Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-24921 State: PUBLISHED Published: 2025-08-12T16:59:12.208Z Last Updated: 2025-08-13T20:16:08.861Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N) Vendors: n/a Products: Edge Orchestrator software Problem Types: Information Disclosure, CWE-707 Description: Improper neutralization for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an unauthenticated user to potentially enable information disclosure via adjacent access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01317.html
CVE ID: CVE-2025-24922 State: PUBLISHED Published: 2025-06-13T20:51:33.392Z Last Updated: 2025-11-03T19:44:54.126Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Broadcom, Dell Products: BCM5820X, ControlVault3, ControlVault3 Plus Problem Types: CWE-121 Description: A stack-based buffer overflow vulnerability exists in the securebio_identify functionality of Dell ControlVault3 prior to 5.15.10.14 and Dell ControlVault3 Plus prior to 6.2.26.36. A specially crafted malicious cv_object can lead to a arbitrary code execution. An attacker can issue an API call to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container
ue an API call to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000276106/dsa-2025-053
CVE ID: CVE-2025-24923 State: PUBLISHED Published: 2025-08-12T16:59:14.048Z Last Updated: 2025-08-15T03:55:45.303Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) AI for Enterprise Retrieval-augmented Generation software Problem Types: Escalation of Privilege, CWE-427 Description: Uncontrolled search path in some Intel(R) AI for Enterprise Retrieval-augmented Generation software may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01338.html
CVE ID: CVE-2025-24924 State: PUBLISHED Published: 2025-03-05T00:02:08.272Z Last Updated: 2025-03-05T15:07:16.136Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: GMOD Products: Apollo Problem Types: CWE-306 Description: Certain functionality within GMOD Apollo does not require authentication when passed with an administrative username Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-07
CVE ID: CVE-2025-24925 State: PUBLISHED Published: 2025-08-11T02:55:05.184Z Last Updated: 2025-08-11T20:38:55.412Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-401 Description: in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through missing release of memory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-07.md
CVE ID: CVE-2025-24928 State: PUBLISHED Published: 2025-02-18T00:00:00.000Z Last Updated: 2025-11-03T21:12:47.571Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: xmlsoft Products: libxml2 Problem Types: CWE-121 Description: libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. To exploit this, DTD validation must occur for an untrusted document or untrusted DTD. NOTE: this is similar to CVE-2017-9047. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.gnome.org/GNOME/libxml2/-/issues/847 - https://issues.oss-fuzz.com/issues/392687022
CVE ID: CVE-2025-24934 State: PUBLISHED Published: 2025-10-22T17:43:12.326Z Last Updated: 2025-10-22T20:01:34.413Z Vendors: FreeBSD Products: FreeBSD Problem Types: CWE-488 Description: Software which sets SO_REUSEPORT_LB on a socket and then connects it to a host will not directly observe any problems. However, due to its membership in a load-balancing group, that socket will receive packets originating from any host. This breaks the contract of the connect(2) and implied connect via sendto(2), and may leave the application vulnerable to spoofing attacks. The kernel failed to check the connection state of sockets when adding them to load-balancing groups. Furthermore, when looking up the de
to check the connection state of sockets when adding them to load-balancing groups. Furthermore, when looking up the destination socket for an incoming packet, the kernel will match a socket belonging to a load-balancing group even if it is connected, in violation of the contract that connected sockets are only supposed to receive packets originating from the connected host. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.freebsd.org/advisories/FreeBSD-SA-25:09.netinet.asc
CVE ID: CVE-2025-24936 State: PUBLISHED Published: 2025-07-21T06:27:46.093Z Last Updated: 2025-07-23T18:45:22.589Z Vendors: Nokia Products: WaveSuite NOC Description: The web application allows user input to pass unfiltered to a command executed on the underlying operating system. The vulnerable component is bound to the network stack and the set of possible attackers extends up to and including the entire Internet. An attacker with low privileged access to the application has the potential to execute commands on the operating system under the context of the webserver. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nokia.com/about-us/security-and-privacy/product
tional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2025-24936/
