Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-61541 State: PUBLISHED Published: 2025-10-16T00:00:00.000Z Last Updated: 2025-10-16T19:02:13.916Z Vendors: n/a Products: n/a Problem Types: n/a Description: Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality (forgot_send.cgi). The reset link sent to users is constructed using the HTTP Host header via get_webmin_email_url(). An attacker can manipulate the Host header to inject a malicious domain into the reset email. If a victim follows the poisoned link, the attacker can intercept the reset token and gain full control of the target account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/webmin/webmin
of the target account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/webmin/webmin - http://www.webmin.com/ - https://github.com/bugdotexe/Vulnerability-Research/tree/main/CVE-2025-61541
CVE ID: CVE-2025-61543 State: PUBLISHED Published: 2025-10-16T00:00:00.000Z Last Updated: 2025-10-16T19:03:20.605Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Host Header Injection vulnerability exists in the password reset functionality of CraftMyCMS 4.0.2.2. The system uses `$_SERVER['HTTP_HOST']` directly to construct password reset links sent via email. An attacker can manipulate the Host header to send malicious reset links, enabling phishing attacks or account takeover. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://owasp.org/www-community/vulnerabilities/HTTP_Host_header_injection - https://github.com/bugdotexe/Vulnerability-Research/tree/mai
/www-community/vulnerabilities/HTTP_Host_header_injection - https://github.com/bugdotexe/Vulnerability-Research/tree/main/CVE-2025-61543
CVE ID: CVE-2025-61553 State: PUBLISHED Published: 2025-10-16T00:00:00.000Z Last Updated: 2025-10-17T13:28:08.648Z Vendors: n/a Products: n/a Problem Types: n/a Description: An out-of-bounds write in VirtIO network device emulation in BitVisor from commit 108df6 (2020-05-20) to commit 480907 (2025-07-06) allows local attackers to cause a denial of service (host hypervisor crash) via a crafted PCI configuration space access. Given it's a heap overflow in a privileged hypervisor context, exploitation may enable arbitrary code execution or guest-to-host privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sourceforge.net/p/bitvisor/code/ci/48090711ade59
dditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sourceforge.net/p/bitvisor/code/ci/48090711ade5910b601d2b0034859a6a890cc82d/ - https://github.com/retrage/advisories/blob/main/CVE-2025-61553/README.md
CVE ID: CVE-2025-61554 State: PUBLISHED Published: 2025-10-16T00:00:00.000Z Last Updated: 2025-10-17T13:32:58.313Z Vendors: n/a Products: n/a Problem Types: n/a Description: A divide-by-zero in VirtIO network device emulation in BitVisor from commit 108df6 (2020-05-20) to commit 480907 (2025-07-06) allows local attackers to cause a denial of service (host hypervisor crash) via a crafted PCI configuration space access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sourceforge.net/p/bitvisor/code/ci/de84887f4418fcd67945b4aa4842e035bce0dfa9 - https://github.com/retrage/advisories/blob/c20246f93edac1b8ad3c8c5e3e768d02405850c7/CVE-2025-61554/README.md
CVE ID: CVE-2025-61577 State: PUBLISHED Published: 2025-10-09T00:00:00.000Z Last Updated: 2025-10-09T19:09:41.342Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-816A2_FWv1.10CNB05 was discovered to contain a stack overflow via the statuscheckpppoeuser parameter in the dir_setWanWifi function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/peris-navince/founded-0-days/blob/main/Dlink/816/dir_setWanWifi/1.md - https://github.com/Flechao1/iot-vuln/blob/main/dlink-816-b05.md
CVE ID: CVE-2025-61581 State: PUBLISHED Published: 2025-10-16T08:40:11.865Z Last Updated: 2025-11-04T21:13:58.992Z Vendors: Apache Software Foundation Products: Apache Traffic Control Problem Types: CWE-1333 Description: ** UNSUPPORTED WHEN ASSIGNED ** Inefficient Regular Expression Complexity vulnerability in Apache Traffic Control. This issue affects Apache Traffic Control: all versions. People with access to the management interface of the Traffic Router component could specify malicious patterns and cause unavailability. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to
