Baitaphish
Security intelligence
SearchLatest briefing
Data & Insights

CVE Explorer

Search one exact, source-linked CVE snapshot by CVE ID or explicit vendor and product tokens. Provider severity, KEV, conflicts, and stale state remain separate observations—not a Baitaphish risk rating.
Snapshot urn:baitaphish:cve-read-model-snapshot:v3:f2c3f72dcc196f8e7d63aa2d29709ad8b3fea39110eb2d563da5ce9b6fa9da89Released 2026-08-05T02:00:00Z
Exact snapshot results

353,537 CVE records

CVE ID descending · no relevance ranking

CVE-2025-67727

Parse Server is an open source backend that can be deployed to any infrastructure that runs Node.js. In versions prior to 8.6.0-alpha.2, a GitHub CI workflow is triggered in a way that grants the GitHub Actions workflow elevated permissions, giving it access to GitHub secrets and write permissions which are defined in the workflow. Code from a fork or lifecycle scripts is potentially included. Only the repository's CI/CD infrastructure is affected, including any public GitHub forks with GitHub A

PUBLISHED
Vendor
parse-community
Product
parse-server
Provider severity
MEDIUM
Conflicts
1

CVE-2025-67726

Tornado is a Python web framework and asynchronous networking library. Versions 6.5.2 and below use an inefficient algorithm when parsing parameters for HTTP header values, potentially causing a DoS. The _parseparam function in httputil.py is used to parse specific HTTP header values, such as those in multipart/form-data and repeatedly calls string.count() within a nested loop while processing quoted semicolons. If an attacker sends a request with a large number of maliciously crafted parameters

PUBLISHED
Vendor
tornadoweb
Product
tornado
Provider severity
HIGH
Conflicts
1

CVE-2025-67725

Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, a single maliciously crafted HTTP request can block the server's event loop for an extended period, caused by the HTTPHeaders.add method. The function accumulates values using string concatenation when the same header name is repeated, causing a Denial of Service (DoS). Due to Python string immutability, each concatenation copies the entire string, resulting in O(n²) time complexity. The severity

PUBLISHED
Vendor
tornadoweb
Product
tornado
Provider severity
HIGH
Conflicts
0

CVE-2025-67724

Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the supplied reason phrase is used unescaped in HTTP headers (where it could be used for header injection) or in HTML in the default error page (where it could be used for XSS) and can be exploited by passing untrusted or malicious data into the reason argument. Used by both RequestHandler.set_status and tornado.web.HTTPError, the argument is designed to allow applications to pass custom "reason"

PUBLISHED
Vendor
tornadoweb
Product
tornado
Provider severity
MEDIUM
Conflicts
1

CVE-2025-67723

Discourse is an open source discussion platform. Versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 have a content-security-policy-mitigated cross-site scriptinv vulnerability on the Discourse Math plugin when using its KaTeX variant. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. As a workaround, the Discourse Math plugin can be disabled, or the Mathjax provider can be used instead of KaTeX.

PUBLISHED
Vendor
discourse
Product
discourse
Provider severity
MEDIUM
Conflicts
0

CVE-2025-67722

FreePBX is an open-source web-based graphical user interface (GUI) that manages Asterisk. Prior to versions 16.0.45 and 17.0.24 of the FreePBX framework, an authenticated local privilege escalation exists in the deprecated FreePBX startup script `amportal`. In the deprecated `amportal` utility, the lookup for the `freepbx_engine` file occurs in `/etc/asterisk/` directories. Typically, these are configured by FreePBX as writable by the **asterisk** user and any members of the **asterisk** group.

PUBLISHED
Vendor
FreePBX
Product
framework
Provider severity
MEDIUM
Conflicts
0

CVE-2025-67721

Aircompressor is a library with ports of the Snappy, LZO, LZ4, and Zstandard compression algorithms to Java. In versions 3.3 and below, incorrect handling of malformed data in Java-based decompressor implementations for Snappy and LZ4 allow remote attackers to read previous buffer contents via crafted compressed input. With certain crafted compressed inputs, elements from the output buffer can end up in the uncompressed output, potentially leaking sensitive data. This is relevant for application

PUBLISHED
Vendor
airlift
Product
aircompressor
Provider severity
MEDIUM
Conflicts
1

CVE-2025-67720

Pyrofork is a modern, asynchronous MTProto API framework. Versions 2.3.68 and earlier do not properly sanitize filenames received from Telegram messages in the download_media method before using them in file path construction. When downloading media, if the user does not specify a custom filename (which is the common/default usage), the method falls back to using the file_name attribute from the media object. The attribute originates from Telegram's DocumentAttributeFilename and is controlled by

