deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-11348
Published: 2025-10-07
Description: A vulnerability was determined in Campcodes Online Apartment Visitor Management System 1.0. This issue affects some unknown processing of the file /index.php. Executing a manipulation of the argument Username can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/arpcyber040/CVE/issues/3; https://vuldb.com/?ctiid.327233; https://vuldb.com/?id.327233
CVE: CVE-2025-11349
Published: 2025-10-07
Description: A vulnerability was identified in Campcodes Online Apartment Visitor Management System 1.0. Impacted is an unknown function of the file /search-visitor.php. The manipulation of the argument searchdata leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/arpcyber040/CVE/issues/4; https://vuldb.com/?ctiid.327234; https://vuldb.com/?id.327234
CVE: CVE-2025-11350
Published: 2025-10-07
Description: A security flaw has been discovered in Campcodes Online Apartment Visitor Management System 1.0. The affected element is an unknown function of the file /bwdates-reports-details.php. The manipulation of the argument fromdate/todate results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/arpcyber040/CVE/issues/5; https://vuldb.com/?ctiid.327235; https://vuldb.com/?id.327235
CVE: CVE-2025-11351
Published: 2025-10-07
Description: A weakness has been identified in code-projects Online Hotel Reservation System 1.0. The impacted element is an unknown function of the file /admin/editpicexec.php. This manipulation of the argument image causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://code-projects.org/; https://github.com/zhicat/C/issues/1; https://vuldb.com/?ctiid.327236
CVE: CVE-2025-11352
Published: 2025-10-07
Description: A security vulnerability has been detected in code-projects Online Hotel Reservation System 1.0. This affects an unknown function of the file /admin/addexec.php. Such manipulation of the argument image leads to unrestricted upload. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://code-projects.org/; https://github.com/zhicat/C/issues/29; https://vuldb.com/?ctiid.327237
CVE: CVE-2025-11362
Published: 2025-10-07
Description: Versions of the package pdfmake before 0.3.0-beta.17 are vulnerable to Allocation of Resources Without Limits or Throttling via repeatedly redirect URL in file embedding. An attacker can cause the application to crash or become unresponsive by providing crafted input that triggers this condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770, CWE-770
References: https://github.com/bpampuch/pdfmake/commit/741169634bf07730e010cd77477b6cc038e846ed; https://security.snyk.io/vuln/SNYK-JS-PDFMAKE-10223297
CVE: CVE-2025-10162
Published: 2025-10-07
Description: The Admin and Customer Messages After Order for WooCommerce: OrderConvo WordPress plugin before 14 does not validate the path of files to be downloaded, which could allow unauthenticated attacker to read/download arbitrary files via a path traversal attack
CVSS Score: 7.5 (HIGH)
References: https://wpscan.com/vulnerability/f878615d-955d-4365-87e0-6c928f548986/; https://wpscan.com/vulnerability/f878615d-955d-4365-87e0-6c928f548986/
CVE: CVE-2025-11353
Published: 2025-10-07
Description: A vulnerability was detected in code-projects Online Hotel Reservation System 1.0. This impacts an unknown function of the file /admin/addgalleryexec.php. Performing manipulation of the argument image results in unrestricted upload. The attack is possible to be carried out remotely. The exploit is now public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://code-projects.org/; https://github.com/zhicat/C/issues/30; https://vuldb.com/?ctiid.327238
CVE: CVE-2025-11354
Published: 2025-10-07
Description: A flaw has been found in code-projects Online Hotel Reservation System 1.0. Affected is an unknown function of the file /admin/addslideexec.php. Executing manipulation of the argument image can lead to unrestricted upload. The attack may be performed from remote. The exploit has been published and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://code-projects.org/; https://github.com/zhicat/C/issues/31; https://vuldb.com/?ctiid.327239
CVE: CVE-2025-11355
Published: 2025-10-07
Description: A vulnerability has been found in UTT 1250GW up to v2v3.2.2-200710. Affected by this vulnerability is the function strcpy of the file /goform/aspChangeChannel. The manipulation of the argument pvid leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/cymiao1978/cve/blob/main/10.md; https://github.com/cymiao1978/cve/blob/main/10.md#poc; https://vuldb.com/?ctiid.327240
CVE: CVE-2025-11356
Published: 2025-10-07
Description: A vulnerability was found in Tenda AC23 up to 16.03.07.52. Affected by this issue is the function sscanf of the file /goform/SetStaticRouteCfg. The manipulation of the argument list results in buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/cymiao1978/cve/blob/main/12.md; https://vuldb.com/?ctiid.327241; https://vuldb.com/?id.327241
CVE: CVE-2025-11357
Published: 2025-10-07
