deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-5023
Published: 2025-07-10
Description: Use of Hard-coded Credentials vulnerability in Mitsubishi Electric Corporation photovoltaic system monitor “EcoGuideTAB” PV-DR004J all versions and PV-DR004JA all versions allows an attacker within the Wi-Fi communication range between the units of the product (measurement unit and display unit) to disclose information such as generated power and electricity sold back to the grid stored in the product, tamper with or destroy stored or configured information in the product, or cause a Denial-of-Service (DoS) condition on the product, by using hardcoded user ID and password common to the product series obtained by exploiting CVE-2025-5022. The affected products discontinued in 2015, support ended in 2020.
CVSS Score: 7.1 (HIGH)
CWE: CWE-798
References: https://jvn.jp/vu/JVNVU90283680/; https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-007_en.pdf
CVE: CVE-2025-6168
Published: 2025-07-10
Description: An issue has been discovered in GitLab EE affecting all versions from 18.0 before 18.0.4 and 18.1 before 18.1.2 that could have allowed authenticated maintainers to bypass group-level user invitation restrictions by sending crafted API requests.
CVSS Score: 2.7 (LOW)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/gitlab/-/issues/549725; https://hackerone.com/reports/3196745
CVE: CVE-2025-6948
Published: 2025-07-10
Description: An issue has been discovered in GitLab CE/EE affecting all versions from 17.11 before 17.11.6, 18.0 before 18.0.4, and 18.1 before 18.1.2 that, under certain conditions, could have allowed a successful attacker to execute actions on behalf of users by injecting malicious content.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://gitlab.com/gitlab-org/gitlab/-/issues/552616; https://hackerone.com/reports/3227316
CVE: CVE-2024-7650
Published: 2025-07-10
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in OpenText™ Directory Services allows Remote Code Inclusion. The
vulnerability could allow access to the system via script injection.This issue affects Directory Services: 23.4.
CWE: CWE-94
References: https://support.opentext.com/csm?id=ot_kb_unauthenticated&sysparm_article=KB0844620
CVE: CVE-2025-32990
Published: 2025-07-10
Description: A heap-buffer-overflow (off-by-one) flaw was found in the GnuTLS software in the template parsing logic within the certtool utility. When it reads certain settings from a template file, it allows an attacker to cause an out-of-bounds (OOB) NULL pointer write, resulting in memory corruption and a denial-of-service (DoS) that could potentially crash the system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-122
References: https://access.redhat.com/errata/RHSA-2025:16115; https://access.redhat.com/errata/RHSA-2025:16116; https://access.redhat.com/errata/RHSA-2025:17181
CVE: CVE-2025-5037
Published: 2025-07-10
Description: A maliciously crafted RFA, RTE, or RVT file, when parsed through Autodesk Revit, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://www.autodesk.com/products/autodesk-access/overview; https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0012
CVE: CVE-2025-5040
Published: 2025-07-10
Description: A maliciously crafted RTE file, when parsed through Autodesk Revit, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://www.autodesk.com/products/autodesk-access/overview; https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0012
CVE: CVE-2025-6211
Published: 2025-07-10
Description: A vulnerability in the DocugamiReader class of the run-llama/llama_index repository, up to version 0.12.28, involves the use of MD5 hashing to generate IDs for document chunks. This approach leads to hash collisions when structurally distinct chunks contain identical text, resulting in one chunk overwriting another. This can cause loss of semantically or legally important document content, breakage of parent-child chunk hierarchies, and inaccurate or hallucinated responses in AI outputs. The issue is resolved in version 0.3.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-440
References: https://github.com/run-llama/llama_index/commit/29b2e07e64ed7d302b1cc058185560b28eaa1352; https://huntr.com/bounties/1a48a011-a3c5-4979-9ffc-9652280bc389; https://huntr.com/bounties/1a48a011-a3c5-4979-9ffc-9652280bc389
CVE: CVE-2024-36697
Published: 2025-07-10
Description: A cross-site scripting (XSS) vulnerability in the Admin Login page of Allworx System Software v9.1.9.12 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the SessionID parameter at query.asp.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://allworx.com; https://gist.github.com/roidrage52/d3e419550b91ff041abd55f698fb1e16
CVE: CVE-2025-7407
Published: 2025-07-10
