deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-3547
Published: 2025-04-14
Description: A vulnerability classified as critical was found in frdel Agent-Zero 0.8.1.2. This vulnerability affects unknown code of the file /get_work_dir_files. The manipulation of the argument path leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-22
References: https://vuldb.com/?ctiid.304588; https://vuldb.com/?id.304588; https://vuldb.com/?submit.546220
CVE: CVE-2025-3548
Published: 2025-04-14
Description: A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp up to 5.4.3. This issue affects the function aiString::Set in the library include/assimp/types.h of the component File Handler. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-122
References: https://github.com/assimp/assimp/issues/6068; https://github.com/assimp/assimp/pull/6073; https://github.com/user-attachments/files/19580584/aiString_Set-hbo.zip
CVE: CVE-2025-3549
Published: 2025-04-14
Description: A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. Affected is the function Assimp::MD3Importer::ValidateSurfaceHeaderOffsets of the file code/AssetLib/MD3/MD3Loader.cpp of the component File Handler. The manipulation leads to heap-based buffer overflow. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-122
References: https://github.com/assimp/assimp/issues/6070; https://github.com/user-attachments/files/19580481/Assimp_MD3Importer_ValidateSurfaceHeaderOffsets-hbo.zip; https://vuldb.com/?ctiid.304590
CVE: CVE-2025-3572
Published: 2025-04-14
Description: SmartRobot from INTUMIT has a Server-Side Request Forgery vulnerability, allowing unauthenticated remote attackers to probe internal network and even access arbitrary local files on the server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://www.twcert.org.tw/en/cp-139-10065-2494c-2.html; https://www.twcert.org.tw/tw/cp-132-10064-6346a-1.html
CVE: CVE-2025-3550
Published: 2025-04-14
Description: A vulnerability has been found in wowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /v1/pushConfig/detail/. The manipulation leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-266, CWE-285
References: https://github.com/38279/2/issues/1; https://vuldb.com/?ctiid.304591; https://vuldb.com/?id.304591
CVE: CVE-2025-3551
Published: 2025-04-14
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The vendor was not able to verify the existence of the original vulnerability report and the researcher was not able to provide further proof.
CVE: CVE-2024-9230
Published: 2025-04-14
Description: The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.9.18 does not sanitise and escape some of its settings when adding a podcast, which could allow author and above users to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/ab5eaf57-fb61-4a08-b439-42dea40b7914/
CVE: CVE-2025-2563
Published: 2025-04-14
Description: The User Registration & Membership  WordPress plugin before 4.1.2 does not prevent users to set their account role when the Membership Addon is enabled, leading to a privilege escalation issue and allowing unauthenticated users to gain admin privileges
CVSS Score: 8.1 (HIGH)
References: https://wpscan.com/vulnerability/2c0f62a1-9510-4f90-a297-17634e6c8b75/
CVE: CVE-2025-3552
Published: 2025-04-14
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The vendor was not able to verify the existence of the original vulnerability report and the researcher was not able to provide further proof.
CVE: CVE-2025-3553
Published: 2025-04-14
Description: A vulnerability was found in phpshe 1.8. It has been declared as critical. This vulnerability affects the function pe_delete of the file /admin.php?mod=brand&act=del. The manipulation of the argument brand_id[] leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://vuldb.com/?ctiid.304594; https://vuldb.com/?id.304594; https://vuldb.com/?submit.548265
CVE: CVE-2025-30516
Published: 2025-04-14
Description: Mattermost Mobile Apps versions <=2.25.0  fail to terminate sessions during logout under certain conditions (e.g. poor connectivity), allowing unauthorized users on shared devices to access sensitive notification content via continued mobile notifications
CVSS Score: 2.0 (LOW)
CWE: CWE-613
References: https://mattermost.com/security-updates
CVE: CVE-2025-32093
Published: 2025-04-14
Description: Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to restrict certain operations on system admins to only other system admins, which allows delegated granular administration users with the "Edit Other Users" permission to perform unauthorized modifications to system administrators via improper permission validation.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-863
References: https://mattermost.com/security-updates
CVE: CVE-2025-3554
Published: 2025-04-14
Description: A vulnerability was found in phpshe 1.8. It has been rated as problematic. This issue affects some unknown processing of the file api.php?mod=cron&act=buyer. The manipulation of the argument act leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94, CWE-79
References: https://vuldb.com/?ctiid.304595; https://vuldb.com/?id.304595; https://vuldb.com/?submit.548411
CVE: CVE-2025-3555
Published: 2025-04-14
Description: A vulnerability classified as problematic has been found in ScriptAndTools eCommerce-website-in-PHP 3.0. Affected is an unknown function of the file /login.php. The manipulation leads to improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.7 (LOW)
CWE: CWE-307, CWE-799
References: https://github.com/Maloyroyorko/E-commerce-3.0-user-bruter; https://vuldb.com/?ctiid.304596; https://vuldb.com/?id.304596
CVE: CVE-2025-31344
Published: 2025-04-14
Description: Heap-based Buffer Overflow vulnerability in openEuler giflib on Linux. This vulnerability is associated with program files gif2rgb.C.