Description: A security flaw has been discovered in code-projects Simple Banking System 1.0. This issue affects some unknown processing of the file /createuser.php. Performing manipulation of the argument Name results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be exploited.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/QuJun1/cve/issues/1; https://vuldb.com/?ctiid.327244
CVE: CVE-2025-11358
Published: 2025-10-07
Description: A weakness has been identified in code-projects Simple Banking System 1.0. Impacted is an unknown function of the file /removeuser.php. Executing manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be exploited.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/QuJun1/cve/issues/2; https://vuldb.com/?ctiid.327245
CVE: CVE-2025-7400
Published: 2025-10-07
Description: The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a post's Featured Image custom fields in all versions up to, and including, 5.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was partially fixed in version 5.2.2.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3362830/featured-image-from-url; https://www.wordfence.com/threat-intel/vulnerabilities/id/a4eeaf05-ec86-4d99-bc00-81f7f99e88ce?source=cve
CVE: CVE-2025-10645
Published: 2025-10-07
Description: The WP Reset plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.05 via the WF_Licensing::log() method when debugging is enabled (default). This makes it possible for unauthenticated attackers to extract sensitive license key and site data.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-532
References: https://plugins.trac.wordpress.org/changeset/3364169/; https://research.cleantalk.org/cve-2025-10645/; https://www.wordfence.com/threat-intel/vulnerabilities/id/86741f4a-8700-45dd-8998-b3f0387c27ed?source=cve
CVE: CVE-2025-11359
Published: 2025-10-07
Description: A security vulnerability has been detected in code-projects Simple Banking System 1.0. The affected element is an unknown function of the file /transfermoney.php. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/ceeeeb-hao/cve/issues/1; https://vuldb.com/?ctiid.327246
CVE: CVE-2025-11360
Published: 2025-10-07
Description: A vulnerability was detected in jakowenko double-take up to 1.13.1. The impacted element is the function app.use of the file api/src/app.js of the component API. The manipulation of the argument X-Ingress-Path results in cross site scripting. The attack can be executed remotely. Upgrading to version 1.13.2 is sufficient to resolve this issue. The patch is identified as e11de9dd6b4ea6b7ec9a5607a920d48961e9fa50. The affected component should be upgraded.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://github.com/jakowenko/double-take/commit/e11de9dd6b4ea6b7ec9a5607a920d48961e9fa50; https://github.com/jakowenko/double-take/releases/tag/v1.13.2; https://vuldb.com/?ctiid.327247
CVE: CVE-2025-11385
Published: 2025-10-07
Description: A vulnerability has been found in Tenda AC20 up to 16.03.08.12. The affected element is the function sscanf of the file /goform/fast_setting_wifi_set. The manipulation of the argument timeZone leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/cymiao1978/cve/blob/main/11.md; https://github.com/cymiao1978/cve/blob/main/11.md#poc; https://vuldb.com/?ctiid.327312
CVE: CVE-2025-11386
Published: 2025-10-07
Description: A vulnerability was found in Tenda AC15 15.03.05.18. The impacted element is an unknown function of the file /goform/SetDDNSCfg of the component POST Parameter Handler. The manipulation of the argument ddnsEn results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/AC15/SetDDNSCfg.md; https://vuldb.com/?ctiid.327313; https://vuldb.com/?id.327313
CVE: CVE-2025-11387
Published: 2025-10-07
Description: A vulnerability was determined in Tenda AC15 15.03.05.18. This affects an unknown function of the file /goform/fast_setting_pppoe_set. This manipulation of the argument Password causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/AC15/fast_setting_pppoe_set.md; https://vuldb.com/?ctiid.327314; https://vuldb.com/?id.327314
CVE: CVE-2025-11388
Published: 2025-10-07
Description: A vulnerability was identified in Tenda AC15 15.03.05.18. This impacts an unknown function of the file /goform/setNotUpgrade. Such manipulation of the argument newVersion leads to stack-based buffer overflow. The attack may be launched remotely. The exploit is publicly available and might be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/AC15/setNotUpgrade.md; https://vuldb.com/?ctiid.327315; https://vuldb.com/?id.327315
CVE: CVE-2025-0603
Published: 2025-10-07
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Callvision Healthcare Callvision Emergency Code allows SQL Injection, Blind SQL Injection.This issue affects Callvision Emergency Code: before V3.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-25-0320
CVE: CVE-2025-11389
Published: 2025-10-07
Description: A security flaw has been discovered in Tenda AC15 15.03.05.18. Affected is an unknown function of the file /goform/saveAutoQos. Performing a manipulation of the argument enable results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/AC15/saveAutoQos.md; https://vuldb.com/?ctiid.327316; https://vuldb.com/?id.327316
CVE: CVE-2025-11390
Published: 2025-10-07
