deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-46823
Published: 2025-05-29
Description: openmrs-module-fhir2 provides the FHIR REST API and related services for OpenMRS, an open medical records system. In versions of the FHIR2 module prior to 2.5.0, privileges were not always correctly checked, which means that unauthorized users may have been able to add or edit data they were not supposed to be able to. All implementers should update to FHIR2 2.5.0 or newer as soon as is feasible to receive a patch.
CWE: CWE-862
References: https://github.com/openmrs/openmrs-module-fhir2/releases/tag/2.5.0; https://github.com/openmrs/openmrs-module-fhir2/security/advisories/GHSA-g5vq-w8v2-4x9j
CVE: CVE-2025-5323
Published: 2025-05-29
Description: A vulnerability, which was classified as problematic, has been found in fossasia open-event-server 1.19.1. This issue affects the function send_email_change_user_email of the file /fossasia/open-event-server/blob/development/app/api/helpers/mail.py of the component Mail Verification Handler. The manipulation leads to reliance on obfuscation or encryption of security-relevant inputs without integrity checking. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.7 (LOW)
CWE: CWE-325, CWE-649
References: https://gist.github.com/superboy-zjc/31ecea91b304b8dd9871ad507467ca61; https://gist.github.com/superboy-zjc/31ecea91b304b8dd9871ad507467ca61#proof-of-concept; https://vuldb.com/?ctiid.310493
CVE: CVE-2025-32752
Published: 2025-05-29
Description: Dell ThinOS 2502 and prior contain a Cleartext Storage of Sensitive Information vulnerability. A high privileged attacker with physical access could potentially exploit this vulnerability, leading to Information Disclosure.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-312
References: https://www.dell.com/support/kbdoc/en-us/000325632/dsa-2025-225
CVE: CVE-2025-46701
Published: 2025-05-29
Description: Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1 through 10.1.40, from 9.0.0.M1 through 9.0.104.
The following versions were EOL at the time the CVE was created but are 
known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions 
may also be affected.


Users are recommended to upgrade to version 11.0.7, 10.1.41 or 9.0.105, which fixes the issue.
CVSS Score: 7.3 (HIGH)
CWE: CWE-178
References: https://lists.apache.org/thread/xhqqk9w5q45srcdqhogdk04lhdscv30j; http://www.openwall.com/lists/oss-security/2025/05/29/4; https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html
CVE: CVE-2025-48336
Published: 2025-05-29
Description: Deserialization of Untrusted Data vulnerability in ThimPress Course Builder course-builder allows Object Injection.This issue affects Course Builder: from n/a through < 3.6.6.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Theme/course-builder/vulnerability/wordpress-course-builder-3-6-6-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-5324
Published: 2025-05-29
Description: A vulnerability, which was classified as problematic, was found in TechPowerUp GPU-Z 2.23.0. Affected is the function sub_140001880 in the library GPU-Z.sys of the component 0x8000645C IOCTL Handler. The manipulation leads to memory leak. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.3 (LOW)
CWE: CWE-401, CWE-404
References: https://github.com/Aiyakami/CVE-1/issues/3; https://github.com/Aiyakami/CVE-1/tree/main/test1; https://vuldb.com/?ctiid.310494
CVE: CVE-2024-49350
Published: 2025-05-29
Description: IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121, CWE-787
References: https://www.ibm.com/support/pages/node/7235069
CVE: CVE-2024-54952
Published: 2025-05-29
Description: MikroTik RouterOS 6.40.5, the SMB service contains a memory corruption vulnerability. Remote, unauthenticated attackers can exploit this issue by sending specially crafted packets, triggering a null pointer dereference. This leads to a Remote Denial of Service (DoS), rendering the SMB service unavailable.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/noobone123/RouterOS-issues/blob/main/README.md
CVE: CVE-2025-2518
Published: 2025-05-29
Description: IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 

is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-789
References: https://www.ibm.com/support/pages/node/7235072
CVE: CVE-2025-3050
Published: 2025-05-29
Description: IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 could allow an authenticated user to cause a denial of service when using Q replication due to the improper allocation of CPU resources.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-770
References: https://www.ibm.com/support/pages/node/7235073
CVE: CVE-2025-47288
Published: 2025-05-29
Description: Discourse Policy plugin gives the ability to confirm users have seen or done something. Prior to version 0.1.1, if there was a policy posted to a public topic that was tied to a private group then the group members could be shown to non-group members. This issue has been patched in version 0.1.1. A workaround involves moving any policy topics with private groups to restricted categories.
