Skip to content

Commit 65e0b50

Browse files
cad-safe-botcad-safe-bot
committed
Auto-Update: 2025-09-03T02:00:12.239865+00:00
1 parent 46103b2 commit 65e0b50

File tree

12 files changed

+928
-159
lines changed

12 files changed

+928
-159
lines changed

‎CVE-2020/CVE-2020-243xx/CVE-2020-24363.json

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"id": "CVE-2020-24363",
33
"sourceIdentifier": "cve@mitre.org",
44
"published": "2020-08-31T16:15:15.380",
5-
"lastModified": "2025-08-29T17:15:31.950",
5+
"lastModified": "2025-09-03T01:00:02.097",
66
"vulnStatus": "Modified",
77
"cveTags": [],
88
"descriptions": [
@@ -84,6 +84,10 @@
8484
}
8585
]
8686
},
87+
"cisaExploitAdd": "2025-09-02",
88+
"cisaActionDue": "2025-09-23",
89+
"cisaRequiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
90+
"cisaVulnerabilityName": "TP-link TL-WA855RE Missing Authentication for Critical Function Vulnerability",
8791
"weaknesses": [
8892
{
8993
"source": "nvd@nist.gov",

‎CVE-2025/CVE-2025-545xx/CVE-2025-54588.json

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"id": "CVE-2025-54588",
3+
"sourceIdentifier": "security-advisories@github.com",
4+
"published": "2025-09-03T00:15:30.067",
5+
"lastModified": "2025-09-03T00:15:30.067",
6+
"vulnStatus": "Received",
7+
"cveTags": [],
8+
"descriptions": [
9+
{
10+
"lang": "en",
11+
"value": "Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. Versions 1.34.0 through 1.34.4 and 1.35.0 contain a use-after-free (UAF) vulnerability in the DNS cache, causing abnormal process termination. The vulnerability is in Envoy's Dynamic Forward Proxy implementation, occurring when a completion callback for a DNS resolution triggers new DNS resolutions or removes existing pending resolutions. This condition may occur when the following conditions are met: dynamic Forwarding Filter is enabled, the `envoy.reloadable_features.dfp_cluster_resolves_hosts` runtime flag is enabled, and the Host header is modified between the Dynamic Forwarding Filter and Router filters. This issue is resolved in versions 1.34.5 and 1.35.1. To work around this issue, set the envoy.reloadable_features.dfp_cluster_resolves_hosts runtime flag to false."
12+
}
13+
],
14+
"metrics": {
15+
"cvssMetricV31": [
16+
{
17+
"source": "security-advisories@github.com",
18+
"type": "Secondary",
19+
"cvssData": {
20+
"version": "3.1",
21+
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
22+
"baseScore": 7.5,
23+
"baseSeverity": "HIGH",
24+
"attackVector": "NETWORK",
25+
"attackComplexity": "LOW",
26+
"privilegesRequired": "NONE",
27+
"userInteraction": "NONE",
28+
"scope": "UNCHANGED",
29+
"confidentialityImpact": "NONE",
30+
"integrityImpact": "NONE",
31+
"availabilityImpact": "HIGH"
32+
},
33+
"exploitabilityScore": 3.9,
34+
"impactScore": 3.6
35+
}
36+
]
37+
},
38+
"weaknesses": [
39+
{
40+
"source": "security-advisories@github.com",
41+
"type": "Primary",
42+
"description": [
43+
{
44+
"lang": "en",
45+
"value": "CWE-416"
46+
}
47+
]
48+
}
49+
],
50+
"references": [
51+
{
52+
"url": "https://github.com/envoyproxy/envoy/releases/tag/v1.34.5",
53+
"source": "security-advisories@github.com"
54+
},
55+
{
56+
"url": "https://github.com/envoyproxy/envoy/releases/tag/v1.35.1",
57+
"source": "security-advisories@github.com"
58+
},
59+
{
60+
"url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-g9vw-6pvx-7gmw",
61+
"source": "security-advisories@github.com"
62+
}
63+
]
64+
}

