Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-55187 State: PUBLISHED Published: 2025-09-26T00:00:00.000Z Last Updated: 2025-09-26T17:13:18.523Z Vendors: n/a Products: n/a Problem Types: n/a Description: In DriveLock 24.1.4 before 24.1.5, 24.2.5 before 24.2.6, and 25.1.2 before 25.1.4, attackers can gain elevated privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://drivelock.help/versions/2025_1/web/en/releasenotes/Content/ReleaseNotes_DriveLock/NewRelease/Aenderungen_Patch2.htm - https://drivelock.help/versions/2025_1/web/en/releasenotes/Content/ReleaseNotes_DriveLock/SecurityBulletins/25-001-RemotePriviledge.htm - https://drivelock.help/versions/current/web/en/releasenotes/Content/Releas
curityBulletins/25-001-RemotePriviledge.htm - https://drivelock.help/versions/current/web/en/releasenotes/Content/ReleaseNotes_DriveLock/SecurityBulletins/25-001-RemotePriviledge.htm
CVE ID: CVE-2025-55188 State: PUBLISHED Published: 2025-08-08T00:00:00.000Z Last Updated: 2025-11-04T22:06:47.049Z Severity: LOW (CVSS 3.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N) Vendors: 7-Zip Products: 7-Zip Problem Types: CWE-59 Description: 7-Zip before 25.01 does not always properly handle symbolic links during extraction. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://sourceforge.net/p/sevenzip/discussion/45797/thread/da14cd780b/ - https://github.com/ip7z/7zip/releases/tag/25.01 - https://github.com/ip7z/7zip/compare/25.00...25.01 - https://www.openwall.com/lists/oss-security/2025/08/09/1 - https://youtu.be/sWT6M1cfnwM - https://
mpare/25.00...25.01 - https://www.openwall.com/lists/oss-security/2025/08/09/1 - https://youtu.be/sWT6M1cfnwM - https://lunbun.dev/blog/cve-2025-55188/ - https://github.com/lunbun/CVE-2025-55188/ - https://www.vicarius.io/vsociety/posts/cve-2025-55188-detect-7-zip-vulnerable-version - https://www.vicarius.io/vsociety/posts/cve-2025-55188-mitigate-7-zip-vulnerability
CVE ID: CVE-2025-55190 State: PUBLISHED Published: 2025-09-04T22:37:52.811Z Last Updated: 2025-09-05T16:07:25.315Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: argoproj Products: argo-cd Problem Types: CWE-200 Description: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. In versions 2.13.0 through 2.13.8, 2.14.0 through 2.14.15, 3.0.0 through 3.0.12 and 3.1.0-rc1 through 3.1.1, API tokens with project-level permissions are able to retrieve sensitive repository credentials (usernames, passwords) through the project details API endpoint, even when the token only has standard application management permissions and no explicit access
ct details API endpoint, even when the token only has standard application management permissions and no explicit access to secrets. This vulnerability does not only affect project-level permissions. Any token with project get permissions is also vulnerable, including global permissions such as: `p, role/user, projects, get, *, allow`. This issue is fixed in versions 2.13.9, 2.14.16, 3.0.14 and 3.1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/argoproj/argo-cd/security/advisories/GHSA-786q-9hcg-v9ff - https://github.com/argoproj/argo-cd/commit/e8f86101f5378662ae6151ce5c3a76e9141900e8
CVE ID: CVE-2025-55191 State: PUBLISHED Published: 2025-09-30T22:52:19.838Z Last Updated: 2025-10-06T18:32:34.110Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: argoproj Products: argo-cd Problem Types: CWE-362 Description: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions between 2.1.0 and 2.14.19, 3.2.0-rc1, 3.1.0-rc1 through 3.1.7, and 3.0.0-rc1 through 3.0.18 contain a race condition in the repository credentials handler that can cause the Argo CD server to panic and crash when concurrent operations are performed on the same repository URL. The vulnerability is located in numerous repository related handlers in the util
e performed on the same repository URL. The vulnerability is located in numerous repository related handlers in the util/db/repository_secrets.go file. A valid API token with repositories resource permissions (create, update, or delete actions) is required to trigger the race condition. This vulnerability causes the entire Argo CD server to crash and become unavailable. Attackers can repeatedly and continuously trigger the race condition to maintain a denial-of-service state, disrupting all GitOps operations. This issue is fixed in versions 2.14.20, 3.2.0-rc2, 3.1.8 and 3.0.19. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/argoproj/argo-cd/security/advis
