deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-14273
Published: 2025-12-22
Description: Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 with the Jira plugin enabled and Mattermost Jira plugin versions <=4.4.0 fail to enforce authentication and issue-key path restrictions in the Jira plugin, which allows an unauthenticated attacker who knows a valid user ID to issue authenticated GET and POST requests to the Jira server via crafted plugin payloads that spoof the user ID and inject arbitrary issue key paths. Mattermost Advisory ID: MMSA-2025-00555
CVSS Score: 7.2 (HIGH)
CWE: CWE-303
References: https://mattermost.com/security-updates
CVE: CVE-2025-14018
Published: 2025-12-22
Description: Unquoted Search Path or Element vulnerability in NetBT Consulting Services Inc. E-Fatura allows Leveraging/Manipulating Configuration File Search Paths, Redirect Access to Libraries.This issue affects e-Fatura: before 1.2.15.
CVSS Score: 7.3 (HIGH)
CWE: CWE-428
References: https://www.usom.gov.tr/bildirim/tr-25-0474
CVE: CVE-2025-26379
Published: 2025-12-22
Description: Use of a weak pseudo-random number generator, which may allow an attacker to read or inject encrypted PowerG packets.
CWE: CWE-338
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-350-02; https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories
CVE: CVE-2025-61740
Published: 2025-12-22
Description: Authentication issue that does not verify the source of a packet which could allow an attacker to create a denial-of-service condition or modify the configuration of the device.
CWE: CWE-346
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-350-02; https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories
CVE: CVE-2025-67826
Published: 2025-12-22
Description: An issue was discovered in K7 Ultimate Security 17.0.2045. A Local Privilege Escalation (LPE) vulnerability in the K7 Ultimate Security antivirus can be exploited by a local unprivileged user on default installations of the product. Insecure access to a named pipe allows unprivileged users to edit any registry key, leading to a full compromise as SYSTEM.
CVSS Score: 7.7 (HIGH)
CWE: CWE-269
References: https://support.k7computing.com/index.php?/selfhelp/view-article/Advisory-issued-on-22nd-Dec-2025; https://www.k7computing.com/
CVE: CVE-2025-10021
Published: 2025-12-22
Description: A Use of Uninitialized Variable vulnerability exists in Open Design Alliance Drawings SDK static versions (mt) before 2026.12. Static object `COdaMfcAppApp theApp` may access `OdString::kEmpty` before its initialization. Due to undefined initialization order of static objects across translation units (Static Initialization Order Fiasco), the application accesses uninitialized memory. This results in application crash on startup, causing denial of service. Due to undefined behavior,  memory corruption and potential arbitrary code execution cannot be ruled out in specific exploitation scenarios.
CWE: CWE-457
References: https://www.opendesign.com/security-advisories
CVE: CVE-2025-67443
Published: 2025-12-22
Description: Schlix CMS before v2.2.9-5 is vulnerable to Cross Site Scripting (XSS). Due to lack of javascript sanitization in the login form, incorrect login attempts in logs are triggered as XSS in the admin panel.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/akinerkisa/b22f4517a4011d049c5fc7fd3b29c9f2; https://www.schlix.com/news/release/december-2025-errata-5-bug-fix-release.html#:~:text=Fixed%20XSS%20vulnerability%20bug%20when%20clicking%20New%20User%20%28thank%20you%20to%20Ak%C4%B1ner%20K%C4%B1sa%20who%20reported%20this%20security%20bug%20and%20provided%20reasonable%20time%20to%20fix%29
CVE: CVE-2025-68326
Published: 2025-12-22
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/xe/guc: Fix stack_depot usage

Add missing stack_depot_init() call when CONFIG_DRM_XE_DEBUG_GUC is
enabled to fix the following call stack:

	[] BUG: kernel NULL pointer dereference, address: [PII_REDACTED]
	[] Workqueue:  drm_sched_run_job_work [gpu_sched]
	[] RIP: 0010:stack_depot_save_flags+0x172/0x870
	[] Call Trace:
	[]  <TASK>
	[]  fast_req_track+0x58/0xb0 [xe]

