deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-63713
Published: 2025-11-07
Description: Cross-Site Scripting (XSS) vulnerability in SourceCodester "MatchMaster" 1.0 allows remote attackers to inject arbitrary web script or HTML via crafted input in the custom test creation feature. The vulnerability exists because the application fails to properly sanitize user-supplied input in test titles and matching pair items before rendering them in the DOM during test execution.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/floccocam-cpu/CVE-Research-2025/blob/main/CVE-2025-63713/README7.md; https://www.sourcecodester.com/javascript/18431/matching-type-test-using-html-css-and-javascript-source-code.html
CVE: CVE-2025-63714
Published: 2025-11-07
Description: Cross-Site Scripting (XSS) vulnerability in SourceCodester User Account Generator 1.0 allows remote attackers to execute arbitrary JavaScript code in the context of the user's browser session via crafted input in the Username Prefix field. The vulnerability exists due to improper sanitization of user-supplied input when rendering generated account data to the DOM, allowing persistent injection of malicious HTML elements that execute when clicked by users.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/floccocam-cpu/CVE-Research-2025/blob/main/CVE-2025-63714/README10.md; https://www.sourcecodester.com/javascript/18430/modern-user-account-generator-using-html-css-and-javascript-source-code.html
CVE: CVE-2025-63716
Published: 2025-11-07
Description: The SourceCodester Leads Manager Tool v1.0 is vulnerable to Cross-Site Request Forgery (CSRF) attacks that allow unauthorized state-changing operations. The application lacks CSRF protection mechanisms such as anti-CSRF tokens or same-origin verification for critical endpoints.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/floccocam-cpu/CVE-Research-2025/blob/main/CVE-2025-63716/README5.md; https://www.sourcecodester.com/php/17510/leads-manager-tool-using-php-and-mysql-source-code.html
CVE: CVE-2025-63718
Published: 2025-11-07
Description: A SQL injection vulnerability exists in the SourceCodester PQMS (Patient Queue Management System) 1.0 in the api_patient_schedule.php endpoint. The appointmentID parameter is not properly sanitized, allowing attackers to execute arbitrary SQL commands.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/floccocam-cpu/CVE-Research-2025/blob/main/CVE-2025-63718/README8.md; https://www.sourcecodester.com/php/18348/patients-waiting-area-queue-management-system.html
CVE: CVE-2025-64347
Published: 2025-11-07
Description: Apollo Router Core is a configurable Rust graph router written to run a federated supergraph using Apollo Federation 2. Versions 1.61.12-rc.0 and below and 2.8.1-rc.0 allow unauthorized access to protected data through schema elements with access control directives (@authenticated, @requiresScopes, and @policy) that were renamed via @link imports. Router did not enforce renamed access control directives on schema elements (e.g. fields and types), allowing queries to bypass those element-level access controls. This issue is fixed in versions 1.61.12 and 2.8.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://github.com/apollographql/router/commit/78e4b20a2fc26cc5f141aa47992ed85375266a2b; https://github.com/apollographql/router/security/advisories/GHSA-g8jh-vg5j-4h3f
CVE: CVE-2025-64430
Published: 2025-11-07
Description: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions 4.2.0 through 7.5.3, and 8.0.0 through 8.3.1-alpha.1, there is a Server-Side Request Forgery (SSRF) vulnerability in the file upload functionality when trying to upload a Parse.File with uri parameter, allowing execution of an arbitrary URI. The vulnerability stems from a file upload feature in which Parse Server retrieves the file data from a URI that is provided in the request. A request to the provided URI is executed, but the response is not stored in Parse Server's file storage as the server crashes upon receiving the response. This issue is fixed in versions 7.5.4 and 8.4.0-alpha.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://github.com/parse-community/parse-server/commit/8bbe3efbcf4a3b66f4a8db9bfb18cd98c050db51; https://github.com/parse-community/parse-server/commit/97763863b72689a29ad7a311dfb590c3e3c50585; https://github.com/parse-community/parse-server/pull/9903
CVE: CVE-2025-9458
Published: 2025-11-07
Description: A maliciously crafted PRT file, when parsed through certain Autodesk products, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://www.autodesk.com/products/autodesk-access/overview; https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0019
CVE: CVE-2024-47118
Published: 2025-11-07
Description: IBM Db2 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121
References: https://www.ibm.com/support/pages/node/7250473