ease a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/mx2jxgnlop2f4vbqnvmrldh4pqmobxvp
CVE ID: CVE-2025-61582 State: PUBLISHED Published: 2025-10-01T22:20:35.501Z Last Updated: 2025-10-03T14:24:28.102Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: joni1802 Products: ts3-manager Problem Types: CWE-20 Description: TS3 Manager is modern web interface for maintaining Teamspeak3 servers. A Denial of Dervice vulnerability has been identified in versions 2.2.1 and earlier. The vulnerability permits an unauthenticated actor to crash the application through the submission of specially crafted Unicode input, requiring no prior authentication or privileges. The flaw manifests when Unicode tag characters are submitted to the Server field on the login page
cation or privileges. The flaw manifests when Unicode tag characters are submitted to the Server field on the login page. The application fails to properly handle these characters during the ASCII conversion process, resulting in an unhandled exception that terminates the application within four to five seconds of submission. This issue is fixed in version 2.2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/joni1802/ts3-manager/security/advisories/GHSA-4cq4-hp4f-8w7p - https://github.com/joni1802/ts3-manager/commit/3a069915f97a6f5dae1fe0b2e32aa11a69d83b5e
CVE ID: CVE-2025-61583 State: PUBLISHED Published: 2025-10-01T22:27:59.716Z Last Updated: 2025-10-02T18:01:57.231Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: joni1802 Products: ts3-manager Problem Types: CWE-20, CWE-80 Description: TS3 Manager is modern web interface for maintaining Teamspeak3 servers. A reflected cross-site scripting vulnerability has been identified in versions 2.2.1 and earlier. The vulnerability exists in the error handling mechanism of the login page, where malicious scripts embedded in server hostnames are executed in the victim's browser context without proper sanitization. This issue is fixed in version 2.2.2. Additional Analyst
ed in the victim's browser context without proper sanitization. This issue is fixed in version 2.2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/joni1802/ts3-manager/security/advisories/GHSA-qw6j-37r6-m93g - https://github.com/joni1802/ts3-manager/commit/3a069915f97a6f5dae1fe0b2e32aa11a69d83b5e
CVE ID: CVE-2025-61584 State: PUBLISHED Published: 2025-09-30T00:12:23.873Z Last Updated: 2025-09-30T13:33:56.830Z Vendors: serverless-dns Products: serverless-dns Problem Types: CWE-77 Description: serverless-dns is a RethinkDNS resolver that deploys to Cloudflare Workers, Deno Deploy, Fastly, and Fly.io. Versions through abd including 0.1.30 have a vulnerability where the pr.yml GitHub Action interpolates in an unsafe manner untrusted input, specifically the github.event.pull_request.head.repo.clone_url and github.head_ref, to a command in the runner. Due to the action using the pull_request_target trigger it has permissive permissions by default. An unauthorized attacker can exploit this
ing the pull_request_target trigger it has permissive permissions by default. An unauthorized attacker can exploit this vulnerability to push arbitrary data to the repository. The subsequent impact on the end-user is executing the attackers' code when running serverless-dns. This is fixed in commit c5537dd, and expected to be released in 0.1.31. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/serverless-dns/serverless-dns/security/advisories/GHSA-9g7x-737f-5xpc - https://github.com/serverless-dns/serverless-dns/commit/c5537dd7f203c59f2b86d1e295c2371f3533946a
CVE ID: CVE-2025-61585 State: REJECTED Published: N/A Last Updated: 2025-10-03T21:06:26.209Z Description: No description available.