(cherry picked from commit 64fdf496a6929a0a194387d2bb5efaf5da2b542f)
References: https://git.kernel.org/stable/c/0e234632e39bd21dd28ffc9ba3ae8eec4deb949c; https://git.kernel.org/stable/c/1966838d1c82149cbf4a652322d26a6e5aae9c4e
CVE: CVE-2025-68328
Published: 2025-12-22
Description: In the Linux kernel, the following vulnerability has been resolved:

firmware: stratix10-svc: fix bug in saving controller data

Fix the incorrect usage of platform_set_drvdata and dev_set_drvdata. They
both are of the same data and overrides each other. This resulted in the
rmmod of the svc driver to fail and throw a kernel panic for kthread_stop
and fifo free.
References: https://git.kernel.org/stable/c/354fb03002da0970d337f0d3edbeb46cc4fa6f41; https://git.kernel.org/stable/c/60ab1851614e[PII_REDACTED]b66da6e31d1cc26cb3; https://git.kernel.org/stable/c/71796c91ee8e33faf4434a9e210b5063c28ea907
CVE: CVE-2025-68329
Published: 2025-12-22
Description: In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAs

When a VMA is split (e.g., by partial munmap or MAP_FIXED), the kernel
calls vm_ops->close on each portion. For trace buffer mappings, this
results in ring_buffer_unmap() being called multiple times while
ring_buffer_map() was only called once.

This causes ring_buffer_unmap() to return -ENODEV on subsequent calls
because user_mapped is already 0, triggering a WARN_ON.

Trace buffer mappings cannot support partial mappings because the ring
buffer structure requires the complete buffer including the meta page.

Fix this by adding a may_split callback that returns -EINVAL to prevent
VMA splits entirely.
References: https://git.kernel.org/stable/c/45053c12c45f0fb8ef6ab95118dd928d2fec0255; https://git.kernel.org/stable/c/922fdd0b755a84f9933b3ca195f60092b6bb88ee; https://git.kernel.org/stable/c/b042fdf18e89a347177a49e795d8e5184778b5b6
CVE: CVE-2025-68330
Published: 2025-12-22
Description: In the Linux kernel, the following vulnerability has been resolved:

iio: accel: bmc150: Fix irq assumption regression

The code in bmc150-accel-core.c unconditionally calls
bmc150_accel_set_interrupt() in the iio_buffer_setup_ops,
such as on the runtime PM resume path giving a kernel
splat like this if the device has no interrupts:

Unable to handle kernel NULL pointer dereference at virtual
  address 00000001 when read

PC is at bmc150_accel_set_interrupt+0x98/0x194
LR is at __pm_runtime_resume+0x5c/0x64
(...)
Call trace:
bmc150_accel_set_interrupt from bmc150_accel_buffer_postenable+0x40/0x108
bmc150_accel_buffer_postenable from __iio_update_buffers+0xbe0/0xcbc
__iio_update_buffers from enable_store+0x84/0xc8
enable_store from kernfs_fop_write_iter+0x154/0x1b4

This bug seems to have been in the driver since the beginning,
but it only manifests recently, I do not know why.

Store the IRQ number in the state struct, as this is a common
pattern in other drivers, then use this to determine if we have
IRQ support or not.
References: https://git.kernel.org/stable/c/3aa385a9c75c09b59dcab2ff76423439d23673ab; https://git.kernel.org/stable/c/65ad4ed983fd9ee0259d86391d6a53f78203918c; https://git.kernel.org/stable/c/93eaa5ddc5fc4f50ac396afad8ce261102ebd4f3
CVE: CVE-2025-68331
Published: 2025-12-22
Description: In the Linux kernel, the following vulnerability has been resolved:

usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer

When a UAS device is unplugged during data transfer, there is
a probability of a system panic occurring. The root cause is
an access to an invalid memory address during URB callback handling.
Specifically, this happens when the dma_direct_unmap_sg() function
is called within the usb_hcd_unmap_urb_for_dma() interface, but the
sg->dma_address field is 0 and the sg data structure has already been
freed.

