rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-62186 
Ankitects Anki before 25.02.5 allows a crafted shared deck on Windows to execute arbitrary commands when playing audio because of URL scheme mishandling.
Problem types: cwe_id: CWE-829
description: CWE-829 Inclusion of Functionality from Untrusted Control Sphere
Affected products: vendor: Ankitects
product: Anki
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.7
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Published: 2025-10-07T00:00:00.000Z
CVE-2025-62187 
In Ankitects Anki before 25.02.6, crafted sound file references could cause files to be written to arbitrary locations on Windows and Linux (media file pathnames are not necessarily relative to the media folder).
Problem types: cwe_id: CWE-23
description: CWE-23 Relative Path Traversal
Affected products: vendor: Ankitects
product: Anki
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 2.9
baseSeverity: LOW
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Published: 2025-10-07T00:00:00.000Z
CVE-2025-62188 Apache DolphinScheduler: Users can access sensitive information through the actuator endpoint.
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Apache DolphinScheduler.

This vulnerability may allow unauthorized actors to access sensitive information, including database credentials.


This issue affects Apache DolphinScheduler versions 3.1.*.


Users are recommended to upgrade to:







  *  version ≥ 3.2.0 if using 3.1.x






As a temporary workaround, users who cannot upgrade immediately may restrict the exposed management endpoints by setting the following environment variable:


```
MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE=health,metrics,prometheus
```

Alternatively, add the following configuration to the application.yaml file:


```
management:
   endpoints:
     web:
        exposure:
          include: health,metrics,prometheus
```

This issue has been reported as CVE-2023-48796:

 https://cveprocess.apache.org/cve5/CVE-2023-48796
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Apache Software Foundation
product: Apache DolphinScheduler
default_status: unaffected
Credits: lang: en
value: w aiyou
lang: en
value: 魏大创
Published: 2026-04-09T09:27:13.570Z
CVE-2025-62189 
LogStare Collector contains an incorrect authorization vulnerability in UserRegistration. If exploited, a non-administrative user may create a new user account by sending a crafted HTTP request.
Problem types: cwe_id: CWE-863
description: Incorrect authorization
Affected products: vendor: LogStare Inc.
product: LogStare Collector (for Windows)
vendor: LogStare Inc.
product: LogStare Collector (for Linux)
Published: 2025-11-21T06:17:56.472Z
CVE-2025-62190 CSRF Allows Call Initiation and Message Delivery
Mattermost versions 11.0.x <= 11.0.4, 10.12.x <= 10.12.2, 10.11.x <= 10.11.6 and Mattermost Calls versions <=1.10.0 fail to implement CSRF protection on the Calls widget page which allows an authenticated attacker to initiate calls and inject messages into channels or direct messages via a malicious webpage or crafted link
Problem types: cwe_id: CWE-352
description: CWE-352: Cross-Site Request Forgery (CSRF)
Affected products: vendor: Mattermost
product: Mattermost
default_status: unaffected
CVSS v3.1: attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
baseSeverity: MEDIUM
baseScore: 4.3
Credits: lang: en
value: DoyenSec
Published: 2025-12-17T12:07:37.516Z
CVE-2025-62192 
SQL Injection vulnerability exists in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession ZION prior to ver5.3.2. If exploited, information stored in the database may be obtained or altered by an authenticated user.
Problem types: cwe_id: CWE-89
description: Improper neutralization of special elements used in an SQL command ('SQL Injection')
Affected products: vendor: Japan Total System Co.,Ltd.
product: GroupSession Free edition
vendor: Japan Total System Co.,Ltd.
product: GroupSession byCloud
vendor: Japan Total System Co.,Ltd.
