deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-5507
Published: 2025-06-03
Description: A vulnerability was found in TOTOLINK A3002RU 2.1.1-B20[PII_REDACTED]. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component MAC Filtering Page. The manipulation of the argument Comment leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/A3002RU_V2/XSS_Mac_filtering; https://vuldb.com/?ctiid.310921; https://vuldb.com/?id.310921
CVE: CVE-2025-5508
Published: 2025-06-03
Description: A vulnerability was found in TOTOLINK A3002RU 2.1.1-B20[PII_REDACTED]. It has been rated as problematic. Affected by this issue is some unknown functionality of the component IP Port Filtering Page. The manipulation of the argument Comment leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/A3002RU_V2/XSS_IP_Port_Filtering; https://vuldb.com/?ctiid.310922; https://vuldb.com/?id.310922
CVE: CVE-2025-5509
Published: 2025-06-03
Description: A vulnerability classified as critical has been found in quequnlong shiyi-blog up to 1.2.1. This affects an unknown part of the file /api/file/upload. The manipulation of the argument file/source leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/uglory-gll/javasec/blob/main/shiyi-blog.md; https://github.com/uglory-gll/javasec/blob/main/shiyi-blog.md#1file-path-traversal; https://vuldb.com/?ctiid.310923
CVE: CVE-2025-23107
Published: 2025-06-03
Description: An issue was discovered in Samsung Mobile Processor Exynos 1480 and 2400. The lack of a length check leads to out-of-bounds writes.
CVSS Score: 8.6 (HIGH)
CWE: CWE-787
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-23107/
CVE: CVE-2025-30167
Published: 2025-06-03
Description: Jupyter Core is a package for the core common functionality of Jupyter projects. When using Jupyter Core prior to version 5.8.0 on Windows, the shared `%PROGRAMDATA%` directory is searched for configuration files (`SYSTEM_CONFIG_PATH` and `SYSTEM_JUPYTER_PATH`), which may allow users to create configuration files affecting other users. Only shared Windows systems with multiple users and unprotected `%PROGRAMDATA%` are affected. Users should upgrade to Jupyter Core version 5.8.0 or later to receive a patch. Some other mitigations are available. As administrator, modify the permissions on the `%PROGRAMDATA%` directory so it is not writable by unauthorized users; or as administrator, create the `%PROGRAMDATA%\jupyter` directory with appropriately restrictive permissions; or as user or administrator, set the `%PROGRAMDATA%` environment variable to a directory with appropriately restrictive permissions (e.g. controlled by administrators _or_ the current user).
CVSS Score: 7.3 (HIGH)
CWE: CWE-427
References: https://github.com/jupyter/jupyter_core/commit/5e8965600adda6b416692ce7e85ecb2bd814bd52; https://github.com/jupyter/jupyter_core/security/advisories/GHSA-33p9-3p43-82vq
CVE: CVE-2025-32105
Published: 2025-06-03
Description: A buffer overflow in the the Sangoma IMG2020 HTTP server through 2.3.9.6 allows an unauthenticated user to achieve remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/austin2111/papers/blob/main/CVE-2025-32105_CVE-2025-32106_Technical_Report.pdf; https://github.com/austin2111/papers/blob/main/Software_Vulnerabilities_in_Telecommunications_Hardware.pdf
CVE: CVE-2025-32106
Published: 2025-06-03
Description: In Audiocodes Mediapack MP-11x through 6.60A.369.002, a crafted POST request request may result in an unauthenticated remote user's ability to execute unauthorized code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://Audiocodes.com; https://github.com/austin2111/papers/blob/main/CVE-2025-32105_CVE-2025-32106_Technical_Report.pdf; https://github.com/austin2111/papers/blob/main/Software_Vulnerabilities_in_Telecommunications_Hardware.pdf
CVE: CVE-2025-5510
Published: 2025-06-03
Description: A vulnerability classified as critical was found in quequnlong shiyi-blog up to 1.2.1. This vulnerability affects unknown code of the file /app/sys/article/optimize. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-918
References: https://github.com/uglory-gll/javasec/blob/main/shiyi-blog.md; https://github.com/uglory-gll/javasec/blob/main/shiyi-blog.md#2ssrf; https://vuldb.com/?ctiid.310924
CVE: CVE-2025-5511
Published: 2025-06-03
Description: A vulnerability, which was classified as critical, has been found in quequnlong shiyi-blog up to 1.2.1. This issue affects some unknown processing of the file /dev api/app/album/photos/. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-266, CWE-285
References: https://github.com/uglory-gll/javasec/blob/main/shiyi-blog.md; https://github.com/uglory-gll/javasec/blob/main/shiyi-blog.md#31bypass-password-verification-and-directly-view-photo-albums; https://vuldb.com/?ctiid.310925
CVE: CVE-2025-5512
Published: 2025-06-03
