deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-10225
Published: 2025-09-10
Description: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) in the OpenSSL-based session module in AxxonSoft Axxon One (C-Werk) 2.0.6 and earlier on Windows allows a remote attacker under high load conditions to cause application crashes or unpredictable behavior via triggering memory reallocation errors when handling expired session keys.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories
CVE: CVE-2025-10226
Published: 2025-09-10
Description: Dependency on Vulnerable Third-Party Component (CWE-1395) in the PostgreSQL backend in AxxonSoft Axxon One (C-Werk) 2.0.8 and earlier on Windows and Linux allows a remote attacker to escalate privileges, execute arbitrary code, or cause denial-of-service via exploitation of multiple known CVEs present in PostgreSQL v10.x, which are resolved in PostgreSQL 17.4.
CVSS Score: 9.8 (CRITICAL)
References: https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories; https://www.postgresql.org/docs/release
CVE: CVE-2025-10227
Published: 2025-09-10
Description: Missing Encryption of Sensitive Data (CWE-311) in the Object Archive component in AxxonSoft Axxon One (C-Werk)  before 2.0.8 on Windows and Linux allows a local attacker with access to exported storage or stolen physical drives to extract sensitive archive data in plaintext via lack of encryption at rest.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-311
References: https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories
CVE: CVE-2025-7718
Published: 2025-09-10
Description: The Resideo Plugin for Resideo - Real Estate WordPress Theme plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.5.4. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
CVSS Score: 8.8 (HIGH)
CWE: CWE-639
References: https://themeforest.net/item/resideo-real-estate-wordpress-theme/27791406; https://www.wordfence.com/threat-intel/vulnerabilities/id/f8375ecf-e64b-4649-9341-fa45bf5556c3?source=cve
CVE: CVE-2025-10231
Published: 2025-09-10
Description: An Incorrect File Handling Permission bug exists on the N-central Windows Agent and Probe that, in the right circumstances, can allow a local low-level user to run commands with elevated permissions.
CVSS Score: 7.0 (HIGH)
CWE: CWE-276
References: https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2025.3_Release_Notes.htm; https://me.n-able.com/s/security-advisory/aArVy0000000jgHKAQ/cve202510231-incorrect-default-permissions-could-lead-to-privilege-escalation
CVE: CVE-2025-56404
Published: 2025-09-10
Description: An issue was discovered in MariaDB MCP 0.1.0 allowing attackers to gain sensitive information via the SSE service as the SSE service lacks user validation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/August829/CVEP/issues/2; https://github.com/MariaDB/mcp/issues/17
CVE: CVE-2025-56405
Published: 2025-09-10
Description: An issue was discovered in litmusautomation litmus-mcp-server thru 0.0.1 allowing unauthorized attackers to control the target's MCP service through the SSE protocol.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284, CWE-306
References: https://github.com/August829/CVEP/issues/3; https://github.com/litmusautomation/litmus-mcp-server/issues/4
CVE: CVE-2025-56406
Published: 2025-09-10
Description: An issue was discovered in mcp-neo4j 0.3.0 allowing attackers to obtain sensitive information or execute arbitrary commands via the SSE service. NOTE: the Supplier's position is that authentication is not mandatory for MCP servers, and the mcp-neo4j MCP server is only intended for use in a local environment where authentication realistically would not be needed. Also, the Supplier provides middleware to help isolate the MCP server from external access (if needed).
