Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
loop. For SArrays on the other hand, `iter_list` is instantiated in the body of a `repeat` ir, so it can be evaluated several times. This issue is being addressed and is expected to be available in version 0.4.1. Users are advised to upgrade as soon as the patched release is available. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vyperlang/vyper/security/advisories/GHSA-h33q-mhmp-8p67 - https://github.com/vyperlang/vyper/pull/4488
CVE ID: CVE-2025-27105 State: PUBLISHED Published: 2025-02-21T21:27:28.056Z Last Updated: 2025-02-22T15:37:28.734Z Vendors: vyperlang Products: vyper Problem Types: CWE-787 Description: vyper is a Pythonic Smart Contract Language for the EVM. Vyper handles AugAssign statements by first caching the target location to avoid double evaluation. However, in the case when target is an access to a DynArray and the rhs modifies the array, the cached target will evaluate first, and the bounds check will not be re-evaluated during the write portion of the statement. This issue has been addressed in version 0.4.1 and all users are advised to upgrade. There are no known workarounds for this vulnerabilit
en addressed in version 0.4.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vyperlang/vyper/security/advisories/GHSA-4w26-8p97-f4jp
CVE ID: CVE-2025-27106 State: PUBLISHED Published: 2025-02-21T21:18:18.284Z Last Updated: 2025-02-22T15:40:06.071Z Vendors: chrisleekr Products: binance-trading-bot Problem Types: CWE-78 Description: binance-trading-bot is an automated Binance trading bot with trailing buy/sell strategy. Authenticated users of binance-trading-bot can achieve Remote Code Execution on the host system due to a command injection vulnerability in the `/restore` endpoint. The restore endpoint of binance-trading-bot is vulnerable to command injection via the `/restore` endpoint. The name of the uploaded file is passed to shell.exec without sanitization other than path normalization, resulting in Remote Code Executi
loaded file is passed to shell.exec without sanitization other than path normalization, resulting in Remote Code Execution. This may allow any authorized user to execute code in the context of the host machine. This issue has been addressed in version 0.0.100 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/chrisleekr/binance-trading-bot/security/advisories/GHSA-wq6j-4388-4gg5 - https://github.com/chrisleekr/binance-trading-bot/commit/99d464cf8ef858d441189993054ec5f5f86e6213 - https://github.com/chrisleekr/binance-trading-bot/blob/dd8e1a91b872a48aec47bbe1280c1c6ea96
8d441189993054ec5f5f86e6213 - https://github.com/chrisleekr/binance-trading-bot/blob/dd8e1a91b872a48aec47bbe1280c1c6ea96784d9/app/frontend/webserver/handlers/restore-post.js#L14
CVE ID: CVE-2025-27107 State: PUBLISHED Published: 2025-03-13T16:55:06.914Z Last Updated: 2025-03-13T18:52:28.229Z Vendors: CyclopsMC Products: IntegratedScripting Problem Types: CWE-74 Description: Integrated Scripting is a tool for creating scripts for handling complex operations in Integrated Dynamics. Minecraft users who use Integrated Scripting prior to versions 1.21.1-1.0.17, 1.21.4-1.0.9-254, 1.20.1-1.0.13, and 1.19.2-1.0.10 may be vulnerable to arbitrary code execution. By using Java reflection on a thrown exception object it's possible to escape the JavaScript sandbox for IntegratedScripting's Variable Cards, and leverage that to construct arbitrary Java classes and invoke arbitrary
box for IntegratedScripting's Variable Cards, and leverage that to construct arbitrary Java classes and invoke arbitrary Java methods. This vulnerability allows for execution of arbitrary Java methods, and by extension arbitrary native code e.g. from `java.lang.Runtime.exec`, on the Minecraft server by any player with the ability to create and use an IntegratedScripting Variable Card. Versions 1.21.1-1.0.17, 1.21.4-1.0.9-254, 1.20.1-1.0.13, and 1.19.2-1.0.10 fix the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/CyclopsMC/IntegratedScripting/security/advisories/GHSA-2v5x-4823-hq77 - https://github.com/CyclopsMC/IntegratedScripting/blob/29051aace619
