ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-m3cr-g25p-7r2w: Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Uniscribe Information Disclosure Vulnerability." CVE-2017-0085, CVE-2017-0091, CVE-2017-0092, CVE-2017-0111, CVE-2017-0112, CVE-2017-0113, CVE-2017-0114, CVE-2017-0115, CVE-2017-0116, CVE-2017-0117, CVE-2017-0118, CVE-2017-0119, CVE-2017-0120, CVE-2017-0121, CVE-2017-0122, CVE-2017-0123, CVE-2017-0124, CVE-2017-0125, CVE-2017-0127, and CVE-2017-0128.
CVSS v3.0: 4.3
RHSA-2022:5101: Red Hat Security Advisory: Red Hat AMQ Broker 7.10.0 release and security update
nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties jackson-databind: denial of service via a large depth of nested objects Broker: Malformed message can result in partial DoS (OOM) netty: control chars in header names may lead to HTTP request smuggling amq: AMQ Broker Operator ClusterWide Edit Permissions Due Token Exposure Framework: Data Binding Rules Vulnerability artemis-commons: Apache ActiveMQ Artemis DoS
CVSS v3.1: 7.5
CVSS v3.0: 9.1
GHSA-q5j2-v8q9-65c8: Microsoft Word Remote Code Execution Vulnerability
CVSS v3.1: 7.8
CVE-2026-20986: Path traversal in Samsung Members prior to Chinese version 15.5.05.4 allows local attackers to overwrite data within Samsung Members.
CVSS v4.0: 5.1
CVE-2024-9122: Type Confusion in V8 in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
CVSS v3.1: 8.8
RHSA-2023:7783: Red Hat Security Advisory: postgresql security update
postgresql: Buffer overrun from integer overflow in array modification
CVSS v3.1: 8.8
CVE-2024-39755: A privilege escalation vulnerability exists in the node update functionality of Veertu Anka Build 1.42.0. A specially crafted PKG file can lead to execute priviledged operation. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.
CVSS v3.1: 7.8
GHSA-ccg9-2v2c-6xww: ClamAV versions prior to 0.101.2 are susceptible to a denial of service (DoS) vulnerability. An out-of-bounds heap read condition may occur when scanning PE files. An example is Windows EXE and DLL files that have been packed using Aspack as a result of inadequate bound-checking.
ICSA-22-307-03: Delta Industrial Automation DIALink
The software uses an external input to construct a pathname intended to identify a file or directory located underneath a restricted parent directory. However, the software does not properly neutralize special elements within the pathname, which can cause the pathname to resolve to a location outside of the restricted directory.CVE-2022-2969 has been assigned to this vulnerability. A CVSS v3 base score of 8.1 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H).
CVSS v3.0: 8.1
CVE-2023-23499: This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Monterey 12.6.3, macOS Ventura 13.2, watchOS 9.3, macOS Big Sur 11.7.3, tvOS 16.3, iOS 16.3 and iPadOS 16.3. An app may be able to access user-sensitive data.
CVSS v3.1: 5.5
GHSA-92cp-5422-2mw7: go-redis allows potential out of order responses when `CLIENT SETINFO` times out during connection establishment
ImpactThe issue only occurs when the `CLIENT SETINFO` command times out during connection establishment. The following circumstances can cause such a timeout:The client is configured to transmit its identity. This can be disabled via the `DisableIndentity` flag.There are network connectivity issuesThe client was configured with aggressive timeoutsThe impact differs by use case:**Sticky connections**: Rather than using a connection from the pool on-demand, the caller can stick with a connection. Then you receive persistent out-of-order responses for the lifetime of the connection.**Pipelines**: All commands in the pipeline receive incorrect responses.**Default connection pool usage without pipelining**: When used with the default [ConnPool](https://github.com/redis/go-redis/blob/8fadbef84a3f4e7573f8b38e5023fd469470a8a4/internal/pool/pool.go#L77) once a connection is returned after use with [ConnPool#Put](https://github.com/redis/go-redis/blob/8fadbef84a3f4e7573f8b38e5023fd469470a8a4/internal/pool/pool.go#L366) the read buffer will be checked and the connection will be marked as bad due to the unread data. This means that at most one out-of-order response before the connection is discarded.PatchesWe prepared a fix in https://github.com/redis/go-redis/pull/3295 and plan to release patch versions soon.WorkaroundsYou can prevent the vulnerability by setting the flag `DisableIndentity` (BTW: We also need to fix the spelling.) to `true` when constructing the client instance.CreditAkhass Wasti
Ramin Ghorashi
Anton Amlinger
Syed Rahman
Mahesh Venkateswaran
Sergey Zavoloka
Aditya Adarwal
Abdulla Anam
Abd-Alhameed
Alex Vanlint
Gaurav Choudhary
Vedanta Jha
Yll Kelani
Ryan Picard
CVSS v3.1: 3.7
GHSA-h848-297q-7v3g: An insecure deserialization vulnerability exists in the download.php script of the to3k Twittodon application through commit b1c58a7d1dc664b38deb486ca290779621342c0b (2023-02-28). The 'obj' parameter receives base64-encoded data that is passed directly to the unserialize() function without validation. This allows a remote, unauthenticated attacker to inject arbitrary PHP objects, leading to a denial of service.