product: GroupSession ZION
Published: 2025-12-12T05:02:38.764Z
CVE-2025-62193 NOAA PMEL Live Access Server (LAS) PyFerret command injection
Sites running NOAA PMEL Live Access Server (LAS) are vulnerable to remote code execution via specially crafted requests that include PyFerret expressions. By leveraging a SPAWN command, a remote, unauthenticated attacker can execute arbitrary OS commands. Fixed in a version of 'gov.noaa.pmel.tmap.las.filter.RequestInputFilter.java'  from 2025-09-24.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: National Oceanic and Atmospheric Administration (NOAA)
product: Live Access Server (LAS)
default_status: unknown
CVSS v3.1: scope: UNCHANGED
version: 3.1
baseScore: 9.8
attackVector: NETWORK
baseSeverity: CRITICAL
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
integrityImpact: HIGH
userInteraction: NONE
attackComplexity: LOW
availabilityImpact: HIGH
privilegesRequired: NONE
confidentialityImpact: HIGH
Published: 2026-01-15T16:44:15.708Z
CVE-2025-62199 Microsoft Office Remote Code Execution Vulnerability
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Microsoft
product: Microsoft 365 Apps for Enterprise
vendor: Microsoft
product: Microsoft Office 2016
vendor: Microsoft
product: Microsoft Office for Android
vendor: Microsoft
product: Microsoft Office LTSC 2021
vendor: Microsoft
product: Microsoft Office LTSC 2024
vendor: Microsoft
product: Microsoft Office LTSC for Mac 2021
vendor: Microsoft
product: Microsoft Office LTSC for Mac 2024
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2025-11-11T17:59:27.802Z
CVE-2025-62200 Microsoft Excel Remote Code Execution Vulnerability
Problem types: cwe_id: CWE-822
description: CWE-822: Untrusted Pointer Dereference
Affected products: vendor: Microsoft
product: Microsoft 365 Apps for Enterprise
vendor: Microsoft
product: Microsoft Excel 2016
vendor: Microsoft
product: Microsoft Office 2019
vendor: Microsoft
product: Microsoft Office LTSC 2021
vendor: Microsoft
product: Microsoft Office LTSC 2024
vendor: Microsoft
product: Office Online Server
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2025-11-11T17:59:41.808Z
CVE-2025-62201 Microsoft Excel Remote Code Execution Vulnerability
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: Microsoft
product: Microsoft 365 Apps for Enterprise
vendor: Microsoft
product: Microsoft Excel 2016
vendor: Microsoft
product: Microsoft Office 2019
vendor: Microsoft
product: Microsoft Office LTSC 2021
vendor: Microsoft
product: Microsoft Office LTSC 2024
vendor: Microsoft
product: Microsoft Office LTSC for Mac 2021
vendor: Microsoft
product: Microsoft Office LTSC for Mac 2024
vendor: Microsoft
product: Office Online Server
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2025-11-11T17:59:42.387Z
CVE-2025-62202 Microsoft Excel Information Disclosure Vulnerability
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Microsoft
product: Microsoft 365 Apps for Enterprise
vendor: Microsoft
product: Microsoft Excel 2016
vendor: Microsoft
product: Microsoft Office 2019
vendor: Microsoft
product: Microsoft Office LTSC 2021
vendor: Microsoft
product: Microsoft Office LTSC 2024
vendor: Microsoft
product: Microsoft Office LTSC for Mac 2021
vendor: Microsoft
product: Microsoft Office LTSC for Mac 2024
vendor: Microsoft
product: Office Online Server
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H/E:U/RL:O/RC:C
Published: 2025-11-11T17:59:42.941Z
CVE-2025-62203 Microsoft Excel Remote Code Execution Vulnerability
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Microsoft
product: Microsoft 365 Apps for Enterprise
vendor: Microsoft
product: Microsoft Excel 2016
vendor: Microsoft
product: Microsoft Office 2019
vendor: Microsoft
product: Microsoft Office LTSC 2021
vendor: Microsoft
product: Microsoft Office LTSC 2024
vendor: Microsoft
product: Microsoft Office LTSC for Mac 2021
vendor: Microsoft
product: Microsoft Office LTSC for Mac 2024
vendor: Microsoft
product: Office Online Server
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2025-11-11T17:59:43.546Z
CVE-2025-62204 Microsoft SharePoint Remote Code Execution Vulnerability
Problem types: cwe_id: CWE-502
description: CWE-502: Deserialization of Untrusted Data
