Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
rts. Please refer to the following link for the steps https://docs.versa-networks.com/Solutions/System_Hardening/Perform_Manual_Hardening_for_Versa_Director#Secure_HA_Ports This vulnerability is not exploitable on Versa Directors if published Firewall guidelines are implemented. We have validated that no Versa-hosted head ends have been affected by this vulnerability. All Versa-hosted head ends are patched and hardened. Please contact Versa Technical Support or Versa account team for any further assistance. Software Download Links: 22.1.4: https://support.versa-networks.com/support/solutions/articles/23000026708-release-22-1-4 Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
/support/solutions/articles/23000026708-release-22-1-4 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security-portal.versa-networks.com/emailbulletins/6735a300415abb89e9a8a9d3
CVE ID: CVE-2024-42451 State: PUBLISHED Published: 2024-12-04T01:06:04.677Z Last Updated: 2024-12-04T14:53:46.665Z Severity: HIGH (CVSS 7.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Veeam Products: Backup & Replication Description: A vulnerability in Veeam Backup & Replication allows low-privileged users to leak all saved credentials in plaintext. This is achieved by calling a series of methods over an external protocol, ultimately retrieving the credentials using a malicious setup on the attacker's side. This exposes sensitive data, which could be used for further attacks, including unauthorized access to systems managed by the platform. Additional Analyst Notes: - CISA ADP Vul
ther attacks, including unauthorized access to systems managed by the platform. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.veeam.com/kb4693
CVE ID: CVE-2024-42452 State: PUBLISHED Published: 2024-12-04T01:06:04.654Z Last Updated: 2024-12-04T16:03:26.578Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Veeam Products: Backup & Replication Description: A vulnerability in Veeam Backup & Replication allows a low-privileged user to start an agent remotely in server mode and obtain credentials, effectively escalating privileges to system-level access. This allows the attacker to upload files to the server with elevated privileges. The vulnerability exists because remote calls bypass permission checks, leading to full system compromise. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - htt
rmission checks, leading to full system compromise. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.veeam.com/kb4693
CVE ID: CVE-2024-42453 State: PUBLISHED Published: 2024-12-04T01:06:04.668Z Last Updated: 2024-12-04T14:54:37.763Z Severity: HIGH (CVSS 7.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: Veeam Products: Backup & Replication Description: A vulnerability Veeam Backup & Replication allows low-privileged users to control and modify configurations on connected virtual infrastructure hosts. This includes the ability to power off virtual machines, delete files in storage, and make configuration changes, potentially leading to Denial of Service (DoS) and data integrity issues. The vulnerability is caused by improper permission checks in methods accessed via management services. Additional An
es. The vulnerability is caused by improper permission checks in methods accessed via management services. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.veeam.com/kb4693
CVE ID: CVE-2024-42455 State: PUBLISHED Published: 2024-12-04T01:06:04.626Z Last Updated: 2024-12-05T10:59:46.913Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: Veeam Products: Backup & Replication Description: A vulnerability in Veeam Backup & Replication allows a low-privileged user to connect to remoting services and exploit insecure deserialization by sending a serialized temporary file collection. This exploit allows the attacker to delete any file on the system with service account privileges. The vulnerability is caused by an insufficient blacklist during the deserialization process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - htt
cient blacklist during the deserialization process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.veeam.com/kb4693
