auren-research/cyber-sec huggingface dataset:
cveID: CVE-2025-61757
vendorProject: Oracle
product: Fusion Middleware
vulnerabilityName: Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability
dateAdded: 2025-11-21
shortDescription: Oracle Fusion Middleware contains a missing authentication for critical function vulnerability, allowing unauthenticated remote attackers to take over Identity Manager.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-12-12
knownRansomwareCampaignUse: Unknown
notes: https://www.oracle.com/security-alerts/cpuoct2025.html ; https://nvd.nist.gov/vuln/detail/CVE-2025-61757
cwes: CWE-306
cveID: CVE-2025-13223
vendorProject: Google
product: Chromium V8
vulnerabilityName: Google Chromium V8 Type Confusion Vulnerability
dateAdded: 2025-11-19
shortDescription: Google Chromium V8 contains a type confusion vulnerability that allows for heap corruption.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-12-10
knownRansomwareCampaignUse: Unknown
notes: https://chromereleases.googleblog.com/2025/11/stable-channel-update-for-desktop_17.html ; https://nvd.nist.gov/vuln/detail/CVE-2025-13223
cwes: CWE-843
cveID: CVE-2025-58034
vendorProject: Fortinet
product: FortiWeb
vulnerabilityName: Fortinet FortiWeb OS Command Injection Vulnerability
dateAdded: 2025-11-18
shortDescription: Fortinet FortiWeb contains an OS command Injection vulnerability that may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-11-25
knownRansomwareCampaignUse: Unknown
notes: https://fortiguard.fortinet.com/psirt/FG-IR-25-513 ; https://nvd.nist.gov/vuln/detail/CVE-2025-58034
cwes: CWE-78
cveID: CVE-2025-64446
vendorProject: Fortinet
product: FortiWeb
vulnerabilityName: Fortinet FortiWeb Path Traversal Vulnerability
dateAdded: 2025-11-14
shortDescription: Fortinet FortiWeb contains a relative path traversal vulnerability that may allow an unauthenticated attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-11-21
knownRansomwareCampaignUse: Unknown
notes: https://www.fortiguard.com/psirt/FG-IR-25-910 ; https://nvd.nist.gov/vuln/detail/CVE-2025-64446
cwes: CWE-23
cveID: CVE-2025-12480
vendorProject: Gladinet
product: Triofox
vulnerabilityName: Gladinet Triofox Improper Access Control Vulnerability
dateAdded: 2025-11-12
shortDescription: Gladinet Triofox contains an improper access control vulnerability that allows access to initial setup pages even after setup is complete.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-12-03
knownRansomwareCampaignUse: Unknown
notes: https://access.triofox.com/releases_history ; https://nvd.nist.gov/vuln/detail/CVE-2025-12480
cwes: CWE-284
cveID: CVE-2025-62215
vendorProject: Microsoft
product: Windows
vulnerabilityName: Microsoft Windows Race Condition Vulnerability
dateAdded: 2025-11-12
shortDescription: Microsoft Windows Kernel contains a race condition vulnerability that allows a local attacker with low-level privileges to escalate privileges. Successful exploitation of this vulnerability could enable the attacker to gain SYSTEM-level access.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-12-03
knownRansomwareCampaignUse: Unknown
notes: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-62215 ; https://nvd.nist.gov/vuln/detail/CVE-2025-62215
cwes: CWE-362
cveID: CVE-2025-9242
vendorProject: WatchGuard
product: Firebox
vulnerabilityName: WatchGuard Firebox Out-of-Bounds Write Vulnerability
dateAdded: 2025-11-12
shortDescription: WatchGuard Firebox contains an out-of-bounds write vulnerability in the OS iked process that may allow a remote unauthenticated attacker to execute arbitrary code.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-12-03
knownRansomwareCampaignUse: Unknown
notes: https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00015 ; https://nvd.nist.gov/vuln/detail/CVE-2025-9242
cwes: CWE-787
cveID: CVE-2025-21042
vendorProject: Samsung
product: Mobile Devices
vulnerabilityName: Samsung Mobile Devices Out-of-Bounds Write Vulnerability
dateAdded: 2025-11-10
shortDescription: Samsung mobile devices contain an out-of-bounds write vulnerability in libimagecodec.quram.so. This vulnerability could allow remote attackers to execute arbitrary code.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-12-01
knownRansomwareCampaignUse: Unknown