The SCSI driver sends transfer commands by invoking uas_queuecommand_lck()
in uas.c, using the uas_submit_urbs() function to submit requests to USB.
Within the uas_submit_urbs() implementation, three URBs (sense_urb,
data_urb, and cmd_urb) are sequentially submitted. Device removal may
occur at any point during uas_submit_urbs execution, which may result
in URB submission failure. However, some URBs might have been successfully
submitted before the failure, and uas_submit_urbs will return the -ENODEV
error code in this case. The current error handling directly calls
scsi_done(). In the SCSI driver, this eventually triggers scsi_complete()
to invoke scsi_end_request() for releasing the sgtable. The successfully
submitted URBs, when being unlinked to giveback, call
usb_hcd_unmap_urb_for_dma() in hcd.c, leading to exceptions during sg
unmapping operations since the sg data structure has already been freed.

This patch modifies the error condition check in the uas_submit_urbs()
function. When a UAS device is removed but one or more URBs have already
been successfully submitted to USB, it avoids immediately invoking
scsi_done() and save the cmnd to devinfo->cmnd array. If the successfully
submitted URBs is completed before devinfo->resetting being set, then
the scsi_done() function will be called within uas_try_complete() after
all pending URB operations are finalized. Otherwise, the scsi_done()
function will be called within uas_zap_pending(), which is executed after
usb_kill_anchored_urbs().

The error handling only takes effect when uas_queuecommand_lck() calls
uas_submit_urbs() and returns the error value -ENODEV . In this case,
the device is disconnected, and the flow proceeds to uas_disconnect(),
where uas_zap_pending() is invoked to call uas_try_complete().
References: https://git.kernel.org/stable/c/26d56a9fcb2014b99e654127960aa0a48a391e3c; https://git.kernel.org/stable/c/2b90a8131c83f6f2be69397d2b7d14d217d95d2f; https://git.kernel.org/stable/c/426edbfc88b22601ea34a441a469092e7b301c52
CVE: CVE-2025-68333
Published: 2025-12-22
Description: In the Linux kernel, the following vulnerability has been resolved:

sched_ext: Fix possible deadlock in the deferred_irq_workfn()

For PREEMPT_RT=y kernels, the deferred_irq_workfn() is executed in
the per-cpu irq_work/* task context and not disable-irq, if the rq
returned by container_of() is current CPU's rq, the following scenarios
may occur:

lock(&rq->__lock);
<Interrupt>
  lock(&rq->__lock);

This commit use IRQ_WORK_INIT_HARD() to replace init_irq_work() to
initialize rq->scx.deferred_irq_work, make the deferred_irq_workfn()
is always invoked in hard-irq context.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: https://git.kernel.org/stable/c/541959b2fadb832a7d0ceb95041dc52bdcf6bff7; https://git.kernel.org/stable/c/600b4379b9a7ba41340d652211fb29699da4c629; https://git.kernel.org/stable/c/a257e974210320ede524f340ffe16bf4bf0dda1e
CVE: CVE-2025-68334
Published: 2025-12-22
Description: In the Linux kernel, the following vulnerability has been resolved:

platform/x86/amd/pmc: Add support for Van Gogh SoC

The ROG Xbox Ally (non-X) SoC features a similar architecture to the
Steam Deck. While the Steam Deck supports S3 (s2idle causes a crash),
this support was dropped by the Xbox Ally which only S0ix suspend.

Since the handler is missing here, this causes the device to not suspend
and the AMD GPU driver to crash while trying to resume afterwards due to
a power hang.
References: https://git.kernel.org/stable/c/8af210df4f71dda74dc027da69372a028c6d4d84; https://git.kernel.org/stable/c/9654c56b111cd1415aca7e77f0c63c109453c409; https://git.kernel.org/stable/c/996092ba6df66e2ac8cf9022007a7c8a412e7733
CVE: CVE-2025-68335
Published: 2025-12-22
Description: In the Linux kernel, the following vulnerability has been resolved:

comedi: pcl818: fix null-ptr-deref in pcl818_ai_cancel()

Syzbot identified an issue [1] in pcl818_ai_cancel(), which stems from
the fact that in case of early device detach via pcl818_detach(),
subdevice dev->read_subdev may not have initialized its pointer to
&struct comedi_async as intended. Thus, any such dereferencing of
&s->async->cmd will lead to general protection fault and kernel crash.

