deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-40104
Published: 2025-10-30
Description: In the Linux kernel, the following vulnerability has been resolved:

ixgbevf: fix mailbox API compatibility by negotiating supported features

There was backward compatibility in the terms of mailbox API. Various
drivers from various OSes supporting 10G adapters from Intel portfolio
could easily negotiate mailbox API.

This convention has been broken since introducing API 1.4.
Commit 0062e7cc955e ("ixgbevf: add VF IPsec offload code") added support
for IPSec which is specific only for the kernel ixgbe driver. None of the
rest of the Intel 10G PF/VF drivers supports it. And actually lack of
support was not included in the IPSec implementation - there were no such
code paths. No possibility to negotiate support for the feature was
introduced along with introduction of the feature itself.

Commit 339f28964147 ("ixgbevf: Add support for new mailbox communication
between PF and VF") increasing API version to 1.5 did the same - it
introduced code supported specifically by the PF ESX driver. It altered API
version for the VF driver in the same time not touching the version
defined for the PF ixgbe driver. It led to additional discrepancies,
as the code provided within API 1.6 cannot be supported for Linux ixgbe
driver as it causes crashes.

The issue was noticed some time ago and mitigated by Jake within the commit
d0725312adf5 ("ixgbevf: stop attempting IPSEC offload on Mailbox API 1.5").
As a result we have regression for IPsec support and after increasing API
to version 1.6 ixgbevf driver stopped to support ESX MBX.

To fix this mess add new mailbox op asking PF driver about supported
features. Basing on a response determine whether to set support for IPSec
and ESX-specific enhanced mailbox.

New mailbox op, for compatibility purposes, must be added within new API
revision, as API version of OOT PF & VF drivers is already increased to
1.6 and doesn't incorporate features negotiate op.

Features negotiation mechanism gives possibility to be extended with new
features when needed in the future.
References: https://git.kernel.org/stable/c/2e0aab9ddaf1428602c78f12064cd1e6ffcc4d18; https://git.kernel.org/stable/c/871ac1cd4ce4804defcb428cbb003fd84c415ff4; https://git.kernel.org/stable/c/a376e29b1b196dc90b50df7e5e3947e3026300c4
CVE: CVE-2025-40105
Published: 2025-10-30
Description: In the Linux kernel, the following vulnerability has been resolved:

vfs: Don't leak disconnected dentries on umount

When user calls open_by_handle_at() on some inode that is not cached, we
will create disconnected dentry for it. If such dentry is a directory,
exportfs_decode_fh_raw() will then try to connect this dentry to the
dentry tree through reconnect_path(). It may happen for various reasons
(such as corrupted fs or race with rename) that the call to
lookup_one_unlocked() in reconnect_one() will fail to find the dentry we
are trying to reconnect and instead create a new dentry under the
parent. Now this dentry will not be marked as disconnected although the
parent still may well be disconnected (at least in case this
inconsistency happened because the fs is corrupted and .. doesn't point
to the real parent directory). This creates inconsistency in
disconnected flags but AFAICS it was mostly harmless. At least until
commit f1ee616214cb ("VFS: don't keep disconnected dentries on d_anon")
which removed adding of most disconnected dentries to sb->s_anon list.
Thus after this commit cleanup of disconnected dentries implicitely
relies on the fact that dput() will immediately reclaim such dentries.
However when some leaf dentry isn't marked as disconnected, as in the
scenario described above, the reclaim doesn't happen and the dentries
are "leaked". Memory reclaim can eventually reclaim them but otherwise
they stay in memory and if umount comes first, we hit infamous "Busy
inodes after unmount" bug. Make sure all dentries created under a
disconnected parent are marked as disconnected as well.
References: https://git.kernel.org/stable/c/20863bb7fbb016379f8227122edfabc5c799bc79; https://git.kernel.org/stable/c/56094ad3eaa21e6621396cc33811d8f72847a834; https://git.kernel.org/stable/c/620f3b0ede9c5cb4976cd0457d0b04ad551e5d6b
CVE: CVE-2025-54469
Published: 2025-10-30
Description: A vulnerability was identified in NeuVector, where the enforcer used environment variables CLUSTER_RPC_PORT and CLUSTER_LAN_PORT to generate a command to be executed via popen, without first sanitising their values.


