stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2025-2127 (severity: MEDIUM, weakness: CWE-79)
A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0 on Joomla. It has been classified as problematic. Affected is an unknown function of the file /extensions/realestate/index.php/properties/list/list-with-sidebar/realties. The manipulation of the argument Itemid/jp_yearbuilt leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-21270 (severity: HIGH, weakness: CWE-400)
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
CVE-2025-21271 (severity: HIGH, weakness: CWE-126)
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
CVE-2025-21272 (severity: MEDIUM, weakness: CWE-908)
Windows COM Server Information Disclosure Vulnerability
CVE-2025-21273 (severity: HIGH, weakness: CWE-122)
Windows Telephony Service Remote Code Execution Vulnerability
CVE-2025-21274 (severity: MEDIUM, weakness: CWE-59)
Windows Event Tracing Denial of Service Vulnerability
CVE-2025-21275 (severity: HIGH, weakness: CWE-285)
Windows App Package Installer Elevation of Privilege Vulnerability
CVE-2025-21276 (severity: HIGH, weakness: CWE-191)
Windows MapUrlToZone Denial of Service Vulnerability
CVE-2025-21277 (severity: HIGH, weakness: CWE-126)
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
CVE-2025-21278 (severity: MEDIUM, weakness: CWE-362)
Windows Remote Desktop Gateway (RD Gateway) Denial of Service Vulnerability
CVE-2025-21279 (severity: HIGH, weakness: CWE-843)
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2025-2128 (severity: MEDIUM, weakness: CWE-89)
The Cost Calculator Builder plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order_ids’ parameter in all versions up to, and including, 3.2.67 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVE-2025-21280 (severity: MEDIUM, weakness: CWE-20)
Windows Virtual Trusted Platform Module Denial of Service Vulnerability
CVE-2025-21281 (severity: HIGH, weakness: CWE-416)
Microsoft COM for Windows Elevation of Privilege Vulnerability
CVE-2025-21282 (severity: HIGH, weakness: CWE-122)
Windows Telephony Service Remote Code Execution Vulnerability
CVE-2025-21283 (severity: HIGH, weakness: CWE-1222)
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2025-21284 (severity: MEDIUM, weakness: CWE-20)
Windows Virtual Trusted Platform Module Denial of Service Vulnerability
CVE-2025-21285 (severity: HIGH, weakness: CWE-476)
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
CVE-2025-21286 (severity: HIGH, weakness: CWE-122)
Windows Telephony Service Remote Code Execution Vulnerability
CVE-2025-21287 (severity: HIGH, weakness: CWE-269)
Windows Installer Elevation of Privilege Vulnerability
CVE-2025-21288 (severity: MEDIUM, weakness: CWE-908)
Windows COM Server Information Disclosure Vulnerability
CVE-2025-21289 (severity: HIGH, weakness: CWE-400)
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
CVE-2025-2129 (severity: MEDIUM, weakness: CWE-1188)
A vulnerability was found in Mage AI 0.9.75. It has been classified as problematic. This affects an unknown part. The manipulation leads to insecure default initialization of resource. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. After 7 months of repeated follow-ups by the researcher, Mage AI has decided to not accept this issue as a valid security vulnerability and has confirmed that they will not be addressing it.
