Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-30201 State: PUBLISHED Published: 2025-11-21T18:17:37.716Z Last Updated: 2025-11-22T04:55:22.165Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: wazuh Products: wazuh Problem Types: CWE-73, CWE-294 Description: Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.13.0, a vulnerability in Wazuh Agent allows authenticated attackers to force NTLM authentication through malicious UNC paths in various agent configuration settings, potentially leading NTLM relay attacks that would result privilege escalation and remote code execution. This issue has been patched in version 4.13.0. Addition
hat would result privilege escalation and remote code execution. This issue has been patched in version 4.13.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/wazuh/wazuh/security/advisories/GHSA-x697-jf34-gp5x - https://github.com/wazuh/wazuh/pull/30060 - https://github.com/wazuh/wazuh/commit/688972da589e5d40d2a81bcd738240303a3dc45a
CVE ID: CVE-2025-30202 State: PUBLISHED Published: 2025-04-30T00:24:45.723Z Last Updated: 2025-04-30T13:16:43.914Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: vllm-project Products: vllm Problem Types: CWE-770 Description: vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Versions starting from 0.5.2 and prior to 0.8.5 are vulnerable to denial of service and data exposure via ZeroMQ on multi-node vLLM deployment. In a multi-node vLLM deployment, vLLM uses ZeroMQ for some multi-node communication purposes. The primary vLLM host opens an XPUB ZeroMQ socket and binds it to ALL interfaces. While the socket is always opened f
s. The primary vLLM host opens an XPUB ZeroMQ socket and binds it to ALL interfaces. While the socket is always opened for a multi-node deployment, it is only used when doing tensor parallelism across multiple hosts. Any client with network access to this host can connect to this XPUB socket unless its port is blocked by a firewall. Once connected, these arbitrary clients will receive all of the same data broadcasted to all of the secondary vLLM hosts. This data is internal vLLM state information that is not useful to an attacker. By potentially connecting to this socket many times and not reading data published to them, an attacker can also cause a denial of service by slowing down or poten
ny times and not reading data published to them, an attacker can also cause a denial of service by slowing down or potentially blocking the publisher. This issue has been patched in version 0.8.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vllm-project/vllm/security/advisories/GHSA-9f8f-2vmf-885j - https://github.com/vllm-project/vllm/pull/6183 - https://github.com/vllm-project/vllm/commit/a0304dc504c85f421d38ef47c64f83046a13641c
CVE ID: CVE-2025-30203 State: PUBLISHED Published: 2025-03-31T15:48:49.651Z Last Updated: 2025-03-31T18:34:00.583Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:L) Vendors: Enalean Products: tuleap Problem Types: CWE-84, CWE-79 Description: Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap allows cross-site scripting (XSS) via the content of RSS feeds in the RSS widgets. A project administrator or someone with control over an used RSS feed could use this vulnerability to force victims to execute uncontrolled code. This vulnerability is fixed in Tuleap Community Edition 16.5.99.1742562878 and Tuleap Enterprise Editi
ncontrolled code. This vulnerability is fixed in Tuleap Community Edition 16.5.99.1742562878 and Tuleap Enterprise Edition 16.5-5 and 16.4-8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Enalean/tuleap/security/advisories/GHSA-39gx-34fc-rx6r - https://github.com/Enalean/tuleap/commit/54cce3f5e883d16055cb0239e023f48cdf5eb25f - https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=54cce3f5e883d16055cb0239e023f48cdf5eb25f - https://tuleap.net/plugins/tracker/?aid=42243
CVE ID: CVE-2025-30204 State: PUBLISHED Published: 2025-03-21T21:42:01.382Z Last Updated: 2025-04-10T13:03:19.897Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: golang-jwt Products: jwt Problem Types: CWE-405 Description: golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request whose Authorization header consists of Bearer followed by many period characters, a call to that function incurs allocations to the tune of O(n) bytes (wh
