Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-54066 State: PUBLISHED Published: 2025-07-17T14:44:27.982Z Last Updated: 2025-07-17T20:03:49.445Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) Vendors: DIRACGrid Products: diracx-web Problem Types: CWE-601 Description: DiracX-Web is a web application that provides an interface to interact with the DiracX services. Prior to version 0.1.0-a8, an attacker can forge a request that they can pass to redirect an authenticated user to another arbitrary website. In the login page, DiracX-Web has a `redirect` field which is the location where the server will redirect the user. This URI is not verified, and can be an arbitrary URI. Paired with a parameter po
ere the server will redirect the user. This URI is not verified, and can be an arbitrary URI. Paired with a parameter pollution, an attacker can hide their malicious URI. This could be used for phishing, and extract new data (such as redirecting to a new "log in" page, and asking another time credentials). Version 0.1.0-a8 fixes this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/DIRACGrid/diracx-web/security/advisories/GHSA-hfj7-542q-8fvv - https://github.com/DIRACGrid/diracx-web/commit/eba3b7bc4f9d394074215986e6d3c15b546b25d5 - https://diracx-cert.app.cern.ch/auth?redirect=https://ipcim.com/en/where/?dsdsd=qsqsfsjfnsfniizaeiaapzqlalkqkaiz
b25d5 - https://diracx-cert.app.cern.ch/auth?redirect=https://ipcim.com/en/where/?dsdsd=qsqsfsjfnsfniizaeiaapzqlalkqkaizqqijsjaopmqmxna?redirect=https://diracx-cert-app.cern.ch/auth
CVE ID: CVE-2025-54068 State: PUBLISHED Published: 2025-07-17T18:16:56.099Z Last Updated: 2025-07-17T20:27:13.084Z Vendors: livewire Products: livewire Problem Types: CWE-94 Description: Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates are hydrated. This vulnerability is unique to Livewire v3 and does not affect prior major versions. Exploitation requires a component to be mounted and configured in a particular way, but does not require authentication or user interaction. This issue ha
to be mounted and configured in a particular way, but does not require authentication or user interaction. This issue has been patched in Livewire v3.6.4. All users are strongly encouraged to upgrade to this version or later as soon as possible. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/livewire/livewire/security/advisories/GHSA-29cq-5w36-x7w3 - https://github.com/livewire/livewire/commit/ef04be759da41b14d2d129e670533180a44987dc - https://github.com/livewire/livewire/releases/tag/v3.6.4
CVE ID: CVE-2025-54070 State: PUBLISHED Published: 2025-07-17T18:25:02.492Z Last Updated: 2025-07-17T20:28:13.310Z Vendors: OpenZeppelin Products: openzeppelin-contracts Problem Types: CWE-125 Description: OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 5.2.0 and prior to version 5.4.0, the `lastIndexOf(bytes,byte,uint256)` function of the `Bytes.sol` library may access uninitialized memory when the following two conditions hold: 1) the provided buffer length is empty (i.e. `buffer.length == 0`) and position is not `2**256 - 1` (i.e. `pos != type(uint256).max`). The `pos` argument could be used to access arbitrary data outside of the buffer boun
(i.e. `pos != type(uint256).max`). The `pos` argument could be used to access arbitrary data outside of the buffer bounds. This could lead to the operation running out of gas, or returning an invalid index (outside of the empty buffer). Processing this invalid result for accessing the `buffer` would cause a revert under normal conditions. When triggered, the function reads memory at offset `buffer + 0x20 + pos`. If memory at that location (outside the `buffer`) matches the search pattern, the function would return an out of bound index instead of the expected `type(uint256).max`. This creates unexpected behavior where callers receive a valid-looking index pointing outside buffer bounds. Sub
).max`. This creates unexpected behavior where callers receive a valid-looking index pointing outside buffer bounds. Subsequent memory accesses that don't check bounds and use the returned index must carefully review the potential impact depending on their setup. Code relying on this function returning `type(uint256).max` for empty buffers or using the returned index without bounds checking could exhibit undefined behavior. Users should upgrade to version 5.4.0 to receive a patch. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-9rcw-c2f9-2j55 - https://github.com/OpenZeppelin/openzeppelin-contrac
in/openzeppelin-contracts/security/advisories/GHSA-9rcw-c2f9-2j55 - https://github.com/OpenZeppelin/openzeppelin-contracts/releases/tag/v5.4.0