.19. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/argoproj/argo-cd/security/advisories/GHSA-g88p-r42r-ppp9 - https://github.com/argoproj/argo-cd/pull/6103 - https://github.com/argoproj/argo-cd/commit/701bc50d01c752cad96185f848088d287a97c7b7
CVE ID: CVE-2025-55192 State: PUBLISHED Published: 2025-08-14T16:40:33.401Z Last Updated: 2025-09-12T19:04:49.118Z Vendors: JurajNyiri Products: HomeAssistant-Tapo-Control Problem Types: CWE-94 Description: HomeAssistant-Tapo-Control offers Control for Tapo cameras as a Home Assistant component. Prior to commit 2a3b80f, there is a code injection vulnerability in the GitHub Actions workflow .github/workflows/issues.yml. It does not affect users of the Home Assistant integration itself — it only impacts the GitHub Actions environment for this repository. The vulnerable workflow directly inserted user-controlled content from the issue body (github.event.issue.body) into a Bash conditional witho
ow directly inserted user-controlled content from the issue body (github.event.issue.body) into a Bash conditional without proper sanitization. A malicious GitHub user could craft an issue body that executes arbitrary commands on the GitHub Actions runner in a privileged context whenever an issue is opened. The potential impact is limited to the repository’s CI/CD environment, which could allow access to repository contents or GitHub Actions secrets. This issue has been patched via commit 2a3b80f. Workarounds involve disabling the affected workflow (issues.yml), replacing the unsafe Bash comparison with a safe quoted grep (or a pure GitHub Actions expression check), or ensuring minimal permi
he unsafe Bash comparison with a safe quoted grep (or a pure GitHub Actions expression check), or ensuring minimal permissions in workflows (permissions: block) to reduce possible impact. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/JurajNyiri/HomeAssistant-Tapo-Control/security/advisories/GHSA-xccg-43hx-c846 - https://github.com/JurajNyiri/HomeAssistant-Tapo-Control/commit/2a3b80ff128ddf4f410c97dd47a94343792ce43c - https://securitylab.github.com/advisories/GHSL-2025-101_homeassistant-tapo-control
CVE ID: CVE-2025-55193 State: PUBLISHED Published: 2025-08-13T22:41:41.890Z Last Updated: 2025-08-14T14:51:11.284Z Vendors: rails Products: rails Problem Types: CWE-150 Description: Active Record connects classes to relational database tables. Prior to versions 7.1.5.2, 7.2.2.2, and 8.0.2.1, the ID passed to find or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences. This issue has been patched in versions 7.1.5.2, 7.2.2.2, and 8.0.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rails/rails/security/advisories/GHSA-76r7-hhxj-r776 - https://github.com/rails/rails/commit/3beef20013
ttps://github.com/rails/rails/security/advisories/GHSA-76r7-hhxj-r776 - https://github.com/rails/rails/commit/3beef20013736fd52c5dcfdf061f7999ba318290 - https://github.com/rails/rails/commit/568c0bc2f1e74c65d150a84b89a080949bf9eb9b - https://github.com/rails/rails/commit/6a944ca4805e72050a0fbb1a461534eb760d3202
CVE ID: CVE-2025-55194 State: PUBLISHED Published: 2025-08-13T22:46:30.217Z Last Updated: 2025-08-14T14:51:03.540Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H) Vendors: Part-DB Products: Part-DB-server Problem Types: CWE-248 Description: Part-DB is an open source inventory management system for electronic components. Prior to version 1.17.3, any authenticated user can upload a profile picture with a misleading file extension (e.g., .jpg.txt), resulting in a persistent 500 Internal Server Error when attempting to view or edit that user’s profile. This makes the profile permanently inaccessible via the UI for both users and administrators, constituting a Denial of S
This makes the profile permanently inaccessible via the UI for both users and administrators, constituting a Denial of Service (DoS) within the user management interface. This issue has been patched in version 1.17.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Part-DB/Part-DB-server/security/advisories/GHSA-7rv3-rcxv-69ww - https://github.com/Part-DB/Part-DB-server/commit/d370f976a7b0c19d502aadbaa0f93eb90c2a6ffa - https://drive.google.com/file/d/10exp_BS9kRKHrFSPjiA_ZYUVJbHN8doW/view
CVE ID: CVE-2025-55195 State: PUBLISHED Published: 2025-08-14T16:39:28.158Z Last Updated: 2025-08-14T19:18:25.234Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: denoland Products: std Problem Types: CWE-1321 Description: @std/toml is the Deno Standard Library. Prior to version 1.0.9, an attacker can pollute the prototype chain in Node.js runtime and Browser when parsing untrusted TOML data, thus achieving Prototype Pollution (PP) vulnerability. This is because the library is merging an untrusted object with an empty object, which by default the empty object has the prototype chain. This issue has been patched in version 1.0.9. Additional Analyst Notes: - CIS
