deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-47211
Published: 2025-10-03
Description: A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data.

We have already fixed the vulnerability in the following versions:
QTS 5.2.6.3195 build 20250715 and later
QuTS hero h5.2.6.3195 build 20250715 and later
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://www.qnap.com/en/security-advisory/qsa-25-36
CVE: CVE-2025-47212
Published: 2025-10-03
Description: A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands.

We have already fixed the vulnerability in the following versions:
QTS 5.2.6.3195 build 20250715 and later
QuTS hero h5.2.6.3195 build 20250715 and later
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://www.qnap.com/en/security-advisory/qsa-25-36
CVE: CVE-2025-47213
Published: 2025-10-03
Description: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following versions:
QTS 5.2.6.3195 build 20250715 and later
QuTS hero h5.2.6.3195 build 20250715 and later
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-476
References: https://www.qnap.com/en/security-advisory/qsa-25-36
CVE: CVE-2025-47214
Published: 2025-10-03
Description: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following versions:
QTS 5.2.6.3195 build 20250715 and later
  and later
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-476
References: https://www.qnap.com/en/security-advisory/qsa-25-36
CVE: CVE-2025-48726
Published: 2025-10-03
Description: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following versions:
QTS 5.2.6.3195 build 20250715 and later
QuTS hero h5.2.6.3195 build 20250715 and later
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-476
References: https://www.qnap.com/en/security-advisory/qsa-25-36
CVE: CVE-2025-48727
Published: 2025-10-03
Description: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following versions:
QTS 5.2.6.3195 build 20250715 and later
QuTS hero h5.2.6.3195 build 20250715 and later
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-476
References: https://www.qnap.com/en/security-advisory/qsa-25-36
CVE: CVE-2025-48728
Published: 2025-10-03
Description: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following versions:
QTS 5.2.6.3195 build 20250715 and later
QuTS hero h5.2.6.3195 build 20250715 and later
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-476
References: https://www.qnap.com/en/security-advisory/qsa-25-36
CVE: CVE-2025-48729
Published: 2025-10-03
Description: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following versions:
QTS 5.2.6.3195 build 20250715 and later
QuTS hero h5.2.6.3195 build 20250715 and later
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-476
References: https://www.qnap.com/en/security-advisory/qsa-25-36
CVE: CVE-2025-48730
Published: 2025-10-03
Description: A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data or modify memory.

We have already fixed the vulnerability in the following versions:
QTS 5.2.6.3195 build 20250715 and later
QuTS hero h5.2.6.3195 build 20250715 and later
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-134
References: https://www.qnap.com/en/security-advisory/qsa-25-36
CVE: CVE-2025-52424
Published: 2025-10-03
Description: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following versions:
QTS 5.2.6.3195 build 20250715 and later
QuTS hero h5.2.6.3195 build 20250715 and later
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-476
References: https://www.qnap.com/en/security-advisory/qsa-25-36
CVE: CVE-2025-52427
Published: 2025-10-03
Description: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following versions:
QTS 5.2.6.3195 build 20250715 and later
QuTS hero h5.2.6.3195 build 20250715 and later
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-476
References: https://www.qnap.com/en/security-advisory/qsa-25-36
CVE: CVE-2025-52428
Published: 2025-10-03
Description: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following versions:
QTS 5.2.6.3195 build 20250715 and later
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-476
References: https://www.qnap.com/en/security-advisory/qsa-25-36
CVE: CVE-2025-52429
Published: 2025-10-03
Description: A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data or modify memory.

