Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
missive CSP (Content Security Policy). Discourse's default CSP prevents this vulnerability. This vulnerability is patched in versions 2.8.13 (stable), 3.0.0.beta16 (beta) and 3.0.0beta16 (tests-passed). As a workaround, enable and/or restore your site's CSP to the default one provided with Discourse. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-8mr2-xf8r-wr8m
CVE ID: CVE-2023-22469 State: PUBLISHED Published: 2023-01-10T20:26:27.108Z Last Updated: 2025-03-10T21:30:54.229Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-922 Description: Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. When getting the reference preview for Deck cards the user has no access to, unauthorized user could eventually get the cached data of a user that has access. There are currently no known workarounds. It is recommended that the Nextcloud app Deck is upgraded to 1.8.2. Additional Analyst Notes: -
y no known workarounds. It is recommended that the Nextcloud app Deck is upgraded to 1.8.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8fjp-w9gp-j5hq - https://github.com/nextcloud/deck/pull/4196
CVE ID: CVE-2023-22470 State: PUBLISHED Published: 2023-01-14T00:32:28.697Z Last Updated: 2025-03-10T21:29:32.168Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L) Vendors: nextcloud Products: security-advisories Problem Types: CWE-400 Description: Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. A database error can be generated potentially causing a DoS when performed multiple times. There are currently no known workarounds. It is recommended that the Nextcloud Server is upgraded to 1.6.5 or 1.7.3 or 1.8.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichmen
Server is upgraded to 1.6.5 or 1.7.3 or 1.8.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-93j5-wx4c-6g88 - https://github.com/nextcloud/deck/pull/4059
CVE ID: CVE-2023-22471 State: PUBLISHED Published: 2023-01-14T00:34:06.722Z Last Updated: 2025-03-10T21:23:18.841Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L) Vendors: nextcloud Products: security-advisories Problem Types: CWE-639 Description: Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Broken access control allows a user to delete attachments of other users. There are currently no known workarounds. It is recommended that the Nextcloud Deck app is upgraded to 1.6.5 or 1.7.3 or 1.8.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://
.5 or 1.7.3 or 1.8.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2vw5-pfg6-3wm6 - https://github.com/nextcloud/deck/pull/4173
CVE ID: CVE-2023-22472 State: PUBLISHED Published: 2023-01-09T13:54:53.199Z Last Updated: 2025-03-10T21:31:17.902Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: nextcloud Products: security-advisories Problem Types: CWE-352 Description: Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. It is possible to make a user send any POST request with an arbitrary body given they click on a malicious deep link on a Windows computer. (e.g. in an email, chat link, etc). There are currently no known workarounds. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.2. Addit
here are currently no known workarounds. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4gfv-xqpx-42qj - https://github.com/nextcloud/desktop/pull/5106
CVE ID: CVE-2023-22473 State: PUBLISHED Published: 2023-01-09T14:07:14.923Z Last Updated: 2025-03-10T21:31:11.966Z Severity: LOW (CVSS 2.1 CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-284 Description: Talk-Android enables users to have video & audio calls through Nextcloud on Android. Due to passcode bypass, an attacker is able to access the user's Nextcloud files and view conversations. To exploit this the attacker needs to have physical access to the target's device. There are currently no known workarounds available. It is recommended that the Nextcloud Talk Android app is upgraded to 15.0.2. Additional Analyst Notes: -
nds available. It is recommended that the Nextcloud Talk Android app is upgraded to 15.0.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wvr4-gc4c-6vmx - https://github.com/nextcloud/talk-android/pull/2598 - https://hackerone.com/reports/1784645
CVE ID: CVE-2023-22474 State: PUBLISHED Published: 2023-02-03T19:57:09.413Z Last Updated: 2024-08-02T10:13:48.475Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: parse-community Products: parse-server Problem Types: CWE-290 Description: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server uses the request header `x-forwarded-for` to determine the client IP address. If Parse Server doesn't run behind a proxy server, then a client can set this header and Parse Server will trust the value of the header. The incorrect client IP address will be used by various features in Parse Server. This allows to
e value of the header. The incorrect client IP address will be used by various features in Parse Server. This allows to circumvent the security mechanism of the Parse Server option `masterKeyIps` by setting an allowed IP address as the `x-forwarded-for` header value. This issue has been patched in version 5.4.1. The mechanism to determine the client IP address has been rewritten. The correct IP address determination now requires to set the Parse Server option `trustProxy`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/parse-community/parse-server/security/advisories/GHSA-vm5r-c87r-pf6x - https://github.com/parse-community/parse-s
