auren-research/cyber-sec huggingface dataset:
cveID: CVE-2025-54313
vendorProject: Prettier
product: eslint-config-prettier
vulnerabilityName: Prettier eslint-config-prettier Embedded Malicious Code Vulnerability
dateAdded: 2026-01-22
shortDescription: Prettier eslint-config-prettier contains an embedded malicious code vulnerability. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2026-02-12
knownRansomwareCampaignUse: Unknown
notes: This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://www.npmjs.com/package/eslint-config-prettier?activeTab=versions ; https://github.com/prettier/eslint-config-prettier/issues/339#issuecomment-3090304490 ; https://nvd.nist.gov/vuln/detail/CVE-2025-54313
cwes: CWE-506
cveID: CVE-2026-20045
vendorProject: Cisco
product: Unified Communications Manager
vulnerabilityName: Cisco Unified Communications Products Code Injection Vulnerability
dateAdded: 2026-01-21
shortDescription: Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance contain a code injection vulnerability that could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2026-02-11
knownRansomwareCampaignUse: Unknown
notes: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-rce-mORhqY4b ; https://nvd.nist.gov/vuln/detail/CVE-2026-20045
cwes: CWE-94
cveID: CVE-2026-20805
vendorProject: Microsoft
product: Windows
vulnerabilityName: Microsoft Windows Information Disclosure Vulnerability
dateAdded: 2026-01-13
shortDescription: Microsoft Windows Desktop Windows Manager contains an information disclosure vulnerability that allows an authorized attacker to disclose information locally.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2026-02-03
knownRansomwareCampaignUse: Unknown
notes: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-20805 ; https://nvd.nist.gov/vuln/detail/CVE-2026-20805
cwes: CWE-200
cveID: CVE-2025-8110
vendorProject: Gogs
product: Gogs
vulnerabilityName: Gogs Path Traversal Vulnerability
dateAdded: 2026-01-12
shortDescription: Gogs contains a path traversal vulnerability affecting improper Symbolic link handling in the PutContents API that could allow for code execution.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2026-02-02
knownRansomwareCampaignUse: Unknown
notes: https://github.com/gogs/gogs/commit/553707f3fd5f68f47f531cfcff56aa3ec294c6f6 ; https://nvd.nist.gov/vuln/detail/CVE-2025-8110
cwes: CWE-22
cveID: CVE-2009-0556
vendorProject: Microsoft
product: Office
vulnerabilityName: Microsoft Office PowerPoint Code Injection Vulnerability
dateAdded: 2026-01-07
shortDescription: Microsoft Office PowerPoint contains a code injection vulnerability that allows remote attackers to execute arbitrary code via a PowerPoint file with an OutlineTextRefAtom containing an invalid index value that triggers memory corruption.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2026-01-28
knownRansomwareCampaignUse: Unknown
notes: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-017 ; https://nvd.nist.gov/vuln/detail/CVE-2009-0556
cwes: CWE-94
cveID: CVE-2025-37164
vendorProject: Hewlett Packard Enterprise (HPE)
product: OneView
vulnerabilityName: Hewlett Packard Enterprise (HPE) OneView Code Injection Vulnerability
dateAdded: 2026-01-07
shortDescription: Hewlett Packard Enterprise (HPE) OneView contains a code injection vulnerability that allows a remote unauthenticated user to perform remote code execution.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2026-01-28
knownRansomwareCampaignUse: Unknown
notes: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04985en_us&docLocale=en_US ; https://nvd.nist.gov/vuln/detail/CVE-2025-37164
cwes: CWE-94
cveID: CVE-2025-14847
vendorProject: MongoDB
product: MongoDB and MongoDB Server
vulnerabilityName: MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability
dateAdded: 2025-12-29
shortDescription: MongoDB Server contains an improper handling of length parameter inconsistency vulnerability in Zlib compressed protocol headers. This vulnerability may allow a read of uninitialized heap memory by an unauthenticated client.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2026-01-19
knownRansomwareCampaignUse: Unknown
notes: This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://jira.mongodb.org/browse/SERVER-115508 ; https://nvd.nist.gov/vuln/detail/CVE-2025-14847
cwes: CWE-130
cveID: CVE-2023-52163
vendorProject: Digiever
product: DS-2105 Pro
