rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-29927 Authorization Bypass in Next.js Middleware
Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3.
Problem types: cwe_id: CWE-285
description: CWE-285: Improper Authorization
Affected products: vendor: vercel
product: next.js
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Published: 2025-03-21T14:34:49.570Z
CVE-2025-29928 authentik's deletion of sessions did not revoke sessions when using database session storage
authentik is an open-source identity provider. Prior to versions 2024.12.4 and 2025.2.3, when authentik was configured to use the database for session storage (which is a non-default setting), deleting sessions via the Web Interface or the API would not revoke the session and the session holder would continue to have access to authentik. authentik 2025.2.3 and 2024.12.4 fix this issue. Switching to the cache-based session storage until the authentik instance can be upgraded is recommended. This will however also delete all existing sessions and users will have to re-authenticate.
Problem types: cwe_id: CWE-384
description: CWE-384: Session Fixation
Affected products: vendor: goauthentik
product: authentik
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
version: 3.1
Published: 2025-03-28T14:42:39.542Z
CVE-2025-29929 Tuleap is missing CSRF protection on tracker hierarchy administration
Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap is missing CSRF protection on tracker hierarchy administration. An attacker could use this vulnerability to trick victims into submitting or editing artifacts or follow-up comments. This vulnerability is fixed in Tuleap Community Edition 16.5.99.1742306712 and Tuleap Enterprise Edition 16.5-5 and 16.4-8.
Problem types: cwe_id: CWE-352
description: CWE-352: Cross-Site Request Forgery (CSRF)
Affected products: vendor: Enalean
product: tuleap
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.6
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
version: 3.1
Published: 2025-03-31T15:40:58.925Z
CVE-2025-29930 imFAQ allows local file inclusion in seo.php
imFAQ is an advanced questions and answers management system for ImpressCMS. Prior to 1.0.1, if the $_GET['seoOp'] parameter is manipulated to include malicious input (e.g., seoOp=php://filter/read=convert.base64-encode/resource=/var/www/html/config.php), the application could allow an attacker to read sensitive files on the server (Local File Inclusion, LFI). The $_GET['seoOp'] and $_GET['seoArg'] parameters are directly used without sanitization or validation. This is partly mitigated by the fact that the ImpressCMS sensitive files are stored outside the web root, in a folder with a randomized name. The issue has been resolved in imFaq 1.0.1.
Problem types: cwe_id: CWE-73
description: CWE-73: External Control of File Name or Path
Affected products: vendor: ImpressModules
product: imfaq
Published: 2025-03-18T18:53:49.388Z
CVE-2025-29931 
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected product does not properly validate a length field in a serialized message which it uses to determine the amount of memory to be allocated for deserialization. This could allow an unauthenticated remote attacker to cause the application to allocate exhaustive amounts of memory and subsequently create a partial denial of service condition.
Successful exploitation is only possible in redundant Telecontrol Server Basic setups and only if the connection between the redundant servers has been disrupted.
Problem types: cwe_id: CWE-130
description: CWE-130: Improper Handling of Length Parameter Inconsistency
Affected products: vendor: Siemens
product: TeleControl Server Basic
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
baseScore: 3.7
baseSeverity: LOW
Published: 2025-04-17T11:05:57.612Z
CVE-2025-29932 
In JetBrains GoLand before 2025.1 an XXE during debugging was possible
Problem types: cwe_id: CWE-611
description: CWE-611
Affected products: vendor: JetBrains
product: GoLand
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 4.1
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
Published: 2025-03-25T12:44:20.869Z
CVE-2025-29933 
Improper input validation within AMD uProf can allow a local attacker to write out of bounds, potentially resulting in a crash or denial of service
Problem types: cwe_id: CWE-787
description: CWE-787  Out-of-bounds Write
Affected products: vendor: AMD
product: AMD μProf
default_status: affected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 5.5
baseSeverity: MEDIUM
Credits: lang: en
value: Reported through AMD Bug Bounty Program
Published: 2025-11-24T21:03:48.656Z
CVE-2025-29934 
A bug within some AMD CPUs could allow a local admin-privileged attacker to run a SEV-SNP guest using stale TLB entries, potentially resulting in loss of data integrity.
Problem types: cwe_id: CWE-459
description: CWE-459  Incomplete Cleanup
Affected products: vendor: AMD
product: AMD EPYC™ 9004 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ 9005 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ 8004 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 7003 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed "Genoa")
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 9005 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed "Bergamo")
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 8004 Series Processors
default_status: affected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N
version: 3.1
Published: 2025-11-21T18:45:16.849Z
CVE-2025-29935 
An out of bounds write within the AMD Platform Management Framework (PMF) could allow an attacker to execute arbitrary code at an elevated privilege level potentially leading to loss of confidentiality integrity, or availability.
