deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-14422
Published: 2025-12-23
Description: GIMP PNM File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PNM files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28273.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://gitlab.gnome.org/GNOME/gimp/-/commit/4ff2d773d58064e6130495de498e440f4a6d5edb; https://www.zerodayinitiative.com/advisories/ZDI-25-1136/
CVE: CVE-2025-14423
Published: 2025-12-23
Description: GIMP LBM File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of LBM files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28311.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121
References: https://gitlab.gnome.org/GNOME/gimp/-/commit/481cdbbb97746be1145ec3a633c567a68633c521; https://www.zerodayinitiative.com/advisories/ZDI-25-1137/
CVE: CVE-2025-14424
Published: 2025-12-23
Description: GIMP XCF File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of XCF files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28376.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://gitlab.gnome.org/GNOME/gimp/-/commit/5cc55d078b7fba995cef77d195fac325ee288ddd; https://www.zerodayinitiative.com/advisories/ZDI-25-1138/
CVE: CVE-2025-14425
Published: 2025-12-23
Description: GIMP JP2 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of JP2 files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28248.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://gitlab.gnome.org/GNOME/gimp/-/commit/cd1c88a0364ad1444c[PII_REDACTED]2a99bd8643fd; https://www.zerodayinitiative.com/advisories/ZDI-25-1139/
CVE: CVE-2025-14488
Published: 2025-12-23
Description: RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of RealDefense SUPERAntiSpyware. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the SAS Core Service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-27657.
CVSS Score: 7.8 (HIGH)
CWE: CWE-749
References: https://www.zerodayinitiative.com/advisories/ZDI-25-1167/
CVE: CVE-2025-14489
Published: 2025-12-23
Description: RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of RealDefense SUPERAntiSpyware. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the SAS Core Service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-27658.
CVSS Score: 7.8 (HIGH)
CWE: CWE-749
References: https://www.zerodayinitiative.com/advisories/ZDI-25-1165/
CVE: CVE-2025-14490
Published: 2025-12-23
Description: RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of RealDefense SUPERAntiSpyware. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the SAS Core Service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-27659.
CVSS Score: 7.8 (HIGH)
CWE: CWE-749
References: https://www.zerodayinitiative.com/advisories/ZDI-25-1166/
CVE: CVE-2025-14491
Published: 2025-12-23
Description: RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of RealDefense SUPERAntiSpyware. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the SAS Core Service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-27660.
CVSS Score: 7.8 (HIGH)
CWE: CWE-749
References: https://www.zerodayinitiative.com/advisories/ZDI-25-1164/
CVE: CVE-2025-14492
Published: 2025-12-23
Description: RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of RealDefense SUPERAntiSpyware. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the SAS Core Service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-27668.
CVSS Score: 7.8 (HIGH)
CWE: CWE-749
References: https://www.zerodayinitiative.com/advisories/ZDI-25-1172/
CVE: CVE-2025-14493
Published: 2025-12-23
Description: RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of RealDefense SUPERAntiSpyware. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the SAS Core Service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-27675.
CVSS Score: 7.8 (HIGH)
CWE: CWE-749
References: https://www.zerodayinitiative.com/advisories/ZDI-25-1170/
CVE: CVE-2025-14494
Published: 2025-12-23
Description: RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of RealDefense SUPERAntiSpyware. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the SAS Core Service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-27676.
CVSS Score: 7.8 (HIGH)
CWE: CWE-749
References: https://www.zerodayinitiative.com/advisories/ZDI-25-1163/
CVE: CVE-2025-14495
Published: 2025-12-23
Description: RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of RealDefense SUPERAntiSpyware. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the SAS Core Service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-27677.
CVSS Score: 7.8 (HIGH)
CWE: CWE-749
References: https://www.zerodayinitiative.com/advisories/ZDI-25-1169/
CVE: CVE-2025-14496
Published: 2025-12-23
Description: RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of RealDefense SUPERAntiSpyware. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the SAS Core Service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-27678.
CVSS Score: 7.8 (HIGH)
CWE: CWE-749
References: https://www.zerodayinitiative.com/advisories/ZDI-25-1171/
CVE: CVE-2025-14497
Published: 2025-12-23
Description: RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of RealDefense SUPERAntiSpyware. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the SAS Core Service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-27680.
