Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-48447 State: PUBLISHED Published: 2025-06-11T14:37:45.457Z Last Updated: 2025-06-11T15:36:46.018Z Vendors: Drupal Products: Lightgallery Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Lightgallery allows Cross-Site Scripting (XSS).This issue affects Lightgallery: from 0.0.0 before 1.6.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-069
CVE ID: CVE-2025-48448 State: PUBLISHED Published: 2025-06-11T14:36:15.275Z Last Updated: 2025-06-11T15:45:14.796Z Vendors: Drupal Products: Admin Audit Trail Problem Types: CWE-770 Description: Allocation of Resources Without Limits or Throttling vulnerability in Drupal Admin Audit Trail allows Excessive Allocation.This issue affects Admin Audit Trail: from 0.0.0 before 1.0.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-068
CVE ID: CVE-2025-48459 State: PUBLISHED Published: 2025-09-24T07:57:24.444Z Last Updated: 2025-11-04T21:11:05.598Z Vendors: Apache Software Foundation Products: Apache IoTDB Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 before 2.0.5. Users are recommended to upgrade to version 2.0.5, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/mr84n19nv8d0bmcrfsj3mm5ff5qn4q2f
CVE ID: CVE-2025-48461 State: PUBLISHED Published: 2025-06-24T02:02:08.633Z Last Updated: 2025-06-25T13:23:33.993Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Advantech Products: Advantech Wireless Sensing and Equipment (WISE) Description: Successful exploitation of the vulnerability could allow an unauthenticated attacker to conduct brute force guessing and account takeover as the session cookies are predictable, potentially allowing the attackers to gain root, admin or user access and reset passwords. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-061/
CVE ID: CVE-2025-48462 State: PUBLISHED Published: 2025-06-24T02:08:58.607Z Last Updated: 2025-06-25T13:25:06.014Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Advantech Products: Advantech Wireless Sensing and Equipment (WISE) Description: Successful exploitation of the vulnerability could allow an attacker to consume all available session slots and block other users from logging in, thereby preventing legitimate users from gaining access to the product. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-061
CVE ID: CVE-2025-48463 State: PUBLISHED Published: 2025-06-24T02:10:39.085Z Last Updated: 2025-06-25T13:14:07.630Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Advantech Products: Advantech Wireless Sensing and Equipment (WISE) Description: Successful exploitation of the vulnerability could allow an attacker to intercept data and conduct session hijacking on the exposed data as the vulnerable product uses unencrypted HTTP communication, potentially leading to unauthorised access or data tampering. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-061
CVE ID: CVE-2025-48464 State: PUBLISHED Published: 2025-10-08T06:50:11.081Z Last Updated: 2025-10-08T17:27:07.706Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: DuckDuckGo Products: DuckDuckGo Browser Problem Types: CWE-200 Description: Successful exploitation of the vulnerability could allow an unauthenticated attacker to gain access to a victim’s Sync account data such as account credentials and email protection information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-097/ - https://tuxplorer.com/posts/dont-leave-me-outdated/
CVE ID: CVE-2025-48466 State: PUBLISHED Published: 2025-06-24T02:12:41.743Z Last Updated: 2025-06-25T12:59:38.016Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: Advantech Products: Advantech Wireless Sensing and Equipment (WISE) Description: Successful exploitation of the vulnerability could allow an unauthenticated, remote attacker to send Modbus TCP packets to manipulate Digital Outputs, potentially allowing remote control of relay channel which may lead to operational or safety risks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-061 - https://github.com/shipcod3/CVE-2025-48466
CVE ID: CVE-2025-48467 State: PUBLISHED Published: 2025-06-24T02:14:44.681Z Last Updated: 2025-06-25T13:21:55.559Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Advantech Products: Advantech Wireless Sensing and Equipment (WISE) Description: Successful exploitation of the vulnerability could allow an attacker to cause repeated reboots, potentially leading to remote denial-of-service and system unavailability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-061
CVE ID: CVE-2025-48468 State: PUBLISHED Published: 2025-06-24T02:16:21.830Z Last Updated: 2025-06-25T13:30:04.047Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Advantech Products: Advantech Wireless Sensing and Equipment (WISE) Description: Successful exploitation of the vulnerability could allow an attacker that has physical access to interface with JTAG to inject or modify firmware. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-061