Description: A weakness has been identified in PHPGurukul Cyber Cafe Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /search.php of the component POST Parameter Handler. Executing a manipulation of the argument searchdata can lead to cross site scripting. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/QIU-DIE/CVE/issues/4; https://phpgurukul.com/; https://vuldb.com/?ctiid.327317
CVE: CVE-2025-11396
Published: 2025-10-07
Description: A vulnerability was identified in code-projects Simple Food Ordering System 1.0. Impacted is an unknown function of the file /product.php. Such manipulation of the argument Category leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/tiancesec/CVE/issues/6; https://vuldb.com/?ctiid.327333
CVE: CVE-2025-3718
Published: 2025-10-07
Description: A client-side path traversal vulnerability was discovered in the web management interface front-end due to missing validation of an input parameter. An authenticated user with limited privileges can craft a malicious URL which, if visited by an authenticated victim, leads to a Cross-Site Scripting (XSS) attack.
CVSS Score: 7.9 (HIGH)
CWE: CWE-22
References: https://security.nozominetworks.com/NN-2025:4-01
CVE: CVE-2025-3719
Published: 2025-10-07
Description: An access control vulnerability was discovered in the CLI functionality due to a specific access restriction not being properly enforced for users with limited privileges. An authenticated user with limited privileges can issue administrative CLI commands, altering the device configuration, and/or affecting its availability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-863
References: https://security.nozominetworks.com/NN-2025:5-01
CVE: CVE-2025-40649
Published: 2025-10-07
Description: Stored Cross-Site Scripting (XSS) in Biobanking and Biomolecular Resources Negotiator v3.15.2 - European Research Infrastructure (BBMRI-ERIC), consisting of a stored XSS due to a lack of proper validation of user input by sending a POST request using parameter text in '/api/v3/negotiations/<postUID>/posts'. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their cookie session details.
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-bbmri-eric-negotiator
CVE: CVE-2025-40676
Published: 2025-10-07
Description: Insecure Direct Object Reference (IDOR) in Negotiator v3.15.2 from Biobanking and Biomolecular Resources - European Research Infrastructure (BBMRI-ERIC). This vulnerability allows an attacker to access or modify unauthorised resources by manipulating requests that use the 'userID' parameter in '/api/v3/users/<userID>', which may result in the exposure or alteration of sensitive data
CWE: CWE-639
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-bbmri-eric-negotiator
CVE: CVE-2025-40885
Published: 2025-10-07
Description: A SQL Injection vulnerability was discovered in the Smart Polling functionality due to improper validation of an input parameter. An authenticated user with limited privileges can execute arbitrary SELECT SQL statements on the DBMS used by the web application, potentially exposing unauthorized data.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-89
References: https://security.nozominetworks.com/NN-2025:6-01
CVE: CVE-2025-40886
Published: 2025-10-07
Description: A SQL Injection vulnerability was discovered in the Alert functionality due to improper validation of an input parameter. An authenticated user with limited privileges can execute arbitrary SQL statements on the DBMS used by the web application, potentially exposing unauthorized data, altering their structure and content, and/or affecting their availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://security.nozominetworks.com/NN-2025:7-01
CVE: CVE-2025-40887
Published: 2025-10-07
Description: A SQL Injection vulnerability was discovered in the Alert functionality due to improper validation of an input parameter. An authenticated user with limited privileges can execute arbitrary SELECT SQL statements on the DBMS used by the web application, potentially exposing unauthorized data.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-89
References: https://security.nozominetworks.com/NN-2025:8-01
CVE: CVE-2025-40888
Published: 2025-10-07
Description: A SQL Injection vulnerability was discovered in the CLI functionality due to improper validation of an input parameter. An authenticated user with limited privileges can execute arbitrary SELECT SQL statements on the DBMS used by the web application, potentially exposing unauthorized data.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-89
References: https://security.nozominetworks.com/NN-2025:10-01
CVE: CVE-2025-40889
Published: 2025-10-07
Description: A path traversal vulnerability was discovered in the Time Machine functionality due to missing validation of two input parameters. An authenticated user with limited privileges, by issuing a specifically-crafted request, can potentially alter the structure and content of files in the /data folder, and/or affect their availability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22
References: https://security.nozominetworks.com/NN-2025:9-01
CVE: CVE-2021-22291
Published: 2025-10-07
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ABB EIBPORT V3 KNX, ABB EIBPORT V3 KNX GSM.This issue affects EIBPORT V3 KNX: before 3.9.2; EIBPORT V3 KNX GSM: before 3.9.2.