edScripting/security/advisories/GHSA-2v5x-4823-hq77 - https://github.com/CyclopsMC/IntegratedScripting/blob/29051aace619604fb5dd60624b72dba428fea2f2/src/main/java/org/cyclops/integratedscripting/evaluate/ScriptHelpers.java#L46 - https://github.com/CyclopsMC/IntegratedScripting/blob/29051aace619604fb5dd60624b72dba428fea2f2/src/main/java/org/cyclops/integratedscripting/evaluate/translation/ValueTranslators.java
CVE ID: CVE-2025-27108 State: PUBLISHED Published: 2025-02-21T21:09:48.818Z Last Updated: 2025-02-24T14:47:22.804Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: ryansolid Products: dom-expressions Problem Types: CWE-79, CWE-116 Description: dom-expressions is a Fine-Grained Runtime for Performant DOM Rendering. In affected versions the use of javascript's `.replace()` opens up to potential Cross-site Scripting (XSS) vulnerabilities with the special replacement patterns beginning with `$`. Particularly, when the attributes of `Meta` tag from solid-meta are user-defined, attackers can utilise the special replacement patterns, either `$'` or `$\`` to achieve XS
solid-meta are user-defined, attackers can utilise the special replacement patterns, either `$'` or `$\`` to achieve XSS. The solid-meta package has this issue since it uses `useAffect` and context providers, which injects the used assets in the html header. "dom-expressions" uses `.replace()` to insert the assets, which is vulnerable to the special replacement patterns listed above. This effectively means that if the attributes of an asset tag contained user-controlled data, it would be vulnerable to XSS. For instance, there might be meta tags for the open graph protocol in a user profile page, but if attackers set the user query to some payload abusing `.replace()`, then they could execut
in a user profile page, but if attackers set the user query to some payload abusing `.replace()`, then they could execute arbitrary javascript in the victim's web browser. Moreover, it could be stored and cause more problems. This issue has been addressed in version 0.39.5 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ryansolid/dom-expressions/security/advisories/GHSA-hw62-58pr-7wc5 - https://github.com/ryansolid/dom-expressions/commit/521f75dfa89ed24161646e7007d9d7d21da07767
CVE ID: CVE-2025-27109 State: PUBLISHED Published: 2025-02-21T21:12:58.218Z Last Updated: 2025-02-24T17:05:00.409Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: solidjs Products: solid Problem Types: CWE-116, CWE-79 Description: solid-js is a declarative, efficient, and flexible JavaScript library for building user interfaces. In affected versions Inserts/JSX expressions inside illegal inlined JSX fragments lacked escaping, allowing user input to be rendered as HTML when put directly inside JSX fragments. This issue has been addressed in version 1.9.4 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Anal
rsion 1.9.4 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/solidjs/solid/security/advisories/GHSA-3qxh-p7jc-5xh6 - https://github.com/solidjs/solid/commit/b93956f28ed75469af6976a98728e313d0edd236
CVE ID: CVE-2025-27110 State: PUBLISHED Published: 2025-02-25T20:00:44.211Z Last Updated: 2025-02-26T16:38:15.284Z Vendors: owasp-modsecurity Products: ModSecurity Problem Types: CWE-172 Description: Libmodsecurity is one component of the ModSecurity v3 project. The library codebase serves as an interface to ModSecurity Connectors taking in web traffic and applying traditional ModSecurity processing. A bug that exists only in Libmodsecurity3 version 3.0.13 means that, in 3.0.13, Libmodsecurity3 can't decode encoded HTML entities if they contains leading zeroes. Version 3.0.14 contains a fix. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
14 contains a fix. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-42w7-rmv5-4x2j - https://github.com/owasp-modsecurity/ModSecurity/issues/3340
CVE ID: CVE-2025-27111 State: PUBLISHED Published: 2025-03-04T15:26:55.377Z Last Updated: 2025-11-03T21:13:11.046Z Vendors: rack Products: rack Problem Types: CWE-93, CWE-117 Description: Rack is a modular Ruby web server interface. The Rack::Sendfile middleware logs unsanitised header values from the X-Sendfile-Type header. An attacker can exploit this by injecting escape sequences (such as newline characters) into the header, resulting in log injection. This vulnerability is fixed in 2.2.12, 3.0.13, and 3.1.11. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/rack/rack/security/advisories/GHSA-8cgq-6mh2-7j6v - https://github.com/r
