2025-8536; https://studiofabryka.pl/systemy_cms.html
CVE: CVE-2025-12176
Published: 2025-10-24
Description: Undocumented administrative accounts were getting created to facilitate access for applications running on board.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1242
References: https://azure-access.com/security-advisories
CVE: CVE-2025-60547
Published: 2025-10-24
Description: D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetWAN_Wizard7.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121
References: https://github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/main/02-buffer%20overflow-formSetWAN_Wizard7.md
CVE: CVE-2025-60548
Published: 2025-10-24
Description: D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formLanSetupRouterSettings.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/main/01-buffer%20overflow-formLanSetupRouterSettings.md
CVE: CVE-2025-60549
Published: 2025-10-24
Description: D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formAutoDetecWAN_wizard4.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121
References: https://github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/main/05-buffer%20overflow-formAutoDetecWAN_wizard4.md
CVE: CVE-2025-60550
Published: 2025-10-24
Description: D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formEasySetTimezone.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121
References: https://github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/main/04-buffer%20overflow-formEasySetTimezone.md
CVE: CVE-2025-60551
Published: 2025-10-24
Description: D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the next_page parameter in the function formDeviceReboot.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121
References: https://github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/main/07-buffer%20overflow-formDeviceReboot.md
CVE: CVE-2025-60552
Published: 2025-10-24
Description: D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formTcpipSetup.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121
References: https://github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/main/06-buffer%20overflow-formTcpipSetup.md
CVE: CVE-2025-60553
Published: 2025-10-24
Description: D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetWAN_Wizard52.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/main/03-buffer%20overflow-formSetWAN_Wizard52.md
CVE: CVE-2025-60554
Published: 2025-10-24
Description: D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetEnableWizard.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/main/08-buffer%20overflow-formSetEnableWizard.md
CVE: CVE-2025-60555
Published: 2025-10-24
Description: D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetWizardSelectMode.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121
References: https://github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/main/10-buffer%20overflow-formSetWizardSelectMode.md
CVE: CVE-2025-60556
Published: 2025-10-24
Description: D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetWizard1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121
References: https://github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/main/09-buffer%20overflow-formSetWizard1.md
CVE: CVE-2025-60557
Published: 2025-10-24
Description: D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetEasy_Wizard.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121
References: https://github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/main/13-buffer%20overflow-formSetEasy_Wizard.md
CVE: CVE-2025-60558
Published: 2025-10-24
Description: D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formVirtualServ.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121
References: https://github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/main/16-buffer%20overflow-formVirtualServ.md
CVE: CVE-2025-60559
Published: 2025-10-24
Description: D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetDomainFilter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121
References: https://github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/main/19-buffer%20overflow-formSetDomainFilter.md
CVE: CVE-2025-60561
Published: 2025-10-24
Description: D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetEmail.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121
References: https://github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/main/12-buffer%20overflow-formSetEmail.md
CVE: CVE-2025-60562
Published: 2025-10-24
Description: D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formWlSiteSurvey.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121
References: https://github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/main/15-buffer%20overflow-formWlSiteSurvey.md
CVE: CVE-2025-60563
Published: 2025-10-24
Description: D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetPortTr.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121
References: https://github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/main/18-buffer%20overflow-formSetPortTr.md
CVE: CVE-2025-60564
Published: 2025-10-24
Description: D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetLog.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121
References: https://github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/main/14-buffer%20overflow-formSetLog.md
CVE: CVE-2025-60565
Published: 2025-10-24
Description: D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSchedule.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121
References: https://github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/main/17-buffer%20overflow-formSchedule.md
CVE: CVE-2025-60566
Published: 2025-10-24
Description: D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetMACFilter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121
References: https://github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/main/20-buffer%20overflow-formSetMACFilter.md
CVE: CVE-2025-60801
Published: 2025-10-24
Description: jshERP up to commit fbda24da was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the jsh_erp function.