CVE-2025-21290 (severity: HIGH, weakness: CWE-400)
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
CVE-2025-21291 (severity: HIGH, weakness: CWE-415)
Windows Direct Show Remote Code Execution Vulnerability
CVE-2025-21292 (severity: HIGH, weakness: CWE-94)
Windows Search Service Elevation of Privilege Vulnerability
CVE-2025-21293 (severity: HIGH, weakness: CWE-284)
Active Directory Domain Services Elevation of Privilege Vulnerability
CVE-2025-21294 (severity: HIGH, weakness: CWE-591)
Microsoft Digest Authentication Remote Code Execution Vulnerability
CVE-2025-21295 (severity: HIGH, weakness: CWE-416)
SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution Vulnerability
CVE-2025-21296 (severity: HIGH, weakness: CWE-416)
BranchCache Remote Code Execution Vulnerability
CVE-2025-21297 (severity: HIGH, weakness: CWE-416)
Windows Remote Desktop Services Remote Code Execution Vulnerability
CVE-2025-21298 (severity: CRITICAL, weakness: CWE-416)
Windows OLE Remote Code Execution Vulnerability
CVE-2025-21299 (severity: HIGH, weakness: CWE-922)
Windows Kerberos Security Feature Bypass Vulnerability
CVE-2025-2130 (severity: MEDIUM, weakness: CWE-79)
A vulnerability was found in OpenXE up to 1.12. It has been declared as problematic. This vulnerability affects unknown code of the component Ticket Bearbeiten Page. The manipulation of the argument Notizen leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-21300 (severity: HIGH, weakness: CWE-400)
Windows upnphost.dll Denial of Service Vulnerability
CVE-2025-21301 (severity: MEDIUM, weakness: CWE-284)
Windows Geolocation Service Information Disclosure Vulnerability
CVE-2025-21302 (severity: HIGH, weakness: CWE-122)
Windows Telephony Service Remote Code Execution Vulnerability
CVE-2025-21303 (severity: HIGH, weakness: CWE-122)
Windows Telephony Service Remote Code Execution Vulnerability
CVE-2025-21304 (severity: HIGH, weakness: CWE-416)
Microsoft DWM Core Library Elevation of Privilege Vulnerability
CVE-2025-21305 (severity: HIGH, weakness: CWE-122)
Windows Telephony Service Remote Code Execution Vulnerability
CVE-2025-21306 (severity: HIGH, weakness: CWE-122)
Windows Telephony Service Remote Code Execution Vulnerability
CVE-2025-21307 (severity: CRITICAL, weakness: CWE-416)
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
CVE-2025-21308 (severity: MEDIUM, weakness: CWE-200)
Windows Themes Spoofing Vulnerability
CVE-2025-21309 (severity: HIGH, weakness: CWE-591)
Windows Remote Desktop Services Remote Code Execution Vulnerability
CVE-2025-2131 (severity: MEDIUM, weakness: CWE-79)
A vulnerability was found in dayrui XunRuiCMS up to 4.6.3. It has been rated as problematic. This issue affects some unknown processing of the component Friendly Links Handler. The manipulation of the argument Website Address leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-21310 (severity: MEDIUM, weakness: CWE-125)
Windows Digital Media Elevation of Privilege Vulnerability
CVE-2025-21311 (severity: CRITICAL, weakness: CWE-303)
Windows NTLM V1 Elevation of Privilege Vulnerability
CVE-2025-21312 (severity: LOW, weakness: CWE-908)
Windows Smart Card Reader Information Disclosure Vulnerability
CVE-2025-21313 (severity: MEDIUM, weakness: CWE-833)
Windows Security Account Manager (SAM) Denial of Service Vulnerability
CVE-2025-21314 (severity: MEDIUM, weakness: CWE-451)
Windows SmartScreen Spoofing Vulnerability
CVE-2025-21315 (severity: HIGH, weakness: CWE-416)
Microsoft Brokering File System Elevation of Privilege Vulnerability
CVE-2025-21316 (severity: MEDIUM, weakness: CWE-532)
Windows Kernel Memory Information Disclosure Vulnerability
CVE-2025-21317 (severity: MEDIUM, weakness: CWE-532)
Windows Kernel Memory Information Disclosure Vulnerability
CVE-2025-21318 (severity: MEDIUM, weakness: CWE-532)
Windows Kernel Memory Information Disclosure Vulnerability