ub.com/parse-community/parse-server/security/advisories/GHSA-vm5r-c87r-pf6x - https://github.com/parse-community/parse-server/commit/e016d813e083ce6828f9abce245d15b681a224d8
CVE ID: CVE-2023-22475 State: PUBLISHED Published: 2023-01-06T14:31:02.302Z Last Updated: 2025-03-10T21:31:34.932Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: thinkst Products: canarytokens Problem Types: CWE-79 Description: Canarytokens is an open source tool which helps track activity and actions on your network. A Cross-Site Scripting vulnerability was identified in the history page of triggered Canarytokens prior to sha-fb61290. An attacker who discovers an HTTP-based Canarytoken (a URL) can use this to execute Javascript in the Canarytoken's trigger history page (domain: canarytokens.org) when the history page is later visited by the Canarytoken's c
arytoken's trigger history page (domain: canarytokens.org) when the history page is later visited by the Canarytoken's creator. This vulnerability could be used to disable or delete the affected Canarytoken, or view its activation history. It might also be used as a stepping stone towards revealing more information about the Canarytoken's creator to the attacker. For example, an attacker could recover the email address tied to the Canarytoken, or place Javascript on the history page that redirect the creator towards an attacker-controlled Canarytoken to show the creator's network location. This vulnerability is similar to CVE-2022-31113, but affected parameters reported differently from the
etwork location. This vulnerability is similar to CVE-2022-31113, but affected parameters reported differently from the Canarytoken trigger request. An attacker could only act on the discovered Canarytoken. This issue did not expose other Canarytokens or other Canarytoken creators. Canarytokens Docker images sha-fb61290 and later contain a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/thinkst/canarytokens/security/advisories/GHSA-3h2c-3fgr-74vh - https://github.com/thinkst/canarytokens/security/advisories/GHSA-5675-3424-hpqr - https://github.com/thinkst/canarytokens/commit/fb612906f2217bbb8863199694891d16e20
rity/advisories/GHSA-5675-3424-hpqr - https://github.com/thinkst/canarytokens/commit/fb612906f2217bbb8863199694891d16e20bad3e
CVE ID: CVE-2023-22476 State: PUBLISHED Published: 2023-02-23T19:00:02.754Z Last Updated: 2025-03-10T21:06:35.048Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: mantisbt Products: mantisbt Problem Types: CWE-200 Description: Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions prior to 2.25.6, due to insufficient access-level checks, any logged-in user allowed to perform Group Actions can access to the _Summary_ field of private Issues (i.e. having Private view status, or belonging to a private Project) via a crafted `bug_arr[]` parameter in *bug_actiongroup_ext.php*. This issue is fixed in version 2.25.6. There are no workarounds. Ad
`bug_arr[]` parameter in *bug_actiongroup_ext.php*. This issue is fixed in version 2.25.6. There are no workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mantisbt/mantisbt/security/advisories/GHSA-hf4x-6h87-hm79 - https://www.mantisbt.org/bugs/view.php?id=31086
CVE ID: CVE-2023-22477 State: PUBLISHED Published: 2023-01-09T14:12:24.837Z Last Updated: 2025-03-10T21:31:05.984Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: mercurius-js Products: mercurius Problem Types: CWE-248 Description: Mercurius is a GraphQL adapter for Fastify. Any users of Mercurius until version 10.5.0 are subjected to a denial of service attack by sending a malformed packet over WebSocket to `/graphql`. This issue was patched in #940. As a workaround, users can disable subscriptions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mercurius-js/mercurius/security/advisories/GHSA-cm8
Container: - CISA ADP Vulnrichment: References: - https://github.com/mercurius-js/mercurius/security/advisories/GHSA-cm8h-q92v-xcfc - https://github.com/mercurius-js/mercurius/issues/939 - https://github.com/mercurius-js/mercurius/pull/940
CVE ID: CVE-2023-22478 State: PUBLISHED Published: 2023-01-14T00:22:54.146Z Last Updated: 2025-03-10T21:29:57.856Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: KubeOperator Products: KubePi Problem Types: CWE-862 Description: KubePi is a modern Kubernetes panel. The API interfaces with unauthorized entities and may leak sensitive information. This issue has been patched in version 1.6.4. There are currently no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/KubeOperator/KubePi/security/advisories/GHSA-gqx8-hxmv-c4v4 - https://github.com/KubeOperator/KubePi/commit/0c6774bf5d9003a
eOperator/KubePi/security/advisories/GHSA-gqx8-hxmv-c4v4 - https://github.com/KubeOperator/KubePi/commit/0c6774bf5d9003ae4d60257a3f207c131ff4a6d6 - https://github.com/KubeOperator/KubePi/releases/tag/v1.6.4
