deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-8424
Published: 2025-08-26
Description: Improper access control on the NetScaler Management Interface in NetScaler ADC and NetScaler Gateway when an attacker can get access to the appliance NSIP, Cluster Management IP or local GSLB Site IP or SNIP with Management Access
CWE: CWE-1284
References: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938
CVE: CVE-2025-9481
Published: 2025-08-26
Description: A security vulnerability has been detected in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This affects the function setIpv6 of the file /goform/setIpv6. The manipulation of the argument tunrd_Prefix leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_35/35.md; https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_35/35.md#poc; https://vuldb.com/?ctiid.321396
CVE: CVE-2025-9482
Published: 2025-08-26
Description: A vulnerability was detected in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This impacts the function portRangeForwardAdd of the file /goform/portRangeForwardAdd. The manipulation of the argument ruleName/schedule/inboundFilter/TCPPorts/UDPPorts results in stack-based buffer overflow. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_36/36.md; https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_36/36.md#poc; https://vuldb.com/?ctiid.321397
CVE: CVE-2025-9483
Published: 2025-08-26
Description: A flaw has been found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. Affected is the function singlePortForwardAdd of the file /goform/singlePortForwardAdd. This manipulation of the argument ruleName/schedule/inboundFilter causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_37/37.md; https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_37/37.md#poc; https://vuldb.com/?ctiid.321398
CVE: CVE-2024-39335
Published: 2025-08-26
Description: Supported versions of Mahara 24.04 before 24.04.1 and 23.04 before 23.04.6 are vulnerable to information being disclosed to an institution administrator under certain conditions via the 'Current submissions' page: Administration -> Groups -> Submissions.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-200
References: https://mahara.org/interaction/forum/topic.php?id=9519; https://mahara.org/interaction/forum/view.php?id=43
CVE: CVE-2025-25732
Published: 2025-08-26
Description: Incorrect access control in the EEPROM component of Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 allows attackers to replace password hashes stored in the EEPROM with hashes of their own, leading to the escalation of privileges to root.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-922
References: https://cwe.mitre.org/data/definitions/922.html; https://phrack.org/issues/72/16_md; https://www.kapsch.net/_Resources/Persistent/3d251a8445e0bf50093903ad70b3dbed34dec7e7/KTC-CVS_RIS-9260_DataSheet.pdf
CVE: CVE-2025-25733
Published: 2025-08-26
Description: Incorrect access control in the SPI Flash Chip of Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 allows physically proximate attackers to arbitrarily modify SPI flash regions, leading to a degradation of the security posture of the device.
CVSS Score: 3.5 (LOW)
CWE: CWE-1233
References: https://cwe.mitre.org/data/definitions/1233.html; https://phrack.org/issues/72/16_md; https://www.kapsch.net/_Resources/Persistent/3d251a8445e0bf50093903ad70b3dbed34dec7e7/KTC-CVS_RIS-9260_DataSheet.pdf
CVE: CVE-2025-25734
Published: 2025-08-26
Description: Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 was discovered to contain an unauthenticated EFI shell which allows attackers to execute arbitrary code or escalate privileges during the boot process.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-284, CWE-1233
References: https://cwe.mitre.org/data/definitions/1233.html; https://phrack.org/issues/72/16_md; https://www.kapsch.net/_Resources/Persistent/3d251a8445e0bf50093903ad70b3dbed34dec7e7/KTC-CVS_RIS-9260_DataSheet.pdf
CVE: CVE-2025-25735
Published: 2025-08-26
Description: Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 were discovered to lack SPI Protected Range Registers (PRRs), allowing attackers with software running on the system to modify SPI flash in real-time.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-1233