CVSS v3.1: 7.5
CVE-2013-5026: An ActiveX control in lookout650.ocx, lookout660.ocx, and lookout670.ocx in National Instruments Lookout 6.5 through 6.7 allows remote attackers to execute arbitrary code by triggering the download of, and calls to, an arbitrary DLL file.
CVSS v2.0: 9.3
GHSA-4c2g-hx49-7h25: Prototype pollution not blocked by object-path related utilities in hoolock
ImpactUtility functions related to object paths (`get`, `set` and `update`) did not block attempts to access or alter object prototypes.PatchesThe `get`, `set` and `update` functions will throw a `TypeError` when a user attempts to access or alter inherited properties in versions >=2.2.1.
CVSS v3.1: 6.3
CVE-2020-15176: SQL injection in GLPI
In GLPI before version 9.5.2, when supplying a back tick in input that gets put into a SQL query,the application does not escape or sanitize allowing for SQL Injection to occur. Leveraging this vulnerability an attacker is able to exfiltrate sensitive information like passwords, reset tokens, personal details, and more. The issue is patched in version 9.5.2
CVSS v3.1: 8.7
GHSA-mcfm-cxwv-vq32: An issue was discovered in SeaCMS version 12.9, allows remote attackers to execute arbitrary code via admin notify.php.
CVSS v3.1: 8.8
CVE-2023-23343: HCL BigFix OSD Bare Metal Server version 311.12 or lower is affected by a clickjacking vulnerability.
A clickjacking vulnerability in the HCL BigFix OSD Bare Metal Server version 311.12 or lower allows attacker to use transparent or opaque layers to trick a user into clicking on a button or link on another page to perform a redirect to an attacker-controlled domain.

CVSS v3.1: 2.4
CVE-2017-2842: In the web management interface in Foscam C1 Indoor HD Camera running application firmware 2.52.2.37, a specially crafted HTTP request can allow for a user to inject arbitrary data in the "msmtprc" configuration file resulting in command execution. An attacker can simply send an HTTP request to the device to trigger this vulnerability.
CVSS v3.0: 8.8
GHSA-cjqx-jx4h-xm5v: SQL injection vulnerability in administration/administre2.php in Eric GUILLAUME uploader&downloader 3 allows remote attackers to execute arbitrary SQL commands via the id_user parameter.
GHSA-rpwq-g7r7-vvmv: STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file, related to "Data from Faulting Address controls Branch Selection starting at STDUXPSFile!DllUnregisterServer+0x0000000000028657."
CVSS v3.0: 7.8
GHSA-hcw5-4792-hv87: Multiple PHP remote file inclusion vulnerabilities in the Journals System module 1.0.2 (RC2) and earlier for phpBB allow remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter in (1) includes/journals_delete.php, (2) includes/journals_post.php, or (3) includes/journals_edit.php.
RHSA-2026:0921: Red Hat Security Advisory: go-toolset:rhel8 security update
crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate
CVSS v3.1: 7.5
GHSA-8r69-9xff-443j: Path Traversal: '.../...//' vulnerability in DeluxeThemes Userpro allows Path Traversal.This issue affects Userpro: from n/a through 5.1.9.
CVSS v3.1: 8.3
GHSA-55jv-gc4r-wxh9: Debian adequate before 0.8.1, when run by root with the --user option, allows local users to hijack the tty and possibly gain privileges via the TIOCSTI ioctl.
GHSA-mh6f-jq3x-vvpv: An unchecked return value within the AMD Platform Management Framework (PMF) could allow an attacker to write to an arbitrary memory address resulting in denial of service or arbitrary code execution.
CVSS v4.0: 7.1
GHSA-8mff-gcgj-hhfr: In Forgejo through 13.0.3, the attachment component allows a denial of service by uploading a multi-gigabyte file attachment (e.g., to be associated with an issue or a release).
