deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-66082
Published: 2025-11-21
Description: Missing Authorization vulnerability in magepeopleteam WpEvently mage-eventpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpEvently: from n/a through <= 5.0.4.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/mage-eventpress/vulnerability/wordpress-wpevently-plugin-5-0-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-66083
Published: 2025-11-21
Description: Missing Authorization vulnerability in magepeopleteam WpEvently mage-eventpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpEvently: from n/a through <= 5.0.4.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/mage-eventpress/vulnerability/wordpress-wpevently-plugin-5-0-4-broken-access-control-vulnerability-2?_s_id=cve
CVE: CVE-2025-66084
Published: 2025-11-21
Description: Missing Authorization vulnerability in Shahjahan Jewel FluentCommunity fluent-community allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentCommunity: from n/a through <= 2.0.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/fluent-community/vulnerability/wordpress-fluentcommunity-plugin-2-0-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-66085
Published: 2025-11-21
Description: Missing Authorization vulnerability in tychesoftwares Arconix Shortcodes arconix-shortcodes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Arconix Shortcodes: from n/a through <= 2.1.18.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/arconix-shortcodes/vulnerability/wordpress-arconix-shortcodes-plugin-2-1-18-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-66086
Published: 2025-11-21
Description: Missing Authorization vulnerability in Cozy Vision SMS Alert Order Notifications sms-alert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMS Alert Order Notifications: from n/a through <= 3.8.8.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/sms-alert/vulnerability/wordpress-sms-alert-order-notifications-plugin-3-8-8-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-66087
Published: 2025-11-21
Description: Missing Authorization vulnerability in Property Hive PropertyHive propertyhive allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PropertyHive: from n/a through <= 2.1.12.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/propertyhive/vulnerability/wordpress-propertyhive-plugin-2-1-12-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-66089
Published: 2025-11-21
Description: Missing Authorization vulnerability in WebToffee Product Feed for WooCommerce webtoffee-product-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Feed for WooCommerce: from n/a through <= 2.3.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/webtoffee-product-feed/vulnerability/wordpress-product-feed-for-woocommerce-plugin-2-3-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-66090
Published: 2025-11-21
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Skill Bar skt-skill-bar allows DOM-Based XSS.This issue affects SKT Skill Bar: from n/a through <= 2.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/skt-skill-bar/vulnerability/wordpress-skt-skill-bar-plugin-2-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-66091
Published: 2025-11-21
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Design Stylish Cost Calculator stylish-cost-calculator allows DOM-Based XSS.This issue affects Stylish Cost Calculator: from n/a through <= 8.1.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/stylish-cost-calculator/vulnerability/wordpress-stylish-cost-calculator-plugin-8-1-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-66092
Published: 2025-11-21
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bqworks Accordion Slider accordion-slider allows Stored XSS.This issue affects Accordion Slider: from n/a through <= 1.9.13.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/accordion-slider/vulnerability/wordpress-accordion-slider-plugin-1-9-13-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-66093
Published: 2025-11-21
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hupe13 Extensions for Leaflet Map extensions-leaflet-map allows DOM-Based XSS.This issue affects Extensions for Leaflet Map: from n/a through <= 4.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/extensions-leaflet-map/vulnerability/wordpress-extensions-for-leaflet-map-plugin-4-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-66095
Published: 2025-11-21
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows SQL Injection.This issue affects KiviCare: from n/a through <= 3.6.13.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/kivicare-clinic-management-system/vulnerability/wordpress-kivicare-plugin-3-6-13-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-66096
Published: 2025-11-21
Description: Missing Authorization vulnerability in Imtiaz Rayhan Table Block by Tableberg tableberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Table Block by Tableberg: from n/a through <= 0.6.9.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/tableberg/vulnerability/wordpress-table-block-by-tableberg-plugin-0-6-9-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-66097
Published: 2025-11-21
Description: Cross-Site Request Forgery (CSRF) vulnerability in Igor Jerosimić I Order Terms i-order-terms allows Cross Site Request Forgery.This issue affects I Order Terms: from n/a through <= 1.5.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/i-order-terms/vulnerability/wordpress-i-order-terms-plugin-1-5-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-66098
Published: 2025-11-21