CVSS Score: 7.5 (HIGH)
CWE: CWE-77, CWE-200, CWE-284
References: https://github.com/August829/CVEP/issues/1; https://github.com/neo4j-contrib/mcp-neo4j/issues/124; https://modelcontextprotocol.io/specification/2025-03-26/basic/authorization
CVE: CVE-2025-56407
Published: 2025-09-10
Description: A vulnerability has been found in HuangDou UTCMS V9 and classified as critical. This vulnerability affects the function RunSql of the file app/modules/ut-data/admin/mysql.php. The manipulation of the argument sql leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/August829/CVEP/issues/4; https://github.com/August829/Yu/blob/main/20250810_1.md
CVE: CVE-2025-56413
Published: 2025-09-10
Description: OS Command injection vulnerability in function OperateSSH in 1panel 2.0.8 allowing attackers to execute arbitrary commands via the operation parameter to the /api/v2/hosts/ssh/operate endpoint.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/August829/CVEP/issues/5; https://github.com/August829/Yu/blob/main/20250812_1.md
CVE: CVE-2025-56466
Published: 2025-09-10
Description: Hardcoded credentials in Dietly v1.25.0 for android allows attackers to gain sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: https://github.com/dewcode91/security-research/blob/main/CVE-2025-56466.md
CVE: CVE-2025-56578
Published: 2025-09-10
Description: An issue in RTSPtoWeb v.2.4.3 allows a remote attacker to obtain sensitive information and executearbitrary code via the lack of authentication mechanisms
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-287
References: https://github.com/God-mellon/article/blob/main/RTSPtoWeb-Unauthorized%20Access%20Vulnerability.pdf
CVE: CVE-2025-20159
Published: 2025-09-10
Description: A vulnerability in the management interface access control list (ACL) processing feature in Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass configured ACLs for the SSH, NetConf, and gRPC features.

This vulnerability exists because management interface ACLs have not been supported on Cisco IOS XR Software Packet I/O infrastructure platforms for Linux-handled features such as SSH, NetConf, or gRPC. An attacker could exploit this vulnerability by attempting to send traffic to an affected device. A successful exploit could allow the attacker to bypass an ingress ACL that is applied on the management interface of the affected device.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-acl-packetio-Swjhhbtz
CVE: CVE-2025-20248
Published: 2025-09-10
Description: A vulnerability in the installation process of Cisco IOS XR Software could allow an authenticated, local attacker to bypass Cisco IOS XR Software image signature verification and load unsigned software on an affected device. To exploit this vulnerability, the attacker must have root-system privileges on the affected device.

This vulnerability is due to incomplete validation of files during the installation of an .iso file. An attacker could exploit this vulnerability by modifying contents of the .iso image and then installing and activating it on the device. A successful exploit could allow the attacker to load an unsigned file as part of the image activation process.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-347
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xrsig-UY4zRUCG
CVE: CVE-2025-20340
Published: 2025-09-10
Description: A vulnerability in the Address Resolution Protocol (ARP) implementation of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to trigger a broadcast storm, leading to a denial of service (DoS) condition on an affected device.&nbsp;

This vulnerability is due to how Cisco IOS XR Software processes a high, sustained rate of ARP traffic hitting the management interface. Under certain conditions, an attacker could exploit this vulnerability by sending an excessive amount of traffic to the management interface of an affected device, overwhelming its ARP processing capabilities. A successful exploit could result in degraded device performance, loss of management connectivity, and complete unresponsiveness of the system, leading to a DoS condition.
CVSS Score: 7.4 (HIGH)
CWE: CWE-400
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-arp-storm-EjUU55yM
CVE: CVE-2025-29592
Published: 2025-09-10
Description: oasys v1.1 is vulnerable to Directory Traversal in ProcedureController.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-22
References: https://github.com/qkdjksfkeg/Security-Collections/blob/main/PathTraversal.md
CVE: CVE-2025-43725
Published: 2025-09-10
Description: Dell PowerProtect Data Manager, Generic Application Agent, version(s) 19.19 and 19.20, contain(s) an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://www.dell.com/support/kbdoc/en-us/000367456/dsa-2025-326-security-update-for-dell-powerprotect-data-manager-multiple-security-vulnerabilities
CVE: CVE-2025-43884
Published: 2025-09-10
Description: Dell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution.
