deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-48626
Published: 2025-12-08
Description: In multiple locations, there is a possible way to launch an application from the background due to a precondition check failure. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-693
References: https://android.googlesource.com/platform/frameworks/base/+/9fb37191609f7cb7b2374531cafb2d00ec8b4bec; https://android.googlesource.com/platform/packages/apps/Launcher3/+/7628af9bf77f1d145359bf4075a6674574cae496; https://source.android.com/security/bulletin/2025-12-01
CVE: CVE-2025-48627
Published: 2025-12-08
Description: In startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible way to launch an activity from the background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
References: https://android.googlesource.com/platform/frameworks/base/+/d34ae40f870d4362a069940a035a4d58a536a231; https://source.android.com/security/bulletin/2025-12-01
CVE: CVE-2025-48628
Published: 2025-12-08
Description: In validateIconUserBoundary of PrintManagerService.java, there is a possible cross-user image leak due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-441
References: https://android.googlesource.com/platform/frameworks/base/+/9489a5dcd3cdd426d5b39d9caf6bb78142af2399; https://source.android.com/security/bulletin/2025-12-01
CVE: CVE-2025-48629
Published: 2025-12-08
Description: In findAvailRecognizer of VoiceInteractionManagerService.java, there is a possible way to become the default speech recognizer app due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1188, CWE-1188
References: https://source.android.com/security/bulletin/2025-12-01
CVE: CVE-2025-48631
Published: 2025-12-08
Description: In onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://source.android.com/docs/security/bulletin/2026/2026-03-01
CVE: CVE-2025-48632
Published: 2025-12-08
Description: In setDisplayName of AssociationRequest.java, there is a possible way to cause CDM associations to persist after the user has disassociated them due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://android.googlesource.com/platform/frameworks/base/+/de27b16b1af86d4ce18c9134d85b53331a8d2147; https://source.android.com/security/bulletin/2025-12-01
CVE: CVE-2025-48633
Published: 2025-12-08
Description: In hasAccountsOnAnyUser of DevicePolicyManagerService.java, there is a possible way to add a Device Owner after provisioning due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
References: https://android.googlesource.com/platform/frameworks/base/+/d00bcda9f42dcf272d329e9bf9298f32af732f93; https://source.android.com/security/bulletin/2025-12-01; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48633
CVE: CVE-2025-48637
Published: 2025-12-08
Description: In multiple functions of mem_protect.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-190
References: https://android.googlesource.com/kernel/common/+/4cfc9c2d[PII_REDACTED]cafbfcd7f98025f0da718d; https://android.googlesource.com/kernel/common/+/aff2255dbe38dc7c57bac8d3ba9feed989289b20; https://source.android.com/security/bulletin/2025-12-01
CVE: CVE-2025-48638
Published: 2025-12-08
Description: In __pkvm_load_tracing of trace.c, there is a possible out-of-bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-20, CWE-787
References: https://android.googlesource.com/kernel/common/+/0429b7af308cf65c84109c08d06b01950dcd57fe; https://android.googlesource.com/kernel/common/+/96ebe96170d67df5072afa2ce84622f5a0ff552a; https://source.android.com/security/bulletin/2025-12-01
CVE: CVE-2025-48639
Published: 2025-12-08
Description: In DefaultTransitionHandler.java, there is a possible way to unknowingly grant permissions to an app due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
CVSS Score: 7.3 (HIGH)
CWE: CWE-1021
References: https://android.googlesource.com/platform/frameworks/base/+/6d1697c96c5cae5062f6aea58cf2665b7d646cb8; https://android.googlesource.com/platform/frameworks/native/+/cc34c7b416b964c05a42ae3e9c2929b59b92c64f; https://source.android.com/security/bulletin/2025-12-01
CVE: CVE-2025-59391
Published: 2025-12-08
Description: A memory disclosure vulnerability exists in libcoap's OSCORE configuration parser in libcoap before release-4.3.5-patches. An out-of-bounds read may occur when parsing certain configuration values, allowing an attacker to infer or read memory beyond string boundaries in the .rodata section. This could potentially lead to information disclosure or denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/obgm/libcoap/pull/1730; https://github.com/obgm/libcoap/releases/tag/v4.3.5a
CVE: CVE-2025-63721
Published: 2025-12-08
