deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-31326
Published: 2025-09-06
Description: Use of an uninitialized variable in the ASP could allow an attacker to access leftover data from a trusted execution environment (TEE) driver, potentially leading to loss of confidentiality.
CVSS Score: 2.8 (LOW)
CWE: CWE-457
References: https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-4012.html; https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-5007.html; https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6018.html
CVE: CVE-2023-31330
Published: 2025-09-06
Description: An out-of-bounds read in the ASP could allow a privileged attacker with access to a malicious bootloader to potentially read sensitive memory resulting in loss of confidentiality.
CVSS Score: 2.5 (LOW)
CWE: CWE-125
References: https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-4012.html; https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-5007.html
CVE: CVE-2023-31351
Published: 2025-09-06
Description: Improper restriction of operations in the IOMMU could allow a malicious hypervisor to access guest private memory resulting in loss of integrity.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119
References: https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3014.html; https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-5007.html
CVE: CVE-2023-31365
Published: 2025-09-06
Description: An integer overflow in the SMU could allow a privileged attacker to potentially write memory beyond the end of the reserved dRAM area resulting in loss of integrity or availability.
CVSS Score: 3.9 (LOW)
CWE: CWE-190
References: https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6018.html
CVE: CVE-2024-21947
Published: 2025-09-06
Description: Improper input validation in the system management mode (SMM) could allow a privileged attacker to overwrite arbitrary memory potentially resulting in arbitrary code execution at the SMM level.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1220
References: https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-4012.html; https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-5007.html
CVE: CVE-2024-21970
Published: 2025-09-06
Description: Improper validation of an array index in the AND power Management Firmware could allow a privileged attacker to corrupt AGESA memory potentially leading to a loss of integrity.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-129
References: https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-4012.html; https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-5007.html
CVE: CVE-2024-36326
Published: 2025-09-06
Description: Missing authorization in AMD RomArmor could allow an attacker to bypass ROMArmor protections during system resume from a standby state, potentially resulting in a loss of confidentiality and integrity.
CVSS Score: 8.4 (HIGH)
CWE: CWE-862
References: https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-4012.html
CVE: CVE-2024-36331
Published: 2025-09-06
Description: Improper initialization of CPU cache memory could allow a privileged attacker with hypervisor access to overwrite SEV-SNP guest memory resulting in loss of data integrity.
CVSS Score: 3.2 (LOW)
CWE: CWE-665
References: https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3014.html; https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-5007.html; https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
CVE: CVE-2024-36342
Published: 2025-09-06
Description: Improper input validation in the GPU driver could allow an attacker to exploit a heap overflow potentially resulting in arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1285
References: https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-5007.html; https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6018.html
CVE: CVE-2024-36346
Published: 2025-09-06
Description: Improper input validation in AMD Power Management Firmware (PMFW) could allow a privileged attacker from Guest VM to send arbitrary input data potentially causing a GPU Reset condition.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-1284
References: https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6018.html
CVE: CVE-2024-36352
Published: 2025-09-06
Description: Improper input validation in the AMD Graphics Driver could allow an attacker to supply a specially crafted pointer, potentially leading to arbitrary writes or denial of service.
CVSS Score: 8.4 (HIGH)
CWE: CWE-822
References: https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-5007.html; https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6018.html
CVE: CVE-2024-36354
Published: 2025-09-06
Description: Improper input validation for DIMM serial presence detect (SPD) metadata could allow an attacker with physical access, ring0 access on a system with a non-compliant DIMM, or control over the Root of Trust for BIOS update, to bypass SMM isolation potentially resulting in arbitrary code execution at the SMM level.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1231
References: https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3014.html; https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-4012.html; https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-5007.html
CVE: CVE-2025-0009
Published: 2025-09-06
Description: A NULL pointer dereference in AMD Crash Defender could allow an attacker to write a NULL output to a log file potentially resulting in a system crash and loss of availability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6018.html
CVE: CVE-2025-0010
Published: 2025-09-06
Description: An out of bounds write in the Linux graphics driver could allow an attacker to overflow the buffer potentially resulting in loss of confidentiality, integrity, or availability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-787
References: https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6018.html
CVE: CVE-2025-0011
Published: 2025-09-06
Description: Improper removal of sensitive information before storage or transfer in AMD Crash Defender could allow an attacker to obtain kernel address information potentially resulting in loss of confidentiality.
CVSS Score: 3.3 (LOW)
CWE: CWE-212
References: https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6018.html
CVE: CVE-2025-0032
Published: 2025-09-06
Description: Improper cleanup in AMD CPU microcode patch loading could allow an attacker with local administrator privilege to load malicious CPU microcode, potentially resulting in loss of integrity of x86 instruction execution.
CVSS Score: 7.2 (HIGH)
CWE: CWE-459
References: https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3014.html; https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-4012.html; https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-5007.html
CVE: CVE-2025-0034
Published: 2025-09-06
Description: Insufficient parameter sanitization in TEE SOC Driver could allow an attacker to issue a malformed DRV_SOC_CMD_ID_SRIOV_SPATIAL_PART and cause read or write past the end of allocated arrays, potentially resulting in a loss of platform integrity or denial of service.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-787
References: https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6018.html
CVE: CVE-2025-58438