CVE ID: CVE-2025-24937 State: PUBLISHED Published: 2025-07-21T06:31:24.062Z Last Updated: 2025-07-23T18:43:23.466Z Vendors: Nokia Products: WaveSuite NOC Description: File contents could be read from the local file system by an attacker. Additionally, malicious code could be inserted in the file, leading to a full compromise of the web application and the container it is running on. The vulnerable component is bound to the network stack and the set of possible attackers extends up to and including the entire Internet. The web application allows arbitrary files to be included in a file that was downloadable and executable by the web server. Additional Analyst Notes: - CISA ADP Vulnrichment: R
d in a file that was downloadable and executable by the web server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2025-24937/
CVE ID: CVE-2025-24938 State: PUBLISHED Published: 2025-07-21T06:33:56.306Z Last Updated: 2025-07-23T18:39:08.345Z Vendors: Nokia Products: WaveSuite NOC Description: The web application allows user input to pass unfiltered to a command executed on the underlying operating system. An attacker with high privileged access (administrator) to the application has the potential execute commands on the operating system under the context of the webserver. The vulnerable component is bound to the network stack and the set of possible attackers extends up to and including the entire Internet. Has the potential to inject command while creating a new User from User Management. Additional Analyst Notes:
Internet. Has the potential to inject command while creating a new User from User Management. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2025-24938/
CVE ID: CVE-2025-24946 State: PUBLISHED Published: 2025-02-20T00:00:00.000Z Last Updated: 2025-02-20T17:26:27.660Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: privateoctopus Products: picoquic Problem Types: CWE-407 Description: The hash table used to manage connections in picoquic before b80fd3f uses a weak hash function, allowing remote attackers to cause a considerable CPU load on the server (a Hash DoS attack) by initiating connections with colliding Source Connection IDs (SCIDs). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ncc-pbottine/QUIC-Hash-Dos-Advisory - https://github.com/private-octopus/picoquic/commit
eferences: - https://github.com/ncc-pbottine/QUIC-Hash-Dos-Advisory - https://github.com/private-octopus/picoquic/commit/b80fd3f5903279ae3e7714ee4109363d9ab4491a
CVE ID: CVE-2025-24947 State: PUBLISHED Published: 2025-02-20T00:00:00.000Z Last Updated: 2025-02-20T20:19:05.607Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: litespeedtech Products: LSQUIC Problem Types: CWE-407 Description: A hash collision vulnerability (in the hash table used to manage connections) in LSQUIC (aka LiteSpeed QUIC) before 4.2.0 allows remote attackers to cause a considerable CPU load on the server (a Hash DoS attack) by initiating connections with colliding Source Connection IDs (SCIDs). This is caused by XXH32 usage. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://xxhash.com - https://github.com/ncc-pbottine/QU
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://xxhash.com - https://github.com/ncc-pbottine/QUIC-Hash-Dos-Advisory - https://github.com/litespeedtech/lsquic/releases/tag/v4.2.0
CVE ID: CVE-2025-24948 State: PUBLISHED Published: 2025-04-15T00:00:00.000Z Last Updated: 2025-04-15T20:08:06.623Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JotUrl 2.0, passwords are sent via HTTP GET-type requests, potentially exposing credentials to eavesdropping or insecure records. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gruppotim.it/it/footer/red-team.html
CVE ID: CVE-2025-24949 State: PUBLISHED Published: 2025-04-15T00:00:00.000Z Last Updated: 2025-04-15T19:57:29.824Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JotUrl 2.0, is possible to bypass security requirements during the password change process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gruppotim.it/it/footer/red-team.html
CVE ID: CVE-2025-24956 State: PUBLISHED Published: 2025-02-11T10:29:18.342Z Last Updated: 2025-02-12T20:51:43.499Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: OpenV2G Problem Types: CWE-120 Description: A vulnerability has been identified in OpenV2G (All versions < V0.9.6). The OpenV2G EXI parsing feature is missing a length check when parsing X509 serial numbers. Thus, an attacker could introduce a buffer overflow that leads to memory corruption. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-647005.html
CVE ID: CVE-2025-24957 State: PUBLISHED Published: 2025-02-03T21:43:41.643Z Last Updated: 2025-02-04T15:23:53.847Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-89 Description: WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `get_detalhes_socio.php` endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to or deletion of sensitive information. This issue has been addressed in version 3.2.12 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-x28g-6228-99p9
CVE ID: CVE-2025-24958 State: PUBLISHED Published: 2025-02-03T21:43:39.768Z Last Updated: 2025-02-04T15:24:31.050Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-89 Description: WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `salvar_tag.php` endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to or deletion of sensitive information. This issue has been addressed in version 3.2.12 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://
