Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-36730 State: PUBLISHED Published: 2025-10-14T16:24:58.356Z Last Updated: 2025-10-14T19:11:07.834Z Vendors: Windsurf Products: Windsurf Problem Types: CWE-1427 Description: A prompt injection vulnerability exists in Windsurft version 1.10.7 in Write mode using SWE-1 model. It is possible to create a file name that will be appended to the user prompt causing Windsurf to follow its instructions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/research/tra-2025-47
CVE ID: CVE-2025-36756 State: PUBLISHED Published: 2025-09-10T08:50:53.996Z Last Updated: 2025-09-10T19:27:07.146Z Vendors: SolaX Power Products: SolaX Cloud Problem Types: CWE-862, CWE-306 Description: A problem with missing authorization on SolaX Cloud platform allows taking over any SolaX solarpanel inverter of which the serial number is known. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://csirt.divd.nl/CVE-2025-36756 - https://csirt.divd.nl/DIVD-2025-00015
CVE ID: CVE-2025-36757 State: PUBLISHED Published: 2025-09-10T08:50:55.697Z Last Updated: 2025-09-10T18:50:46.301Z Vendors: SolaX Power Products: SolaX Cloud Problem Types: CWE-306 Description: It is possible to bypass the administrator login screen on SolaX Cloud. An attacker could use parameter tampering to bypass the login screen and gain limited access to the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://csirt.divd.nl/CVE-2025-36757 - https://csirt.divd.nl/DIVD-2025-00015
CVE ID: CVE-2025-36758 State: PUBLISHED Published: 2025-09-10T08:50:54.789Z Last Updated: 2025-09-10T19:13:51.954Z Vendors: SolaX Power Products: SolaX Cloud Problem Types: CWE-307 Description: It is possible to bypass the clipping level of authentication attempts in SolaX Cloud through the use of the 'Forgot Password' functionality as an oracle. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://csirt.divd.nl/CVE-2025-36758 - https://csirt.divd.nl/DIVD-2025-00015
CVE ID: CVE-2025-36759 State: PUBLISHED Published: 2025-09-10T08:50:56.409Z Last Updated: 2025-09-10T18:38:08.524Z Vendors: SolaX Power Products: SolaX Cloud Problem Types: CWE-200 Description: Through the provision of user names, SolaX Cloud will suggest (similar) user accounts and thereby leak sensitive information such as user email addresses and phone numbers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://csirt.divd.nl/CVE-2025-36759 - https://csirt.divd.nl/DIVD-2025-00015
CVE ID: CVE-2025-36845 State: PUBLISHED Published: 2025-07-21T00:00:00.000Z Last Updated: 2025-07-21T19:00:44.901Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Eveo URVE Web Manager 27.02.2025. The endpoint /_internal/redirect.php allows for Server-Side Request Forgery (SSRF). The endpoint takes a URL as input, sends a request to this address, and reflects the content in the response. This can be used to request endpoints only reachable by the application server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://smartoffice.expert/en - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-035.txt
CVE ID: CVE-2025-36846 State: PUBLISHED Published: 2025-07-21T00:00:00.000Z Last Updated: 2025-07-21T19:05:38.118Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Eveo URVE Web Manager 27.02.2025. The application exposes a /_internal/pc/vpro.php localhost endpoint to unauthenticated users that is vulnerable to OS Command Injection. The endpoint takes an input parameter that is passed directly into the shell_exec() function of PHP. NOTE: this can be chained with CVE-2025-36845. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://smartoffice.expert/en/ - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-034.txt
CVE ID: CVE-2025-36852 State: PUBLISHED Published: 2025-06-10T19:23:33.956Z Last Updated: 2025-06-10T21:35:37.274Z Vendors: Niklas Portmann, Nx Products: Azure Based Remote Cache Plugin for Nx, Minio Based Remote Cache Plugin for Nx, Nx Remote Cache Utilities, AWS S3 Remote Cache Plugin for Nx, GCS Remote Cache Plugin for Nx, Azure Blob Remote Cache Plugin for Nx, Shared File System Cache Plugin for Nx Problem Types: CWE-829 Description: A critical security vulnerability exists in remote cache extensions for common build systems utilizing bucket-based remote cache (such as those using Amazon S3, Google Cloud Storage, or similar object storage) that allows any contributor with pull request pr