CVE ID: CVE-2023-22479 State: PUBLISHED Published: 2023-01-10T20:34:08.097Z Last Updated: 2025-03-10T21:30:47.885Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: KubeOperator Products: KubePi Problem Types: CWE-384 Description: KubePi is a modern Kubernetes panel. A session fixation attack allows an attacker to hijack a legitimate user session, versions 1.6.3 and below are susceptible. A patch will be released in version 1.6.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/KubeOperator/KubePi/security/advisories/GHSA-v4w5-r2xc-7f8h
CVE ID: CVE-2023-22480 State: PUBLISHED Published: 2023-01-14T00:03:19.245Z Last Updated: 2025-03-10T21:30:05.655Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: KubeOperator Products: KubeOperator Problem Types: CWE-285 Description: KubeOperator is an open source Kubernetes distribution focused on helping enterprises plan, deploy and operate production-level K8s clusters. In KubeOperator versions 3.16.3 and below, API interfaces with unauthorized entities and can leak sensitive information. This vulnerability could be used to take over the cluster under certain conditions. This issue has been patched in version 3.16.4. Additional Analyst Notes: - CVE Program
cluster under certain conditions. This issue has been patched in version 3.16.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/KubeOperator/KubeOperator/security/advisories/GHSA-jxgp-jgh3-8jc8 - https://github.com/KubeOperator/KubeOperator/commit/7ef42bf1c16900d13e6376f8be5ecdbfdfb44aaf - https://github.com/KubeOperator/KubeOperator/releases/tag/v3.16.4
CVE ID: CVE-2023-22481 State: PUBLISHED Published: 2023-03-06T17:33:03.697Z Last Updated: 2025-02-25T15:01:23.226Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N) Vendors: FreshRSS Products: FreshRSS Problem Types: CWE-532 Description: FreshRSS is a self-hosted RSS feed aggregator. When using the greader API, the provided password is logged in clear in `users/_/log_api.txt` in the case where the authentication fails. The issues occurs in `authorizationToUser()` in `greader.php`. If there is an issue with the request or the credentials, `unauthorized()` or `badRequest()` is called. Both these functions are printing the return of `debugInfo()` in the logs. `debugInfo()`
` or `badRequest()` is called. Both these functions are printing the return of `debugInfo()` in the logs. `debugInfo()` will return the content of the request. By default, this will be saved in `users/_/log_api.txt` and if the const `COPY_LOG_TO_SYSLOG` is true, in syslogs as well. Exploiting this issue requires having access to logs produced by FreshRSS. Using the information from the logs, a malicious individual could get users' API keys (would be displayed if the users fills in a bad username) or passwords. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-8vvv-jxg6-8578 - https://github.
lnrichment: References: - https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-8vvv-jxg6-8578 - https://github.com/FreshRSS/FreshRSS/commit/075cf4c800063e3cc65c3d41a9c23222e8ebb554
CVE ID: CVE-2023-22482 State: PUBLISHED Published: 2023-01-25T18:25:15.287Z Last Updated: 2025-03-11T13:30:49.509Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: argoproj Products: argo-cd Problem Types: CWE-863 Description: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions of Argo CD starting with v1.8.2 and prior to 2.3.13, 2.4.19, 2.5.6, and 2.6.0-rc-3 are vulnerable to an improper authorization bug causing the API to accept certain invalid tokens. OIDC providers include an `aud` (audience) claim in signed tokens. The value of that claim specifies the intended audience(s) of the token (i.e. the service or services which
gned tokens. The value of that claim specifies the intended audience(s) of the token (i.e. the service or services which are meant to accept the token). Argo CD _does_ validate that the token was signed by Argo CD's configured OIDC provider. But Argo CD _does not_ validate the audience claim, so it will accept tokens that are not intended for Argo CD. If Argo CD's configured OIDC provider also serves other audiences (for example, a file storage service), then Argo CD will accept a token intended for one of those other audiences. Argo CD will grant the user privileges based on the token's `groups` claim, even though those groups were not intended to be used by Argo CD. This bug also increases
on the token's `groups` claim, even though those groups were not intended to be used by Argo CD. This bug also increases the impact of a stolen token. If an attacker steals a valid token for a different audience, they can use it to access Argo CD. A patch for this vulnerability has been released in versions 2.6.0-rc3, 2.5.6, 2.4.19, and 2.3.13. There are no workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/argoproj/argo-cd/security/advisories/GHSA-q9hr-j4rf-8fjc
CVE ID: CVE-2023-22483 State: PUBLISHED Published: 2023-01-23T22:36:14.574Z Last Updated: 2025-03-10T21:21:03.509Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: github Products: cmark-gfm Problem Types: CWE-400 Description: cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject to several polynomial time complexity issues in cmark-gfm that may lead to unbounded resource exhaustion and subsequent denial of service. Various commands, when piped to cmark-gfm with large values, cause the running time to increase quadratically. These vulnerabilities have been patched in version 0