CVE ID: CVE-2025-54071 State: PUBLISHED Published: 2025-07-21T20:09:17.687Z Last Updated: 2025-07-22T19:55:01.735Z Vendors: rommapp Products: romm Problem Types: CWE-434 Description: RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. In versions 4.0.0-beta.3 and below, an authenticated arbitrary file write vulnerability exists in the /api/saves endpoint. This can lead to Remote Code Execution on the system. The vulnerability permits arbitrary file write operations, allowing attackers to create or modify files at any filesystem location with user-supplied content. A user with viewer role or Scope.ASSETS_WRITE permissi
dify files at any filesystem location with user-supplied content. A user with viewer role or Scope.ASSETS_WRITE permission or above is required to pass authentication checks. The vulnerability is fixed in version 4.0.0-beta.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rommapp/romm/security/advisories/GHSA-fgxf-hggc-qqmq - https://github.com/rommapp/romm/commit/89248d03805e5fabca78443dd202ff32e0b4d9f3
CVE ID: CVE-2025-54072 State: PUBLISHED Published: 2025-07-22T21:34:43.408Z Last Updated: 2025-07-23T18:30:06.761Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: yt-dlp Products: yt-dlp Problem Types: CWE-78 Description: yt-dlp is a feature-rich command-line audio/video downloader. In versions 2025.06.25 and below, when the --exec option is used on Windows with the default placeholder (or {}), insufficient sanitization is applied to the expanded filepath, allowing for remote code execution. This is a bypass of the mitigation for CVE-2024-22423 where the default placeholder and {} were not covered by the new escaping rules. Windows users who are unable to upgr
23 where the default placeholder and {} were not covered by the new escaping rules. Windows users who are unable to upgrade should avoid using --exec altogether. Instead, the --write-info-json or --dump-json options could be used, with an external script or command line consuming the JSON output. This is fixed in version 2025.07.21. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-45hg-7f49-5h56 - https://github.com/yt-dlp/yt-dlp/commit/959ac99e98c3215437e573c22d64be42d361e863 - https://github.com/yt-dlp/yt-dlp/releases/tag/2025.07.21
CVE ID: CVE-2025-54073 State: PUBLISHED Published: 2025-07-18T15:45:09.114Z Last Updated: 2025-07-22T18:31:13.962Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: sammcj Products: mcp-package-docs Problem Types: CWE-77 Description: mcp-package-docs is an MCP (Model Context Protocol) server that provides LLMs with efficient access to package documentation across multiple programming languages and language server protocol (LSP) capabilities. A command injection vulnerability exists in the `mcp-package-docs` MCP Server prior to the fix in commit cb4ad49615275379fd6f2f1cf1ec4731eec56eb9. The vulnerability is caused by the unsanitized use of input parameters within
cb4ad49615275379fd6f2f1cf1ec4731eec56eb9. The vulnerability is caused by the unsanitized use of input parameters within a call to `child_process.exec`, enabling an attacker to inject arbitrary system commands. Successful exploitation can lead to remote code execution under the server process's privileges. The server constructs and executes shell commands using unvalidated user input directly within command-line strings. This introduces the possibility of shell metacharacter injection (`|`, `>`, `&&`, etc.). Commit cb4ad49615275379fd6f2f1cf1ec4731eec56eb9 in version 0.1.27 contains a fix for the issue, but upgrading to 0.1.28 is recommended. Additional Analyst Notes: - CISA ADP Vulnrichment:
contains a fix for the issue, but upgrading to 0.1.28 is recommended. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/sammcj/mcp-package-docs/security/advisories/GHSA-vf9j-h32g-2764 - https://github.com/sammcj/mcp-package-docs/commit/cb4ad49615275379fd6f2f1cf1ec4731eec56eb9 - https://equixly.com/blog/2025/03/29/mcp-server-new-security-nightmare - https://github.com/advisories/GHSA-3q26-f695-pp76 - https://github.com/advisories/GHSA-5w57-2ccq-8w95 - https://github.com/advisories/GHSA-gjv4-ghm7-q58q - https://github.com/sammcj/mcp-package-docs/releases/tag/v0.1.27 - https://github.com/sammcj/mcp-package-docs/releases/tag/v0.1.28 - https://invariantlabs.ai/bl
ocs/releases/tag/v0.1.27 - https://github.com/sammcj/mcp-package-docs/releases/tag/v0.1.28 - https://invariantlabs.ai/blog/mcp-github-vulnerability
CVE ID: CVE-2025-54074 State: PUBLISHED Published: 2025-08-13T13:27:28.232Z Last Updated: 2025-08-13T14:15:16.261Z Vendors: CherryHQ Products: cherry-studio Problem Types: CWE-78 Description: Cherry Studio is a desktop client that supports for multiple LLM providers. From versions 1.2.5 to 1.5.1, Cherry Studio is vulnerable to OS Command Injection during a connection with a malicious MCP server in HTTP Streamable mode. Attackers can setup a malicious MCP server with compatible OAuth authorization server endpoints and trick victims into connecting it, leading to OS command injection in vulnerable clients. This issue has been patched in version 1.5.2. Additional Analyst Notes: - CISA ADP Vulnr