those using Amazon S3, Google Cloud Storage, or similar object storage) that allows any contributor with pull request privileges to inject compromised artifacts from an untrusted environment into trusted production environments without detection. The vulnerability exploits a fundamental design flaw in the "first-to-cache wins" principle, where artifacts built in untrusted environments (feature branches, pull requests) can poison the cache used by trusted environments (protected branches, production deployments). This attack bypasses all traditional security measures including encryption, access controls, and checksum validation because the poisoning occurs during the artifact construction ph
ng encryption, access controls, and checksum validation because the poisoning occurs during the artifact construction phase, before any security measures are applied. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://nx.app/files/cve-2025-06
CVE ID: CVE-2025-36853 State: PUBLISHED Published: 2025-09-08T13:48:43.492Z Last Updated: 2025-09-08T13:52:43.781Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Microsoft Products: .NET 6.0, Microsoft.NetCore.App.Runtime.linux-arm, Microsoft.NetCore.App.Runtime.linux-arm64, Microsoft.NetCore.App.Runtime.linux-musl-arm, Microsoft.NetCore.App.Runtime.linux-musl-arm64, Microsoft.NetCore.App.Runtime.linux-musl-x64, Microsoft.NetCore.App.Runtime.linux-x64, Microsoft.NetCore.App.Runtime.osx-arm64, Microsoft.NetCore.App.Runtime.osx-x64, Microsoft.NetCore.App.Runtime.win-arm, Microsoft.NetCore.App.Runtime.win-arm64, Microsoft.NetCore.App.Runtime.win-x64, Microsoft.N
NetCore.App.Runtime.win-arm, Microsoft.NetCore.App.Runtime.win-arm64, Microsoft.NetCore.App.Runtime.win-x64, Microsoft.NetCore.App.Runtime.win-x86 Problem Types: CWE-190, CWE-122 Description: A vulnerability (CVE-2025-21172) exists in msdia140.dll due to integer overflow and heap-based overflow. Per CWE-122: Heap-based Buffer Overflow, a heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().‍ Per CWE-190: Integer Overflow or Wraparound, is when a product performs a calculation that can produce an integer overflow or wraparound when the
low or Wraparound, is when a product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number. NOTE: This CVE affects only End Of Life (EOL) software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.herodevs.com/vulnerability-directory/cve-2025-21172 -
Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.herodevs.com/vulnerability-directory/cve-2025-21172 - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21172
CVE ID: CVE-2025-36854 State: PUBLISHED Published: 2025-09-08T13:53:08.619Z Last Updated: 2025-09-08T14:01:20.382Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Microsoft Products: .NET 6.0, Microsoft.AspNetCore.Identity, Microsoft.AspNetCore.App.Runtime.win-arm, Microsoft.AspNetCore.App.Runtime.win-arm64, Microsoft.AspNetCore.App.Runtime.win-x64, Microsoft.AspNetCore.App.Runtime.win-x86, Microsoft.AspNetCore.App.Runtime.linux-arm, Microsoft.AspNetCore.App.Runtime.linux-arm64, Microsoft.AspNetCore.App.Runtime.linux-musl-arm, Microsoft.AspNetCore.App.Runtime.linux-musl-arm64, Microsoft.AspNetCore.App.Runtime.linux-musl-x64, Microsoft.AspNetCore.App.Runtime.li
tCore.App.Runtime.linux-musl-arm64, Microsoft.AspNetCore.App.Runtime.linux-musl-x64, Microsoft.AspNetCore.App.Runtime.linux-x64, Microsoft.AspNetCore.App.Runtime.osx-arm64, Microsoft.AspNetCore.App.Runtime.osx-x64 Problem Types: CWE-416 Description: A vulnerability ( CVE-2024-38229 https://www.cve.org/CVERecord ) exists in EOL ASP.NET when closing an HTTP/3 stream while application code is writing to the response body, a race condition may lead to use-after-free, resulting in Remote Code Execution. Per CWE-416: Use After Free https://cwe.mitre.org/data/definitions/416.html , Use After Free is when a product reuses or references memory after it has been freed. At some point afterward, the mem
, Use After Free is when a product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer. This issue affects EOL ASP.NET 6.0.0 <= 6.0.36 as represented in this CVE, as well as 8.0.0 <= 8.0.8, 9.0.0-preview.1.24081.5 <= 9.0.0.RC.1 as represented in CVE-2024-38229 https://www.cve.org/CVERecord . Additionally, if you've deployed self-contained applications https://docs.microsoft.com/dotnet/