We have already fixed the vulnerability in the following versions:
QTS 5.2.6.3195 build 20250715 and later
QuTS hero h5.2.6.3195 build 20250715 and later
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-134
References: https://www.qnap.com/en/security-advisory/qsa-25-36
CVE: CVE-2025-52432
Published: 2025-10-03
Description: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following versions:
QTS 5.2.6.3195 build 20250715 and later
  and later
QuTS hero h5.2.6.3195 build 20250715 and later
QuTS hero h5.3.0.3192 build 20250716 and later
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-476
References: https://www.qnap.com/en/security-advisory/qsa-25-36
CVE: CVE-2025-52433
Published: 2025-10-03
Description: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following versions:
QTS 5.2.6.3195 build 20250715 and later
QuTS hero h5.2.6.3195 build 20250715 and later
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-476
References: https://www.qnap.com/en/security-advisory/qsa-25-36
CVE: CVE-2025-52654
Published: 2025-10-03
Description: HCL MyXalytics v6.6 is affected by an HTML Injection. This issue occurs when untrusted input is included in the output without proper handling, potentially allowing unauthorized content injection and manipulation.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-80
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124411
CVE: CVE-2025-52656
Published: 2025-10-03
Description: HCL MyXalytics: 6.6.  is affected by Mass Assignment vulnerability. Mass Assignment occurs when user input is automatically bound to application objects without proper validation or access controls, potentially allowing unauthorized modification of sensitive fields.
CVSS Score: 7.6 (HIGH)
CWE: CWE-915
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124411
CVE: CVE-2025-52658
Published: 2025-10-03
Description: HCL MyXalytics is affected by the use of vulnerable/outdated versions which can expose the application to known security risks that could be exploited.
CVSS Score: 3.5 (LOW)
CWE: CWE-1104, CWE-1021, CWE-1104
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124411
CVE: CVE-2025-52853
Published: 2025-10-03
Description: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following versions:
QTS 5.2.6.3195 build 20250715 and later
QuTS hero h5.2.6.3195 build 20250715 and later
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-476
References: https://www.qnap.com/en/security-advisory/qsa-25-36
CVE: CVE-2025-52854
Published: 2025-10-03
Description: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following versions:
QTS 5.2.6.3195 build 20250715 and later
QuTS hero h5.2.6.3195 build 20250715 and later
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-476
References: https://www.qnap.com/en/security-advisory/qsa-25-36
CVE: CVE-2025-52855
Published: 2025-10-03
Description: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following versions:
QTS 5.2.6.3195 build 20250715 and later
QuTS hero h5.2.6.3195 build 20250715 and later
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-476
References: https://www.qnap.com/en/security-advisory/qsa-25-36
CVE: CVE-2025-52857
Published: 2025-10-03
Description: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following versions:
QTS 5.2.6.3195 build 20250715 and later
QuTS hero h5.2.6.3195 build 20250715 and later
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-476
References: https://www.qnap.com/en/security-advisory/qsa-25-36
CVE: CVE-2025-52858
Published: 2025-10-03
Description: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following versions:
QTS 5.2.6.3195 build 20250715 and later
QuTS hero h5.2.6.3195 build 20250715 and later
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-476
References: https://www.qnap.com/en/security-advisory/qsa-25-36
CVE: CVE-2025-52859
Published: 2025-10-03
Description: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following versions:
QTS 5.2.6.3195 build 20250715 and later
QuTS hero h5.2.6.3195 build 20250715 and later
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-476
References: https://www.qnap.com/en/security-advisory/qsa-25-36
CVE: CVE-2025-52860
Published: 2025-10-03
Description: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following versions:
QTS 5.2.6.3195 build 20250715 and later
QuTS hero h5.2.6.3195 build 20250715 and later
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-476
References: https://www.qnap.com/en/security-advisory/qsa-25-36
CVE: CVE-2025-52862
Published: 2025-10-03
Description: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following versions:
QTS 5.2.6.3195 build 20250715 and later
QuTS hero h5.2.6.3195 build 20250715 and later
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-476
References: https://www.qnap.com/en/security-advisory/qsa-25-36
CVE: CVE-2025-52866
Published: 2025-10-03
Description: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following versions:
QTS 5.2.6.3195 build 20250715 and later
QuTS hero h5.2.6.3195 build 20250715 and later
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-476
References: https://www.qnap.com/en/security-advisory/qsa-25-36
CVE: CVE-2025-52867
Published: 2025-10-03
Description: An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.2 ( 2025/07/31 ) and later
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400, CWE-770
References: https://www.qnap.com/en/security-advisory/qsa-25-35
CVE: CVE-2025-53406
Published: 2025-10-03
Description: A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data or modify memory.

We have already fixed the vulnerability in the following versions:
QTS 5.2.6.3195 build 20250715 and later
QuTS hero h5.2.6.3195 build 20250715 and later
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-134
References: https://www.qnap.com/en/security-advisory/qsa-25-36
CVE: CVE-2025-53407
Published: 2025-10-03
Description: A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data or modify memory.

We have already fixed the vulnerability in the following versions:
QTS 5.2.6.3195 build 20250715 and later
QuTS hero h5.2.6.3195 build 20250715 and later
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-134
References: https://www.qnap.com/en/security-advisory/qsa-25-36
CVE: CVE-2025-53595
Published: 2025-10-03
Description: An SQL injection vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands.

We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.2 ( 2025/07/31 ) and later
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.qnap.com/en/security-advisory/qsa-25-35
CVE: CVE-2025-54153
Published: 2025-10-03
Description: An SQL injection vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands.

We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.2 ( 2025/07/31 ) and later
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.qnap.com/en/security-advisory/qsa-25-35
CVE: CVE-2025-54154
Published: 2025-10-03
Description: An improper authentication vulnerability has been reported to affect QNAP Authenticator. If an attacker gains physical access, they can then exploit the vulnerability to compromise the security of the system.

We have already fixed the vulnerability in the following version:
QNAP Authenticator 1.3.1.1227 and later
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: https://www.qnap.com/en/security-advisory/qsa-25-30
CVE: CVE-2025-57714
Published: 2025-10-03
Description: An unquoted search path or element vulnerability has been reported to affect NetBak Replicator. If a local attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands.