CVSS Score: 8.2 (HIGH)
CWE: CWE-77
References: https://fushuling.com/index.php/2025/08/17/%e7%bb%95%e8%bf%87%e8%a1%a5%e4%b8%81%ef%bc%8c%e5%86%8d%e6%ac%a1%e5%ae%9e%e7%8e%b0%e5%8d%8e%e5%a4%8ferp%e6%9c%aa%e6%8e%88%e6%9d%83rce%e5%b7%b2%e4%bf%ae%e5%a4%8d/; https://github.com/jishenghua/jshERP/issues/132
CVE: CVE-2025-60803
Published: 2025-10-24
Description: Antabot White-Jotter up to commit 9bcadc was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the component /api/aaa;/../register.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/Antabot/White-Jotter/issues/162
CVE: CVE-2025-62714
Published: 2025-10-24
Description: Karmada Dashboard is a general-purpose, web-based control panel for Karmada which is a multi-cluster management project. Prior to version 0.2.0, there is an authentication bypass vulnerability in the Karmada Dashboard API. The backend API endpoints (e.g., /api/v1/secret, /api/v1/service) did not enforce authentication, allowing unauthenticated users to access sensitive cluster information such as Secrets and Services directly. Although the web UI required a valid JWT for access, the API itself remained exposed to direct requests without any authentication checks. Any user or entity with network access to the Karmada Dashboard service could exploit this vulnerability to retrieve sensitive data.
CWE: CWE-862
References: https://github.com/karmada-io/dashboard/commit/8457b8bb87725e2371a638ca5a255fd2895c70f1; https://github.com/karmada-io/dashboard/commit/d2d04909f25e96b4c20fa6b636c398bd1636ee06; https://github.com/karmada-io/dashboard/pull/271
CVE: CVE-2025-60729
Published: 2025-10-24
Description: PerfreeBlog v4.0.11 has an arbitrary file read vulnerability in the validThemeFilePath function
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-126
References: http://perfreeblog.com; https://github.com/dengxmenglihua/cve/blob/main/PerfreeBlog/File%20Read/Arbitrary%20File%20Read%20Vulnerability%20in%20PerfreeBlog%20System.md; https://perfree.org.cn/
CVE: CVE-2025-60730
Published: 2025-10-24
Description: PerfreeBlog v4.0.11 has an arbitrary file deletion vulnerability in the unInstallTheme function
CVSS Score: 7.6 (HIGH)
CWE: CWE-459
References: http://perfreeblog.com; https://github.com/dengxmenglihua/cve/blob/main/PerfreeBlog/File%20Deletion/Arbitrary%20File%20Deletion%20Vulnerability%20in%20PerfreeBlog%20System.md; https://perfree.org.cn/
CVE: CVE-2025-60731
Published: 2025-10-24
Description: PerfreeBlog v4.0.11 has a File Upload vulnerability in the installTheme function
CVSS Score: 7.6 (HIGH)
CWE: CWE-434
References: http://perfreeblog.com; https://github.com/dengxmenglihua/cve/blob/main/PerfreeBlog/File%20Upload/Arbitrary%20File%20Upload%20Vulnerability%20in%20PerfreeBlog%20System.md; https://perfree.org.cn/
CVE: CVE-2025-60735
Published: 2025-10-24
Description: PerfreeBlog v4.0.11 has a File Upload vulnerability in the installPlugin function
CVSS Score: 7.6 (HIGH)
CWE: CWE-434
References: http://perfreeblog.com; https://github.com/dengxmenglihua/cve/blob/main/PerfreeBlog/File%20Upload%202/Arbitrary%20File%20Upload%20Vulnerability%20in%20PerfreeBlog%20System.md; https://perfree.org.cn/
CVE: CVE-2025-60419
Published: 2025-10-24
Description: An issue was discovered in the NDIS Usermode IO driver (RtkIOAC60.sys, version 6.0.5600.16348) allowing local authenticated attackers to send a crafted IOCTL request to the driver to cause a denial of service.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-400
References: http://ndis.com; http://realtek.com; https://splineuser.github.io/posts/RTKVuln/
CVE: CVE-2025-62716
Published: 2025-10-24
Description: Plane is open-source project management software. Prior to version 1.1.0, an open redirect vulnerability in the ?next_path query parameter allows attackers to supply arbitrary schemes (e.g., javascript:) that are passed directly to router.push. This results in a cross-site scripting (XSS) vulnerability, enabling attackers to execute arbitrary JavaScript in the victim’s browser. The issue can be exploited without authentication and has severe impact, including information disclosure, and privilege escalation and modifications of administrative settings. This issue has been patched in version 1.1.0.