CVE: CVE-2025-12890
Published: 2025-11-07
Description: Improper handling of  malformed Connection Request with the interval set to be 1 (which supposed to be illegal) and the chM 0x7CFFFFFFFF triggers a crash. The peripheral will not be connectable after it.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-703
References: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-8hrf-pfww-83v9
CVE: CVE-2025-2534
Published: 2025-11-07
Description: IBM Db2 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-789
References: https://www.ibm.com/support/pages/node/7250472
CVE: CVE-2025-33012
Published: 2025-11-07
Description: IBM Db2 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux could allow an authenticated user to regain access after account lockout due to password use after expiration date.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-324
References: https://www.ibm.com/support/pages/node/7250469
CVE: CVE-2025-36006
Published: 2025-11-07
Description: IBM Db2 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a denial due to the improper release of resources after use.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-404
References: https://www.ibm.com/support/pages/node/7250479
CVE: CVE-2025-36008
Published: 2025-11-07
Description: IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a denial of service due to improper allocation of resources.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://www.ibm.com/support/pages/node/7250482
CVE: CVE-2025-36131
Published: 2025-11-07
Description: IBM Db2 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) clpplus command exposes user credentials to the terminal which could be obtained by a third party with physical access to the system.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-359
References: https://www.ibm.com/support/pages/node/7250484
CVE: CVE-2025-36135
Published: 2025-11-07
Description: IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.7_1, 6.2.0.0 through 6.2.0.5, and 6.2.1.0 and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7_1, 6.2.0.0 through 6.2.0.5, and 6.2.1.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.ibm.com/support/pages/node/7250509
CVE: CVE-2025-36136
Published: 2025-11-07
Description: IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local user to cause a denial of service due to the database monitor script incorrectly detecting that the instance is still starting under specific conditions.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-770
References: https://www.ibm.com/support/pages/node/7250485
CVE: CVE-2025-36185
Published: 2025-11-07
Description: IBM Db2 12.1.0 through 12.1.2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a local user to cause a denial of service due to improper neutralization of special elements in data query logic.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-943
References: https://www.ibm.com/support/pages/node/7250487
CVE: CVE-2025-36186
Published: 2025-11-07
Description: IBM Db2 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) under specific configurations could allow a local user to execute malicious code that escalate their privileges to root due to execution of unnecessary privileges operated at a higher than minimum level.
CVSS Score: 7.4 (HIGH)
CWE: CWE-250
References: https://www.ibm.com/support/pages/node/7250486
CVE: CVE-2025-61261
Published: 2025-11-07
Description: A reflected cross-site scripting (XSS) vulnerability in CKeditor v46.1.0 & Angular v18.0.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/ckeditor/ckeditor5/releases/tag/v46.1.0; https://senscybersecurity.nl/cve-2025-61261-explained/
CVE: CVE-2025-63717
Published: 2025-11-07
Description: The change password functionality at /pet_grooming/admin/change_pass.php in SourceCodester Pet Grooming Management Software 1.0 is vulnerable to Cross-Site Request Forgery (CSRF) attacks. The application does not implement adequate anti-CSRF tokens or same-site cookie restrictions, allowing attackers to trick authenticated users into unknowingly changing their passwords.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/floccocam-cpu/CVE-Research-2025/blob/main/CVE-2025-63717/README6.md; https://www.sourcecodester.com/php/18340/pet-grooming-management-software-download.html
CVE: CVE-2025-64431
Published: 2025-11-07
Description: Zitadel is an open source identity management platform. Versions 4.0.0-rc.1 through 4.6.2 are vulnerable to secure Direct Object Reference (IDOR) attacks through its V2Beta API, allowing authenticated users with specific administrator roles within one organization to access and modify data belonging to other organizations. Note that this vulnerability is limited to organization-level data (name, domains, metadata). No other related data (such as users, projects, applications, etc.) is affected. This issue is fixed in version 4.6.3.