s of Bearer followed by many period characters, a call to that function incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This issue is fixed in 5.2.2 and 4.5.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/golang-jwt/jwt/security/advisories/GHSA-mh63-6h87-95cp - https://github.com/golang-jwt/jwt/commit/0951d184286dece21f73c85673fd308786ffe9c3 - https://github.com/golang-jwt/jwt/commit/bf316c48137a1212f8d0af9288cc9ce8e59f1afb
CVE ID: CVE-2025-30205 State: PUBLISHED Published: 2025-03-24T16:47:36.648Z Last Updated: 2025-03-24T17:51:17.180Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:N) Vendors: oddlama Products: kanidm-provision Problem Types: CWE-532 Description: kanidim-provision is a helper utility that uses kanidm's API to provision users, groups and oauth2 systems. Prior to version 1.2.0, a faulty function intrumentation in the (optional) kanidm patches provided by kandim-provision will cause the provisioned admin credentials to be leaked to the system log. This only impacts users which both use the provided patches and provision their `admin` or `idm_admin` account credentials this wa
impacts users which both use the provided patches and provision their `admin` or `idm_admin` account credentials this way. No other credentials are affected. Users should recompile kanidm with the newest patchset from tag `v1.2.0` or higher. As a workaround, the user can set the log level `KANIDM_LOG_LEVEL` to any level higher than `info`, for example `warn`. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/oddlama/kanidm-provision/security/advisories/GHSA-57fc-pcqm-53rp - https://github.com/oddlama/kanidm-provision/commit/a102b52e4a79be4263068577ba837f16c3e487a2
CVE ID: CVE-2025-30206 State: PUBLISHED Published: 2025-04-15T19:14:41.450Z Last Updated: 2025-04-15T19:58:52.725Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: donknap Products: dpanel Problem Types: CWE-321, CWE-453, CWE-547 Description: Dpanel is a Docker visualization panel system which provides complete Docker management functions. The Dpanel service contains a hardcoded JWT secret in its default configuration, allowing attackers to generate valid JWT tokens and compromise the host machine. This security flaw allows attackers to analyze the source code, discover the embedded secret, and craft legitimate JWT tokens. By forging these tokens, an attack
alyze the source code, discover the embedded secret, and craft legitimate JWT tokens. By forging these tokens, an attacker can successfully bypass authentication mechanisms, impersonate privileged users, and gain unauthorized administrative access. Consequently, this enables full control over the host machine, potentially leading to severe consequences such as sensitive data exposure, unauthorized command execution, privilege escalation, or further lateral movement within the network environment. This issue is patched in version 1.6.1. A workaround for this vulnerability involves replacing the hardcoded secret with a securely generated value and load it from secure configuration storage. Add
volves replacing the hardcoded secret with a securely generated value and load it from secure configuration storage. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/donknap/dpanel/security/advisories/GHSA-j752-cjcj-w847
CVE ID: CVE-2025-30207 State: PUBLISHED Published: 2025-05-13T15:20:00.707Z Last Updated: 2025-05-13T19:37:09.973Z Vendors: getkirby Products: kirby Problem Types: CWE-22, CWE-23 Description: Kirby is an open-source content management system. A vulnerability in versions prior to 3.9.8.3, 3.10.1.2, and 4.7.1 affects all Kirby setups that use PHP's built-in server. Such setups are commonly only used during local development. Sites that use other server software (such as Apache, nginx or Caddy) are not affected. A missing path traversal check allowed attackers to navigate all files on the server that were accessible to the PHP process, including files outside of the Kirby installation. The vuln
files on the server that were accessible to the PHP process, including files outside of the Kirby installation. The vulnerable implementation delegated all existing files to PHP, including existing files outside of the document root. This leads to a different response that allows attackers to determine whether the requested file exists. Because Kirby's router only delegates such requests to PHP and does not load or execute them, contents of the files were not exposed as PHP treats requests to files outside of the document root as invalid. The problem has been patched in Kirby 3.9.8.3, Kirby 3.10.1.2, and Kirby 4.7.1. In all of the mentioned releases, the maintainers of Kirby have updated the