CVE ID: CVE-2025-61586 State: PUBLISHED Published: 2025-09-29T23:14:51.054Z Last Updated: 2025-09-30T14:31:02.217Z Vendors: FreshRSS Products: FreshRSS Problem Types: CWE-22 Description: FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below are vulnerable to directory enumeration by setting path in theme field, allowing attackers to gain additional information about the server by checking if certain directories exist. This issue is fixed in version 1.27.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-w35p-p867-qr4f - https://github.com/FreshRSS/FreshRSS/pull/7722 - https://github.com/Fresh
hRSS/security/advisories/GHSA-w35p-p867-qr4f - https://github.com/FreshRSS/FreshRSS/pull/7722 - https://github.com/FreshRSS/FreshRSS/commit/6549932d59aef3b72a9da29294af0f30ffb77af5
CVE ID: CVE-2025-61587 State: PUBLISHED Published: 2025-10-01T22:01:00.707Z Last Updated: 2025-10-06T18:34:22.636Z Vendors: WeblateOrg Products: weblate Problem Types: CWE-601, CWE-1395 Description: Weblate is a web based localization tool. An open redirect exists in versions 5.13.2 and below via the redir parameter on .within.website when Weblate is configured with Anubis and REDIRECT_DOMAINS is not set. An attacker can craft a URL on the legitimate domain that redirects a victim to an attacker-controlled site. The redirect can also be used to initiate drive-by downloads (redirecting to a URL that serves a malicious file), increasing the risk to end users. This issue is fixed in version 5.1
redirecting to a URL that serves a malicious file), increasing the risk to end users. This issue is fixed in version 5.13.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/WeblateOrg/weblate/security/advisories/GHSA-3xhv-r4gx-xw99 - https://github.com/WeblateOrg/docker/commit/76518342f65b8af8c2b7f7c5d37f84813c1253a1 - https://github.com/WeblateOrg/weblate/commit/6b3d73a310279b5630bca8cbd9ea0be28bc67b63 - https://github.com/WeblateOrg/weblate/commit/ec3b900f8a52c5c992d9e7014f09397e159ac381
CVE ID: CVE-2025-61588 State: PUBLISHED Published: 2025-10-01T23:30:26.257Z Last Updated: 2025-10-02T18:01:05.528Z Vendors: risc0 Products: risc0 Problem Types: CWE-94 Description: RISC Zero is a zero-knowledge verifiable general computing platform based on zk-STARKs and the RISC-V microarchitecture. In versions 2.0.2 and below of risc0-zkvm-platform, when the zkVM guest calls sys_read, the host is able to use a crafted response to write to an arbitrary memory location in the guest. This capability can be leveraged to execute arbitrary code within the guest. As sys_read is the mechanism by which input is requested by the guest, all guest programs built with the affected versions are vulnerab
the mechanism by which input is requested by the guest, all guest programs built with the affected versions are vulnerable. This critically compromises the soundness guarantees of the guest program. Other affected packages include risc0-aggregation versions below 0.9, risc0-zkos-v1compat below 2.1.0, risc0-zkvm versions between 3.0.0-rc.1 and 3.0.1. This issue has been fixed in the following versions: risc0-zkvm-platform 2.1.0, risc0-zkos-v1compat 2.1.0, risc0-aggregation 0.9, and risc0-zkvm 2.3.2 and 3.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/risc0/risc0/security/advisories/GHSA-jqq4-c7wq-36h7 - https://github.com/risc0/risc0/pull/3351 - https
ttps://github.com/risc0/risc0/security/advisories/GHSA-jqq4-c7wq-36h7 - https://github.com/risc0/risc0/pull/3351 - https://github.com/risc0/risc0/commit/3f00e1fa0159599c1601e788021f2169d1f0a4dc
CVE ID: CVE-2025-61589 State: PUBLISHED Published: 2025-10-03T06:48:30.926Z Last Updated: 2025-10-03T13:23:17.983Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: cursor Products: cursor Problem Types: CWE-200 Description: Cursor is a code editor built for programming with AI. In versions 1.6 and below, Mermaid (a to render diagrams) allows embedding images which then get rendered by Cursor in the chat box. An attacker can use this to exfiltrate sensitive information to a third-party attacker controlled server through an image fetch after successfully performing a prompt injection. A malicious model (or hallucination/backdoor) might also trigger this exploit
uccessfully performing a prompt injection. A malicious model (or hallucination/backdoor) might also trigger this exploit at will. This issue requires prompt injection from malicious data (web, image upload, source code) in order to exploit. In that case, it can send sensitive information to an attacker-controlled external server. Some additional bypasses not covered in the initial fix to this issue were discovered, see GHSA-43wj-mwcc-x93p. This issue is fixed in version 1.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cursor/cursor/security/advisories/GHSA-xw2x-252g-97w2 - https://github.com/cursor/cursor/security/advisories/GHSA-43wj-mwcc-x93p
CVE ID: CVE-2025-61590 State: PUBLISHED Published: 2025-10-03T16:27:34.258Z Last Updated: 2025-10-03T18:27:52.376Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: cursor Products: cursor Problem Types: CWE-94 Description: Cursor is a code editor built for programming with AI. Versions 1.6 and below are vulnerable to Remote Code Execution (RCE) attacks through Visual Studio Code Workspaces. Workspaces allow users to open more than a single folder and save specific settings (pretty similar to .vscode/settings.json) for the folders / project. An untitled workspace is automatically created by VS Code (untitled.code-workspace), which contains all the folders and wo