CVE-2025-21319 (severity: MEDIUM, weakness: CWE-532)
Windows Kernel Memory Information Disclosure Vulnerability
CVE-2025-2132 (severity: MEDIUM, weakness: CWE-74)
A vulnerability classified as critical has been found in ftcms 2.1. Affected is an unknown function of the file /admin/index.php/web/ajax_all_lists of the component Search. The manipulation of the argument name leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-21320 (severity: MEDIUM, weakness: CWE-532)
Windows Kernel Memory Information Disclosure Vulnerability
CVE-2025-21321 (severity: MEDIUM, weakness: CWE-532)
Windows Kernel Memory Information Disclosure Vulnerability
CVE-2025-21322 (severity: HIGH, weakness: CWE-59)
Microsoft PC Manager Elevation of Privilege Vulnerability
CVE-2025-21323 (severity: MEDIUM, weakness: CWE-532)
Windows Kernel Memory Information Disclosure Vulnerability
CVE-2025-21324 (severity: MEDIUM, weakness: CWE-125)
Windows Digital Media Elevation of Privilege Vulnerability
CVE-2025-21325 (severity: HIGH, weakness: CWE-732)
Windows Secure Kernel Mode Elevation of Privilege Vulnerability
CVE-2025-21326 (severity: HIGH, weakness: CWE-843)
Internet Explorer Remote Code Execution Vulnerability
CVE-2025-21327 (severity: MEDIUM, weakness: CWE-125)
Windows Digital Media Elevation of Privilege Vulnerability
CVE-2025-21328 (severity: MEDIUM, weakness: CWE-41)
MapUrlToZone Security Feature Bypass Vulnerability
CVE-2025-21329 (severity: MEDIUM, weakness: CWE-41)
MapUrlToZone Security Feature Bypass Vulnerability
CVE-2025-2133 (severity: MEDIUM, weakness: CWE-79)
A vulnerability classified as problematic was found in ftcms 2.1. Affected by this vulnerability is an unknown functionality of the file /admin/index.php/news/edit. The manipulation of the argument title leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-21330 (severity: HIGH, weakness: CWE-400)
Windows Remote Desktop Services Denial of Service Vulnerability
CVE-2025-21331 (severity: HIGH, weakness: CWE-59)
Windows Installer Elevation of Privilege Vulnerability
CVE-2025-21332 (severity: HIGH, weakness: CWE-41)
MapUrlToZone Security Feature Bypass Vulnerability
CVE-2025-21333 (severity: HIGH, weakness: CWE-122)
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
CVE-2025-21334 (severity: HIGH, weakness: CWE-416)
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
CVE-2025-21335 (severity: HIGH, weakness: CWE-416)
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
CVE-2025-21336 (severity: MEDIUM, weakness: CWE-203)
Windows Cryptographic Information Disclosure Vulnerability
CVE-2025-21337 (severity: LOW, weakness: CWE-284)
Windows NTFS Elevation of Privilege Vulnerability
CVE-2025-21338 (severity: HIGH, weakness: CWE-190)
GDI+ Remote Code Execution Vulnerability
CVE-2025-21339 (severity: HIGH, weakness: CWE-122)
Windows Telephony Service Remote Code Execution Vulnerability
CVE-2025-21340 (severity: MEDIUM, weakness: CWE-284)
Windows Virtualization-Based Security (VBS) Security Feature Bypass Vulnerability
CVE-2025-21341 (severity: MEDIUM, weakness: CWE-125)
Windows Digital Media Elevation of Privilege Vulnerability
CVE-2025-21342 (severity: HIGH, weakness: CWE-843)
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2025-21343 (severity: HIGH, weakness: CWE-269)
Windows Web Threat Defense User Service Information Disclosure Vulnerability
CVE-2025-21344 (severity: HIGH, weakness: CWE-20)
Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2025-21345 (severity: HIGH, weakness: CWE-416)
Microsoft Office Visio Remote Code Execution Vulnerability
CVE-2025-21346 (severity: HIGH, weakness: CWE-693)
Microsoft Office Security Feature Bypass Vulnerability
CVE-2025-21347 (severity: MEDIUM, weakness: CWE-59)
Windows Deployment Services Denial of Service Vulnerability
CVE-2025-21348 (severity: HIGH, weakness: CWE-285)
Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2025-21349 (severity: MEDIUM, weakness: CWE-287)