CVE ID: CVE-2025-48469 State: PUBLISHED Published: 2025-06-24T02:17:41.939Z Last Updated: 2025-06-25T12:57:05.750Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Advantech Products: Advantech Wireless Sensing and Equipment (WISE) Description: Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload firmware through a public update page, potentially leading to backdoor installation or privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-061/ - https://jro.sg/CVEs/CVE-2025-48469/
CVE ID: CVE-2025-48470 State: PUBLISHED Published: 2025-06-24T02:19:33.670Z Last Updated: 2025-06-25T13:01:16.041Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L) Vendors: Advantech Products: Advantech Wireless Sensing and Equipment (WISE) Description: Successful exploitation of the stored cross-site scripting vulnerability could allow an attacker to inject malicious scripts into device fields and executed in other users’ browser, potentially leading to session hijacking, defacement, credential theft, or privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-061
CVE ID: CVE-2025-48471 State: PUBLISHED Published: 2025-05-29T15:17:11.682Z Last Updated: 2025-05-29T15:42:16.001Z Vendors: freescout-help-desk Products: freescout Problem Types: CWE-434 Description: FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.179, the application does not check or performs insufficient checking of files uploaded to the application. This allows files to be uploaded with the phtml and phar extensions, which can lead to remote code execution if the Apache web server is used. This issue has been patched in version 1.8.179. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/freescout-help-desk/freescout/secu
. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-h2f3-932h-v38j - https://github.com/freescout-help-desk/freescout/commit/e136660e8dbc220454b8d3f646dd1b144e49e9ed
CVE ID: CVE-2025-48472 State: PUBLISHED Published: 2025-05-29T15:18:58.406Z Last Updated: 2025-05-29T15:36:15.931Z Vendors: freescout-help-desk Products: freescout Problem Types: CWE-863 Description: FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.179, there is no check to ensure that the user is disabling notifications for the mailbox to which they already have access. Moreover, the code explicitly implements functionality that if the user does not have access to the mailbox, then after disabling (enabling) notifications for this mailbox, the user will gain access to it. This issue has been patched in version 1.8.179. Additional Analyst Notes: - CISA ADP V
the user will gain access to it. This issue has been patched in version 1.8.179. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-f62r-8354-8pqg - https://github.com/freescout-help-desk/freescout/commit/01c91d2086ddd56778698e557138a178b2f59916
CVE ID: CVE-2025-48473 State: PUBLISHED Published: 2025-05-29T15:27:52.137Z Last Updated: 2025-05-29T15:43:38.768Z Vendors: freescout-help-desk Products: freescout Problem Types: CWE-863 Description: FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.179, when creating a conversation from a message in another conversation, there is no check to ensure that the user has the ability to view this message. Thus, the user can view arbitrary messages from other mailboxes or from other conversations to which they do not have access (access restriction to conversations is implemented by the show_only_assigned_conversations setting, which is also not checked). This issu
n to conversations is implemented by the show_only_assigned_conversations setting, which is also not checked). This issue has been patched in version 1.8.179. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-3x75-7856-r794 - https://github.com/freescout-help-desk/freescout/commit/2552a2b84248824b73c35b2699aa86da644eea1a
CVE ID: CVE-2025-48474 State: PUBLISHED Published: 2025-05-29T15:55:47.132Z Last Updated: 2025-05-29T17:57:41.208Z Vendors: freescout-help-desk Products: freescout Problem Types: CWE-863 Description: FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the application incorrectly checks user access rights for conversations. Users with show_only_assigned_conversations enabled can assign themselves to an arbitrary conversation from the mailbox to which they have access, thereby bypassing the restriction on viewing conversations. This issue has been patched in version 1.8.180. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/
as been patched in version 1.8.180. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-9wc4-vchw-mr3m - https://github.com/freescout-help-desk/freescout/commit/87cdb65d6b632b5292bcac2d7a209f6e36ae51d7
CVE ID: CVE-2025-48475 State: PUBLISHED Published: 2025-05-29T16:27:43.554Z Last Updated: 2025-05-29T17:58:01.308Z Vendors: freescout-help-desk Products: freescout Problem Types: CWE-863 Description: FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the System does not provide a check on which "clients" of the System an authorized user can view and edit, and which ones they cannot. As a result, an authorized user who does not have access to any of the existing mailboxes, as well as to any of the existing conversations, has the ability to view and edit the System's clients. The limitation of client visibility can be implemented by the limit_user_customer_