/www.cve.org/CVERecord . Additionally, if you've deployed self-contained applications https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed. NOTE: This CVE only represents End Of Life (EOL) software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.herodevs.com/vulnerability-directory/cve-2024-38229 - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38229
CVE ID: CVE-2025-36855 State: PUBLISHED Published: 2025-09-08T13:57:28.386Z Last Updated: 2025-09-08T14:06:24.393Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Microsoft Products: .NET 6.0 Problem Types: CWE-126 Description: A vulnerability ( CVE-2025-21176 https://www.cve.org/CVERecord ) exists in DiaSymReader.dll due to buffer over-read. Per CWE-126: Buffer Over-read https://cwe.mitre.org/data/definitions/126.html , Buffer Over-read is when a product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer. This issue affects EOL ASP.NET 6.0.0 <= 6.0.36 as represented in this
rence memory locations after the targeted buffer. This issue affects EOL ASP.NET 6.0.0 <= 6.0.36 as represented in this CVE, as well as 8.0.0 <= 8.0.11 & <= 9.0.0 as represented in CVE-2025-21176. Additionally, if you've deployed self-contained applications https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed. NOTE: This CVE affects only End Of Life (EOL) software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:/
ture updates nor support provided upon inquiry. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.herodevs.com/vulnerability-directory/cve-2025-21176 - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21176
CVE ID: CVE-2025-36857 State: PUBLISHED Published: 2025-09-25T14:41:35.939Z Last Updated: 2025-09-25T16:03:45.231Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Rapid7 Products: Appspider Pro Problem Types: CWE-276 Description: Rapid7 Appspider Pro versions below 7.5.021, suffer from a broken access control vulnerability in the application's configuration file loading mechanism, whereby an attacker can place files in directories belonging to other users or projects. Affected versions allow standard users to add custom configuration files. These files, which are loaded in alphabetical order, can override or change the settings of the original configuration fil
ese files, which are loaded in alphabetical order, can override or change the settings of the original configuration files, creating a security vulnerability. This issue stems from improper directory access management. This vulnerability was remediated in version 7.5.021 of the product. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.rapid7.com/insight/releasenotes-2025sep/#application-security-insightappsec-and-appspider
CVE ID: CVE-2025-36887 State: PUBLISHED Published: 2025-09-04T05:17:19.856Z Last Updated: 2025-09-05T03:55:32.940Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In wl_cfgscan_update_v3_schedscan_results() of wl_cfgscan.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2025-06-01
CVE ID: CVE-2025-36890 State: PUBLISHED Published: 2025-09-04T04:49:12.764Z Last Updated: 2025-09-08T15:07:25.982Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: Elevation of Privilege Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2025-09-01
CVE ID: CVE-2025-36891 State: PUBLISHED Published: 2025-09-04T04:49:47.569Z Last Updated: 2025-09-05T03:55:46.806Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: Elevation of privilege Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2025-09-01
CVE ID: CVE-2025-36892 State: PUBLISHED Published: 2025-09-04T04:50:20.480Z Last Updated: 2025-09-04T14:02:44.197Z Vendors: Google Products: Android Problem Types: Denial of service Description: Denial of service Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2025-09-01
CVE ID: CVE-2025-36893 State: PUBLISHED Published: 2025-09-04T04:51:06.845Z Last Updated: 2025-09-04T14:02:38.667Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In ReadTachyonCommands of gxp_main_actor.cc, there is a possible information leak due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2025-09-01
CVE ID: CVE-2025-36894 State: PUBLISHED Published: 2025-09-04T04:51:22.911Z Last Updated: 2025-09-04T14:02:32.748Z Vendors: Google Products: Android Problem Types: Denial of service Description: In TBD of TBD, there is a possible DoS due to a missing null check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2025-09-01
CVE ID: CVE-2025-36895 State: PUBLISHED Published: 2025-09-04T04:51:36.059Z Last Updated: 2025-09-04T14:02:26.445Z Vendors: Google Products: Android Problem Types: Information disclosure Description: Information disclosure Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2025-09-01
