deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-8812
Published: 2025-08-10
Description: A vulnerability, which was classified as problematic, was found in atjiu pybbs up to 6.0.0. This affects an unknown part of the file /api/settings of the component Admin Panel. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 2fe4a51afbce0068c291bc1818bbc8f7f3b01a22. It is recommended to apply a patch to fix this issue.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/atjiu/pybbs/commit/2fe4a51afbce0068c291bc1818bbc8f7f3b01a22; https://github.com/atjiu/pybbs/issues/209; https://github.com/atjiu/pybbs/issues/209#issuecomment[PII_REDACTED]
CVE: CVE-2025-8813
Published: 2025-08-10
Description: A vulnerability has been found in atjiu pybbs up to 6.0.0 and classified as problematic. This vulnerability affects the function changeLanguage of the file src/main/java/co/yiiu/pybbs/controller/front/IndexController.java. The manipulation of the argument referer leads to open redirect. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is identified as edb14ff13e9e05394960ba46c3d31d844ff2deac. It is recommended to apply a patch to fix this issue.
CVSS Score: 3.5 (LOW)
CWE: CWE-601
References: https://github.com/atjiu/pybbs/commit/edb14ff13e9e05394960ba46c3d31d844ff2deac; https://github.com/atjiu/pybbs/issues/210; https://github.com/atjiu/pybbs/issues/210#issue[PII_REDACTED]
CVE: CVE-2025-8814
Published: 2025-08-10
Description: A vulnerability was found in atjiu pybbs up to 6.0.0 and classified as problematic. This issue affects the function setCookie of the file src/main/java/co/yiiu/pybbs/util/CookieUtil.java. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is named 8aa2bb1aef3346e49aec6358edf5e47ce905ae7b. It is recommended to apply a patch to fix this issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-862
References: https://github.com/atjiu/pybbs/commit/8aa2bb1aef3346e49aec6358edf5e47ce905ae7b; https://github.com/atjiu/pybbs/issues/211; https://github.com/atjiu/pybbs/issues/211#issue[PII_REDACTED]
CVE: CVE-2025-8815
Published: 2025-08-10
Description: A vulnerability was found in 猫宁i Morning up to bc782730c74ff080494f145cc363a0b4f43f7d3e. It has been classified as critical. Affected is an unknown function of the file /index of the component Shiro Configuration. The manipulation leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.
CVSS Score: 7.3 (HIGH)
CWE: CWE-22
References: https://gitee.com/morning-pro/Morning/issues/ICOVAK; https://vuldb.com/?ctiid.319344; https://vuldb.com/?id.319344
CVE: CVE-2025-8816
Published: 2025-08-10
Description: A vulnerability was determined in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. Affected is the function setOpMode of the file /goform/setOpMode. The manipulation of the argument ethConv leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_50/50.md; https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_50/50.md#poc; https://vuldb.com/?ctiid.319350
CVE: CVE-2025-8817
Published: 2025-08-10
Description: A vulnerability was identified in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. Affected by this vulnerability is the function setLan of the file /goform/setLan. The manipulation of the argument lan2enabled leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_51/51.md; https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_51/51.md#poc; https://vuldb.com/?ctiid.319351
CVE: CVE-2025-8818
Published: 2025-08-10
Description: A vulnerability has been found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. Affected by this issue is the function setDFSSetting of the file /goform/setLan. The manipulation of the argument lanNetmask/lanIp leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77, CWE-78
References: https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_52/52.md; https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_52/52.md#poc; https://vuldb.com/?ctiid.319352
CVE: CVE-2025-8819
Published: 2025-08-10
Description: A vulnerability was found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. This affects the function setWan of the file /goform/setWan. The manipulation of the argument staticIp leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_53/53.md; https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_53/53.md#poc; https://vuldb.com/?ctiid.319353
CVE: CVE-2025-8820
Published: 2025-08-11
Description: A vulnerability was determined in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. This vulnerability affects the function wirelessBasic of the file /goform/wirelessBasic. The manipulation of the argument submit_SSID1 leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_54/54.md; https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_54/54.md#poc; https://vuldb.com/?ctiid.319354
CVE: CVE-2025-8821
Published: 2025-08-11
Description: A vulnerability was identified in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. This issue affects the function RP_setBasic of the file /goform/RP_setBasic. The manipulation of the argument bssid leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77, CWE-78
References: https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_55/55.md; https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_55/55.md#poc; https://vuldb.com/?ctiid.319355
CVE: CVE-2025-8822
Published: 2025-08-11
Description: A vulnerability has been found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. Affected is the function algDisable of the file /goform/setOpMode. The manipulation of the argument opMode leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_56/56.md; https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_56/56.md#poc; https://vuldb.com/?ctiid.319356
CVE: CVE-2025-8823
Published: 2025-08-11
Description: A vulnerability was found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. Affected by this vulnerability is the function setDeviceName of the file /goform/setDeviceName. The manipulation of the argument DeviceName leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77, CWE-78
References: https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_57/57.md; https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_57/57.md#poc; https://vuldb.com/?ctiid.319357
CVE: CVE-2025-8824
Published: 2025-08-11
Description: A vulnerability was determined in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. Affected by this issue is the function setRIP of the file /goform/setRIP. The manipulation of the argument RIPmode/RIPpasswd leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_40/40.md; https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_40/40.md#poc; https://vuldb.com/?ctiid.319358
CVE: CVE-2025-8825
Published: 2025-08-11
Description: A vulnerability was identified in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. This affects the function RP_setBasicAuto of the file /goform/RP_setBasicAuto. The manipulation of the argument staticIp/staticNetmask leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77, CWE-78
References: https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_41/41.md; https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_41/41.md#poc; https://vuldb.com/?ctiid.319359
CVE: CVE-2025-8826
Published: 2025-08-11
Description: A vulnerability has been found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. This vulnerability affects the function um_rp_autochannel of the file /goform/RP_setBasicAuto. The manipulation of the argument apcli_AuthMode_2G/apcli_AuthMode_5G leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_42/42.md; https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_42/42.md#poc; https://vuldb.com/?ctiid.319360
CVE: CVE-2025-24298
Published: 2025-08-11
Description: in OpenHarmony v5.0.3 and prior versions allow a local attacker arbitrary code execution in tcb through use after free.