o view and edit the System's clients. The limitation of client visibility can be implemented by the limit_user_customer_visibility setting, however, in the specified scenarios, there is no check for the presence of this setting. This issue has been patched in version 1.8.180. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-xvch-f75c-8w8q - https://github.com/freescout-help-desk/freescout/commit/1f154ce039618ed5abd960c97619c23534c0717a
CVE ID: CVE-2025-48476 State: PUBLISHED Published: 2025-05-30T04:30:09.425Z Last Updated: 2025-05-30T22:01:35.949Z Vendors: freescout-help-desk Products: freescout Problem Types: CWE-841 Description: FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, when adding and editing user records using the fill() method, there is no check for the absence of the password field in the data coming from the user, which leads to a mass-assignment vulnerability. As a result, a user with the right to edit other users of the system can change their password, and then log in to the system using the set password. This issue has been patched in version 1.8.180. Additional Ana
rd, and then log in to the system using the set password. This issue has been patched in version 1.8.180. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-7h5m-q39p-h849
CVE ID: CVE-2025-48477 State: PUBLISHED Published: 2025-05-30T04:31:42.185Z Last Updated: 2025-05-30T22:01:30.108Z Vendors: freescout-help-desk Products: freescout Problem Types: CWE-841 Description: FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the application's logic requires the user to perform a correct sequence of actions to implement a functional capability, but the application allows access to the functional capability without correctly completing one or more actions in the sequence. The leaves the attributes of Mailbox object able to be changed by the fill method. This issue has been patched in version 1.8.180. Additional Analyst Notes: - CIS
t able to be changed by the fill method. This issue has been patched in version 1.8.180. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-2c82-qx7x-35h8
CVE ID: CVE-2025-48478 State: PUBLISHED Published: 2025-05-30T04:32:12.553Z Last Updated: 2025-05-30T22:01:24.683Z Vendors: freescout-help-desk Products: freescout Problem Types: CWE-841 Description: FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, insufficient input validation during user creation has resulted in a mass assignment vulnerability, allowing an attacker to manipulate all fields of the object, which are enumerated in the $fillable array (the User object), when creating a new user. This issue has been patched in version 1.8.180. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/freescout-help-desk/freescout/
.180. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-fqjj-79j2-8qx6 - https://github.com/freescout-help-desk/freescout/commit/d2048f59a899dbcfc9a71bb98549ead81cdb62a5
CVE ID: CVE-2025-48479 State: PUBLISHED Published: 2025-05-30T04:34:09.292Z Last Updated: 2025-05-30T22:01:19.446Z Vendors: freescout-help-desk Products: freescout Problem Types: CWE-841 Description: FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the laravel-translation-manager package does not correctly validate user input, enabling the deletion of any directory, given sufficient access rights. This issue has been patched in version 1.8.180. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-627h-pc3c-w68h
CVE ID: CVE-2025-48480 State: PUBLISHED Published: 2025-05-30T04:34:34.040Z Last Updated: 2025-05-30T22:01:13.652Z Vendors: freescout-help-desk Products: freescout Problem Types: CWE-841 Description: FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, an authorized user with the administrator role or with the privilege User::PERM_EDIT_USERS can create a user, specifying the path to the user's avatar ../.htaccess during creation, and then delete the user's avatar, resulting in the deletion of the file .htaccess in the folder /storage/app/public. This issue has been patched in version 1.8.180. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
ublic. This issue has been patched in version 1.8.180. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-pfjf-43mp-3gp2
CVE ID: CVE-2025-48481 State: PUBLISHED Published: 2025-05-30T04:35:03.132Z Last Updated: 2025-05-30T12:32:54.467Z Vendors: freescout-help-desk Products: freescout Problem Types: CWE-841 Description: FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, an attacker with an unactivated email invitation containing invite_hash, can exploit this vulnerability to self-activate their account, despite it being blocked or deleted, by leveraging the invitation link from the email to gain initial access to the account. This issue has been patched in version 1.8.180. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/freescout-help-desk
version 1.8.180. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-jgj2-x749-5wc7