njection in vulnerable clients. This issue has been patched in version 1.5.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/CherryHQ/cherry-studio/security/advisories/GHSA-8xr5-732g-84px - https://github.com/CherryHQ/cherry-studio/commit/40f9601379150854826ff3572ef7372fb0acdc38
CVE ID: CVE-2025-54075 State: PUBLISHED Published: 2025-07-18T15:47:38.236Z Last Updated: 2025-07-22T15:14:53.051Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: nuxt-modules Products: mdc Problem Types: CWE-79 Description: MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. Prior to version 0.17.2, a remote script-inclusion / stored cross-site scripting vulnerability in @nuxtjs/mdc lets a Markdown author inject a `<base href="https://attacker.tld">` element. The `<base>` tag rewrites how all subsequent relative URLs are resolved, so an attacker can make the page load scripts, styles, or images from an external,
ubsequent relative URLs are resolved, so an attacker can make the page load scripts, styles, or images from an external, attacker-controlled origin and execute arbitrary JavaScript in the site’s context. Version 0.17.2 contains a fix for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nuxt-modules/mdc/security/advisories/GHSA-cj6r-rrr9-fg82 - https://github.com/nuxt-modules/mdc/commit/3657a5bf2326a73cd3d906f57149146a412b962a
CVE ID: CVE-2025-54076 State: PUBLISHED Published: 2025-07-18T15:50:56.868Z Last Updated: 2025-07-22T15:14:21.268Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-79 Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in versions prior to 3.4.6 in the `pre_cadastro_atendido.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the `msg_e` parameter. Version 3.4.6 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrich
malicious scripts in the `msg_e` parameter. Version 3.4.6 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-vpvf-hffw-4qpc
CVE ID: CVE-2025-54077 State: PUBLISHED Published: 2025-07-18T15:53:12.103Z Last Updated: 2025-07-22T15:13:46.583Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-79 Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in versions prior to 3.4.6 in the `personalizacao.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the `err` parameter. Version 3.4.6 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: Ref
us scripts in the `err` parameter. Version 3.4.6 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-4g9x-whv2-3xr4
CVE ID: CVE-2025-54078 State: PUBLISHED Published: 2025-07-18T15:55:59.064Z Last Updated: 2025-07-18T16:14:01.157Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-79 Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in versions prior to 3.4.6 in the `personalizacao_imagem.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the `err` parameter. Version 3.4.6 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichme
malicious scripts in the `err` parameter. Version 3.4.6 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-f4j2-mxwh-rfm7
CVE ID: CVE-2025-54079 State: PUBLISHED Published: 2025-07-18T15:56:58.077Z Last Updated: 2025-07-18T16:19:04.939Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-89 Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in versions prior to 3.4.6 in the endpoint `/html/atendido/Profile_Atendido.php`, in the `idatendido` parameter. This vulnerability allow an authorized attacker to execute arbitrary SQL queries, allowing access to sensitive information. Version 3.4.6 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRede
rsion 3.4.6 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-g4v3-j8w5-33v3
CVE ID: CVE-2025-54080 State: PUBLISHED Published: 2025-08-29T14:50:17.623Z Last Updated: 2025-08-29T14:58:23.574Z Vendors: Exiv2 Products: exiv2 Problem Types: CWE-125 Description: Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds read was found in Exiv2 versions 0.28.5 and earlier. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writi
if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. The bug is fixed in version 0.28.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Exiv2/exiv2/security/advisories/GHSA-496f-x7cq-cq39 - https://github.com/Exiv2/exiv2/commit/e737332427711f15bcdc4e903203d6b7493eaec0
CVE ID: CVE-2025-54081 State: PUBLISHED Published: 2025-09-23T18:18:39.474Z Last Updated: 2025-09-23T19:17:53.733Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: LizardByte Products: Sunshine Problem Types: CWE-428 Description: Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.923.33222, the Windows service SunshineService is installed with an unquoted executable path. If Sunshine is installed in a directory whose name includes a space, the Service Control Manager (SCM) interprets the path incrementally and may execute a malicious binary placed earlier in the search string. This issue has been patched in version 2025.923.33222.