Description: A vulnerability, which was classified as critical, was found in Netgear D6400 1.0.0.114. This affects an unknown part of the file diag.cgi. The manipulation of the argument host_name leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early and confirmed the existence of the vulnerability. They reacted very quickly, professional and kind. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77, CWE-78
References: https://github.com/wudipjq/my_vuln/blob/main/Netgear7/vuln_66/66.md; https://github.com/wudipjq/my_vuln/blob/main/Netgear7/vuln_66/66.md#poc; https://vuldb.com/?ctiid.315867
CVE: CVE-2025-7424
Published: 2025-07-10
Description: A flaw was found in the libxslt library. The same memory field, psvi, is used for both stylesheet and input data, which can lead to type confusion during XML transformations. This vulnerability allows an attacker to crash the application or corrupt memory. In some cases, it may lead to denial of service or unexpected behavior.
CVSS Score: 7.5 (HIGH)
CWE: CWE-843
References: https://access.redhat.com/errata/RHBA-2025:12345; https://access.redhat.com/errata/RHSA-2026:11015; https://access.redhat.com/security/cve/CVE-2025-7424
CVE: CVE-2025-7425
Published: 2025-07-10
Description: A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this corruption prevents the proper cleanup of ID attributes. As a result, the system may access freed memory, causing crashes or enabling attackers to trigger heap corruption.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://access.redhat.com/errata/RHBA-2025:12345; https://access.redhat.com/errata/RHSA-2025:12447; https://access.redhat.com/errata/RHSA-2025:12450
CVE: CVE-2024-37524
Published: 2025-07-10
Description: IBM Analytics Content Hub 2.0, 2.1, 2.2, and 2.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://www.ibm.com/support/pages/node/7234122
CVE: CVE-2024-38327
Published: 2025-07-10
Description: IBM Analytics Content Hub 2.0, 2.1, 2.2, and 2.3 is vulnerable to information exposure and further attacks due to an exposed JavaScript source map which could assist an attacker to read and debug JavaScript used in the application's API.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-540
References: https://www.ibm.com/support/pages/node/7234122
CVE: CVE-2024-39752
Published: 2025-07-10
Description: IBM Analytics Content Hub 2.0, 2.1, 2.2, and 2.3 could be vulnerable to malicious file upload by not validating the type of file uploaded to Explore Content. Attackers can make use of this weakness and upload malicious executable files into the system, and it can be sent to victim for performing further attacks.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-434
References: https://www.ibm.com/support/pages/node/7234122
CVE: CVE-2025-27613
Published: 2025-07-10
Description: Gitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clones an untrusted repository and runs gitk without additional command arguments, files for which the user has write permission can be created and truncated. The option Support per-file encoding must have been enabled before in Gitk's Preferences. This option is disabled by default. The same happens when Show origin of this line is used in the main window (regardless of whether Support per-file encoding is enabled or not). This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.
CVSS Score: 3.6 (LOW)
CWE: CWE-78
References: https://github.com/j6t/gitk/compare/465f03869ae11acd04abfa1b83c67879c867410c..026c397d911cde55924d7eb1311d0fd6e2e105d5; https://github.com/j6t/gitk/compare/7dd272eca153058da2e8d5b9960bbbf0b4f0cbaa..67a128b91e25978a15f9f7e194d81b441d603652; https://github.com/j6t/gitk/security/advisories/GHSA-f3cw-xrj3-wr2v
CVE: CVE-2025-27614
Published: 2025-07-10
Description: Gitk is a Tcl/Tk based Git history browser. Starting with 2.41.0, a Git repository can be crafted in such a way that with some social engineering a user who has cloned the repository can be tricked into running any script (e.g., Bourne shell, Perl, Python, ...) supplied by the attacker by invoking gitk filename, where filename has a particular structure. The script is run with the privileges of the user. This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.
CVSS Score: 8.6 (HIGH)
CWE: CWE-78
References: https://github.com/j6t/gitk/commit/8e3070aa5e331be45d4d03e3be41f84494fce129; https://github.com/j6t/gitk/security/advisories/GHSA-g4v5-fjv9-mhhc; http://www.openwall.com/lists/oss-security/2025/07/08/4
CVE: CVE-2025-36090
Published: 2025-07-10
Description: IBM Analytics Content Hub 2.0, 2.1, 2.2, and 2.3 could allow a remote attacker to obtain information about the application framework which could be used in reconnaissance to gather information for future attacks from a detailed technical error message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209
References: https://www.ibm.com/support/pages/node/7234122
CVE: CVE-2025-44251
Published: 2025-07-10
Description: Ecovacs Deebot T10 1.7.2 transmits Wi-Fi credentials in cleartext during the pairing process.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: http://ecovacs.com; https://httpscolonforwardslashforwardslashwwwdotzoltanbalazsdotcom.com/2025/07/09/CVE-2025-44251.html