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: https://github.com/discourse/discourse-policy/commit/6b4390fe486408cc86ccea6b091406cfac6c5b8f; https://github.com/discourse/discourse-policy/security/advisories/GHSA-jc5r-rm2j-mh4x
CVE: CVE-2025-47933
Published: 2025-05-29
Description: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.13.8, 2.14.13, and 3.0.4, an attacker can perform arbitrary actions on behalf of the victim via the API. Due to the improper filtering of URL protocols in the repository page, an attacker can achieve cross-site scripting with permission to edit the repository. This issue has been patched in versions 2.13.8, 2.14.13, and 3.0.4.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79
References: https://github.com/argoproj/argo-cd/commit/a5b4041a79c54bc7b3d090805d070bcdb9a9e4d1; https://github.com/argoproj/argo-cd/security/advisories/GHSA-2hj5-g64g-fp6p
CVE: CVE-2025-4967
Published: 2025-05-29
Description: Esri Portal for ArcGIS 11.4 and prior allows a remote, unauthenticated attacker to bypass the Portal’s SSRF protections.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-918
References: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2025-update-3-patch
CVE: CVE-2025-5325
Published: 2025-05-29
Description: A vulnerability has been found in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /adpweb/a/ica/api/service/rfa/testService. The manipulation leads to improper neutralization of special elements used in a template engine. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-791, CWE-1336
References: https://vuldb.com/?ctiid.310495; https://vuldb.com/?id.310495; https://vuldb.com/?submit.581275
CVE: CVE-2025-5326
Published: 2025-05-29
Description: A vulnerability was found in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0 and classified as critical. Affected by this issue is some unknown functionality of the file /adpweb/wechat/verifyToken/. The manipulation leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-20, CWE-502, CWE-502
References: https://vuldb.com/?ctiid.310496; https://vuldb.com/?id.310496; https://vuldb.com/?submit.581277
CVE: CVE-2025-5327
Published: 2025-05-29
Description: A vulnerability was found in chshcms mccms 2.7. It has been classified as critical. This affects the function index of the file sys/apps/controllers/api/Gf.php. The manipulation of the argument pic leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://github.com/caigo8/CVE-md/blob/main/Mccms_V2.7/%E5%89%8D%E5%8F%B0SSRF.md; https://vuldb.com/?ctiid.310497; https://vuldb.com/?id.310497
CVE: CVE-2025-5328
Published: 2025-05-29
Description: A vulnerability was found in chshcms mccms 2.7. It has been declared as critical. This vulnerability affects the function restore_del of the file /sys/apps/controllers/admin/Backups.php. The manipulation of the argument dirs leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://github.com/caigo8/CVE-md/blob/main/Mccms_V2.7/%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E5%88%A0%E9%99%A4.md; https://vuldb.com/?ctiid.310498; https://vuldb.com/?id.310498
CVE: CVE-2025-30466
Published: 2025-05-29
Description: This issue was addressed through improved state management. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, visionOS 2.4. A website may be able to bypass Same Origin Policy.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-346
References: https://support.apple.com/en-us/122371; https://support.apple.com/en-us/122373; https://support.apple.com/en-us/122378
CVE: CVE-2025-31189
Published: 2025-05-29
Description: A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to break out of its sandbox.
