deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-43225
Published: 2025-07-30
Description: A logging issue was addressed with improved data redaction. This issue is fixed in iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to access sensitive user data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532
References: https://support.apple.com/en-us/124148; https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124150
CVE: CVE-2025-43226
Published: 2025-07-30
Description: An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.7, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing a maliciously crafted image may result in disclosure of process memory.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-125
References: https://support.apple.com/en-us/124147; https://support.apple.com/en-us/124148; https://support.apple.com/en-us/124149
CVE: CVE-2025-43227
Published: 2025-07-30
Description: This issue was addressed through improved state management. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may disclose sensitive user information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-359
References: https://support.apple.com/en-us/124147; https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124152
CVE: CVE-2025-43228
Published: 2025-07-30
Description: The issue was addressed with improved UI. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6. Visiting a malicious website may lead to address bar spoofing.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-451
References: https://support.apple.com/en-us/124147; https://support.apple.com/en-us/124152; http://seclists.org/fulldisclosure/2025/Aug/0
CVE: CVE-2025-43229
Published: 2025-07-30
Description: This issue was addressed through improved state management. This issue is fixed in Safari 18.6, macOS Sequoia 15.6. Processing maliciously crafted web content may lead to universal cross site scripting.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124152; http://seclists.org/fulldisclosure/2025/Aug/0
CVE: CVE-2025-43230
Published: 2025-07-30
Description: The issue was addressed with additional permissions checks. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. An app may be able to access user-sensitive data.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-863
References: https://support.apple.com/en-us/124147; https://support.apple.com/en-us/124148; https://support.apple.com/en-us/124149
CVE: CVE-2025-43232
Published: 2025-07-30
Description: A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to bypass certain Privacy preferences.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124150; https://support.apple.com/en-us/124151
CVE: CVE-2025-43233
Published: 2025-07-30
Description: This issue was addressed with improved access restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. A malicious app acting as a HTTPS proxy could get access to sensitive user data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124150; https://support.apple.com/en-us/124151
CVE: CVE-2025-43234
Published: 2025-07-30
Description: Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing a maliciously crafted texture may lead to unexpected app termination.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://support.apple.com/en-us/124147; https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124153
CVE: CVE-2025-43235
Published: 2025-07-30
Description: The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6. An app may be able to cause a denial-of-service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: https://support.apple.com/en-us/124149; http://seclists.org/fulldisclosure/2025/Jul/32
CVE: CVE-2025-43237
Published: 2025-07-30
Description: An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.6. An app may be able to cause unexpected system termination.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://support.apple.com/en-us/124149; http://seclists.org/fulldisclosure/2025/Jul/32
CVE: CVE-2025-43239
Published: 2025-07-30
Description: An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. Processing a maliciously crafted file may lead to unexpected app termination.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124150; https://support.apple.com/en-us/124151
CVE: CVE-2025-43240
Published: 2025-07-30
Description: A logic issue was addressed with improved checks. This issue is fixed in Safari 18.6, macOS Sequoia 15.6. A download's origin may be incorrectly associated.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-703
References: https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124152; http://seclists.org/fulldisclosure/2025/Aug/0
CVE: CVE-2025-43241
Published: 2025-07-30
Description: A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to read files outside of its sandbox.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124150; https://support.apple.com/en-us/124151
CVE: CVE-2025-43243
Published: 2025-07-30
Description: A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to modify protected parts of the file system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-732
References: https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124150; https://support.apple.com/en-us/124151
CVE: CVE-2025-43244
Published: 2025-07-30
Description: A race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to cause unexpected system termination.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-362
References: https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124150; https://support.apple.com/en-us/124151
CVE: CVE-2025-43245
Published: 2025-07-30
Description: A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to access protected user data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-290
References: https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124150; https://support.apple.com/en-us/124151
CVE: CVE-2025-43246
Published: 2025-07-30
Description: This issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7. An app may be able to access sensitive user data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124150; http://seclists.org/fulldisclosure/2025/Jul/32
CVE: CVE-2025-43247
Published: 2025-07-30
Description: A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. A malicious app with root privileges may be able to modify the contents of system files.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-732
References: https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124150; https://support.apple.com/en-us/124151
CVE: CVE-2025-43248
Published: 2025-07-30
Description: A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7. A malicious app may be able to gain root privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124150; http://seclists.org/fulldisclosure/2025/Jul/32
CVE: CVE-2025-43249
Published: 2025-07-30
Description: A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to gain root privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124150; https://support.apple.com/en-us/124151
CVE: CVE-2025-43250
Published: 2025-07-30
Description: A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to break out of its sandbox.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124150; https://support.apple.com/en-us/124151
CVE: CVE-2025-43251
Published: 2025-07-30