Affected products: vendor: Microsoft
product: Microsoft SharePoint Enterprise Server 2016
vendor: Microsoft
product: Microsoft SharePoint Server 2019
vendor: Microsoft
product: Microsoft SharePoint Server Subscription Edition
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2025-11-11T17:59:44.205Z
CVE-2025-62205 Microsoft Office Remote Code Execution Vulnerability
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Microsoft
product: Microsoft 365 Apps for Enterprise
vendor: Microsoft
product: Microsoft Office LTSC 2021
vendor: Microsoft
product: Microsoft Office LTSC 2024
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2025-11-11T17:59:44.771Z
CVE-2025-62206 Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability
Problem types: cwe_id: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Microsoft
product: Microsoft Dynamics 365 (on-premises) version 9.1
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
Published: 2025-11-11T17:59:28.307Z
CVE-2025-62207 Azure Monitor Elevation of Privilege Vulnerability
Problem types: cwe_id: CWE-918
description: CWE-918: Server-Side Request Forgery (SSRF)
Affected products: vendor: Microsoft
product: Azure Monitor Control Service
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 8.6
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C
Published: 2025-11-20T22:18:38.189Z
CVE-2025-62208 Windows License Manager Information Disclosure Vulnerability
Problem types: cwe_id: CWE-532
description: CWE-532: Insertion of Sensitive Information into Log File
Affected products: vendor: Microsoft
product: Windows 10 Version 1507
vendor: Microsoft
product: Windows 10 Version 1607
vendor: Microsoft
product: Windows 10 Version 1809
vendor: Microsoft
product: Windows 10 Version 21H2
vendor: Microsoft
product: Windows 10 Version 22H2
vendor: Microsoft
product: Windows 11 version 22H2
vendor: Microsoft
product: Windows 11 version 22H3
vendor: Microsoft
product: Windows 11 Version 23H2
vendor: Microsoft
product: Windows 11 Version 24H2
vendor: Microsoft
product: Windows 11 Version 25H2
vendor: Microsoft
product: Windows Server 2016
vendor: Microsoft
product: Windows Server 2016 (Server Core installation)
vendor: Microsoft
product: Windows Server 2019
vendor: Microsoft
product: Windows Server 2019 (Server Core installation)
vendor: Microsoft
product: Windows Server 2022
vendor: Microsoft
product: Windows Server 2022, 23H2 Edition (Server Core installation)
vendor: Microsoft
product: Windows Server 2025
vendor: Microsoft
product: Windows Server 2025 (Server Core installation)
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
Published: 2025-11-11T17:59:45.339Z
CVE-2025-62209 Windows License Manager Information Disclosure Vulnerability
Problem types: cwe_id: CWE-532
description: CWE-532: Insertion of Sensitive Information into Log File
Affected products: vendor: Microsoft
product: Windows 10 Version 1507
vendor: Microsoft
product: Windows 10 Version 1607
vendor: Microsoft
product: Windows 10 Version 1809
vendor: Microsoft
product: Windows 10 Version 21H2
vendor: Microsoft
product: Windows 10 Version 22H2
vendor: Microsoft
product: Windows 11 version 22H2
vendor: Microsoft
product: Windows 11 version 22H3
vendor: Microsoft
product: Windows 11 Version 23H2
vendor: Microsoft
product: Windows 11 Version 24H2
vendor: Microsoft
product: Windows 11 Version 25H2
vendor: Microsoft
product: Windows Server 2016
vendor: Microsoft
product: Windows Server 2016 (Server Core installation)
vendor: Microsoft
product: Windows Server 2019
vendor: Microsoft
product: Windows Server 2019 (Server Core installation)
vendor: Microsoft
product: Windows Server 2022
vendor: Microsoft
product: Windows Server 2022, 23H2 Edition (Server Core installation)
vendor: Microsoft
product: Windows Server 2025
vendor: Microsoft
product: Windows Server 2025 (Server Core installation)
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
Published: 2025-11-11T17:59:45.904Z
CVE-2025-62210 Dynamics 365 Field Service (online) Spoofing Vulnerability
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Microsoft
product: Dynamics 365 Field Service (online)
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 8.7
