deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-49153
Published: 2025-06-25
Description: The affected products could allow an unauthenticated attacker to overwrite files and execute arbitrary code.
CWE: CWE-22
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-175-07
CVE: CVE-2025-4656
Published: 2025-06-25
Description: Vault Community and Vault Enterprise rekey and recovery key operations can lead to a denial of service due to uncontrolled cancellation by a Vault operator. This vulnerability (CVE-2025-4656) has been remediated in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11, 1.17.17, and 1.16.22.
CVSS Score: 3.1 (LOW)
CWE: CWE-1088
References: https://discuss.hashicorp.com/t/hcsec-2025-11-vault-vulnerable-to-recovery-key-cancellation-denial-of-service/75570
CVE: CVE-2025-52480
Published: 2025-06-25
Description: Registrator is a GitHub app that automates creation of registration pull requests for julia packages to the General registry. Prior to version 1.9.5, if the clone URL returned by GitHub is malicious (or can be injected using upstream vulnerabilities), an argument injection is possible in the `gettreesha()` function. This can then lead to a potential remote code execution. Users should upgrade immediately to v1.9.5 to receive a patch. All prior versions are vulnerable. No known workarounds are available.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-88
References: https://github.com/JuliaRegistries/Registrator.jl/pull/449; https://github.com/JuliaRegistries/Registrator.jl/security/advisories/GHSA-w8jv-rg3h-fc68
CVE: CVE-2025-52483
Published: 2025-06-25
Description: Registrator is a GitHub app that automates creation of registration pull requests for julia packages to the General registry. Prior to version 1.9.5, if the clone URL returned by GitHub is malicious (or can be injected using upstream vulnerabilities) a shell script injection can occur within the `withpasswd` function. Alternatively, an argument injection is possible in the `gettreesha `function. either of these can then lead to a potential RCE. Users should upgrade immediately to v1.9.5 to receive a fix. All prior versions are vulnerable. No known workarounds are available.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/JuliaRegistries/Registrator.jl/pull/448; https://github.com/JuliaRegistries/Registrator.jl/security/advisories/GHSA-589r-g8hf-xx59
CVE: CVE-2025-52569
Published: 2025-06-25
Description: GitForge.jl is a unified interface for interacting with Git "forges." Versions prior to 5.9.1 lack input validation of input validation for user-provided values in certain functions. In the `GitHub.repo()` function, the user can provide any string for the `repo_name` field. These inputs are not validated or safely encoded and are sent directly to the server. This means a user can add path traversal patterns like `../` in the input to access any other endpoints on `api.github.com` that were not intended. Users should upgrade immediately to v5.9.1 or later to receive a patch. All prior versions are vulnerable. No known workarounds are available.
CWE: CWE-20, CWE-22
References: https://github.com/JuliaWeb/GitHub.jl/pull/224; https://github.com/JuliaWeb/GitHub.jl/security/advisories/GHSA-jg9p-c3wh-q83x
CVE: CVE-2025-52576
Published: 2025-06-25
Description: Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.46, Kanboard is vulnerable to username enumeration and IP spoofing-based brute-force protection bypass. By analyzing login behavior and abusing trusted HTTP headers, an attacker can determine valid usernames and circumvent rate-limiting or blocking mechanisms. Any organization running a publicly accessible Kanboard instance is affected, especially if relying on IP-based protections like Fail2Ban or CAPTCHA for login rate-limiting. Attackers with access to the login page can exploit this flaw to enumerate valid usernames and bypass IP-based blocking mechanisms, putting all user accounts at higher risk of brute-force or credential stuffing attacks. Version 1.2.46 contains a patch for the issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203
References: https://github.com/kanboard/kanboard/blob/cbb7e60fb595ff4572bb8801b275a0b451c4bda0/app/Model/UserLockingModel.php#L101-L104; https://github.com/kanboard/kanboard/blob/cbb7e60fb595ff4572bb8801b275a0b451c4bda0/app/Subscriber/AuthSubscriber.php#L96-L108; https://github.com/kanboard/kanboard/commit/[PII_REDACTED]dc39f9c7b0c840d2a[PII_REDACTED]1f1
CVE: CVE-2025-52889
Published: 2025-06-25
Description: Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, Incus version 6.12 and 6.13 generates nftables rules for local services (DHCP, DNS...) that partially bypass security options `security.mac_filtering`, `security.ipv4_filtering` and `security.ipv6_filtering`. This can lead to DHCP pool exhaustion and opens the door for other attacks. A patch is available at commit 2516fb19ad8428454cb4edfe70c0a5f0dc1da214.
