Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
to version 0.16.10 to receive a patch. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/wolfi-dev/wolfictl/security/advisories/GHSA-8fg7-hp93-qhvr - https://github.com/wolfi-dev/wolfictl/commit/0d06e1578300327c212dda26a5ab31d09352b9d0 - https://github.com/wolfi-dev/wolfictl/commit/403e93569f46766b4e26e06cf9cd0cae5ee0c2a2 - https://github.com/wolfi-dev/wolfictl/blob/488b53823350caa706de3f01ec0eded9350c7da7/pkg/update/update.go#L143 - https://github.com/wolfi-dev/wolfictl/blob/4dd6c95abb4bc0f9306350a8601057bd7a92bded/pkg/update/deps/cleanup.go#L49 - https://github.com/wolfi-dev/wolfictl/blob/6d99909f7b1aa23f732d84dad054b02a61f530e6/pk
/pkg/update/deps/cleanup.go#L49 - https://github.com/wolfi-dev/wolfictl/blob/6d99909f7b1aa23f732d84dad054b02a61f530e6/pkg/git/git.go#L22
CVE ID: CVE-2024-35184 State: PUBLISHED Published: 2024-05-15T21:29:33.712Z Last Updated: 2024-08-02T03:07:46.811Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: paperless-ngx Products: paperless-ngx Problem Types: CWE-287 Description: Paperless-ngx is a document management system that transforms physical documents into a searchable online archive. Starting in version 2.5.0 and prior to version 2.8.6, remote user authentication allows API access even if API access is explicitly disabled. Version 2.8.6 contains a patchc for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/paperless-ngx/pa
ional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/paperless-ngx/paperless-ngx/security/advisories/GHSA-72w4-hxqq-c256 - https://github.com/paperless-ngx/paperless-ngx/pull/6739 - https://github.com/paperless-ngx/paperless-ngx/commit/ed05b40ba461641b1b59b0a92f51f3f6a66ce180 - https://github.com/paperless-ngx/paperless-ngx/releases/tag/v2.8.6
CVE ID: CVE-2024-35185 State: PUBLISHED Published: 2024-05-16T15:15:13.530Z Last Updated: 2024-08-02T03:07:46.733Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: stacklok Products: minder Problem Types: CWE-400, CWE-770 Description: Minder is a software supply chain security platform. Prior to version 0.0.49, the Minder REST ingester is vulnerable to a denial of service attack via an attacker-controlled REST endpoint that can crash the Minder server. The REST ingester allows users to interact with REST endpoints to fetch data for rule evaluation. When fetching data with the REST ingester, Minder sends a request to an endpoint and will use the data from the
uation. When fetching data with the REST ingester, Minder sends a request to an endpoint and will use the data from the body of the response as the data to evaluate against a certain rule. If the response is sufficiently large, it can drain memory on the machine and crash the Minder server. The attacker can control the remote REST endpoints that Minder sends requests to, and they can configure the remote REST endpoints to return responses with large bodies. They would then instruct Minder to send a request to their configured endpoint that would return the large response which would crash the Minder server. Version 0.0.49 fixes this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: -
ich would crash the Minder server. Version 0.0.49 fixes this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/stacklok/minder/security/advisories/GHSA-fjw8-3gp8-4cvx - https://github.com/stacklok/minder/commit/065049336aac0621ee00a0bb2211f8051d47c14b
CVE ID: CVE-2024-35186 State: PUBLISHED Published: 2024-05-23T08:55:20.653Z Last Updated: 2024-08-02T03:07:46.876Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Byron Products: gitoxide Problem Types: CWE-23 Description: gitoxide is a pure Rust implementation of Git. During checkout, `gix-worktree-state` does not verify that paths point to locations in the working tree. A specially crafted repository can, when cloned, place new files anywhere writable by the application. This vulnerability leads to a major loss of confidentiality, integrity, and availability, but creating files outside a working tree without attempting to execute code can directly impact int
, and availability, but creating files outside a working tree without attempting to execute code can directly impact integrity as well. This vulnerability has been patched in version(s) 0.36.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Byron/gitoxide/security/advisories/GHSA-7w47-3wg8-547c