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C
Published: 2025-11-11T17:59:28.905Z
CVE-2025-62211 Dynamics 365 Field Service (online) Spoofing Vulnerability
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Microsoft
product: Dynamics 365 Field Service (online)
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 8.7
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C
Published: 2025-11-11T17:59:46.977Z
CVE-2025-62213 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Microsoft
product: Windows 10 Version 1607
vendor: Microsoft
product: Windows 10 Version 1809
vendor: Microsoft
product: Windows 10 Version 21H2
vendor: Microsoft
product: Windows 10 Version 22H2
vendor: Microsoft
product: Windows 11 version 22H3
vendor: Microsoft
product: Windows 11 Version 23H2
vendor: Microsoft
product: Windows 11 Version 24H2
vendor: Microsoft
product: Windows 11 Version 25H2
vendor: Microsoft
product: Windows Server 2008 R2 Service Pack 1
vendor: Microsoft
product: Windows Server 2008 R2 Service Pack 1 (Server Core installation)
vendor: Microsoft
product: Windows Server 2008 Service Pack 2
vendor: Microsoft
product: Windows Server 2008 Service Pack 2 (Server Core installation)
vendor: Microsoft
product: Windows Server 2012
vendor: Microsoft
product: Windows Server 2012 (Server Core installation)
vendor: Microsoft
product: Windows Server 2012 R2
vendor: Microsoft
product: Windows Server 2012 R2 (Server Core installation)
vendor: Microsoft
product: Windows Server 2016
vendor: Microsoft
product: Windows Server 2016 (Server Core installation)
vendor: Microsoft
product: Windows Server 2019
vendor: Microsoft
product: Windows Server 2019 (Server Core installation)
vendor: Microsoft
product: Windows Server 2022
vendor: Microsoft
product: Windows Server 2022, 23H2 Edition (Server Core installation)
vendor: Microsoft
product: Windows Server 2025
vendor: Microsoft
product: Windows Server 2025 (Server Core installation)
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2025-11-11T17:59:48.693Z
CVE-2025-62214 Visual Studio Remote Code Execution Vulnerability
Problem types: cwe_id: CWE-77
description: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected products: vendor: Microsoft
product: Microsoft Visual Studio 2022 version 17.14
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 6.7
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2025-11-11T17:59:47.547Z
CVE-2025-62215 Windows Kernel Elevation of Privilege Vulnerability
Problem types: cwe_id: CWE-362
description: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
cwe_id: CWE-415
description: CWE-415: Double Free
Affected products: vendor: Microsoft
product: Windows 10 Version 1809
vendor: Microsoft
product: Windows 10 Version 21H2
vendor: Microsoft
product: Windows 10 Version 22H2
vendor: Microsoft
product: Windows 11 version 22H3
vendor: Microsoft
product: Windows 11 Version 23H2
vendor: Microsoft
product: Windows 11 Version 24H2
vendor: Microsoft
product: Windows 11 Version 25H2
vendor: Microsoft
product: Windows Server 2019
vendor: Microsoft
product: Windows Server 2019 (Server Core installation)
vendor: Microsoft
product: Windows Server 2022
vendor: Microsoft
product: Windows Server 2022, 23H2 Edition (Server Core installation)
vendor: Microsoft
product: Windows Server 2025
vendor: Microsoft
product: Windows Server 2025 (Server Core installation)
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
Published: 2025-11-11T17:59:48.205Z
CVE-2025-62216 Microsoft Office Remote Code Execution Vulnerability
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Microsoft
product: Microsoft 365 Apps for Enterprise
vendor: Microsoft
product: Microsoft Office LTSC 2021
vendor: Microsoft
product: Microsoft Office LTSC 2024
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2025-11-11T17:59:29.420Z
CVE-2025-62217 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Problem types: cwe_id: CWE-362
description: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Affected products: vendor: Microsoft
product: Windows 10 Version 1607
vendor: Microsoft
product: Windows 10 Version 1809
vendor: Microsoft
product: Windows 10 Version 21H2
vendor: Microsoft
product: Windows 10 Version 22H2
vendor: Microsoft