CWE: CWE-639
References: https://github.com/zitadel/zitadel/commit/8dcfff97ed52a8b9fc77ecb1f972744f42cff3ed; https://github.com/zitadel/zitadel/releases/tag/v4.6.3; https://github.com/zitadel/zitadel/security/advisories/GHSA-cpf4-pmr4-w6cx
CVE: CVE-2025-64432
Published: 2025-11-07
Description: KubeVirt is a virtual machine management add-on for Kubernetes. Versions 1.5.3 and below, and 1.6.0 contained a flawed implementation of the Kubernetes aggregation layer's authentication flow which could enable bypass of RBAC controls. It was discovered that the virt-api component fails to correctly authenticate the client when receiving API requests over mTLS. In particular, it fails to validate the CN (Common Name) field in the received client TLS certificates against the set of allowed values defined in the extension-apiserver-authentication configmap. Failre to validate certain fields in the client TLS certificate may allow an attacker to bypass existing RBAC controls by directly communicating with the aggregated API server, impersonating the Kubernetes API server and its aggregator component. This issue is fixed in versions 1.5.3 and 1.6.1.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-287, CWE-295
References: https://github.com/kubevirt/kubevirt/commit/231dc69723f331dc02f65a31ab4c3d6869f40d6a; https://github.com/kubevirt/kubevirt/commit/af2f08a9a186eccc650f87c30ab3e07b669e8b5b; https://github.com/kubevirt/kubevirt/commit/b9773bc588e6e18ece896a2dad5336ef7a653074
CVE: CVE-2025-7700
Published: 2025-11-07
Description: A flaw was found in FFmpeg’s ALS audio decoder, where it does not properly check for memory allocation failures. This can cause the application to crash when processing certain malformed audio files. While it does not lead to data theft or system control, it can be used to disrupt services and cause a denial of service.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-476
References: https://access.redhat.com/security/cve/CVE-2025-7700; https://bugzilla.redhat.com/show_bug.cgi?id=2380420; https://github.com/FFmpeg/FFmpeg/commit/35a6de137a39f274d5e01ed0e0e6c4f04d0aaf07
CVE: CVE-2025-10230
Published: 2025-11-07
Description: A flaw was found in Samba, in the front-end WINS hook handling: NetBIOS names from registration packets are passed to a shell without proper validation or escaping. Unsanitized NetBIOS name data from WINS registration packets are inserted into a shell command and executed by the Samba Active Directory Domain Controller’s wins hook, allowing an unauthenticated network attacker to achieve remote command execution as the Samba process.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-78
References: https://access.redhat.com/security/cve/CVE-2025-10230; https://bugzilla.redhat.com/show_bug.cgi?id=2394377; https://www.samba.org/samba/history/security.html
CVE: CVE-2025-63638
Published: 2025-11-07
Description: Sourcecodester AI-Powered To-Do List App v1.0 is vulnerable to Cross-Site Scripting (XSS) in the "Task Title" and "Description (Optional)" fields when creating a Task, allowing an attacker to inject arbitrary potentially malicious HTML/JavaScript code that executes in the victim's browser upon clicking the "Add Task" button.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ChuckBartowski7/Vulnerability-Research/tree/main/CVE-2025-63638; https://www.sourcecodester.com/javascript/18421/ai-powered-do-list-app-using-html-css-and-javascript-source-code.html
CVE: CVE-2025-63639
Published: 2025-11-07
Description: The chat feature in the application Sourcecodester FAQ Bot with AI Assistant v1.0 is vulnerable to Cross-Site Scripting (XSS) due to improper handling of user-supplied input. An attacker can inject malicious HTML or JavaScript into chat messages, which executes in the browser of any user viewing the conversation.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ChuckBartowski7/Vulnerability-Research/blob/main/CVE-2025-63639/README.md; https://www.sourcecodester.com/javascript/18413/faq-bot-ai-assistant-using-html-css-and-javascript-source-code.html
CVE: CVE-2025-63640
Published: 2025-11-07
Description: Sourcecodester Medicine Reminder App v1.0 is vulnerable to Cross-Site Scripting (XSS) in the "Medicine Name" and "Notes (Optional)" fields when creating an "Upcoming Reminder", allowing an attacker to inject arbitrary potentially malicious HTML/JavaScript code that executes in the victim's browser upon clicking the "Save Reminder" button.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ChuckBartowski7/Vulnerability-Research/blob/main/CVE-2025-63640/README.md; https://www.sourcecodester.com/javascript/18402/medicine-reminder-app-using-html-css-and-javascript-source-code.html