PUBLISHED
Vendor
Mayuri-Chan
Product
pyrofork
Provider severity
MEDIUM
Conflicts
0

CVE-2025-6772

A vulnerability was found in eosphoros-ai db-gpt up to 0.7.2. It has been classified as critical. Affected is the function import_flow of the file /api/v2/serve/awel/flow/import. The manipulation of the argument File leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

PUBLISHED
Vendor
eosphoros-ai
Product
db-gpt
Provider severity
HIGH, MEDIUM
Conflicts
1

CVE-2025-67719

Ibexa is a composable end-to-end DXP (Digital Experience Platform). Versions 5.0.0-beta1 through 5.0.3 do not have password validation. During the transition from v4 to v5 an error was introduced into validation code which causes the validation of the previous password not to run as expected. This makes it possible for a logged in user to change their password in the back office without knowing the previous password. For example, if a user logs into their account and walks away without locking t

PUBLISHED
Vendor
ibexa
Product
user
Provider severity
HIGH
Conflicts
0

CVE-2025-67718

Form.io is a combined Form and API platform for Serverless applications. Versions 3.5.6 and below and 4.0.0-rc.1 through 4.4.2 contain a flaw in path handling which could allow an attacker to access protected API endpoints by sending a crafted request path. An unauthenticated or unauthorized request could retrieve data from endpoints that should be protected. This issue is fixed in versions 3.5.7 and 4.4.3.

PUBLISHED
Vendor
formio
Product
formio
Provider severity
HIGH
Conflicts
1

CVE-2025-67717

ZITADEL is an open-source identity infrastructure tool. Versions 2.44.0 through 3.4.4 and 4.0.0-rc.1 through 4.7.1 disclose the total number of instance users to authenticated users, regardless of their specific permissions. While this does not leak individual user data or PII, disclosing the total user count via the totalResult field constitutes an information disclosure vulnerability that may be sensitive in certain contexts. This issue is fixed in versions 3.4.5 and 4.7.2.

PUBLISHED
Vendor
zitadel
Product
zitadel
Provider severity
MEDIUM
Conflicts
0

CVE-2025-67716

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions 4.9.0 through 4.12.1 contain an input-validation flaw in the returnTo parameter, which could allow attackers to inject unintended OAuth query parameters into the Auth0 authorization request. Successful exploitation may result in tokens being issued with unintended parameters. This issue is fixed in version 4.13.0.

PUBLISHED
Vendor
auth0
Product
nextjs-auth0
Provider severity
MEDIUM
Conflicts
0

CVE-2025-67715

Weblate is a web based localization tool. In versions prior to 5.15, it was possible to retrieve user notification settings or list all users via API. Version 5.15 fixes the issue.

PUBLISHED
Vendor
WeblateOrg
Product
weblate
Provider severity
MEDIUM
Conflicts
1

CVE-2025-67713

Miniflux 2 is an open source feed reader. Versions 2.2.14 and below treat redirect_url as safe when url.Parse(...).IsAbs() is false, enabling phishing flows after login. Protocol-relative URLs like //ikotaslabs.com have an empty scheme and pass that check, allowing post-login redirects to attacker-controlled sites. This issue is fixed in version 2.2.15.

PUBLISHED
Vendor
miniflux
Product
v2
Provider severity
MEDIUM
Conflicts
0

CVE-2025-67712

There is an HTML injection issue in Esri ArcGIS Web AppBuilder developer edition versions prior to 2.30 that allows a remote, unauthenticated attacker to potentially entice a user to click a link that causes arbitrary HTML to render in a victim's browser. There is no evidence of JavaScript execution, which limits the impact. At the time of submission, ArcGIS Web App Builder developer edition is retired and unsupported. ArcGIS Web App Builder 2.30 is not susceptible to this vulnerability.

PUBLISHED
Vendor
Esri
Product
ArcGIS Web AppBuilder {Developer Edition)
Provider severity
MEDIUM
Conflicts
0

CVE-2025-67711

There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim’s browser.

PUBLISHED
Vendor
Esri
Product
ArcGIS Server
Provider severity
MEDIUM
Conflicts
0

CVE-2025-67710

There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim’s browser.