Description: HummerRisk thru v1.5.0 is using a vulnerable Snakeyaml component, allowing attackers with normal user privileges to hit the /rule/add API and thereby achieve RCE and take over the server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://gist.github.com/k1ng0fic3/e8c8c9353fff8fa95e2c2952587e9266; https://github.com/k1ng0fic3/secrisk/blob/main/README.md; https://gist.github.com/k1ng0fic3/e8c8c9353fff8fa95e2c2952587e9266
CVE: CVE-2025-65363
Published: 2025-12-08
Description: Authenticated append-style command-injection Ruijie APs (AP_RGOS 11.1.x) allows an authenticated web user to execute appended shell expressions as root, enabling file disclosure, device disruption, and potential network pivoting via the command parameter to the web_action.do endpoint.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: http://rg-ap720-l.com; http://ruijie.com; https://github.com/tmogg/security-advisories/blob/main/CVE-2025-65363/README.md
CVE: CVE-2025-65795
Published: 2025-12-08
Description: Incorrect access control in the /api/v1/user endpoint of usememos memos v0.25.2 allows unauthorized attackers to create arbitrary accounts via a crafted request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: http://memos.com; http://usememos.com; https://github.com/usememos/memos/pull/5217
CVE: CVE-2025-65797
Published: 2025-12-08
Description: Incorrect access control in the Identity Provider service of usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily modify or delete registered identity providers, leading to an account takeover or Denial of Service (DoS).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: http://memos.com; http://usememos.com; https://github.com/usememos/memos/pull/5217
CVE: CVE-2025-65799
Published: 2025-12-08
Description: A lack of file name validation or verification in the Attachment service of usememos memos v0.25.2 allows attackers to execute a path traversal.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-73
References: http://memos.com; http://usememos.com; https://github.com/usememos/memos/pull/5218
CVE: CVE-2025-14258
Published: 2025-12-08
Description: A vulnerability has been found in itsourcecode Student Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /newsubject.php. The manipulation of the argument sub leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/ltranquility/CVE/issues/18; https://itsourcecode.com/; https://vuldb.com/?ctiid.334764
CVE: CVE-2025-14259
Published: 2025-12-08
Description: A vulnerability was found in Jihai Jshop MiniProgram Mall System 2.9.0. Affected by this issue is some unknown functionality of the file /index.php/api.html. The manipulation of the argument cat_id results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: http://101.200.76.102:38765/qwertyuiop/qwsdfvbnm/1/vuldb/Jshop/Jshop.html; https://vuldb.com/?ctiid.334765; https://vuldb.com/?id.334765
CVE: CVE-2025-48569
Published: 2025-12-08
Description: In multiple locations, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-770, CWE-400
References: https://source.android.com/security/bulletin/android-16-qpr2
CVE: CVE-2025-48606
Published: 2025-12-08
Description: In preparePackage of InstallPackageHelper.java, there is a possible way for an app to appear hidden upon installation without a mechanism to uninstall it due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/android-16-qpr2
CVE: CVE-2025-48608
Published: 2025-12-08
Description: In isValidMediaUri of SettingsProvider.java, there is a possible cross user media read due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862, CWE-306
References: https://source.android.com/security/bulletin/android-16-qpr2
CVE: CVE-2025-48625
Published: 2025-12-08
Description: In multiple locations of UsbDataAdvancedProtectionHook.java, there is a possible way to access USB data when the screen is off due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-362
References: https://source.android.com/security/bulletin/android-16-qpr2
CVE: CVE-2025-64081
Published: 2025-12-08
Description: SQL injection vulnerability in /php/api_patient_schedule.php in SourceCodester Patients Waiting Area Queue Management System v1 allows attackers to execute arbitrary SQL commands via the appointmentID parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://packetstorm.news/files/id/211592; https://www.sourcecodester.com/php/18348/patients-waiting-area-queue-management-system.html
CVE: CVE-2025-65804
Published: 2025-12-08
Description: Tenda AX3 v16.03.12.11 contains a stack overflow in formSetIptv via the iptvType parameter, which can cause memory corruption and enable remote code execution (RCE).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121
References: https://river-brow-763.notion.site/Tenda-AX3-Buffer-Overflow-in-formSetIptv-2aaa595a7aef8072968edc528a2d95b1
CVE: CVE-2025-14261
Published: 2025-12-08
Description: The Litmus platform uses JWT for authentication and authorization, but the secret being used for signing the JWT is only 6 bytes long at its core, which makes it extremely easy to crack.