CVSS Score: 8.2 (HIGH)
CWE: CWE-78
References: https://www.dell.com/support/kbdoc/en-us/000367456/dsa-2025-326-security-update-for-dell-powerprotect-data-manager-multiple-security-vulnerabilities
CVE: CVE-2025-43885
Published: 2025-09-10
Description: Dell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://www.dell.com/support/kbdoc/en-us/000367456/dsa-2025-326-security-update-for-dell-powerprotect-data-manager-multiple-security-vulnerabilities
CVE: CVE-2025-43886
Published: 2025-09-10
Description: Dell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) a Path Traversal: '.../...//' vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Filesystem access for attacker.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-35
References: https://www.dell.com/support/kbdoc/en-us/000367456/dsa-2025-326-security-update-for-dell-powerprotect-data-manager-multiple-security-vulnerabilities
CVE: CVE-2025-43887
Published: 2025-09-10
Description: Dell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.
CVSS Score: 7.0 (HIGH)
CWE: CWE-276
References: https://www.dell.com/support/kbdoc/en-us/000367456/dsa-2025-326-security-update-for-dell-powerprotect-data-manager-multiple-security-vulnerabilities
CVE: CVE-2025-43888
Published: 2025-09-10
Description: Dell PowerProtect Data Manager, Hyper-V, version(s) 19.19 and 19.20, contain(s) an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access.
CVSS Score: 8.8 (HIGH)
CWE: CWE-532
References: https://www.dell.com/support/kbdoc/en-us/000367456/dsa-2025-326-security-update-for-dell-powerprotect-data-manager-multiple-security-vulnerabilities
CVE: CVE-2025-43938
Published: 2025-09-10
Description: Dell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) a Plaintext Storage of a Password vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to gain unauthorized access with privileges of the compromised account.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-256
References: https://www.dell.com/support/kbdoc/en-us/000367456/dsa-2025-326-security-update-for-dell-powerprotect-data-manager-multiple-security-vulnerabilities
CVE: CVE-2025-57569
Published: 2025-09-10
Description: Tenda F3 V12.01.01.48_multi and after is vulnerable to Buffer Overflow via the portList parameter in /goform/setNAT.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-120
References: http://tenda.com; https://github.com/arashiclustar/PingX-md/blob/main/F3/2025-57569/C.V.E-2025-57569.md
CVE: CVE-2025-57570
Published: 2025-09-10
Description: Tenda F3 V12.01.01.48_multi and after is vulnerable to Buffer Overflow via the QosList parameter in goform/setQoS.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-120
References: http://tenda.com; https://github.com/arashiclustar/PingX-md/blob/main/F3/2025-57570/C.V.E-2025-57570.md
CVE: CVE-2025-57571
Published: 2025-09-10
Description: Tenda F3 V12.01.01.48_multi and after is vulnerable to Buffer Overflow. via the macFilterList parameter in goform/setNAT.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-120
References: http://tenda.com; https://github.com/arashiclustar/PingX-md/blob/main/F3/2025-57571/C.V.E-2025-57571.md
CVE: CVE-2025-57572
Published: 2025-09-10
Description: Tenda F3 V12.01.01.48_multi and after is vulnerable to Buffer Overflow via the onlineList parameter in goform/setParentControl.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-120
References: http://tenda.com; https://github.com/arashiclustar/PingX-md/blob/main/F3/2025-57572/C.V.E-2025-57572.md
CVE: CVE-2025-57573
Published: 2025-09-10
Description: Tenda F3 V12.01.01.48_multi and after is vulnerable to Buffer Overflow via the wifiTimeClose parameter in goform/setWifi.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-120
References: http://tenda.com; https://github.com/arashiclustar/PingX-md/blob/main/F3/2025-57573/C.V.E-2025-57573.md
CVE: CVE-2025-58764
Published: 2025-09-10