Windows Remote Desktop Configuration Service Tampering Vulnerability
CVE-2025-2135 (severity: HIGH, weakness: CWE-843)
Type Confusion in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVE-2025-21350 (severity: MEDIUM, weakness: CWE-20)
Windows Kerberos Denial of Service Vulnerability
CVE-2025-21351 (severity: HIGH, weakness: CWE-400)
Windows Active Directory Domain Services API Denial of Service Vulnerability
CVE-2025-21352 (severity: MEDIUM, weakness: CWE-400)
Internet Connection Sharing (ICS) Denial of Service Vulnerability
CVE-2025-21354 (severity: HIGH, weakness: CWE-822)
Microsoft Excel Remote Code Execution Vulnerability
CVE-2025-21355 (severity: CRITICAL, weakness: CWE-306)
Missing Authentication for Critical Function in Microsoft Bing allows an unauthorized attacker to execute code over a network
CVE-2025-21356 (severity: HIGH, weakness: CWE-122)
Microsoft Office Visio Remote Code Execution Vulnerability
CVE-2025-21357 (severity: MEDIUM, weakness: CWE-908)
Microsoft Outlook Remote Code Execution Vulnerability
CVE-2025-21358 (severity: HIGH, weakness: CWE-822)
Windows Core Messaging Elevation of Privileges Vulnerability
CVE-2025-21359 (severity: HIGH, weakness: CWE-284)
Windows Kernel Security Feature Bypass Vulnerability
CVE-2025-2136 (severity: HIGH, weakness: CWE-416)
Use after free in Inspector in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVE-2025-21360 (severity: HIGH, weakness: CWE-269)
Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability
CVE-2025-21361 (severity: HIGH, weakness: CWE-641)
Microsoft Outlook Remote Code Execution Vulnerability
CVE-2025-21362 (severity: HIGH, weakness: CWE-416)
Microsoft Excel Remote Code Execution Vulnerability
CVE-2025-21363 (severity: HIGH, weakness: CWE-822)
Microsoft Word Remote Code Execution Vulnerability
CVE-2025-21364 (severity: HIGH, weakness: CWE-502)
Microsoft Excel Security Feature Bypass Vulnerability
CVE-2025-21365 (severity: HIGH, weakness: CWE-426)
Microsoft Office Remote Code Execution Vulnerability
CVE-2025-21366 (severity: HIGH, weakness: CWE-416)
Microsoft Access Remote Code Execution Vulnerability
CVE-2025-21367 (severity: HIGH, weakness: CWE-416)
Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
CVE-2025-21368 (severity: HIGH, weakness: CWE-122)
Microsoft Digest Authentication Remote Code Execution Vulnerability
CVE-2025-21369 (severity: HIGH, weakness: CWE-122)
Microsoft Digest Authentication Remote Code Execution Vulnerability
CVE-2025-2137 (severity: HIGH, weakness: CWE-125)
Out of bounds read in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium)
CVE-2025-21370 (severity: HIGH, weakness: CWE-20)
Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
CVE-2025-21371 (severity: HIGH, weakness: CWE-122)
Windows Telephony Service Remote Code Execution Vulnerability
CVE-2025-21372 (severity: HIGH, weakness: CWE-416)
Microsoft Brokering File System Elevation of Privilege Vulnerability
CVE-2025-21373 (severity: HIGH, weakness: CWE-59)
Windows Installer Elevation of Privilege Vulnerability
CVE-2025-21374 (severity: MEDIUM, weakness: CWE-125)
Windows CSC Service Information Disclosure Vulnerability
CVE-2025-21375 (severity: HIGH, weakness: CWE-20)
Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability
CVE-2025-21376 (severity: HIGH, weakness: CWE-122)
Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
CVE-2025-21377 (severity: MEDIUM, weakness: CWE-73)
NTLM Hash Disclosure Spoofing Vulnerability
CVE-2025-21378 (severity: HIGH, weakness: CWE-122)
Windows CSC Service Elevation of Privilege Vulnerability
CVE-2025-21379 (severity: HIGH, weakness: CWE-416)
DHCP Client Service Remote Code Execution Vulnerability
CVE-2025-21380 (severity: MEDIUM, weakness: CWE-284)
Improper access control in Azure SaaS Resources allows an authorized attacker to disclose information over a network.
