deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-68929
Published: 2025-12-29
Description: Frappe is a full-stack web application framework. Prior to versions 14.99.6 and 15.88.1, an authenticated user with specific permissions could be tricked into accessing a specially crafted link. This could lead to a malicious template being executed on the server, resulting in remote code execution. Versions 14.99.6 and 15.88.1 fix the issue. No known workarounds are available.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-1336
References: https://github.com/frappe/frappe/releases/tag/v14.99.6; https://github.com/frappe/frappe/releases/tag/v15.88.1; https://github.com/frappe/frappe/security/advisories/GHSA-qq98-vfv9-xmxh
CVE: CVE-2025-15194
Published: 2025-12-29
Description: A vulnerability was found in D-Link DIR-600 up to 2.15WWb02. Affected by this vulnerability is an unknown functionality of the file hedwig.cgi of the component HTTP Header Handler. The manipulation of the argument Cookie results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119, CWE-121
References: https://github.com/LonTan0/CVE/blob/main/Stack-Based%20Buffer%20Overflow%20Vulnerability%20in%20hedwig.cgi%20of%20D-Link%20DIR-600.md; https://github.com/LonTan0/CVE/blob/main/Stack-Based%20Buffer%20Overflow%20Vulnerability%20in%20hedwig.cgi%20of%20D-Link%20DIR-600.md#poc; https://vuldb.com/?ctiid.338581
CVE: CVE-2025-15195
Published: 2025-12-29
Description: A vulnerability was determined in code-projects Assessment Management 1.0. Affected by this issue is some unknown functionality of the file /admin/add-module.php. This manipulation of the argument linked[] causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/Limingqian123/CVE/issues/3; https://vuldb.com/?ctiid.338582
CVE: CVE-2025-56333
Published: 2025-12-29
Description: An issue in Fossorial fosrl/pangolin v.1.6.2 and before allows a remote attacker to escalate privileges via the 2FA component
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://gist.github.com/mrdgef/ef6fa41d69c[PII_REDACTED]c163d7d7d75; https://github.com/fosrl/pangolin; https://gist.github.com/mrdgef/ef6fa41d69c[PII_REDACTED]c163d7d7d75
CVE: CVE-2025-68876
Published: 2025-12-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in INVELITY Invelity SPS connect invelity-sps-connect allows Reflected XSS.This issue affects Invelity SPS connect: from n/a through <= 1.0.8.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/invelity-sps-connect/vulnerability/wordpress-invelity-sps-connect-plugin-1-0-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-68877
Published: 2025-12-29
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in cedcommerce CedCommerce Integration for Good Market ced-good-market-integration allows PHP Local File Inclusion.This issue affects CedCommerce Integration for Good Market: from n/a through <= 1.0.6.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/ced-good-market-integration/vulnerability/wordpress-cedcommerce-integration-for-good-market-plugin-1-0-6-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-68878
Published: 2025-12-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in prasadkirpekar Advanced Custom CSS advanced-custom-css allows Reflected XSS.This issue affects Advanced Custom CSS: from n/a through <= 1.1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/advanced-custom-css/vulnerability/wordpress-advanced-custom-css-plugin-1-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-68879
Published: 2025-12-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in councilsoft Content Grid Slider content-grid-slider allows Reflected XSS.This issue affects Content Grid Slider: from n/a through <= 1.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/content-grid-slider/vulnerability/wordpress-content-grid-slider-plugin-1-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-68893
Published: 2025-12-29
Description: Server-Side Request Forgery (SSRF) vulnerability in HETWORKS WordPress Image shrinker wp-image-shrinker allows Server Side Request Forgery.This issue affects WordPress Image shrinker: from n/a through <= 1.1.0.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-918
References: https://patchstack.com/database/Wordpress/Plugin/wp-image-shrinker/vulnerability/wordpress-wordpress-image-shrinker-plugin-1-1-0-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2025-68897
Published: 2025-12-29
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Mohammad I. Okfie IF AS Shortcode if-as-shortcode allows Code Injection.This issue affects IF AS Shortcode: from n/a through <= 1.2.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-94
References: https://patchstack.com/database/Wordpress/Plugin/if-as-shortcode/vulnerability/wordpress-if-as-shortcode-plugin-1-2-remote-code-execution-rce-vulnerability?_s_id=cve
CVE: CVE-2025-68951
Published: 2025-12-29
Description: phpMyFAQ is an open source FAQ web application. Versions 4.0.14 and 4.0.15 have a stored cross-site scripting (XSS) vulnerability that allows an attacker to execute arbitrary JavaScript in an administrator’s browser by registering a user whose display name contains HTML entities. When an administrator views the admin user list, the payload is decoded server-side and rendered without escaping, resulting in script execution in the admin context. Version 4.0.16 contains a patch for the issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/thorsten/phpMyFAQ/commit/61829e83411f7b28bc6fd1052bfde54c32c6c370; https://github.com/thorsten/phpMyFAQ/commit/8211d1d25951b4c272443cfc3ef9c09b1363fd87; https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-jv8r-hv7q-p6vc