CVSS Score: 7.8 (HIGH)
CWE: CWE-749
References: https://www.zerodayinitiative.com/advisories/ZDI-25-1168/
CVE: CVE-2025-14498
Published: 2025-12-23
Description: TradingView Desktop Electron Uncontrolled Search Path Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of TradingView Desktop. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the configuration of the Electron framework. The product loads a script file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of a target user. Was ZDI-CAN-27395.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://www.zerodayinitiative.com/advisories/ZDI-25-1070/
CVE: CVE-2025-14499
Published: 2025-12-23
Description: IceWarp gmaps Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of IceWarp. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of a parameter passed to the gmaps webpage. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of an arbitrary script. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-25441.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: https://support.icewarp.com/hc/en-us/community/posts/[PII_REDACTED]7729-EPOS-Update-2-build-8-14-2-0-8; https://www.zerodayinitiative.com/advisories/ZDI-25-1071/
CVE: CVE-2025-14500
Published: 2025-12-23
Description: IceWarp14 X-File-Operation Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IceWarp. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of the X-File-Operation header. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-27394.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.zerodayinitiative.com/advisories/ZDI-25-1072/
CVE: CVE-2025-14501
Published: 2025-12-23
Description: Sante PACS Server HTTP Content-Length Header Handling NULL Pointer Dereference Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Sante PACS Server. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of HTTP Content-Length header. The issue results from the lack of proper validation of a pointer prior to accessing it. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-26770.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://www.zerodayinitiative.com/advisories/ZDI-25-1104/
CVE: CVE-2025-15046
Published: 2025-12-23
Description: A vulnerability has been found in Tenda WH450 1.0.0.18. The impacted element is an unknown function of the file /goform/PPTPClient of the component HTTP Request Handler. Such manipulation of the argument netmsk leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119, CWE-121
References: https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda_WH450/PPTPClient/PPTPClient.md; https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda_WH450/PPTPClient/PPTPClient.md#reproduce; https://vuldb.com/?ctiid.337851
CVE: CVE-2025-15047
Published: 2025-12-23
Description: A vulnerability was found in Tenda WH450 1.0.0.18. This affects an unknown function of the file /goform/PPTPDClient of the component HTTP Request Handler. Performing a manipulation of the argument Username results in stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made public and could be used.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119, CWE-121
References: https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda_WH450/PPTPDClient/PPTPDClient.md; https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda_WH450/PPTPDClient/PPTPDClient.md#reproduce; https://vuldb.com/?ctiid.337852
CVE: CVE-2025-66209
Published: 2025-12-23
Description: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in the Database Backup functionality allows users with application/service management permissions to execute arbitrary commands as root on managed servers. Database names used in backup operations are passed directly to shell commands without sanitization, enabling full remote code execution. Version 4.0.0-beta.451 fixes the issue.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-78
References: https://github.com/0xrakan/coolify-cve-2025-66209-66213; https://github.com/coollabsio/coolify/pull/7375; https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.451
CVE: CVE-2025-66210
Published: 2025-12-23
Description: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in the Database Import functionality allows users with application/service management permissions to execute arbitrary commands as root on managed servers. Database names used in import operations are passed directly to shell commands without sanitization, enabling full remote code execution. Version 4.0.0-beta.451 fixes the issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/0xrakan/coolify-cve-2025-66209-66213; https://github.com/coollabsio/coolify/pull/7375; https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.451
CVE: CVE-2025-66211
Published: 2025-12-23
Description: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in PostgreSQL Init Script Filename handling allows users with application/service management permissions to execute arbitrary commands as root on managed servers. PostgreSQL initialization script filenames are passed to shell commands without proper validation, enabling full remote code execution. Version 4.0.0-beta.451 fixes the issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/0xrakan/coolify-cve-2025-66209-66213; https://github.com/coollabsio/coolify/pull/7375; https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.451
CVE: CVE-2025-66212
Published: 2025-12-23