This issue affects giflib: through 5.2.2.
CVSS Score: 7.3 (HIGH)
CWE: CWE-122
References: https://gitee.com/src-openeuler/giflib/pulls/54; https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1292; http://www.openwall.com/lists/oss-security/2025/04/07/3
CVE: CVE-2025-3556
Published: 2025-04-14
Description: A vulnerability classified as problematic was found in ScriptAndTools eCommerce-website-in-PHP 3.0. Affected by this vulnerability is an unknown functionality of the file /admin/login.php. The manipulation leads to improper restriction of excessive authentication attempts. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.7 (LOW)
CWE: CWE-307, CWE-799
References: https://vuldb.com/?ctiid.304597; https://vuldb.com/?id.304597; https://vuldb.com/?submit.549187
CVE: CVE-2025-3557
Published: 2025-04-14
Description: A vulnerability, which was classified as problematic, has been found in ScriptAndTools eCommerce-website-in-PHP 3.0. Affected by this issue is some unknown functionality. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Multiple endpoints are affected. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-862, CWE-352
References: https://vuldb.com/?ctiid.304598; https://vuldb.com/?id.304598; https://vuldb.com/?submit.551053
CVE: CVE-2025-24859
Published: 2025-04-14
Description: A session management vulnerability exists in Apache Roller before version 6.1.5 where active user sessions are not properly invalidated after password changes. When a user's password is changed, either by the user themselves or by an administrator, existing sessions remain active and usable. This allows continued access to the application through old sessions even after password changes, potentially enabling unauthorized access if credentials were compromised.

This issue affects Apache Roller versions up to and including 6.1.4.

The vulnerability is fixed in Apache Roller 6.1.5 by implementing centralized session management that properly invalidates all active sessions when passwords are changed or users are disabled.
CVSS Score: 8.8 (HIGH)
CWE: CWE-613
References: https://lists.apache.org/thread/4j906k16v21kdx8hk87gl7663sw7lg7f; https://lists.apache.org/thread/vxv52vdr8nhtjlj6v02w43fdvo0cxw23; http://www.openwall.com/lists/oss-security/2025/04/11/1
CVE: CVE-2025-3558
Published: 2025-04-14
Description: A vulnerability, which was classified as critical, was found in ghostxbh uzy-ssm-mall 1.0.0. This affects an unknown part of the file /mall/user/uploadUserHeadImage. The manipulation of the argument File leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://vuldb.com/?ctiid.304599; https://vuldb.com/?id.304599; https://vuldb.com/?submit.549259
CVE: CVE-2025-3559
Published: 2025-04-14
Description: A vulnerability has been found in ghostxbh uzy-ssm-mall 1.0.0 and classified as critical. This vulnerability affects the function ForeProductListController of the file /mall/product/0/20. The manipulation of the argument orderBy leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://vuldb.com/?ctiid.304600; https://vuldb.com/?id.304600; https://vuldb.com/?submit.549260
CVE: CVE-2025-3560
Published: 2025-04-14
Description: A vulnerability was found in ghostxbh uzy-ssm-mall 1.0.0 and classified as problematic. This issue affects some unknown processing of the file /product. The manipulation of the argument product_name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://vuldb.com/?ctiid.304601; https://vuldb.com/?id.304601; https://vuldb.com/?submit.549261
CVE: CVE-2025-3561
Published: 2025-04-14
Description: A vulnerability was found in ghostxbh uzy-ssm-mall 1.0.0. It has been classified as problematic. Affected is an unknown function. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-862, CWE-352
References: https://vuldb.com/?ctiid.304602; https://vuldb.com/?id.304602; https://vuldb.com/?submit.549268
CVE: CVE-2025-27009
Published: 2025-04-14
Description: Cross-Site Request Forgery (CSRF) vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Stored XSS.This issue affects My auctions allegro: from n/a through <= 3.6.33.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/my-auctions-allegro-free-edition/vulnerability/wordpress-my-auctions-allegro-plugin-3-6-20-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-3562
Published: 2025-04-14
Description: A vulnerability was found in Yonyou YonBIP MA2.7. It has been declared as problematic. Affected by this vulnerability is the function FileInputStream of the file /mobsm/common/userfile. The manipulation of the argument path leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://vuldb.com/?ctiid.304603; https://vuldb.com/?id.304603; https://vuldb.com/?submit.549269
CVE: CVE-2025-3563
Published: 2025-04-14
Description: A vulnerability was found in WuzhiCMS 4.1. It has been rated as critical. Affected by this issue is the function Set of the file /index.php?m=attachment&f=index&_su=wuzhicms&v=set&submit=1 of the component Setting Handler. The manipulation of the argument Setting leads to code injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-94, CWE-94
References: https://vuldb.com/?ctiid.304604; https://vuldb.com/?id.304604; https://vuldb.com/?submit.549270
CVE: CVE-2024-10087
Published: 2025-04-14
Description: Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Reflected XSS (Cross-site Scripting) attacks. An attacker might craft a link containing a malicious script, which then gets directly embedded in references to other resources, what causes the script to run in user's context multiple times. 