by 3.9.8.3, Kirby 3.10.1.2, and Kirby 4.7.1. In all of the mentioned releases, the maintainers of Kirby have updated the router to check if existing static files are within the document root. Requests to files outside the document root are treated as page requests of the error page and will no longer allow to determine whether the file exists or not. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/getkirby/kirby/security/advisories/GHSA-9p3p-w5jf-8xxg - https://github.com/getkirby/kirby/releases/tag/3.10.1.2 - https://github.com/getkirby/kirby/releases/tag/3.9.8.3 - https://github.com/getkirby/kirby/releases/tag/4.7.1
CVE ID: CVE-2025-30208 State: PUBLISHED Published: 2025-03-24T17:03:40.728Z Last Updated: 2025-03-24T17:46:37.205Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: vitejs Products: vite Problem Types: CWE-200, CWE-284 Description: Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. `@fs` denies access to files outside of Vite serving allow list. Adding `?raw??` or `?import&raw??` to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as `?` are removed in several places, but are not accounted for in query
bypass exists because trailing separators such as `?` are removed in several places, but are not accounted for in query string regexes. The contents of arbitrary files can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected. Versions 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 fix the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vitejs/vite/security/advisories/GHSA-x574-m823-4x7w - https://github.com/vitejs/vite/commit/315695e9d97cc6cfa7e6d9e0229fb50cdae3d9f4 - https://github.com/vitejs/vite/commit/80381c38d6f068b12e6e928cd3c616bd1d64803c - https:/
cc6cfa7e6d9e0229fb50cdae3d9f4 - https://github.com/vitejs/vite/commit/80381c38d6f068b12e6e928cd3c616bd1d64803c - https://github.com/vitejs/vite/commit/807d7f06d33ab49c48a2a3501da3eea1906c0d41 - https://github.com/vitejs/vite/commit/92ca12dc79118bf66f2b32ff81ed09e0d0bd07ca - https://github.com/vitejs/vite/commit/f234b5744d8b74c95535a7b82cc88ed2144263c1
CVE ID: CVE-2025-30209 State: PUBLISHED Published: 2025-03-31T15:53:46.455Z Last Updated: 2025-03-31T18:19:35.993Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Enalean Products: tuleap Problem Types: CWE-863 Description: Tuleap is an Open Source Suite to improve management of software developments and collaboration. An attacker can access release notes content or information via the FRS REST endpoints it should not have access to. This vulnerability is fixed in Tuleap Community Edition 16.5.99.1742812323 and Tuleap Enterprise Edition 16.5-6 and 16.4-10. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Enalean/tuleap/secu
5-6 and 16.4-10. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Enalean/tuleap/security/advisories/GHSA-hcp5-pmpm-mgwh - https://github.com/Enalean/tuleap/commit/34af2d5d10b0349967129f53427f495815e5bbcc - https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=34af2d5d10b0349967129f53427f495815e5bbcc - https://tuleap.net/plugins/tracker/?aid=42251
CVE ID: CVE-2025-30210 State: PUBLISHED Published: 2025-04-01T14:16:57.897Z Last Updated: 2025-04-02T15:54:38.097Z Vendors: usebruno Products: bruno Problem Types: CWE-80 Description: Bruno is an open source IDE for exploring and testing APIs. Prior to 1.39.1, the custom tool-tip components which internally use react-tooltip were setting the content (in this case the Environment name) as raw HTML which then gets injected into DOM on hover. This, combined with loose Content Security Policy restrictions, allowed any valid HTML text containing inline script to get executed on hovering over the respective Environment's name. This vulnerability's attack surface is limited strictly to scenarios wh
hovering over the respective Environment's name. This vulnerability's attack surface is limited strictly to scenarios where users import collections from untrusted or malicious sources. The exploit requires deliberate action from the user—specifically, downloading and opening an externally provided malicious Bruno or Postman collection export and the user hovers on the environment name. This vulnerability is fixed in 1.39.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/usebruno/bruno/security/advisories/GHSA-fqxc-cxph-9vq8
