deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-44018
Published: 2025-11-24
Description: A firmware downgrade vulnerability exists in the OTA Update functionality of GL-Inet GL-AXT1800 4.7.0. A specially crafted .tar file can lead to a firmware downgrade. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.
CVSS Score: 8.3 (HIGH)
CWE: CWE-295
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2230; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2230
CVE: CVE-2025-56401
Published: 2025-11-24
Description: ZIRA Group WBRM 7.0 is vulnerable to SQL Injection in referenceLookupsByTableNameAndColumnName.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: http://wbrm.com; https://mstreet97.github.io/security/cve/sqli/2025/07/25/Zira-WBRM-SQL-Injection-CVE-2025-56401.html
CVE: CVE-2025-56423
Published: 2025-11-24
Description: An issue in Austrian Academy of Sciences (AW) Austrian Archaeological Institute OpenAtlas v.8.12.0 allows a remote attacker to obtain sensitive information via the login error messages
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203
References: https://www.sec4you-pentest.com/schwachstelle/openatlas-schwachstelle-user-enumeration/; https://www.sec4you-pentest.com/schwachstellen/
CVE: CVE-2025-60632
Published: 2025-11-24
Description: An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via crafted POST request to the Npcf_BDTPolicyControl API.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-617
References: https://github.com/free5gc/free5gc; https://github.com/free5gc/free5gc/issues/705
CVE: CVE-2025-60633
Published: 2025-11-24
Description: An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via the Nudm_SubscriberDataManagement API.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1287
References: https://github.com/free5gc/free5gc; https://github.com/free5gc/free5gc/issues/700; https://github.com/free5gc/free5gc/issues/701
CVE: CVE-2025-60638
Published: 2025-11-24
Description: An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via crafted POST request to the Nnssf_NSSAIAvailability API.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/free5gc/free5gc; https://github.com/free5gc/free5gc/issues/704
CVE: CVE-2025-60914
Published: 2025-11-24
Description: Incorrect access control in Austrian Archaeological Institute Openatlas before v8.12.0 allows attackers to access sensitive information via sending a crafted GET request to the /display_logo endpoint.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://www.sec4you-pentest.com/schwachstelle/openatlas-unautorisierter-zugriff-display_logo/; https://www.sec4you-pentest.com/schwachstellen/
CVE: CVE-2025-60915
Published: 2025-11-24
Description: An issue in the size query parameter (/views/file.py) of Austrian Archaeological Institute Openatlas before v8.12.0 allows attackers to execute a path traversal via a crafted request.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22
References: https://www.sec4you-pentest.com/schwachstelle/openatlas-schwachstelle-lfi-konfigurationsdatei-exfiltration/; https://www.sec4you-pentest.com/schwachstellen/
CVE: CVE-2025-60916
Published: 2025-11-24
Description: A reflected cross-site scripting (XSS) vulnerability in the /overview/network/ endpoint of Austrian Archaeological Institute Openatlas before v8.12.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload into the charge parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.sec4you-pentest.com/schwachstelle/openatlas-schwachstelle-reflected-dom-based-xss-charge/; https://www.sec4you-pentest.com/schwachstellen/
CVE: CVE-2025-60917
Published: 2025-11-24
Description: A reflected cross-site scripting (XSS) vulnerability in the /overview/network/ endpoint of Austrian Archaeological Institute Openatlas before v8.12.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload into the color parameter.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://www.sec4you-pentest.com/schwachstelle/openatlas-schwachstelle-xss-in-farb-feldern-ort/; https://www.sec4you-pentest.com/schwachstellen/
CVE: CVE-2025-13511
Published: 2025-11-24
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2025-13594
Published: 2025-11-24
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2025-63432
Published: 2025-11-24
Description: Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is Missing SSL Certificate Validation. The application fails to properly validate the TLS certificate from its update server. An attacker on the same network can exploit this vulnerability by performing a Man-in-the-Middle (MITM) attack to intercept, decrypt, and modify traffic between the application and the update server. This serves as the basis for further attacks, including Remote Code Execution.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-599