CVSS v3.1: 7.5
GHSA-fgm3-q9r5-43v9: Romeo's invalid NetworkPolicy enables a malicious actor to pivot into another namespace
ImpactDue to a mis-written NetworkPolicy, a malicious actor can pivot from the "hardened" namespace to any Pod out of it.
This breaks the security-by-default property expected as part of the deployment program, leading to a potential lateral movement.PatchRemoving the `inter-ns` NetworkPolicy patches the vulnerability. If updates are not possible in production environments, we recommend to manually delete it and update as soon as possible.WorkaroundGiven your context, delete the failing network policy that should be prefixed by `inter-ns-` in the target namespace.
CVSS v4.0: 7.9
CVE-2022-28702: e-Design - Multiple vulnerabilities
Incorrect Default Permissions vulnerability in ABB e-Design allows attacker to install malicious software executing with SYSTEM permissions violating confidentiality, integrity, and availability of the target machine.
CVSS v3.1: 6.1
GHSA-2x4j-x774-w5j9: Samba 3.2.0 uses weak permissions (0666) for the (1) group_mapping.tdb and (2) group_mapping.ldb files, which allows local users to modify the membership of Unix groups.
GHSA-wp8q-76mh-g25x: In the Linux kernel, the following vulnerability has been resolved:driver: iio: add missing checks on iio_info's callback accessSome callbacks from iio_info structure are accessed without any check, so
if a driver doesn't implement them trying to access the corresponding
sysfs entries produce a kernel oops such as:[ 2203.527791] Unable to handle kernel NULL pointer dereference at virtual address 00000000 when execute
[...]
[ 2203.783416] Call trace:
[ 2203.783429]  iio_read_channel_info_avail from dev_attr_show+0x18/0x48
[ 2203.789807]  dev_attr_show from sysfs_kf_seq_show+0x90/0x120
[ 2203.794181]  sysfs_kf_seq_show from seq_read_iter+0xd0/0x4e4
[ 2203.798555]  seq_read_iter from vfs_read+0x238/0x2a0
[ 2203.802236]  vfs_read from ksys_read+0xa4/0xd4
[ 2203.805385]  ksys_read from ret_fast_syscall+0x0/0x54
[ 2203.809135] Exception stack(0xe0badfa8 to 0xe0badff0)
[ 2203.812880] dfa0:                   00000003 b6f10f80 00000003 b6eab000 00020000 00000000
[ 2203.819746] dfc0: 00000003 b6f10f80 7ff00000 00000003 00000003 00000000 00020000 00000000
[ 2203.826619] dfe0: b6e1bc88 bed80958 b6e1bc94 b6e1bcb0
[ 2203.830363] Code: bad PC value
[ 2203.832695] ---[ end trace 0000000000000000 ]---
CVSS v3.1: 5.5
CVE-2007-1326: SQL injection vulnerability in index.php in Serendipity 1.1.1 allows remote attackers to execute arbitrary SQL commands via the serendipity[multiCat][] parameter.
CVSS v2.0: 7.5
CVE-2024-2927: code-projects Mobile Shop Login Page Details.php sql injection
A vulnerability was found in code-projects Mobile Shop 1.0. It has been classified as critical. Affected is an unknown function of the file Details.php of the component Login Page. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258000.
CVSS v3.1: 7.3
CVSS v3.0: 7.3
CVSS v2.0: 7.5
GHSA-jq9p-m278-5p53: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Pluginwale Easy Pricing Table WP allows PHP Local File Inclusion. This issue affects Easy Pricing Table WP: from n/a through 1.1.3.
CVSS v3.1: 7.5
GHSA-m748-r53c-f6pp: The WP Cerber Security plugin for WordPress is vulnerable to IP Protection bypass in versions up to, and including 9.4 due to the plugin improperly checking for a visitor's IP address. This makes it possible for an attacker whose IP address has been blocked to bypass this control by setting the X-Forwarded-For: HTTP header to an IP Address that hasn't been blocked.
CVSS v3.1: 5.3
GHSA-22gf-2q7p-998g: An unauthenticated directory traversal vulnerability in cgi-bin/upload.cgi in SNMP Web Pro 1.1 allows a remote attacker to read arbitrary files. The CGI concatenates the user-supplied params directly onto the base path (/var/www/files/userScript/) using memcpy + strcat without validation or canonicalization, enabling ../ sequences to escape the intended directory. The download branch also echoes the unsanitized params into Content-Disposition, introducing header-injection risk.
CVSS v3.1: 4.3
GHSA-57h9-733x-v43q: Improper Privilege Management vulnerability in Teplitsa of social technologies Leyka allows Privilege Escalation.This issue affects Leyka: from n/a through 3.30.2.