CVSS Score: 8.2 (HIGH)
CWE: CWE-693
References: https://support.apple.com/en-us/122373; https://support.apple.com/en-us/122374; https://support.apple.com/en-us/122375
CVE: CVE-2025-31198
Published: 2025-05-29
Description: This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A path handling issue was addressed with improved validation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-59
References: https://support.apple.com/en-us/122373; https://support.apple.com/en-us/122374; https://support.apple.com/en-us/122375
CVE: CVE-2025-31199
Published: 2025-05-29
Description: A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.8.2, visionOS 2.4. An app may be able to access sensitive user data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532
References: https://support.apple.com/en-us/122371; https://support.apple.com/en-us/122373; https://support.apple.com/en-us/122378
CVE: CVE-2025-31231
Published: 2025-05-29
Description: A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4. An app may be able to read sensitive location information.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/en-us/122373
CVE: CVE-2025-31261
Published: 2025-05-29
Description: A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to access protected user data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-276
References: https://support.apple.com/en-us/122373; https://support.apple.com/en-us/122374; https://support.apple.com/en-us/122375
CVE: CVE-2025-31263
Published: 2025-05-29
Description: The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4. An app may be able to corrupt coprocessor memory.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-119
References: https://support.apple.com/en-us/122373
CVE: CVE-2025-31264
Published: 2025-05-29
Description: An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An attacker with physical access to a locked device may be able to view sensitive user information.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-287
References: https://support.apple.com/en-us/122373; https://support.apple.com/en-us/122374; https://support.apple.com/en-us/122375
CVE: CVE-2025-5307
Published: 2025-05-29
Description: Santesoft Sante DICOM Viewer Pro contains a memory corruption vulnerability. A local attacker could exploit this issue to potentially disclose information and to execute arbitrary code on affected installations of Sante DICOM Viewer Pro.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-148-01; https://www.santesoft.com/win/sante-dicom-viewer-pro/download.html
CVE: CVE-2025-5330
Published: 2025-05-29
Description: A vulnerability, which was classified as critical, was found in FreeFloat FTP Server 1.0. This affects an unknown part of the component RETR Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://github.com/r3ng4f/FreeFloat_1/blob/main/01-exploit.txt; https://vuldb.com/?ctiid.310503; https://vuldb.com/?id.310503
CVE: CVE-2025-5331
Published: 2025-05-29
Description: A vulnerability has been found in PCMan FTP Server 2.0.7 and classified as critical. This vulnerability affects unknown code of the component NLST Command Handler. The manipulation leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://github.com/r3ng4f/PCMan_1/blob/main/exploit02.txt; https://vuldb.com/?ctiid.310504; https://vuldb.com/?id.310504
CVE: CVE-2025-5332
Published: 2025-05-29
Description: A vulnerability was found in 1000 Projects Online Notice Board 1.0 and classified as critical. This issue affects some unknown processing of the file /index.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://1000projects.org/; https://github.com/ubfbuz3/cve/issues/16; https://vuldb.com/?ctiid.310505
CVE: CVE-2025-1907
Published: 2025-05-30
Description: Instantel Micromate lacks authentication on a configuration port which could allow an attacker to execute commands if connected.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-148-04; https://www.instantel.com/service-and-support/contact-technical-support
CVE: CVE-2025-41438
Published: 2025-05-30
Description: The CS5000 Fire Panel is vulnerable due to a default account that exists
 on the panel. Even though it is possible to change this by SSHing into 
the device, it has remained unchanged on every installed system 
observed. This account is not root but holds high-level permissions that
 could severely impact the device's operation if exploited.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1188
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-148-03; https://www.consiliumsafety.com/en/support/
CVE: CVE-2025-46352
Published: 2025-05-30
Description: The CS5000 Fire Panel is vulnerable due to a hard-coded password that 
runs on a VNC server and is visible as a string in the binary 
responsible for running VNC. This password cannot be altered, allowing 
anyone with knowledge of it to gain remote access to the panel. Such 
access could enable an attacker to operate the panel remotely, 
potentially putting the fire panel into a non-functional state and 
causing serious safety issues.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-148-03; https://www.consiliumsafety.com/en/support/
CVE: CVE-2020-36846
Published: 2025-05-30
Description: A buffer overflow, as described in CVE-2020-8927, exists in the embedded Brotli library.  Versions of IO::Compress::Brotli prior to 0.007 included a version of the brotli library prior to version 1.0.8, where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your IO::Compress::Brotli module to 0.007 or later. If one cannot update, we recommend to use the "streaming" API as opposed to the "one-shot" API, and impose chunk size limits.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/advisories/GHSA-5v8v-66v8-mwm7; https://github.com/google/brotli/commit/223d80cfbec8fd346e32906c732c8ede21f0cea6; https://github.com/google/brotli/pull/826
CVE: CVE-2024-12224
Published: 2025-05-30