CVE ID: CVE-2024-35187 State: PUBLISHED Published: 2024-05-16T15:16:57.797Z Last Updated: 2024-08-02T03:07:46.856Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: stalwartlabs Products: mail-server Problem Types: CWE-863 Description: Stalwart Mail Server is an open-source mail server. Prior to version 0.8.0, attackers who achieved Arbitrary Code Execution as the stalwart-mail user (including web interface admins) can gain complete root access to the system. Usually, system services are run as a separate user (not as root) to isolate an attacker with Arbitrary Code Execution to the current service. Therefore, other system services and the system itself rema
tacker with Arbitrary Code Execution to the current service. Therefore, other system services and the system itself remains protected in case of a successful attack. stalwart-mail runs as a separate user, but it can give itself full privileges again in a simple way, so this protection is practically ineffective. Server admins who handed out the admin credentials to the mail server, but didn't want to hand out complete root access to the system, as well as any attacked user when the attackers gained Arbitrary Code Execution using another vulnerability, may be vulnerable. Version 0.8.0 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: R
sion 0.8.0 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/stalwartlabs/mail-server/security/advisories/GHSA-rwp5-f854-ppg6
CVE ID: CVE-2024-35189 State: PUBLISHED Published: 2024-05-30T19:47:43.080Z Last Updated: 2024-08-02T03:07:46.734Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: ethyca Products: fides Problem Types: CWE-201, CWE-200 Description: Fides is an open-source privacy engineering platform. The Fides webserver has a number of endpoints that retrieve `ConnectionConfiguration` records and their associated `secrets` which _can_ contain sensitive data (e.g. passwords, private keys, etc.). These `secrets` are stored encrypted at rest (in the application database), and the associated endpoints are not meant to expose that sensitive data in plaintext to API clients, as it
n database), and the associated endpoints are not meant to expose that sensitive data in plaintext to API clients, as it could be compromising. Fides's developers have available to them a Pydantic field-attribute (`sensitive`) that they can annotate as `True` to indicate that a given secret field should not be exposed via the API. The application has an internal function that uses `sensitive` annotations to mask the sensitive fields with a `"**********"` placeholder value. This vulnerability is due to a bug in that function, which prevented `sensitive` API model fields that were _nested_ below the root-level of a `secrets` object from being masked appropriately. Only the `BigQuery` connectio
were _nested_ below the root-level of a `secrets` object from being masked appropriately. Only the `BigQuery` connection configuration secrets meets these criteria: the secrets schema has a nested sensitive `keyfile_creds.private_key` property that is exposed in plaintext via the APIs. Connection types other than `BigQuery` with sensitive fields at the root-level that are not nested are properly masked with the placeholder and are not affected by this vulnerability. This vulnerability has been patched in Fides version 2.37.0. Users are advised to upgrade to this version or later to secure their systems against this threat. Users are also advised to rotate any Google Cloud secrets used for B
later to secure their systems against this threat. Users are also advised to rotate any Google Cloud secrets used for BigQuery integrations in their Fides deployments. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/ethyca/fides/security/advisories/GHSA-rcvg-jj3g-rj7c - https://cloud.google.com/iam/docs/key-rotation
CVE ID: CVE-2024-35190 State: PUBLISHED Published: 2024-05-17T16:55:41.346Z Last Updated: 2024-08-02T03:07:46.821Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: asterisk Products: asterisk Problem Types: CWE-303, CWE-480, CWE-670 Description: Asterisk is an open source private branch exchange and telephony toolkit. After upgrade to 18.23.0, ALL unauthorized SIP requests are identified as PJSIP Endpoint of local asterisk server. This vulnerability is fixed in 18.23.1, 20.8.1, and 21.3.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/asterisk/asterisk/security/advisories/GHSA-qqxj-v78h-hrf9 - htt