CVSS v3.1: 8.8
CVE-2006-7214: Multiple unspecified vulnerabilities in Firebird 1.5 allow remote attackers to (1) cause a denial of service (application crash) by sending many remote protocol versions; and (2) cause a denial of service (connection drop) via certain network traffic, as demonstrated by Nessus vulnerability scanning.
CVSS v2.0: 7.8
CVE-2026-3332: Xhanch - My Advanced Settings <= 1.1.2 - Cross-Site Request Forgery to Settings Update
The Xhanch - My Advanced Settings plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.2. This is due to missing nonce validation in the `xms_setting()` function on the settings update handler. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Settings that can be modified include favicon URL, Google Analytics account ID, and various WordPress behavior toggles. The `favicon_url` and `ga_acc_id` values are output on the front-end without escaping, enabling a CSRF to Stored XSS chain.
CVSS v3.1: 4.3
GHSA-4wpv-r6m6-xjq5: In the Linux kernel through 4.20.11, af_alg_release() in crypto/af_alg.c neglects to set a NULL value for a certain structure member, which leads to a use-after-free in sockfs_setattr.
CVSS v3.1: 7.8
GHSA-f5fw-7jfj-jwx6: The extension system in Google Chrome before 22.0.1229.79 does not properly handle modal dialogs, which allows remote attackers to cause a denial of service (application crash) via unspecified vectors.
CVE-2003-1475: Netbus 1.5 through 1.7 allows more than one client to be connected at the same time, but only prompts the first connection for authentication, which allows remote attackers to gain access.
CVSS v2.0: 6.8
GHSA-j757-pf57-f8r4: Gradio performs a non-constant-time comparison when comparing hashes
Impact**What kind of vulnerability is it? Who is impacted?**This vulnerability involves a **timing attack** in the way Gradio compares hashes for the `analytics_dashboard` function. Since the comparison is not done in constant time, an attacker could exploit this by measuring the response time of different requests to infer the correct hash byte-by-byte. This can lead to unauthorized access to the analytics dashboard, especially if the attacker can repeatedly query the system with different keys.PatchesYes, please upgrade to `gradio>4.44` to mitigate this issue.Workarounds**Is there a way for users to fix or remediate the vulnerability without upgrading?**To mitigate the risk before applying the patch, developers can manually patch the `analytics_dashboard` dashboard to use a **constant-time comparison** function for comparing sensitive values, such as hashes. Alternatively, access to the analytics dashboard can be disabled.
CVSS v4.0: 6.3
CVSS v3.1: 3.7
GHSA-ff6v-w58f-v97w: XWiki provides no warning when granting XWiki.Notifications.Code.NotificationEmailRendererClass admin right
ImpactWhen a user without script right creates a document with an `XWiki.Notifications.Code.NotificationEmailRendererClass` object, and later an admin edits and saves that document, the email templates in this object will be used for notifications. No malicious code can be executed, though, as while these templates allow Velocity code, the existing generic analyzer already warns admins before editing Velocity code. The main impact would thus be to send spam, e.g., with phishing links to other users or to hide notifications about other attacks. Note that warnings before editing documents with dangerous properties have only been introduced in XWiki 15.9, before that version, this was a known issue and the advice was simply to be careful.PatchesThis has been patched in XWiki 16.10.2, 16.4.7 and 15.10.16 by adding an analysis for the respective XClass properties.WorkaroundsWe're not aware of any real workarounds apart from just being careful with editing documents previously edited by untrusted users as a user with script, admin or programming right.
CVSS v4.0: 5.1
CVE-2026-42663: WordPress Simple Membership plugin <= 4.7.2 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Simple Membership <= 4.7.2 versions.
CVSS v3.1: 6.5
GHSA-842p-2vmc-h4jw: CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
vulnerability exists when an attacker injects then executes arbitrary malicious JavaScript code
within the context of the product.
CVSS v3.1: 8.2
CVE-2023-6419: Cross-site Scripting vulnerability in Voovi Social Networking Script
A vulnerability has been reported in Voovi Social Networking Script version 1.0 that allows a XSS via editprofile.php in multiple parameters, the exploitation of which could allow a remote attacker to send a specially crafted JavaScript payload and partially take over the browser session of an authenticated user.
CVSS v3.1: 6.5
GHSA-vc3p-29h2-gpcp: golang.org/x/net/http2 allows uncontrolled memory consumption
net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests.
CVSS v3.1: 7.5
CVE-2024-51902: WordPress TinyCode plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cybio TinyCode tinycode allows Stored XSS.This issue affects TinyCode: from n/a through <= 1.2.1.