CVE: CVE-2025-46334
Published: 2025-07-10
Description: Git GUI allows you to use the Git source control management tools via a GUI. A malicious repository can ship versions of sh.exe or typical textconv filter programs such as astextplain. Due to the unfortunate design of Tcl on Windows, the search path when looking for an executable always includes the current directory. The mentioned programs are invoked when the user selects Git Bash or Browse Files from the menu. This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.
CVSS Score: 8.6 (HIGH)
CWE: CWE-78
References: https://github.com/j6t/git-gui/compare/dcda716dbc9c90bcac4611bd[PII_REDACTED]ee0906..a1ccd2512072cf52835050f4c97a4fba9f0ec8f9; https://github.com/j6t/git-gui/security/advisories/GHSA-7px4-9hg2-fvhx; http://www.openwall.com/lists/oss-security/2025/07/08/4
CVE: CVE-2025-46835
Published: 2025-07-10
Description: Git GUI allows you to use the Git source control management tools via a GUI. When a user clones an untrusted repository and is tricked into editing a file located in a maliciously named directory in the repository, then Git GUI can create and overwrite files for which the user has write permission. This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.
CVSS Score: 8.5 (HIGH)
CWE: CWE-88
References: https://github.com/j6t/git-gui/compare/dcda716dbc9c90bcac4611bd[PII_REDACTED]ee0906..a437f5bc93330a70b42a230e52f3bd036ca1b1da; https://github.com/j6t/git-gui/security/advisories/GHSA-xfx7-68v4-v8fg; http://www.openwall.com/lists/oss-security/2025/07/08/4
CVE: CVE-2025-7365
Published: 2025-07-10
Description: A flaw was found in Keycloak. When an authenticated attacker attempts to merge accounts with another existing account during an identity provider (IdP) login, the attacker will subsequently be prompted to "review profile" information. This vulnerability allows the attacker to modify their email address to match that of a victim's account, triggering a verification email sent to the victim's email address. The attacker's email address is not present in the verification email content, making it a potential phishing opportunity. If the victim clicks the verification link, the attacker can gain access to the victim's account.
CVSS Score: 7.1 (HIGH)
CWE: CWE-346
References: https://access.redhat.com/errata/RHSA-2025:11986; https://access.redhat.com/errata/RHSA-2025:11987; https://access.redhat.com/errata/RHSA-2025:12015
CVE: CVE-2025-7370
Published: 2025-07-10
Description: Rejected reason: Upon investigtion upstream maintainers discovered this was not a real issue. See the references for more details. See: https://gitlab.gnome.org/GNOME/libsoup/-/issues/430#note_2494090.
CVE: CVE-2025-7408
Published: 2025-07-10
Description: A vulnerability has been found in SourceCodester Zoo Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /admin/templates/animal_form_template.php. The manipulation of the argument msg leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/manyufann/CVE/issues/4; https://vuldb.com/?ctiid.315868; https://vuldb.com/?id.315868
CVE: CVE-2025-46788
Published: 2025-07-10
Description: Improper certificate validation in Zoom Workplace for Linux before version 6.4.13 may allow an unauthorized user to conduct an information disclosure via network access.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295
References: https://https://www.zoom.com/en/trust/security-bulletin/zsb-25023/
CVE: CVE-2025-46789
Published: 2025-07-10
Description: Classic buffer overflow in certain Zoom Clients for Windows may allow an authorized user to conduct a denial of service via network access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://https://www.zoom.com/en/trust/security-bulletin/zsb-25024/
CVE: CVE-2025-53364
Published: 2025-07-10
Description: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Starting in 5.3.0 and before 7.5.3 and 8.2.2, the Parse Server GraphQL API previously allowed public access to the GraphQL schema without requiring a session token or the master key. While schema introspection reveals only metadata and not actual data, this metadata can still expand the potential attack surface. This vulnerability is fixed in 7.5.3 and 8.2.2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-497
References: https://github.com/parse-community/parse-server/pull/9819; https://github.com/parse-community/parse-server/pull/9820; https://github.com/parse-community/parse-server/security/advisories/GHSA-48q3-prgv-gm4w
CVE: CVE-2025-6395
Published: 2025-07-10
Description: A NULL pointer dereference flaw was found in the GnuTLS software in _gnutls_figure_common_ciphersuite().
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://access.redhat.com/errata/RHSA-2025:16115; https://access.redhat.com/errata/RHSA-2025:16116; https://access.redhat.com/errata/RHSA-2025:17181
CVE: CVE-2024-42516
Published: 2025-07-10
Description: HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP response.

