deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-51481
Published: 2025-07-22
Description: Local File Inclusion in dagster._grpc.impl.get_notebook_data in Dagster 1.10.14 allows attackers with access to the gRPC server to read arbitrary files by supplying path traversal sequences in the notebook_path field of ExternalNotebookData requests, bypassing the intended extension-based check.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-22
References: https://github.com/dagster-io/dagster; https://github.com/dagster-io/dagster/pull/30002; https://www.gecko.security/blog/cve-2025-51481
CVE: CVE-2025-51482
Published: 2025-07-22
Description: Remote Code Execution in letta.server.rest_api.routers.v1.tools.run_tool_from_source in letta-ai Letta 0.7.12 allows remote attackers to execute arbitrary Python code and system commands via crafted payloads to the /v1/tools/run endpoint, bypassing intended sandbox restrictions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://github.com/letta-ai/letta; https://github.com/letta-ai/letta/pull/2630; https://www.gecko.security/blog/cve-2025-51482
CVE: CVE-2025-6523
Published: 2025-07-22
Description: Use of weak credentials in emergency authentication component in Devolutions Server allows an unauthenticated attacker to bypass authentication via brute forcing the short emergency codes generated by the server within a feasible timeframe.

This issue affects the following versions :

  *  Devolutions Server 2025.2.2.0 through 2025.2.3.0
  *  
Devolutions Server 2025.1.11.0 and earlier
CVSS Score: 7.7 (HIGH)
CWE: CWE-1391
References: https://devolutions.net/security/advisories/DEVO-2025-0012/
CVE: CVE-2025-6741
Published: 2025-07-22
Description: Improper access control in secure message component in Devolutions Server allows an authenticated user to steal unauthorized entries via the secure message entry attachment feature


This issue affects the following versions :

  *  Devolutions Server 2025.2.2.0 through 2025.2.4.0
  *  
Devolutions Server 2025.1.11.0 and earlier
CVSS Score: 7.7 (HIGH)
CWE: CWE-284
References: https://devolutions.net/security/advisories/DEVO-2025-0012/
CVE: CVE-2024-38335
Published: 2025-07-22
Description: IBM Security QRadar Network Threat Analytics 1.0.0 through 1.3.1 could allow a privileged user to cause a denial of service due to improper allocation of resources.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-770
References: https://www.ibm.com/support/pages/node/7240244
CVE: CVE-2025-48964
Published: 2025-07-22
Description: ping in iputils before 20250602 allows a denial of service (application error in adaptive ping mode or incorrect data collection) via a crafted ICMP Echo Reply packet, because a zero timestamp can lead to large intermediate values that have an integer overflow when squared during statistics calculations. NOTE: this issue exists because of an incomplete fix for CVE-2025-47268 (that fix was only about timestamp calculations, and it did not account for a specific scenario where the original timestamp in the ICMP payload is zero).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-190
References: https://bugzilla.suse.com/show_bug.cgi?id=1243772; https://github.com/iputils/iputils/commit/afa36390394a6e0cceba03b52b59b6d41710608c; https://github.com/iputils/iputils/issues
CVE: CVE-2025-51464
Published: 2025-07-22
Description: Cross-site Scripting (XSS) in aimhubio Aim 3.28.0 allows remote attackers to execute arbitrary JavaScript in victims browsers via malicious Python code submitted to the /api/reports endpoint, which is interpreted and executed by Pyodide when the report is viewed. No sanitisation or sandbox restrictions prevent JavaScript execution via pyodide.code.run_js().
CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: https://github.com/aimhubio/aim; https://github.com/aimhubio/aim/pull/3333; https://www.gecko.security/blog/cve-2025-51464
CVE: CVE-2025-51459
Published: 2025-07-22
Description: File Upload vulnerability in agent.hub.controller.refresh_plugins in eosphoros-ai DB-GPT 0.7.0 allows remote attackers to execute arbitrary code via a malicious plugin ZIP file uploaded to the /v1/personal/agent/upload endpoint, interacting with plugin_hub._sanitize_filename and plugins_util.scan_plugins.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: https://github.com/eosphoros-ai/DB-GPT/pull/2649; https://www.gecko.security/blog/cve-2025-51459
CVE: CVE-2025-51471
Published: 2025-07-22
Description: Cross-Domain Token Exposure in server.auth.getAuthorizationToken in Ollama 0.6.7 allows remote attackers to steal authentication tokens and bypass access controls via a malicious realm value in a WWW-Authenticate header returned by the /api/pull endpoint.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-345, CWE-384
References: https://github.com/ollama/ollama; https://github.com/ollama/ollama/pull/10750; https://huntr.com/bounties/94eea285-fd65-4e01-a035-f533575ebdc2
CVE: CVE-2025-51479
Published: 2025-07-22
Description: Authorization bypass in update_user_group in onyx-dot-app Onyx Enterprise Edition 0.27.0 allows remote authenticated attackers to modify arbitrary user groups via crafted PATCH requests to the /api/manage/admin/user-group/id endpoint, bypassing intended curator-group assignment checks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-639
References: https://github.com/onyx-dot-app/onyx; https://github.com/onyx-dot-app/onyx/pull/4714; https://www.gecko.security/blog/cve-2025-51479
CVE: CVE-2025-31511
Published: 2025-07-22
Description: An issue was discovered in AlertEnterprise Guardian 4.1.14.2.2.1. One can bypass manager approval by changing the user ID in a Request%20Building%20Access requestSubmit API call. The vendor has stated that the system is protected by updating to a version equal to or greater than one of the following build numbers: 4.1.12.2.1.19, 4.1.12.5.2.36, 4.1.13.0.60, 4.1.13.2.0.3.39, 4.1.13.2.0.3.41, 4.1.13.2.42, 4.1.13.2.25.44, 4.1.14.0.13, 4.1.14.0.43, 4.1.14.0.48, and 4.1.14.1.5.32.
CVSS Score: 7.3 (HIGH)
CWE: CWE-290
References: https://alertenterprise.com/switch-to-guardian/; https://alertenterprise.screenstepslive.com/a/1969949-alertenterprise-security-advisory-july-2025; https://x.com/pand0rausa/status/[PII_REDACTED]09826359
CVE: CVE-2025-31512
Published: 2025-07-22
Description: An issue was discovered in AlertEnterprise Guardian 4.1.14.2.2.1. One can bypass manager approval via isAddedByApprover in a Request%20Building%20Access requestSubmit API call. The vendor has stated that the system is protected by updating to a version equal to or greater than one of the following build numbers: 4.1.12.2.1.19, 4.1.12.5.2.36, 4.1.13.0.60, 4.1.13.2.0.3.39, 4.1.13.2.0.3.41, 4.1.13.2.42, 4.1.13.2.25.44, 4.1.14.0.13, 4.1.14.0.43, 4.1.14.0.48, and 4.1.14.1.5.32.
CVSS Score: 7.3 (HIGH)
CWE: CWE-288
References: https://alertenterprise.com/switch-to-guardian/; https://alertenterprise.screenstepslive.com/a/1969949-alertenterprise-security-advisory-july-2025; https://x.com/pand0rausa/status/[PII_REDACTED]09826359
CVE: CVE-2025-31513
Published: 2025-07-22
Description: An issue was discovered in AlertEnterprise Guardian 4.1.14.2.2.1. One can elevate to administrator privileges via the IsAdminApprover parameter in a Request%20Building%20Access requestSubmit API call. The vendor has stated that the system is protected by updating to a version equal to or greater than one of the following build numbers: 4.1.12.2.1.19, 4.1.12.5.2.36, 4.1.13.0.60, 4.1.13.2.0.3.39, 4.1.13.2.0.3.41, 4.1.13.2.42, 4.1.13.2.25.44, 4.1.14.0.13, 4.1.14.0.43, 4.1.14.0.48, and 4.1.14.1.5.32.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-266
References: https://alertenterprise.com/switch-to-guardian/; https://alertenterprise.screenstepslive.com/a/1969949-alertenterprise-security-advisory-july-2025; https://x.com/pand0rausa/status/[PII_REDACTED]09826359
CVE: CVE-2025-51458
Published: 2025-07-22
Description: SQL Injection in editor_sql_run and query_ex in eosphoros-ai DB-GPT 0.7.0 allows remote attackers to execute arbitrary SQL statements via crafted input passed to the /v1/editor/sql/run or /v1/editor/chart/run endpoints, interacting with api_editor_v1.editor_sql_run, editor_chart_run, and datasource.rdbms.base.query_ex.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/eosphoros-ai/DB-GPT/pull/2650; https://www.gecko.security/blog/cve-2025-51458
CVE: CVE-2025-51472
Published: 2025-07-22
Description: Code Injection in AgentTemplate.eval_agent_config in TransformerOptimus SuperAGI 0.0.14 allows remote attackers to execute arbitrary Python code via malicious values in agent template configurations such as the goal, constraints, or instruction field, which are evaluated using eval() without validation during template loading or updates.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: https://github.com/TransformerOptimus/SuperAGI; https://github.com/TransformerOptimus/SuperAGI/pull/1461; https://www.gecko.security/blog/cve-2025-51472
CVE: CVE-2025-51475
Published: 2025-07-22
Description: Arbitrary File Overwrite (AFO) in superagi.controllers.resources.upload in TransformerOptimus SuperAGI 0.0.14 allows remote attackers to overwrite arbitrary files via unsanitised filenames submitted to the file upload endpoint, due to improper handling of directory traversal in os.path.join() and lack of path validation in get_root_input_dir().