Problem types: cwe_id: CWE-787
description: CWE-787  Out-of-bounds Write
Affected products: vendor: AMD
product: AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics (formerly codenamed "Rembrandt R")
default_status: affected
vendor: AMD
product: AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Phoenix")
default_status: affected
vendor: AMD
product: AMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Hawk Point")
default_status: affected
vendor: AMD
product: AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics (formerly codenamed "Rembrandt")
default_status: affected
vendor: AMD
product: AMD Ryzen™ Embedded R8000 Series Processors
default_status: affected
Credits: lang: en
value: Reported through AMD Bug Bounty Program
Published: 2026-05-15T01:53:42.356Z
CVE-2025-29936 
Improper input validation within the AMD Platform Management Framework (PMF) could allow an attacker to unmap arbitrary memory pages potentially impacting integrity and availability, or allowing privilege escalation resulting in loss of confidentiality.
Problem types: cwe_id: CWE-20
description: CWE-20  Improper Input Validation
Affected products: vendor: AMD
product: AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics (formerly codenamed "Rembrandt R")
default_status: affected
vendor: AMD
product: AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Phoenix")
default_status: affected
vendor: AMD
product: AMD Ryzen™ AI 300 Series Processors (formerly codenamed "Strix Point")
default_status: affected
vendor: AMD
product: AMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Hawk Point")
default_status: affected
vendor: AMD
product: AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics (formerly codenamed "Rembrandt")
default_status: affected
vendor: AMD
product: AMD Ryzen™ Al Max+
default_status: affected
vendor: AMD
product: AMD Ryzen™ Embedded 8000 Series Processors
default_status: affected
Credits: lang: en
value: Reported through AMD Bug Bounty Program
Published: 2026-05-15T01:52:13.641Z
CVE-2025-29937 
An out of bounds read within the AMD Platform Management Framework (PMF) could allow an attacker to trigger a read of an arbitrary memory location potentially resulting in loss of availability or confidentiality.
Problem types: cwe_id: CWE-125
description: CWE-125  Out-of-bounds Read
Affected products: vendor: AMD
product: AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics (formerly codenamed "Rembrandt R")
default_status: affected
vendor: AMD
product: AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Phoenix")
default_status: affected
vendor: AMD
product: AMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Hawk Point")
default_status: affected
vendor: AMD
product: AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics (formerly codenamed "Rembrandt")
default_status: affected
vendor: AMD
product: AMD Ryzen™ Embedded 8000 Series Processors
default_status: affected
Credits: lang: en
value: Reported through AMD Bug Bounty Program
Published: 2026-05-15T01:52:48.560Z
CVE-2025-29938 
An unchecked return value within the AMD Platform Management Framework (PMF) could allow an attacker to write to an arbitrary memory address resulting in denial of service or arbitrary code execution.
Problem types: cwe_id: CWE-252
description: CWE-252  Unchecked Return Value
Affected products: vendor: AMD
product: AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics (formerly codenamed "Rembrandt R")
default_status: affected
vendor: AMD
product: AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Phoenix")
default_status: affected
vendor: AMD
product: AMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Hawk Point")
default_status: affected
vendor: AMD
product: AMD Ryzen Embedded 8000 Series Processors
default_status: affected
Credits: lang: en
value: Reported through AMD Bug Bounty Program
Published: 2026-05-15T01:53:04.018Z
CVE-2025-29939 
Improper access control in secure encrypted virtualization (SEV) could allow a privileged attacker to write to the reverse map page (RMP) during secure nested paging (SNP) initialization, potentially resulting in a loss of guest memory confidentiality and integrity.
Problem types: cwe_id: CWE-284
description: CWE-284  Improper Access Control
Affected products: vendor: AMD
product: AMD EPYC™ 9004 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ 7003 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ 9005 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ 8004 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 7003 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed "Genoa")
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 9005 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed "Bergamo")
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 8004 Series Processors
default_status: affected
Published: 2026-02-10T19:11:59.059Z
CVE-2025-29943 
Write what were condition within AMD CPUs may allow an admin-privileged attacker to modify the configuration of the CPU pipeline potentially resulting in the corruption of the stack pointer inside an SEV-SNP guest.
Problem types: cwe_id: CWE-123
description: CWE-123  Write-what-where Condition
Affected products: vendor: AMD
product: AMD EPYC™ 9004 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ 9005 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ 8004 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 7003 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 9005 Series Processors
default_status: affected
Published: 2026-01-16T15:46:08.641Z
CVE-2025-29944 
A buffer overflow vulnerability within AMD Sensor Fusion Hub Driver can allow a local attacker to write out of bounds, potentially resulting in denial of service or crash
Problem types: cwe_id: CWE-120
description: CWE-120  Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: AMD
product: AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Renoir")
default_status: affected
vendor: AMD
product: AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics (formerly codenamed "Rembrandt R")
default_status: affected
vendor: AMD
product: AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Picasso")
default_status: affected
vendor: AMD
product: AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Phoenix")
default_status: affected
vendor: AMD
product: AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics (formerly codenamed "Mendocino")
default_status: affected
vendor: AMD
product: AMD Ryzen™ 7030 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Barcelo R")
default_status: affected
vendor: AMD
product: AMD Ryzen™ AI 300 Series Processors (formerly codenamed "Strix Point")
default_status: affected
vendor: AMD
product: AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Cezanne")
default_status: affected
vendor: AMD
product: AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Lucienne")
default_status: affected
vendor: AMD
product: AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Barcelo")
default_status: affected
vendor: AMD
product: AMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Hawk Point")
default_status: affected
vendor: AMD
product: AMD Ryzen™ 3000 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Dali")
default_status: affected
vendor: AMD
product: AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics (formerly codenamed "Rembrandt")
default_status: affected
vendor: AMD
product: AMD Ryzen™ AI Max 300 Series Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ Embedded 8000 Series Processors
default_status: affected
vendor: AMD
product: AMD RYZEN™ Embedded 7000 Series Processors
default_status: affected
Credits: lang: en
value: Reported through AMD Bug Bounty Program
Published: 2026-05-15T01:53:28.219Z
CVE-2025-29946 
Insufficient or Incomplete Data Removal in Hardware Component in SEV firmware doesn't fully flush IOMMU. This can potentially lead to a loss of confidentiality and integrity in guest memory.