CVE ID: CVE-2025-48482 State: PUBLISHED Published: 2025-05-30T04:35:30.293Z Last Updated: 2025-05-30T22:01:07.370Z Vendors: freescout-help-desk Products: freescout Problem Types: CWE-841 Description: FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, there is a mass assignment vulnerability. The Customer object is updated using the fill() method, which processes fields such as channel and channel_id. However, the fill() method is called with all client-provided data, including unexpected values for channel and channel_id, leading to a mass assignment vulnerability. This issue has been patched in version 1.8.180. Additional Analyst Notes: - CISA ADP Vulnri
ss assignment vulnerability. This issue has been patched in version 1.8.180. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-7fjp-538q-9vrf
CVE ID: CVE-2025-48483 State: PUBLISHED Published: 2025-05-30T04:58:48.648Z Last Updated: 2025-05-30T22:00:59.493Z Vendors: freescout-help-desk Products: freescout Problem Types: CWE-79, CWE-352 Description: FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the application is vulnerable to Cross-Site Scripting (XSS) attacks due to incorrect input validation and sanitization of user-input data during mail signature sanitization. An attacker can inject arbitrary HTML code, including JavaScript scripts, into the page processed by the user's browser, allowing them to steal sensitive data, hijack user sessions, or conduct other malicious activities. Additiona
s browser, allowing them to steal sensitive data, hijack user sessions, or conduct other malicious activities. Additionally, if an administrator accesses one of these emails with a modified signature, it could result in a subsequent Cross-Site Request Forgery (CSRF) vulnerability. This issue has been patched in version 1.8.180. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-g2vq-qwx2-pc2m
CVE ID: CVE-2025-48484 State: PUBLISHED Published: 2025-05-30T04:59:23.469Z Last Updated: 2025-05-30T22:00:54.061Z Vendors: freescout-help-desk Products: freescout Problem Types: CWE-79 Description: FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.178, the application is vulnerable to Cross-Site Scripting (XSS) attacks due to incorrect input validation and sanitization of user-input data in the conversation POST data body. This issue has been patched in version 1.8.178. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-w3j9-7fhq-m8x7
CVE ID: CVE-2025-48485 State: PUBLISHED Published: 2025-05-30T06:16:50.271Z Last Updated: 2025-05-30T12:20:07.757Z Vendors: freescout-help-desk Products: freescout Problem Types: CWE-79 Description: FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the application is vulnerable to Cross-Site Scripting (XSS) attacks due to incorrect input validation and sanitization of user-input data when an authenticated user updates the profile of an arbitrary customer. This issue has been patched in version 1.8.180. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-556q-w535-xxg8
CVE ID: CVE-2025-48486 State: PUBLISHED Published: 2025-05-30T06:17:08.502Z Last Updated: 2025-05-30T13:51:14.755Z Vendors: freescout-help-desk Products: freescout Problem Types: CWE-79 Description: FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the cross-site scripiting (XSS) vulnerability is caused by the lack of input validation and sanitization in both \Session::flash and __, allowing user input to be executed without proper filtering. This issue has been patched in version 1.8.180. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-9jpm-xrpc-cv66
CVE ID: CVE-2025-48487 State: PUBLISHED Published: 2025-05-30T06:17:28.999Z Last Updated: 2025-05-30T13:49:02.168Z Vendors: freescout-help-desk Products: freescout Problem Types: CWE-79 Description: FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, when creating a translation of a phrase that appears in a flash-message after a completed action, it is possible to inject a payload to exploit XSS vulnerability. This issue has been patched in version 1.8.180. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-wg2q-m2fj-x6j4
CVE ID: CVE-2025-48488 State: PUBLISHED Published: 2025-05-30T06:30:07.549Z Last Updated: 2025-05-30T13:12:08.020Z Vendors: freescout-help-desk Products: freescout Problem Types: CWE-79 Description: FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, deleting the file .htaccess allows an attacker to upload an HTML file containing malicious JavaScript code to the server, which can result in a Cross-Site Scripting (XSS) vulnerability. This issue has been patched in version 1.8.180. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-2m76-538h-7hf9
CVE ID: CVE-2025-48489 State: PUBLISHED Published: 2025-05-30T06:18:01.272Z Last Updated: 2025-05-30T13:38:08.123Z Vendors: freescout-help-desk Products: freescout Problem Types: CWE-79 Description: FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the application is vulnerable to Cross-Site Scripting (XSS) attacks due to insufficient data validation and sanitization during data reception. This issue has been patched in version 1.8.180. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-jqjf-f566-485j