CVE ID: CVE-2024-42456 State: PUBLISHED Published: 2024-12-04T01:06:04.627Z Last Updated: 2024-12-04T16:48:57.686Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Veeam Products: Backup & Replication Description: A vulnerability in Veeam Backup & Replication platform allows a low-privileged user with a specific role to exploit a method that updates critical configuration settings, such as modifying the trusted client certificate used for authentication on a specific port. This can result in unauthorized access, enabling the user to call privileged methods and initiate critical services. The issue arises due to insufficient permission requirements on the method
leged methods and initiate critical services. The issue arises due to insufficient permission requirements on the method, allowing users with low privileges to perform actions that should require higher-level permissions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.veeam.com/kb4693
CVE ID: CVE-2024-42457 State: PUBLISHED Published: 2024-12-04T01:06:04.658Z Last Updated: 2024-12-04T16:00:32.213Z Severity: HIGH (CVSS 7.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Veeam Products: Backup & Replication Description: A vulnerability in Veeam Backup & Replication allows users with certain operator roles to expose saved credentials by leveraging a combination of methods in a remote management interface. This can be achieved using a session object that allows for credential enumeration and exploitation, leading to the leak of plaintext credentials to a malicious host. The attack is facilitated by improper usage of a method that allows operators to add a new host with
o a malicious host. The attack is facilitated by improper usage of a method that allows operators to add a new host with an attacker-controlled IP, enabling them to retrieve sensitive credentials in plaintext. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.veeam.com/kb4693
CVE ID: CVE-2024-42458 State: PUBLISHED Published: 2024-08-02T00:00:00 Last Updated: 2024-08-07T15:20:47.299Z Vendors: n/a Products: n/a Problem Types: n/a Description: server.c in Neat VNC (aka neatvnc) before 0.8.1 does not properly validate the security type, a related issue to CVE-2006-2369. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/any1/neatvnc/commit/cc71650a69abc2573a0d96d082409d2468802d47 - https://github.com/any1/neatvnc/compare/v0.8.0...v0.8.1 - https://github.com/any1/neatvnc/releases/tag/v0.8.1 - https://www.openwall.com/lists/oss-security/2024/08/02/1 - https://www.openwall.com/lists/oss-security/2024/08/02/7 - https://www.openwall.com/l
/lists/oss-security/2024/08/02/1 - https://www.openwall.com/lists/oss-security/2024/08/02/7 - https://www.openwall.com/lists/oss-security/2024/08/02/10
CVE ID: CVE-2024-42459 State: PUBLISHED Published: 2024-08-02T00:00:00.000Z Last Updated: 2025-11-03T22:04:51.903Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Elliptic package 6.5.6 for Node.js, EDDSA signature malleability occurs because there is a missing signature length check, and thus zero-valued bytes can be removed or appended. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/indutny/elliptic/pull/317
CVE ID: CVE-2024-42460 State: PUBLISHED Published: 2024-08-02T00:00:00.000Z Last Updated: 2025-11-03T22:04:53.363Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because there is a missing check for whether the leading bit of r and s is zero. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/indutny/elliptic/pull/317
CVE ID: CVE-2024-42461 State: PUBLISHED Published: 2024-08-02T00:00:00.000Z Last Updated: 2025-11-03T22:04:54.848Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/indutny/elliptic/pull/317
CVE ID: CVE-2024-42462 State: PUBLISHED Published: 2024-08-16T13:22:59.157Z Last Updated: 2025-10-03T14:07:03.526Z Vendors: upKeeper Solutions Products: upKeeper Manager Problem Types: CWE-306 Description: Improper Authentication vulnerability in upKeeper Solutions product upKeeper Manager allows Authentication Bypass.This issue affects upKeeper Manager: through 5.1.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.upkeeper.se/hc/en-us/articles/15432045399452-CVE-2024-42462-Bypass-multifactor-authentication
CVE ID: CVE-2024-42463 State: PUBLISHED Published: 2024-08-16T13:24:07.821Z Last Updated: 2024-08-20T16:51:09.282Z Vendors: upKeeper Solutions Products: upKeeper Manager Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key vulnerability in upKeeper Solutions product upKeeper Manager allows Utilizing REST's Trust in the System Resource to Obtain Sensitive Data.This issue affects upKeeper Manager: through 5.1.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.upkeeper.se/hc/en-us/articles/15432241822620-CVE-2024-42463-Leak-of-organizations-messages