PUBLISHED
Vendor
Esri
Product
ArcGIS Server
Provider severity
MEDIUM
Conflicts
0

CVE-2025-6771

OS command injection in Ivanti Endpoint Manager Mobile (EPMM) before version 12.5.0.2,12.4.0.3 and 12.3.0.3 allows a remote authenticated attacker with high privileges to achieve remote code execution

PUBLISHED
Vendor
Ivanti
Product
Endpoint Manager Mobile
Provider severity
HIGH
Conflicts
0

CVE-2025-67709

There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim’s browser.

PUBLISHED
Vendor
Esri
Product
ArcGIS Server
Provider severity
MEDIUM
Conflicts
0

CVE-2025-67708

There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim’s browser.

PUBLISHED
Vendor
Esri
Product
ArcGIS Server
Provider severity
MEDIUM
Conflicts
0

CVE-2025-67707

ArcGIS Server versions 11.5 and earlier on Windows and Linux do not sufficiently validate uploaded files, enabling a remote unauthenticated attacker to upload arbitrary files to the server’s designated upload directories. However, the server’s architecture enforces controls that restrict uploaded files to non‑executable storage locations and prevent modification or replacement of existing application components or system configurations. Uploaded files cannot be executed, leveraged to escalate p

PUBLISHED
Vendor
Esri
Product
ArcGIS Server
Provider severity
MEDIUM
Conflicts
0

CVE-2025-67706

ArcGIS Server versions 11.5 and earlier on Windows and Linux do not sufficiently validate uploaded files, enabling a remote unauthenticated attacker to upload arbitrary files to the server’s designated upload directories. However, the server’s architecture enforces controls that restrict uploaded files to non‑executable storage locations and prevent modification or replacement of existing application components or system configurations. Uploaded files cannot be executed, leveraged to escalate p

PUBLISHED
Vendor
Esri
Product
ArcGIS Server
Provider severity
MEDIUM
Conflicts
0

CVE-2025-67705

There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim’s browser.

PUBLISHED
Vendor
Esri
Product
ArcGIS Server
Provider severity
MEDIUM
Conflicts
0

CVE-2025-67704

There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim’s browser.

PUBLISHED
Vendor
Esri
Product
ArcGIS Server
Provider severity
MEDIUM
Conflicts
0

CVE-2025-67703

There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim’s browser.

PUBLISHED
Vendor
Esri
Product
ArcGIS Server
Provider severity
MEDIUM
Conflicts
0

CVE-2025-6770

OS command injection in Ivanti Endpoint Manager Mobile (EPMM) before version 12.5.0.2 allows a remote authenticated attacker with high privileges to achieve remote code execution

PUBLISHED
Vendor
Ivanti
Product
Endpoint Manager Mobile
Provider severity
HIGH
Conflicts
0

CVE-2025-6769

An issue has been discovered in GitLab CE/EE affecting all versions from 15.1 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed authenticated users to view administrator-only maintenance notes by accessing runner details through specific interfaces.

PUBLISHED
Vendor
GitLab
Product
GitLab
Provider severity
MEDIUM
Conflicts
0

CVE-2025-67685

A Server-Side Request Forgery (SSRF) vulnerability [CWE-918] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.4, FortiSandbox 4.4 all versions, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an authenticated attacker to proxy internal requests limited to plaintext endpoints only via crafted HTTP requests.

PUBLISHED
Vendor
Fortinet
Product
FortiSandbox
Provider severity
LOW
Conflicts
0

CVE-2025-67684

Quick.Cart is vulnerable to Local File Inclusion and Path Traversal issues in the theme selection mechanism. Quick.Cart allows a privileged user to upload arbitrary file contents while only validating the filename extension. This allows an attacker to include and execute uploaded PHP code, resulting in Remote Code Execution on the server. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.7 was

PUBLISHED
Vendor
OpenSolution
Product
Quick.Cart
Provider severity
CRITICAL
Conflicts
0

CVE-2025-67683

Quick.Cart is vulnerable to reflected XSS via the sSort parameter. An attacker can craft a malicious URL which, when opened, results in arbitrary JavaScript execution in the victim’s browser. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.7 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.