the empty object has the prototype chain. This issue has been patched in version 1.0.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/denoland/std/security/advisories/GHSA-crjp-8r9q-2j9r - https://github.com/denoland/std/commit/540662cfd6d71e969af292aa604ef4049dbe271b - https://github.com/denoland/std/releases/tag/release-2025.08.13
CVE ID: CVE-2025-55196 State: PUBLISHED Published: 2025-08-13T22:54:02.698Z Last Updated: 2025-08-14T14:50:55.621Z Vendors: external-secrets Products: external-secrets Problem Types: CWE-284 Description: External Secrets Operator is a Kubernetes operator that integrates external secret management systems. From version 0.15.0 to before 0.19.2, a vulnerability was discovered where the List() calls for Kubernetes Secret and SecretStore resources performed by the PushSecret controller did not apply a namespace selector. This flaw allowed an attacker to use label selectors to list and read secrets/secret-stores across the cluster, bypassing intended namespace restrictions. An attacker with the ab
st and read secrets/secret-stores across the cluster, bypassing intended namespace restrictions. An attacker with the ability to create or update PushSecret resources and control SecretStore configurations could exploit this vulnerability to exfiltrate sensitive data from arbitrary namespaces. This could lead to full disclosure of Kubernetes secrets, including credentials, tokens, and other sensitive information stored in the cluster. This vulnerability has been patched in version 0.19.2. A workaround for this issue includes auditing and restricting RBAC permissions so that only trusted service accounts can create or update PushSecret and SecretStore resources. Additional Analyst Notes: - CI
only trusted service accounts can create or update PushSecret and SecretStore resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/external-secrets/external-secrets/security/advisories/GHSA-fcxq-v2r3-cc8h - https://github.com/external-secrets/external-secrets/pull/5109 - https://github.com/external-secrets/external-secrets/pull/5133 - https://github.com/external-secrets/external-secrets/commit/39cdba5863533007b582dc63dd300839326b2f1d - https://github.com/external-secrets/external-secrets/commit/de40e8f4fa9559c1d770bb674589b285da5ef2d1
CVE ID: CVE-2025-55197 State: PUBLISHED Published: 2025-08-13T23:03:02.018Z Last Updated: 2025-08-14T14:50:48.663Z Vendors: py-pdf Products: pypdf Problem Types: CWE-400, CWE-770 Description: pypdf is a free and open-source pure-python PDF library. Prior to version 6.0.0, an attacker can craft a PDF which leads to the RAM being exhausted. This requires just reading the file if a series of FlateDecode filters is used on a malicious cross-reference stream. Other content streams are affected on explicit access. This issue has been fixed in 6.0.0. If an update is not possible, a workaround involves including the fixed code from pypdf.filters.decompress into the existing filters file. Additional
a workaround involves including the fixed code from pypdf.filters.decompress into the existing filters file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/py-pdf/pypdf/security/advisories/GHSA-7hfw-26vp-jp8m - https://github.com/py-pdf/pypdf/issues/3429 - https://github.com/py-pdf/pypdf/pull/3430 - https://github.com/py-pdf/pypdf/blob/0dd57738bbdcdb63f0fb43d8a6b3d222b6946595/pypdf/filters.py#L72-L143 - https://github.com/py-pdf/pypdf/releases/tag/6.0.0
CVE ID: CVE-2025-55198 State: PUBLISHED Published: 2025-08-13T23:23:56.780Z Last Updated: 2025-08-14T14:50:32.593Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: helm Products: helm Problem Types: CWE-908 Description: Helm is a package manager for Charts for Kubernetes. Prior to version 3.18.5, when parsing Chart.yaml and index.yaml files, an improper validation of type error can lead to a panic. This issue has been resolved in Helm 3.18.5. A workaround involves ensuring YAML files are formatted as Helm expects prior to processing them with Helm. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/helm/helm/security/advisorie
h Helm. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/helm/helm/security/advisories/GHSA-f9f8-9pmf-xv68 - https://github.com/helm/helm/commit/ec5f59e2db56533d042a124f5bae54dd87b558e6