Description: An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.6. A local attacker may gain access to Keychain items.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-863
References: https://support.apple.com/en-us/124149; http://seclists.org/fulldisclosure/2025/Jul/32
CVE: CVE-2025-43252
Published: 2025-07-30
Description: This issue was addressed by adding an additional prompt for user consent. This issue is fixed in macOS Sequoia 15.6. A website may be able to access sensitive user data when resolving symlinks.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-59
References: https://support.apple.com/en-us/124149; http://seclists.org/fulldisclosure/2025/Jul/32
CVE: CVE-2025-43253
Published: 2025-07-30
Description: This issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7. A malicious app may be able to launch arbitrary binaries on a trusted device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124150; http://seclists.org/fulldisclosure/2025/Jul/32
CVE: CVE-2025-43254
Published: 2025-07-30
Description: An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. Processing a maliciously crafted file may lead to unexpected app termination.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124150; https://support.apple.com/en-us/124151
CVE: CVE-2025-43256
Published: 2025-07-30
Description: This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7. An app may be able to gain root privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124150; http://seclists.org/fulldisclosure/2025/Jul/32
CVE: CVE-2025-43259
Published: 2025-07-30
Description: This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An attacker with physical access to a locked device may be able to view sensitive user information.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-359
References: https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124150; https://support.apple.com/en-us/124151
CVE: CVE-2025-43260
Published: 2025-07-30
Description: This issue was addressed with improved data protection. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7. An app may be able to hijack entitlements granted to other privileged apps.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-266
References: https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124150; http://seclists.org/fulldisclosure/2025/Jul/32
CVE: CVE-2025-43261
Published: 2025-07-30
Description: A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to break out of its sandbox.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-693
References: https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124150; https://support.apple.com/en-us/124151
CVE: CVE-2025-43265
Published: 2025-07-30
Description: An out-of-bounds read was addressed with improved input validation. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may disclose internal states of the app.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-125
References: https://support.apple.com/en-us/124147; https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124152
CVE: CVE-2025-43266
Published: 2025-07-30
Description: A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to break out of its sandbox.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-732
References: https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124150; https://support.apple.com/en-us/124151
CVE: CVE-2025-43267
Published: 2025-07-30
Description: An injection issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.6. An app may be able to access sensitive user data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-74
References: https://support.apple.com/en-us/124149; http://seclists.org/fulldisclosure/2025/Jul/32
CVE: CVE-2025-43270
Published: 2025-07-30
Description: An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may gain unauthorized access to Local Network.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124150; https://support.apple.com/en-us/124151
CVE: CVE-2025-43273
Published: 2025-07-30
Description: A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.8. A sandboxed process may be able to circumvent sandbox restrictions.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-693
References: https://support.apple.com/en-us/124149; https://support.apple.com/en-us/125112; http://seclists.org/fulldisclosure/2025/Jul/32
CVE: CVE-2025-43274
Published: 2025-07-30
Description: A privacy issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.6. A sandboxed process may be able to circumvent sandbox restrictions.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-311
References: https://support.apple.com/en-us/124149; http://seclists.org/fulldisclosure/2025/Jul/32
CVE: CVE-2025-43275
Published: 2025-07-30
Description: A race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to break out of its sandbox.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-362
References: https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124150; https://support.apple.com/en-us/124151
CVE: CVE-2025-43276
Published: 2025-07-30
Description: A logic error was addressed with improved error handling. This issue is fixed in macOS Sequoia 15.6. iCloud Private Relay may not activate when more than one user is logged in at the same time.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-367
References: https://support.apple.com/en-us/124149; http://seclists.org/fulldisclosure/2025/Jul/32
CVE: CVE-2025-43277
Published: 2025-07-30
Description: The issue was addressed with improved memory handling. This issue is fixed in iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, macOS Sonoma 14.8, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing a maliciously crafted audio file may lead to memory corruption.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://support.apple.com/en-us/124147; https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124153
CVE: CVE-2025-8319
Published: 2025-07-30
Description: the BMA login interface allows arbitrary JavaScript or HTML to be written straight into the page’s Document Object Model via the error= URL parameter
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://bugcrowd.com/disclosures/30a330ef-0885-458c-a64f-2ad63d196b4d/dom-based-cross-site-scripting-xss-with-keylogger-injection-via-the-error-parameter-in-barracuda-mail-archiver; https://bugcrowd.com/disclosures/30a330ef-0885-458c-a64f-2ad63d196b4d/dom-based-cross-site-scripting-xss-with-keylogger-injection-via-the-error-parameter-in-barracuda-mail-archiver
CVE: CVE-2025-0712
Published: 2025-07-30
Description: An uncontrolled search path element vulnerability can lead to local privilege Escalation (LPE) via Insecure Directory Permissions. The vulnerability arises from improper handling of directory permissions. An attacker with local access may exploit this flaw to move and delete arbitrary files, potentially gaining SYSTEM privileges.
CVSS Score: 7.0 (HIGH)
CWE: CWE-427
References: https://discuss.elastic.co/t/beats-windows-installer-9-1-0-security-update-esa-2025-12/380558
CVE: CVE-2025-25011
Published: 2025-07-30
Description: An uncontrolled search path element vulnerability can lead to local privilege Escalation (LPE) via Insecure Directory Permissions. The vulnerability arises from improper handling of directory permissions. An attacker with local access may exploit this flaw to move and delete arbitrary files, potentially gaining SYSTEM privileges.