vulnerabilityName: Digiever DS-2105 Pro Missing Authorization Vulnerability
dateAdded: 2025-12-22
shortDescription: Digiever DS-2105 Pro contains a missing authorization vulnerability which could allow for command injection via time_tzsetup.cgi.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2026-01-12
knownRansomwareCampaignUse: Unknown
notes: https://www.digiever.com/tw/support/faq-content.php?FAQ=217 ; https://nvd.nist.gov/vuln/detail/CVE-2023-52163
cwes: CWE-862
cveID: CVE-2025-14733
vendorProject: WatchGuard
product: Firebox
vulnerabilityName: WatchGuard Firebox Out of Bounds Write Vulnerability
dateAdded: 2025-12-19
shortDescription: WatchGuard Fireware OS iked process contains an out of bounds write vulnerability in the OS iked process. This vulnerability may allow a remote unauthenticated attacker to execute arbitrary code and affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-12-26
knownRansomwareCampaignUse: Unknown
notes: Check for signs of potential compromise on all internet accessible instances after applying mitigations. For more information please see: https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00027 ; https://nvd.nist.gov/vuln/detail/CVE-2025-14733
cwes: CWE-787
cveID: CVE-2025-59374
vendorProject: ASUS
product: Live Update
vulnerabilityName: ASUS Live Update Embedded Malicious Code Vulnerability
dateAdded: 2025-12-17
shortDescription: ASUS Live Update contains an embedded malicious code vulnerability client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2026-01-07
knownRansomwareCampaignUse: Unknown
notes: https://www.asus.com/support/faq/1018727/ ; https://nvd.nist.gov/vuln/detail/CVE-2025-59374
cwes: CWE-506
cveID: CVE-2025-40602
vendorProject: SonicWall
product: SMA1000 appliance
vulnerabilityName: SonicWall SMA1000 Missing Authorization Vulnerability
dateAdded: 2025-12-17
shortDescription: SonicWall SMA1000 contains a missing authorization vulnerability that could allow for privilege escalation appliance management console (AMC) of affected devices.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable
dueDate: 2025-12-24
knownRansomwareCampaignUse: Unknown
notes: Check for signs of potential compromise on all internet accessible SonicWall SMA1000 instances after applying mitigations. For more information please see: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0019 ; https://nvd.nist.gov/vuln/detail/CVE-2025-40602
cwes: CWE-862
CWE-250
cveID: CVE-2025-20393
vendorProject: Cisco
product: Multiple Products
vulnerabilityName: Cisco Multiple Products Improper Input Validation Vulnerability
dateAdded: 2025-12-17
shortDescription: Cisco Secure Email Gateway, Secure Email, AsyncOS Software, and Web Manager appliances contains an improper input validation vulnerability that allows threat actors to execute arbitrary commands with root privileges on the underlying operating system of an affected appliance.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-12-24
knownRansomwareCampaignUse: Unknown
notes: Please adhere to Cisco's guidelines to assess exposure and mitigate risks. Check for signs of potential compromise on all internet accessible Cisco products affected by this vulnerability. Apply any final mitigations provided by the vendor as soon as they become available. For more information please see: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-attack-N9bf4 ; https://nvd.nist.gov/vuln/detail/CVE-2025-20393
cwes: CWE-20
cveID: CVE-2025-59718
vendorProject: Fortinet
product: Multiple Products
vulnerabilityName: Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability
dateAdded: 2025-12-16
shortDescription: Fortinet FortiOS, FortiSwitchMaster, FortiProxy, and FortiWeb contain an improper verification of cryptographic signature vulnerability that may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML message. Please be aware that CVE-2025-59719 pertains to the same problem and is mentioned in the same vendor advisory. Ensure to apply all patches mentioned in the advisory.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-12-23
knownRansomwareCampaignUse: Unknown
notes: https://fortiguard.fortinet.com/psirt/FG-IR-25-647 ; https://docs.fortinet.com/upgrade-tool/fortigate ; https://nvd.nist.gov/vuln/detail/CVE-2025-59718
cwes: CWE-347
cveID: CVE-2025-14611
vendorProject: Gladinet
product: CentreStack and Triofox
vulnerabilityName: Gladinet CentreStack and Triofox Hard Coded Cryptographic Vulnerability