The entry process of the enforcer container is the monitor
 process. When the enforcer container stops, the monitor process checks 
whether the consul subprocess has exited. To perform this check, the 
monitor process uses the popen function to execute a shell command that determines whether the ports used by the consul subprocess are still active.


The values of environment variables CLUSTER_RPC_PORT and CLUSTER_LAN_PORT
 are used directly to compose shell commands via popen without 
validation or sanitization.  This behavior could allow a malicious user 
to inject malicious commands through these variables within the enforcer
 container.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-78
References: https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-54469; https://github.com/neuvector/neuvector/security/advisories/GHSA-c8g6-qrwh-m3vp
CVE: CVE-2025-54470
Published: 2025-10-30
Description: This vulnerability affects NeuVector deployments only when the Report anonymous cluster data option is enabled. When this option is enabled, NeuVector sends anonymous telemetry data to the telemetry server.


In affected versions, NeuVector does not enforce TLS 
certificate verification when transmitting anonymous cluster data to the
 telemetry server. As a result, the communication channel is susceptible
 to man-in-the-middle (MITM) attacks, where an attacker could intercept 
or modify the transmitted data. Additionally, NeuVector loads the 
response of the telemetry server is loaded into memory without size 
limitation, which makes  it vulnerable to a Denial of Service(DoS) 
attack
CVSS Score: 8.6 (HIGH)
CWE: CWE-295
References: https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-54470; https://github.com/neuvector/neuvector/security/advisories/GHSA-qqj3-g7mx-5p4w
CVE: CVE-2025-54471
Published: 2025-10-30
Description: NeuVector used a hard-coded cryptographic key embedded in the source 
code. At compilation time, the key value was replaced with the secret 
key value and used to encrypt sensitive configurations  when NeuVector 
stores the data.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-321
References: https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-54471; https://github.com/neuvector/neuvector/security/advisories/GHSA-h773-7gf7-9m2x
CVE: CVE-2025-54941
Published: 2025-10-30
Description: An example dag `example_dag_decorator` had non-validated parameter that allowed the UI user to redirect the example to a malicious server and execute code on worker. This however required that the example dags are enabled in production (not default) or the example dag code copied to build your own similar dag. If you used the `example_dag_decorator` please review it and apply the changes implemented in Airflow 3.0.5 accordingly.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-78
References: https://lists.apache.org/thread/c6q6nofc6xl5bms039ks9b34v0v36df1; http://www.openwall.com/lists/oss-security/2025/10/29/6
CVE: CVE-2025-62402
Published: 2025-10-30
Description: API users via `/api/v2/dagReports` could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Dag files were available.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-250
References: https://lists.apache.org/thread/vbzxnxn031wb998hsd7vqnvh4z8nx6rs; http://www.openwall.com/lists/oss-security/2025/10/29/7
CVE: CVE-2025-62503
Published: 2025-10-30
Description: User with CREATE and no UPDATE privilege for Pools, Connections, Variables could update existing records via bulk create API with overwrite action.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-250
References: https://lists.apache.org/thread/3v58249qscyn1hg240gh8hqg9pb4okcr; http://www.openwall.com/lists/oss-security/2025/10/29/8
CVE: CVE-2025-39663
Published: 2025-10-30
Description: Cross-Site Scripting (XSS) vulnerability in Checkmk's distributed monitoring allows a compromised remote site to inject malicious HTML code into service outputs in the central site. Affecting Checkmk before 2.4.0p14, 2.3.0p39, 2.2.0 and 2.1.0 (eol).
CVSS Score: 8.4 (HIGH)
CWE: CWE-80, CWE-79
References: https://checkmk.com/werk/17998; https://github.com/sbaresearch/advisories/tree/82fd27e[PII_REDACTED]c30b35150b197db9a850f4e/2025/SBA-ADV-20250729-01_Checkmk_Cross_Site_Scripting; http://seclists.org/fulldisclosure/2025/Nov/0
CVE: CVE-2025-53880
Published: 2025-10-30
Description: A Path Traversal vulnerability in the tftpsync/add and tftpsync/delete scripts allows a remote attacker on an adjacent network to write or delete files on the filesystem with the privileges of the unprivileged wwwrun user. Although the endpoint is unauthenticated, access is restricted to a list of allowed IP addresses.
CWE: CWE-35
References: https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-53880
CVE: CVE-2025-53883
Published: 2025-10-30
Description: A Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability allows attackers to run arbitrary javascript via a reflected XSS issue in the search fields.This issue affects Container suse/manager/5.0/x86_64/server:latest: from ? before 5.0.28-150600.3.36.8; SUSE Manager Server LTS 4.3: from ? before 4.3.88-150400.3.113.5.
CWE: CWE-80
References: https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-53883
CVE: CVE-2025-10317
Published: 2025-10-30
Description: Quick.Cart is vulnerable to Cross-Site Request Forgery in product creation functionality. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request creating a malicious product with content defined by the attacker.
This software does not implement any protection against this type of attack. All forms available in this software are potentially vulnerable.