Description: Claude Code is an agentic coding tool. Due to an error in command parsing, versions prior to 1.0.105 were vulnerable to a bypass of the Claude Code confirmation prompt to trigger execution of an untrusted command. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. Users on standard Claude Code auto-update will have received this fix automatically. Users performing manual updates are advised to update to version 1.0.105 or the latest version.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/anthropics/claude-code/security/advisories/GHSA-qxfv-fcpc-w36x
CVE: CVE-2025-59034
Published: 2025-09-10
Description: Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to version 3.3.8, a legacy API to retrieve user details could be misused to retrieve profile details of other users without having admin permissions due to a broken access check. Users should to update to Indico 3.3.8 as soon as possible. As a workaround, it is possible to restrict access to the affected API (e.g. in the webserver config).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://github.com/indico/indico/releases/tag/v3.3.8; https://github.com/indico/indico/security/advisories/GHSA-4269-mcfh-cp7q
CVE: CVE-2025-59035
Published: 2025-09-10
Description: Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to version 3.3.8, there is a Cross-Site-Scripting vulnerability when rendering LaTeX math code in contribution or abstract descriptions. Users should to update to Indico 3.3.8 as soon as possible. As a workaround, only let trustworthy users create content on Indico. Note that a conference doing a Call for Abstracts actively invites external speakers (who the organizers may not know and thus cannot fully trust) to submit content, hence the need to update to a a fixed version ASAP in particular when using such workflows.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://github.com/indico/indico/releases/tag/v3.3.8; https://github.com/indico/indico/security/advisories/GHSA-7cf7-9wrr-vrf4
CVE: CVE-2025-59041
Published: 2025-09-10
Description: Claude Code is an agentic coding tool. At startup, Claude Code executed a command templated in with `git config user.email`. Prior to version 1.0.105, a maliciously configured user email in git could be used to trigger arbitrary code execution before a user accepted the workspace trust dialog. Users on standard Claude Code auto-update will have received this fix automatically. Users performing manual updates are advised to update to version 1.0.105 or the latest version.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/anthropics/claude-code/security/advisories/GHSA-j4h9-wv2m-wrf7
CVE: CVE-2025-59045
Published: 2025-09-10
Description: Stalwart is a mail and collaboration server. Starting in version 0.12.0 and prior to version 0.13.3, a memory exhaustion vulnerability exists in Stalwart's CalDAV implementation that allows authenticated attackers to cause denial-of-service by triggering unbounded memory consumption through recurring event expansion. An authenticated attacker can crash the Stalwart server by creating recurring events with large payloads and triggering their expansion through CalDAV REPORT requests. A single malicious request expanding 300 events with 1000-character descriptions can consume up to 2 GB of memory. The vulnerability exists in the `ArchivedCalendarEventData.expand` function, which processes CalDAV `REPORT` requests with event expansion. When a client requests recurring events in their expanded form using the `<C:expand>` element, the server stores all expanded event instances in memory without enforcing size limits. Users should upgrade to Stalwart version 0.13.3 or later to receive a fix. If immediate upgrading is not possible, implement memory limits at the container/system level; monitor server memory usage for unusual spikes; consider rate limiting CalDAV REPORT requests; and restrict CalDAV access to trusted users only.