CVE-2025-21381 (severity: HIGH, weakness: CWE-822)
Microsoft Excel Remote Code Execution Vulnerability
CVE-2025-21382 (severity: HIGH, weakness: CWE-122)
Windows Graphics Component Elevation of Privilege Vulnerability
CVE-2025-21383 (severity: MEDIUM, weakness: CWE-125)
Microsoft Excel Information Disclosure Vulnerability
CVE-2025-21384 (severity: HIGH, weakness: CWE-693)
An authenticated attacker can exploit an Server-Side Request Forgery (SSRF) vulnerability in Microsoft Azure Health Bot to elevate privileges over a network.
CVE-2025-21385 (severity: MEDIUM, weakness: CWE-918)
A Server-Side Request Forgery (SSRF) vulnerability in Microsoft Purview allows an authorized attacker to disclose information over a network.
CVE-2025-21386 (severity: HIGH, weakness: CWE-416)
Microsoft Excel Remote Code Execution Vulnerability
CVE-2025-21387 (severity: HIGH, weakness: CWE-416)
Microsoft Excel Remote Code Execution Vulnerability
CVE-2025-21389 (severity: HIGH, weakness: CWE-400)
Windows upnphost.dll Denial of Service Vulnerability
CVE-2025-21390 (severity: HIGH, weakness: CWE-122)
Microsoft Excel Remote Code Execution Vulnerability
CVE-2025-21391 (severity: HIGH, weakness: CWE-59)
Windows Storage Elevation of Privilege Vulnerability
CVE-2025-21392 (severity: HIGH, weakness: CWE-416)
Microsoft Office Remote Code Execution Vulnerability
CVE-2025-21393 (severity: MEDIUM, weakness: CWE-79)
Microsoft SharePoint Server Spoofing Vulnerability
CVE-2025-21394 (severity: HIGH, weakness: CWE-416)
Microsoft Excel Remote Code Execution Vulnerability
CVE-2025-21395 (severity: HIGH, weakness: CWE-122)
Microsoft Access Remote Code Execution Vulnerability
CVE-2025-21396 (severity: CRITICAL, weakness: CWE-862)
Missing authorization in Microsoft Account allows an unauthorized attacker to elevate privileges over a network.
CVE-2025-21397 (severity: HIGH, weakness: CWE-416)
Microsoft Office Remote Code Execution Vulnerability
CVE-2025-21399 (severity: HIGH, weakness: CWE-426)
Microsoft Edge (Chromium-based) Update Elevation of Privilege Vulnerability
CVE-2025-21400 (severity: HIGH, weakness: CWE-285)
Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2025-21401 (severity: MEDIUM, weakness: CWE-601)
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
CVE-2025-21402 (severity: HIGH, weakness: CWE-641)
Microsoft Office OneNote Remote Code Execution Vulnerability
CVE-2025-21403 (severity: MEDIUM, weakness: CWE-863)
On-Premises Data Gateway Information Disclosure Vulnerability
CVE-2025-21404 (severity: MEDIUM, weakness: CWE-449)
Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2025-21405 (severity: HIGH, weakness: CWE-284)
Visual Studio Elevation of Privilege Vulnerability
CVE-2025-21406 (severity: HIGH, weakness: CWE-416)
Windows Telephony Service Remote Code Execution Vulnerability
CVE-2025-21407 (severity: HIGH, weakness: CWE-122)
Windows Telephony Service Remote Code Execution Vulnerability
CVE-2025-21408 (severity: HIGH, weakness: CWE-843)
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2025-21409 (severity: HIGH, weakness: CWE-122)
Windows Telephony Service Remote Code Execution Vulnerability
CVE-2025-21410 (severity: HIGH, weakness: CWE-122)
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2025-21411 (severity: HIGH, weakness: CWE-122)
Windows Telephony Service Remote Code Execution Vulnerability
CVE-2025-21413 (severity: HIGH, weakness: CWE-122)
Windows Telephony Service Remote Code Execution Vulnerability
CVE-2025-21414 (severity: HIGH, weakness: CWE-122)
Windows Core Messaging Elevation of Privileges Vulnerability
CVE-2025-21415 (severity: HIGH, weakness: CWE-290)
Authentication bypass by spoofing in Azure AI Face Service allows an authorized attacker to elevate privileges over a network.