This vulnerability was described as CVE-2023-38709 but the patch included in Apache HTTP Server 2.4.59 did not address the issue.

Users are recommended to upgrade to version 2.4.64, which fixes this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://httpd.apache.org/security/vulnerabilities_24.html; http://www.openwall.com/lists/oss-security/2025/07/10/2; http://www.openwall.com/lists/oss-security/2025/07/10/3
CVE: CVE-2024-43204
Published: 2025-07-10
Description: SSRF in Apache HTTP Server with mod_proxy loaded allows an attacker to send outbound proxy requests to a URL controlled by the attacker.  Requires an unlikely configuration where mod_headers is configured to modify the Content-Type request or response header with a value provided in the HTTP request.

Users are recommended to upgrade to version 2.4.64 which fixes this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://httpd.apache.org/security/vulnerabilities_24.html; http://www.openwall.com/lists/oss-security/2025/07/10/2; http://www.openwall.com/lists/oss-security/2025/07/10/4
CVE: CVE-2024-43394
Published: 2025-07-10
Description: Server-Side Request Forgery (SSRF) in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via 
mod_rewrite or apache expressions that pass unvalidated request input.

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.63.

Note:  The Apache HTTP Server Project will be setting a higher bar for accepting vulnerability reports regarding SSRF via UNC paths. 

The server offers limited protection against administrators directing the server to open UNC paths.
Windows servers should limit the hosts they will connect over via SMB based on the nature of NTLM authentication.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://httpd.apache.org/security/vulnerabilities_24.html; http://www.openwall.com/lists/oss-security/2025/07/10/2; http://www.openwall.com/lists/oss-security/2025/07/10/5
CVE: CVE-2024-47252
Published: 2025-07-10
Description: Insufficient escaping of user-supplied data in mod_ssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations.

In a logging configuration where CustomLog is used with "%{varname}x" or "%{varname}c" to log variables provided by mod_ssl such as SSL_TLS_SNI, no escaping is performed by either mod_log_config or mod_ssl and unsanitized data provided by the client may appear in log files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-150
References: https://httpd.apache.org/security/vulnerabilities_24.html; http://www.openwall.com/lists/oss-security/2025/07/10/2; http://www.openwall.com/lists/oss-security/2025/07/10/6
CVE: CVE-2025-23048
Published: 2025-07-10
Description: In some mod_ssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is possible using TLS 1.3 session resumption.