Description: A vulnerability, which was classified as critical, was found in quequnlong shiyi-blog up to 1.2.1. Affected is an unknown function of the file /api/sys/user/verifyPassword/ of the component Administrator Backend. The manipulation leads to improper authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-287
References: https://github.com/uglory-gll/javasec/blob/main/shiyi-blog.md; https://github.com/uglory-gll/javasec/blob/main/shiyi-blog.md#32attackers-can-bypass-screen-lock-to-access-the-backend; https://vuldb.com/?ctiid.310926
CVE: CVE-2025-30359
Published: 2025-06-03
Description: webpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior to version 5.2.1, webpack-dev-server users' source code may be stolen when they access a malicious web site. Because the request for classic script by a script tag is not subject to same origin policy, an attacker can inject a malicious script in their site and run the script. Note that the attacker has to know the port and the output entrypoint script path. Combined with prototype pollution, the attacker can get a reference to the webpack runtime variables. By using `Function::toString` against the values in `__webpack_modules__`, the attacker can get the source code. Version 5.2.1 contains a patch for the issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-749
References: https://github.com/webpack/webpack-dev-server/commit/d2575ad8dfed9207ed810b5ea0ccf465115a2239; https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-4v9v-hfq4-rm2v
CVE: CVE-2025-30360
Published: 2025-06-03
Description: webpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior to version 5.2.1, webpack-dev-server users' source code may be stolen when you access a malicious web site with non-Chromium based browser. The `Origin` header is checked to prevent Cross-site WebSocket hijacking from happening, which was reported by CVE-2018-14732. But webpack-dev-server always allows IP address `Origin` headers. This allows websites that are served on IP addresses to connect WebSocket. An attacker can obtain source code via a method similar to that used to exploit CVE-2018-14732. Version 5.2.1 contains a patch for the issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-346
References: https://github.com/webpack/webpack-dev-server/blob/55220a800ba4e30dbde2d98785ecf4c80b32f711/lib/Server.js#L3113-L3127; https://github.com/webpack/webpack-dev-server/commit/5c9378bb01276357d7af208a0856ca2163db188e; https://github.com/webpack/webpack-dev-server/commit/72efaab83381a0e1c4914adf401cbd210b7de7eb
CVE: CVE-2025-5513
Published: 2025-06-03
Description: A vulnerability has been found in quequnlong shiyi-blog up to 1.2.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /dev-api/api/comment/add. The manipulation of the argument content leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/uglory-gll/javasec/blob/main/shiyi-blog.md; https://github.com/uglory-gll/javasec/blob/main/shiyi-blog.md#4stored-cross-site-scripting; https://vuldb.com/?ctiid.310927
CVE: CVE-2025-5515
Published: 2025-06-03
Description: A vulnerability, which was classified as critical, has been found in TOTOLINK X2000R 1.0.0-B20[PII_REDACTED]. Affected by this issue is some unknown functionality of the file /boafrm/formMapDel. The manipulation of the argument devicemac1 leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77
References: https://github.com/fizz-is-on-the-way/Iot_vuls/blob/main/X2000R/RCE_formMapDel/RCE_formMapDel.md; https://vuldb.com/?ctiid.310952; https://vuldb.com/?id.310952
CVE: CVE-2025-5516
Published: 2025-06-03
Description: A vulnerability, which was classified as problematic, was found in TOTOLINK X2000R 1.0.0-B20[PII_REDACTED]. This affects an unknown part of the file /boafrm/formFilter of the component URL Filtering Page. The manipulation of the argument URL Address leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/X2000R/XSS_url_filtering; https://vuldb.com/?ctiid.310953; https://vuldb.com/?id.310953
CVE: CVE-2025-5520
Published: 2025-06-03
Description: A vulnerability was found in Open5GS up to 2.7.3. It has been classified as problematic. Affected is the function gmm_state_authentication/emm_state_authentication of the component AMF/MME. The manipulation leads to reachable assertion. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 9f5d133657850e[PII_REDACTED]514ee1364d37a884. It is recommended to apply a patch to fix this issue. This is a different issue than CVE-2025-1893.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-617
References: https://github.com/open5gs/open5gs/commit/9f5d133657850e[PII_REDACTED]514ee1364d37a884; https://github.com/open5gs/open5gs/issues/3910; https://github.com/open5gs/open5gs/issues/3910#issuecomment[PII_REDACTED]
CVE: CVE-2025-23102
Published: 2025-06-03
Description: An issue was discovered in Samsung Mobile Processor Exynos 980, 990, 1080, 2100, 1280, 2200, 1380, 1480 and 2400. A Double Free in the mobile processor leads to privilege escalation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-415