CVE ID: CVE-2025-30211 State: PUBLISHED Published: 2025-03-28T14:55:47.778Z Last Updated: 2025-11-03T19:46:46.745Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: erlang Products: otp Problem Types: CWE-789 Description: Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.1, 26.2.5.10, and 25.3.2.19, a maliciously formed KEX init message can result with high memory usage. Implementation does not verify RFC specified limits on algorithm names (64 characters) provided in KEX init message. Big KEX init packet may lead to inefficient processing of the error data. As a result, large amount of memory will be allocated for
packet may lead to inefficient processing of the error data. As a result, large amount of memory will be allocated for processing malicious data. Versions OTP-27.3.1, OTP-26.2.5.10, and OTP-25.3.2.19 fix the issue. Some workarounds are available. One may set option `parallel_login` to `false` and/or reduce the `max_sessions` option. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/erlang/otp/security/advisories/GHSA-vvr3-fjhh-cfwc
CVE ID: CVE-2025-30212 State: PUBLISHED Published: 2025-03-25T14:21:32.405Z Last Updated: 2025-03-25T14:41:42.114Z Vendors: frappe Products: frappe Problem Types: CWE-89 Description: Frappe is a full-stack web application framework. An SQL Injection vulnerability has been identified in Frappe Framework prior to versions 14.89.0 and 15.51.0 which could allow a malicious actor to access sensitive information. Versions 14.89.0 and 15.51.0 fix the issue. Upgrading is required; no other workaround is present. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/frappe/frappe/security/advisories/GHSA-3hj6-r5c9-q8f3 - https://github.com/frappe/frappe/commit/27f13437db
://github.com/frappe/frappe/security/advisories/GHSA-3hj6-r5c9-q8f3 - https://github.com/frappe/frappe/commit/27f13437db161a173137d91cd07d0f9287d7c556 - https://github.com/frappe/frappe/commit/2ebd88520ecfa9bb7d3392b7de8c8f94a86ec05c
CVE ID: CVE-2025-30213 State: PUBLISHED Published: 2025-03-25T14:55:04.949Z Last Updated: 2025-03-25T15:04:26.512Z Vendors: frappe Products: frappe Problem Types: CWE-20 Description: Frappe is a full-stack web application framework. Prior to versions 14.91.0 and 15.52.0, a system user was able to create certain documents in a specific way that could lead to remote code execution. Versions 14.9.1 and 15.52.0 contain a patch for the vulnerability. There's no workaround; an upgrade is required. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/frappe/frappe/security/advisories/GHSA-v342-4xr9-x3q3
CVE ID: CVE-2025-30214 State: PUBLISHED Published: 2025-03-25T15:05:42.656Z Last Updated: 2025-03-25T15:52:36.718Z Vendors: frappe Products: frappe Problem Types: CWE-200, CWE-287 Description: Frappe is a full-stack web application framework. Prior to versions 14.89.0 and 15.51.0, making crafted requests could lead to information disclosure that could further lead to account takeover. Versions 14.89.0 and 15.51.0 fix the issue. There's no workaround to fix this without upgrading. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/frappe/frappe/security/advisories/GHSA-qrv3-jc3h-f3m6
CVE ID: CVE-2025-30215 State: PUBLISHED Published: 2025-04-15T23:25:43.143Z Last Updated: 2025-04-17T14:22:42.979Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H) Vendors: nats-io Products: nats-server Problem Types: CWE-306, CWE-287 Description: NATS-Server is a High-Performance server for NATS.io, the cloud and edge native messaging system. In versions starting from 2.2.0 but prior to 2.10.27 and 2.11.1, the management of JetStream assets happens with messages in the $JS. subject namespace in the system account; this is partially exposed into regular accounts to allow account holders to manage their assets. Some of the JS API requests were missing access controls
gular accounts to allow account holders to manage their assets. Some of the JS API requests were missing access controls, allowing any user with JS management permissions in any account to perform certain administrative actions on any JS asset in any other account. At least one of the unprotected APIs allows for data destruction. None of the affected APIs allow disclosing stream contents. This vulnerability is fixed in v2.11.1 or v2.10.27. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nats-io/nats-server/security/advisories/GHSA-fhg8-qxh5-7q3w - https://advisories.nats.io/CVE/secnote-2025-01.txt