ram Container: References: - https://github.com/rack/rack/security/advisories/GHSA-8cgq-6mh2-7j6v - https://github.com/rack/rack/commit/803aa221e8302719715e224f4476e438f2531a53 - https://github.com/rack/rack/commit/aeac570bb8080ca7b53b7f2e2f67498be7ebd30b - https://github.com/rack/rack/commit/b13bc6bfc7506aca3478dc5ac1c2ec6fc53f82a3
CVE ID: CVE-2025-27112 State: PUBLISHED Published: 2025-02-24T18:37:14.221Z Last Updated: 2025-02-24T19:00:44.866Z Vendors: navidrome Products: navidrome Problem Types: CWE-287 Description: Navidrome is an open source web-based music collection server and streamer. Starting in version 0.52.0 and prior to version 0.54.5, in certain Subsonic API endpoints, a flaw in the authentication check process allows an attacker to specify any arbitrary username that does not exist on the system, along with a salted hash of an empty password. Under these conditions, Navidrome treats the request as authenticated, granting access to various Subsonic endpoints without requiring valid credentials. An attacker
request as authenticated, granting access to various Subsonic endpoints without requiring valid credentials. An attacker can use any non-existent username to bypass the authentication system and gain access to various read-only data in Navidrome, such as user playlists. However, any attempt to modify data fails with a "permission denied" error due to insufficient permissions, limiting the impact to unauthorized viewing of information. Version 0.54.5 contains a patch for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/navidrome/navidrome/security/advisories/GHSA-c3p4-vm8f-386p - https://github.com/navidrome/navidrome/commit/287079a9e409fb6b9708c
/navidrome/security/advisories/GHSA-c3p4-vm8f-386p - https://github.com/navidrome/navidrome/commit/287079a9e409fb6b9708ca384d7daa7b5185c1a0
CVE ID: CVE-2025-27113 State: PUBLISHED Published: 2025-02-18T00:00:00.000Z Last Updated: 2025-11-03T21:13:22.434Z Severity: LOW (CVSS 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: xmlsoft Products: libxml2 Problem Types: CWE-476 Description: libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.gnome.org/GNOME/libxml2/-/issues/861
CVE ID: CVE-2025-27127 State: PUBLISHED Published: 2025-07-08T10:34:31.542Z Last Updated: 2025-08-12T11:16:54.752Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C) Vendors: Siemens Products: TIA Project-Server, TIA Project-Server V17, Totally Integrated Automation Portal (TIA Portal) V17, Totally Integrated Automation Portal (TIA Portal) V18, Totally Integrated Automation Portal (TIA Portal) V19, Totally Integrated Automation Portal (TIA Portal) V20 Problem Types: CWE-434 Description: A vulnerability has been identified in TIA Project-Server (All versions < V2.1.1), TIA Project-Server V17 (All versions), Totally Integrated Automation Portal (TIA Portal)
erver (All versions < V2.1.1), TIA Project-Server V17 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions), Totally Integrated Automation Portal (TIA Portal) V18 (All versions), Totally Integrated Automation Portal (TIA Portal) V19 (All versions < V19 Update 4), Totally Integrated Automation Portal (TIA Portal) V20 (All versions < V20 Update 3). The affected application improperly handles uploaded projects in the document root. This could allow an attacker with contributor privileges to cause denial of service by uploading a malicious project. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-
. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-460466.html
CVE ID: CVE-2025-27128 State: PUBLISHED Published: 2025-08-11T02:55:20.732Z Last Updated: 2025-08-11T13:48:29.345Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-416 Description: in OpenHarmony v5.0.3 and prior versions allow a local attacker arbitrary code execution in tcb through use after free. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-07.md