untitled workspace is automatically created by VS Code (untitled.code-workspace), which contains all the folders and workspace settings from the user's current session, opening up an entire new attack vector if the user has a .code-workspace file in path (either untitled created automatically or a saved one). If an attacker is able to hijack the chat context of the victim (such as via a compromised MCP server), they can use prompt injection to make the Cursor Agent write into this file and modify the workspace. This leads to a bypass of CVE-2025-54130 which can lead to RCE by writing to the settings section. This issue is fixed in version 1.7. Additional Analyst Notes: - CISA ADP Vulnrichme
by writing to the settings section. This issue is fixed in version 1.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cursor/cursor/security/advisories/GHSA-xg6w-rmh5-r77r
CVE ID: CVE-2025-61591 State: PUBLISHED Published: 2025-10-03T16:44:54.776Z Last Updated: 2025-10-03T18:28:46.799Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: cursor Products: cursor Problem Types: CWE-78 Description: Cursor is a code editor built for programming with AI. In versions 1.7 and below, when MCP uses OAuth authentication with an untrusted MCP server, an attacker can impersonate a malicious MCP server and return crafted, maliciously injected commands during the interaction process, leading to command injection and potential remote code execution. If chained with an untrusted MCP service via OAuth, this command injection vulnerability could allow
ote code execution. If chained with an untrusted MCP service via OAuth, this command injection vulnerability could allow arbitrary code execution on the host by the agent. This can then be used to directly compromise the system by executing malicious commands with full user privileges. This issue does not currently have a fixed release version, but there is a patch, 2025.09.17-25b418f. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cursor/cursor/security/advisories/GHSA-wj33-264c-j9cq
CVE ID: CVE-2025-61592 State: PUBLISHED Published: 2025-10-03T17:23:37.743Z Last Updated: 2025-10-03T18:29:26.868Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: cursor Products: cursor Problem Types: CWE-829 Description: Cursor is a code editor built for programming with AI. In versions 1.7 and below, automatic loading of project-specific CLI configuration from the current working directory (<project>/.cursor/cli.json) could override certain global configurations in Cursor CLI. This allowed users running the CLI inside a malicious repository to be vulnerable to Remote Code Execution through a combination of permissive configuration (allowing shell commands)
y to be vulnerable to Remote Code Execution through a combination of permissive configuration (allowing shell commands) and prompt injection delivered via project-specific Rules (<project>/.cursor/rules/rule.mdc) or other mechanisms. The fix for this issue is currently available as a patch 2025.09.17-25b418f. As of October 3, 2025 there is no release version. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cursor/cursor/security/advisories/GHSA-v64q-396f-7m79
CVE ID: CVE-2025-61593 State: PUBLISHED Published: 2025-10-03T17:28:03.214Z Last Updated: 2025-10-03T18:30:34.784Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: cursor Products: cursor Problem Types: CWE-178, CWE-94 Description: Cursor is a code editor built for programming with AI. In versions 1.7 and below, a vulnerability in the way Cursor CLI Agent protects its sensitive files (i.e. */.cursor/cli.json) allows attackers to modify the content of the files through prompt injection, thus achieving remote code execution. A prompt injection can lead to full RCE through modifying sensitive files on case-insensitive filesystems. This issue is fixed in a commit,
an lead to full RCE through modifying sensitive files on case-insensitive filesystems. This issue is fixed in a commit, 25b418f, but has yet to be released as of October 3, 2025. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cursor/cursor/security/advisories/GHSA-x2vq-h6v6-jhc6
CVE ID: CVE-2025-61595 State: PUBLISHED Published: 2025-10-02T19:36:41.428Z Last Updated: 2025-10-02T19:49:51.997Z Vendors: MANTRA-Chain Products: mantrachain Problem Types: CWE-400, CWE-770 Description: MANTRA is a purpose-built RWA Layer 1 Blockchain, capable of adherence to real world regulatory requirements. Versions 4.0.1 and below do not enforce the tx gas limit in its send hooks. Send hooks can spend more gas than what remains in tx, combined with recursive calls in the wasm contract, potentially amplifying the gas consumption exponentially. This is fixed in version 4.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MANTRA-Chain/mantrachain/secu
4.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MANTRA-Chain/mantrachain/security/advisories/GHSA-qwvm-wqq8-8j69 - https://github.com/MANTRA-Chain/mantrachain/commit/30d36c46e9823b56b8f0dcbb66e980ca5df284e4
CVE ID: CVE-2025-61596 State: REJECTED Published: N/A Last Updated: 2025-10-01T17:00:53.913Z Description: No description available.