CVE ID: CVE-2025-30216 State: PUBLISHED Published: 2025-03-25T19:22:22.645Z Last Updated: 2025-03-25T19:37:44.551Z Severity: CRITICAL (CVSS 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H) Vendors: nasa Products: CryptoLib Problem Types: CWE-122 Description: CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. In versions 1.3.3 and prior, a Heap Overflow vulnerability occurs in the `Crypto_TM_ProcessSecurity` function (`crypto_tm.c:1735:8`). When processing the Secondary Header Length of a TM protocol packet, if the
ssSecurity` function (`crypto_tm.c:1735:8`). When processing the Secondary Header Length of a TM protocol packet, if the Secondary Header Length exceeds the packet's total length, a heap overflow is triggered during the memcpy operation that copies packet data into the dynamically allocated buffer `p_new_dec_frame`. This allows an attacker to overwrite adjacent heap memory, potentially leading to arbitrary code execution or system instability. A patch is available at commit 810fd66d592c883125272fef123c3240db2f170f. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nasa/CryptoLib/security/advisories/GHSA-v3jc-5j74-hcjv - https://github.com/nasa/CryptoLib/comm
es: - https://github.com/nasa/CryptoLib/security/advisories/GHSA-v3jc-5j74-hcjv - https://github.com/nasa/CryptoLib/commit/810fd66d592c883125272fef123c3240db2f170f - https://github.com/user-attachments/assets/d49cea04-ce84-4d60-bb3a-987e843f09c4
CVE ID: CVE-2025-30217 State: PUBLISHED Published: 2025-03-26T16:18:31.638Z Last Updated: 2025-03-31T13:12:27.821Z Vendors: frappe Products: frappe Problem Types: CWE-89 Description: Frappe is a full-stack web application framework. Prior to versions 14.93.2 and 15.55.0, a SQL Injection vulnerability has been identified in Frappe Framework which could allow a malicious actor to access sensitive information. Versions 14.93.2 and 15.55.0 contain a patch for the issue. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/frappe/frappe/security/advisories/GHSA-6phg-4wmq-h5h3
CVE ID: CVE-2025-30218 State: PUBLISHED Published: 2025-04-02T21:23:14.660Z Last Updated: 2025-10-13T15:37:02.310Z Vendors: vercel Products: next.js Problem Types: CWE-200 Description: Next.js is a React framework for building full-stack web applications. To mitigate CVE-2025-29927, Next.js validated the x-middleware-subrequest-id which persisted across multiple incoming requests. However, this subrequest ID is sent to all requests, even if the destination is not the same host as the Next.js application. Initiating a fetch request to a third-party within Middleware will send the x-middleware-subrequest-id to that third party. This vulnerability is fixed in 12.3.6, 13.5.10, 14.2.26, and 15.2.
d the x-middleware-subrequest-id to that third party. This vulnerability is fixed in 12.3.6, 13.5.10, 14.2.26, and 15.2.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vercel/next.js/security/advisories/GHSA-223j-4rm8-mrmf - https://vercel.com/changelog/cve-2025-30218-5DREmEH765PoeAsrNNQj3O
CVE ID: CVE-2025-30219 State: PUBLISHED Published: 2025-03-25T22:55:35.539Z Last Updated: 2025-03-26T13:43:18.250Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: rabbitmq Products: rabbitmq-server Problem Types: CWE-79 Description: RabbitMQ is a messaging and streaming broker. Versions prior to 4.0.3 are vulnerable to a sophisticated attack that could modify virtual host name on disk and then make it unrecoverable (with other on disk file modifications) can lead to arbitrary JavaScript code execution in the browsers of management UI users. When a virtual host on a RabbitMQ node fails to start, recent versions will display an error message (a notification) i
When a virtual host on a RabbitMQ node fails to start, recent versions will display an error message (a notification) in the management UI. The error message includes virtual host name, which was not escaped prior to open source RabbitMQ 4.0.3 and Tanzu RabbitMQ 4.0.3, 3.13.8. An attack that both makes a virtual host fail to start and creates a new virtual host name with an XSS code snippet or changes the name of an existing virtual host on disk could trigger arbitrary JavaScript code execution in the management UI (the user's browser). Open source RabbitMQ `4.0.3` and Tanzu RabbitMQ `4.0.3` and `3.13.8` patch the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https
zu RabbitMQ `4.0.3` and `3.13.8` patch the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-g58g-82mw-9m3p