CVSS Score: 3.4 (LOW)
CWE: CWE-770
References: https://github.com/lxc/incus/commit/2516fb19ad8428454cb4edfe70c0a5f0dc1da214; https://github.com/lxc/incus/commit/a7c33301738aede3c035063e973b1d885d9bac7c; https://github.com/lxc/incus/security/advisories/GHSA-9q7c-qmhm-jv86
CVE: CVE-2025-52890
Published: 2025-06-25
Description: Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, Incus versions 6.12 and 6.13generates nftables rules that partially bypass security options `security.mac_filtering`, `security.ipv4_filtering` and `security.ipv6_filtering`. This can lead to ARP spoofing on the bridge and to fully spoof another VM/container on the same bridge. Commit 254dfd2483ab8de39b47c2258b7f1cf0759231c8 contains a patch for the issue.
CVSS Score: 8.1 (HIGH)
CWE: CWE-863
References: https://github.com/lxc/incus/commit/254dfd2483ab8de39b47c2258b7f1cf0759231c8; https://github.com/lxc/incus/security/advisories/GHSA-p7fw-vjjm-2rwp; https://github.com/lxc/incus/security/advisories/GHSA-p7fw-vjjm-2rwp
CVE: CVE-2025-52893
Published: 2025-06-25
Description: OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. OpenBao before v2.3.0 may leak sensitive information in logs when processing malformed data. This is separate from the earlier HCSEC-2025-09 / CVE-2025-4166. This issue has been fixed in OpenBao v2.3.0 and later. Like with HCSEC-2025-09, there is no known workaround except to ensure properly formatted requests from all clients.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-532
References: https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin/74717; https://github.com/go-viper/mapstructure/commit/ed3f92181528ff776a0324107b8b55026e93766a; https://github.com/go-viper/mapstructure/pull/105
CVE: CVE-2025-52894
Published: 2025-06-25
Description: OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. OpenBao before v2.3.0 allowed an attacker to perform unauthenticated, unaudited cancellation of root rekey and recovery rekey operations, effecting a denial of service. In OpenBao v2.2.0 and later, manually setting the configuration option `disable_unauthed_rekey_endpoints=true` allows an operator to deny these rarely-used endpoints on global listeners. A patch is available at commit fe75468822a22a88318c[PII_REDACTED]a02ae5b77b. In a future OpenBao release communicated on OpenBao's website, the maintainers will set this to `true` for all users and provide an authenticated alternative. As a workaround, if an active proxy or load balancer sits in front of OpenBao, an operator can deny requests to these endpoints from unauthorized IP ranges.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/openbao/openbao/commit/fe75468822a22a88318c[PII_REDACTED]a02ae5b77b; https://github.com/openbao/openbao/security/advisories/GHSA-prpj-rchp-9j5h; https://openbao.org/docs/deprecation
CVE: CVE-2025-52999
Published: 2025-06-25
Description: jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the depth is particularly large. jackson-core 2.15.0 contains a configurable limit for how deep Jackson will traverse in an input document, defaulting to an allowable depth of 1000. jackson-core will throw a StreamConstraintsException if the limit is reached. jackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs. As a workaround, users should avoid parsing input files from untrusted sources.