CVE ID: CVE-2025-27129 State: PUBLISHED Published: 2025-08-20T13:09:07.073Z Last Updated: 2025-11-03T18:08:58.875Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Tenda Products: AC6 V5.0 Problem Types: CWE-288 Description: An authentication bypass vulnerability exists in the HTTP authentication functionality of Tenda AC6 V5.0 V02.03.01.110. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can send packets to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2025-2165
CVE ID: CVE-2025-27130 State: PUBLISHED Published: 2025-04-01T08:57:25.711Z Last Updated: 2025-04-01T15:16:20.041Z Severity: MEDIUM (CVSS 6.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Welcart Inc. Products: Welcart e-Commerce Problem Types: CWE-502 Description: Welcart e-Commerce 2.11.6 and earlier versions contains an untrusted data deserialization vulnerability. If this vulnerability is exploited, arbitrary code may be executed by a remote unauthenticated attacker who can access websites created using the product. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.welcart.com/archives/23868.html - https://jvn.jp/en/jp/JVN87266215/
CVE ID: CVE-2025-27131 State: PUBLISHED Published: 2025-06-08T11:46:58.944Z Last Updated: 2025-06-09T03:30:51.763Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-20 Description: in OpenHarmony v5.0.3 and prior versions allow a local attacker cause DOS through improper input. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-06.md
CVE ID: CVE-2025-27132 State: PUBLISHED Published: 2025-05-06T09:03:12.027Z Last Updated: 2025-05-06T15:03:26.621Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-787 Description: in OpenHarmony v5.0.3 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write. This vulnerability can be exploited only in restricted scenarios. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-05.md
CVE ID: CVE-2025-27133 State: PUBLISHED Published: 2025-02-24T18:43:16.403Z Last Updated: 2025-02-24T18:58:30.181Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-89 Description: WeGIA is a Web manager for charitable institutions. A SQL Injection vulnerability was discovered in the WeGIA application prior to version 3.2.15 at the `adicionar_tipo_exame.php` endpoint. This vulnerability allows an authorized attacker to execute arbitrary SQL queries, allowing access to sensitive information. Version 3.2.15 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-xj79-w799-qjcp -
CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-xj79-w799-qjcp - https://github.com/LabRedesCefetRJ/WeGIA/commit/619ead748e18e685459c6dc3c226e621b9ff5403
CVE ID: CVE-2025-27134 State: PUBLISHED Published: 2025-04-30T14:55:10.285Z Last Updated: 2025-04-30T15:11:12.895Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: laurent22 Products: joplin Problem Types: CWE-284 Description: Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, a privilege escalation vulnerability exists in the Joplin server, allowing non-admin users to exploit the API endpoint `PATCH /api/users/:id` to set the `is_admin` field to 1. The vulnerability allows malicious low-privileged users to perform administrative actions without proper autho
eld to 1. The vulnerability allows malicious low-privileged users to perform administrative actions without proper authorization. This issue has been patched in version 3.3.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/laurent22/joplin/security/advisories/GHSA-xj67-649m-3p8x - https://github.com/laurent22/joplin/commit/12baa9827dac9da903f244c9f358e3deb264e228
CVE ID: CVE-2025-27135 State: PUBLISHED Published: 2025-02-25T18:16:58.667Z Last Updated: 2025-02-25T18:57:33.672Z Vendors: infiniflow Products: ragflow Problem Types: CWE-89 Description: RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. Versions 0.15.1 and prior are vulnerable to SQL injection. The ExeSQL component extracts the SQL statement from the input and sends it directly to the database query. As of time of publication, no patched version is available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/infiniflow/ragflow/security/advisories/GHSA-3gqj-66qm-25jq - https://github.com/infiniflow/ragflow/blob/v0.15.1/agent/component/ex
/ragflow/security/advisories/GHSA-3gqj-66qm-25jq - https://github.com/infiniflow/ragflow/blob/v0.15.1/agent/component/exesql.py - https://swizzky.notion.site/ragflow-exesql-150ca6df7c03806989cefde915cf8e42?pvs=4