The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.7 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
CWE: CWE-352
References: https://cert.pl/posts/2025/10/CVE-2025-10317; https://opensolution.org/sklep-internetowy-quick-cart.html
CVE: CVE-2025-10348
Published: 2025-10-30
Description: URVE Smart Office is vulnerable to Stored XSS in report problem functionality. An attacker with a low-privileged account can upload an SVG file containing a malicious payload, which will be executed when a victim visits the URL of the uploaded resource. The resource is available to anyone without any form of authentication.

This issue was fixed in version 1.1.24.
CWE: CWE-79
References: https://cert.pl/posts/2025/10/CVE-2025-10348; https://smartoffice.expert/
CVE: CVE-2025-63608
Published: 2025-10-30
Description: A SQL injection vulnerability exists in CSZ-CMS <=1.3.0 in the Form Builder view functionality. The vulnerability is located in the field parameter of the form viewing feature, allowing authenticated administrators to execute arbitrary SQL queries.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-89
References: https://github.com/Huu1j/CSZ_CMS-exploit/blob/main/csz-cms-vulnerability-analysis.md
CVE: CVE-2025-43939
Published: 2025-10-30
Description: Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution and Elevation of privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://www.dell.com/support/kbdoc/en-us/000385307/dsa-2025-379-security-update-for-dell-unity-dell-unityvsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities
CVE: CVE-2025-43940
Published: 2025-10-30
Description: Dell Unity, version(s) 5.5 and Prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution and Elevation of privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://www.dell.com/support/kbdoc/en-us/000385307/dsa-2025-379-security-update-for-dell-unity-dell-unityvsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities
CVE: CVE-2025-43941
Published: 2025-10-30
Description: Dell Unity, version(s) 5.5 and Prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability to execute arbitrary command with root privileges. This vulnerability only affects systems without a valid license install.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://www.dell.com/support/kbdoc/en-us/000385307/dsa-2025-379-security-update-for-dell-unity-dell-unityvsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities
CVE: CVE-2025-50736
Published: 2025-10-30
Description: An open redirect vulnerability exists in Byaidu PDFMathTranslate v1.9.9 that allows attackers to craft URLs that cause the application to redirect users to arbitrary external websites via the file parameter to the /gradio_api endpoint. This vulnerability could be exploited for phishing attacks or to bypass security filters.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/fai1424/Vulnerability-Research/tree/main/CVE-2025-50736; https://pdf2zh.com/
CVE: CVE-2025-50739
Published: 2025-10-30
Description: iib0011 omni-tools v0.4.0 is vulnerable to remote code execution via unsafe JSON deserialization.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/fai1424/Vulnerability-Research/tree/main/CVE-2025-50739; https://omnitools.app/json/stringify
CVE: CVE-2025-43027
Published: 2025-10-30
Description: A critical severity vulnerability has been identified in the ALPR Manager role of Security Center that could allow attackers to gain administrative access to the Genetec Security Center system. The Genetec engineering team discovered this issue internally. There is currently no evidence that this vulnerability has been exploited in the wild.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://resources.genetec.com/security-advisories/critical-security-vulnerability-affecting-the-alpr-manager-role-of-security-center; https://ressources.genetec.com/avis-de-securite/faille-de-securite-critique-affectant-le-role-gestionnaire-rapi-de-security-center