CVSS Score: 8.0 (HIGH)
CWE: CWE-79
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108471A7808&LanguageCode=en&DocumentPartId=pdf&Action=Launch
CVE: CVE-2025-11397
Published: 2025-10-07
Description: A security flaw has been discovered in SourceCodester Hotel and Lodge Management System 1.0. The affected element is an unknown function of the file /login.php. Performing manipulation of the argument email results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be exploited.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/TThuyyy/cve1/issues/5; https://vuldb.com/?ctiid.327334; https://vuldb.com/?id.327334
CVE: CVE-2025-25009
Published: 2025-10-07
Description: Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://discuss.elastic.co/t/kibana-8-18-8-8-19-5-9-0-8-and-9-1-5-security-update-esa-2025-20/382449
CVE: CVE-2025-37728
Published: 2025-10-07
Description: Insufficiently Protected Credentials in the Crowdstrike connector can lead to Crowdstrike credentials being leaked. A malicious user can access cached credentials from a Crowdstrike connector in another space by creating and running a Crowdstrike connector in a space to which they have access.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-522
References: https://discuss.elastic.co/t/kibana-crowdstrike-connector-8-18-8-8-19-5-9-0-8-and-9-1-5-security-update-esa-2025-19/382455; https://discuss.elastic.co/t/kibana-crowdstrike-connector-8-18-8-8-19-5-9-0-8-and-9-1-5-security-update-esa-2025-19/382455
CVE: CVE-2025-48826
Published: 2025-10-07
Description: A format string vulnerability exists in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. A specially crafted series of HTTP requests can lead to memory corruption. An attacker can send a series of HTTP requests to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-134
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2228; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2228
CVE: CVE-2025-50505
Published: 2025-10-07
Description: Clash Verge Rev thru 2.2.3 (fixed in 2.3.0) forces the installation of system services(clash-verge-service) by default and exposes key functions through the unauthorized HTTP API `/start_clash`, allowing local users to submit arbitrary bin_path parameters and pass them directly to the service process for execution, resulting in local privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-250
References: https://github.com/bron1e/CVE-2025-50505; https://github.com/cisagov/vulnrichment/issues/206; https://github.com/clash-verge-rev/clash-verge-rev
CVE: CVE-2025-53476
Published: 2025-10-07
Description: A denial of service vulnerability exists in the ModbusTCP server functionality of OpenPLC _v3 a931181e8b81e36fadf7b74d5cba99b73c3f6d58. A specially crafted series of network connections can lead to the server not processing subsequent Modbus requests. An attacker can open a series of TCP connections to trigger this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-775
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2223; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2223
CVE: CVE-2025-54399
Published: 2025-10-07
Description: Multiple stack-based buffer overflow vulnerabilities exist in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. A specially crafted series of HTTP requests can lead to stack-based buffer overflow. An attacker can send a series of HTTP requests to trigger these vulnerabilities.This buffer overflow is related to the `ipaddr` request parameter for composing the `"ping -c <counts> <ipaddr> 2>&1 > %s &"` string.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2226; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2226
CVE: CVE-2025-54400
Published: 2025-10-07
Description: Multiple stack-based buffer overflow vulnerabilities exist in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. A specially crafted series of HTTP requests can lead to stack-based buffer overflow. An attacker can send a series of HTTP requests to trigger these vulnerabilities.This buffer overflow is related to the `counts` request parameter for composing the `"ping -c <counts> <ipaddr> 2>&1 > %s &"` string.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2226; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2226
CVE: CVE-2025-54401
Published: 2025-10-07
Description: Multiple stack-based buffer overflow vulnerabilities exist in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. A specially crafted series of HTTP requests can lead to stack-based buffer overflow. An attacker can send a series of HTTP requests to trigger these vulnerabilities.This buffer overflow is related to the `submit-url` request parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2226; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2226