e no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-2mhx-5998-46hx
CVE ID: CVE-2025-24959 State: PUBLISHED Published: 2025-02-03T20:48:16.507Z Last Updated: 2025-02-12T20:51:25.848Z Vendors: google Products: zx Problem Types: CWE-94 Description: zx is a tool for writing better scripts. An attacker with control over environment variable values can inject unintended environment variables into `process.env`. This can lead to arbitrary command execution or unexpected behavior in applications that rely on environment variables for security-sensitive operations. Applications that process untrusted input and pass it through `dotenv.stringify` are particularly vulnerable. This issue has been patched in version 8.3.2. Users should immediately upgrade to this version
particularly vulnerable. This issue has been patched in version 8.3.2. Users should immediately upgrade to this version to mitigate the vulnerability. If upgrading is not feasible, users can mitigate the vulnerability by sanitizing user-controlled environment variable values before passing them to `dotenv.stringify`. Specifically, avoid using `"`, `'`, and backticks in values, or enforce strict validation of environment variables before usage. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/google/zx/security/advisories/GHSA-qwp8-x4ff-5h87 - https://github.com/google/zx/pull/1094
CVE ID: CVE-2025-24960 State: PUBLISHED Published: 2025-02-03T20:40:50.403Z Last Updated: 2025-02-12T20:51:26.290Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: CyferShepard Products: Jellystat Problem Types: CWE-22 Description: Jellystat is a free and open source Statistics App for Jellyfin. In affected versions Jellystat is directly using a user input in the route(s). This can lead to Path Traversal Vulnerabilities. Since this functionality is only for admin(s), there is very little scope for abuse. However, the `DELETE` `files/:filename` can be used to delete any file. This issue has been addressed in version 1.1.3. Users are advised to upgrade. There are
can be used to delete any file. This issue has been addressed in version 1.1.3. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/CyferShepard/Jellystat/security/advisories/GHSA-6x46-6w9f-ffv6 - https://github.com/CyferShepard/Jellystat/pull/303 - https://cwe.mitre.org/data/definitions/22.html
CVE ID: CVE-2025-24961 State: PUBLISHED Published: 2025-02-03T20:29:17.885Z Last Updated: 2025-02-12T20:51:25.069Z Vendors: gaul Products: s3proxy Problem Types: CWE-22 Description: org.gaul S3Proxy implements the S3 API and proxies requests. Users of the filesystem and filesystem-nio2 storage backends could unintentionally expose local files to users. This issue has been addressed in version 2.6.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/gaul/s3proxy/security/advisories/GHSA-2ccp-vqmv-4r4x - https://github.com/apache/jclouds/commit/b0819e0ef5e08c792a4d1724b938714c
roxy/security/advisories/GHSA-2ccp-vqmv-4r4x - https://github.com/apache/jclouds/commit/b0819e0ef5e08c792a4d1724b938714ce9503aa3 - https://github.com/gaul/s3proxy/commit/86b6ee4749aa163a78e7898efc063617ed171980
CVE ID: CVE-2025-24962 State: PUBLISHED Published: 2025-02-03T20:58:06.512Z Last Updated: 2025-02-12T20:51:26.145Z Vendors: yogeshojha Products: rengine Problem Types: CWE-74 Description: reNgine is an automated reconnaissance framework for web applications. In affected versions a user can inject commands via the nmap_cmd parameters. This issue has been addressed in commit `c28e5c8d` and is expected in the next versioned release. Users are advised to filter user input and monitor the project for a new release. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/yogeshojha/rengine/security/advisories/GHSA-cg75-ph7x-5rr9 - https://github.com/yogeshojha/rengine/c
https://github.com/yogeshojha/rengine/security/advisories/GHSA-cg75-ph7x-5rr9 - https://github.com/yogeshojha/rengine/commit/c28e5c8d304478a787811580b4d80b330920ace4
CVE ID: CVE-2025-24963 State: PUBLISHED Published: 2025-02-04T19:36:52.385Z Last Updated: 2025-02-12T20:51:28.011Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: vitest-dev Products: vitest Problem Types: CWE-22 Description: Vitest is a testing framework powered by Vite. The `__screenshot-error` handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by `browser.api.host: true`, an attacker can send a request to that handler from remote to get the content of arbitrary files.This `__screenshot-error` handler on the browser mode HTTP server responds any file on the file system. This
trary files.This `__screenshot-error` handler on the browser mode HTTP server responds any file on the file system. This code was added by commit `2d62051`. Users explicitly exposing the browser mode server to the network by `browser.api.host: true` may get any files exposed. This issue has been addressed in versions 2.1.9 and 3.0.4. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vitest-dev/vitest/security/advisories/GHSA-8gvc-j273-4wm5 - https://github.com/vitest-dev/vitest/commit/2d62051f13b4b0939b2f7e94e88006d830dc4d1f - https://github.com/vitest-dev/vitest/blob/f17918
