Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-49582 State: PUBLISHED Published: 2025-06-13T16:41:45.131Z Last Updated: 2025-06-13T17:34:44.816Z Vendors: xwiki Products: xwiki-platform Problem Types: CWE-357 Description: XWiki is a generic wiki platform. When editing content that contains "dangerous" macros like malicious script macros that were authored by a user with fewer rights, XWiki warns about the execution of these macros since XWiki 15.9RC1. These required rights analyzers that trigger these warnings are incomplete, allowing an attacker to hide malicious content. For most macros, the existing analyzers don't consider non-lowercase parameters. Further, most macro parameters that can contain XWiki syntax like titl
nalyzers don't consider non-lowercase parameters. Further, most macro parameters that can contain XWiki syntax like titles of information boxes weren't analyzed at all. Similarly, the "source" parameters of the content and context macro weren't anylzed even though they could contain arbitrary XWiki syntax. In the worst case, this could allow a malicious to add malicious script macros including Groovy or Python macros to a page that are then executed after another user with programming righs edits the page, thus allowing remote code execution. The required rights analyzers have been made more robust and extended to cover those cases in XWiki 16.4.7, 16.10.3 and 17.0.0. Additional Analyst Note
ave been made more robust and extended to cover those cases in XWiki 16.4.7, 16.10.3 and 17.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-c32m-27pj-4xcj - https://github.com/xwiki/xwiki-platform/commit/0a705e8e253cb871b804e25c53b2bde879c886bd - https://github.com/xwiki/xwiki-platform/commit/3d451e957fe2b14459e9ac64172b4a0e4c46971c - https://github.com/xwiki/xwiki-platform/commit/abdcefc0db27035b67329add836fd683e0cf92b8 - https://github.com/xwiki/xwiki-platform/commit/cc74dc802efe0e2d3fa2ba3355dbadc51c5fd8c7 - https://jira.xwiki.org/browse/XWIKI-22758 - https://jira.xwiki.org/browse/XWIKI-22759 - https://
2ba3355dbadc51c5fd8c7 - https://jira.xwiki.org/browse/XWIKI-22758 - https://jira.xwiki.org/browse/XWIKI-22759 - https://jira.xwiki.org/browse/XWIKI-22763 - https://jira.xwiki.org/browse/XWIKI-22799
CVE ID: CVE-2025-49583 State: PUBLISHED Published: 2025-06-13T17:04:49.975Z Last Updated: 2025-06-13T18:22:11.872Z Vendors: xwiki Products: xwiki-platform Problem Types: CWE-270, CWE-357 Description: XWiki is a generic wiki platform. When a user without script right creates a document with an `XWiki.Notifications.Code.NotificationEmailRendererClass` object, and later an admin edits and saves that document, the email templates in this object will be used for notifications. No malicious code can be executed, though, as while these templates allow Velocity code, the existing generic analyzer already warns admins before editing Velocity code. The main impact would thus be to send spam, e.g., wit
eneric analyzer already warns admins before editing Velocity code. The main impact would thus be to send spam, e.g., with phishing links to other users or to hide notifications about other attacks. Note that warnings before editing documents with dangerous properties have only been introduced in XWiki 15.9, before that version, this was a known issue and the advice was simply to be careful. This has been patched in XWiki 16.10.2, 16.4.7 and 15.10.16 by adding an analysis for the respective XClass properties. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-ff6v-w58f-v97w - https://github.com/xwiki/xwiki-platform
ttps://github.com/xwiki/xwiki-platform/security/advisories/GHSA-ff6v-w58f-v97w - https://github.com/xwiki/xwiki-platform/commit/3d96bf3ceb167bf0213d63f0be1f7e1732eb0a92 - https://jira.xwiki.org/browse/XWIKI-22471
CVE ID: CVE-2025-49584 State: PUBLISHED Published: 2025-06-13T17:21:33.575Z Last Updated: 2025-06-13T18:20:04.000Z Vendors: xwiki Products: xwiki-platform Problem Types: CWE-201 Description: XWiki is a generic wiki platform. In XWiki Platform versions 10.9 through 16.4.6, 16.5.0-rc-1 through 16.10.2, and 17.0.0-rc-1, the title of every single page whose reference is known can be accessed through the REST API as long as an XClass with a page property is accessible, this is the default for an XWiki installation. This allows an attacker to get titles of pages whose reference is known, one title per request. This doesn't affect fully private wikis as the REST endpoint checks access rights on the