CVE ID: CVE-2024-42464 State: PUBLISHED Published: 2024-08-16T13:25:20.986Z Last Updated: 2024-08-16T15:50:20.872Z Vendors: upKeeper Solutions Products: upKeeper Manager Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key vulnerability in upKeeper Solutions product upKeeper Manager allows Utilizing REST's Trust in the System Resource to Obtain Sensitive Data.This issue affects upKeeper Manager: through 5.1.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.upkeeper.se/hc/en-us/articles/15432275702044-CVE-2024-42464-Leak-of-user-Information
CVE ID: CVE-2024-42465 State: PUBLISHED Published: 2024-08-16T13:26:14.455Z Last Updated: 2024-08-16T13:54:38.679Z Vendors: upKeeper Solutions Products: upKeeper Manager Problem Types: CWE-307 Description: Improper Restriction of Excessive Authentication Attempts vulnerability in upKeeper Solutions product upKeeper Manager allows Authentication Abuse.This issue affects upKeeper Manager: through 5.1.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.upkeeper.se/hc/en-us/articles/15432332385564-CVE-2024-42465-Lack-of-resources-and-rate-limiting-two-factor-authentication
CVE ID: CVE-2024-42466 State: PUBLISHED Published: 2024-08-16T13:27:18.919Z Last Updated: 2024-08-16T17:32:47.854Z Vendors: upKeeper Solutions Products: upKeeper Manager Problem Types: CWE-307 Description: Improper Restriction of Excessive Authentication Attempts vulnerability in upKeeper Solutions product upKeeper Manager allows Authentication Abuse.This issue affects upKeeper Manager: through 5.1.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.upkeeper.se/hc/en-us/articles/15432408367260-CVE-2024-42466-Lack-of-resources-and-rate-limiting-login
CVE ID: CVE-2024-42467 State: PUBLISHED Published: 2024-08-09T18:06:34.059Z Last Updated: 2024-08-12T17:34:04.341Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: openhab Products: openhab-webui Problem Types: CWE-918 Description: openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. Prior to version 4.2.1, the proxy endpoint of openHAB's CometVisu add-on can be accessed without authentication. This proxy-feature can be exploited as Server-Side Request Forgery (SSRF) to induce GET HTTP requests to internal-only servers, in case openHAB is exposed in a non-private network. Furthermore, this pro
e GET HTTP requests to internal-only servers, in case openHAB is exposed in a non-private network. Furthermore, this proxy-feature can also be exploited as a Cross-Site Scripting (XSS) vulnerability, as an attacker is able to re-route a request to their server and return a page with malicious JavaScript code. Since the browser receives this data directly from the openHAB CometVisu UI, this JavaScript code will be executed with the origin of the CometVisu UI. This allows an attacker to exploit call endpoints on an openHAB server even if the openHAB server is located in a private network. (e.g. by sending an openHAB admin a link that proxies malicious JavaScript.) This issue may lead up to Rem
vate network. (e.g. by sending an openHAB admin a link that proxies malicious JavaScript.) This issue may lead up to Remote Code Execution (RCE) when chained with other vulnerabilities. Users should upgrade to version 4.2.1 of the CometVisu add-on of openHAB to receive a patch. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/openhab/openhab-webui/security/advisories/GHSA-v7gr-mqpj-wwh3 - https://github.com/openhab/openhab-webui/commit/630e8525835c698cf58856aa43782d92b18087f2 - https://github.com/openhab/openhab-webui/blob/1c03c60f84388b9d7da0231df2d4ebb1e17d3fcf/bundles/org.openhab.ui.cometvisu/src/main/java/org/openhab/ui/cometvisu/internal/backend/rest/P
7da0231df2d4ebb1e17d3fcf/bundles/org.openhab.ui.cometvisu/src/main/java/org/openhab/ui/cometvisu/internal/backend/rest/ProxyResource.java#L83
CVE ID: CVE-2024-42468 State: PUBLISHED Published: 2024-08-09T18:10:20.660Z Last Updated: 2024-08-13T18:39:57.323Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: openhab Products: openhab-webui Problem Types: CWE-22 Description: openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. CometVisuServlet in versions prior to 4.2.1 is susceptible to an unauthenticated path traversal vulnerability. Local files on the server can be requested via HTTP GET on the CometVisuServlet. This issue may lead to information disclosure. Users should upgrade to version 4.2.1 of the CometVisu add-on of openHAB to re