com/vitest-dev/vitest/commit/2d62051f13b4b0939b2f7e94e88006d830dc4d1f - https://github.com/vitest-dev/vitest/blob/f17918a79969d27a415f70431e08a9445b051e45/packages/browser/src/node/plugin.ts#L88-L130 - https://vitest.dev/guide/browser/config.html#browser-api
CVE ID: CVE-2025-24964 State: PUBLISHED Published: 2025-02-04T19:36:50.509Z Last Updated: 2025-02-12T20:51:28.286Z Severity: CRITICAL (CVSS 9.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: vitest-dev Products: vitest Problem Types: CWE-1385 Description: Vitest is a testing framework powered by Vite. Affected versions are subject to arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking (CSWSH) attacks. When `api` option is enabled (Vitest UI enables it), Vitest starts a WebSocket server. This WebSocket server did not check Origin header and did not have any authorization mechanism and was vulnerable
rver. This WebSocket server did not check Origin header and did not have any authorization mechanism and was vulnerable to CSWSH attacks. This WebSocket server has `saveTestFile` API that can edit a test file and `rerun` API that can rerun the tests. An attacker can execute arbitrary code by injecting a code in a test file by the `saveTestFile` API and then running that file by calling the `rerun` API. This vulnerability can result in remote code execution for users that are using Vitest serve API. This issue has been patched in versions 1.6.1, 2.1.9 and 3.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichme
vised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vitest-dev/vitest/security/advisories/GHSA-9crc-q9x8-hgqq - https://github.com/vitest-dev/vitest/blob/9a581e1c43e5c02b11e2a8026a55ce6a8cb35114/packages/vitest/src/api/setup.ts#L32-L46 - https://github.com/vitest-dev/vitest/blob/9a581e1c43e5c02b11e2a8026a55ce6a8cb35114/packages/vitest/src/api/setup.ts#L66-L76 - https://vitest.dev/config/#api
CVE ID: CVE-2025-24965 State: PUBLISHED Published: 2025-02-19T16:46:31.602Z Last Updated: 2025-02-19T16:56:05.966Z Vendors: containers Products: crun Problem Types: CWE-22 Description: crun is an open source OCI Container Runtime fully written in C. In affected versions A malicious container image could trick the krun handler into escaping the root filesystem, allowing file creation or modification on the host. No special permissions are needed, only the ability for the current user to write to the target file. The problem is fixed in crun 1.20 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: Refer
upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/containers/crun/security/advisories/GHSA-f42g-r5jj-qh4j - https://github.com/containers/crun/commit/0aec82c2b686f0b1793deed43b46524fe2e8b5a7 - https://github.com/containers/crun/releases/tag/1.20
CVE ID: CVE-2025-24966 State: PUBLISHED Published: 2025-02-04T19:26:54.322Z Last Updated: 2025-02-04T19:55:31.392Z Vendors: yogeshojha Products: rengine Problem Types: CWE-79 Description: reNgine is an automated reconnaissance framework for web applications. HTML Injection occurs when an application improperly validates or sanitizes user inputs, allowing attackers to inject arbitrary HTML code. In this scenario, the vulnerability exists in the "Add Target" functionality of the application, where the Target Organization and Target Description fields accept HTML payloads. The injected HTML is rendered and executed in the target area, potentially leading to malicious actions. Exploitation of HT
injected HTML is rendered and executed in the target area, potentially leading to malicious actions. Exploitation of HTML Injection can compromise the application's integrity and user trust. Attackers can execute unauthorized actions, steal sensitive information, or trick users into performing harmful actions. The organization's reputation, customer trust, and regulatory compliance could be negatively affected. This issue affects all versions up to and including 2.2.0. Users are advised to monitor the project for future releases which address this issue. There are no known workarounds. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/yogeshojha/rengine/sec
workarounds. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/yogeshojha/rengine/security/advisories/GHSA-4phc-m2wm-p8x6
CVE ID: CVE-2025-24967 State: PUBLISHED Published: 2025-02-04T19:28:16.069Z Last Updated: 2025-02-04T19:54:30.726Z Vendors: yogeshojha Products: rengine Problem Types: CWE-79 Description: reNgine is an automated reconnaissance framework for web applications. A stored cross-site scripting (XSS) vulnerability exists in the admin panel's user management functionality. An attacker can exploit this issue by injecting malicious payloads into the username field during user creation. This vulnerability allows unauthorized script execution whenever the admin views or interacts with the affected user entry, posing a significant risk to sensitive admin functionalities. This issue affects all versions u
the affected user entry, posing a significant risk to sensitive admin functionalities. This issue affects all versions up to and including 2.20. Users are advised to monitor the project for future releases which address this issue. There are no known workarounds. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/yogeshojha/rengine/security/advisories/GHSA-23wx-5q5w-334w