CVSS v3.1: 6.5
CVE-2022-23694: Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database potentially leading to complete compromise of the ClearPass Policy Manager cluster in Aruba ClearPass Policy Manager version(s): 6.10.x: 6.10.6 and below; 6.9.x: 6.9.11 and below. Aruba has released upgrades for Aruba ClearPass Policy Manager that address these security vulnerabilities.
CVSS v3.1: 8.8
GHSA-cf92-gfcw-6v53: Magic Wormhole: receive, with --output pointing at an existing directory can be path-traversed
ImpactA receiver who specifies "--output <dir>" where that output directory currently exists (as a directory).Patches0.24.0 will contain the patchWorkaroundsEnsure local target directories specified by "--output" do not already existResourcesPrivate email and Signal communications from a user.
Magic Wormhole thanks  @marduc812
CVSS v3.1: 3.5
GHSA-xfqg-p48g-hh94: Login timing attack in ezsystems/ezpublish-kernel
Ibexa DXP is using random execution time to hinder timing attacks against user accounts, a method of discovering whether a given account exists in a system without knowing its password, thus affecting privacy. This implementation was found to not be good enough in some situations. The fix replaces this with constant time functionality, configured in the new security.yml parameter 'ibexa.security.authentication.constant_auth_time'. It will log a warning if the constant time is exceeded. If this happens the setting should be increased.
GHSA-3p99-663g-4p22: Use-after-free vulnerability in the Sb.SuperBuddy.1 ActiveX control (sb.dll) in America Online (AOL) 9.5.0.1 allows remote attackers to trigger memory corruption or possibly execute arbitrary code via a malformed argument to the SetSuperBuddy method.
CVSS v3.1: 8.8
CVE-2020-4342: IBM Security Secret Server 10.7 could disclose sensitive information included in installation files to an unauthorized user. IBM X-Force ID: 178182.
CVSS v3.0: 5.3
CVE-2025-49714: Visual Studio Code Python Extension Remote Code Execution Vulnerability
Trust boundary violation in Visual Studio Code - Python extension allows an unauthorized attacker to execute code locally.
CVSS v3.1: 7.8
GHSA-5c9x-8gcm-mpgx: Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0
SummaryFor stream request bodies, maxBodyLength is bypassed when maxRedirects is set to 0 (native http/https transport path). Oversized streamed uploads are sent fully even when the caller sets strict body limits.DetailsRelevant flow in lib/adapters/http.js:556-564: maxBodyLength check applies only to buffered/non-stream data.681-682: maxRedirects === 0 selects native http/https transport.694-699: options.maxBodyLength is set, but native transport does not enforce it.925-945: stream is piped directly to socket (data.pipe(req)) with no Axios byte counting.This creates a path-specific bypass for streamed uploads.PoCEnvironment:Axios main at commit f7a4ee2Node v24.2.0Steps:Start an HTTP server that counts uploaded bytes and returns {received}.Send a 2 MiB Readable stream with:adapter: 'http'maxBodyLength: 1024maxRedirects: 0Observed:Request succeeds; server reports received: 2097152.Control checks:Same stream with default/nonzero redirects: rejected with ERR_FR_MAX_BODY_LENGTH_EXCEEDED.Buffered body with maxRedirects: 0: rejected with ERR_BAD_REQUEST.ImpactType: DoS / uncontrolled upstream upload / resource exhaustion.
Impacted: Node.js services using streamed request bodies with maxBodyLength expecting hard enforcement, especially when following Axios guidance to use maxRedirects: 0 for streams.
CVSS v3.1: 5.3
GHSA-cp7p-c3xv-f5g5: GNU LibreDWG 0.9.3.2564 has an attempted excessive memory allocation in read_sections_map in decode_r2007.c.
GHSA-2gf6-g5m3-qg3c: Technicolor DPC2320 dpc2300r2-v202r1244101-150420a-v6 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
CVSS v3.0: 9.8
GHSA-73rw-h6xr-x6hm: A vulnerability in the authenticated user web interface of Pulse Connect Secure < 9.1R9 could allow attackers to conduct Cross-Site Scripting (XSS) through the CGI file.
GHSA-mqq6-542f-w38g: A post authentication command execution vulnerability exists in the web filtering functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVSS v3.1: 7.2
GHSA-m476-gc4w-5q6x: Unauthenticated SQL Injection (SQLi) vulnerability discovered in [GWA] AutoResponder WordPress plugin (versions <= 2.3), vulnerable at (&listid). No patched version available, plugin closed.