CVE ID: CVE-2025-27136 State: PUBLISHED Published: 2025-03-10T18:24:38.743Z Last Updated: 2025-03-10T19:09:21.238Z Vendors: Robothy Products: local-s3 Problem Types: CWE-611 Description: LocalS3 is an Amazon S3 mock service for testing and local development. Prior to version 1.21, the LocalS3 service's bucket creation endpoint is vulnerable to XML External Entity (XXE) injection. When processing the CreateBucketConfiguration XML document during bucket creation, the service's XML parser is configured to resolve external entities. This allows an attacker to declare an external entity that references an internal URL, which the server will then attempt to fetch when parsing the XML. The vulnerab
l entity that references an internal URL, which the server will then attempt to fetch when parsing the XML. The vulnerability specifically occurs in the location constraint processing, where the XML parser resolves external entities without proper validation or restrictions. When the external entity is resolved, the server makes an HTTP request to the specified URL and includes the response content in the parsed XML document. This vulnerability can be exploited to perform server-side request forgery (SSRF) attacks, allowing an attacker to make requests to internal services or resources that should not be accessible from external networks. The server will include the responses from these inte
or resources that should not be accessible from external networks. The server will include the responses from these internal requests in the resulting bucket configuration, effectively leaking sensitive information. The attacker only needs to be able to send HTTP requests to the LocalS3 service to exploit this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Robothy/local-s3/security/advisories/GHSA-g6wm-2v64-wq36 - https://github.com/Robothy/local-s3/commit/d6ed756ceb30c1eb9d4263321ac683d734f8836f
CVE ID: CVE-2025-27137 State: PUBLISHED Published: 2025-02-24T20:59:50.974Z Last Updated: 2025-02-25T14:34:56.467Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: DependencyTrack Products: dependency-track Problem Types: CWE-73 Description: Dependency-Track is a component analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track allows users with the `SYSTEM_CONFIGURATION` permission to customize notification templates. Templates are evaluated using the Pebble template engine. Pebble supports an `include` tag, which allows template authors to include the content of arbitrary files upon evaluation.
ble supports an `include` tag, which allows template authors to include the content of arbitrary files upon evaluation. Prior to version 4.12.6, users of Dependency-Track with the `SYSTEM_CONFIGURATION` permission can abuse the `include` tag by crafting notification templates that `include` sensitive local files, such as `/etc/passwd` or `/proc/1/environ`. By configuring such a template for a notification rule (aka "Alert"), and having it send notifications to a destination controlled by the actor, sensitive information may be leaked. The issue has been fixed in Dependency-Track 4.12.6. In fixed versions, the `include` tag can no longer be used. Usage of the tag will cause template evaluatio
Track 4.12.6. In fixed versions, the `include` tag can no longer be used. Usage of the tag will cause template evaluation to fail. As a workaround, avoid assigning the `SYSTEM_CONFIGURATION` permission to untrusted users. The `SYSTEM_CONFIGURATION` permission per default is only granted to members of the `Administrators` team. Assigning this permission to non-administrative users or teams is a security risk in itself, and highly discouraged. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/DependencyTrack/dependency-track/security/advisories/GHSA-9582-88hr-54w3 - https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-p75g-cxfj-7wrx - http
es/GHSA-9582-88hr-54w3 - https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-p75g-cxfj-7wrx - https://github.com/PebbleTemplates/pebble/issues/680 - https://github.com/DependencyTrack/dependency-track/pull/4684 - https://github.com/DependencyTrack/dependency-track/pull/4685 - https://pebbletemplates.io/wiki/tag/include