Configurations are affected when mod_ssl is configured for multiple virtual hosts, with each restricted to a different set of trusted client certificates (for example with a different SSLCACertificateFile/Path setting). In such a case, a client trusted to access one virtual host may be able to access another virtual host, if SSLStrictSNIVHostCheck is not enabled in either virtual host.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-284
References: https://httpd.apache.org/security/vulnerabilities_24.html; http://www.openwall.com/lists/oss-security/2025/07/10/2; http://www.openwall.com/lists/oss-security/2025/07/10/8
CVE: CVE-2025-27889
Published: 2025-07-10
Description: Wing FTP Server before 7.4.4 does not properly validate and sanitize the url parameter of the downloadpass.html endpoint, allowing injection of an arbitrary link. If a user clicks a crafted link, this discloses a cleartext password to the attacker.
CVSS Score: 3.4 (LOW)
CWE: CWE-15
References: https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2025-27889.txt; https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/; https://www.wftpserver.com/wftpserver.htm
CVE: CVE-2025-47811
Published: 2025-07-10
Description: In Wing FTP Server through 7.4.4, the administrative web interface (listening by default on port 5466) runs as root or SYSTEM by default. The web application itself offers several legitimate ways to execute arbitrary system commands (i.e., through the web console or the task scheduler), and they are automatically executed in the highest possible privilege context. Because administrative users of the web interface are not necessarily also system administrators, one might argue that this is a privilege escalation. (If a privileged application role is not available to an attacker, CVE-2025-47812 can be leveraged.) NOTE: the vendor reportedly considers this behavior "fine to keep."
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-267
References: https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/; https://www.wftpserver.com; https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/
CVE: CVE-2025-47812
Published: 2025-07-10
Description: In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default). This is thus a remote code execution vulnerability that guarantees a total server compromise. This is also exploitable via anonymous FTP accounts.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-158
References: https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/; https://www.vicarius.io/vsociety/posts/cve-2025-47812-detection-script-remote-code-execution-vulnerability-in-wing-ftp-server; https://www.vicarius.io/vsociety/posts/cve-2025-47812-mitigation-script-remote-code-execution-vulnerability-in-wing-ftp-server
CVE: CVE-2025-47813
Published: 2025-07-10
Description: loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209
References: https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2025-47813.txt; https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/; https://www.wftpserver.com
CVE: CVE-2025-49462
Published: 2025-07-10
Description: Cross-site scripting in certain Zoom Clients  before version 6.4.5 may allow an authenticated user to conduct a disclosure of information via network access.
CVSS Score: 3.5 (LOW)
CWE: CWE-352
References: https://https://www.zoom.com/en/trust/security-bulletin/zsb-25025/
CVE: CVE-2025-49463
Published: 2025-07-10
Description: Insufficient control flow management in certain Zoom Clients for iOS before version 6.4.5 may allow an unauthenticated user to conduct a disclosure of information via network access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-691
References: https://https://www.zoom.com/en/trust/security-bulletin/zsb-25026/
CVE: CVE-2025-49464
Published: 2025-07-10
Description: Classic buffer overflow in certain Zoom Clients for Windows may allow an authorised user to conduct a denial of service via network access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://https://www.zoom.com/en/trust/security-bulletin/zsb-25028/
CVE: CVE-2025-49630
Published: 2025-07-10
Description: In certain proxy configurations, a denial of service attack against Apache HTTP Server versions 2.4.26 through to 2.4.63 can be triggered by untrusted clients causing an assertion in mod_proxy_http2.

Configurations affected are a reverse proxy is configured for an HTTP/2 backend, with ProxyPreserveHost set to "on".
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://httpd.apache.org/security/vulnerabilities_24.html; http://www.openwall.com/lists/oss-security/2025/07/10/2; http://www.openwall.com/lists/oss-security/2025/07/10/7