CWE: CWE-121
References: https://github.com/FasterXML/jackson-core/pull/943; https://github.com/FasterXML/jackson-core/security/advisories/GHSA-h46c-h94j-95f3
CVE: CVE-2025-5015
Published: 2025-06-25
Description: A cross-site scripting vulnerability exists in the AccuWeather and Custom RSS widget that allows an unauthenticated user to replace the RSS feed URL with a malicious one.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-175-06
CVE: CVE-2025-6442
Published: 2025-06-25
Description: Ruby WEBrick read_header HTTP Request Smuggling Vulnerability. This vulnerability allows remote attackers to smuggle arbitrary HTTP requests on affected installations of Ruby WEBrick. This issue is exploitable when the product is deployed behind an HTTP proxy that fulfills specific conditions.

The specific flaw exists within the read_headers method. The issue results from the inconsistent parsing of terminators of HTTP headers. An attacker can leverage this vulnerability to smuggle arbitrary HTTP requests. Was ZDI-CAN-21876.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-444
References: https://github.com/ruby/webrick/commit/ee60354bcb84ec33b9245e1d1aa6e1f7e8132101#diff-ad02984d873efb089aa51551bc6b7d307a53e0ba1ac439e91d69c2e58a478864; https://www.zerodayinitiative.com/advisories/ZDI-25-414/
CVE: CVE-2025-6616
Published: 2025-06-25
Description: A vulnerability has been found in D-Link DIR-619L 2.06B01 and classified as critical. This vulnerability affects the function formSetWAN_Wizard51 of the file /goform/formSetWAN_Wizard51. The manipulation of the argument curTime leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_77/77.md; https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_77/77.md#poc; https://vuldb.com/?ctiid.313834
CVE: CVE-2025-6617
Published: 2025-06-25
Description: A vulnerability was found in D-Link DIR-619L 2.06B01 and classified as critical. This issue affects the function formAdvanceSetup of the file /goform/formAdvanceSetup. The manipulation of the argument webpage leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_78/78.md; https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_78/78.md#poc; https://vuldb.com/?ctiid.313835
CVE: CVE-2025-45332
Published: 2025-06-25
Description: vkoskiv c-ray 1.1 contains a Null Pointer Dereference (NPD) vulnerability in the parse_mtllib function of its data processing module, leading to unpredictable program behavior, causing segmentation faults, and program crashes.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://gist.github.com/QiuYitai/6ebfa07510828a9464ba7fb948255ed5; https://github.com/vkoskiv/c-ray/issues/119
CVE: CVE-2025-49549
Published: 2025-06-25
Description: Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized access. Exploitation of this issue does not require user interaction.
CVSS Score: 2.7 (LOW)
CWE: CWE-863
References: https://helpx.adobe.com/security/products/magento/apsb25-50.html
CVE: CVE-2025-49550
Published: 2025-06-25
Description: Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized access. Exploitation of this issue requires user interaction.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://helpx.adobe.com/security/products/magento/apsb25-50.html
CVE: CVE-2025-5822
Published: 2025-06-25
Description: Autel MaxiCharger AC Wallbox Commercial Technician API Incorrect Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. An attacker must first obtain a low-privileged authorization token in order to exploit this vulnerability.

The specific flaw exists within the implementation of the Autel Technician API. The issue results from incorrect authorization. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user. Was ZDI-CAN-26325.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: https://www.zerodayinitiative.com/advisories/ZDI-25-340/
CVE: CVE-2025-5823
Published: 2025-06-25
Description: Autel MaxiCharger AC Wallbox Commercial Serial Number Exposed Dangerous Method Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is required to exploit this vulnerability.

The specific flaw exists within the implementation of the Autel Technician API. The issue results from an exposed dangerous method. An attacker can leverage this vulnerability to disclose credentials, leading to further compromise. Was ZDI-CAN-26351.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-749
References: https://www.zerodayinitiative.com/advisories/ZDI-25-341/
CVE: CVE-2025-5824
Published: 2025-06-25
Description: Autel MaxiCharger AC Wallbox Commercial Origin Validation Error Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Autel MaxiCharger AC Wallbox Commercial. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability.