CVE Program Container: References: - https://github.com/asterisk/asterisk/security/advisories/GHSA-qqxj-v78h-hrf9 - https://github.com/asterisk/asterisk/pull/600 - https://github.com/asterisk/asterisk/pull/602 - https://github.com/asterisk/asterisk/commit/85241bd22936cc15760fd1f65d16c98be7aeaf6d
CVE ID: CVE-2024-35191 State: PUBLISHED Published: 2024-05-20T20:26:24.492Z Last Updated: 2024-08-02T03:07:46.830Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: verbb Products: formie Problem Types: CWE-1336 Description: Formie is a Craft CMS plugin for creating forms. Prior to 2.1.6, users with access to a form's settings can include malicious Twig code into fields that support Twig. These might be the Submission Title or the Success Message. This code will then be executed upon creating a submission, or rendering the text. This has been fixed in Formie 2.1.6. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https:
fixed in Formie 2.1.6. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/verbb/formie/security/advisories/GHSA-v45m-hxqp-fwf5 - https://github.com/verbb/formie/commit/90296edf7e707f117e760aa57e70dbd43a854420
CVE ID: CVE-2024-35192 State: PUBLISHED Published: 2024-05-20T20:36:56.695Z Last Updated: 2024-08-02T03:07:47.025Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N) Vendors: aquasecurity Products: trivy Problem Types: CWE-522 Description: Trivy is a security scanner. Prior to 0.51.2, if a malicious actor is able to trigger Trivy to scan container images from a crafted malicious registry, it could result in the leakage of credentials for legitimate registries such as AWS Elastic Container Registry (ECR), Google Cloud Artifact/Container Registry, or Azure Container Registry (ACR). These tokens can then be used to push/pull images from those registries to which the identi
re Container Registry (ACR). These tokens can then be used to push/pull images from those registries to which the identity/user running Trivy has access. Systems are not affected if the default credential provider chain is unable to obtain valid credentials. This vulnerability only applies when scanning container images directly from a registry. This vulnerability is fixed in 0.51.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/aquasecurity/trivy/security/advisories/GHSA-xcq4-m2r3-cmrj - https://github.com/aquasecurity/trivy/commit/e7f14f729de259551203f313e57d2d9d3aa2ff87
CVE ID: CVE-2024-35194 State: PUBLISHED Published: 2024-05-20T20:44:10.562Z Last Updated: 2024-08-02T03:07:46.859Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: stacklok Products: minder Problem Types: CWE-400 Description: Minder is a software supply chain security platform. Prior to version 0.0.50, Minder engine is susceptible to a denial of service from memory exhaustion that can be triggered from maliciously created templates. Minder engine uses templating to generate strings for various use cases such as URLs, messages for pull requests, descriptions for advisories. In some cases can the user control both the template and the params for it, and in a su
ts, descriptions for advisories. In some cases can the user control both the template and the params for it, and in a subset of these cases, Minder reads the generated template entirely into memory. When Minders templating meets both of these conditions, an attacker is able to generate large enough templates that Minder will exhaust memory and crash. This vulnerability is fixed in 0.0.50. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/stacklok/minder/security/advisories/GHSA-crgc-2583-rw27 - https://github.com/stacklok/minder/commit/fe321d345b4f738de6a06b13207addc72b59f892
CVE ID: CVE-2024-35195 State: PUBLISHED Published: 2024-05-20T20:14:48.206Z Last Updated: 2025-07-31T03:56:03.717Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N) Vendors: psf Products: requests Problem Types: CWE-670 Description: Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. This vulnerability is fixed in 2.32.0. Additional
continue for the lifecycle of the connection in the connection pool. This vulnerability is fixed in 2.32.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/psf/requests/security/advisories/GHSA-9wx4-h78v-vm56 - https://github.com/psf/requests/pull/6655 - https://github.com/psf/requests/commit/a58d7f2ffb4d00b46dca2d70a3932a0b37e22fac - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IYLSNK5TL46Q6XPRVMHVWS63MVJQOK4Q/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N7WP6EYDSUOCOJYHDK5NX43PYZ4SNHGZ/