Problem types: cwe_id: CWE-1301
description: CWE-1301  Insufficient or Incomplete Data Removal within Hardware Component
Affected products: vendor: AMD
product: AMD EPYC™ 9005 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 9005 Series Processors
default_status: affected
Published: 2026-02-10T19:15:57.179Z
CVE-2025-29948 
Improper access control in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to bypass RMP protections, potentially resulting in a loss of SEV-SNP guest memory integrity.
Problem types: cwe_id: CWE-1260
description: CWE-1260  Improper Handling of Overlap Between Protected Memory Ranges
Affected products: vendor: AMD
product: AMD EPYC™ 9005 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 9005 Series Processors
default_status: affected
Published: 2026-02-10T19:07:53.130Z
CVE-2025-29949 
Insufficient input parameter sanitization in AMD Secure Processor (ASP) Boot Loader (legacy recovery mode only) could allow an attacker to write out-of-bounds to corrupt Secure DRAM potentially resulting in denial of service.
Problem types: cwe_id: CWE-787
description: CWE-787  Out-of-bounds Write
Affected products: vendor: AMD
product: AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ 3000 Series Desktop Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ Threadripper™ PRO 3000WX Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ 7030 Series Mobile Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ Threadripper™ 3000 Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ Threadripper™ PRO 5000 WX-Series Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ 4000 Series Desktop Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ 5000 Series Desktop Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ 5000 Series Desktop Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ 3000 Series Desktop Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ 3000 Series Mobile Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ Embedded R1000 Series Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ Embedded R2000 Series Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ Embedded V1000 Series Processors (formerly codenamed "Raven Ridge")
default_status: affected
vendor: AMD
product: AMD Ryzen™ Embedded 8000 Series Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ Embedded V2000 Series Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ Embedded V3000 Series Processors
default_status: affected
Published: 2026-02-10T19:46:42.763Z
CVE-2025-29950 
Improper input validation in system management mode (SMM) could allow a privileged attacker to overwrite stack memory leading to arbitrary code execution.
Problem types: cwe_id: CWE-1274
description: CWE-1274  Improper Access Control for Volatile Memory Containing Boot Code
Affected products: vendor: AMD
product: AMD EPYC™ 9004 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ 7003 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ 7002 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ 7001 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ 9005 Series Processors
default_status: affected
vendor: AMD
product: AMD Instinct™ MI300A
default_status: affected
vendor: AMD
product: AMD EPYC™ 9V64H Processor
default_status: affected
vendor: AMD
product: AMD Ryzen™ Threadripper™ PRO 3000WX Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ Threadripper™ PRO 5000 WX-Series Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ Threadripper™ 7000 Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ Threadripper™ PRO 7000 WX-Series Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ Threadripper™ 9000 Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ Threadripper™ PRO 9000 WX-Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 7003 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed "Genoa")
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 7002 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 3000 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 9005 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed "Bergamo")
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 8004 Series Processors
default_status: affected
Credits: lang: en
value: Reported through AMD Bug Bounty Program
Published: 2026-02-10T19:10:28.112Z
CVE-2025-29951 
A buffer overflow in the AMD Secure Processor (ASP) bootloader could allow an attacker to overwrite memory, potentially resulting in privilege escalation and arbitrary code execution.
Problem types: cwe_id: CWE-121
description: CWE-121  Stack-based Buffer Overflow
Affected products: vendor: AMD
product: AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ Embedded R1000 Series Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ Embedded R2000 Series Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ Embedded V1000 Series Processors (formerly codenamed "Raven Ridge")
default_status: affected
Published: 2026-02-10T19:50:51.594Z
CVE-2025-29952 
Improper Initialization within the AMD Secure Encrypted Virtualization (SEV) firmware can allow an admin privileged attacker to corrupt RMP covered memory, potentially resulting in loss of guest memory integrity
Problem types: cwe_id: CWE-457
description: CWE-457  Use of Uninitialized Variable
Affected products: vendor: AMD
product: AMD EPYC™ 9005 Series Processors
default_status: affected
vendor: AMD
product: AMD EPYC™ Embedded 9005 Series Processors
default_status: affected
Published: 2026-02-10T19:09:37.854Z