CVE: CVE-2025-69200
Published: 2025-12-29
Description: phpMyFAQ is an open source FAQ web application. In versions prior to 4.0.16, an unauthenticated remote attacker can trigger generation of a configuration backup ZIP via `POST /api/setup/backup` and then download the generated ZIP from a web-accessible location. The ZIP contains sensitive configuration files (e.g., `database.php` with database credentials), leading to high-impact information disclosure and potential follow-on compromise. Version 4.0.16 fixes the issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-202
References: https://github.com/thorsten/phpMyFAQ/commit/b0e99ee[PII_REDACTED]841cb546d8dce64ceb8c29a; https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-9cg9-4h4f-j6fg
CVE: CVE-2025-69201
Published: 2025-12-29
Description: Tugtainer is a self-hosted app for automating updates of docker containers. In versions prior to 1.15.1, arbitary arguments can be injected in tugtainer-agent `POST api/command/run`. Version 1.15.1 fixes the issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/Quenary/tugtainer/commit/dbb17d843e30fd7509acf0328c913dcb42f40831; https://github.com/Quenary/tugtainer/pull/88; https://github.com/Quenary/tugtainer/releases/tag/v1.15.1
CVE: CVE-2025-69206
Published: 2025-12-29
Description: Hemmelig is a messing app with with client-side encryption and self-destructing messages. Prior to version 7.3.3, a Server-Side Request Forgery (SSRF) filter bypass vulnerability exists in the webhook URL validation of the Secret Requests feature. The application attempts to block internal/private IP addresses but can be bypassed using DNS rebinding or open redirect services. This allows an authenticated user to make the server initiate HTTP requests to internal network resources. Version 7.3.3 contains a patch for the issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-918
References: https://github.com/HemmeligOrg/Hemmelig.app/commit/6c909e571d0797ee3bbd2c72e4eb767b57378228; https://github.com/HemmeligOrg/Hemmelig.app/security/advisories/GHSA-vvxf-wj5w-6gj5; https://github.com/HemmeligOrg/Hemmelig.app/security/advisories/GHSA-vvxf-wj5w-6gj5
CVE: CVE-2025-69211
Published: 2025-12-29
Description: Nest is a framework for building scalable Node.js server-side applications. Versions prior to 11.1.11 have a Fastify URL encoding middleware bypass. A NestJS application is vulnerable if it uses `@nestjs/platform-fastify`; relies on `NestMiddleware` (via `MiddlewareConsumer`) for security checks (authentication, authorization, etc.), or through `app.use()`; and applies middleware to specific routes using string paths or controllers (e.g., `.forRoutes('admin')`). Exploitation can result in unauthenticated users accessing protected routes, restricted administrative endpoints becoming accessible to lower-privileged users, and/or middleware performing sanitization or validation being skipped. This issue is patched in `@nestjs/platform-fastify@11.1.11`.
CVSS Score: 7.4 (HIGH)
CWE: CWE-367
References: https://github.com/nestjs/nest/commit/c4cedda15a05aafec1e6045b36b0335ab850e771; https://github.com/nestjs/nest/security/advisories/GHSA-8wpr-639p-ccrj
CVE: CVE-2025-15196
Published: 2025-12-29
Description: A vulnerability was identified in code-projects Assessment Management 1.0. This affects an unknown part of the file login.php. Such manipulation of the argument userid leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/Limingqian123/CVE/issues/4; https://vuldb.com/?ctiid.338583
CVE: CVE-2025-15197
Published: 2025-12-29
Description: A security flaw has been discovered in code-projects/anirbandutta9 Content Management System and News-Buzz 1.0. This vulnerability affects unknown code of the file /admin/editposts.php. Performing manipulation of the argument image results in unrestricted upload. The attack may be initiated remotely. The exploit has been released to the public and may be exploited.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://github.com/Limingqian123/CVE/issues/7; https://vuldb.com/?ctiid.338584; https://vuldb.com/?id.338584
CVE: CVE-2025-53627
Published: 2025-12-29
Description: Meshtastic is an open source mesh networking solution. The Meshtastic firmware (starting from version 2.5) introduces asymmetric encryption (PKI) for direct messages, but when the `pki_encrypted` flag is missing, the firmware silently falls back to legacy AES-256-CTR channel encryption. This was an intentional decision to maintain backwards compatibility. However, the end-user applications, like Web app, iOS/Android app, and applications built on top of Meshtastic using the SDK, did not have a way to differentiate between end-to-end encrypted DMs and the legacy DMs. This creates a downgrade attack path where adversaries who know a shared channel key can craft and inject spoofed direct messages that are displayed as if they were PKC encrypted. Users are not given any feedback of whether a direct message was decrypted with PKI or with legacy symmetric encryption, undermining the expected security guarantees of the PKI rollout. Version 2.7.15 fixes this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1287
References: https://github.com/meshtastic/firmware/security/advisories/GHSA-377p-prwp-4hwf
CVE: CVE-2025-66861
Published: 2025-12-29
Description: An issue was discovered in function d_unqualified_name in file cp-demangle.c in BinUtils 2.26 allowing attackers to cause a denial of service via crafted PE file.