ith large values, cause the running time to increase quadratically. These vulnerabilities have been patched in version 0.29.0.gfm.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/github/cmark-gfm/security/advisories/GHSA-29g3-96g3-jg6c
CVE ID: CVE-2023-22484 State: PUBLISHED Published: 2023-01-23T22:42:57.790Z Last Updated: 2025-03-10T21:20:57.334Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: github Products: cmark-gfm Problem Types: CWE-400, CWE-407 Description: cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject to a polynomial time complexity issue in cmark-gfm that may lead to unbounded resource exhaustion and subsequent denial of service. This vulnerability has been patched in 0.29.0.gfm.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com
29.0.gfm.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/github/cmark-gfm/security/advisories/GHSA-24f7-9frr-5h2r
CVE ID: CVE-2023-22485 State: PUBLISHED Published: 2023-01-24T00:26:57.671Z Last Updated: 2025-03-10T21:20:51.304Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: github Products: cmark-gfm Problem Types: CWE-125 Description: cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior 0.29.0.gfm.7, a crafted markdown document can trigger an out-of-bounds read in the `validate_protocol` function. We believe this bug is harmless in practice, because the out-of-bounds read accesses `malloc` metadata without causing any visible damage.This vulnerability has been patched in 0.29.0.gfm.7. Additional Analyst N
c` metadata without causing any visible damage.This vulnerability has been patched in 0.29.0.gfm.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/github/cmark-gfm/security/advisories/GHSA-c944-cv5f-hpvr
CVE ID: CVE-2023-22486 State: PUBLISHED Published: 2023-01-24T02:30:29.099Z Last Updated: 2025-03-10T21:20:44.634Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: github Products: cmark-gfm Problem Types: CWE-400, CWE-407 Description: cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 contain a polynomial time complexity issue in handle_close_bracket that may lead to unbounded resource exhaustion and subsequent denial of service. This vulnerability has been patched in 0.29.0.gfm.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github
n 0.29.0.gfm.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/github/cmark-gfm/security/advisories/GHSA-r572-jvj2-3m8p
CVE ID: CVE-2023-22487 State: PUBLISHED Published: 2023-01-11T19:49:37.668Z Last Updated: 2025-03-10T21:30:35.411Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: flarum Products: framework Problem Types: CWE-284 Description: Flarum is a forum software for building communities. Using the mentions feature provided by the flarum/mentions extension, users can mention any post ID on the forum with the special `@"<username>"#p<id>` syntax. The following behavior never changes no matter if the actor should be able to read the mentioned post or not: A URL to the mentioned post is inserted into the actor post HTML, leaking its discussion ID and post number. The `menti
A URL to the mentioned post is inserted into the actor post HTML, leaking its discussion ID and post number. The `mentionsPosts` relationship included in the `POST /api/posts` and `PATCH /api/posts/<id>` JSON responses leaks the full JSON:API payload of all mentioned posts without any access control. This includes the content, date, number and attributes added by other extensions. An attacker only needs the ability to create new posts on the forum to exploit the vulnerability. This works even if new posts require approval. If they have the ability to edit posts, the attack can be performed even more discreetly by using a single post to scan any size of database and hiding the attack post co
can be performed even more discreetly by using a single post to scan any size of database and hiding the attack post content afterward. The attack allows the leaking of all posts in the forum database, including posts awaiting approval, posts in tags the user has no access to, and private discussions created by other extensions like FriendsOfFlarum Byobu. This also includes non-comment posts like tag changes or renaming events. The discussion payload is not leaked but using the mention HTML payload it's possible to extract the discussion ID of all posts and combine all posts back together into their original discussions even if the discussion title remains unknown. All Flarum versions prior
ts back together into their original discussions even if the discussion title remains unknown. All Flarum versions prior to 1.6.3 are affected. The vulnerability has been fixed and published as flarum/core v1.6.3. As a workaround, user can disable the mentions extension. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/flarum/framework/security/advisories/GHSA-22m9-m3ww-53h3 - https://github.com/flarum/framework/commit/ab1c868b978e8b0d09a5d682c54665dae17d0985