issue may lead to information disclosure. Users should upgrade to version 4.2.1 of the CometVisu add-on of openHAB to receive a patch. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/openhab/openhab-webui/security/advisories/GHSA-pcwp-26pw-j98w - https://github.com/openhab/openhab-webui/commit/630e8525835c698cf58856aa43782d92b18087f2 - https://github.com/openhab/openhab-webui/blob/1c03c60f84388b9d7da0231df2d4ebb1e17d3fcf/bundles/org.openhab.ui.cometvisu/src/main/java/org/openhab/ui/cometvisu/internal/servlet/CometVisuServlet.java#L75
CVE ID: CVE-2024-42469 State: PUBLISHED Published: 2024-08-09T18:12:11.502Z Last Updated: 2024-08-09T18:32:18.245Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: openhab Products: openhab-webui Problem Types: CWE-22 Description: openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. Prior to version 4.2.1, CometVisu's file system endpoints don't require authentication and additionally the endpoint to update an existing file is susceptible to path traversal. This makes it possible for an attacker to overwrite existing files on the openHAB instance. If the overwritten file is a shell script tha
sible for an attacker to overwrite existing files on the openHAB instance. If the overwritten file is a shell script that is executed at a later time, this vulnerability can allow remote code execution by an attacker. Users should upgrade to version 4.2.1 to receive a patch. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/openhab/openhab-webui/security/advisories/GHSA-f729-58x4-gqgf - https://github.com/openhab/openhab-webui/commit/630e8525835c698cf58856aa43782d92b18087f2
CVE ID: CVE-2024-42470 State: PUBLISHED Published: 2024-08-09T18:02:12.061Z Last Updated: 2024-08-09T21:32:13.351Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: openhab Products: openhab-webui Problem Types: CWE-862 Description: openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. Several endpoints in versions prior to 4.2.1 of the CometVisu add-on of openHAB don't require authentication. This makes it possible for unauthenticated attackers to modify or to steal sensitive data. This issue may lead to sensitive information disclosure. Users should upgrade to version 4.2.1 of the CometVisu add
ata. This issue may lead to sensitive information disclosure. Users should upgrade to version 4.2.1 of the CometVisu add-on of openHAB to receive a patch. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/openhab/openhab-webui/security/advisories/GHSA-3g4c-hjhr-73rj - https://github.com/openhab/openhab-webui/commit/630e8525835c698cf58856aa43782d92b18087f2
CVE ID: CVE-2024-42471 State: PUBLISHED Published: 2024-09-02T16:13:50.712Z Last Updated: 2025-08-27T21:33:03.045Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: actions Products: toolkit Problem Types: CWE-22 Description: actions/artifact is the GitHub ToolKit for developing GitHub Actions. Versions of `actions/artifact` on the 2.x branch before 2.1.2 are vulnerable to arbitrary file write when using `downloadArtifactInternal`, `downloadArtifactPublic`, or `streamExtractExternal` for extracting a specifically crafted artifact that contains path traversal filenames. Users are advised to upgrade to version 2.1.2 or higher. There are no known workarounds for th
path traversal filenames. Users are advised to upgrade to version 2.1.2 or higher. There are no known workarounds for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/actions/toolkit/security/advisories/GHSA-6q32-hq47-5qq3 - https://github.com/actions/toolkit/pull/1666 - https://snyk.io/research/zip-slip-vulnerability
CVE ID: CVE-2024-42472 State: PUBLISHED Published: 2024-08-15T18:32:11.304Z Last Updated: 2025-04-02T22:03:10.874Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: flatpak Products: flatpak Problem Types: CWE-74 Description: Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files outside of what it would otherwise have access to, which is an attack on integrity and confidentiality. When `persistent=subdir` is used in the application permissions (represented as `--persist=subdir` in the command-line interface), t
tent=subdir` is used in the application permissions (represented as `--persist=subdir` in the command-line interface), that means that an application which otherwise doesn't have access to the real user home directory will see an empty home directory with a writeable subdirectory `subdir`. Behind the scenes, this directory is actually a bind mount and the data is stored in the per-application directory as `~/.var/app/$APPID/subdir`. This allows existing apps that are not aware of the per-application directory to still work as intended without general home directory access. However, the application does have write access to the application directory `~/.var/app/$APPID` where this directory is