CVSS Score: 7.1 (HIGH)
CWE: CWE-331
References: https://github.com/litmuschaos/litmus/pull/5324; https://research.jfrog.com/vulnerabilities/litmus-jwt-missing-entropy-elevation-jfsa-2[PII_REDACTED]59/
CVE: CVE-2025-65231
Published: 2025-12-08
Description: Barix Instreamer v04.06 and earlier is vulnerable to Cross Site Scripting (XSS) in the Web UI I/O & Serial configuration page, specifically the CTS close command user-input field which is stored and later rendered on the Status page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/iyadalkhatib98/My_CVES/tree/main/CVE-2025-65231; https://help.barix.com/instreamer/user-manual; https://github.com/iyadalkhatib98/My_CVES/tree/main/CVE-2025-65231
CVE: CVE-2025-65271
Published: 2025-12-08
Description: Client-side template injection (CSTI) in Azuriom CMS admin dashboard allows a low-privilege user to execute arbitrary template code in the context of an administrator's session. This can occur via plugins or dashboard components that render untrusted user input, potentially enabling privilege escalation to an administrative account. Fixed in Azuriom 1.2.7.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://github.com/1337Skid/CVE-2025-65271; https://github.com/Azuriom/Azuriom; https://github.com/Azuriom/Azuriom/commit/[PII_REDACTED]319add814dcb526e8ba034f1ebc3ec
CVE: CVE-2025-65548
Published: 2025-12-08
Description: NUT-14 allows cashu tokens to be created with a preimage hash. However, nutshell (cashubtc/nuts) before 0.18.0 do not validate the size of preimage when the token is spent. The preimage is stored by the mint and attacker can exploit this vulnerability to fill the mint's db nd disk with arbitrary data.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-1284
References: https://bitcointalk.org/index.php?topic=5564329; https://delvingbitcoin.org/t/public-disclosure-denial-of-service-using-htlc-in-cashu/2090; https://github.com/cashubtc/nuts/blob/main/07.md
CVE: CVE-2025-65849
Published: 2025-12-08
Description: A cryptanalytic break in Altcha Proof-of-Work obfuscation mode version 0.8.0 and later allows for remote visitors to recover the Proof-of-Work nonce in constant time via mathematical deduction. NOTE: this is disputed by the Supplier because the product's objective is "to discourage automated scraping / bots, not guarantee resistance to determined attackers." The documentation states “the goal is not to provide a secure cryptographic algorithm but to use a proof-of-work mechanism that allows any capable device to decrypt the hidden data.”
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-327
References: https://altcha.org/docs/v2/obfuscation/; https://github.com/altcha-org/altcha/blob/154f874cbcdd4e[PII_REDACTED]30d13988a2bd1bdc/src/helpers.ts#L170-L194; https://github.com/eternal-flame-AD/altcha-deobfs
CVE: CVE-2025-65229
Published: 2025-12-08
Description: A stored cross-site scripting (XSS) vulnerability exists in the web interface of Lyrion Music Server <= 9.0.3. An authenticated user with access to Settings Player can save arbitrary HTML/JavaScript in the Player name field. That value is stored by the server and later rendered without proper output encoding on the Information (Player Info) tab, causing the script to execute in the context of any user viewing that page.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://github.com/iyadalkhatib98/My_CVES/tree/main/CVE-2025-65229; https://lyrion.org/
CVE: CVE-2025-65230
Published: 2025-12-08
Description: Barix Instreamer v04.06 and v04.05 contains a stored cross-site scripting (XSS) vulnerability in the Web UI Configuration Streaming Destination input.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/iyadalkhatib98/My_CVES/tree/main/CVE-2025-65230; https://help.barix.com/instreamer/user-manual; https://github.com/iyadalkhatib98/My_CVES/tree/main/CVE-2025-65230
CVE: CVE-2025-65228
Published: 2025-12-08
Description: A stored cross-site scripting vulnerability exists in the web management interface of the R.V.R. Elettronica TLK302T telemetry controller (firmware 1.5.1799).
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/iyadalkhatib98/My_CVES/tree/main/CVE-2025-65228; https://www.rvr.it/en/products/components/telemetry-units-system/tlk300-series/tlk302t/
CVE: CVE-2025-12635
Published: 2025-12-08
Description: IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.12 are affected by cross-site scripting due to improper validation of user-supplied input. An attacker could exploit this vulnerability by using a specially crafted URL to redirect the user to a malicious site.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.ibm.com/support/pages/node/7254078
CVE: CVE-2025-12832
Published: 2025-12-08
Description: IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-918
References: https://www.ibm.com/support/pages/node/7253507
CVE: CVE-2025-14276
Published: 2025-12-08
Description: A vulnerability was determined in Ilevia EVE X1 Server up to 4.6.5.0.eden. Impacted is an unknown function of the file /ajax/php/leaf_search.php. This manipulation of the argument line causes command injection. The attack can be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is considered difficult. The exploit has been publicly disclosed and may be utilized. Upgrading the affected component is recommended. The vendor confirms the issue and recommends: "We already know that issue and on most devices are already solved, also it’s not needed to open the port to outside world so we advised our customer to close it".