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: https://github.com/TransformerOptimus/SuperAGI; https://github.com/TransformerOptimus/SuperAGI/pull/1463; https://www.gecko.security/blog/cve-2025-51475
CVE: CVE-2025-51462
Published: 2025-07-22
Description: Stored Cross-site Scripting (XSS) vulnerability in api.apps.dialog_app.set_dialog in RAGFlow 0.17.2 allows remote attackers to execute arbitrary JavaScript via crafted input to the assistant greeting field, which is stored unsanitised and rendered using a markdown component with rehype-raw.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/infiniflow/ragflow; https://github.com/infiniflow/ragflow/pull/7250; https://www.gecko.security/blog/cve-2025-51462
CVE: CVE-2025-7723
Published: 2025-07-22
Description: A command injection vulnerability exists that can be exploited after authentication in VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V2.This issue affects VIGI NVR1104H-4P V1: before 1.1.5 Build 250518; VIGI NVR2016H-16MP V2: before 1.3.1 Build 250407.
CWE: CWE-78
References: https://www.tp-link.com/jp/support/download/vigi-nvr1104h-4p/#Firmware; https://www.tp-link.com/jp/support/download/vigi-nvr2016h-16mp/#Firmware; https://www.tp-link.com/us/support/faq/4547/
CVE: CVE-2025-7724
Published: 2025-07-22
Description: An unauthenticated OS command injection vulnerability exists in VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V2.This issue affects VIGI NVR1104H-4P V1: before 1.1.5 Build 250518; VIGI NVR2016H-16MP V2: before 1.3.1 Build 250407.
CWE: CWE-78
References: https://www.tp-link.com/jp/support/download/vigi-nvr1104h-4p/#Firmware; https://www.tp-link.com/jp/support/download/vigi-nvr2016h-16mp/#Firmware; https://www.tp-link.com/us/support/faq/4547/
CVE: CVE-2025-8027
Published: 2025-07-22
Description: On 64-bit platforms IonMonkey-JIT only wrote 32 bits of the 64-bit return value space on the stack. Baseline-JIT, however, read the entire 64 bits. This vulnerability was fixed in Firefox 141, Firefox ESR 115.26, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-457
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1968423; https://www.mozilla.org/security/advisories/mfsa2025-56/; https://www.mozilla.org/security/advisories/mfsa2025-57/
CVE: CVE-2025-8028
Published: 2025-07-22
Description: On arm64, a WASM `br_table` instruction with a lot of entries could lead to the label being too far from the instruction causing truncation and incorrect computation of the branch address. This vulnerability was fixed in Firefox 141, Firefox ESR 115.26, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1332
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1971581; https://www.mozilla.org/security/advisories/mfsa2025-56/; https://www.mozilla.org/security/advisories/mfsa2025-57/
CVE: CVE-2025-8029
Published: 2025-07-22
Description: Thunderbird executed `javascript:` URLs when used in `object` and `embed` tags. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1.
CVSS Score: 8.1 (HIGH)
CWE: CWE-80
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1928021; https://www.mozilla.org/security/advisories/mfsa2025-56/; https://www.mozilla.org/security/advisories/mfsa2025-58/
CVE: CVE-2025-8030
Published: 2025-07-22
Description: Insufficient escaping in the “Copy as cURL” feature could potentially be used to trick a user into executing unexpected code. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1.