The specific flaw exists within the handling of bluetooth pairing requests. The issue results from insufficient validation of the origin of commands. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-26353.
CVSS Score: 7.5 (HIGH)
CWE: CWE-346
References: https://www.zerodayinitiative.com/advisories/ZDI-25-343/
CVE: CVE-2025-5825
Published: 2025-06-25
Description: Autel MaxiCharger AC Wallbox Commercial Firmware Downgrade Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability.

The specific flaw exists within the firmware update process. The issue results from the lack of proper validation of a firmware image before using it to perform an upgrade. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the device. Was ZDI-CAN-26354.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1328
References: https://www.zerodayinitiative.com/advisories/ZDI-25-344/
CVE: CVE-2025-5826
Published: 2025-06-25
Description: Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Misinterpretation of Input Vulnerability. This vulnerability allows network-adjacent attackers to inject arbitrary AT commands on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the ble_process_esp32_msg function. The issue results from misinterpretation of input data. An attacker can leverage this vulnerability to execute AT commands in the context of the device. Was ZDI-CAN-26368.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-115
References: https://www.zerodayinitiative.com/advisories/ZDI-25-345/
CVE: CVE-2025-5827
Published: 2025-06-25
Description: Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the ble_process_esp32_msg function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-26369.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://www.zerodayinitiative.com/advisories/ZDI-25-346/
CVE: CVE-2025-5828
Published: 2025-06-25
Description: Autel MaxiCharger AC Wallbox Commercial wLength Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of USB frame packets. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-26328.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-120
References: https://www.zerodayinitiative.com/advisories/ZDI-25-347/
CVE: CVE-2025-5829
Published: 2025-06-25
Description: Autel MaxiCharger AC Wallbox Commercial autocharge Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected  affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of JSON messages. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-26330.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-121
References: https://www.zerodayinitiative.com/advisories/ZDI-25-348/
CVE: CVE-2025-5830
Published: 2025-06-25
Description: Autel MaxiCharger AC Wallbox Commercial DLB_SlaveRegister Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of DLB_SlaveRegister messages. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-26327.
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://www.zerodayinitiative.com/advisories/ZDI-25-349/
CVE: CVE-2025-5832
Published: 2025-06-25
Description: Pioneer DMH-WT7600NEX Software Update Signing Insufficient Verification of Data Authenticity Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Pioneer DMH-WT7600NEX devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the software update verification process. The issue results from the lack of validating all the data in the software update. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-26079.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-345
References: https://www.zerodayinitiative.com/advisories/ZDI-25-352/
CVE: CVE-2025-5833
Published: 2025-06-25
Description: Pioneer DMH-WT7600NEX Root Filesystem Insufficient Verification of Data Authenticity Vulnerability. This vulnerability allows physically present attackers to bypass authentication on affected installations of Pioneer DMH-WT7600NEX devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the configuration of the operating system. The issue results from the lack of properly configured protection for the root file system. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-26077.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-345
References: https://www.zerodayinitiative.com/advisories/ZDI-25-350/
CVE: CVE-2025-5834
Published: 2025-06-25
Description: Pioneer DMH-WT7600NEX Missing Immutable Root of Trust in Hardware Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to bypass authentication on affected installations of Pioneer DMH-WT7600NEX devices. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the configuration of the application system-on-chip (SoC). The issue results from the lack of a properly configured hardware root of trust. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the boot process. Was ZDI-CAN-26078.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1326
References: https://www.zerodayinitiative.com/advisories/ZDI-25-351/
CVE: CVE-2025-6444
Published: 2025-06-25
Description: ServiceStack GetErrorResponse Improper Input Validation NTLM Relay Vulnerability. This vulnerability allows remote attackers to relay NTLM credentials on affected installations of ServiceStack. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the implementation of the GetErrorResponse method. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to relay NTLM credentials in the context of the current user. Was ZDI-CAN-25834.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: https://www.zerodayinitiative.com/advisories/ZDI-25-415/