notes: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=04 ; https://nvd.nist.gov/vuln/detail/CVE-2025-21042
cwes: CWE-787
cveID: CVE-2025-48703
vendorProject: CWP
product: Control Web Panel
vulnerabilityName: CWP Control Web Panel OS Command Injection Vulnerability
dateAdded: 2025-11-04
shortDescription: CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command Injection vulnerability that allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-11-25
knownRansomwareCampaignUse: Unknown
notes: https://control-webpanel.com/changelog ; https://nvd.nist.gov/vuln/detail/CVE-2025-48703
cwes: CWE-78
cveID: CVE-2025-11371
vendorProject: Gladinet
product: CentreStack and Triofox
vulnerabilityName: Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability
dateAdded: 2025-11-04
shortDescription: Gladinet CentreStack and Triofox contains a files or directories accessible to external parties vulnerability that allows unintended disclosure of system files.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-11-25
knownRansomwareCampaignUse: Unknown
notes: https://www.centrestack.com/p/gce_latest_release.html ; https://nvd.nist.gov/vuln/detail/CVE-2025-11371
cwes: CWE-552
cveID: CVE-2025-41244
vendorProject: Broadcom
product: VMware Aria Operations and VMware Tools
vulnerabilityName: Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability
dateAdded: 2025-10-30
shortDescription: Broadcom VMware Aria Operations and VMware Tools contain a privilege defined with unsafe actions vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-11-20
knownRansomwareCampaignUse: Unknown
notes: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36149 ; https://nvd.nist.gov/vuln/detail/CVE-2025-41244
cwes: CWE-267
cveID: CVE-2025-24893
vendorProject: XWiki
product: Platform
vulnerabilityName: XWiki Platform Eval Injection Vulnerability
dateAdded: 2025-10-30
shortDescription: XWiki Platform contains an eval injection vulnerability that could allow any guest to perform arbitrary remote code execution through a request to SolrSearch.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-11-20
knownRansomwareCampaignUse: Unknown
notes: https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rr6p-3pfg-562j ; https://nvd.nist.gov/vuln/detail/CVE-2025-24893
cwes: CWE-95
cveID: CVE-2025-6204
vendorProject: Dassault Systèmes
product: DELMIA Apriso
vulnerabilityName: Dassault Systèmes DELMIA Apriso Code Injection Vulnerability
dateAdded: 2025-10-28
shortDescription: Dassault Systèmes DELMIA Apriso contains a code injection vulnerability that could allow an attacker to execute arbitrary code.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-11-18
knownRansomwareCampaignUse: Unknown
notes: https://www.3ds.com/trust-center/security/security-advisories/cve-2025-6204 ; https://nvd.nist.gov/vuln/detail/CVE-2025-6204
cwes: CWE-94
cveID: CVE-2025-6205
vendorProject: Dassault Systèmes
product: DELMIA Apriso
vulnerabilityName: Dassault Systèmes DELMIA Apriso Missing Authorization Vulnerability
dateAdded: 2025-10-28
shortDescription: Dassault Systèmes DELMIA Apriso contains a missing authorization vulnerability that could allow an attacker to gain privileged access to the application.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-11-18
knownRansomwareCampaignUse: Unknown
notes: https://www.3ds.com/trust-center/security/security-advisories/cve-2025-6205 ; https://nvd.nist.gov/vuln/detail/CVE-2025-6205
cwes: CWE-862
cveID: CVE-2025-54236
vendorProject: Adobe
product: Commerce and Magento
vulnerabilityName: Adobe Commerce and Magento Improper Input Validation Vulnerability
dateAdded: 2025-10-24
shortDescription: Adobe Commerce and Magento Open Source contain an improper input validation vulnerability that could allow an attacker to take over customer accounts through the Commerce REST API.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-11-14
knownRansomwareCampaignUse: Unknown
notes: https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-27397 ; https://nvd.nist.gov/vuln/detail/CVE-2025-54236
cwes: CWE-20
cveID: CVE-2025-59287
vendorProject: Microsoft
product: Windows
vulnerabilityName: Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability
dateAdded: 2025-10-24