CVSS Score: 8.4 (HIGH)
CWE: CWE-416
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-07.md
CVE: CVE-2025-24844
Published: 2025-08-11
Description: in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through missing release of memory.
CVSS Score: 3.3 (LOW)
CWE: CWE-401
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-07.md
CVE: CVE-2025-24925
Published: 2025-08-11
Description: in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through missing release of memory.
CVSS Score: 3.3 (LOW)
CWE: CWE-401
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-07.md
CVE: CVE-2025-25212
Published: 2025-08-11
Description: in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through  improper input.
CVSS Score: 3.3 (LOW)
CWE: CWE-20
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-07.md
CVE: CVE-2025-25278
Published: 2025-08-11
Description: in OpenHarmony v5.0.3 and prior versions allow a local attacker arbitrary code execution in tcb through race condition.
CVSS Score: 8.4 (HIGH)
CWE: CWE-362
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-08.md
CVE: CVE-2025-26690
Published: 2025-08-11
Description: in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through NULL pointer dereference.
CVSS Score: 3.3 (LOW)
CWE: CWE-476
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-07.md
CVE: CVE-2025-27128
Published: 2025-08-11
Description: in OpenHarmony v5.0.3 and prior versions allow a local attacker arbitrary code execution in tcb through use after free.
CVSS Score: 8.4 (HIGH)
CWE: CWE-416
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-07.md
CVE: CVE-2025-27536
Published: 2025-08-11
Description: in OpenHarmony v5.0.3 and prior versions allow a local attacker cause DOS through type confusion.
CVSS Score: 3.3 (LOW)
CWE: CWE-843
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-07.md
CVE: CVE-2025-27562
Published: 2025-08-11
Description: in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through missing release of memory.
CVSS Score: 3.3 (LOW)
CWE: CWE-401
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-07.md
CVE: CVE-2025-27577
Published: 2025-08-11
Description: in OpenHarmony v5.0.3 and prior versions allow a local attacker arbitrary code execution in tcb through race condition.
CVSS Score: 8.4 (HIGH)
CWE: CWE-362
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-08.md
CVE: CVE-2025-8827
Published: 2025-08-11
Description: A vulnerability was found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. This issue affects the function um_inspect_cross_band of the file /goform/RP_setBasicAuto. The manipulation of the argument staticGateway leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77, CWE-78
References: https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_43/43.md; https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_43/43.md#poc; https://vuldb.com/?ctiid.319361
CVE: CVE-2025-8828
Published: 2025-08-11
Description: A vulnerability was determined in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. Affected is the function ipv6cmd of the file /goform/setIpv6. The manipulation of the argument Ipv6PriDns/Ipv6SecDns/Ipv6StaticGateway/LanIpv6Addr/LanPrefixLen/pppoeUser/pppoePass/pppoeIdleTime/pppoeRedialPeriod/Ipv6in4_PrefixLen/LocalIpv6/RemoteIpv4/LanIPv6_Prefix/LanPrefixLen/ipv6to4Relay/ipv6rdRelay/tunrd_PrefixLen/wan_UseLinkLocal/Ipv6StaticIp/Ipv6PrefixLen leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77, CWE-78
References: https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_44/44.md; https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_44/44.md#poc; https://vuldb.com/?ctiid.319362
CVE: CVE-2025-8829
Published: 2025-08-11
Description: A vulnerability was identified in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. Affected by this vulnerability is the function um_red of the file /goform/RP_setBasicAuto. The manipulation of the argument hname leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77, CWE-78
References: https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_45/45.md; https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_45/45.md#poc; https://vuldb.com/?ctiid.319363
CVE: CVE-2025-8830
Published: 2025-08-11
Description: A vulnerability has been found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. Affected by this issue is the function sub_3517C of the file /goform/setWan. The manipulation of the argument Hostname leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77, CWE-78
References: https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_46/46.md; https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_46/46.md#poc; https://vuldb.com/?ctiid.319364
CVE: CVE-2025-8831
Published: 2025-08-11