CVSS Score: 2.5 (LOW)
CWE: CWE-400
References: https://github.com/caozhzh/CRGF-Vul/blob/main/cxxfilt/crash1.md; https://github.com/caozhzh/CRGF-Vul/blob/main/cxxfilt/crash1.md
CVE: CVE-2025-66862
Published: 2025-12-29
Description: A buffer overflow vulnerability in function gnu_special in file cplus-dem.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-122
References: https://github.com/caozhzh/CRGF-Vul/blob/main/cxxfilt/crash3.md
CVE: CVE-2025-66863
Published: 2025-12-29
Description: An issue was discovered in function d_discriminator in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/caozhzh/CRGF-Vul/blob/main/cxxfilt/crash2.md
CVE: CVE-2025-66864
Published: 2025-12-29
Description: An issue was discovered in function d_print_comp_inner in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/caozhzh/CRGF-Vul/blob/main/cxxfilt/crash5.md; https://github.com/caozhzh/CRGF-Vul/blob/main/cxxfilt/crash5.md
CVE: CVE-2025-66865
Published: 2025-12-29
Description: An issue was discovered in function d_print_comp_inner in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121
References: https://github.com/caozhzh/CRGF-Vul/blob/main/cxxfilt/crash4.md
CVE: CVE-2025-66866
Published: 2025-12-29
Description: An issue was discovered in function d_abi_tags in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/caozhzh/CRGF-Vul/blob/main/cxxfilt/crash6.md; https://github.com/caozhzh/CRGF-Vul/blob/main/cxxfilt/crash6.md
CVE: CVE-2025-66869
Published: 2025-12-29
Description: Buffer overflow vulnerability in function strcat in asan_interceptors.cpp in libming 0.4.8.
CVSS Score: 7.5 (HIGH)
CWE: CWE-122
References: https://github.com/libming/libming/issues/366
CVE: CVE-2025-68868
Published: 2025-12-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codeaffairs Wp Text Slider Widget wp-text-slider-widget allows Stored XSS.This issue affects Wp Text Slider Widget: from n/a through <= 1.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-text-slider-widget/vulnerability/wordpress-wp-text-slider-widget-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-68870
Published: 2025-12-29
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in reDim GmbH CookieHint WP cookiehint-wp allows PHP Local File Inclusion.This issue affects CookieHint WP: from n/a through <= 1.0.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/cookiehint-wp/vulnerability/wordpress-cookiehint-wp-plugin-1-0-0-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-15198
Published: 2025-12-29
Description: A weakness has been identified in code-projects College Notes Uploading System 1.0. This issue affects some unknown processing of the file /login.php. Executing a manipulation of the argument User can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/Limingqian123/CVE/issues/10; https://vuldb.com/?ctiid.338585
CVE: CVE-2025-55060
Published: 2025-12-29
Description: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0
CVE: CVE-2025-55061
Published: 2025-12-29
Description: CWE-434 Unrestricted Upload of File with Dangerous Type
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0
CVE: CVE-2025-55062
Published: 2025-12-29
Description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0
CVE: CVE-2025-55063
Published: 2025-12-29
Description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0
CVE: CVE-2025-55064
Published: 2025-12-29
Description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0
CVE: CVE-2025-66877
Published: 2025-12-29
Description: Buffer overflow vulnerability in function dcputchar in decompile.c in libming 0.4.8.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121
References: https://github.com/libming/libming/issues/367
CVE: CVE-2025-68861
Published: 2025-12-29
Description: Missing Authorization vulnerability in pluginoptimizer Plugin Optimizer plugin-optimizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Plugin Optimizer: from n/a through <= 1.3.7.