CVE ID: CVE-2025-36896 State: PUBLISHED Published: 2025-09-04T04:54:42.218Z Last Updated: 2025-09-05T03:55:44.648Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: WLAN in Android before 2025-09-05 on Google Pixel devices allows elevation of privilege, aka A-394765106. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2025-09-01
CVE ID: CVE-2025-36897 State: PUBLISHED Published: 2025-09-04T04:55:12.811Z Last Updated: 2025-09-05T03:55:43.846Z Vendors: Google Products: Android Problem Types: Remote code execution Description: In unknown of cd_CnMsgCodecUserApi.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2025-09-01
CVE ID: CVE-2025-36898 State: PUBLISHED Published: 2025-09-04T04:55:49.459Z Last Updated: 2025-09-05T03:55:42.944Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: There is a possible escalation of privilege due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2025-09-01
CVE ID: CVE-2025-36899 State: PUBLISHED Published: 2025-09-04T04:56:16.174Z Last Updated: 2025-09-05T03:55:41.142Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: There is a possible escalation of privilege due to test/debugging code left in a production build. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2025-09-01
CVE ID: CVE-2025-36900 State: PUBLISHED Published: 2025-09-04T04:56:34.625Z Last Updated: 2025-09-05T03:55:39.313Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In lwis_test_register_io of lwis_device_test.c, there is a possible OOB Write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2025-09-01
CVE ID: CVE-2025-36901 State: PUBLISHED Published: 2025-09-04T04:56:59.054Z Last Updated: 2025-09-05T03:55:37.347Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: WLAN in Android before 2025-09-05 on Google Pixel devices allows elevation of privilege, aka A-396462223. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2025-09-01
CVE ID: CVE-2025-36902 State: PUBLISHED Published: 2025-09-04T04:57:39.376Z Last Updated: 2025-09-05T03:55:34.669Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In syna_cdev_ioctl_store_pid() of syna_tcm2_sysfs.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2025-09-01
CVE ID: CVE-2025-36903 State: PUBLISHED Published: 2025-09-04T04:58:03.609Z Last Updated: 2025-09-05T03:55:46.016Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In lwis_io_buffer_write, there is a possible OOB read/write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2025-09-01
CVE ID: CVE-2025-36904 State: PUBLISHED Published: 2025-09-04T04:58:29.302Z Last Updated: 2025-09-05T03:55:42.062Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: WLAN in Android before 2025-09-05 on Google Pixel devices allows elevation of privilege, aka A-396458384. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2025-09-01
CVE ID: CVE-2025-36905 State: PUBLISHED Published: 2025-09-04T04:58:58.463Z Last Updated: 2025-09-05T03:55:40.240Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In gxp_mapping_create of gxp_mapping.c, there is a possible privilege escalation due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2025-09-01
CVE ID: CVE-2025-36906 State: PUBLISHED Published: 2025-09-04T04:59:15.554Z Last Updated: 2025-09-05T17:05:48.350Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In ConvertReductionOp of darwinn_mlir_converter_aidl.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2025-09-01
CVE ID: CVE-2025-36907 State: PUBLISHED Published: 2025-09-04T04:59:31.475Z Last Updated: 2025-09-05T03:55:36.457Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In draw_surface_image() of abl/android/lib/draw/draw.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege via USB fastboot, after a bootloader unlock, with no additional execution privileges needed. User interaction is needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2025-09-01
CVE ID: CVE-2025-36908 State: PUBLISHED Published: 2025-09-04T04:59:49.039Z Last Updated: 2025-09-05T03:55:35.611Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In lwis_top_register_io of lwis_device_top.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2025-09-01
CVE ID: CVE-2025-36909 State: PUBLISHED Published: 2025-09-04T05:00:27.322Z Last Updated: 2025-09-04T20:06:36.266Z Vendors: Google Products: Android Problem Types: Information disclosure Description: Information disclosure Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2025-09-01