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Camille V Travelers' Map travelers-map allows Stored XSS.This issue affects Travelers' Map: from n/a through <= 2.3.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/travelers-map/vulnerability/wordpress-travelers-map-plugin-2-3-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-66099
Published: 2025-11-21
Description: Missing Authorization vulnerability in ThemeAtelier Chat Help chat-help allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Chat Help: from n/a through <= 3.1.3.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/chat-help/vulnerability/wordpress-chat-help-plugin-3-1-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-66101
Published: 2025-11-21
Description: Missing Authorization vulnerability in Sabuj Kundu CBX Bookmark & Favorite cbxwpbookmark allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CBX Bookmark & Favorite: from n/a through <= 2.0.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/cbxwpbookmark/vulnerability/wordpress-cbx-bookmark-favorite-plugin-2-0-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-66106
Published: 2025-11-21
Description: Missing Authorization vulnerability in Essential Plugin Featured Post Creative featured-post-creative allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Featured Post Creative: from n/a through <= 1.5.5.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/featured-post-creative/vulnerability/wordpress-featured-post-creative-plugin-1-5-5-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-66107
Published: 2025-11-21
Description: Missing Authorization vulnerability in Scott Paterson Subscriptions & Memberships for PayPal subscriptions-memberships-for-paypal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Subscriptions & Memberships for PayPal: from n/a through <= 1.1.7.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/subscriptions-memberships-for-paypal/vulnerability/wordpress-subscriptions-memberships-for-paypal-plugin-1-1-7-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-66108
Published: 2025-11-21
Description: Missing Authorization vulnerability in Merlot Digital (by TNC) TNC Toolbox: Web Performance tnc-toolbox allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TNC Toolbox: Web Performance: from n/a through <= 2.0.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/tnc-toolbox/vulnerability/wordpress-tnc-toolbox-web-performance-plugin-2-0-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-66109
Published: 2025-11-21
Description: Missing Authorization vulnerability in Octolize Shipping Plugins Cart Weight for WooCommerce woo-cart-weight allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cart Weight for WooCommerce: from n/a through <= 1.9.11.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/woo-cart-weight/vulnerability/wordpress-cart-weight-for-woocommerce-plugin-1-9-11-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-66110
Published: 2025-11-21
Description: Missing Authorization vulnerability in bPlugins Tiktok Feed b-tiktok-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tiktok Feed: from n/a through <= 1.0.23.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/b-tiktok-feed/vulnerability/wordpress-tiktok-feed-plugin-1-0-22-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-66111
Published: 2025-11-21
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nelio Software Nelio Popups nelio-popups allows Stored XSS.This issue affects Nelio Popups: from n/a through <= 1.3.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/nelio-popups/vulnerability/wordpress-nelio-popups-plugin-1-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-66112
Published: 2025-11-21
Description: Missing Authorization vulnerability in WebToffee Accessibility Toolkit by WebYes accessibility-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accessibility Toolkit by WebYes: from n/a through <= 2.0.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/accessibility-plus/vulnerability/wordpress-accessibility-toolkit-by-webyes-plugin-2-0-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-66113
Published: 2025-11-21
Description: Missing Authorization vulnerability in ThemeAtelier Better Chat Support for Messenger better-chat-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Chat Support for Messenger: from n/a through <= 1.2.18.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/better-chat-support/vulnerability/wordpress-better-chat-support-for-messenger-plugin-1-2-18-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-66114
Published: 2025-11-21
Description: Missing Authorization vulnerability in theme funda Show Variations as Single Products Woocommerce woo-show-single-variations-shop-category allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Show Variations as Single Products Woocommerce: from n/a through <= 2.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/woo-show-single-variations-shop-category/vulnerability/wordpress-show-variations-as-single-products-woocommerce-plugin-2-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-66115
Published: 2025-11-21
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in MatrixAddons Easy Invoice easy-invoice allows PHP Local File Inclusion.This issue affects Easy Invoice: from n/a through <= 2.1.4.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/easy-invoice/vulnerability/wordpress-easy-invoice-plugin-2-1-4-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-11127
Published: 2025-11-21
Description: The Mstoreapp Mobile App WordPress plugin through 2.08 and Mstoreapp Mobile Multivendor through 9.0.1 do not properly verify users identify when using an AJAX action, allowing unauthenticated users to retrieve a valid session for arbitrary users by knowing their email address.