Description: A vulnerability was found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. This affects the function remoteManagement of the file /goform/remoteManagement. The manipulation of the argument portNumber leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_47/47.md; https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_47/47.md#poc; https://vuldb.com/?ctiid.319365
CVE: CVE-2025-8854
Published: 2025-08-11
Description: Stack-based buffer overflow in LoadOFF in bulletphysics bullet3 before 3.26 on all platforms allows remote attackers to execute arbitrary code via a crafted OFF file with an overlong initial token processed by the VHACD test utility or invoked indirectly through PyBullet's vhacd function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-787
References: https://github.com/bulletphysics/bullet3/blob/master/Extras/VHACD/test/src/main_vhacd.cpp#L472; https://github.com/bulletphysics/bullet3/issues/4732; https://github.com/bulletphysics/bullet3/issues/4732
CVE: CVE-2025-7965
Published: 2025-08-11
Description: The CBX Restaurant Booking WordPress plugin through 1.2.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/13e0db0b-87c5-4cf0-b0a6-178bdf96991b/
CVE: CVE-2025-8832
Published: 2025-08-11
Description: A vulnerability was determined in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. This vulnerability affects the function setDMZ of the file /goform/setDMZ. The manipulation of the argument DMZIPAddress leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_48/48.md; https://github.com/wudipjq/my_vuln/blob/main/Linksys1/vuln_48/48.md#poc; https://vuldb.com/?ctiid.319366
CVE: CVE-2025-8833
Published: 2025-08-11
Description: A vulnerability was identified in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. This issue affects the function langSwitchBack of the file /goform/langSwitchBack. The manipulation of the argument langSelectionOnly leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_38/38.md; https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_38/38.md#poc; https://vuldb.com/?ctiid.319367
CVE: CVE-2025-8834
Published: 2025-08-11
Description: A vulnerability has been found in JCG Link-net LW-N915R 17s.20.001.908. Affected is an unknown function of the file /wireless/basic.asp of the component Wireless Basic Settings Page. The manipulation of the argument Network Name leads to cross site scripting. It is possible to launch the attack remotely.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://vuldb.com/?ctiid.319368; https://vuldb.com/?id.319368; https://vuldb.com/?submit.627228
CVE: CVE-2025-8835
Published: 2025-08-11
Description: A vulnerability was found in JasPer up to 4.2.5. Affected by this vulnerability is the function jas_image_chclrspc of the file src/libjasper/base/jas_image.c of the component Image Color Space Conversion Handler. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The identifier of the patch is bb7d62bd0a2a8e0e1fdb4d603f3305f955158c52. It is recommended to apply a patch to fix this issue.
CVSS Score: 3.3 (LOW)
CWE: CWE-404, CWE-476, CWE-476
References: https://drive.google.com/file/d/1E754R-FsFkNJp9OYtu6Dqjv47uGSVP18/view?usp=sharing; https://github.com/jasper-software/jasper/commit/bb7d62bd0a2a8e0e1fdb4d603f3305f955158c52; https://github.com/jasper-software/jasper/issues/400
CVE: CVE-2025-8660
Published: 2025-08-11
Description: Privilege escalation occurs when a user gets access to more resources or functionality than they are normally allowed.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36021
CVE: CVE-2025-8661
Published: 2025-08-11
Description: A stored Cross-Site Scripting vulnerability (XSS) occurs when the server does not properly validate or encode the data entered by the user.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36021
CVE: CVE-2025-8747
Published: 2025-08-11
Description: A safe mode bypass vulnerability in the `Model.load_model` method in Keras versions 3.0.0 through 3.10.0 allows an attacker to achieve arbitrary code execution by convincing a user to load a specially crafted `.keras` model archive.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502
References: https://github.com/keras-team/keras/pull/21429; https://jfrog.com/blog/keras-safe_mode-bypass-vulnerability/; https://jfrog.com/blog/keras-safe_mode-bypass-vulnerability/
CVE: CVE-2025-8836
Published: 2025-08-11
Description: A vulnerability was determined in JasPer up to 4.2.5. Affected by this issue is the function jpc_floorlog2 of the file src/libjasper/jpc/jpc_enc.c of the component JPEG2000 Encoder. The manipulation leads to reachable assertion. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as 79185d32d7a444abae441935b20ae4676b3513d4. It is recommended to apply a patch to fix this issue.
CVSS Score: 3.3 (LOW)
CWE: CWE-617
References: https://drive.google.com/file/d/1pPgndhHh2z0lk99Wt31W-XIW3XWt8FB3/view?usp=drive_link; https://github.com/jasper-software/jasper/commit/79185d32d7a444abae441935b20ae4676b3513d4; https://github.com/jasper-software/jasper/issues/401