CVSS Score: 8.1 (HIGH)
CWE: CWE-79, CWE-601
References: https://github.com/makeplane/plane/security/advisories/GHSA-6fj7-xgpg-mj6f
CVE: CVE-2025-52099
Published: 2025-10-24
Description: Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2025-29088. Reason: This record is a duplicate of CVE-2025-29088. Notes: All CVE users should reference CVE-2025-29088 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage.
CVE: CVE-2025-60954
Published: 2025-10-24
Description: Microweber CMS 2.0 has Weak Password Requirements. The application does not enforce minimum password length or complexity during password resets. Users can set extremely weak passwords, including single-character passwords, which can lead to account compromise, including administrative accounts.
CVSS Score: 8.3 (HIGH)
CWE: CWE-521
References: https://gist.github.com/progprnv/feae2b76f2db0cb2ac6e14b1bf7d8646; https://github.com/microweber/microweber; https://github.com/progprnv/CVE-Reports/blob/main/CVE-2025-60954
CVE: CVE-2025-62717
Published: 2025-10-24
Description: Emlog is an open source website building system. In version 2.5.23, Emlog Pro is vulnerable to a session verification code error due to a clearing logic error. This means the verification code could be reused anywhere an email verification code is required. This issue has been fixed in commit 1f726df.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287
References: https://github.com/emlog/emlog/commit/1f726df0ce56a1bc6e8225dd[PII_REDACTED]3bd0c0; https://github.com/emlog/emlog/security/advisories/GHSA-wwj4-ppfj-hcm6
CVE: CVE-2025-62723
Published: 2025-10-24
Description: FlashMQ is a MQTT broker/server, designed for multi-CPU environments. Prior to version 1.23.2, any authenticated user can create sessions and have them collect QoS messages. When not sent to a client, these are then not released upon (eventual) session expiration. Version 1.23.2 fixes the issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-772
References: https://github.com/halfgaar/FlashMQ/commit/e86c49360ef4387440c97f591770cdb9284b4ee9; https://github.com/halfgaar/FlashMQ/issues/154; https://github.com/halfgaar/FlashMQ/security/advisories/GHSA-7mhp-22q4-r6vv
CVE: CVE-2025-34293
Published: 2025-10-24
Description: GN4 Publishing System versions prior to 2.6 contain an insecure direct object reference (IDOR) vulnerability via the API. Authenticated requests to the API's object endpoints allow an authenticated user to request arbitrary user IDs and receive sensitive account data for those users, including the stored password and the account's security question and answer. The exposed recovery data and encrypted password may be used to reset or take over the target account.
CWE: CWE-639
References: https://nne.navigacloud.com/GN4Help/gn4_introduction_to_gn4.htm; https://www.miles33.com/news/news/5955/naviga--miles-33--acquisition.html; https://www.miles33.com/section/14/gn4
CVE: CVE-2025-4106
Published: 2025-10-24
Description: An authenticated admin user with access to both the management WebUI and command line interface on a Firebox can enable a diagnostic debug shell by uploading a platform and version-specific diagnostic package and executing a leftover diagnostic command.



This issue affects Fireware OS: from 12.0 before 12.11.2.
CWE: CWE-489
References: https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00010
CVE: CVE-2025-62711
Published: 2025-10-24
Description: Wasmtime is a runtime for WebAssembly. In versions from 38.0.0 to before 38.0.3, the implementation of component-model related host-to-wasm trampolines in Wasmtime contained a bug where it's possible to carefully craft a component, which when called in a specific way, would crash the host with a segfault or assert failure. Wasmtime 38.0.3 has been released and is patched to fix this issue. There are no workarounds.
CVSS Score: 3.1 (LOW)
CWE: CWE-755
References: https://github.com/bytecodealliance/wasmtime/commit/192f2fcdadfec9d0cf6b58548a85a7307450cbf5; https://github.com/bytecodealliance/wasmtime/pull/11592; https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-4h67-722j-5pmc