This vulnerability has been patched in version 79.0
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://cert.pl/en/posts/2025/04/CVE-2024-10087; https://www.iksoris.pl/system-rezerwacji-i-sprzedazy-biletow-iksoris.html
CVE: CVE-2024-10088
Published: 2025-04-14
Description: Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Reflected XSS (Cross-site Scripting) attacks. An attacker might trick a user into filling a login form with a malicious script, what causes the script to run in user's context. 
This vulnerability has been patched in version 79.0
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://cert.pl/en/posts/2025/04/CVE-2024-10087; https://www.iksoris.pl/system-rezerwacji-i-sprzedazy-biletow-iksoris.html
CVE: CVE-2024-10089
Published: 2025-04-14
Description: Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Stored XSS (Cross-site Scripting) attacks. An attacker might trick a user into filling a form designed for changing user's data with a malicious script, what causes the script to run in user's context. 
This vulnerability has been patched in version 79.0
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://cert.pl/en/posts/2025/04/CVE-2024-10087; https://www.iksoris.pl/system-rezerwacji-i-sprzedazy-biletow-iksoris.html
CVE: CVE-2024-10090
Published: 2025-04-14
Description: Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Reflected XSS (Cross-site Scripting) attacks. An attacker might trick a user into filling a form designed for adding users with a malicious script, what causes the script to run in user's context. 
This vulnerability has been patched in version 79.0
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://cert.pl/en/posts/2025/04/CVE-2024-10087; https://www.iksoris.pl/system-rezerwacji-i-sprzedazy-biletow-iksoris.html
CVE: CVE-2024-13597
Published: 2025-04-14
Description: Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Reflected XSS (Cross-site Scripting) attacks. An attacker might trick a user into filling a form sent to login panel at /softcom/ with a malicious script, what causes the script to run in user's context. 
This vulnerability has been patched in version 79.0
CWE: CWE-79
References: https://cert.pl/en/posts/2025/04/CVE-2024-10087; https://www.iksoris.pl/system-rezerwacji-i-sprzedazy-biletow-iksoris.html
CVE: CVE-2024-13598
Published: 2025-04-14
Description: Internet Starter, one of SoftCOM iKSORIS system modules, is  vulnerable to Reflected XSS (Cross-site Scripting) attacks. Using a functionality of creating new form fields one creates new parameters vulnerable to XSS attacks. A user tricked into filling such a form with a malicious script will run the code in their's context. 
This vulnerability has been patched in version 79.0
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://cert.pl/en/posts/2025/04/CVE-2024-10087; https://www.iksoris.pl/system-rezerwacji-i-sprzedazy-biletow-iksoris.html
CVE: CVE-2024-49705
Published: 2025-04-14
Description: Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to client-side Denial of Servise (DoS) attacks. An attacker might trick a user into using an URL with a d parameter set to an unhandled value. All the subsequent requests will not be accepted as the server returns an error message. Since this parameter is sent as part of a session cookie, the issue persists until the session expires or the user deletes cookies manually. 
Similar effect might be achieved when a user tries to change platform language to an unimplemented one.
This vulnerability has been patched in version 79.0
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-248
References: https://cert.pl/en/posts/2025/04/CVE-2024-10087; https://www.iksoris.pl/system-rezerwacji-i-sprzedazy-biletow-iksoris.html
CVE: CVE-2024-49706
Published: 2025-04-14
Description: Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Open Redirect attacks by including base64 encoded URLs in the target parameter sent in a POST request to one of the endpoints.