CVE ID: CVE-2025-55199 State: PUBLISHED Published: 2025-08-13T23:23:43.304Z Last Updated: 2025-08-14T14:50:39.218Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: helm Products: helm Problem Types: CWE-770 Description: Helm is a package manager for Charts for Kubernetes. Prior to version 3.18.5, it is possible to craft a JSON Schema file in a manner which could cause Helm to use all available memory and have an out of memory (OOM) termination. This issue has been resolved in Helm 3.18.5. A workaround involves ensuring all Helm charts that are being loaded into Helm do not have any reference of $ref pointing to /dev/zero. Additional Analyst Notes: - CISA ADP
re being loaded into Helm do not have any reference of $ref pointing to /dev/zero. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/helm/helm/security/advisories/GHSA-9h84-qmv7-982p - https://github.com/helm/helm/commit/b78692c18f0fb38fe5ba4571a674de067a4c53a5
CVE ID: CVE-2025-55200 State: PUBLISHED Published: 2025-10-09T18:51:57.884Z Last Updated: 2025-10-09T19:08:17.415Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: bigbluebutton Products: bigbluebutton Problem Types: CWE-79 Description: BigBlueButton is an open-source virtual classroom. In versions prior to 3.0.13, the "Shared Notes" feature contains a Stored Cross-Site Scripting (XSS) vulnerability with the input location being the "Username" field and the output location on the "Shared Notes" page, when a user with a malicious username is editing content. This vulnerability allows a low-privileged user to execute arbitrary JavaScript in the context of higher-
iting content. This vulnerability allows a low-privileged user to execute arbitrary JavaScript in the context of higher-privileged users (e.g., Admins) who open the Shared Notes page. Version 3.0.13 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-9jv9-cjrm-grj2 - https://github.com/bigbluebutton/bbb-pads/pull/67 - https://github.com/bigbluebutton/bigbluebutton/pull/23693 - https://github.com/bigbluebutton/bbb-pads/releases/tag/v1.5.4
CVE ID: CVE-2025-55201 State: PUBLISHED Published: 2025-08-18T16:21:25.576Z Last Updated: 2025-08-18T17:37:53.420Z Vendors: copier-org Products: copier Problem Types: CWE-22 Description: Copier library and CLI app for rendering project templates. Prior to 9.9.1, a safe template can currently read and write arbitrary files because Copier exposes a few pathlib.Path objects in the Jinja context which have unconstrained I/O methods. This effectively renders the security model w.r.t. filesystem access useless. This vulnerability is fixed in 9.9.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/copier-org/copier/security/advisories/GHSA-3xw7-v6cj-5q8h - https:/
A ADP Vulnrichment: References: - https://github.com/copier-org/copier/security/advisories/GHSA-3xw7-v6cj-5q8h - https://github.com/copier-org/copier/commit/3feea3b3ff3c20d80cbb16a2f3b9567ffc5606d1
CVE ID: CVE-2025-55202 State: PUBLISHED Published: 2025-08-29T15:35:35.338Z Last Updated: 2025-08-29T16:00:31.047Z Vendors: opencast Products: opencast Problem Types: CWE-23 Description: Opencast is a free, open-source platform to support the management of educational audio and video content. In version 18.0 and versions before 17.7, the protections against path traversal attacks in the UI config module are insufficient, still partially allowing for attacks in very specific cases. The path is checked without checking for the file separator. This could allow attackers access to files within another folder which starts with the same path. This issue has been fixed in versions 17.7 and 18.1. To
to files within another folder which starts with the same path. This issue has been fixed in versions 17.7 and 18.1. To mitigate this issue, check for folders that start with the same path as the ui-config folder. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/opencast/opencast/security/advisories/GHSA-hq8m-v68g-8cf8 - https://github.com/opencast/opencast/pull/6979 - https://github.com/opencast/opencast/commit/e2cc65d6fbe052ebb71d9f6b583bb54b181af009
CVE ID: CVE-2025-55203 State: PUBLISHED Published: 2025-08-15T15:06:00.636Z Last Updated: 2025-08-15T19:09:18.212Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: makeplane Products: plane Problem Types: CWE-79 Description: Plane is open-source project management software. Prior to version 0.28.0, a stored cross-site scripting (XSS) vulnerability exists in the description_html field of Plane. This flaw allows an attacker to inject malicious JavaScript code that is stored and later executed in other users’ browsers. The description_html field is not properly sanitized or escaped. An attacker can submit crafted JavaScript payloads that are saved in the applica