References: https://cwe.mitre.org/data/definitions/1233.html; https://phrack.org/issues/72/16_md; https://www.kapsch.net/_Resources/Persistent/3d251a8445e0bf50093903ad70b3dbed34dec7e7/KTC-CVS_RIS-9260_DataSheet.pdf
CVE: CVE-2025-25736
Published: 2025-08-26
Description: Kapsch TrafficCom RIS-9260 RSU LEO v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 were discovered to contain Android Debug Bridge (ADB) pre-installed (/mnt/c3platpersistent/opt/platform-tools/adb) and enabled by default, allowing unauthenticated root shell access to the cellular modem via the default 'kapsch' user.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-306
References: https://cwe.mitre.org/data/definitions/306.html; https://phrack.org/issues/72/16_md; https://www.kapsch.net/_Resources/Persistent/3d251a8445e0bf50093903ad70b3dbed34dec7e7/KTC-CVS_RIS-9260_DataSheet.pdf
CVE: CVE-2025-25737
Published: 2025-08-26
Description: Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 were discovered to lack secure password requirements for its BIOS Supervisor and User accounts, allowing attackers to bypass authentication via a bruteforce attack.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-521
References: https://cwe.mitre.org/data/definitions/521.html; https://phrack.org/issues/72/16_md; https://www.kapsch.net/_Resources/Persistent/3d251a8445e0bf50093903ad70b3dbed34dec7e7/KTC-CVS_RIS-9260_DataSheet.pdf
CVE: CVE-2025-52035
Published: 2025-08-26
Description: A vulnerability in NotesCMS and specifically in the page /index.php?route=notes. The manipulation of the title of the service descriptions leads to a stored XSS vulnerability. The issue was confirmed to be present in the source code as of commit 7d821a0f028b0778b245b99ab3d3bff1ac10e2d3 (dated 2024-05-08) and was fixed in commit 95322c5121dbd7070f3bd54f[PII_REDACTED]a0a8ea (dated 2025-03-31). The attack can be launched remotely.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/yA0-Z/54322492b29d[PII_REDACTED]891a7ef988; https://github.com/PrivateAccount/NotesCMS/issues/2
CVE: CVE-2025-52036
Published: 2025-08-26
Description: A vulnerability has been found in NotesCMS and classified as medium. Affected by this vulnerability is the page /index.php?route=categories. The manipulation of the title of the service descriptions leads to a stored XSS vulnerability. The issue was confirmed to be present in the source code as of commit 7d821a0f028b0778b245b99ab3d3bff1ac10e2d3 (dated 2024-05-08), and was fixed in commit 95322c5121dbd7070f3bd54f[PII_REDACTED]a0a8ea (dated 2025-03-31). The attack can be launched remotely. CWE Definition of the Vulnerability: CWE-79.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/yA0-Z/aeea5af372fec0085c6a4a7bb9c6bc8e; https://github.com/PrivateAccount/NotesCMS/issues/1
CVE: CVE-2025-52037
Published: 2025-08-26
Description: A vulnerability has been found in NotesCMS and classified as medium. Affected by this vulnerability is the page /index.php?route=sites. The manipulation of the title of the service descriptions leads to a stored XSS vulnerability. The issue was confirmed to be present in the source code as of commit 7d821a0f028b0778b245b99ab3d3bff1ac10e2d3 (dated 2024-05-08), and was fixed in commit 95322c5121dbd7070f3bd54f[PII_REDACTED]a0a8ea (dated 2025-03-31). The attack can be launched remotely. CWE Definition of the Vulnerability: CWE-79.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/yA0-Z/eb6cd89398abff716c70866fa873dbde; https://github.com/PrivateAccount/NotesCMS/issues/3
CVE: CVE-2025-52217
Published: 2025-08-26
Description: SelectZero Data Observability Platform before 2025.5.2 is vulnerable to HTML Injection. Legacy UI fields improperly handle user-supplied input, allowing injection of arbitrary HTML.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://selectzero.io/change-log/
CVE: CVE-2025-52218
Published: 2025-08-26
Description: SelectZero Data Observability Platform before 2025.5.2 is vulnerable to Content Spoofing / Text Injection. Improper sanitization of unspecified parameters allows attackers to inject arbitrary text or limited HTML into the login page.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: https://selectzero.io/change-log/
CVE: CVE-2025-52219
Published: 2025-08-26