Description: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in the Dynamic Proxy Configuration Filename handling allows users with application/service management permissions to execute arbitrary commands as root on managed servers. Proxy configuration filenames are passed to shell commands without proper escaping, enabling full remote code execution. Version 4.0.0-beta.451 fixes the issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/0xrakan/coolify-cve-2025-66209-66213; https://github.com/coollabsio/coolify/pull/7375; https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.451
CVE: CVE-2025-66213
Published: 2025-12-23
Description: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in the File Storage Directory Mount Path functionality allows users with application/service management permissions to execute arbitrary commands as root on managed servers. The file_storage_directory_source parameter is passed directly to shell commands without proper sanitization, enabling full remote code execution on the host system. Version 4.0.0-beta.451 fixes the issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/0xrakan/coolify-cve-2025-66209-66213; https://github.com/coollabsio/coolify/pull/7375; https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.451
CVE: CVE-2025-15048
Published: 2025-12-23
Description: A vulnerability was determined in Tenda WH450 1.0.0.18. This impacts an unknown function of the file /goform/CheckTools of the component HTTP Request Handler. Executing a manipulation of the argument ipaddress can lead to command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-77
References: https://github.com/z472421519/BinaryAudit/blob/main/PoC/CMD/Tenda_WH450/CheckTools/CheckTools.md; https://github.com/z472421519/BinaryAudit/blob/main/PoC/CMD/Tenda_WH450/CheckTools/CheckTools.md#reproduce; https://vuldb.com/?ctiid.337853
CVE: CVE-2025-15049
Published: 2025-12-23
Description: A vulnerability was identified in code-projects Online Farm System 1.0. Affected is an unknown function of the file /addProduct.php. The manipulation of the argument Username leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/xiaotsai/tttt/issues/1; https://vuldb.com/?ctiid.337854
CVE: CVE-2025-68617
Published: 2025-12-23
Description: FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From versions 2.5.0 to before 2.5.2, a race condition during unloading of a DLS file can trigger a heap-based use-after-free. A concurrently running thread may be pending to unload a DLS file, leading to use of freed memory, if the synthesizer is being concurrently destroyed, or samples of the (unloaded) DLS file are concurrently used to synthesize audio. This issue has been patched in version 2.5.2. The problem will not occur, when explicitly unloading a DLS file (before synth destruction), provided that at the time of unloading, no samples of the respective file are used by active voices. The problem will not occur in versions of FluidSynth that have been compiled without native DLS support.
CVSS Score: 7.0 (HIGH)
CWE: CWE-416
References: https://github.com/FluidSynth/fluidsynth/commit/685e54cdc44911ace31774260bd0c9ec89887491; https://github.com/FluidSynth/fluidsynth/commit/962b9946b5cb6b16f0c08b89dd1b7016d4fce886; https://github.com/FluidSynth/fluidsynth/issues/1717
CVE: CVE-2025-68664
Published: 2025-12-23
Description: LangChain is a framework for building agents and LLM-powered applications. Prior to versions 0.3.81 and 1.2.5, a serialization injection vulnerability exists in LangChain's dumps() and dumpd() functions. The functions do not escape dictionaries with 'lc' keys when serializing free-form dictionaries. The 'lc' key is used internally by LangChain to mark serialized objects. When user-controlled data contains this key structure, it is treated as a legitimate LangChain object during deserialization rather than plain user data. This issue has been patched in versions 0.3.81 and 1.2.5.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-502
References: https://github.com/langchain-ai/langchain/commit/5ec0fa69de31bbe3d76e4cf9cd65a6accb8466c8; https://github.com/langchain-ai/langchain/commit/d9ec4c5cc78960abd37da79b0250f5642e6f0ce6; https://github.com/langchain-ai/langchain/pull/34455
CVE: CVE-2025-68665
Published: 2025-12-23
Description: LangChain is a framework for building LLM-powered applications. Prior to @langchain/core versions 0.3.80 and 1.1.8, and prior to langchain versions 0.3.37 and 1.2.3, a serialization injection vulnerability exists in LangChain JS's toJSON() method (and subsequently when string-ifying objects using JSON.stringify(). The method did not escape objects with 'lc' keys when serializing free-form data in kwargs. The 'lc' key is used internally by LangChain to mark serialized objects. When user-controlled data contains this key structure, it is treated as a legitimate LangChain object during deserialization rather than plain user data. This issue has been patched in @langchain/core versions 0.3.80 and 1.1.8, and langchain versions 0.3.37 and 1.2.3
CVSS Score: 8.6 (HIGH)
CWE: CWE-502
References: https://github.com/langchain-ai/langchainjs/commit/e5063f9c6e9989ea067dfdff39262b9e7b6aba62; https://github.com/langchain-ai/langchainjs/releases/tag/%40langchain%2Fcore%401.1.8; https://github.com/langchain-ai/langchainjs/releases/tag/langchain%401.2.3