CWE: CWE-770
References: https://github.com/stalwartlabs/stalwart/blob/main/CHANGELOG.md; https://github.com/stalwartlabs/stalwart/commit/15762fba2ba335e560b8d25f71af085a8b6b6cf2; https://github.com/stalwartlabs/stalwart/releases/tag/v0.13.3
CVE: CVE-2025-8681
Published: 2025-09-10
Description: Pega Platform versions 7.1.0 to Infinity 24.2.2 are affected by a Stored XSS issue in a user interface component.  Requires a high privileged user with a developer role.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: https://support.pega.com/support-doc/pega-security-advisory-g25-vulnerability-remediation-note
CVE: CVE-2025-43785
Published: 2025-09-10
Description: Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.45 through 7.4.3.128, and Liferay DXP 2024 Q2.0 through 2024.Q2.9, 2024.Q1.1 through 2024.Q1.12, and 7.4 update 45 through update 92 allows remote attackers to execute an arbitrary web script or HTML in the My Workflow Tasks page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43785
CVE: CVE-2025-57520
Published: 2025-09-10
Description: A Cross Site Scripting (XSS) vulnerability exists in Decap CMS thru 3.8.3. Input fields such as body, tags, title, and description are not properly sanitized before being rendered in the content preview pane. This enables an attacker to inject arbitrary JavaScript which executes whenever a user views the preview panel. The vulnerability affects multiple input vectors and does not require user interaction beyond viewing the affected content.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/decaporg/decap-cms; https://onurcangenc.com.tr/blog/decap-cms-xss-analysis; https://onurcangenc.com.tr/posts/cve-2025-57520--stored-xss-in-decap-cms-3-8-3/
CVE: CVE-2025-57642
Published: 2025-09-10
Description: A Shell Upload vulnerability in Tourism Management System 2.0 allows an attacker to upload and execute arbitrary PHP shell scripts on the server, leading to remote code execution and unauthorized access to the system. This can result in the compromise of sensitive data and system functionality.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://github.com/debug-security/CVE/tree/main/CVE-2025-57642; https://github.com/sohamjuhin/Tourism-Management-System/issues/2
CVE: CVE-2025-50892
Published: 2025-09-10
Description: The eudskacs.sys driver version 20250328 shipped with EaseUs Todo Backup 1.2.0.1 fails to properly validate privileges for I/O requests (IRP_MJ_READ/IRP_MJ_WRITE) sent to its device object. This allows a local, low-privileged attacker to perform arbitrary raw disk reads and writes, leading to sensitive information disclosure, denial of service, or local privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: http://easeus.com; https://gist.github.com/christopher-ellis-workday/756c998f9f59dd2c437d83e60c7ed220
CVE: CVE-2025-55976
Published: 2025-09-10
Description: Intelbras IWR 3000N 1.9.8 exposes the Wi-Fi password in plaintext via the /api/wireless endpoint. Any unauthenticated user on the local network can directly obtain the Wi-Fi network password by querying this endpoint.
CVSS Score: 8.4 (HIGH)
CWE: CWE-200, CWE-319
References: https://medium.com/@windsormoreira/intelbras-iwr-3000n-unauthenticated-wi-fi-password-disclosure-cve-2025-55976-7cdac7770413; https://www.intelbras.com/pt-br/produto/roteador-wireless-n-300mbps-iwr-3000n
CVE: CVE-2025-57392
Published: 2025-09-10
Description: BenimPOS Masaustu 3.0.x is affected by insecure file permissions. The application installation directory grants Everyone and BUILTIN\Users groups FILE_ALL_ACCESS, allowing local users to replace or modify .exe and .dll files. This may lead to privilege escalation or arbitrary code execution upon launch by another user or elevated context.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://github.com/meisterlos/BenimPOS-POC; https://github.com/meisterlos/CVE-2025-57392
CVE: CVE-2025-8696
Published: 2025-09-10
Description: If an unauthenticated user sends a large amount of data to the Stork UI, it may cause memory and disk use problems for the system running the Stork server.
This issue affects Stork versions 1.0.0 through 2.3.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-779, CWE-789
References: https://kb.isc.org/docs/cve-2025-8696; http://www.openwall.com/lists/oss-security/2025/09/10/5
CVE: CVE-2025-10200
Published: 2025-09-10
Description: Use after free in Serviceworker in Google Chrome on Desktop prior to 140.0.7339.127 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_9.html; https://issues.chromium.org/issues/440454442
CVE: CVE-2025-10201
Published: 2025-09-10
Description: Inappropriate implementation in Mojo in Google Chrome on Android, Linux, ChromeOS prior to 140.0.7339.127 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-284, CWE-346
References: https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_9.html; https://issues.chromium.org/issues/439305148