Description: SelectZero SelectZero Data Observability Platform before 2025.5.2 contains an Open Redirect vulnerability. Legacy UI fields can be used to create arbitrary external links via HTML Injection.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-601
References: https://selectzero.io/change-log/
CVE: CVE-2025-6366
Published: 2025-08-26
Description: The Event List plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.0.4. This is due to the plugin not properly validating a user's capabilities prior to updating their profile in the el_update_profile() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change their capabilities to those of an administrator.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://themeforest.net/item/meup-marketplace-events-wordpress-theme/24770641; https://www.wordfence.com/threat-intel/vulnerabilities/id/5998520b-62fd-4b3d-9b78-6363b72b406d?source=cve
CVE: CVE-2025-56432
Published: 2025-08-26
Description: A cross-site scripting (XSS) vulnerability exists in Nagios XI 2024R2. The vulnerability allows remote attackers to execute arbitrary JavaScript in the context of a logged-in user's session via a specially crafted URL. The issue resides in a web component responsible for rendering performance-related data.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://nagios.com; https://www.nagios.com/changelog/
CVE: CVE-2025-57810
Published: 2025-08-26
Description: jsPDF is a library to generate PDFs in JavaScript. Prior to 3.0.2, user control of the first argument of the addImage method results in CPU utilization and denial of service. If given the possibility to pass unsanitized image data or URLs to the addImage method, a user can provide a harmful PNG file that results in high CPU utilization and denial of service. The vulnerability was fixed in jsPDF 3.0.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-770
References: https://github.com/parallax/jsPDF/commit/4cf3ab619e565d9b88b4b130bff901b91d8688e9; https://github.com/parallax/jsPDF/pull/3880; https://github.com/parallax/jsPDF/releases/tag/v3.0.2
CVE: CVE-2025-57813
Published: 2025-08-26
Description: traQ is a messenger application built for Digital Creators Club traP. Prior to version 3.25.0, a vulnerability exists where sensitive information, such as OAuth tokens, are recorded in log files when an error occurs during the execution of an SQL query. An attacker could intentionally trigger an SQL error by methods such as placing a high load on the database. This could allow an attacker who has the authority to view the log files to illicitly acquire the recorded sensitive information. This vulnerability has been patched in version 3.25.0. If upgrading is not possible, a temporary workaround involves reviewing access permissions for SQL error logs and strictly limiting access to prevent unauthorized users from viewing them.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-532
References: https://github.com/traPtitech/traQ/commit/ce5da94f5d5a8348f9ecdc82140b6f53b3721698; https://github.com/traPtitech/traQ/pull/2787; https://github.com/traPtitech/traQ/security/advisories/GHSA-27r7-3m9x-r533
CVE: CVE-2025-1494
Published: 2025-08-26
Description: IBM Cognos Command Center 10.2.4.1 and 10.2.5 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-1021
References: https://www.ibm.com/support/pages/node/7242159
CVE: CVE-2025-1994
Published: 2025-08-26
Description: IBM Cognos Command Center 10.2.4.1 and 10.2.5 



could allow a local user to execute arbitrary code on the system due to the use of unsafe use of the BinaryFormatter function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-242
References: https://www.ibm.com/support/pages/node/7242159
CVE: CVE-2025-2697
Published: 2025-08-26
Description: IBM Cognos Command Center 10.2.4.1 and 10.2.5 

could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim.
CVSS Score: 7.4 (HIGH)
CWE: CWE-601
References: https://www.ibm.com/support/pages/node/7242159
CVE: CVE-2025-36729
Published: 2025-08-26
Description: A non-primary administrator user with admin rights to the web interface but without shell access permissions can display configuration of the device including the master admin password. This vulnerability also allows the user to give themselves shell access with the root gid.