CVSS Score: 7.1 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/plugin-optimizer/vulnerability/wordpress-plugin-optimizer-plugin-1-3-7-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-13592
Published: 2025-12-29
Description: The Advanced Ads plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.0.14 via the 'change-ad__content' shortcode parameter. This allows authenticated attackers with editor-level permissions or above, to execute code on the server.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://plugins.trac.wordpress.org/browser/advanced-ads/tags/2.0.14/includes/ads/class-ad-plain.php#L36; https://plugins.trac.wordpress.org/changeset/3427297/advanced-ads#file9; https://www.wordfence.com/threat-intel/vulnerabilities/id/f9e83561-aa71-4984-8a26-207e208d70e8?source=cve
CVE: CVE-2025-14280
Published: 2025-12-29
Description: The PixelYourSite plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.1.5 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed log files, when the "Meta API logs" setting is enabled (disabled by default). The vulnerability was partially patched in version 11.1.5 and fully patched in version 11.1.5.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/browser/pixelyoursite/tags/11.1.4.2/includes/logger/class-pys-logger.php#L118; https://plugins.trac.wordpress.org/changeset/3416113/pixelyoursite; https://plugins.trac.wordpress.org/changeset/3424175/pixelyoursite
CVE: CVE-2025-14728
Published: 2025-12-29
Description: Rapid7 Velociraptor versions before 0.75.6 contain a directory traversal issue on Linux servers that allows a rogue client to upload a file which is written outside the datastore directory. Velociraptor is normally only allowed to write in the datastore directory. The issue occurs due to insufficient sanitization of directory names which end with a ".", only encoding the final "." AS "%2E".


Although files can be written to incorrect locations, the containing directory must end with "%2E". This limits the impact of this vulnerability, and prevents it from overwriting critical files.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: https://docs.velociraptor.app/announcements/advisories/cve-2025-14728/
CVE: CVE-2025-15199
Published: 2025-12-29
Description: A security vulnerability has been detected in code-projects College Notes Uploading System 1.0. Impacted is an unknown function of the file /dashboard/userprofile.php. The manipulation of the argument image leads to unrestricted upload. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://code-projects.org/; https://github.com/jjjjj-zr/jjjjjzr18/issues/1; https://vuldb.com/?ctiid.338586
CVE: CVE-2025-15200
Published: 2025-12-29
Description: A vulnerability was detected in SohuTV CacheCloud up to 3.2.0. The affected element is the function getExceptionStatisticsByClient/getCommandStatisticsByClient/doIndex of the file src/main/java/com/sohu/cache/web/controller/AppClientDataShowController.java. The manipulation results in cross site scripting. The attack can be executed remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/sohutv/cachecloud/issues/372; https://github.com/sohutv/cachecloud/issues/382; https://vuldb.com/?ctiid.338587
CVE: CVE-2025-15201
Published: 2025-12-29
Description: A flaw has been found in SohuTV CacheCloud up to 3.2.0. The impacted element is the function redirectNoPower of the file src/main/java/com/sohu/cache/web/controller/WebResourceController.java. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/sohutv/cachecloud/issues/373; https://vuldb.com/?ctiid.338588; https://vuldb.com/?id.338588
CVE: CVE-2025-67254
Published: 2025-12-29
Description: NagiosXI 2026R1.0.1 build[PII_REDACTED] is vulnerable to Directory Traversal in /admin/coreconfigsnapshots.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/YongYe-Security/NagiosXI/tree/main; https://www.nagios.org/
CVE: CVE-2025-67255
Published: 2025-12-29
Description: In NagiosXI 2026R1.0.1 build[PII_REDACTED], Dashboard parameters lack proper filtering, allowing any authenticated user to exploit a SQL Injection vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/YongYe-Security/NagiosXI/tree/main; https://www.nagios.org/
CVE: CVE-2025-68431
Published: 2025-12-29
Description: libheif is an HEIF and AVIF file format decoder and encoder. Prior to version 1.21.0, a crafted HEIF that exercises the overlay image item path triggers a heap buffer over-read in `HeifPixelImage::overlay()`. The function computes a negative row length (likely from an unclipped overlay rectangle or invalid offsets), which then underflows when converted to `size_t` and is passed to `memcpy`, causing a very large read past the end of the source plane and a crash. Version 1.21.0 contains a patch. As a workaround, avoid decoding images using `iovl` overlay boxes.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-190
References: https://github.com/strukturag/libheif/commit/b8c12a7b70f46c9516711a988483bed377b78d46; https://github.com/strukturag/libheif/releases/tag/v1.21.0; https://github.com/strukturag/libheif/security/advisories/GHSA-j87x-4gmq-cqfq
CVE: CVE-2025-68706
Published: 2025-12-29
Description: A stack-based buffer overflow exists in the GoAhead-Webs HTTP daemon on KuWFi 4G LTE AC900 devices with firmware 1.0.13. The /goform/formMultiApnSetting handler uses sprintf() to copy the user-supplied pincode parameter into a fixed 132-byte stack buffer with no bounds checks. This allows an attacker to corrupt adjacent stack memory, crash the web server, and (under certain conditions) may enable arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://drive.proton.me/urls/HJCJYAC7JM#XtHcm3P7QaYk; https://github.com/actuator/cve/blob/main/Kuwfi/CVE-2025-68706.txt; https://github.com/actuator/cve/tree/main/Kuwfi