Published: 2025-09-06
Description: internetarchive is a Python and Command-Line Interface to Archive.org In versions 5.5.0 and below, there is a directory traversal (path traversal) vulnerability in the File.download() method of the internetarchive library. The file.download() method does not properly sanitize user-supplied filenames or validate the final download path. A maliciously crafted filename could contain path traversal sequences (e.g., ../../../../windows/system32/file.txt) or illegal characters that, when processed, would cause the file to be written outside of the intended target directory. An attacker could potentially overwrite critical system files or application configuration files, leading to a denial of service, privilege escalation, or remote code execution, depending on the context in which the library is used.  The vulnerability is particularly critical for users on Windows systems, but all operating systems are affected. This issue is fixed in version 5.5.1.
CWE: CWE-22
References: https://github.com/jjjake/internetarchive/commit/cba2d459e10a9489fb35caeba0b03e80f5f5d7c2; https://github.com/jjjake/internetarchive/releases/tag/v5.5.1; https://github.com/jjjake/internetarchive/security/advisories/GHSA-wx3r-v6h7-frjp
CVE: CVE-2025-58446
Published: 2025-09-06
Description: xgrammar is an open-source library for efficient, flexible, and portable structured generation. A grammar optimizer introduced in 0.1.23 processes large grammars (>100k characters) at very low rates, and can be used for DOS of model providers. This issue is fixed in version 0.1.24.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/mlc-ai/xgrammar/commit/ced69c3ad2f8f61b516cc278a342e7c644383e27; https://github.com/mlc-ai/xgrammar/security/advisories/GHSA-9q5r-wfvf-rr7f
CVE: CVE-2025-58443
Published: 2025-09-06
Description: FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Versions 1.5.10.1673 and below contain an authentication bypass vulnerability. It is possible for an attacker to perform an unauthenticated DB dump where they could pull a full SQL DB without credentials. A fix is expected to be released 9/15/2025. To address this vulnerability immediately, upgrade to the latest version of either the dev-branch or working-1.6 branch. This will patch the issue for users concerned about immediate exposure. See the FOG Project documentation for step-by-step upgrade instructions: https://docs.fogproject.org/en/latest/install-fog-server#choosing-a-fog-version.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287, CWE-306
References: https://github.com/FOGProject/fogproject/security/advisories/GHSA-mvwm-9m2h-87p9; https://github.com/FOGProject/fogproject/security/advisories/GHSA-mvwm-9m2h-87p9
CVE: CVE-2025-58445
Published: 2025-09-06
Description: Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. All versions of Atlantis publicly expose detailed version information through its /status endpoint. This information disclosure could allow attackers to identify and target known vulnerabilities associated with the specific versions, potentially compromising the service's security posture. This issue does not currently have a fix.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/runatlantis/atlantis/security/advisories/GHSA-xh7v-965r-23f7; https://github.com/runatlantis/atlantis/security/advisories/GHSA-xh7v-965r-23f7
CVE: CVE-2025-10062
Published: 2025-09-06
Description: A vulnerability was determined in itsourcecode Student Information Management System 1.0. This affects an unknown part of the file /admin/login.php. Executing manipulation of the argument uname can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/hjsjbsg/record-for-own/issues/3; https://itsourcecode.com/; https://vuldb.com/?ctiid.322985
CVE: CVE-2025-10063
Published: 2025-09-06
Description: A vulnerability was identified in itsourcecode POS Point of Sale System 1.0. This vulnerability affects unknown code of the file /inventory/main/vendors/datatables/unit_testing/templates/deferred_table.php. The manipulation of the argument scripts leads to cross site scripting. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/AlphabugX/CVE-Report/blob/main/CVE-007.md; https://itsourcecode.com/; https://vuldb.com/?ctiid.322986
CVE: CVE-2025-10064
Published: 2025-09-07
Description: A security flaw has been discovered in itsourcecode POS Point of Sale System 1.0. This issue affects some unknown processing of the file /inventory/main/vendors/datatables/unit_testing/templates/dom_data_two_headers.php. The manipulation of the argument scripts results in cross site scripting. The attack can be executed remotely. The exploit has been released to the public and may be exploited.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/AlphabugX/CVE-Report/blob/main/CVE-008.md; https://itsourcecode.com/; https://vuldb.com/?ctiid.322987
CVE: CVE-2025-10065
Published: 2025-09-07
Description: A weakness has been identified in itsourcecode POS Point of Sale System 1.0. Impacted is an unknown function of the file /inventory/main/vendors/datatables/unit_testing/templates/dom_data_th.php. This manipulation of the argument scripts causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/AlphabugX/CVE-Report/blob/main/CVE-009.md; https://itsourcecode.com/; https://vuldb.com/?ctiid.322988
CVE: CVE-2025-10066
Published: 2025-09-07
Description: A security vulnerability has been detected in itsourcecode POS Point of Sale System 1.0. The affected element is an unknown function of the file /inventory/main/vendors/datatables/unit_testing/templates/dymanic_table.php. Such manipulation of the argument scripts leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/AlphabugX/CVE-Report/blob/main/CVE-010.md; https://itsourcecode.com/; https://vuldb.com/?ctiid.322989
CVE: CVE-2025-36100
Published: 2025-09-07
Description: IBM MQ LTS 9.1.0.0 through 9.1.0.29, 9.2.0.0 through 9.2.0.36, 9.3.0.0 through 9.3.0.30 and 9.4.0.0 through 9.4.0.12 and IBM MQ CD 9.3.0.0 through 9.3.5.1 and 9.4.0.0 through 9.4.3.0  Java and JMS stores a password in client configuration files when trace is enabled which can be read by a local user.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-260
References: https://www.ibm.com/support/pages/node/7243544
CVE: CVE-2025-10067
Published: 2025-09-07
Description: A vulnerability was detected in itsourcecode POS Point of Sale System 1.0. The impacted element is an unknown function of the file /inventory/main/vendors/datatables/unit_testing/templates/empty_table.php. Performing manipulation of the argument scripts results in cross site scripting. It is possible to initiate the attack remotely. The exploit is now public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/AlphabugX/CVE-Report/blob/main/CVE-011.md; https://itsourcecode.com/; https://vuldb.com/?ctiid.322990
CVE: CVE-2025-10068
Published: 2025-09-07
Description: A flaw has been found in itsourcecode Online Discussion Forum 1.0. This affects an unknown function of the file /admin/admin_forum/add_views.php. Executing manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/JunGu-W/cve/issues/13; https://itsourcecode.com/; https://vuldb.com/?ctiid.322991
CVE: CVE-2025-39727
Published: 2025-09-07
Description: In the Linux kernel, the following vulnerability has been resolved:

mm: swap: fix potential buffer overflow in setup_clusters()

In setup_swap_map(), we only ensure badpages are in range (0, last_page]. 
As maxpages might be < last_page, setup_clusters() will encounter a buffer
overflow when a badpage is >= maxpages.

Only call inc_cluster_info_page() for badpage which is < maxpages to fix
the issue.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://git.kernel.org/stable/c/152c1339dc13ad46f1b136e8693de[PII_REDACTED]; https://git.kernel.org/stable/c/815c528b13f2bb9b3130c13bedeabf2351a68129; https://git.kernel.org/stable/c/91b370800b3f2b3dda244c0ab06719c4971190a5
CVE: CVE-2025-39729
Published: 2025-09-07
Description: In the Linux kernel, the following vulnerability has been resolved:

crypto: ccp - Fix dereferencing uninitialized error pointer

Fix below smatch warnings:
drivers/crypto/ccp/sev-dev.c:1312 __sev_platform_init_locked()
error: we previously assumed 'error' could be null
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-824
References: https://git.kernel.org/stable/c/0fa766726c091ff0ec7d26874f6e4724d23ecb0e; https://git.kernel.org/stable/c/841634e1fdc2bdf35ab851fc279fd3bedcdf5e93
CVE: CVE-2025-39730
Published: 2025-09-07
Description: In the Linux kernel, the following vulnerability has been resolved:

NFS: Fix filehandle bounds checking in nfs_fh_to_dentry()

The function needs to check the minimal filehandle length before it can
access the embedded filehandle.
CVSS Score: 7.8 (HIGH)
References: https://git.kernel.org/stable/c/12ad3def2e5e0b120e3d0cb6ce8b7b796819ad40; https://git.kernel.org/stable/c/2ad40b7992aa26bc631afc1a995b0e3ddc30de3f; https://git.kernel.org/stable/c/3570ef5c31314c13274c935a20b91768ab5bf412
CVE: CVE-2025-39731
Published: 2025-09-07
Description: In the Linux kernel, the following vulnerability has been resolved:

f2fs: vm_unmap_ram() may be called from an invalid context

When testing F2FS with xfstests using UFS backed virtual disks the
kernel complains sometimes that f2fs_release_decomp_mem() calls
vm_unmap_ram() from an invalid context. Example trace from
f2fs/007 test:

f2fs/007 5s ...  [12:59:38][    8.902525] run fstests f2fs/007
[   11.468026] BUG: sleeping function called from invalid context at mm/vmalloc.c:2978
[   11.471849] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 68, name: irq/22-ufshcd
[   11.475357] preempt_count: 1, expected: 0
[   11.476970] RCU nest depth: 0, expected: 0
[   11.478531] CPU: 0 UID: 0 PID: 68 Comm: irq/22-ufshcd Tainted: G        W           6.16.0-rc5-xfstests-ufs-g40f92e79b0aa #9 PREEMPT(none)
[   11.478535] Tainted: [W]=WARN
[   11.478536] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   11.478537] Call Trace:
[   11.478543]  <TASK>
[   11.478545]  dump_stack_lvl+0x4e/0x70
[   11.478554]  __might_resched.cold+0xaf/0xbe
[   11.478557]  vm_unmap_ram+0x21/0xb0
[   11.478560]  f2fs_release_decomp_mem+0x59/0x80
[   11.478563]  f2fs_free_dic+0x18/0x1a0
[   11.478565]  f2fs_finish_read_bio+0xd7/0x290
[   11.478570]  blk_update_request+0xec/0x3b0
[   11.478574]  ? sbitmap_queue_clear+0x3b/0x60
[   11.478576]  scsi_end_request+0x27/0x1a0
[   11.478582]  scsi_io_completion+0x40/0x300
[   11.478583]  ufshcd_mcq_poll_cqe_lock+0xa3/0xe0
[   11.478588]  ufshcd_sl_intr+0x194/0x1f0
[   11.478592]  ufshcd_threaded_intr+0x68/0xb0
[   11.478594]  ? __pfx_irq_thread_fn+0x10/0x10
[   11.478599]  irq_thread_fn+0x20/0x60
[   11.478602]  ? __pfx_irq_thread_fn+0x10/0x10
[   11.478603]  irq_thread+0xb9/0x180
[   11.478605]  ? __pfx_irq_thread_dtor+0x10/0x10
[   11.478607]  ? __pfx_irq_thread+0x10/0x10
[   11.478609]  kthread+0x10a/0x230
[   11.478614]  ? __pfx_kthread+0x10/0x10
[   11.478615]  ret_from_fork+0x7e/0xd0
[   11.478619]  ? __pfx_kthread+0x10/0x10
[   11.478621]  ret_from_fork_asm+0x1a/0x30
[   11.478623]  </TASK>

This patch modifies in_task() check inside f2fs_read_end_io() to also
check if interrupts are disabled. This ensures that pages are unmapped
asynchronously in an interrupt handler.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/08a7efc5b02a0620ae16aa9584060e980a69cb55; https://git.kernel.org/stable/c/0fe7976b62546f1e95eebfe9879925e9aa22b7a8; https://git.kernel.org/stable/c/1023836d1b9465593c8746f97d608da32958785f
CVE: CVE-2025-39732
Published: 2025-09-07
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask()

ath11k_mac_disable_peer_fixed_rate() is passed as the iterator to
ieee80211_iterate_stations_atomic(). Note in this case the iterator is
required to be atomic, however ath11k_mac_disable_peer_fixed_rate() does
not follow it as it might sleep. Consequently below warning is seen:

BUG: sleeping function called from invalid context at wmi.c:304
Call Trace:
 <TASK>
 dump_stack_lvl
 __might_resched.cold
 ath11k_wmi_cmd_send
 ath11k_wmi_set_peer_param
 ath11k_mac_disable_peer_fixed_rate
 ieee80211_iterate_stations_atomic
 ath11k_mac_op_set_bitrate_mask.cold

Change to ieee80211_iterate_stations_mtx() to fix this issue.

Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.30
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/65c12b104cb942d588a1a093acc4537fb3d3b129; https://git.kernel.org/stable/c/6bdef22d540258ca06f079f7b6ae100669a19b47; https://git.kernel.org/stable/c/7d4d0db0dc9424de2bdc0b45e919e[PII_REDACTED]f
CVE: CVE-2025-39733
Published: 2025-09-07
Description: In the Linux kernel, the following vulnerability has been resolved:

team: replace team lock with rtnl lock

syszbot reports various ordering issues for lower instance locks and
team lock. Switch to using rtnl lock for protecting team device,
similar to bonding. Based on the patch by Tetsuo Handa.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/53edc761c9911f597b6d701e846f6e84f15eaa6d; https://git.kernel.org/stable/c/556a4337ba3e9a70e1e3a428e8465c3ea3c4aa41; https://git.kernel.org/stable/c/bfb4fb77f9a8ce33ce357224569eae5564eec573
CVE: CVE-2025-39734
Published: 2025-09-07
Description: In the Linux kernel, the following vulnerability has been resolved:

Revert "fs/ntfs3: Replace inode_trylock with inode_lock"

This reverts commit 69505fe98f198ee813898cbcaf[PII_REDACTED]430b.

Initially, conditional lock acquisition was removed to fix an xfstest bug
that was observed during internal testing. The deadlock reported by syzbot
is resolved by reintroducing conditional acquisition. The xfstest bug no
longer occurs on kernel version 6.16-rc1 during internal testing. I
assume that changes in other modules may have contributed to this.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/1903a6c1f2818154f6bc87bceaaecafa92b6ac5c; https://git.kernel.org/stable/c/7ce6f83ca9d52c9245b7a017466fc4baa1241b0b; https://git.kernel.org/stable/c/a49f0abd8959048af18c6c690b065eb0d65b2d21
CVE: CVE-2025-48042
Published: 2025-09-07
Description: Incorrect Authorization vulnerability in ash-project ash allows Exploiting Incorrectly Configured Access Control Security Levels. This vulnerability is associated with program files lib/ash/actions/create/bulk.ex, lib/ash/actions/destroy/bulk.ex, lib/ash/actions/update/bulk.ex and program routines 'Elixir.Ash.Actions.Create.Bulk':run/5, 'Elixir.Ash.Actions.Destroy.Bulk':run/6, 'Elixir.Ash.Actions.Update.Bulk:run'/6.

This issue affects ash: from pkg:hex/ash before pkg:hex/ash@3.5.39, before 3.5.39, before 5d1b6a5d00771fd468a[PII_REDACTED]27b5218be9a.
CWE: CWE-863
References: https://cna.erlef.org/cves/CVE-2025-48042.html; https://github.com/ash-project/ash/commit/5d1b6a5d00771fd468a[PII_REDACTED]27b5218be9a; https://github.com/ash-project/ash/security/advisories/GHSA-jj4j-x5ww-cwh9
CVE: CVE-2025-10070
Published: 2025-09-07
Description: A flaw has been found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /enturmacao-em-lote/. This manipulation causes improper access controls. The attack is possible to be carried out remotely. The exploit has been published and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-266, CWE-284
References: https://github.com/marcelomulder/CVE/blob/main/i-educar/Broken%20Access%20Control%20Vulnerability%20%20in%20%60.enturmacao-em-lote.(ID)%60%20Endpoint.md; https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-10070.md; https://vuldb.com/?ctiid.323018