Mitigate this problem by removing a call to pcl818_ai_cancel() from
pcl818_detach() altogether. This way, if the subdevice setups its
support for async commands, everything async-related will be
handled via subdevice's own ->cancel() function in
comedi_device_detach_locked() even before pcl818_detach(). If no
support for asynchronous commands is provided, there is no need
to cancel anything either.

[1] Syzbot crash:
Oops: general protection fault, probably for non-canonical address 0xdffffc[PII_REDACTED]: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x[PII_REDACTED]000028-0x[PII_REDACTED]00002f]
CPU: 1 UID: 0 PID: 6050 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
RIP: 0010:pcl818_ai_cancel+0x69/0x3f0 drivers/comedi/drivers/pcl818.c:762
...
Call Trace:
 <TASK>
 pcl818_detach+0x66/0xd0 drivers/comedi/drivers/pcl818.c:1115
 comedi_device_detach_locked+0x178/0x750 drivers/comedi/drivers.c:207
 do_devconfig_ioctl drivers/comedi/comedi_fops.c:848 [inline]
 comedi_unlocked_ioctl+0xcde/0x1020 drivers/comedi/comedi_fops.c:2178
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
...
References: https://git.kernel.org/stable/c/5caa40e7c6a43e08e3574f[PII_REDACTED]05c22861; https://git.kernel.org/stable/c/877adccfacb32687b90714a27cfb09f444fdfa16; https://git.kernel.org/stable/c/88d99ca5adbd01ff088f5fb2ddeba5755e085e52
CVE: CVE-2025-68336
Published: 2025-12-22
Description: In the Linux kernel, the following vulnerability has been resolved:

locking/spinlock/debug: Fix data-race in do_raw_write_lock

KCSAN reports:

BUG: KCSAN: data-race in do_raw_write_lock / do_raw_write_lock

write (marked) to 0xffff800009cf504c of 4 bytes by task 1102 on cpu 1:
 do_raw_write_lock+0x120/0x204
 _raw_write_lock_irq
 do_exit
 call_usermodehelper_exec_async
 ret_from_fork

read to 0xffff800009cf504c of 4 bytes by task 1103 on cpu 0:
 do_raw_write_lock+0x88/0x204
 _raw_write_lock_irq
 do_exit
 call_usermodehelper_exec_async
 ret_from_fork

value changed: 0xffffffff -> 0x00000001

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 1103 Comm: kworker/u4:1 6.1.111

Commit 1a365e822372 ("locking/spinlock/debug: Fix various data races") has
adressed most of these races, but seems to be not consistent/not complete.

>From do_raw_write_lock() only debug_write_lock_after() part has been
converted to WRITE_ONCE(), but not debug_write_lock_before() part.
Do it now.
References: https://git.kernel.org/stable/c/16b3590c0e1e615757dade098c8fbc0d4f040c76; https://git.kernel.org/stable/c/396a9270a7b90886be501611b13aa636f2e8c703; https://git.kernel.org/stable/c/39d2ef113416f1a4205b03fb0aa2e428d1412c77
CVE: CVE-2025-68337
Published: 2025-12-22
Description: In the Linux kernel, the following vulnerability has been resolved:

jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted

There's issue when file system corrupted:
------------[ cut here ]------------
kernel BUG at fs/jbd2/transaction.c:1289!
Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
CPU: 5 UID: 0 PID: 2031 Comm: mkdir Not tainted 6.18.0-rc1-next
RIP: 0010:jbd2_journal_get_create_access+0x3b6/0x4d0
RSP: 0018:ffff888117aafa30 EFLAGS: 00010202
RAX: [PII_REDACTED] RBX: ffff88811a86b000 RCX: ffffffff89a63534
RDX: 1ffff110200ec602 RSI: [PII_REDACTED] RDI: ffff[PII_REDACTED]10
RBP: ffff[PII_REDACTED]00 R08: [PII_REDACTED] R09: ffff[PII_REDACTED]28
R10: [PII_REDACTED] R11: [PII_REDACTED] R12: [PII_REDACTED]
R13: ffff88812c432000 R14: ffff88812c608000 R15: ffff888120bfc000
CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
CR2: 00007f91d6970c99 CR3:[PII_REDACTED]9c4000 CR4:[PII_REDACTED]0006f0
Call Trace:
 <TASK>
 __ext4_journal_get_create_access+0x42/0x170
 ext4_getblk+0x319/0x6f0
 ext4_bread+0x11/0x100
 ext4_append+0x1e6/0x4a0
 ext4_init_new_dir+0x145/0x1d0
 ext4_mkdir+0x326/0x920
 vfs_mkdir+0x45c/0x740
 do_mkdirat+0x234/0x2f0
 __x64_sys_mkdir+0xd6/0x120
 do_syscall_64+0x5f/0xfa0
 entry_SYSCALL_64_after_hwframe+0x76/0x7e