CVE ID: CVE-2025-61597 State: PUBLISHED Published: 2025-10-03T06:16:14.013Z Last Updated: 2025-10-03T13:33:18.931Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L) Vendors: emlog Products: emlog Problem Types: CWE-79 Description: Emlog is an open source website building system. In versions 2.5.21 and below, an HTML template injection allows stored cross‑site scripting (XSS) via the mail template settings. Once a malicious payload is saved, any subsequent visit to the settings page in an authenticated admin context will execute attacker‑controlled JavaScript, enabling session/token theft and full admin account takeover. This issue is fixed in version 2.5.22. Additional A
cript, enabling session/token theft and full admin account takeover. This issue is fixed in version 2.5.22. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/emlog/emlog/security/advisories/GHSA-hj97-hp2c-6m4m - https://github.com/emlog/emlog/pull/179
CVE ID: CVE-2025-61598 State: PUBLISHED Published: 2025-10-28T20:38:54.753Z Last Updated: 2025-10-29T13:43:00.335Z Vendors: discourse Products: discourse Problem Types: CWE-524 Description: Discourse is an open source discussion platform. Version before 3.6.2 and 3.6.0.beta2, default Cache-Control response header with value no-store, no-cache was missing from error responses. This may caused unintended caching of those responses by proxies potentially leading to cache poisoning attacks. This vulnerability is fixed in 3.6.2 and 3.6.0.beta2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-jp9x-wwv6-cv3j - https://
DP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-jp9x-wwv6-cv3j - https://github.com/discourse/discourse/commit/3ea1b663c82c067e5ca778db846bad1e082ba6cd - https://github.com/discourse/discourse/commit/fd567af7bf5a15c70772021acbdf5d38487a31bc
CVE ID: CVE-2025-61599 State: PUBLISHED Published: 2025-10-03T06:27:46.228Z Last Updated: 2025-10-03T13:30:16.657Z Vendors: emlog Products: emlog Problem Types: CWE-79 Description: Emlog is an open source website building system. A stored Cross-Site Scripting (XSS) vulnerability exists in the "Twitter"feature of EMLOG Pro 2.5.21 and below. An authenticated user with privileges to post a "Twitter" message can inject arbitrary JavaScript code. The malicious script is stored on the server and gets executed in the browser of any user, including administrators, when they click on the malicious post to view it. This issue does not currently have a fix. Additional Analyst Notes: - CISA ADP Vulnrich
n the malicious post to view it. This issue does not currently have a fix. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/emlog/emlog/security/advisories/GHSA-rm5c-mjpg-vm89
CVE ID: CVE-2025-61600 State: PUBLISHED Published: 2025-10-02T21:30:52.203Z Last Updated: 2025-10-03T13:39:45.634Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: stalwartlabs Products: stalwart Problem Types: CWE-400, CWE-789 Description: Stalwart is a mail and collaboration server. Versions 0.13.3 and below contain an unbounded memory allocation vulnerability in the IMAP protocol parser which allows remote attackers to exhaust server memory, potentially triggering the system's out-of-memory (OOM) killer and causing a denial of service. The CommandParser implementation enforces size limits on its dynamic buffer in most parsing states, but several state handle
CommandParser implementation enforces size limits on its dynamic buffer in most parsing states, but several state handlers omit these validation checks. This issue is fixed in version 0.13.4. A workaround for this issue is to implement rate limiting and connection monitoring at the network level, however this does not provide complete protection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/stalwartlabs/stalwart/security/advisories/GHSA-8jqj-qj5p-v5rr - https://github.com/stalwartlabs/stalwart/commit/a8e631e881bded8128358732f18e02ca94a4e677 - https://github.com/stalwartlabs/stalwart/releases/tag/v0.13.4