CVSS Score: 8.1 (HIGH)
CWE: CWE-94
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1968414; https://www.mozilla.org/security/advisories/mfsa2025-56/; https://www.mozilla.org/security/advisories/mfsa2025-58/
CVE: CVE-2025-8031
Published: 2025-07-22
Description: The `username:password` part was not correctly stripped from URLs in CSP reports potentially leaking HTTP Basic Authentication credentials. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-276
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1971719; https://www.mozilla.org/security/advisories/mfsa2025-56/; https://www.mozilla.org/security/advisories/mfsa2025-58/
CVE: CVE-2025-8032
Published: 2025-07-22
Description: XSLT document loading did not correctly propagate the source document which bypassed its CSP. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1.
CVSS Score: 8.1 (HIGH)
CWE: CWE-693
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1974407; https://www.mozilla.org/security/advisories/mfsa2025-56/; https://www.mozilla.org/security/advisories/mfsa2025-58/
CVE: CVE-2025-8033
Published: 2025-07-22
Description: The JavaScript engine did not handle closed generators correctly and it was possible to resume them leading to a nullptr deref. This vulnerability was fixed in Firefox 141, Firefox ESR 115.26, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1973990; https://www.mozilla.org/security/advisories/mfsa2025-56/; https://www.mozilla.org/security/advisories/mfsa2025-57/
CVE: CVE-2025-8034
Published: 2025-07-22
Description: Memory safety bugs present in Firefox ESR 115.25, Firefox ESR 128.12, Thunderbird ESR 128.12, Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 141, Firefox ESR 115.26, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1970422; https://www.mozilla.org/security/advisories/mfsa2025-56/; https://www.mozilla.org/security/advisories/mfsa2025-57/
CVE: CVE-2025-8035
Published: 2025-07-22
Description: Memory safety bugs present in Firefox ESR 128.12, Thunderbird ESR 128.12, Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1975961; https://www.mozilla.org/security/advisories/mfsa2025-56/; https://www.mozilla.org/security/advisories/mfsa2025-58/
CVE: CVE-2025-8036
Published: 2025-07-22
Description: Thunderbird cached CORS preflight responses across IP address changes. This allowed circumventing CORS with DNS rebinding. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1.
CVSS Score: 8.1 (HIGH)
CWE: CWE-350
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1960834; https://www.mozilla.org/security/advisories/mfsa2025-56/; https://www.mozilla.org/security/advisories/mfsa2025-59/
CVE: CVE-2025-8037
Published: 2025-07-22
Description: Setting a nameless cookie with an equals sign in the value shadowed other cookies. Even if the nameless cookie was set over HTTP and the shadowed cookie included the `Secure` attribute. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-614
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1964767; https://www.mozilla.org/security/advisories/mfsa2025-56/; https://www.mozilla.org/security/advisories/mfsa2025-59/
CVE: CVE-2025-8038
Published: 2025-07-22
Description: Thunderbird ignored paths when checking the validity of navigations in a frame. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-345
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1808979; https://www.mozilla.org/security/advisories/mfsa2025-56/; https://www.mozilla.org/security/advisories/mfsa2025-59/
CVE: CVE-2025-8039
Published: 2025-07-22
Description: In some cases search terms persisted in the URL bar even after navigating away from the search page. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1.
CVSS Score: 8.1 (HIGH)
CWE: CWE-200
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1970997; https://www.mozilla.org/security/advisories/mfsa2025-56/; https://www.mozilla.org/security/advisories/mfsa2025-59/
CVE: CVE-2025-8040
Published: 2025-07-22
Description: Memory safety bugs present in Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1975058%2C1975998; https://www.mozilla.org/security/advisories/mfsa2025-56/; https://www.mozilla.org/security/advisories/mfsa2025-59/
CVE: CVE-2025-8043
Published: 2025-07-22
Description: Focus incorrectly truncated URLs towards the beginning instead of around the origin. This vulnerability was fixed in Firefox 141.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-451
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1970209; https://www.mozilla.org/security/advisories/mfsa2025-56/
CVE: CVE-2025-8044
Published: 2025-07-22
Description: Memory safety bugs present in Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 141 and Thunderbird 141.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1933572%2C1971116; https://www.mozilla.org/security/advisories/mfsa2025-56/; https://www.mozilla.org/security/advisories/mfsa2025-61/
CVE: CVE-2025-41425
Published: 2025-07-22
Description: DuraComm SPM-500 DP-10iN-100-MU

 is vulnerable to a cross-site scripting attack. This could allow an attacker to prevent legitimate users from accessing the web interface.