The above issue occurs with us in errors=continue mode when accompanied by
storage failures. There have been many inconsistencies in the file system
data.
In the case of file system data inconsistency, for example, if the block
bitmap of a referenced block is not set, it can lead to the situation where
a block being committed is allocated and used again. As a result, the
following condition will not be satisfied then trigger BUG_ON. Of course,
it is entirely possible to construct a problematic image that can trigger
this BUG_ON through specific operations. In fact, I have constructed such
an image and easily reproduced this issue.
Therefore, J_ASSERT() holds true only under ideal conditions, but it may
not necessarily be satisfied in exceptional scenarios. Using J_ASSERT()
directly in abnormal situations would cause the system to crash, which is
clearly not what we want. So here we directly trigger a JBD abort instead
of immediately invoking BUG_ON.
References: https://git.kernel.org/stable/c/3faac6531d4818cd6be45e5bbf32937bbbc795c0; https://git.kernel.org/stable/c/71bbe06c40fc59b5b15661eca8ff307f4176d7f9; https://git.kernel.org/stable/c/986835bf4d11032bba4ab8414d18fce038c61bb4
CVE: CVE-2025-65270
Published: 2025-12-22
Description: Reflected cross-site scripting (XSS) vulnerability in ClinCapture EDC 3.0 and 2.2.3, allowing an unauthenticated remote attacker to execute JavaScript code in the context of the victim's browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/xh4vm/CVE-2025-65270; https://www.clincapture.com/; https://github.com/xh4vm/CVE-2025-65270
CVE: CVE-2025-67289
Published: 2025-12-22
Description: An arbitrary file upload vulnerability in the Attachments module of Frappe Framework v15.89.0 allows attackers to execute arbitrary code via uploading a crafted XML file.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79, CWE-434
References: http://erpnext.com; http://frappe.com; https://github.com/vuquyen03/CVE/blob/main/CVE-2025-67289/README.md
CVE: CVE-2025-68645
Published: 2025-12-22
Description: A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper handling of user-supplied request parameters in the RestFilter servlet. An unauthenticated remote attacker can craft requests to the /h/rest endpoint to influence internal request dispatching, allowing inclusion of arbitrary files from the WebRoot directory.
CVSS Score: 8.8 (HIGH)
CWE: CWE-98
References: https://wiki.zimbra.com/wiki/Security_Center; https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-68645
CVE: CVE-2024-25814
Published: 2025-12-22
Description: MyNET up to v26.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the msg parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/am0nt31r0/Common-Vulnerabilities-and-Exposures-CVE-/blob/main/MyNet.md; https://www.airc.pt/solucoes-servicos/solucoes?segment=MYN; https://github.com/am0nt31r0/Common-Vulnerabilities-and-Exposures-CVE-/blob/main/MyNet.md
CVE: CVE-2024-35321
Published: 2025-12-22
Description: MyNET up to v26.08 was discovered to contain a Reflected cross-site scripting (XSS) vulnerability via the msgtipo parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/Manuel-arc/Common-Vulnerabilities-and-Exposures-CVE-/blob/main/MyNet.md; https://github.com/am0nt31r0/Common-Vulnerabilities-and-Exposures-CVE-/blob/main/MyNet.md; https://www.airc.pt/solucoes-servicos/solucoes?segment=MYN
CVE: CVE-2025-15033
Published: 2025-12-22
Description: A vulnerability in WooCommerce 8.1 to 10.4.2 can allow logged-in customers to access order data of guest customers on sites with a certain configuration. This has been fixed in WooCommerce 10.4.3, as well as all the previously affected versions through point releases, starting from 8.1, where it has been fixed in 8.1.3. It does not affect WooCommerce 8.0 or earlier.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://wpscan.com/vulnerability/f55fd7d3-7fbe-474f-9406-f47f8aee5e57/
CVE: CVE-2025-26787
Published: 2025-12-22
Description: An error in the SignServer container startup logic was found in Keyfactor SignServer versions prior to 7.2. The Admin CLI command used to configure Certificate access to the initial startup of the container sets a property of "allowany" to allow any user with a valid and trusted client auth certificate to connect. Admins can then set more restricted access to specific certificates. A logic error caused this admin CLI command to be run on each restart of the container instead of only the first startup as intended resetting the configuration to "allowany".
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-642
References: https://docs.keyfactor.com/signserver/latest/signserver-7-2-release-notes; https://support.keyfactor.com/hc/en-us/articles/[PII_REDACTED]6987-SignServer-security-advisory-Container-vulnerability-CVE-2025-26787-fixed-in-version-7-2
CVE: CVE-2025-63662
Published: 2025-12-22
Description: Insecure permissions in the /api/v1/agents API of GT Edge AI Platform before v2.0.10-dev allows unauthorized attackers to access sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://gist.github.com/p80n-sec/48ce34c929e8b946f0ad25f76e7b8cef; https://github.com/p80n-sec/Vulnerability-Research/blob/main/Pending
CVE: CVE-2025-63663
Published: 2025-12-22
Description: Incorrect access control in the /api/v1/conversations/*/files API of GT Edge AI Platform before v2.0.10 allows unauthorized attackers to access other users' uploaded files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://gist.github.com/p80n-sec/f3ca933480157cb4e18c387d92f4d0c2; https://github.com/p80n-sec/Vulnerability-Research/blob/main/Pending
CVE: CVE-2025-63664
Published: 2025-12-22
Description: Incorrect access control in the /api/v1/conversations/*/messages API of GT Edge AI Platform before v2.0.10-dev allows unauthorized attackers to access other users' message history with AI agents.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://gist.github.com/p80n-sec/0a0a71a2190d5e6f8083bf6069e7b5f2; https://github.com/p80n-sec/Vulnerability-Research/blob/main/Pending
CVE: CVE-2025-67288
Published: 2025-12-22
Description: An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code by uploading a crafted PDF file. NOTE: this is disputed by the Supplier because the responsibility for file validation (as shown in the documentation) belongs to the system administrator who is implementing Umbraco CMS in their environment, not to Umbraco CMS itself, a related issue to CVE-2023-49279.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: http://umbraco.com; https://github.com/vuquyen03/CVE/tree/main/CVE-2025-67288
CVE: CVE-2024-25812
Published: 2025-12-22
Description: MyNET up to v26.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the src parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/am0nt31r0/Common-Vulnerabilities-and-Exposures-CVE-/blob/main/MyNet.md; https://www.airc.pt/solucoes-servicos/solucoes?segment=MYN
CVE: CVE-2024-27708
Published: 2025-12-22
Description: Iframe injection vulnerability in airc.pt/solucoes-servicos.solucoes MyNET v.26.06 and before allows a remote attacker to execute arbitrary code via the src parameter.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-74, CWE-75
References: https://github.com/esquim0/Common_Vulnerabilities_and_Exposures_CVE/blob/main/2024/MyNet.md; https://www.airc.pt/solucoes-servicos/solucoes?segment=MYN