References: https://github.com/ab3lson/cve-references/tree/master/CVE-2025-63432; https://www.nowsecure.com/blog/2025/07/16/remote-code-execution-discovered-in-xtool-anyscan-app-risks-to-phones-and-vehicles/
CVE: CVE-2025-63433
Published: 2025-11-24
Description: Xtooltech Xtool AnyScan Android Application 4.40.40 and prior uses a hardcoded cryptographic key and IV to decrypt update metadata. The key is stored as a static value within the application's code. An attacker with the ability to intercept network traffic can use this hardcoded key to decrypt, modify, and re-encrypt the update manifest, allowing them to direct the application to download a malicious update package.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-798
References: https://github.com/ab3lson/cve-references/tree/master/CVE-2025-63433; https://www.nowsecure.com/blog/2025/07/16/remote-code-execution-discovered-in-xtool-anyscan-app-risks-to-phones-and-vehicles/
CVE: CVE-2025-63434
Published: 2025-11-24
Description: The update mechanism in Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is insecure. The application downloads and extracts update packages containing executable code without performing a cryptographic integrity or authenticity check on their contents. An attacker who can control the update metadata can serve a malicious package, which the application will accept, extract, and later execute, leading to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-494
References: https://github.com/ab3lson/cve-references/tree/master/CVE-2025-63434; https://www.nowsecure.com/blog/2025/07/16/remote-code-execution-discovered-in-xtool-anyscan-app-risks-to-phones-and-vehicles/
CVE: CVE-2025-63435
Published: 2025-11-24
Description: Xtooltech Xtool AnyScan Android Application 4.40.40 is Missing Authentication for Critical Function. The server-side endpoint responsible for serving update packages for the application does not require any authentication. This allows an unauthenticated remote attacker to freely download official update packages..
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-306
References: https://github.com/ab3lson/cve-references/tree/master/CVE-2025-63435; https://www.nowsecure.com/blog/2025/07/16/remote-code-execution-discovered-in-xtool-anyscan-app-risks-to-phones-and-vehicles/
CVE: CVE-2025-63952
Published: 2025-11-24
Description: A Cross-Site Request Forgery (CSRF) in the /mwapi?method=add-user component of Magewell Pro Convert v1.2.213 allows attackers to arbitrarily create accounts via a crafted GET request.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-352
References: https://github.com/iyadalkhatib98/My_CVES/tree/main/CVE-2025-63952; https://www.magewell.com
CVE: CVE-2025-63953
Published: 2025-11-24
Description: A Cross-Site Request Forgery (CSRF) in the /usapi?method=add-user component of Magewell Pro Convert v1.2.213 allows attackers to arbitrarily create accounts via a crafted GET request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/iyadalkhatib98/My_CVES/tree/main/CVE-2025-63953; https://www.magewell.com
CVE: CVE-2025-63958
Published: 2025-11-24
Description: MILLENSYS Vision Tools Workspace 6.5.0.2585 exposes a sensitive configuration endpoint (/MILLENSYS/settings) that is accessible without authentication. This page leaks plaintext database credentials, file share paths, internal license server configuration, and software update parameters. An unauthenticated attacker can retrieve this information by accessing the endpoint directly, potentially leading to full system compromise. The vulnerability is due to missing access controls on a privileged administrative function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200, CWE-284, CWE-306
References: https://ozex.gitlab.io/tricks_hacks/2025-11-19-cve-2025-63958/index.html; https://www.millensys.com/
CVE: CVE-2025-13609
Published: 2025-11-24
Description: A vulnerability has been identified in keylime where an attacker can exploit this flaw by registering a new agent using a different Trusted Platform Module (TPM) device but claiming an existing agent's unique identifier (UUID). This action overwrites the legitimate agent's identity, enabling the attacker to impersonate the compromised agent and potentially bypass security controls.