‎CVE-2025/CVE-2025-551xx/CVE-2025-55177.json

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"id": "CVE-2025-55177",
33
"sourceIdentifier": "cve-assign@fb.com",
44
"published": "2025-08-29T16:15:36.723",
5-
"lastModified": "2025-09-02T15:15:32.373",
5+
"lastModified": "2025-09-03T01:00:02.113",
66
"vulnStatus": "Awaiting Analysis",
77
"cveTags": [],
88
"descriptions": [
@@ -35,6 +35,10 @@
3535
}
3636
]
3737
},
38+
"cisaExploitAdd": "2025-09-02",
39+
"cisaActionDue": "2025-09-23",
40+
"cisaRequiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
41+
"cisaVulnerabilityName": "Meta Platforms WhatsApp Incorrect Authorization Vulnerability",
3842
"references": [
3943
{
4044
"url": "https://www.facebook.com/security/advisories/cve-2025-55177",

‎CVE-2025/CVE-2025-578xx/CVE-2025-57806.json

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
{
2+
"id": "CVE-2025-57806",
3+
"sourceIdentifier": "security-advisories@github.com",
4+
"published": "2025-09-03T01:15:30.043",
5+
"lastModified": "2025-09-03T01:15:30.043",
6+
"vulnStatus": "Received",
7+
"cveTags": [],
8+
"descriptions": [
9+
{
10+
"lang": "en",
11+
"value": "Local Deep Research is an AI-powered research assistant for deep, iterative research. Versions 0.2.0 through 0.6.7 stored confidential information, including API keys, in a local SQLite database without encryption. This behavior was not clearly documented outside of the database architecture page. Users were not given the ability to configure the database location, allowing anyone with access to the container or host filesystem to retrieve sensitive data in plaintext by accessing the .db file. This is fixed in version 1.0.0."
12+
}
13+
],
14+
"metrics": {
15+
"cvssMetricV40": [
16+
{
17+
"source": "security-advisories@github.com",
18+
"type": "Secondary",
19+
"cvssData": {
20+
"version": "4.0",
21+
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
22+
"baseScore": 6.9,
23+
"baseSeverity": "MEDIUM",
24+
"attackVector": "LOCAL",
25+
"attackComplexity": "LOW",
26+
"attackRequirements": "NONE",
27+
"privilegesRequired": "NONE",
28+
"userInteraction": "NONE",
29+
"vulnConfidentialityImpact": "HIGH",
30+
"vulnIntegrityImpact": "NONE",
31+
"vulnAvailabilityImpact": "NONE",
32+
"subConfidentialityImpact": "NONE",
33+
"subIntegrityImpact": "NONE",
34+
"subAvailabilityImpact": "NONE",
35+
"exploitMaturity": "NOT_DEFINED",
36+
"confidentialityRequirement": "NOT_DEFINED",
37+
"integrityRequirement": "NOT_DEFINED",
38+
"availabilityRequirement": "NOT_DEFINED",
39+
"modifiedAttackVector": "NOT_DEFINED",
40+
"modifiedAttackComplexity": "NOT_DEFINED",
41+
"modifiedAttackRequirements": "NOT_DEFINED",
42+
"modifiedPrivilegesRequired": "NOT_DEFINED",
43+
"modifiedUserInteraction": "NOT_DEFINED",
44+
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
45+
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
46+
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
47+
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
48+
"modifiedSubIntegrityImpact": "NOT_DEFINED",
49+
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
50+
"Safety": "NOT_DEFINED",
51+
"Automatable": "NOT_DEFINED",
52+
"Recovery": "NOT_DEFINED",
53+
"valueDensity": "NOT_DEFINED",
54+
"vulnerabilityResponseEffort": "NOT_DEFINED",
55+
"providerUrgency": "NOT_DEFINED"
56+
}
57+
}
58+
]
59+
},
60+
"weaknesses": [
61+
{
62+
"source": "security-advisories@github.com",
63+
"type": "Primary",
64+
"description": [
65+
{
66+
"lang": "en",
67+
"value": "CWE-312"
68+
},
69+
{
70+
"lang": "en",
71+
"value": "CWE-522"
72+
}
73+
]
74+
}
75+
],
76+
"references": [
77+
{
78+
"url": "http://github.com/LearningCircuit/local-deep-research/releases/tag/v1.0.0",
79+
"source": "security-advisories@github.com"
80+
},
81+
{
82+
"url": "https://github.com/LearningCircuit/local-deep-research/pull/578",
83+
"source": "security-advisories@github.com"
84+
},
85+
{
86+
"url": "https://github.com/LearningCircuit/local-deep-research/security/advisories/GHSA-4h8c-qrcq-cv5c",
87+
"source": "security-advisories@github.com"
88+
}
89+
]
90+
}