CVSS Score: 9.8 (CRITICAL)
References: https://wpscan.com/vulnerability/6432bd1a-6e44-4a3f-890b-df2bd877d626/
CVE: CVE-2025-13357
Published: 2025-11-21
Description: Vault’s Terraform Provider incorrectly set the default deny_null_bind parameter for the LDAP auth method to false by default, potentially resulting in an insecure configuration. If the underlying LDAP server allowed anonymous or unauthenticated binds, this could result in authentication bypass. This vulnerability, CVE-2025-13357, is fixed in Vault Terraform Provider v5.5.0.
CVSS Score: 7.4 (HIGH)
CWE: CWE-1188
References: https://discuss.hashicorp.com/t/hcsec-2025-33-vault-terraform-provider-applied-incorrect-defaults-for-ldap-auth-method/76822
CVE: CVE-2025-13432
Published: 2025-11-21
Description: Terraform state versions can be created by a user with specific but insufficient permissions in a Terraform Enterprise workspace. This may allow for the alteration of infrastructure if a subsequent plan operation is approved by a user with approval permission or auto-applied. This vulnerability, CVE-2025-13432, is fixed in Terraform Enterprise version 1.1.1 and 1.0.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://discuss.hashicorp.com/t/hcsec-2025-34-terraform-enterprise-state-versions-can-be-created-by-users-without-sufficient-write-access/76821
CVE: CVE-2025-41115
Published: 2025-11-21
Description: SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management.

In Grafana versions 12.x where SCIM provisioning is enabled and configured, a vulnerability in user identity handling allows a malicious or compromised SCIM client to provision a user with a numeric externalId, which in turn could allow to override internal user IDs and lead to impersonation or privilege escalation.

This vulnerability applies only if all of the following conditions are met:
- `enableSCIM` feature flag set to true
- `user_sync_enabled` config option in the `[auth.scim]` block set to true
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-266
References: https://grafana.com/security/security-advisories/CVE-2025-41115
CVE: CVE-2025-12747
Published: 2025-11-21
Description: The Tainacan plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.0 via uploaded files marked as private being exposed in wp-content without adequate protection.  This makes it possible for unauthenticated attackers to extract potentially sensitive information from files that have been marked as private.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-552
References: https://github.com/tainacan/tainacan/blob/2491612ee9d5b14baa70862ba2308ee925de0938/src/classes/class-tainacan-private-files.php; https://github.com/tainacan/tainacan/compare/1.0.0...1.0.1; https://www.wordfence.com/threat-intel/vulnerabilities/id/c64869f0-a4dd-4135-8ed8-a6ff82a48e1f?source=cve
CVE: CVE-2025-12973
Published: 2025-11-21
Description: The S2B AI Assistant – ChatBot, ChatGPT, OpenAI, Content & Image Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the storeFile() function in all versions up to, and including, 1.7.8. This makes it possible for authenticated attackers, with Editor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://github.com/d0n601/CVE-2025-12973; https://plugins.trac.wordpress.org/browser/s2b-ai-assistant/trunk/lib/helpers/Utils.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3399267%40s2b-ai-assistant&new=3399267%40s2b-ai-assistant&sfp_email=&sfph_mail=
CVE: CVE-2025-13470
Published: 2025-11-21
Description: In RNP version 0.18.0 a refactoring regression causes the symmetric 
session key used for Public-Key Encrypted Session Key (PKESK) packets to
 be left uninitialized except for zeroing, resulting in it always being 
an all-zero byte array.

Any data encrypted using public-key encryption 
in this release can be decrypted trivially by supplying an all-zero 
session key, fully compromising confidentiality.

The vulnerability affects only public key encryption (PKESK packets).  Passphrase-based encryption (SKESK packets) is not affected.

Root cause: Vulnerable session key buffer used in PKESK packet generation.



The defect was introduced in commit `7bd9a8dc356aae756b40755be76d36205b6b161a` where initialization 
logic inside `encrypted_build_skesk()` only randomized the key for the 
SKESK path and omitted it for the PKESK path.
CVSS Score: 7.5 (HIGH)
CWE: CWE-330
References: https://access.redhat.com/security/cve/cve-2025-13402; https://aur.archlinux.org/packages/rnp; https://bugzilla.redhat.com/show_bug.cgi?id=2415863
CVE: CVE-2025-13132
Published: 2025-11-21
Description: This vulnerability allowed a site to enter fullscreen, after a user click, without a full-screen notification (toast) appearing. Without this notification, users could potentially be misled about what site they were on if a malicious site renders a fake UI (like a fake address bar.)