product: Windows 11 version 22H3
vendor: Microsoft
product: Windows 11 Version 23H2
vendor: Microsoft
product: Windows 11 Version 24H2
vendor: Microsoft
product: Windows 11 Version 25H2
vendor: Microsoft
product: Windows Server 2008 R2 Service Pack 1
vendor: Microsoft
product: Windows Server 2008 R2 Service Pack 1 (Server Core installation)
vendor: Microsoft
product: Windows Server 2008 Service Pack 2
vendor: Microsoft
product: Windows Server 2008 Service Pack 2 (Server Core installation)
vendor: Microsoft
product: Windows Server 2012
vendor: Microsoft
product: Windows Server 2012 (Server Core installation)
vendor: Microsoft
product: Windows Server 2012 R2
vendor: Microsoft
product: Windows Server 2012 R2 (Server Core installation)
vendor: Microsoft
product: Windows Server 2016
vendor: Microsoft
product: Windows Server 2016 (Server Core installation)
vendor: Microsoft
product: Windows Server 2019
vendor: Microsoft
product: Windows Server 2019 (Server Core installation)
vendor: Microsoft
product: Windows Server 2022
vendor: Microsoft
product: Windows Server 2022, 23H2 Edition (Server Core installation)
vendor: Microsoft
product: Windows Server 2025
vendor: Microsoft
product: Windows Server 2025 (Server Core installation)
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2025-11-11T17:59:31.180Z
CVE-2025-62218 Microsoft Wireless Provisioning System Elevation of Privilege Vulnerability
Problem types: cwe_id: CWE-362
description: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Affected products: vendor: Microsoft
product: Windows 10 Version 1607
vendor: Microsoft
product: Windows 10 Version 1809
vendor: Microsoft
product: Windows 10 Version 21H2
vendor: Microsoft
product: Windows 10 Version 22H2
vendor: Microsoft
product: Windows 11 version 22H3
vendor: Microsoft
product: Windows 11 Version 23H2
vendor: Microsoft
product: Windows 11 Version 24H2
vendor: Microsoft
product: Windows 11 Version 25H2
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2025-11-11T17:59:31.687Z
CVE-2025-62219 Microsoft Wireless Provisioning System Elevation of Privilege Vulnerability
Problem types: cwe_id: CWE-415
description: CWE-415: Double Free
cwe_id: CWE-362
description: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Affected products: vendor: Microsoft
product: Windows 10 Version 1607
vendor: Microsoft
product: Windows 10 Version 1809
vendor: Microsoft
product: Windows 10 Version 21H2
vendor: Microsoft
product: Windows 10 Version 22H2
vendor: Microsoft
product: Windows 11 version 22H3
vendor: Microsoft
product: Windows 11 Version 23H2
vendor: Microsoft
product: Windows 11 Version 24H2
vendor: Microsoft
product: Windows 11 Version 25H2
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2025-11-11T17:59:32.270Z
CVE-2025-62220 Windows Subsystem for Linux GUI Remote Code Execution Vulnerability
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: Microsoft
product: Windows Subsystem for Linux GUI
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2025-11-11T17:59:32.750Z
CVE-2025-62221 Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Microsoft
product: Windows 10 Version 1809
vendor: Microsoft
product: Windows 10 Version 21H2
vendor: Microsoft
product: Windows 10 Version 22H2
vendor: Microsoft
product: Windows 11 version 22H3
vendor: Microsoft
product: Windows 11 Version 23H2
vendor: Microsoft
product: Windows 11 Version 24H2
vendor: Microsoft
product: Windows 11 Version 25H2
vendor: Microsoft
product: Windows Server 2019
vendor: Microsoft
product: Windows Server 2019 (Server Core installation)
vendor: Microsoft
product: Windows Server 2022
vendor: Microsoft
product: Windows Server 2022, 23H2 Edition (Server Core installation)
vendor: Microsoft
product: Windows Server 2025
vendor: Microsoft
product: Windows Server 2025 (Server Core installation)
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2025-12-09T17:56:10.169Z
CVE-2025-62222 Agentic AI and Visual Studio Code Remote Code Execution Vulnerability
Problem types: cwe_id: CWE-77
description: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: Microsoft
product: Microsoft Visual Studio Code CoPilot Chat Extension
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2025-11-11T17:59:49.273Z