‎CVE-2025/CVE-2025-89xx/CVE-2025-8941.json

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"id": "CVE-2025-8941",
33
"sourceIdentifier": "secalert@redhat.com",
44
"published": "2025-08-13T15:15:41.873",
5-
"lastModified": "2025-09-01T09:15:34.680",
5+
"lastModified": "2025-09-03T01:15:30.260",
66
"vulnStatus": "Awaiting Analysis",
77
"cveTags": [],
88
"descriptions": [
@@ -56,6 +56,10 @@
5656
"url": "https://access.redhat.com/errata/RHSA-2025:14557",
5757
"source": "secalert@redhat.com"
5858
},
59+
{
60+
"url": "https://access.redhat.com/errata/RHSA-2025:15100",
61+
"source": "secalert@redhat.com"
62+
},
5963
{
6064
"url": "https://access.redhat.com/security/cve/CVE-2025-8941",
6165
"source": "secalert@redhat.com"

‎CVE-2025/CVE-2025-92xx/CVE-2025-9260.json

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"id": "CVE-2025-9260",
3+
"sourceIdentifier": "security@wordfence.com",
4+
"published": "2025-09-03T00:15:30.273",
5+
"lastModified": "2025-09-03T00:15:30.273",
6+
"vulnStatus": "Received",
7+
"cveTags": [],
8+
"descriptions": [
9+
{
10+
"lang": "en",
11+
"value": "The Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to PHP Object Injection in versions 5.1.16 to 6.1.1 via deserialization of untrusted input in the parseUserProperties function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to read arbitrary files. If allow_url_include is enabled on the server, remote code execution is possible.\r\nWhile the vendor patched this issue in version 6.1.0, the patch caused a fatal error in the vulnerable code, due to a missing class import, so we consider 6.1.2 to be the most complete and best patched version"
12+
}
13+
],
14+
"metrics": {
15+
"cvssMetricV31": [
16+
{
17+
"source": "security@wordfence.com",
18+
"type": "Primary",
19+
"cvssData": {
20+
"version": "3.1",
21+
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
22+
"baseScore": 6.5,
23+
"baseSeverity": "MEDIUM",
24+
"attackVector": "NETWORK",
25+
"attackComplexity": "LOW",
26+
"privilegesRequired": "LOW",
27+
"userInteraction": "NONE",
28+
"scope": "UNCHANGED",
29+
"confidentialityImpact": "HIGH",
30+
"integrityImpact": "NONE",
31+
"availabilityImpact": "NONE"
32+
},
33+
"exploitabilityScore": 2.8,
34+
"impactScore": 3.6
35+
}
36+
]
37+
},
38+
"weaknesses": [
39+
{
40+
"source": "security@wordfence.com",
41+
"type": "Primary",
42+
"description": [
43+
{
44+
"lang": "en",
45+
"value": "CWE-502"
46+
}
47+
]
48+
}
49+
],
50+
"references": [
51+
{
52+
"url": "https://plugins.trac.wordpress.org/browser/fluentform/tags/6.0.2/app/Services/FormBuilder/EditorShortcodeParser.php#L214",
53+
"source": "security@wordfence.com"
54+
},
55+
{
56+
"url": "https://plugins.trac.wordpress.org/browser/fluentform/tags/6.0.2/vendor/wpfluent/framework/src/WPFluent/View/View.php#L7",
57+
"source": "security@wordfence.com"
58+
},
59+
{
60+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/938e5d6b-1ad6-4021-a148-1d1c9e8a0a83?source=cve",
61+
"source": "security@wordfence.com"
62+
}
63+
]
64+
}

0 commit comments

Comments
 (0)