CVSS Score: 8.2 (HIGH)
CWE: CWE-694
References: https://access.redhat.com/errata/RHSA-2025:23201; https://access.redhat.com/errata/RHSA-2025:23210; https://access.redhat.com/errata/RHSA-2025:23628
CVE: CVE-2025-13466
Published: 2025-11-24
Description: body-parser 2.2.0 is vulnerable to denial of service due to inefficient handling of URL-encoded bodies with very large numbers of parameters. An attacker can send payloads containing thousands of parameters within the default 100KB request size limit, causing elevated CPU and memory usage. This can lead to service slowdown or partial outages under sustained malicious traffic.
This issue is addressed in version 2.2.1.
CWE: CWE-400
References: https://github.com/expressjs/body-parser/security/advisories/GHSA-wqch-xfxh-vrr4
CVE: CVE-2025-36112
Published: 2025-11-24
Description: IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7 and 6.2.0.0 through 6.2.0.5 and 6.2.1.1 could reveal sensitive server IP configuration information to an unauthorized user.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-497
References: https://www.ibm.com/support/pages/node/7252197
CVE: CVE-2025-0005
Published: 2025-11-24
Description: Improper input validation within the XOCL driver may allow a local attacker to generate an integer overflow condition, potentially resulting in crash or denial of service.
CVSS Score: 7.3 (HIGH)
CWE: CWE-190
References: https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8014.html
CVE: CVE-2025-52539
Published: 2025-11-24
Description: A buffer overflow with Xilinx Run Time Environment may allow a local attacker to read or corrupt data from the advanced extensible interface (AXI), potentially resulting in loss of confidentiality, integrity, and/or availability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-121
References: https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8014.html
CVE: CVE-2025-56400
Published: 2025-11-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in the OAuth implementation of the Tuya SDK 6.5.0 for Android and iOS, affects the Tuya Smart and Smartlife mobile applications, as well as other third-party applications that integrate the SDK, allows an attacker to link their own Amazon Alexa account to a victim's Tuya account. The applications fail to validate the OAuth state parameter during the account linking flow, enabling a cross-site request forgery (CSRF)-like attack. By tricking the victim into clicking a crafted authorization link, an attacker can complete the OAuth flow on the victim's behalf, resulting in unauthorized Alexa access to the victim's Tuya-connected devices. This affects users regardless of prior Alexa linkage and does not require the Tuya application to be active at the time. Successful exploitation may allow remote control of devices such as cameras, doorbells, door locks, or alarms.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-384
References: http://tuya.com; https://src.tuya.com/announcement/30
CVE: CVE-2025-63914
Published: 2025-11-24
Description: An issue was discovered in Cinnamon kotaemon 0.11.0. The _may_extract_zip function in the \libs\ktem\ktem\index\file\ui.py file does not check the contents of uploaded ZIP files. Although the contents are extracted into a temporary folder that is cleared before each extraction, successfully uploading a ZIP bomb could still cause the server to consume excessive resources during decompression. Moreover, if no further files are uploaded afterward, the extracted data could occupy disk space and potentially render the system unavailable. Anyone with permission to upload files can carry out this attack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-409
References: https://github.com/Cinnamon/kotaemon; https://github.com/WxDou/CVE-2025-63914
CVE: CVE-2025-64047
Published: 2025-11-24
Description: OpenRapid RapidCMS 1.3.1 is vulnerable to Cross Site Scripting (XSS) in /user/user-move.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://rapidcms.com; https://gist.github.com/b1uel0n3/b105ad05dbcd3fe148a26e8180dddda7
CVE: CVE-2025-64048
Published: 2025-11-24
Description: YCCMS 3.4 contains a stored cross-site scripting (XSS) vulnerability in the article management functionality. The vulnerability exists in the add() and getPost() functions within the ArticleAction.class.php file due to improper neutralization of user input in the article title field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://yccms.com; https://gist.github.com/b1uel0n3/8354650e683ffb0812bfe72b702b482d
CVE: CVE-2018-25126
Published: 2025-11-24
Description: Shenzhen TVT Digital Technology Co., Ltd. NVMS-9000 firmware (used by many white-labeled DVR/NVR/IPC products) contains hardcoded API credentials and an OS command injection flaw in its configuration services. The web/API interface accepts HTTP/XML requests authenticated with a fixed vendor credential string and passes user-controlled fields into shell execution contexts without proper argument sanitization. An unauthenticated remote attacker can leverage the hard-coded credential to access endpoints such as /editBlackAndWhiteList and inject shell metacharacters inside XML parameters, resulting in arbitrary command execution as root. The same vulnerable backend is also reachable in some models through a proprietary TCP service on port 4567 that accepts a magic GUID preface and base64-encoded XML, enabling the same command injection sink. Firmware releases from mid-February 2018 and later are reported to have addressed this issue. Exploitation evidence was observed by the Shadowserver Foundation on 2025-01-28 UTC.