CVSS Score: 7.2 (HIGH)
CWE: CWE-269
References: https://www.tenable.com/security/research/tra-2025-25
CVE: CVE-2025-50974
Published: 2025-08-26
Description: The Calamaris log exporter CGI (/cgi-bin/logs.cgi/calamaris.dat) in IPFire 2.29 does not properly sanitize user-supplied input before incorporating parameter values into a shell command. An unauthenticated remote attacker can inject arbitrary OS commands by embedding shell metacharacters in any of the following parameters BYTE_UNIT, DAY_BEGIN, DAY_END, HIST_LEVEL, MONTH_BEGIN, MONTH_END, NUM_CONTENT, NUM_DOMAINS, NUM_HOSTS, NUM_URLS, PERF_INTERVAL, YEAR_BEGIN, YEAR_END.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-78
References: https://github.com/4rdr/proofs/blob/main/info/IPFire-2.29-Command-Injection.md
CVE: CVE-2025-52184
Published: 2025-08-26
Description: Cross Site Scripting vulnerability in Helpy.io v.2.8.0 allows a remote attacker to escalate privileges via the New Topic Ticket funtion.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/gmrvh/947e517f263245b13abcc63226907f4f; https://gist.github.com/gmrvh/eeb6aa8b379c7ad3860d78ee054f6123
CVE: CVE-2025-55212
Published: 2025-08-26
Description: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-28 and 7.1.2-2, passing a geometry string containing only a colon (":") to montage -geometry leads GetGeometry() to set width/height to 0. Later, ThumbnailImage() divides by these zero dimensions, triggering a crash (SIGFPE/abort), resulting in a denial of service. This issue has been patched in versions 6.9.13-28 and 7.1.2-2.
CVSS Score: 3.7 (LOW)
CWE: CWE-369
References: https://github.com/ImageMagick/ImageMagick/blob/0ba1b587be17543b664f7ad538e9e51e0da59d17/MagickCore/geometry.c#L355; https://github.com/ImageMagick/ImageMagick/blob/0ba1b587be17543b664f7ad538e9e51e0da59d17/MagickCore/resize.c#L4625-L4629; https://github.com/ImageMagick/ImageMagick/commit/5f0bcf986b8b5e90567750d31a37af502b73f2af
CVE: CVE-2025-57425
Published: 2025-08-26
Description: A Stored Cross-Site Scripting (XSS) vulnerability in SourceCodester FAQ Management System 1.0 allows an authenticated attacker to inject malicious JavaScript into the 'question' and 'answer' fields via the update-faq.php endpoint.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/progprnv/10110b20469e4ae02aa1c9bfe130f5e9
CVE: CVE-2025-9491
Published: 2025-08-26
Description: Microsoft Windows LNK File UI Misrepresentation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of .LNK files. Crafted data in an .LNK file can cause hazardous content in the file to be invisible to a user who inspects the file via the Windows-provided user interface. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-25373.
CVSS Score: 7.8 (HIGH)
CWE: CWE-451
References: https://www.zerodayinitiative.com/advisories/ZDI-25-148/; https://msrc.microsoft.com/update-guide/advisory/ADV25258226; https://www.virustotal.com/gui/file/a55789d49c395a9b16cb56b0544266d9ecee409fa3c5fead8082f28c2aff4e76
CVE: CVE-2025-50976
Published: 2025-08-26
Description: IPFire 2.29 DNS management interface (dns.cgi) fails to properly sanitize user-supplied input in the NAMESERVER, REMARK, and TLS_HOSTNAME query parameters, resulting in a reflected cross-site scripting (XSS) vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/4rdr/proofs/blob/main/info/IPFire-2.29-Reflected-XSS-via-DNS.md
CVE: CVE-2025-55298
Published: 2025-08-26
Description: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to ImageMagick versions 6.9.13-28 and 7.1.2-2, a format string bug vulnerability exists in InterpretImageFilename function where user input is directly passed to FormatLocaleString without proper sanitization. An attacker can overwrite arbitrary memory regions, enabling a wide range of attacks from heap overflow to remote code execution. This issue has been patched in versions 6.9.13-28 and 7.1.2-2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-123, CWE-134
References: https://github.com/ImageMagick/ImageMagick/commit/439b362b93c074eea6c3f834d84982b43ef057d5; https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9ccg-6pjw-x645; https://github.com/dlemstra/Magick.NET/releases/tag/14.8.1