CVE: CVE-2025-43942
Published: 2025-10-30
Description: Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution and Elevation of privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://www.dell.com/support/kbdoc/en-us/000385307/dsa-2025-379-security-update-for-dell-unity-dell-unityvsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities
CVE: CVE-2025-46422
Published: 2025-10-30
Description: Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability to execute arbitrary commands with root privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://www.dell.com/support/kbdoc/en-us/000385307/dsa-2025-379-security-update-for-dell-unity-dell-unityvsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities
CVE: CVE-2025-46423
Published: 2025-10-30
Description: Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability to execute arbitrary commands with root privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://www.dell.com/support/kbdoc/en-us/000385307/dsa-2025-379-security-update-for-dell-unity-dell-unityvsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities
CVE: CVE-2025-50574
Published: 2025-10-30
Description: Cross-site scripting (XSS) vulnerability in blog-details.php in Hiruna Gallage's Glamour Salon Management System v1 allows remote attackers to inject arbitrary web script or HTML via the blog comment section parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/Kiezroy/3396b04389c0b91815e538590167f670; https://github.com/Kiezroy/XSS-Disclosure-Glamour-Salon; https://github.com/hirunaofficial/salon-management-system
CVE: CVE-2025-5342
Published: 2025-10-30
Description: Zohocorp ManageEngine Exchange Reporter Plus through 5721 are vulnerable to ReDOS vulnerability in the search module.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400, CWE-1333
References: https://www.manageengine.com/products/exchange-reports/advisory/CVE-2025-5342.html
CVE: CVE-2025-5343
Published: 2025-10-30
Description: Zohocorp ManageEngine Exchange Reporter Plus versions through 5721 are vulnerable to Stored Cross Site Scripting in the Instant Search option.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://www.manageengine.com/products/exchange-reports/advisory/CVE-2025-5343.html
CVE: CVE-2025-5347
Published: 2025-10-30
Description: Zohocorp ManageEngine Exchange Reporter Plus versions before 5723 are vulnerable to Stored Cross Site Scripting in the reports module.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://www.manageengine.com/products/exchange-reports/advisory/CVE-2025-5347.html
CVE: CVE-2025-11998
Published: 2025-10-30
Description: The following HP Card Readers B Models (X3D03B & Y7C05B) are potentially vulnerable to information disclosure, allowing prior user identity to be inherited under certain conditions —e.g., when an NFC device (such as a smartphone/smartwatches) is in proximity during a card swipe event.
CWE: CWE-200
References: https://support.hp.com/us-en/document/ish_13[PII_REDACTED]5716-16/hpsbpi04065
CVE: CVE-2025-12515
Published: 2025-10-30
Description: Systemic Internal Server Errors - HTTP 500 ResponseThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-394
References: https://azure-access.com/security-advisories
CVE: CVE-2025-12516
Published: 2025-10-30
Description: Lack of Graceful Error Handling - HTTP 5xx ErrorThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-394
References: https://azure-access.com/security-advisories
CVE: CVE-2025-12517
Published: 2025-10-30
Description: Credits Page not Matching Versions in Use in the FirmwareThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-448
References: https://azure-access.com/security-advisories
CVE: CVE-2025-36592
Published: 2025-10-30
Description: Dell Secure Connect Gateway (SCG) Policy Manager, version(s) 5.20. 5.22, 5.24, 5.26, 5.28, contain(s) an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Script injection.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.dell.com/support/kbdoc/en-us/000385220/dsa-2025-391-security-update-for-dell-secure-connect-gateway-policy-manager-for-multiple-vulnerabilities