y execute a malicious binary placed earlier in the search string. This issue has been patched in version 2025.923.33222. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LizardByte/Sunshine/security/advisories/GHSA-6p7j-5v8v-w45h - https://github.com/LizardByte/Sunshine/commit/f22b00d6981f756d3531fba0028723d4a5065824 - https://github.com/LizardByte/Sunshine/releases/tag/v2025.923.33222
CVE ID: CVE-2025-54082 State: PUBLISHED Published: 2025-07-21T16:25:11.873Z Last Updated: 2025-07-21T18:01:55.023Z Vendors: marshmallow-packages Products: nova-tiptap Problem Types: CWE-434 Description: marshmallow-packages/nova-tiptap is a rich text editor for Laravel Nova based on tiptap. Prior to 5.7.0, a vulnerability was discovered in the marshmallow-packages/nova-tiptap Laravel Nova package that allows unauthenticated users to upload arbitrary files to any Laravel disk configured in the application. The vulnerability is due to missing authentication middleware (Nova and Nova.Auth) on the /nova-tiptap/api/file upload endpoint, the lack of validation on uploaded files (no MIME/type or ex
nd Nova.Auth) on the /nova-tiptap/api/file upload endpoint, the lack of validation on uploaded files (no MIME/type or extension restrictions), and the ability for an attacker to choose the disk parameter dynamically. This means an attacker can craft a custom form and send a POST request to /nova-tiptap/api/file, supplying a valid CSRF token, and upload executable or malicious files (e.g., .php, binaries) to public disks such as local, public, or s3. If a publicly accessible storage path is used (e.g. S3 with public access, or Laravel’s public disk), the attacker may gain the ability to execute or distribute arbitrary files — amounting to a potential Remote Code Execution (RCE) vector in some
e ability to execute or distribute arbitrary files — amounting to a potential Remote Code Execution (RCE) vector in some environments. This vulnerability was fixed in 5.7.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/marshmallow-packages/nova-tiptap/security/advisories/GHSA-96c2-h667-9fxp - https://github.com/marshmallow-packages/nova-tiptap/commit/fed42d2f8ebb9e3c74f1ee262c9db33567030756
CVE ID: CVE-2025-54083 State: PUBLISHED Published: 2025-09-09T20:29:17.196Z Last Updated: 2025-09-12T13:58:21.007Z Vendors: Calix Products: GigaCenter ONT Problem Types: CWE-922 Description: Insecure Storage of Sensitive Information vulnerability in Calix GigaCenter ONT (Quantenna SoC modules) allows admin access to the web interface.This issue affects GigaCenter ONT: 844E, 844G, 844GE, 854GE. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/rocola - https://www.calix.com - https://revers3everything.com/calix-case-five-0-days-five-cves/
CVE ID: CVE-2025-54084 State: PUBLISHED Published: 2025-09-09T20:37:28.023Z Last Updated: 2025-09-12T13:59:00.965Z Vendors: Calix Products: GigaCenter ONT Problem Types: CWE-78 Description: OS Command ('OS Command Injection') vulnerability in Calix GigaCenter ONT (Quantenna SoC modules) allows authenticated attackers with 'super' user credentials to execute arbitrary OS commands through improper input validation, potentially leading to full system compromise.This issue affects GigaCenter ONT: 844E, 844G, 844GE, 854GE. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/bacalao - https://www.calix.com - https://revers3everything.com/calix-case-
ences: - https://fluidattacks.com/advisories/bacalao - https://www.calix.com - https://revers3everything.com/calix-case-five-0-days-five-cves/
CVE ID: CVE-2025-54085 State: PUBLISHED Published: 2025-07-30T23:40:28.441Z Last Updated: 2025-07-31T13:31:58.019Z Vendors: Absolute Security Products: Secure Access Description: CVE-2025-54085 is a vulnerability in the management console of Absolute Secure Access prior to version 13.56. Attackers with administrative access to the console and who have been assigned a certain set of permissions can bypass those permissions to improperly read or change other settings. The attack complexity is low, there are no preexisting attack requirements; the privileges required are high, and there is no user interaction required. The impact to system confidentiality and integrity is low, there is no impac
and there is no user interaction required. The impact to system confidentiality and integrity is low, there is no impact to system availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2025-54085
CVE ID: CVE-2025-54086 State: PUBLISHED Published: 2025-10-02T19:56:37.373Z Last Updated: 2025-10-06T18:35:14.588Z Vendors: Absolute Security Products: Secure Access Description: CVE-2025-54086 is an excess permissions vulnerability in the Warehouse component of Absolute Secure Access prior to version 14.10. Attackers with access to the local file system can read the Java keystore file. The attack complexity is low, there are no attack requirements, the privileges required are low and no user interaction is required. Impact to confidentiality is low, there is no impact to integrity or availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.absolute.com/plat
ntegrity or availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2025-54086
CVE ID: CVE-2025-54087 State: PUBLISHED Published: 2025-10-02T20:05:38.092Z Last Updated: 2025-10-07T19:27:01.644Z Vendors: Absolute Security Products: Secure Access Description: CVE-2025-54087 is a server-side request forgery vulnerability in Secure Access prior to version 14.10. Attackers with administrative privileges can publish a crafted test HTTP request originating from the Secure Access server. The attack complexity is high, there are no attack requirements, and user interaction is required. There is no direct impact to confidentiality, integrity, or availability. There is a low severity subsequent system impact to integrity. Additional Analyst Notes: - CISA ADP Vulnrichment: Referen
here is a low severity subsequent system impact to integrity. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2025-54087