However, the application does have write access to the application directory `~/.var/app/$APPID` where this directory is stored. If the source directory for the `persistent`/`--persist` option is replaced by a symlink, then the next time the application is started, the bind mount will follow the symlink and mount whatever it points to into the sandbox. Partial protection against this vulnerability can be provided by patching Flatpak using the patches in commits ceec2ffc and 98f79773. However, this leaves a race condition that could be exploited by two instances of a malicious app running in parallel. Closing the race condition requires updating or patching the version of bubblewrap that is u
us app running in parallel. Closing the race condition requires updating or patching the version of bubblewrap that is used by Flatpak to add the new `--bind-fd` option using the patch and then patching Flatpak to use it. If Flatpak has been configured at build-time with `-Dsystem_bubblewrap=bwrap` (1.15.x) or `--with-system-bubblewrap=bwrap` (1.14.x or older), or a similar option, then the version of bubblewrap that needs to be patched is a system copy that is distributed separately, typically `/usr/bin/bwrap`. This configuration is the one that is typically used in Linux distributions. If Flatpak has been configured at build-time with `-Dsystem_bubblewrap=` (1.15.x) or with `--without-syst
distributions. If Flatpak has been configured at build-time with `-Dsystem_bubblewrap=` (1.15.x) or with `--without-system-bubblewrap` (1.14.x or older), then it is the bundled version of bubblewrap that is included with Flatpak that must be patched. This is typically installed as `/usr/libexec/flatpak-bwrap`. This configuration is the default when building from source code. For the 1.14.x stable branch, these changes are included in Flatpak 1.14.10. The bundled version of bubblewrap included in this release has been updated to 0.6.3. For the 1.15.x development branch, these changes are included in Flatpak 1.15.10. The bundled version of bubblewrap in this release is a Meson "wrap" subprojec
e changes are included in Flatpak 1.15.10. The bundled version of bubblewrap in this release is a Meson "wrap" subproject, which has been updated to 0.10.0. The 1.12.x and 1.10.x branches will not be updated for this vulnerability. Long-term support OS distributions should backport the individual changes into their versions of Flatpak and bubblewrap, or update to newer versions if their stability policy allows it. As a workaround, avoid using applications using the `persistent` (`--persist`) permission. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/flatpak/flatpak/security/advisories/GHSA-7hgv-f2j8-xw87 - https://github.com/conta
ent: References: - https://github.com/flatpak/flatpak/security/advisories/GHSA-7hgv-f2j8-xw87 - https://github.com/containers/bubblewrap/commit/68e75c3091c87583c28a439b45c45627a94d622c - https://github.com/containers/bubblewrap/commit/a253257cd298892da43e15201d83f9a02c9b58b5 - https://github.com/flatpak/flatpak/commit/2cdd1e1e5ae90d7c3a4b60ce2e36e4d609e44e72 - https://github.com/flatpak/flatpak/commit/3caeb16c31a3ed62d744e2aaf01d684f7991051a - https://github.com/flatpak/flatpak/commit/6bd603f6836e9b38b9b937d3b78f3fbf36e7ff75 - https://github.com/flatpak/flatpak/commit/7c63e53bb2af0aae9097fd2edfd6a9ba9d453e97 - https://github.com/flatpak/flatpak/commit/8a18137d7e80f0575e8defabf677d81e5cc3a788
53bb2af0aae9097fd2edfd6a9ba9d453e97 - https://github.com/flatpak/flatpak/commit/8a18137d7e80f0575e8defabf677d81e5cc3a788 - https://github.com/flatpak/flatpak/commit/db3a785241fda63bf53f0ec12bb519aa5210de19
CVE ID: CVE-2024-42473 State: PUBLISHED Published: 2024-08-09T21:16:17.683Z Last Updated: 2024-08-10T14:21:04.103Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: openfga Products: openfga Problem Types: CWE-863 Description: OpenFGA is an authorization/permission engine. OpenFGA v1.5.7 and v1.5.8 are vulnerable to authorization bypass when calling Check API with a model that uses `but not` and `from` expressions and a userset. Users should downgrade to v1.5.6 as soon as possible. This downgrade is backward compatible. As of time of publication, a patch is not available but OpenFGA's maintainers are planning a patch for inclusion in a future release. Additional