CVSS Score: 7.4 (HIGH)
CWE: CWE-1021
References: https://www.diabrowser.com/security/bulletins#CVE-2025-13132
CVE: CVE-2025-64483
Published: 2025-11-21
Description: Wazuh is a security detection, visibility, and compliance open source project. From version 4.9.0 to before 4.13.0, the Wazuh API – Agent Configuration in certain configurations allows authenticated users with read-only API roles to retrieve agent enrollment credentials through the /utils/configuration endpoint. These credentials can be used to register new agents within the same Wazuh tenant without requiring elevated permissions through the UI. This issue has been patched in version 4.13.0.
CWE: CWE-284
References: https://github.com/wazuh/wazuh-dashboard-plugins/commit/eac859f1ad0bf5eb8b0dbc7ea7eeef4bd22c3722; https://github.com/wazuh/wazuh-dashboard-plugins/security/advisories/GHSA-gwf3-8gm3-qrmj
CVE: CVE-2025-29934
Published: 2025-11-21
Description: A bug within some AMD CPUs could allow a local admin-privileged attacker to run a SEV-SNP guest using stale TLB entries, potentially resulting in loss of data integrity.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-459
References: https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3029.html
CVE: CVE-2025-30201
Published: 2025-11-21
Description: Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.13.0, a vulnerability in Wazuh Agent allows authenticated attackers to force NTLM authentication through malicious UNC paths in various agent configuration settings, potentially leading NTLM relay attacks that would result privilege escalation and remote code execution. This issue has been patched in version 4.13.0.
CVSS Score: 7.7 (HIGH)
CWE: CWE-73, CWE-294
References: https://github.com/wazuh/wazuh/commit/688972da589e5d40d2a81bcd738240303a3dc45a; https://github.com/wazuh/wazuh/pull/30060; https://github.com/wazuh/wazuh/security/advisories/GHSA-x697-jf34-gp5x
CVE: CVE-2025-48502
Published: 2025-11-21
Description: Improper input validation within AMD uprof can allow a local attacker to overwrite MSR registers, potentially resulting in crash or denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-1285
References: https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-9019.html
CVE: CVE-2025-54866
Published: 2025-11-21
Description: Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.3.0 to before 4.13.0, a missing ACL on "C:\Program Files (x86)\ossec-agent\authd.pass" exposes the password to all "Authenticated Users" on the local machine. This issue has been patched in version 4.13.0.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-276
References: https://github.com/wazuh/wazuh/commit/606f19e688944ebe5d28d72eb81ac36f8fffb143; https://github.com/wazuh/wazuh/pull/31187; https://github.com/wazuh/wazuh/releases/tag/v4.13.0
CVE: CVE-2025-62608
Published: 2025-11-21
Description: MLX is an array framework for machine learning on Apple silicon. Prior to version 0.29.4, there is a heap buffer overflow in mlx::core::load() when parsing malicious NumPy .npy files. Attacker-controlled file causes 13-byte out-of-bounds read, leading to crash or information disclosure. This issue has been patched in version 0.29.4.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-122
References: https://github.com/ml-explore/mlx/pull/1; https://github.com/ml-explore/mlx/pull/2; https://github.com/ml-explore/mlx/security/advisories/GHSA-w6vg-jg77-2qg6
CVE: CVE-2025-62609
Published: 2025-11-21
Description: MLX is an array framework for machine learning on Apple silicon. Prior to version 0.29.4, there is a segmentation fault in mlx::core::load_gguf() when loading malicious GGUF files. Untrusted pointer from external gguflib library is dereferenced without validation, causing application crash. This issue has been patched in version 0.29.4.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/ml-explore/mlx/security/advisories/GHSA-j842-xgm4-wf88
CVE: CVE-2025-62626
Published: 2025-11-21
Description: Improper handling of insufficient entropy in the AMD CPUs could allow a local attacker to influence the values returned by the RDSEED instruction, potentially resulting in the consumption of insufficiently random values.
CWE: CWE-333
References: https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-7055.html
CVE: CVE-2025-64169
Published: 2025-11-21
Description: Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 3.7.0 to before 4.12.0, fim_alert() implementation does not check whether oldsum->md5 is NULL or not before dereferencing it. A compromised agent can cause a crash of analysisd by sending a specially crafted message to the wazuh manager. This issue has been patched in version 4.12.0.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-252, CWE-476, CWE-476
References: https://github.com/wazuh/wazuh/security/advisories/GHSA-hc35-h924-8596