This vulnerability has been patched in version 79.0
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://cert.pl/en/posts/2025/04/CVE-2024-10087; https://www.iksoris.pl/system-rezerwacji-i-sprzedazy-biletow-iksoris.html
CVE: CVE-2024-49707
Published: 2025-04-14
Description: Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Reflected XSS (Cross-site Scripting) attacks. An attacker might trick a user into filling a form designed for resetting user's password with a malicious script, what causes the script to run in user's context. 
This vulnerability has been patched in version 79.0
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://cert.pl/en/posts/2025/04/CVE-2024-10087; https://www.iksoris.pl/system-rezerwacji-i-sprzedazy-biletow-iksoris.html
CVE: CVE-2024-49708
Published: 2025-04-14
Description: Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Stored XSS (Cross-site Scripting) attacks. An attacker might trick a user into filling a form designed for setting delivery address with a malicious script, what causes the script to run in user's context. 
This vulnerability has been patched in version 79.0
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://cert.pl/en/posts/2025/04/CVE-2024-10087; https://www.iksoris.pl/system-rezerwacji-i-sprzedazy-biletow-iksoris.html
CVE: CVE-2024-49709
Published: 2025-04-14
Description: Internet Starter, one of SoftCOM iKSORIS system modules, allows for setting an arbitrary session cookie value. An attacker with an access to user's browser might set such a cookie, wait until the user logs in and then use the same cookie to take over the account. 
Moreover, the system does not destroy the old sessions when creating new ones, what expands the time frame in which an attack might be performed. 
This vulnerability has been patched in version 79.0
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-384
References: https://cert.pl/en/posts/2025/04/CVE-2024-10087; https://www.iksoris.pl/system-rezerwacji-i-sprzedazy-biletow-iksoris.html
CVE: CVE-2025-3564
Published: 2025-04-14
Description: A vulnerability classified as problematic has been found in huanfenz/code-projects StudentManager up to 1.0. This affects an unknown part of the component Teacher String Handler. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-266, CWE-285
References: https://github.com/buluorifu/Vulnerability-recurrence/blob/main/Refer/StudentManager-authority.md; https://vuldb.com/?ctiid.304605; https://vuldb.com/?id.304605
CVE: CVE-2025-3565
Published: 2025-04-14
Description: A vulnerability classified as critical was found in huanfenz/code-projects StudentManager 1.0. This vulnerability affects unknown code of the file /upload/uploadArticle.do of the component Announcement Management Section. The manipulation of the argument File leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/buluorifu/Vulnerability-recurrence/blob/main/Refer/StudentManager-xss.md; https://vuldb.com/?ctiid.304606; https://vuldb.com/?id.304606
CVE: CVE-2025-3566
Published: 2025-04-14
Description: A vulnerability, which was classified as critical, has been found in veal98 小牛肉 Echo 开源社区系统 4.2. This issue affects the function uploadMdPic of the file /discuss/uploadMdPic. The manipulation of the argument editormd-image-file leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-284, CWE-434
References: https://github.com/caigo8/CVE-md/blob/main/Echo/%E6%9C%AA%E6%8E%88%E6%9D%83%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0.md; https://vuldb.com/?ctiid.304607; https://vuldb.com/?id.304607
CVE: CVE-2025-3567
Published: 2025-04-14
Description: A vulnerability, which was classified as problematic, was found in veal98 小牛肉 Echo 开源社区系统 4.2. Affected is the function preHandle of the file src/main/java/com/greate/community/controller/interceptor/LoginTicketInterceptor.java of the component Ticket Handler. The manipulation leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-266, CWE-285
References: https://github.com/caigo8/CVE-md/blob/main/Echo/%E4%B8%8D%E5%AE%89%E5%85%A8%E7%9A%84%E6%9D%83%E9%99%90%E6%A0%A1%E9%AA%8C.md; https://vuldb.com/?ctiid.304608; https://vuldb.com/?id.304608
CVE: CVE-2025-32906
Published: 2025-04-14
Description: A flaw was found in libsoup, where the soup_headers_parse_request() function may be vulnerable to an out-of-bound read. This flaw allows a malicious user to use a specially crafted HTTP request to crash the HTTP server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://access.redhat.com/errata/RHSA-2025:21657; https://access.redhat.com/errata/RHSA-2025:4439; https://access.redhat.com/errata/RHSA-2025:4440