dateAdded: 2025-12-15
shortDescription: Gladinet CentreStack and TrioFox contain a hardcoded cryptographic keys vulnerability for their implementation of the AES cryptoscheme. This vulnerability degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially crafted request without authentication.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2026-01-05
knownRansomwareCampaignUse: Unknown
notes: https://www.centrestack.com/p/gce_latest_release.html ; https://access.triofox.com/releases_history/; https://support.centrestack.com/hc/en-us/articles/360007159054-Hardening-the-CentreStack-Cluster#h_01JQRV57T37HJFQZKBZH9NBXQP ; https://nvd.nist.gov/vuln/detail/CVE-2025-14611
cwes: CWE-798
cveID: CVE-2025-43529
vendorProject: Apple
product: Multiple Products
vulnerabilityName: Apple Multiple Products Use-After-Free WebKit Vulnerability
dateAdded: 2025-12-15
shortDescription: Apple iOS, iPadOS, macOS, and other Apple products contain a use-after-free vulnerability in WebKit. Processing maliciously crafted web content may lead to memory corruption. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2026-01-05
knownRansomwareCampaignUse: Unknown
notes: https://support.apple.com/en-us/125884 ; https://support.apple.com/en-us/125892 ; https://support.apple.com/en-us/125885 ; https://support.apple.com/en-us/125886 ; https://support.apple.com/en-us/125889 ; https://nvd.nist.gov/vuln/detail/CVE-2025-43529
cwes: CWE-416
cveID: CVE-2018-4063
vendorProject: Sierra Wireless
product: AirLink ALEOS
vulnerabilityName: Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability
dateAdded: 2025-12-12
shortDescription: Sierra Wireless AirLink ALEOS contains an unrestricted upload of file with dangerous type vulnerability. A specially crafted HTTP request can upload a file, resulting in executable code being uploaded, and routable, to the webserver. An attacker can make an authenticated HTTP request to trigger this vulnerability. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2026-01-02
knownRansomwareCampaignUse: Unknown
notes: https://www.cisa.gov/news-events/ics-advisories/icsa-19-122-03 ; https://source.sierrawireless.com/resources/airlink/software_reference_docs/technical-bulletin/sierra-wireless-technical-bulletin---swi-psa-2019-003 ; https://source.sierrawireless.com/resources/airlink/hardware_reference_docs/airlink_es450_eol ; https://nvd.nist.gov/vuln/detail/CVE-2018-4063
cwes: CWE-434
cveID: CVE-2025-14174
vendorProject: Google
product: Chromium
vulnerabilityName: Google Chromium Out of Bounds Memory Access Vulnerability
dateAdded: 2025-12-12
shortDescription: Google Chromium contains an out of bounds memory access vulnerability in ANGLE that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2026-01-02
knownRansomwareCampaignUse: Unknown
notes: https://chromereleases.googleblog.com/2025/12/stable-channel-update-for-desktop_10.html ; https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security ; https://nvd.nist.gov/vuln/detail/CVE-2025-14174
cveID: CVE-2025-58360
vendorProject: OSGeo
product: GeoServer
vulnerabilityName: OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability
dateAdded: 2025-12-11
shortDescription: OSGeo GeoServer contains an improper restriction of XML external entity reference vulnerability that occurs when the application accepts XML input through a specific endpoint /geoserver/wms operation GetMap and could allow an attacker to define external entities within the XML request.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2026-01-01
knownRansomwareCampaignUse: Unknown
notes: This vulnerability affects an open-source component, third-party library, or a protocol used by different products. For more information, please see: https://github.com/geoserver/geoserver/security/advisories/GHSA-fjf5-xgmq-5525 ; https://osgeo-org.atlassian.net/browse/GEOS-11922 ; https://nvd.nist.gov/vuln/detail/CVE-2025-58360
cwes: CWE-611
cveID: CVE-2025-6218
vendorProject: RARLAB
product: WinRAR
vulnerabilityName: RARLAB WinRAR Path Traversal Vulnerability
dateAdded: 2025-12-09
shortDescription: RARLAB WinRAR contains a path traversal vulnerability allowing an attacker to execute code in the context of the current user.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-12-30
knownRansomwareCampaignUse: Unknown
notes: https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=276&cHash=b5165454d983fc9717bc8748901a64f9 ; https://nvd.nist.gov/vuln/detail/CVE-2025-6218