CVSS Score: 8.1 (HIGH)
CWE: CWE-79
References: https://duracomm.com/contact-us/; https://www.cisa.gov/news-events/ics-advisories/icsa-25-203-01
CVE: CVE-2025-48733
Published: 2025-07-22
Description: DuraComm SPM-500 DP-10iN-100-MU

 lacks access controls for a function that should require user authentication. This could allow an attacker to repeatedly reboot the device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://duracomm.com/contact-us/; https://www.cisa.gov/news-events/ics-advisories/icsa-25-203-01
CVE: CVE-2025-53538
Published: 2025-07-22
Description: Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. In versions 7.0.10 and below and  8.0.0-beta1 through 8.0.0-rc1, mishandling of data on HTTP2 stream 0 can lead to uncontrolled memory usage, leading to loss of visibility. Workarounds include disabling the HTTP/2 parser, and using a signature like drop http2 any any -> any any (frame:http2.hdr; byte_test:1,=,0,3; byte_test:4,=,0,5; sid: 1;) where the first byte test tests the HTTP2 frame type DATA and the second tests the stream id 0. This is fixed in versions 7.0.11 and 8.0.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-770
References: https://github.com/OISF/suricata/commit/1d6d331752e933c46aca0ae7a9679b27462246e3; https://github.com/OISF/suricata/commit/7fa88ea9e7d05e07a7864050cfd836b576669720; https://github.com/OISF/suricata/security/advisories/GHSA-qrr7-crgj-cmh3
CVE: CVE-2025-53703
Published: 2025-07-22
Description: DuraComm SPM-500 DP-10iN-100-MU

 transmits sensitive data without encryption over a channel that could be intercepted by attackers.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: https://duracomm.com/contact-us/; https://www.cisa.gov/news-events/ics-advisories/icsa-25-203-01
CVE: CVE-2025-54072
Published: 2025-07-22
Description: yt-dlp is a feature-rich command-line audio/video downloader. In versions 2025.06.25 and below, when the --exec option is used on Windows with the default placeholder (or {}), insufficient sanitization is applied to the expanded filepath, allowing for remote code execution. This is a bypass of the mitigation for CVE-2024-22423 where the default placeholder and {} were not covered by the new escaping rules. Windows users who are unable to upgrade should avoid using --exec altogether. Instead, the --write-info-json or --dump-json options could be used, with an external script or command line consuming the JSON output. This is fixed in version 2025.07.21.
CVSS Score: 7.5 (HIGH)
CWE: CWE-78
References: https://github.com/yt-dlp/yt-dlp/commit/959ac99e98c3215437e573c22d64be42d361e863; https://github.com/yt-dlp/yt-dlp/releases/tag/2025.07.21; https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-45hg-7f49-5h56
CVE: CVE-2025-54137
Published: 2025-07-22
Description: HAX CMS NodeJS allows users to manage their microsite universe with a NodeJS backend. Versions 11.0.9 and below were distributed with hardcoded default credentials for the user and superuser accounts. Additionally, the application has default private keys for JWTs. Users aren't prompted to change credentials or secrets during installation, and there is no way to change them through the UI. An unauthenticated attacker can read the default user credentials and JWT private keys from the public haxtheweb GitHub repositories. These credentials and keys can be used to access unconfigured self-hosted instances of the application, modify sites, and perform further attacks. This is fixed in version 11.0.10.
CVSS Score: 7.3 (HIGH)
CWE: CWE-1392
References: https://github.com/haxtheweb/haxcms-nodejs/blob/main/src/lib/HAXCMS.js#L1614; https://github.com/haxtheweb/haxcms-nodejs/commit/6dc2441c876350ca6fe9fbaecb058d92ef442869; https://github.com/haxtheweb/issues/security/advisories/GHSA-5fpv-5qvh-7cf3