We have already fixed the vulnerability in the following version:
NetBak Replicator 4.5.15.0807 and later
CVSS Score: 7.8 (HIGH)
CWE: CWE-428
References: https://www.qnap.com/en/security-advisory/qsa-25-39
CVE: CVE-2025-49844
Published: 2025-10-03
Description: Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-416
References: https://github.com/redis/redis/commit/d5728cb5795c966c5b5b1e0f0ac576a7e69af539; https://github.com/redis/redis/releases/tag/8.2.2; https://github.com/redis/redis/security/advisories/GHSA-4789-qfc9-5f9q
CVE: CVE-2025-53354
Published: 2025-10-03
Description: NiceGUI is a Python-based UI framework. Versions 2.24.2 and below are at risk for Cross-Site Scripting (XSS) when developers render unescaped user input into the DOM using ui.html(). NiceGUI did not enforce HTML or JavaScript sanitization, so applications that directly combine components like ui.input() with ui.html() or  ui.chat_message with HTML content without escaping may allow attackers to execute arbitrary JavaScript in the user’s browser. Applications that do not pass untrusted input into ui.html() are not affected. This issue is fixed in version 3.0.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/zauberzeug/nicegui/commit/4673dc35c94a0c7339e2164378b0977332e60775; https://github.com/zauberzeug/nicegui/security/advisories/GHSA-8c95-hpq2-w46f
CVE: CVE-2025-54374
Published: 2025-10-03
Description: Eidos is an extensible framework for Personal Data Management. Versions 0.21.0 and below contain a one-click remote code execution vulnerability. An attacker can exploit this vulnerability by embedding a specially crafted eidos: URL on any website, including a malicious one they control. When a victim visits such a site or clicks on the link, the browser triggers the app’s custom URL handler (eidos:), causing the Eidos application to launch and process the URL, leading to remote code execution on the victim’s machine. This issue does not have a fix as of October 3, 2025
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://github.com/mayneyao/eidos/security/advisories/GHSA-qhhm-56qp-xr2r; https://github.com/mayneyao/eidos/security/advisories/GHSA-qhhm-56qp-xr2r
CVE: CVE-2025-59829
Published: 2025-10-03
Description: Claude Code is an agentic coding tool. Versions below 1.0.120 failed to account for symlinks when checking permission deny rules. If a user explicitly denied Claude Code access to a file and Claude Code had access to a symlink pointing to that file, it was possible for Claude Code to access the file. Users on standard Claude Code auto-update will have received this fix automatically. Users performing manual updates are advised to update to the latest version. This issue is fixed in version 1.0.120.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-61
References: https://github.com/anthropics/claude-code/security/advisories/GHSA-66m2-gx93-v996
CVE: CVE-2025-10692
Published: 2025-10-03
Description: The endpoint POST /api/staff/get-new-tickets concatenates the user-controlled parameter departmentId directly into the SQL WHERE clause without parameter binding. As a result, an authenticated staff user (level ≥ 1) can inject SQL to alter the filter logic, effectively bypassing department scoping and disclosing tickets beyond their intended access.This issue affects OpenSupports: 4.11.0.
CWE: CWE-89
References: https://fluidattacks.com/advisories/tito; https://github.com/opensupports/opensupports
CVE: CVE-2025-10695
Published: 2025-10-03
Description: Two unauthenticated diagnostic endpoints allow arbitrary backend-initiated network connections to an attacker‑supplied destination. Both endpoints are exposed with permission => 'any', enabling unauthenticated SSRF for internal network scanning and service interaction.

This issue affects OpenSupports: 4.11.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918
References: https://fluidattacks.com/advisories/freer; https://github.com/opensupports/opensupports; https://fluidattacks.com/advisories/freer
CVE: CVE-2025-10696
Published: 2025-10-03
Description: OpenSupports exposes an endpoint that allows the list of 'supervised users' for any account to be edited, but it does not validate whether the actor is the owner of that list. A Level 1 staff member can modify the supervision relationship of a third party (the target user), who can then view the tickets of the added 'supervised' users. This breaks the authorization model and filters the content of other users' tickets.This issue affects OpenSupports: 4.11.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-863
References: https://fluidattacks.com/advisories/stratovarius; https://github.com/opensupports/opensupports; https://fluidattacks.com/advisories/stratovarius
CVE: CVE-2025-59943
Published: 2025-10-03
Description: phpMyFAQ is an open source FAQ web application. Versions 4.0-nightly-2025-10-03 and below do not enforce uniqueness of email addresses during user registration. This allows multiple distinct accounts to be created with the same email. Because email is often used as an identifier for password resets, notifications, and administrative actions, this flaw can cause account ambiguity and, in certain configurations, may lead to privilege escalation or account takeover. This issue is fixed in version 4.0.13.
CVSS Score: 8.1 (HIGH)
CWE: CWE-284, CWE-286
References: https://github.com/thorsten/phpMyFAQ/commit/44cd20f86eb041f39d1c30a9beefad1cc61dc0ec; https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-9wj2-4hcm-r74j; https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-9wj2-4hcm-r74j