shortDescription: Microsoft Windows Server Update Service (WSUS) contains a deserialization of untrusted data vulnerability that allows for remote code execution.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-11-14
knownRansomwareCampaignUse: Unknown
notes: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-59287 ; https://nvd.nist.gov/vuln/detail/CVE-2025-59287
cwes: CWE-502
cveID: CVE-2025-61932
vendorProject: Motex
product: LANSCOPE Endpoint Manager
vulnerabilityName: Motex LANSCOPE Endpoint Manager Improper Verification of Source of a Communication Channel Vulnerability
dateAdded: 2025-10-22
shortDescription: Motex LANSCOPE Endpoint Manager contains an improper verification of source of a communication channel vulnerability allowing an attacker to execute arbitrary code by sending specially crafted packets.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-11-12
knownRansomwareCampaignUse: Unknown
notes: https://www.motex.co.jp/news/notice/2025/release251020/ ; https://nvd.nist.gov/vuln/detail/CVE-2025-61932
cwes: CWE-940
cveID: CVE-2022-48503
vendorProject: Apple
product: Multiple Products
vulnerabilityName: Apple Multiple Products Unspecified Vulnerability
dateAdded: 2025-10-20
shortDescription: Apple macOS, iOS, tvOS, Safari, and watchOS contain an unspecified vulnerability in JavaScriptCore that when processing web content may lead to arbitrary code execution. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-11-10
knownRansomwareCampaignUse: Unknown
notes: https://support.apple.com/en-us/HT213340 ; https://support.apple.com/en-us/HT213341 ; https://support.apple.com/en-us/HT213342 ; https://support.apple.com/en-us/HT213345 ; https://support.apple.com/en-us/HT213346 ; https://nvd.nist.gov/vuln/detail/CVE-2022-48503
cveID: CVE-2025-2746
vendorProject: Kentico
product: Xperience CMS
vulnerabilityName: Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability
dateAdded: 2025-10-20
shortDescription: Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-11-10
knownRansomwareCampaignUse: Unknown
notes: https://devnet.kentico.com/download/hotfixes ; https://nvd.nist.gov/vuln/detail/CVE-2025-2746
cwes: CWE-288
cveID: CVE-2025-2747
vendorProject: Kentico
product: Xperience CMS
vulnerabilityName: Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability
dateAdded: 2025-10-20
shortDescription: Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-11-10
knownRansomwareCampaignUse: Unknown
notes: https://devnet.kentico.com/download/hotfixes ; https://nvd.nist.gov/vuln/detail/CVE-2025-2747
cwes: CWE-288
cveID: CVE-2025-33073
vendorProject: Microsoft
product: Windows
vulnerabilityName: Microsoft Windows SMB Client Improper Access Control Vulnerability
dateAdded: 2025-10-20
shortDescription: Microsoft Windows SMB Client contains an improper access control vulnerability that could allow for privilege escalation. An attacker could execute a specially crafted malicious script to coerce the victim machine to connect back to the attack system using SMB and authenticate.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-11-10
knownRansomwareCampaignUse: Unknown
notes: https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-33073 ; https://nvd.nist.gov/vuln/detail/CVE-2025-33073
cwes: CWE-284
cveID: CVE-2025-61884
vendorProject: Oracle
product: E-Business Suite
vulnerabilityName: Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability
dateAdded: 2025-10-20
shortDescription: Oracle E-Business Suite contains a server-side request forgery (SSRF) vulnerability in the Runtime component of Oracle Configurator. This vulnerability is remotely exploitable without authentication.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-11-10
knownRansomwareCampaignUse: Known
notes: https://www.oracle.com/security-alerts/alert-cve-2025-61884.html ; https://nvd.nist.gov/vuln/detail/CVE-2025-61884
cwes: CWE-918
cveID: CVE-2025-54253
vendorProject: Adobe
product: Experience Manager (AEM) Forms
vulnerabilityName: Adobe Experience Manager Forms Code Execution Vulnerability
dateAdded: 2025-10-15
shortDescription: Adobe Experience Manager Forms in JEE contains an unspecified vulnerability that allows for arbitrary code execution.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-11-05
knownRansomwareCampaignUse: Unknown
notes: https://helpx.adobe.com/security/products/aem-forms/apsb25-82.html ; https://nvd.nist.gov/vuln/detail/CVE-2025-54253