PUBLISHED
Vendor
OpenSolution
Product
Quick.Cart
Provider severity
MEDIUM
Conflicts
0

CVE-2025-6768

A vulnerability classified as critical has been found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. Affected is the function findAllHosByCondition of the file HospitalServiceImpl.java. The manipulation of the argument hospitalName leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor

PUBLISHED
Vendor
sfturing
Product
hosp_order
Provider severity
MEDIUM
Conflicts
2

CVE-2025-6767

A vulnerability was found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. It has been rated as critical. This issue affects the function findDoctorByCondition of the file DoctorServiceImpl.java. The manipulation of the argument hospitalName leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details f

PUBLISHED
Vendor
sfturing
Product
hosp_order
Provider severity
MEDIUM
Conflicts
2

CVE-2025-6766

A vulnerability was found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. It has been declared as critical. This vulnerability affects the function getOfficeName of the file OfficeServiceImpl.java. The manipulation of the argument officesName leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affe

PUBLISHED
Vendor
sfturing
Product
hosp_order
Provider severity
MEDIUM
Conflicts
2

CVE-2025-67653

Advantech WebAccess/SCADA is vulnerable to directory traversal, which may allow an attacker to determine the existence of arbitrary files.

PUBLISHED
Vendor
Advantech
Product
WebAccess/SCADA
Provider severity
MEDIUM
Conflicts
1

CVE-2025-67652

An attacker with access to the project file could use the exposed credentials to impersonate users, escalate privileges, or gain unauthorized access to systems and services. The absence of robust encryption or secure handling mechanisms increases the likelihood of this type of exploitation, leaving sensitive information more vulnerable.

PUBLISHED
Vendor
AutomationDirect
Product
CLICK Programmable Logic Controller
Provider severity
MEDIUM
Conflicts
0

CVE-2025-67651

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in multiple PHP Jabbers scripts. The lack of CSRF tokens or appropriate SameSite attributes allows an attacker to send unauthorized requests in the context of an authenticated user, leading to unauthorized administrative actions, such as creating new admin accounts. This issue was fixed in the versions specified in the affected products list.

PUBLISHED
Vendor
PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers
Product
Rental Property Booking Calendar, Cleaning Business Software, Car Rental Script, Auto Classifieds Script, Cinema Booking System, Yacht Listing Script, Vacation Rental Script, Availability Booking Calendar, Time Slots Booking Calendar, Car Park Booking System, Availability Calendar, PHP Newsletter Script, Service Booking Script, Product Comparison Script, Business Directory Script, Travel Tours Script, Meeting Room Booking System, Bus Reservation System, Hotel Booking System, Appointment Scheduler, Food Delivery Script, Event Ticketing System, PHP Shopping Cart, Restaurant Booking System, Member Login Script, Limo Booking Software, Taxi Booking Script, Shuttle Booking Software, Member Directory Script, PHP Event Calendar, Job Listing Script, Ticket Support Script, Property Listing Script, Event Booking Calendar, Equipment Rental Script
Provider severity
MEDIUM
Conflicts
1

CVE-2025-67650

An authenticated SQL injection vulnerability has been identified in multiple PHP Jabbers scripts. Improper neutralization of input provided by an authenticated user into parameters responsible for sorting functions allows an attacker to perform SQL Injection attacks. This issue was fixed in the versions specified in the affected products list.

PUBLISHED
Vendor
PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers, PHP Jabbers
Product
Auto Classifieds Script, Car Rental Script, Service Booking Script, Meeting Room Booking System, Hotel Booking System, Availability Booking Calendar, Cinema Booking System, Rental Property Booking Calendar, Property Listing Script, Yacht Listing Script, PHP Newsletter Script, Bus Reservation System, Equipment Rental Script, Event Booking Calendar, Member Login Script, Ticket Support Script, Availability Calendar, PHP Event Calendar, Product Comparison Script, PHP Shopping Cart, Time Slots Booking Calendar, Food Delivery Script, Limo Booking Software, Vacation Rental Script, Job Listing Script, Business Directory Script, Appointment Scheduler, Shuttle Booking Software, Taxi Booking Script, Restaurant Booking System, Cleaning Business Software, Car Park Booking System, Travel Tours Script, Event Ticketing System, Member Directory Script
Provider severity
HIGH
Conflicts
1

CVE-2025-6765

A vulnerability, which was classified as critical, has been found in Intelbras InControl 2.21.60.9. This issue affects some unknown processing of the file /v1/operador/ of the component HTTP PUT Request Handler. The manipulation leads to permission issues. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

PUBLISHED
Vendor
Intelbras
Product
InControl
Provider severity
MEDIUM
Conflicts
2

CVE-2025-67649

A SQL injection vulnerability has been identified in PHP Jabbers - Car Rental Script . Improper neutralization of input provided by user into parameters responsible for sorting functions allows an unauthenticated attacker to perform SQL Injection attacks. This issue was fixed in version 4.1.