s known, one title per request. This doesn't affect fully private wikis as the REST endpoint checks access rights on the XClass definition. The impact on confidentiality depends on the strategy for page names. By default, page names match the title, so the impact should be low but if page names are intentionally obfuscated because the titles are sensitive, the impact could be high. This has been fixed in XWiki 16.4.7, 16.10.3 and 17.0.0 by adding access control checks before getting the title of any page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-mvp5-qx9c-c3fv - https://github.com/xwiki/xwiki-platform/co
s://github.com/xwiki/xwiki-platform/security/advisories/GHSA-mvp5-qx9c-c3fv - https://github.com/xwiki/xwiki-platform/commit/ee642f973a7c95d2d146fe03c81bcdee1871f4ec - https://jira.xwiki.org/browse/XWIKI-22736
CVE ID: CVE-2025-49585 State: PUBLISHED Published: 2025-06-13T17:33:34.357Z Last Updated: 2025-06-13T18:02:11.331Z Vendors: xwiki Products: xwiki-platform Problem Types: CWE-357 Description: XWiki is a generic wiki platform. In versions before 15.10.16, 16.0.0-rc-1 through 16.4.6, and 16.5.0-rc-1 through 16.10.1, when an attacker without script or programming right creates an XClass definition in XWiki (requires edit right), and that same document is later edited by a user with script, admin, or programming right, malicious code could be executed with the rights of the editing user without prior warning. In particular, this concerns custom display code, the script of computed properties and
ing user without prior warning. In particular, this concerns custom display code, the script of computed properties and queries in database list properties. Note that warnings before editing documents with dangerous properties have only been introduced in XWiki 15.9, before that version, this was a known issue and the advice was simply to be careful. This has been patched in XWiki 16.10.2, 16.4.7 and 15.10.16 by adding an analysis for the respective XClass properties. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-59w6-r9hm-439h - https://github.com/xwiki/xwiki-platform/commit/385bde985cdb61ebf315d30c0b144b6d2
curity/advisories/GHSA-59w6-r9hm-439h - https://github.com/xwiki/xwiki-platform/commit/385bde985cdb61ebf315d30c0b144b6d2e2c2d45 - https://jira.xwiki.org/browse/XWIKI-22476
CVE ID: CVE-2025-49586 State: PUBLISHED Published: 2025-06-13T17:47:07.105Z Last Updated: 2025-06-13T18:07:37.038Z Vendors: xwiki Products: xwiki-platform Problem Types: CWE-863 Description: XWiki is an open-source wiki software platform. Any XWiki user with edit right on at least one App Within Minutes application (the default for all users XWiki) can obtain programming right/perform remote code execution by editing the application. This vulnerability has been fixed in XWiki 17.0.0, 16.4.7, and 16.10.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-jp4x-w9cj-97q7 - https://github.com/xwiki/xwiki-platform/com
://github.com/xwiki/xwiki-platform/security/advisories/GHSA-jp4x-w9cj-97q7 - https://github.com/xwiki/xwiki-platform/commit/ef978315649cf83eae396021bb33603a1a5f7e42 - https://jira.xwiki.org/browse/XWIKI-22719
CVE ID: CVE-2025-49587 State: PUBLISHED Published: 2025-06-13T17:51:48.163Z Last Updated: 2025-06-13T18:05:28.952Z Vendors: xwiki Products: xwiki-platform Problem Types: CWE-357 Description: XWiki is an open-source wiki software platform. When a user without script right creates a document with an XWiki.Notifications.Code.NotificationDisplayerClass object, and later an admin edits and saves that document, the possibly malicious content of that object is output as raw HTML, allowing XSS attacks. While the notification displayer executes Velocity, the existing generic analyzer already warns admins before editing Velocity code. Note that warnings before editing documents with dangerous properti
r already warns admins before editing Velocity code. Note that warnings before editing documents with dangerous properties have only been introduced in XWiki 15.9, before that version, this was a known issue and the advice was simply to be careful. This vulnerability has been patched in XWiki 15.10.16, 16.4.7, and 16.10.2 by adding a required rights analyzer that warns the admin before editing about the possibly malicious code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-j7p2-87q3-44w7 - https://github.com/xwiki/xwiki-platform/commit/55c5d568c4dc4619f37397d00d14dcdeab9c252d - https://jira.xwiki.org/browse/X
ttps://github.com/xwiki/xwiki-platform/commit/55c5d568c4dc4619f37397d00d14dcdeab9c252d - https://jira.xwiki.org/browse/XWIKI-22470