CVE: CVE-2025-57803
Published: 2025-08-26
Description: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-28 and 7.1.2-2 for ImageMagick's 32-bit build, a 32-bit integer overflow in the BMP encoder’s scanline-stride computation collapses bytes_per_line (stride) to a tiny value while the per-row writer still emits 3 × width bytes for 24-bpp images. The row base pointer advances using the (overflowed) stride, so the first row immediately writes past its slot and into adjacent heap memory with attacker-controlled bytes. This is a classic, powerful primitive for heap corruption in common auto-convert pipelines. This issue has been patched in versions 6.9.13-28 and 7.1.2-2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-122, CWE-190
References: https://github.com/ImageMagick/ImageMagick/commit/2c55221f4d38193adcb51056c14cf238fbcc35d7; https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mxvv-97wh-cfmm; https://github.com/dlemstra/Magick.NET/releases/tag/14.8.1
CVE: CVE-2025-57818
Published: 2025-08-26
Description: Firecrawl turns entire websites into LLM-ready markdown or structured data. Prior to version 2.0.1, a server-side request forgery (SSRF) vulnerability was discovered in Firecrawl's webhook functionality. Authenticated users could configure a webhook to an internal URL and send POST requests with arbitrary headers, which may have allowed access to internal systems. This has been fixed in version 2.0.1. If upgrading is not possible, it is recommend to isolate Firecrawl from any sensitive internal systems.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-918
References: https://github.com/firecrawl/firecrawl/commit/b15fae51a760e9810a66bbfde5d5693d0df3fbeb; https://github.com/firecrawl/firecrawl/commit/e8cf0985b07968061a6b684b58097732e827ed46; https://github.com/firecrawl/firecrawl/releases/tag/v2.0.1
CVE: CVE-2025-23307
Published: 2025-08-26
Description: NVIDIA NeMo Curator for all platforms contains a vulnerability where a malicious file created by an attacker could allow code injection. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94
References: https://nvd.nist.gov/vuln/detail/CVE-2025-23307; https://nvidia.custhelp.com/app/answers/detail/a_id/5690; https://www.cve.org/CVERecord?id=CVE-2025-23307
CVE: CVE-2025-23312
Published: 2025-08-26
Description: NVIDIA NeMo Framework for all platforms contains a vulnerability in the retrieval services component, where malicious data created by an attacker could cause a code injection. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94
References: https://nvd.nist.gov/vuln/detail/CVE-2025-23312; https://nvidia.custhelp.com/app/answers/detail/a_id/5689; https://www.cve.org/CVERecord?id=CVE-2025-23312
CVE: CVE-2025-23313
Published: 2025-08-26
Description: NVIDIA NeMo Framework for all platforms contains a vulnerability in the NLP component, where malicious data created by an attacker could cause a code injection issue. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94
References: https://nvd.nist.gov/vuln/detail/CVE-2025-23313; https://nvidia.custhelp.com/app/answers/detail/a_id/5689; https://www.cve.org/CVERecord?id=CVE-2025-23313
CVE: CVE-2025-23314
Published: 2025-08-26
Description: NVIDIA NeMo Framework for all platforms contains a vulnerability in the NLP component, where malicious data created by an attacker could cause a code injection issue. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94
References: https://nvd.nist.gov/vuln/detail/CVE-2025-23314; https://nvidia.custhelp.com/app/answers/detail/a_id/5689; https://www.cve.org/CVERecord?id=CVE-2025-23314
CVE: CVE-2025-23315
Published: 2025-08-26
Description: NVIDIA NeMo Framework for all platforms contains a vulnerability in the export and deploy component, where malicious data created by an attacker could cause a code injection issue. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94
References: https://nvd.nist.gov/vuln/detail/CVE-2025-23315; https://nvidia.custhelp.com/app/answers/detail/a_id/5689; https://www.cve.org/CVERecord?id=CVE-2025-23315