CWE: CWE-78, CWE-798
References: https://blogs.juniper.net/en-us/threat-research/iot-botnet-exploiting-tvt-shenzhen-dvrs-still-lingers; https://github.com/mcw0/PoC/blob/master/TVT_and_OEM_IPC_NVR_DVR_RCE_Backdoor_and_Information_Disclosure.txt; https://qkl.seebug.org/vuldb/ssvid-97217
CVE: CVE-2023-7330
Published: 2025-11-24
Description: Ruijie NBR series routers contain an unauthenticated arbitrary file upload vulnerability via /ddi/server/fileupload.php. The endpoint accepts attacker-supplied values in the name and uploadDir parameters and saves the provided multipart file content without adequate validation or sanitization of file type, path, or extension. A remote attacker can upload a crafted PHP file and then access it from the web root, resulting in arbitrary code execution in the context of the web service. Exploitation evidence was observed by the Shadowserver Foundation on 2025-01-14 UTC.
CWE: CWE-434
References: https://cn-sec.com/archives/1995366.html; https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/ruijie/ruijie-nbr-fileupload.yaml; https://rfk0z.github.io/posts/Ruijie-NBR-router-fileupload-php-arbitrary-file-upload-vulnerability/
CVE: CVE-2024-14007
Published: 2025-11-24
Description: Shenzhen TVT Digital Technology Co., Ltd. NVMS-9000 firmware (used by many white-labeled DVR/NVR/IPC products) versions prior to 1.3.4 contain an authentication bypass in the NVMS-9000 control protocol. By sending a single crafted TCP payload to an exposed NVMS-9000 control port, an unauthenticated remote attacker can invoke privileged administrative query commands without valid credentials. Successful exploitation discloses sensitive information including administrator usernames and passwords in cleartext, network and service configuration, and other device details via commands such as queryBasicCfg, queryUserList, queryEmailCfg, queryPPPoECfg, and queryFTPCfg.
CWE: CWE-306
References: https://ssd-disclosure.com/ssd-advisory-nvms9000-information-disclosure/; https://undercodetesting.com/eleven11-botnet-mirai-variant-targeting-nvms-9000-devices/; https://www.greynoise.io/blog/surge-exploitation-attempts-tvt-dvrs
CVE: CVE-2025-0003
Published: 2025-11-24
Description: Inadequate lock protection within Xilinx Run time may allow a local attacker to trigger a Use-After-Free condition potentially resulting in loss of confidentiality or availability
CVSS Score: 7.3 (HIGH)
CWE: CWE-413
References: https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8014.html
CVE: CVE-2025-0007
Published: 2025-11-24
Description: Insufficient validation within Xilinx Run Time framework could allow a local attacker to escalate privileges from user space to kernel space, potentially compromising confidentiality, integrity, and/or availability.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-710
References: https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8014.html
CVE: CVE-2025-29933
Published: 2025-11-24
Description: Improper input validation within AMD uProf can allow a local attacker to write out of bounds, potentially resulting in a crash or denial of service
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-9019.html
CVE: CVE-2025-36150
Published: 2025-11-24
Description: IBM Concert 1.0.0 through 2.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-327
References: https://www.ibm.com/support/pages/node/7252019
CVE: CVE-2025-48510
Published: 2025-11-24
Description: Improper return value within AMD uProf can allow a local attacker to bypass KSLR, potentially resulting in loss of confidentiality or availability.