CVE: CVE-2025-12863
Published: 2025-11-07
Description: Rejected reason: This CVE was assigned for a libxml2 issue#1012 but later deemed not valid. Ref.: https://gitlab.gnome.org/GNOME/libxml2/-/issues/1012#note_2608283
CVE: CVE-2025-12875
Published: 2025-11-07
Description: A weakness has been identified in mruby 3.4.0. This vulnerability affects the function ary_fill_exec of the file mrbgems/mruby-array-ext/src/array.c. Executing a manipulation of the argument start/length can lead to out-of-bounds write. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. This patch is called 93619f06dd378db6766666b30c08978311c7ec94. It is best practice to apply a patch to resolve this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-787, CWE-787
References: https://github.com/makesoftwaresafe/mruby/commit/93619f06dd378db6766666b30c08978311c7ec94; https://github.com/mruby/mruby/; https://github.com/mruby/mruby/issues/6650
CVE: CVE-2025-12896
Published: 2025-11-07
Description: Improper resource management in firmware of some Solidigm DC Products may allow an attacker with local or physical access to gain un-authorized access to a locked storage device.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-307
References: https://www.solidigm.com/support-page/support-security.html
CVE: CVE-2025-12902
Published: 2025-11-07
Description: Improper resource management in firmware of some Solidigm DC Products may allow an attacker with local or physical access to gain un-authorized access to a locked Storage Device or create a Denial of Service.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-665
References: https://www.solidigm.com/support-page/support-security.html
CVE: CVE-2025-63543
Published: 2025-11-07
Description: TechStore 1.0 is vulnerable to Cross Site Scripting (XSS) in the /search_results endpoint via the q parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/LuigiGrimaldi/5e9e66b12973bddd35f933a6d0cd2730
CVE: CVE-2025-63544
Published: 2025-11-07
Description: TechStore 1.0 is vulnerable to Cross Site Scripting (XSS) in /order_notes via the id parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/LuigiGrimaldi/5e9e66b12973bddd35f933a6d0cd2730
CVE: CVE-2025-64439
Published: 2025-11-07
Description: LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). In versions 2.1.2 and below, the JsonPlusSerializer (used as the default serialization protocol for all checkpointing) contains a Remote Code Execution (RCE) vulnerability when deserializing payloads saved in the "json" serialization mode. By default, the serializer attempts to use "msgpack" for serialization. However, prior to version 3.0 of the checkpointer library, if illegal Unicode surrogate values caused serialization to fail, it would fall back to using the "json" mode. This issue is fixed in version 3.0.0.
CWE: CWE-502
References: https://github.com/langchain-ai/langgraph/blob/c5744f583b11745cd406f3059903e17bbcdcc8ac/libs/checkpoint/langgraph/checkpoint/serde/jsonplus.py; https://github.com/langchain-ai/langgraph/commit/c5744f583b11745cd406f3059903e17bbcdcc8ac; https://github.com/langchain-ai/langgraph/releases/tag/checkpoint%3D%3D3.0.0
CVE: CVE-2025-64442
Published: 2025-11-07
Description: HumHub is an Open Source Enterprise Social Network. Versions below 1.17.4 have a XSS vulnerability in the Meta-Search feature which allows malicious input to be executed in search previews. This issue is fixed in version 1.17.4.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/humhub/humhub/pull/7814; https://github.com/humhub/humhub/releases/tag/v1.17.4; https://github.com/humhub/humhub/security/advisories/GHSA-2hgp-33j2-93cc
CVE: CVE-2025-64481
Published: 2025-11-07
Description: Datasette is an open source multi-tool for exploring and publishing data. In versions 0.65.1 and below and 1.0a0 through 1.0a19, deployed instances of Datasette include an open redirect vulnerability. Hits to the path //example.com/foo/bar/ (the trailing slash is required) will redirect the user to https://example.com/foo/bar. This problem has been patched in both Datasette 0.65.2 and 1.0a21. To workaround this issue, if Datasette is running behind a proxy, that proxy could be configured to replace // with / in incoming request URLs.