CVE ID: CVE-2024-35196 State: PUBLISHED Published: 2024-05-31T17:25:55.716Z Last Updated: 2024-08-02T03:07:46.866Z Severity: LOW (CVSS 2 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N) Vendors: getsentry Products: sentry Problem Types: CWE-532 Description: Sentry is a developer-first error tracking and performance monitoring platform. Sentry's Slack integration incorrectly records the incoming request body in logs. This request data can contain sensitive information, including the deprecated Slack verification token. With this verification token, it is possible under specific configurations, an attacker can forge requests and act as the Slack integration. The request body is leaked in log entr
configurations, an attacker can forge requests and act as the Slack integration. The request body is leaked in log entries matching `event == "slack.*" && name == "sentry.integrations.slack" && request_data == *`. The deprecated slack verification token, will be found in the `request_data.token` key. **SaaS users** do not need to take any action. **Self-hosted users** should upgrade to version 24.5.0 or higher, rotate their Slack verification token, and use the Slack Signing Secret instead of the verification token. For users only using the `slack.signing-secret` in their self-hosted configuration, the legacy verification token is not used to verify the webhook payload. It is ignored. Users
self-hosted configuration, the legacy verification token is not used to verify the webhook payload. It is ignored. Users unable to upgrade should either set the `slack.signing-secret` instead of `slack.verification-token`. The signing secret is Slack's recommended way of authenticating webhooks. By having `slack.singing-secret` set, Sentry self-hosted will no longer use the verification token for authentication of the webhooks, regardless of whether `slack.verification-token` is set or not. Alternatively if the self-hosted instance is unable to be upgraded or re-configured to use the `slack.signing-secret`, the logging configuration can be adjusted to not generate logs from the integration.
to use the `slack.signing-secret`, the logging configuration can be adjusted to not generate logs from the integration. The default logging configuration can be found in `src/sentry/conf/server.py`. **Services should be restarted once the configuration change is saved.** Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/getsentry/sentry/security/advisories/GHSA-c2g2-gx4j-rj3j - https://github.com/getsentry/sentry/pull/70508 - https://api.slack.com/authentication/verifying-requests-from-slack#app-management-updates - https://api.slack.com/authentication/verifying-requests-from-slack#deprecation - https://api.slack.com/authentication/v
https://api.slack.com/authentication/verifying-requests-from-slack#deprecation - https://api.slack.com/authentication/verifying-requests-from-slack#regenerating - https://develop.sentry.dev/integrations/slack - https://github.com/getsentry/sentry/blob/17d2b87e39ccd57e11da4deed62971ff306253d1/src/sentry/conf/server.py#L1307
CVE ID: CVE-2024-35197 State: PUBLISHED Published: 2024-05-23T12:09:09.044Z Last Updated: 2024-08-02T03:07:46.729Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Byron Products: gitoxide Problem Types: CWE-67 Description: gitoxide is a pure Rust implementation of Git. On Windows, fetching refs that clash with legacy device names reads from the devices, and checking out paths that clash with such names writes arbitrary data to the devices. This allows a repository, when cloned, to cause indefinite blocking or the production of arbitrary message that appear to have come from the application, and potentially other harmful effects under limited circumstances. I
sage that appear to have come from the application, and potentially other harmful effects under limited circumstances. If Windows is not used, or untrusted repositories are not cloned or otherwise used, then there is no impact. A minor degradation in availability may also be possible, such as with a very large file named `CON`, though the user could interrupt the application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Byron/gitoxide/security/advisories/GHSA-49jc-r788-3fc9