CVSS Score: 7.1 (HIGH)
CWE: CWE-394
References: https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-9019.html
CVE: CVE-2025-48511
Published: 2025-11-24
Description: Improper input validation within AMD uprof can allow a local attacker to write to an arbitrary physical address, potentially resulting in crash or denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-1285
References: https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-9019.html
CVE: CVE-2025-52538
Published: 2025-11-24
Description: Improper input validation within the XOCL driver may allow a local attacker to generate an integer overflow condition, potentially resulting in loss of confidentiality or availability.
CVSS Score: 8.0 (HIGH)
CWE: CWE-190
References: https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8014.html
CVE: CVE-2025-63498
Published: 2025-11-24
Description: alinto SOGo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the "userName" parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Alinto/sogo/commit/9e20190fad1a437f7e1307f0adcfe19a8d45184c; https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.4; https://github.com/xryptoh/CVE-2025-63498
CVE: CVE-2024-47856
Published: 2025-11-24
Description: In RSA Authentication Agent before 7.4.7, service paths and shortcut paths may be vulnerable to path interception if the path has one or more spaces and is not surrounded by quotation marks. An adversary can place an executable in a higher-level directory of the path, and Windows will resolve that executable instead of the intended executable.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-23
References: https://community.rsa.com/s/article/RSA-2024-13-RSA-Authentication-Agent-for-Microsoft-Windows-Security-Update; https://community.rsa.com/s/product-download/a9G4u000000mCOYEAU/rsa-authentication-agent-747-for-microsoft-windows
CVE: CVE-2025-54338
Published: 2025-11-24
Description: An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows an attacker to disclose user hashes.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://desktopalert.net/cve-2025-54338/
CVE: CVE-2025-54341
Published: 2025-11-24
Description: A vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2. There are Hard-coded configuration values.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-798
References: https://desktopalert.net/cve-2025-54341/
CVE: CVE-2025-54347
Published: 2025-11-24
Description: A Directory Traversal vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows an attacker to write arbitrary files under certain conditions.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-22
References: https://desktopalert.net/cve-2025-54347/
CVE: CVE-2025-54563
Published: 2025-11-24
Description: An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows Incorrect Access Control, leading to Remote Information Disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://desktopalert.net/cve-2025-54563/
CVE: CVE-2025-63674
Published: 2025-11-24
Description: An issue in Blurams Lumi Security Camera (A31C) v23.[PII_REDACTED] allows local physical attackers to execute arbitrary code via overriding the bootloader on the SD card.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-77
References: http://a31c.com; http://blurams.com; https://vindivlabs.com/research/lumi_part_2/
CVE: CVE-2025-10144
Published: 2025-11-24
Description: The Perfect Brands for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the `brands` attribute of the `products` shortcode in all versions up to, and including, 3.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/perfect-woocommerce-brands/tags/3.6.0/lib/class-woocommerce.php#L112; https://www.wordfence.com/threat-intel/vulnerabilities/id/f4618bfd-77d9-4396-b041-d7ba0f6ec75a?source=cve
CVE: CVE-2025-62155
Published: 2025-11-25
Description: New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.9.6, a recently patched SSRF vulnerability contains a bypass method that can bypass the existing security fix and still allow SSRF to occur.
Because the existing fix only applies security restrictions to the first URL request, a 302 redirect can bypass existing security measures and successfully access the intranet. This issue has been patched in version 0.9.6.
CVSS Score: 8.5 (HIGH)
CWE: CWE-918
References: https://github.com/QuantumNous/new-api/security/advisories/GHSA-9f46-w24h-69w4