CVE ID: CVE-2025-49588 State: PUBLISHED Published: 2025-07-02T14:05:29.039Z Last Updated: 2025-07-02T14:23:32.937Z Vendors: linkwarden Products: linkwarden Problem Types: CWE-73 Description: Linkwarden is a self-hosted, open-source collaborative bookmark manager to collect, organize and archive webpages. In version 2.10.2, the server accepts links of format file:///etc/passwd and doesn't do any validation before sending them to parsers and playwright, this can result in leak of other user's links (and in some cases it might be possible to leak environment secrets). This issue has been patched in version 2.10.3 which has not been made public at time of publication. Additional Analyst Notes: -
ue has been patched in version 2.10.3 which has not been made public at time of publication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/linkwarden/linkwarden/security/advisories/GHSA-rfc2-x8hr-536q
CVE ID: CVE-2025-49589 State: PUBLISHED Published: 2025-06-12T20:56:38.711Z Last Updated: 2025-06-13T14:07:14.750Z Vendors: PCSX2 Products: pcsx2 Problem Types: CWE-121 Description: PCSX2 is a free and open-source PlayStation 2 (PS2) emulator. A stack-based buffer overflow exists in the Kprintf_HLE function of PCSX2 versions up to 2.3.414. Opening a disc image that logs a specially crafted message may allow a remote attacker to execute arbitrary code if the user enabled IOP Console Logging. This vulnerability is fixed in 2.3.414. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/PCSX2/pcsx2/security/advisories/GHSA-f494-4xf7-xj35 - https://github.com/PCSX2/p
hment: References: - https://github.com/PCSX2/pcsx2/security/advisories/GHSA-f494-4xf7-xj35 - https://github.com/PCSX2/pcsx2/pull/12823 - https://github.com/PCSX2/pcsx2/pull/12826
CVE ID: CVE-2025-49590 State: PUBLISHED Published: 2025-06-18T22:14:06.323Z Last Updated: 2025-06-23T16:41:36.205Z Vendors: cryptpad Products: cryptpad Problem Types: CWE-692 Description: CryptPad is a collaboration suite. Prior to version 2025.3.0, the "Link Bouncer" functionality attempts to filter javascript URIs to prevent Cross-Site Scripting (XSS), however this can be bypassed. There is an "early allow" code path that happens before the URI's protocol/scheme is checked, which a maliciously crafted URI can follow. This issue has been patched in version 2025.3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cryptpad/cryptpad/security/advisories/GHSA
onal Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cryptpad/cryptpad/security/advisories/GHSA-vq9h-x3gr-v8rj - https://github.com/cryptpad/cryptpad/commit/d5e4830ba104a4a442cb23aab5378b8565a95607 - https://github.com/cryptpad/cryptpad/blob/15c81aa8ccb737a9a1167481f4a699af331364bb/www/bounce/main.js#L64-L95
CVE ID: CVE-2025-49591 State: PUBLISHED Published: 2025-06-18T22:15:16.890Z Last Updated: 2025-06-23T16:42:24.165Z Vendors: cryptpad Products: cryptpad Problem Types: CWE-284, CWE-287 Description: CryptPad is a collaboration suite. Prior to version 2025.3.0, enforcement of Two-Factor Authentication (2FA) in CryptPad can be trivially bypassed, due to weak implementation of access controls. An attacker that compromises a user's credentials can gain access to the victim's account, even if the victim has 2FA set up. This is due to 2FA not being enforced if the path parameter is not 44 characters long, which can be bypassed by simply URL encoding a single character in the path. This issue has bee
not 44 characters long, which can be bypassed by simply URL encoding a single character in the path. This issue has been patched in version 2025.3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cryptpad/cryptpad/security/advisories/GHSA-xq5x-wgcm-3p33 - https://github.com/cryptpad/cryptpad/commit/0c5d4bbf5e5206d53470ea86a664fa2b703fb611 - https://github.com/cryptpad/cryptpad/commit/f624f9d457d36040f57c7598d98a8b9461b79837 - https://github.com/cryptpad/cryptpad/blob/15c81aa8ccb737a9a1167481f4a699af331364bb/lib/http-worker.js#L356-L364
CVE ID: CVE-2025-49592 State: PUBLISHED Published: 2025-06-26T19:45:27.862Z Last Updated: 2025-06-26T19:57:19.559Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: n8n-io Products: n8n Problem Types: CWE-601 Description: n8n is a workflow automation platform. Versions prior to 1.98.0 have an Open Redirect vulnerability in the login flow. Authenticated users can be redirected to untrusted, attacker-controlled domains after logging in, by crafting malicious URLs with a misleading redirect query parameter. This may lead to phishing attacks by impersonating the n8n UI on lookalike domains (e.g., n8n.local.evil.com), credential or 2FA theft if users are tricked in