PUBLISHED
Vendor
PHP Jabbers
Product
Car Rental Script
Provider severity
CRITICAL
Conflicts
0

CVE-2025-67648

Shopware is an open commerce platform. Versions 6.4.6.0 through 6.6.10.9 and 6.7.0.0 through 6.7.5.0 have a Reflected XSS vulnerability in AuthController.php. A request parameter from the login page URL is directly rendered within the Twig template of the Storefront login page without further processing or input validation. This allows direct code injection into the template via the URL parameter, waitTime, which lacks proper input validation. This issue is fixed in versions 6.6.10.10 and 6.7.5.

PUBLISHED
Vendor
shopware
Product
shopware
Provider severity
HIGH
Conflicts
0

CVE-2025-67647

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.49.5, SvelteKit is vulnerable to a server side request forgery (SSRF) and denial of service (DoS) under certain conditions. From 2.44.0 through 2.49.4, the vulnerability results in a DoS when your app has at least one prerendered route (export const prerender = true). From 2.19.0 through 2.49.4, the vulnerability results in a DoS when your app has at least one prerendered route and you ar

PUBLISHED
Vendor
sveltejs
Product
kit
Provider severity
HIGH
Conflicts
1

CVE-2025-67646

TableProgressTracking is a MediaWiki extension to track progress against specific criterion. Versions 1.2.0 and below do not enforce CSRF token validation in the REST API. As a result, an attacker could craft a malicious webpage that, when visited by an authenticated user on a wiki with the extension enabled, would trigger unintended authenticated actions through the victim's browser. Due to the lack of token validation, an attacker can delete or track progress against tables. This issue is patc

PUBLISHED
Vendor
Telepedia
Product
TableProgressTracking
Provider severity
LOW
Conflicts
0

CVE-2025-67645

OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 7.0.4 have a broken access control in the Profile Edit endpoint. An authenticated normal user can modify the request parameters (pubpid / pid) to reference another user’s record; the server accepts the modified IDs and applies the changes to that other user’s profile. This allows one user to alter another user’s profile data (name, contact info, etc.), and could enable accou

PUBLISHED
Vendor
openemr
Product
openemr
Provider severity
HIGH
Conflicts
0

CVE-2025-67644

LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). Versions 3.0.0 and below are vulnerable to SQL injection through the checkpoint implementation. Checkpoint allows attackers to manipulate SQL queries through metadata filter keys, affecting applications that accept untrusted metadata filter keys (not just filter values) in checkpoint search operations. The _metadata_predicate() function constructs SQL queries by

PUBLISHED
Vendor
langchain-ai
Product
langgraph
Provider severity
HIGH
Conflicts
0

CVE-2025-67643

Jenkins Redpen - Pipeline Reporter for Jira Plugin 1.054.v7b_9517b_6b_202 and earlier does not correctly perform path validation of the workspace directory while uploading artifacts to Jira, allowing attackers with Item/Configure permission to retrieve files present on the Jenkins controller workspace directory.

PUBLISHED
Vendor
Jenkins Project
Product
Jenkins Redpen - Pipeline Reporter for Jira Plugin
Provider severity
MEDIUM
Conflicts
0

CVE-2025-67642

Jenkins HashiCorp Vault Plugin 371.v884a_4dd60fb_6 and earlier does not set the appropriate context for Vault credentials lookup, allowing attackers with Item/Configure permission to access and potentially capture Vault credentials they are not entitled to.

PUBLISHED
Vendor
Jenkins Project
Product
Jenkins HashiCorp Vault Plugin
Provider severity
MEDIUM
Conflicts
0

CVE-2025-67641

Jenkins Coverage Plugin 2.3054.ve1ff7b_a_a_123b_ and earlier does not validate the configured coverage results ID when creating coverage results, only when submitting the job configuration through the UI, allowing attackers with Item/Configure permission to use a `javascript:` scheme URL as identifier by configuring the job through the REST API, resulting in a stored cross-site scripting (XSS) vulnerability.

PUBLISHED
Vendor
Jenkins Project
Product
Jenkins Coverage Plugin
Provider severity
HIGH
Conflicts
0

CVE-2025-67640

Jenkins Git client Plugin 6.4.0 and earlier does not not correctly escape the path to the workspace directory as part of an argument in a temporary shell script generated by the plugin, allowing attackers able to control the workspace directory name to inject arbitrary OS commands.

PUBLISHED
Vendor
Jenkins Project
Product
Jenkins Git client Plugin
Provider severity
MEDIUM
Conflicts
0

CVE-2025-67639

A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers to trick users into logging in to the attacker's account.

PUBLISHED
Vendor
Jenkins Project
Product
Jenkins
Provider severity
LOW
Conflicts
0