CWE: CWE-601
References: https://github.com/simonw/datasette/commit/f257ca6edb64848c3b04b54d41e347c54fe57c05; https://github.com/simonw/datasette/issues/2429; https://github.com/simonw/datasette/security/advisories/GHSA-w832-gg5g-x44m
CVE: CVE-2020-36870
Published: 2025-11-07
Description: Various Ruijie Gateway EG and NBR models firmware versions 11.1(6)B9P1 < 11.9(4)B12P1 contain a code execution vulnerability in the EWEB management system that can be abused via front-end functionality. Attackers can exploit front-end code when features such as guest authentication, local server authentication, or screen mirroring are enabled to gain access or execute commands on affected devices. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-02-05 UTC.
CWE: CWE-94
References: https://www.cnvd.org.cn/flaw/show/CNVD-2021-09650; https://www.ruijie.com.cn/gy/xw-aqtg-gw/86747/; https://www.ruijie.com.cn/gy/xw-aqtg-zw/85638/
CVE: CVE-2025-12418
Published: 2025-11-07
Description: Potential Denial of Service issue in all supported versions of Revenera InstallShield version 2025 R1, 2024 R2, 2023 R2, and prior. When e.g., a local administrator performs an uninstall, a symlink may get followed on removal of a user writeable configuration directory and induce a Denial of Service as a result. The issue is resolved through the hotfixes InstallShield2025R1-CVE-2025-12418-SecurityPatch, InstallShield2024R2-CVE-2025-12418-SecurityPatch, and InstallShield2023R2-CVE-2025-12418-SecurityPatch.
CWE: CWE-59
References: https://community.revenera.com/s/article/CVE-2025-12418-Potential-Unintended-File-Deletion-Issue-Caused-by-InstallShield-Suite-Uninstallation-Process
CVE: CVE-2025-60574
Published: 2025-11-07
Description: A Local File Inclusion (LFI) vulnerability has been identified in tQuadra CMS 4.2.1117. The issue exists in the "/styles/" path, which fails to properly sanitize user-supplied input. An attacker can exploit this by sending a crafted GET request to retrieve arbitrary files from the underlying system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-98
References: https://github.com/jacopoaugelli/CVE-2025-60574
CVE: CVE-2025-63420
Published: 2025-11-07
Description: CrushFTP11 before 11.3.7_57 is vulnerable to stored HTML injection in the CrushFTP Admin Panel (Reports / "Who Created Folder"), enabling persistent HTML execution in admin sessions.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/MMAKINGDOM/791d264c27656f0a4aa3c0ae35075e70; https://github.com/MMAKINGDOM/CVE-2025-63420/
CVE: CVE-2025-37736
Published: 2025-11-07
Description: Improper Authorization in Elastic Cloud Enterprise can lead to Privilege Escalation where the built-in readonly user can call APIs that should not be allowed. The list of APIs that are affected by this issue is:





post:/platform/configuration/security/service-accounts
delete:/platform/configuration/security/service-accounts/{user_id}
patch:/platform/configuration/security/service-accounts/{user_id}
post:/platform/configuration/security/service-accounts/{user_id}/keys
delete:/platform/configuration/security/service-accounts/{user_id}/keys/{api_key_id}
patch:/user
post:/users
post:/users/auth/keys
delete:/users/auth/keys
delete:/users/auth/keys/_all
delete:/users/auth/keys/{api_key_id}
delete:/users/{user_id}/auth/keys
delete:/users/{user_id}/auth/keys/{api_key_id}
delete:/users/{user_name}
patch:/users/{user_name}
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-3-and-4-0-3-security-update-esa-2025-22/383132