CVE-2025-21416 (severity: HIGH, weakness: CWE-862)
Missing authorization in Azure Virtual Desktop allows an authorized attacker to elevate privileges over a network.
CVE-2025-21417 (severity: HIGH, weakness: CWE-122)
Windows Telephony Service Remote Code Execution Vulnerability
CVE-2025-21418 (severity: HIGH, weakness: CWE-122)
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
CVE-2025-21419 (severity: HIGH, weakness: CWE-59)
Windows Setup Files Cleanup Elevation of Privilege Vulnerability
CVE-2025-21420 (severity: HIGH, weakness: CWE-59)
Windows Disk Cleanup Tool Elevation of Privilege Vulnerability
CVE-2025-21421 (severity: HIGH, weakness: CWE-126)
Memory corruption while processing escape code in API.
CVE-2025-21423 (severity: HIGH, weakness: CWE-129)
Memory corruption occurs when handling client calls to EnableTestMode through an Escape call.
CVE-2025-21424 (severity: HIGH, weakness: CWE-416)
Memory corruption while calling the NPU driver APIs concurrently.
CVE-2025-21425 (severity: HIGH, weakness: CWE-284)
Memory corruption may occur due top improper access control in HAB process.
CVE-2025-21428 (severity: HIGH, weakness: CWE-126)
Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request from the AP to establish a TSpec session.
CVE-2025-21429 (severity: HIGH, weakness: CWE-126)
Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request.
CVE-2025-21430 (severity: HIGH, weakness: CWE-126)
Transient DOS while connecting STA to AP and initiating ADD TS request from AP to establish TSpec session.
CVE-2025-21431 (severity: MEDIUM, weakness: CWE-367)
Information disclosure may be there when a guest VM is connected.
CVE-2025-21434 (severity: HIGH, weakness: CWE-126)
Transient DOS may occur while parsing EHT operation IE or EHT capability IE.
CVE-2025-21435 (severity: HIGH, weakness: CWE-126)
Transient DOS may occur while parsing extended IE in beacon.
CVE-2025-21436 (severity: HIGH, weakness: CWE-416)
Memory corruption may occur while initiating two IOCTL calls simultaneously to create processes from two different threads.
CVE-2025-21437 (severity: HIGH, weakness: CWE-416)
Memory corruption while processing memory map or unmap IOCTL operations simultaneously.
CVE-2025-21438 (severity: HIGH, weakness: CWE-125)
Memory corruption while IOCTL call is invoked from user-space to read board data.
CVE-2025-21439 (severity: HIGH, weakness: CWE-787)
Memory corruption may occur while reading board data via IOCTL call when the WLAN driver copies the content to the provided output buffer.
CVE-2025-21440 (severity: HIGH, weakness: CWE-787)
Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver.
CVE-2025-21441 (severity: HIGH, weakness: CWE-787)
Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver.
CVE-2025-21442 (severity: HIGH, weakness: CWE-680)
Memory corruption while transmitting packet mapping information with invalid header payload size.
CVE-2025-21443 (severity: HIGH, weakness: CWE-120)
Memory corruption while processing message content in eAVB.
CVE-2025-21447 (severity: HIGH, weakness: CWE-129)
Memory corruption may occur while processing device IO control call for session control.
CVE-2025-21448 (severity: HIGH, weakness: CWE-126)
Transient DOS may occur while parsing SSID in action frames.