CVE: CVE-2025-46363
Published: 2025-10-30
Description: Dell Secure Connect Gateway (SCG) 5.0 Application and Appliance version(s) 5.26.00.00 - 5.30.00.00, contain a Relative Path Traversal vulnerability in the SCG exposed for an internal collection download REST API (if this REST API is enabled by Admin user from UI). A low privileged attacker with remote access could potentially exploit this vulnerability, leading to allowing relative path traversal to restricted resources.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-23, CWE-22
References: https://www.dell.com/support/kbdoc/en-us/000385239/dsa-2025-386-security-update-for-dell-secure-connect-gateway-rest-api
CVE: CVE-2025-61113
Published: 2025-10-30
Description: TalkTalk 3.3.6 Android App contains improper access control vulnerabilities in multiple API endpoints. By modifying request parameters, attackers may obtain sensitive user information (such as device identifiers and birthdays) and access private group information, including join credentials. Successful exploitation may result in privacy breaches and unauthorized access to restricted resources.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://kar1oz.notion.site/TalkTalk-2619a473ecb28072b600dfcc7791c9d2
CVE: CVE-2025-61115
Published: 2025-10-30
Description: ABC Fine Wine & Spirits Android App version v.11.27.5 and before (package name com.cta.abcfinewineandspirits), developed by ABC Liquors, Inc., contains an improper access control vulnerability in its login mechanism. The application does not properly validate user passwords during authentication, allowing attackers to bypass login checks and obtain valid session identifiers. Successful exploitation could result in unauthorized account access, privacy breaches, and misuse of the platform.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://kar1oz.notion.site/ABC-Fine-Wine-Spirits-2629a473ecb2807787e2f2557e504c7d
CVE: CVE-2025-61116
Published: 2025-10-30
Description: AdForest - Classified Android App version 4.0.12 (package name scriptsbundle.adforest), developed by Muhammad Jawad Arshad, contains an improper access control vulnerability in its authentication mechanism. The app uses a Base64-encoded email address as the authorization credential, which can be manipulated by attackers to gain unauthorized access to user accounts. Successful exploitation could result in account compromise, privacy breaches, and misuse of the platform.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://kar1oz.notion.site/AdForest-Classified-2629a473ecb2806cb787d3654f3e50b8
CVE: CVE-2025-61117
Published: 2025-10-30
Description: Senza: Keto & Fasting Android App version 2.10.15 (package name com.gl.senza), developed by Paul Itoi, contains an improper access control vulnerability. By exploiting insufficient checks in user data API endpoints, attackers can obtain authentication tokens and perform account takeover. Successful exploitation could result in unauthorized account access, privacy breaches, and misuse of the platform.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://kar1oz.notion.site/Senza-Keto-Fasting-2629a473ecb28079bce0dab884d912a2
CVE: CVE-2025-61118
Published: 2025-10-30
Description: mCarFix Motorists App version 2.3 (package name com.skytop.mcarfix), developed by Paniel Mwaura, contains improper access control vulnerabilities. Attackers may bypass verification to arbitrarily register accounts, and by tampering with sequential numeric IDs, gain unauthorized access to user data and groups. Successful exploitation could result in fake account creation, privacy breaches, and misuse of the platform.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://kar1oz.notion.site/mCarFix-Motorists-App-2629a473ecb280ac8679c73098423cf0