cveID: CVE-2025-47827
vendorProject: IGEL
product: IGEL OS
vulnerabilityName: IGEL OS Use of a Key Past its Expiration Date Vulnerability
dateAdded: 2025-10-14
shortDescription: IGEL OS contains a use of a key past its expiration date vulnerability that allows for Secure Boot bypass. The igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a crafted root filesystem can be mounted from an unverified SquashFS image.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-11-04
knownRansomwareCampaignUse: Unknown
notes: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-47827 ; https://nvd.nist.gov/vuln/detail/CVE-2025-47827
cwes: CWE-324
cveID: CVE-2025-24990
vendorProject: Microsoft
product: Windows
vulnerabilityName: Microsoft Windows Untrusted Pointer Dereference Vulnerability
dateAdded: 2025-10-14
shortDescription: Microsoft Windows Agere Modem Driver contains an untrusted pointer dereference vulnerability that allows for privilege escalation. An attacker who successfully exploited this vulnerability could gain administrator privileges.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-11-04
knownRansomwareCampaignUse: Unknown
notes: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-24990 ; https://nvd.nist.gov/vuln/detail/CVE-2025-24990
cwes: CWE-822
cveID: CVE-2025-59230
vendorProject: Microsoft
product: Windows
vulnerabilityName: Microsoft Windows Improper Access Control Vulnerability
dateAdded: 2025-10-14
shortDescription: Microsoft Windows contains an improper access control vulnerability in Windows Remote Access Connection Manager which could allow an authorized attacker to elevate privileges locally.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-11-04
knownRansomwareCampaignUse: Unknown
notes: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-59230 ; https://nvd.nist.gov/vuln/detail/CVE-2025-59230
cwes: CWE-284
cveID: CVE-2016-7836
vendorProject: SKYSEA
product: Client View
vulnerabilityName: SKYSEA Client View Improper Authentication Vulnerability
dateAdded: 2025-10-14
shortDescription: SKYSEA Client View contains an improper authentication vulnerability that allows remote code execution via a flaw in processing authentication on the TCP connection with the management console program.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-11-04
knownRansomwareCampaignUse: Unknown
notes: https://www.skyseaclientview.net/news/161221/ ; https://nvd.nist.gov/vuln/detail/CVE-2016-7836
cwes: CWE-287
cveID: CVE-2021-43798
vendorProject: Grafana Labs
product: Grafana
vulnerabilityName: Grafana Path Traversal Vulnerability
dateAdded: 2025-10-09
shortDescription: Grafana contains a path traversal vulnerability that could allow access to local files.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-10-30
knownRansomwareCampaignUse: Unknown
notes: https://grafana.com/blog/2021/12/07/grafana-8.3.1-8.2.7-8.1.8-and-8.0.7-released-with-high-severity-security-fix/ ; https://nvd.nist.gov/vuln/detail/CVE-2021-43798
cwes: CWE-22
cveID: CVE-2025-27915
vendorProject: Synacor
product: Zimbra Collaboration Suite (ZCS)
vulnerabilityName: Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability
dateAdded: 2025-10-07
shortDescription: Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-10-28
knownRansomwareCampaignUse: Unknown
notes: https://wiki.zimbra.com/wiki/Security_Center ; https://nvd.nist.gov/vuln/detail/CVE-2025-27915
cwes: CWE-79
cveID: CVE-2021-22555
vendorProject: Linux
product: Kernel
vulnerabilityName: Linux Kernel Heap Out-of-Bounds Write Vulnerability
dateAdded: 2025-10-06
shortDescription: Linux Kernel contains a heap out-of-bounds write vulnerability that could allow an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space.
requiredAction: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
dueDate: 2025-10-27
knownRansomwareCampaignUse: Unknown
notes: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/net/netfilter/x_tables.c?id=9fa492cdc160cd27ce1046cb36f47d3b2b1efa21 ; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/net/netfilter/x_tables.c?id=b29c457a6511435960115c0f548c4360d5f4801d ; https://security.netapp.com/advisory/ntap-20210805-0010/ ; https://github.com/google/security-research/security/advisories/GHSA-xxx5-8mvq-3528 ; https://nvd.nist.gov/vuln/detail/CVE-2021-22555
cwes: CWE-787