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-23102/
CVE: CVE-2025-48950
Published: 2025-06-03
Description: MaxKB is an open-source AI assistant for enterprise. Prior to version 1.10.8-lts, Sandbox only restricts the execution permissions of binary files in common directories, such as `/bin,/usr/bin`, etc. Therefore, attackers can exploit some files with execution permissions in non blacklisted directories to carry out attacks. Version 1.10.8-lts fixes the issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-276
References: https://github.com/1Panel-dev/MaxKB/commit/187e9c1e4ea1ebb6864c5bf61558c42f2fc6c005; https://github.com/1Panel-dev/MaxKB/pull/3127; https://github.com/1Panel-dev/MaxKB/releases/tag/v1.10.8-lts
CVE: CVE-2025-48953
Published: 2025-06-03
Description: Umbraco is an ASP.NET content management system (CMS). Starting in version 14.0.0 and prior to versions 15.4.2 and 16.0.0, it's possible to upload a file that doesn't adhere with the configured allowable file extensions via a manipulated API request. The issue is patched in versions 15.4.2 and 16.0.0. No known workarounds are available.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-434
References: https://github.com/umbraco/Umbraco-CMS/commit/d920e93d1ee29dc3301697e444f53e8cd5db3cf9; https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-fr6r-p8hv-x3c4
CVE: CVE-2025-48997
Published: 2025-06-03
Description: Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.1 allows an attacker to trigger a Denial of Service (DoS) by sending an upload file request with an empty string field name. This request causes an unhandled exception, leading to a crash of the process. Users should upgrade to `2.0.1` to receive a patch. No known workarounds are available.
CWE: CWE-248
References: https://github.com/expressjs/multer/commit/35a3272b611945155e046dd5cef[PII_REDACTED]e9; https://github.com/expressjs/multer/issues/1233; https://github.com/expressjs/multer/pull/1256
CVE: CVE-2025-48998
Published: 2025-06-03
Description: DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, a bypass of the patch for CVE-2025-27103 allows authenticated users to read and deserialize arbitrary files through the background JDBC connection. The vulnerability has been fixed in v2.10.10. No known workarounds are available.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-862
References: https://github.com/dataease/dataease/security/advisories/GHSA-2wfc-qwx7-w692; https://github.com/dataease/dataease/security/advisories/GHSA-v4gg-8rp3-ccjx; https://github.com/dataease/dataease/security/advisories/GHSA-2wfc-qwx7-w692
CVE: CVE-2025-5521
Published: 2025-06-03
Description: A vulnerability was found in WuKongOpenSource WukongCRM 9.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /system/user/updataPassword. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-862, CWE-352
References: https://github.com/Aiyakami/CVE-1/issues/6; https://vuldb.com/?ctiid.310957; https://vuldb.com/?id.310957
CVE: CVE-2025-5522
Published: 2025-06-03
Description: A vulnerability was found in jack0240 魏 bskms 蓝天幼儿园管理系统 up to dffe6640b5b54d8e29da6f060e0493fea74b3fad. It has been rated as critical. Affected by this issue is some unknown functionality of the file /sa/addUser of the component User Creation Handler. The manipulation leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
CVSS Score: 7.3 (HIGH)
CWE: CWE-266, CWE-285
References: https://gitee.com/jack0240/bskms/issues/ICAOOU; https://vuldb.com/?ctiid.310958; https://vuldb.com/?id.310958
CVE: CVE-2025-23097
Published: 2025-06-03
Description: An issue was discovered in Samsung Mobile Processor Exynos 1380. The lack of a length check leads to out-of-bounds writes.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-787
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-23097/
CVE: CVE-2025-23098
Published: 2025-06-03
Description: An issue was discovered in Samsung Mobile Processor Exynos 980, 990, 1080, 2100, 1280, 2200, 1380. A Use-After-Free in the mobile processor leads to privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-23098/
CVE: CVE-2025-23100
Published: 2025-06-03
Description: An issue was discovered in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400. The absence of a NULL check leads to a Denial of Service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-23100/
CVE: CVE-2025-35036
Published: 2025-06-03
Description: Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as of 6.2.0 and 7.0.0 no longer interpolates custom constraint violation messages with Expression Language and strongly recommends not allowing user-supplied input in constraint violation messages. CVE-2020-5245 and CVE-2025-4428 are examples of related, downstream vulnerabilities involving Expression Language intepolation of user-supplied data.