d is not properly sanitized or escaped. An attacker can submit crafted JavaScript payloads that are saved in the application’s database. When another user views the affected content, the injected code executes in their browser, running in the application’s context and bypassing standard security protections. Successful exploitation can lead to session hijacking, theft of sensitive information, or forced redirection to malicious sites. The vulnerability can also be chained with CSRF attacks to perform unauthorized actions, or leveraged to distribute malware and exploit additional browser vulnerabilities. This issue has been patched in version 0.28.0. Additional Analyst Notes: - CISA ADP Vulnr
ional browser vulnerabilities. This issue has been patched in version 0.28.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/makeplane/plane/security/advisories/GHSA-rwjc-xhh3-m9m9 - https://drive.google.com/file/d/1lQzQJ9Eun6xmcxyyAkr5ORyIrfw9ys5w/view?usp=sharing
CVE ID: CVE-2025-55205 State: PUBLISHED Published: 2025-08-18T16:28:51.317Z Last Updated: 2025-08-18T17:39:07.476Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: projectcapsule Products: capsule Problem Types: CWE-863 Description: Capsule is a multi-tenancy and policy-based framework for Kubernetes. A namespace label injection vulnerability in Capsule v0.10.3 and earlier allows authenticated tenant users to inject arbitrary labels into system namespaces (kube-system, default, capsule-system), bypassing multi-tenant isolation and potentially accessing cross-tenant resources through TenantResource selectors. This vulnerability enables privilege escalation a
lly accessing cross-tenant resources through TenantResource selectors. This vulnerability enables privilege escalation and violates the fundamental security boundaries that Capsule is designed to enforce. This vulnerability is fixed in 0.10.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/projectcapsule/capsule/security/advisories/GHSA-fcpm-6mxq-m5vv - https://github.com/projectcapsule/capsule/commit/e1f47feade6e1695b2204407607d07c3b3994f6e
CVE ID: CVE-2025-55207 State: PUBLISHED Published: 2025-08-15T15:13:08.214Z Last Updated: 2025-08-15T19:10:33.451Z Vendors: withastro Products: astro Problem Types: CWE-601 Description: Astro is a web framework for content-driven websites. Following CVE-2025-54793 there's still an Open Redirect vulnerability in a subset of Astro deployment scenarios prior to version 9.4.1. Astro 5.12.8 addressed CVE-2025-54793 where https://example.com//astro.build/press would redirect to the external origin //astro.build/press. However, with the Node deployment adapter in standalone mode and trailingSlash set to "always" in the Astro configuration, https://example.com//astro.build/press still redirects to /
nd trailingSlash set to "always" in the Astro configuration, https://example.com//astro.build/press still redirects to //astro.build/press. This affects any user who clicks on a specially crafted link pointing to the affected domain. Since the domain appears legitimate, victims may be tricked into trusting the redirected page, leading to possible credential theft, malware distribution, or other phishing-related attacks. This issue has been patched in version 9.4.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/withastro/astro/security/advisories/GHSA-9x9c-ghc5-jhw9 - https://github.com/withastro/astro/commit/5fc3c599cacb0172cc7d8e1202a5f2e8685d7ef2
CVE ID: CVE-2025-55209 State: PUBLISHED Published: 2025-09-04T22:50:59.946Z Last Updated: 2025-09-05T15:47:36.235Z Vendors: FreePBX Products: security-reporting Problem Types: CWE-79 Description: contactmanager is a module for FreePBX@, which is an open source GUI that controls and manages Asterisk© (PBX). In versions 15.0.14 and below, 16.0.0 through 16.0.26.4 and 17.0.0 through 17.0.5, a stored cross-site scripting (XSS) vulnerability in FreePBX allows a low-privileged User Control Panel (UCP) user to inject malicious JavaScript into the system. The malicious code executes in the context of an administrator when they interact with the affected component, leading to session hijacking and po
s in the context of an administrator when they interact with the affected component, leading to session hijacking and potential privilege escalation. This issue is fixed in versions 15.0.14, 16.0.27 and 17.0.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FreePBX/security-reporting/security/advisories/GHSA-j654-x3q2-6wm3 - https://github.com/FreePBX/contactmanager/commit/55abba0f1ab5d66ba87732fd06179231d1f68184