CVSS Score: 7.0 (HIGH)
CWE: CWE-427
References: https://discuss.elastic.co/t/beats-windows-installer-9-1-0-security-update-esa-2025-12/380558
CVE: CVE-2025-4421
Published: 2025-07-30
Description: The vulnerability was identified in the code developed specifically for Lenovo. Please visit "Lenovo Product Security Advisories and Announcements" webpage for more information about the vulnerability.  https://support.lenovo.com/us/en/product_security/home
CVSS Score: 8.2 (HIGH)
CWE: CWE-787
References: https://support.lenovo.com/us/en/product_security/home; https://www.insyde.com/security-pledge/sa-2025007/
CVE: CVE-2025-4422
Published: 2025-07-30
Description: The vulnerability was identified in the code developed specifically for Lenovo. Please visit "Lenovo Product Security Advisories and Announcements" webpage for more information about the vulnerability.  https://support.lenovo.com/us/en/product_security/home
CVSS Score: 8.2 (HIGH)
CWE: CWE-787
References: https://support.lenovo.com/us/en/product_security/home; https://www.insyde.com/security-pledge/sa-2025007/
CVE: CVE-2025-4423
Published: 2025-07-30
Description: The vulnerability was identified in the code developed specifically for Lenovo. Please visit "Lenovo Product Security Advisories and Announcements" webpage for more information about the vulnerability.  https://support.lenovo.com/us/en/product_security/home
CVSS Score: 8.2 (HIGH)
CWE: CWE-119
References: https://support.lenovo.com/us/en/product_security/home; https://www.insyde.com/security-pledge/sa-2025007/
CVE: CVE-2025-4424
Published: 2025-07-30
Description: The vulnerability was identified in the code developed specifically for Lenovo. Please visit "Lenovo Product Security Advisories and Announcements" webpage for more information about the vulnerability.  https://support.lenovo.com/us/en/product_security/home
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-20
References: https://support.lenovo.com/us/en/product_security/home; https://www.insyde.com/security-pledge/sa-2025007/
CVE: CVE-2025-4425
Published: 2025-07-30
Description: The vulnerability was identified in the code developed specifically for Lenovo. Please visit "Lenovo Product Security Advisories and Announcements" webpage for more information about the vulnerability.  https://support.lenovo.com/us/en/product_security/home
CVSS Score: 8.2 (HIGH)
CWE: CWE-121
References: https://support.lenovo.com/us/en/product_security/home; https://www.insyde.com/security-pledge/sa-2025007/
CVE: CVE-2025-4426
Published: 2025-07-30
Description: The vulnerability was identified in the code developed specifically for Lenovo. Please visit "Lenovo Product Security Advisories and Announcements" webpage for more information about the vulnerability.  https://support.lenovo.com/us/en/product_security/home
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-200
References: https://support.lenovo.com/us/en/product_security/home; https://www.insyde.com/security-pledge/sa-2025007/
CVE: CVE-2025-8217
Published: 2025-07-30
Description: The Amazon Q Developer Visual Studio Code (VS Code) extension v1.84.0 contains inert, injected code designed to call the Q Developer CLI. The code executes when the extension is launched within the VS Code environment; however the injected code contains a syntax error which prevents it from making a successful API call to the Q Developer CLI.



To mitigate this issue, users should upgrade to version v1.85.0. All installations of v1.84.0 should be removed from use.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-506
References: https://aws.amazon.com/security/security-bulletins/AWS-2025-015/; https://github.com/aws/aws-toolkit-vscode/releases/tag/amazonq%2Fv1.85.0; https://github.com/aws/aws-toolkit-vscode/security/advisories/GHSA-7g7f-ff96-5gcw
CVE: CVE-2025-8320
Published: 2025-07-30
Description: Tesla Wall Connector Content-Length Header Improper Input Validation Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Tesla Wall Connector devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the parsing of the HTTP Content-Length header. The issue results from the lack of proper validation of user-supplied data, which can result in memory access past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-26300.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1284
References: https://www.zerodayinitiative.com/advisories/ZDI-25-711/
CVE: CVE-2025-8321
Published: 2025-07-30
Description: Tesla Wall Connector Firmware Downgrade Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Tesla Wall Connector devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the firmware upgrade feature. The issue results from the lack of an anti-downgrade mechanism. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the device. Was ZDI-CAN-26299.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-1328
References: https://www.zerodayinitiative.com/advisories/ZDI-25-712/
CVE: CVE-2025-8292
Published: 2025-07-30
Description: Use after free in Media Stream in Google Chrome prior to 138.0.7204.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2025/07/stable-channel-update-for-desktop_29.html; https://issues.chromium.org/issues/426054987
CVE: CVE-2025-8322
Published: 2025-07-30
Description: The e-School from Ventem has a Missing Authorization vulnerability, allowing remote attackers with regular privilege to access administrator functions, including creating, modifying, and deleting accounts. They can even escalate any account to system administrator privilege.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://www.twcert.org.tw/en/cp-139-10305-2eca0-2.html; https://www.twcert.org.tw/tw/cp-132-10304-6b375-1.html