Description: Improper Validation of Unsafe Equivalence in punycode by the idna crate from Servo rust-url allows an attacker to create a punycode hostname that one part of a system might treat as distinct while another part of that system would treat as equivalent to another hostname.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1289, CWE-352
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1887898; https://rustsec.org/advisories/RUSTSEC-2024-0421.html; https://bugzilla.mozilla.org/show_bug.cgi?id=1887898
CVE: CVE-2025-44612
Published: 2025-05-30
Description: Tinxy WiFi Lock Controller v1 RF was discovered to transmit sensitive information in plaintext, including control information and device credentials, allowing attackers to possibly intercept and access sensitive information via a man-in-the-middle attack.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-319
References: https://github.com/ShravanSinghRathore/Tinxy/wiki/1.-WiFi-Lock-Controller-v1-RF-%281%E2%80%909%29
CVE: CVE-2025-44614
Published: 2025-05-30
Description: Tinxy WiFi Lock Controller v1 RF was discovered to store users' sensitive information, including credentials and mobile phone numbers, in plaintext.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: https://github.com/ShravanSinghRathore/Tinxy/wiki/1.-WiFi-Lock-Controller-v1-RF-%281%E2%80%909%29
CVE: CVE-2025-44619
Published: 2025-05-30
Description: Tinxy WiFi Lock Controller v1 RF was discovered to be configured to transmit on an open Wi-Fi network, allowing attackers to join the network without authentication.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-284
References: http://tinxy.com; http://wifi.com
CVE: CVE-2025-48757
Published: 2025-05-30
Description: An insufficient database Row-Level Security policy in Lovable through 2025-04-15 allows remote unauthenticated attackers to read or write to arbitrary database tables of generated sites. NOTE: this is disputed by the Supplier because each individual customer of the Lovable platform accepts a responsibility over protecting the data of their application.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-863
References: https://docs.lovable.dev/changelog; https://gist.github.com/lhchavez/625ee42a6c408a850d35e50f8e649de9; https://mattpalmer.io/posts/CVE-2025-48757/
CVE: CVE-2025-44904
Published: 2025-05-30
Description: hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5VM_memcpyvv function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://github.com/madao123123/crash_report/blob/main/hdf5_poc/hdf5_poc1.md; https://github.com/madao123123/crash_report/blob/main/hdf5_poc/hdf5_poc1.md
CVE: CVE-2025-44905
Published: 2025-05-30
Description: hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5Z__filter_scaleoffset function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://github.com/madao123123/crash_report/blob/main/hdf5_poc/hdf5_poc5.md; https://github.com/madao123123/crash_report/blob/main/hdf5_poc/hdf5_poc5.md
CVE: CVE-2025-44906
Published: 2025-05-30
Description: jhead v3.08 was discovered to contain a heap-use-after-free via the ProcessFile function at jhead.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://github.com/madao123123/crash_report/blob/main/jhead/jhead.md; https://github.com/madao123123/crash_report/blob/main/jhead/jhead.md
CVE: CVE-2025-47952
Published: 2025-05-30
Description: Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. Prior to versions 2.11.25 and 3.4.1, there is a potential vulnerability in Traefik managing the requests using a PathPrefix, Path or PathRegex matcher. When Traefik is configured to route the requests to a backend using a matcher based on the path, if the URL contains a URL encoded string in its path, it’s possible to target a backend, exposed using another router, by-passing the middlewares chain. This issue has been patched in versions 2.11.25 and 3.4.1.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://github.com/traefik/traefik/commit/08d5dfee0164aa54dd44a467870042e18e8d3f00; https://github.com/traefik/traefik/releases/tag/v2.11.25; https://github.com/traefik/traefik/releases/tag/v3.4.1
CVE: CVE-2025-48068
Published: 2025-05-30
Description: Next.js is a React framework for building full-stack web applications. In versions starting from 13.0 to before 14.2.30 and 15.0.0 to before 15.2.2, Next.js may have allowed limited source code exposure when the dev server was running with the App Router enabled. The vulnerability only affects local development environments and requires the user to visit a malicious webpage while npm run dev is active. This issue has been patched in versions 14.2.30 and 15.2.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1385
References: https://github.com/vercel/next.js/security/advisories/GHSA-3h52-269p-cp9r; https://vercel.com/changelog/cve-2025-48068
CVE: CVE-2025-48381
Published: 2025-05-30
Description: Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. In versions starting from 2.4.0 to before 2.38.0, an authenticated CVAT user may be able to retrieve the IDs and names of all tasks, projects, labels, and the IDs of all jobs and quality reports on the CVAT instance. In addition, if the instance contains many resources of a particular type, retrieving this information may tie up system resources, denying access to legitimate users. This issue has been patched in version 2.38.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-201
References: https://github.com/cvat-ai/cvat/commit/7136c99fb2c3a5cb2d8c3ca54b4201b9fa6aab5a; https://github.com/cvat-ai/cvat/security/advisories/GHSA-7484-2gfm-852p
CVE: CVE-2025-48491
Published: 2025-05-30
Description: Project AI is a platform designed to create AI agents. Prior to the pre-beta version, a hardcoded API key was present in the source code. This issue has been patched in the pre-beta version.
CWE: CWE-798
References: https://github.com/aryan6673/project-ai/commit/142252c43f1dacb3fed99e3336f5cd863b028bc2; https://github.com/aryan6673/project-ai/commit/1de910f353eb2a68c980149b906e[PII_REDACTED]ad; https://github.com/aryan6673/project-ai/commit/54a69c3ccd301d35f3d54f4844d9910e609beb73