mpersonating the n8n UI on lookalike domains (e.g., n8n.local.evil.com), credential or 2FA theft if users are tricked into re-entering sensitive information, and/or reputation risk due to the visual similarity between attacker-controlled domains and trusted ones. The vulnerability affects anyone hosting n8n and exposing the `/signin` endpoint to users. The issue has been patched in version 1.98.0. All users should upgrade to this version or later. The fix introduces strict origin validation for redirect URLs, ensuring only same-origin or relative paths are allowed after login. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/n8n-io/n8n/security/advisories/G
in. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/n8n-io/n8n/security/advisories/GHSA-5vj6-wjr7-5v9f - https://github.com/n8n-io/n8n/pull/16034 - https://github.com/n8n-io/n8n/commit/4865d1e360a0fe7b045e295b5e1a29daad12314e - https://github.com/n8n-io/n8n/releases/tag/n8n%401.98.0
CVE ID: CVE-2025-49593 State: PUBLISHED Published: 2025-06-17T21:27:38.542Z Last Updated: 2025-06-18T13:41:17.580Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: portainer Products: portainer Problem Types: CWE-200 Description: Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. Prior to STS version 2.31.0 and LTS version 2.27.7, if a Portainer administrator can be convinced to register a malicious container registry, or an existing container registry can be taken over, HTTP Headers (including registry authentication credentials or Po
, or an existing container registry can be taken over, HTTP Headers (including registry authentication credentials or Portainer session tokens) may be leaked to that registry. This issue has been patched in STS version 2.31.0 and LTS version 2.27.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/portainer/portainer/security/advisories/GHSA-h5jw-8c32-xfv6 - https://github.com/portainer/portainer/commit/384cb53c64af78af8e1ac7ef5b0f91bad530e989 - https://github.com/portainer/portainer/commit/b767dcb27ed253b423facd2e04ef971985950fd3
CVE ID: CVE-2025-49594 State: PUBLISHED Published: 2025-10-06T14:48:43.609Z Last Updated: 2025-10-23T13:16:52.688Z Vendors: xwiki-contrib Products: oidc Problem Types: CWE-285 Description: XWiki OIDC has various tools to manipulate OpenID Connect protocol in XWiki. Starting in version 2.17.1 and prior to version 2.18.2, anyone with VIEW access to a user profile can create a token for that user. If that XWiki instance is configured to allow token authentication, it allows authentication with any user (since users are very commonly viewable, at least to other registered users). Version 2.18.2 contains a patch. As a workaround, disable token access. Additional Analyst Notes: - CISA ADP Vulnrich
). Version 2.18.2 contains a patch. As a workaround, disable token access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/xwiki-contrib/oidc/security/advisories/GHSA-f2hf-pfrj-vrm7 - https://github.com/xwiki-contrib/oidc/commit/d90d717172283aaa96bb5bb44e357f910ae64adb - https://jira.xwiki.org/browse/OIDC-240
CVE ID: CVE-2025-49595 State: PUBLISHED Published: 2025-07-03T12:16:47.207Z Last Updated: 2025-07-03T13:14:59.815Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: n8n-io Products: n8n Problem Types: CWE-400 Description: n8n is a workflow automation platform. Prior to version 1.99.0, there is a denial of Service vulnerability in /rest/binary-data endpoint when processing empty filesystem URIs (filesystem:// or filesystem-v2://). This allows authenticated attackers to cause service unavailability through malformed filesystem URI requests, effecting the /rest/binary-data endpoint and n8n.cloud instances (confirmed HTTP/2 524 timeout responses). Attackers can ex
ecting the /rest/binary-data endpoint and n8n.cloud instances (confirmed HTTP/2 524 timeout responses). Attackers can exploit this by sending GET requests with empty filesystem URIs (filesystem:// or filesystem-v2://) to the /rest/binary-data endpoint, causing resource exhaustion and service disruption. This issue has been patched in version 1.99.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/n8n-io/n8n/security/advisories/GHSA-pr9r-gxgp-9rm8 - https://github.com/n8n-io/n8n/pull/16229 - https://github.com/n8n-io/n8n/commit/43c52a8b4f844e91b02e3cc9df92826a2d7b6052