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-74, CWE-77
References: https://vuldb.com/?ctiid.334802; https://vuldb.com/?id.334802; https://vuldb.com/?submit.702649
CVE: CVE-2025-33111
Published: 2025-12-08
Description: IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 is vulnerable to creation of temporary files without atomic operations which may expose sensitive information to an authenticated user due to race condition attacks.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-379
References: https://www.ibm.com/support/pages/node/7253273
CVE: CVE-2025-36015
Published: 2025-12-08
Description: IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 could allow an authenticated user to cause a denial of service due to improper validation of a specified quantity size input.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1284
References: https://www.ibm.com/support/pages/node/7253273
CVE: CVE-2025-36017
Published: 2025-12-08
Description: IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 stores unencrypted sensitive information in environmental variables files which can be obtained by an authenticated user.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-526
References: https://www.ibm.com/support/pages/node/7253283
CVE: CVE-2025-36102
Published: 2025-12-08
Description: IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 could allow a privileged user to bypass validation, passing user input into the application as trusted data, due to client-side enforcement of server-side security.
CVSS Score: 2.7 (LOW)
CWE: CWE-602
References: https://www.ibm.com/support/pages/node/7253273
CVE: CVE-2025-62408
Published: 2025-12-08
Description: c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5  terminate a query after maximum attempts when using read_answer() and process_answer(), which can cause a Denial of Service. This issue is fixed in version 1.34.6.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-416
References: https://github.com/c-ares/c-ares/commit/714bf5675c541bd1e668a8db8e67ce012651e618; https://github.com/c-ares/c-ares/security/advisories/GHSA-jq53-42q6-pqr5
CVE: CVE-2025-64650
Published: 2025-12-08
Description: IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.18 could disclose sensitive user credentials in log files.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-532
References: https://www.ibm.com/support/pages/node/7253864
CVE: CVE-2025-36140
Published: 2025-12-08
Description: IBM watsonx.data 2.2 through 2.2.1 could allow an authenticated user to cause a denial of service through ingestion pods due to improper allocation of resources without limits.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://www.ibm.com/support/pages/node/7253932
CVE: CVE-2025-64497
Published: 2025-12-08
Description: Tuleap is an Open Source Suite for management of software development and collaboration. Versions below 17.0.99[PII_REDACTED] of  Tuleap Community Edition and Tuleap Enterprise Edition below 17.0-2, 16.13-7 and 16.12-10 allow attackers to access file release system information in projects they do not have access to. This issue is fixed in version 17.0.99[PII_REDACTED] of the Tuleap Community Edition and versions 17.0-2, 16.13-7 and 16.12-10 of Tuleap Enterprise Edition.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639
References: https://github.com/Enalean/tuleap/commit/403eb69f4cfafe52254c8f9bdbe66e1fedadc254; https://github.com/Enalean/tuleap/security/advisories/GHSA-v6vm-6rxf-7p2v; https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=403eb69f4cfafe52254c8f9bdbe66e1fedadc254
CVE: CVE-2025-64498
Published: 2025-12-08
Description: Tuleap is an Open Source Suite for management of software development and collaboration. Tuleap Community Edition versions below 17.0.99[PII_REDACTED] and Tuleap Enterprise Edition versions prior to  17.0-2, 16.13-7 and 16.12-10 allow attackers trick victims into changing tracker general settings. This issue is fixed in version Tuleap Community Edition version 17.0.99[PII_REDACTED] and Tuleap Enterprise Edition versions 17.0-2, 16.13-7 and 16.12-10.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-352
References: https://github.com/Enalean/tuleap/commit/993316dd6a291bb3937cb7a4571eaab0e7d55370; https://github.com/Enalean/tuleap/security/advisories/GHSA-vxfh-h8p6-p5rg; https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=993316dd6a291bb3937cb7a4571eaab0e7d55370
CVE: CVE-2025-64499
Published: 2025-12-08
Description: Tuleap is a free and open source suite for management of software development and collaboration. Tuleap Community Editon versions prior to 17.0.99[PII_REDACTED] and Tuleap Enterprise Edition versions prior to 17.0-2, 16.13-7 and 16.12-10 are vulnerable to CSRF attacks through planning management API. Attackers have access to create, edit or remove plans. This issue is fixed in Tuleap Community Edition version 17.0.99[PII_REDACTED] and Tuleap Enterprise Edtion versions 17.0-2, 16.13-7 and 16.12-10.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-352
References: https://github.com/Enalean/tuleap/commit/1734a7bb[PII_REDACTED]ddc3f6dd7b4c82eee27526; https://github.com/Enalean/tuleap/security/advisories/GHSA-9h47-jg7r-ww7x; https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=1734a7bb[PII_REDACTED]ddc3f6dd7b4c82eee27526