cwes: CWE-22
cveID: CVE-2025-62221
vendorProject: Microsoft
product: Windows
vulnerabilityName: Microsoft Windows Use After Free Vulnerability
dateAdded: 2025-12-09
shortDescription: Microsoft Windows Cloud Files Mini Filter Driver contains a use after free vulnerability that can allow an authorized attacker to elevate privileges locally.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-12-30
knownRansomwareCampaignUse: Unknown
notes: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-62221 ; https://nvd.nist.gov/vuln/detail/CVE-2025-62221
cwes: CWE-416
cveID: CVE-2022-37055
vendorProject: D-Link
product: Routers
vulnerabilityName: D-Link Routers Buffer Overflow Vulnerability
dateAdded: 2025-12-08
shortDescription: D-Link Routers contains a buffer overflow vulnerability that has a high impact on confidentiality, integrity, and availability. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-12-29
knownRansomwareCampaignUse: Unknown
notes: https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10308 ; https://nvd.nist.gov/vuln/detail/CVE-2022-37055
cwes: CWE-120
cveID: CVE-2025-66644
vendorProject: Array Networks 
product: ArrayOS AG
vulnerabilityName: Array Networks ArrayOS AG OS Command Injection Vulnerability
dateAdded: 2025-12-08
shortDescription: Array Networks ArrayOS AG contains an OS command injection vulnerability that could allow an attacker to execute arbitrary commands.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-12-29
knownRansomwareCampaignUse: Unknown
notes: https://support.arraynetworks.net/prx/001/http/supportportal.arraynetworks.net/ag.html ; https://www.jpcert.or.jp/at/2025/at250024.html ; https://nvd.nist.gov/vuln/detail/CVE-2025-66644
cwes: CWE-78
cveID: CVE-2025-55182
vendorProject: Meta
product: React Server Components
vulnerabilityName: Meta React Server Components Remote Code Execution Vulnerability
dateAdded: 2025-12-05
shortDescription: Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-12-12
knownRansomwareCampaignUse: Known
notes: Check for signs of potential compromise on all internet accessible REACT instances after applying mitigations. For more information, please see: https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components ; https://github.com/vercel-labs/fix-react2shell-next?tab=readme-ov-file ; https://nvd.nist.gov/vuln/detail/CVE-2025-55182
cveID: CVE-2021-26828
vendorProject: OpenPLC
product: ScadaBR
vulnerabilityName: OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability
dateAdded: 2025-12-03
shortDescription: OpenPLC ScadaBR contains an unrestricted upload of file with dangerous type vulnerability that allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-12-24
knownRansomwareCampaignUse: Unknown
notes: This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/SCADA-LTS/Scada-LTS/pull/2174 ; https://nvd.nist.gov/vuln/detail/CVE-2021-26828
cwes: CWE-434
cveID: CVE-2025-48633
vendorProject: Android
product: Framework
vulnerabilityName: Android Framework Information Disclosure Vulnerability
dateAdded: 2025-12-02
shortDescription: Android Framework contains an unspecified vulnerability that allows for information disclosure.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-12-23
knownRansomwareCampaignUse: Unknown
notes: https://source.android.com/docs/security/bulletin/2025-12-01 ; https://nvd.nist.gov/vuln/detail/CVE-2025-48633
cveID: CVE-2025-48572
vendorProject: Android
product: Framework
vulnerabilityName: Android Framework Privilege Escalation Vulnerability
dateAdded: 2025-12-02
shortDescription: Android Framework contains an unspecified vulnerability that allows for privilege escalation.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-12-23
knownRansomwareCampaignUse: Unknown
notes: https://source.android.com/docs/security/bulletin/2025-12-01 ; https://nvd.nist.gov/vuln/detail/CVE-2025-48572
cveID: CVE-2021-26829
vendorProject: OpenPLC
product: ScadaBR
vulnerabilityName: OpenPLC ScadaBR Cross-site Scripting Vulnerability
dateAdded: 2025-11-28
shortDescription: OpenPLC ScadaBR contains a cross-site scripting vulnerability via system_settings.shtm.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-12-19
knownRansomwareCampaignUse: Unknown
notes: This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/SCADA-LTS/Scada-LTS/pull/3211 ; https://nvd.nist.gov/vuln/detail/CVE-2021-26829
cwes: CWE-79