CVE ID: CVE-2025-49596 State: PUBLISHED Published: 2025-06-13T20:11:40.453Z Last Updated: 2025-07-09T20:19:02.667Z Vendors: modelcontextprotocol Products: inspector Problem Types: CWE-306 Description: The MCP inspector is a developer tool for testing and debugging MCP servers. Versions of MCP Inspector below 0.14.1 are vulnerable to remote code execution due to lack of authentication between the Inspector client and proxy, allowing unauthenticated requests to launch MCP commands over stdio. Users should immediately upgrade to version 0.14.1 or later to address these vulnerabilities. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/modelcontextprotocol/inspe
bilities. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-7f8r-222p-6f5g - https://github.com/modelcontextprotocol/inspector/commit/50df0e1ec488f3983740b4d28d2a968f12eb8979 - https://thenewstack.io/mcp-vulnerability-exposes-the-ai-untrusted-code-crisis - https://www.oligo.security/blog/critical-rce-vulnerability-in-anthropic-mcp-inspector-cve-2025-49596
CVE ID: CVE-2025-49597 State: PUBLISHED Published: 2025-06-13T19:51:19.190Z Last Updated: 2025-06-23T16:08:07.251Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: handcraftedinthealps Products: goodby-csv Problem Types: CWE-915 Description: handcraftedinthealps goodby-csv is a highly memory efficient, flexible and extendable open-source CSV import/export library. Prior to 1.4.3, goodby-csv could be used as part of a chain of methods that is exploitable when an insecure deserialization vulnerability exists in an application. This so-called "gadget chain" presents no direct threat but is a vector that can be used to achieve remote code execution if the applicatio
get chain" presents no direct threat but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due to another vulnerability. The problem is patched with Version 1.4.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/handcraftedinthealps/goodby-csv/security/advisories/GHSA-x3c7-22c8-prg7 - https://github.com/handcraftedinthealps/goodby-csv/commit/acd14c6ed85116bb2cb4da35ab62821e5cf54519
CVE ID: CVE-2025-49598 State: PUBLISHED Published: 2025-06-13T20:22:37.600Z Last Updated: 2025-06-13T20:33:39.563Z Vendors: conda-forge Products: conda-forge-ci-setup-feedstock Problem Types: CWE-95 Description: conda-forge-ci-setup is a package installed by conda-forge each time a build is run on CI. The conda-forge-ci-setup-feedstock setup script is vulnerable due to the unsafe use of the eval function when parsing version information from a custom-formatted meta.yaml file. An attacker controlling meta.yaml can inject malicious code into the version assignment, which is executed during file processing, leading to arbitrary code execution. Exploitation requires an attacker to modify the rec
xecuted during file processing, leading to arbitrary code execution. Exploitation requires an attacker to modify the recipe file by manipulating the RECIPE_DIR variable and introducing a malicious meta.yaml file. While this is more feasible in CI/CD pipelines, it is uncommon in typical environments, reducing overall risk. This vulnerability is fixed in 4.15.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/conda-forge/conda-forge-ci-setup-feedstock/security/advisories/GHSA-jh2q-mrmj-hff3 - https://github.com/conda-forge/conda-forge-ci-setup-feedstock/commit/fd91cb271c01f0e7928ebdc1feaac96fe385f959
CVE ID: CVE-2025-49599 State: PUBLISHED Published: 2025-06-06T00:00:00.000Z Last Updated: 2025-06-09T15:17:51.874Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N) Vendors: Huawei Products: EG8141A5, EG8145V5, EG8145V5-V2 Problem Types: CWE-863 Description: Huawei EG8141A5 devices through V5R019C00S100, EG8145V5 devices through V5R019C00S100, and EG8145V5-V2 devices through V5R021C00S184 allow the Epuser account to disable ONT firewall functionality, e.g., to remove the default blocking of the SSH and TELNET TCP ports, aka HWNO-56Q3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.youtube.com/watch?v=l1eYpcNvZdQ
CVE ID: CVE-2025-49600 State: PUBLISHED Published: 2025-07-04T00:00:00.000Z Last Updated: 2025-07-08T14:36:23.748Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N) Vendors: Mbed Products: mbedtls Problem Types: CWE-325 Description: In MbedTLS 3.3.0 before 3.6.4, mbedtls_lms_verify may accept invalid signatures if hash computation fails and internal errors go unchecked, enabling LMS (Leighton-Micali Signature) forgery in a fault scenario. Specifically, unchecked return values in mbedtls_lms_verify allow an attacker (who can induce a hardware hash accelerator fault) to bypass LMS signature verification by reusing stale stack data, resulting in acceptance of an invalid s