CVSS Score: 7.3 (HIGH)
CWE: CWE-94
References: https://docs.jboss.org/hibernate/stable/validator/reference/en-US/html_single/#section-hibernateconstraintvalidatorcontext; https://github.com/hibernate/hibernate-validator/commit/05f795bb7cf18856004f40e5042709e550ed0d6e; https://github.com/hibernate/hibernate-validator/commit/254858d9dcc4e7cd775d1b0f47f482218077c5e1
CVE: CVE-2025-5523
Published: 2025-06-03
Description: A vulnerability classified as problematic has been found in enilu web-flash 1.0. This affects the function fileService.upload of the file src/main/java/cn/enilu/flash/api/controller/FileController/upload of the component File Upload. The manipulation of the argument File leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://gitee.com/enilu/web-flash/issues/ICAXTM; https://vuldb.com/?ctiid.310959; https://vuldb.com/?id.310959
CVE: CVE-2025-5525
Published: 2025-06-03
Description: A vulnerability was found in Jrohy trojan up to 2.15.3. It has been declared as critical. This vulnerability affects the function LogChan of the file trojan/util/linux.go. The manipulation of the argument c leads to os command injection. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-77, CWE-78, CWE-78
References: https://github.com/Tritium0041/Jrohy-trojan-RCE-POC/blob/main/POC.py; https://github.com/ainrm/Jrohy-trojan-unauth-poc/blob/main/README.en.md; https://vuldb.com/?ctiid.310966
CVE: CVE-2025-48951
Published: 2025-06-03
Description: Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. Versions 8.0.0-BETA3 prior to 8.3.1 contain a vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data. Applications using the Auth0-PHP SDK are affected, as are applications using the Auth0/symfony, Auth0/laravel-auth0, or Auth0/wordpress SDKs, because those SDKsrely on the Auth0-PHP SDK versions from 8.0.0-BETA3 until 8.14.0. Version 8.3.1 contains a patch for the issue.
CWE: CWE-502
References: https://github.com/auth0/auth0-PHP/commit/04b1f5daa8bdfebc5e740ec5ca0fb2df1648a715; https://github.com/auth0/auth0-PHP/security/advisories/GHSA-v9m8-9xxp-q492; https://github.com/auth0/laravel-auth0/security/advisories/GHSA-c42h-56wx-h85q
CVE: CVE-2025-48999
Published: 2025-06-03
Description: DataEase is an open source business intelligence and data visualization tool. A bypass of CVE-2025-46566's patch exists in versions prior to 2.10.10. In a malicious payload, `getUrlType()` retrieves `hostName`. Since the judgment statement returns false, it will not enter the if statement and will not be filtered. The payload can be directly concatenated at the replace location to construct a malicious JDBC statement. Version 2.10.10 contains a patch for the issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284, CWE-923
References: https://github.com/dataease/dataease/commit/03b18db8a0fb7e9dc2c44f6d26d8c6221b7748c4; https://github.com/dataease/dataease/security/advisories/GHSA-6pq2-6q8x-mp2r; https://github.com/dataease/dataease/security/advisories/GHSA-6pq2-6q8x-mp2r
CVE: CVE-2025-49000
Published: 2025-06-03
Description: InvenTree is an Open Source Inventory Management System. Prior to version 0.17.13, the skip field in the built-in `label-sheet` plugin lacks an upper bound, so a large value forces the server to allocate an enormous Python list. This lets any authenticated label-printing user trigger a denial-of-service via memory exhaustion. the issue is fixed in versions 0.17.13 and higher. No workaround is available aside from upgrading to the patched version.
CVSS Score: 3.5 (LOW)
CWE: CWE-400, CWE-770
References: https://github.com/inventree/InvenTree/commit/0826a75ef6dde0ad96d680f52a9cf171ba2ce98b; https://github.com/inventree/InvenTree/releases/tag/0.17.13; https://github.com/inventree/InvenTree/security/advisories/GHSA-m2ch-h84r-p9r6
CVE: CVE-2025-49001
Published: 2025-06-03
Description: DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.10, secret verification does not take effect successfully, so a user can use any secret to forge a JWT token. The vulnerability has been fixed in v2.10.10. No known workarounds are available.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://github.com/dataease/dataease/security/advisories/GHSA-xx2m-gmwg-mf3r; https://github.com/dataease/dataease/security/advisories/GHSA-xx2m-gmwg-mf3r
CVE: CVE-2025-49002
Published: 2025-06-03
Description: DataEase is an open source business intelligence and data visualization tool. Versions prior to version 2.10.10 have a flaw in the patch for CVE-2025-32966 that allow the patch to be bypassed through case insensitivity because INIT and RUNSCRIPT are prohibited. The vulnerability has been fixed in v2.10.10. No known workarounds are available.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-290
References: https://github.com/dataease/dataease/security/advisories/GHSA-999m-jv2p-5h34; https://github.com/dataease/dataease/security/advisories/GHSA-h7hj-4j78-cvc7; https://github.com/dataease/dataease/security/advisories/GHSA-h7hj-4j78-cvc7