CVE ID: CVE-2024-35198 State: PUBLISHED Published: 2024-07-18T22:40:08.176Z Last Updated: 2024-08-07T16:00:46.093Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: pytorch Products: serve Problem Types: CWE-706 Description: TorchServe is a flexible and easy-to-use tool for serving and scaling PyTorch models in production. TorchServe 's check on allowed_urls configuration can be by-passed if the URL contains characters such as ".." but it does not prevent the model from being downloaded into the model store. Once a file is downloaded, it can be referenced without providing a URL the second time, which effectively bypasses the allowed_urls security check. Cus
n be referenced without providing a URL the second time, which effectively bypasses the allowed_urls security check. Customers using PyTorch inference Deep Learning Containers (DLC) through Amazon SageMaker and EKS are not affected. This issue in TorchServe has been fixed by validating the URL without characters such as ".." before downloading see PR #3082. TorchServe release 0.11.0 includes the fix to address this vulnerability. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/pytorch/serve/security/advisories/GHSA-wxcx-gg9c-fwp2 - https://github.c
ram Container: References: - https://github.com/pytorch/serve/security/advisories/GHSA-wxcx-gg9c-fwp2 - https://github.com/pytorch/serve/pull/3082 - https://github.com/pytorch/serve/releases/tag/v0.11.0
CVE ID: CVE-2024-35199 State: PUBLISHED Published: 2024-07-18T22:40:06.549Z Last Updated: 2024-08-07T15:59:53.795Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) Vendors: pytorch Products: serve Problem Types: CWE-668 Description: TorchServe is a flexible and easy-to-use tool for serving and scaling PyTorch models in production. In affected versions the two gRPC ports 7070 and 7071, are not bound to [localhost](http://localhost/) by default, so when TorchServe is launched, these two interfaces are bound to all interfaces. Customers using PyTorch inference Deep Learning Containers (DLC) through Amazon SageMaker and EKS are not affected. This issue in TorchServe has bee
rence Deep Learning Containers (DLC) through Amazon SageMaker and EKS are not affected. This issue in TorchServe has been fixed in PR #3083. TorchServe release 0.11.0 includes the fix to address this vulnerability. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/pytorch/serve/security/advisories/GHSA-hhpg-v63p-wp7w - https://github.com/pytorch/serve/pull/3083 - https://github.com/pytorch/serve/releases/tag/v0.11.0
CVE ID: CVE-2024-35200 State: PUBLISHED Published: 2024-05-29T16:02:05.342Z Last Updated: 2025-02-13T17:52:32.647Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: F5 Products: NGINX Open Source, NGINX Plus Problem Types: CWE-476 Description: When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can cause NGINX worker processes to terminate. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://my.f5.com/manage/s/article/K000139612 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R7RPLWC35WHEUFCGKNFG62ESNID25TEZ/ - http:
doraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R7RPLWC35WHEUFCGKNFG62ESNID25TEZ/ - http://www.openwall.com/lists/oss-security/2024/05/30/4 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MLAOKJWDALQZBIV3WKGPJ6T5Z56D3PRD/
CVE ID: CVE-2024-35201 State: PUBLISHED Published: 2024-11-13T21:11:02.599Z Last Updated: 2024-11-14T19:40:23.617Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) SDP Tool for Windows software Problem Types: escalation of privilege, CWE-276 Description: Incorrect default permissions in the Intel(R) SDP Tool for Windows software all versions may allow an authenticated user to enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01179.html
CVE ID: CVE-2024-35202 State: PUBLISHED Published: 2024-10-10T00:00:00 Last Updated: 2024-10-10T15:24:42.395Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bitcoin Core before 25.0 allows remote attackers to cause a denial of service (blocktxn message-handling assertion and node exit) by including transactions in a blocktxn message that are not committed to in a block's merkle root. FillBlock can be called twice for one PartiallyDownloadedBlock instance. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures - https://github.com/bitcoin/bitcoin/releases/tag/v25.0 - https://bitcoincore.org/en/2024/10/08/dis