deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-68339
Published: 2025-12-23
Description: In the Linux kernel, the following vulnerability has been resolved:

atm/fore200e: Fix possible data race in fore200e_open()

Protect access to fore200e->available_cell_rate with rate_mtx lock in the
error handling path of fore200e_open() to prevent a data race.

The field fore200e->available_cell_rate is a shared resource used to track
available bandwidth. It is concurrently accessed by fore200e_open(),
fore200e_close(), and fore200e_change_qos().

In fore200e_open(), the lock rate_mtx is correctly held when subtracting
vcc->qos.txtp.max_pcr from available_cell_rate to reserve bandwidth.
However, if the subsequent call to fore200e_activate_vcin() fails, the
function restores the reserved bandwidth by adding back to
available_cell_rate without holding the lock.

This introduces a race condition because available_cell_rate is a global
device resource shared across all VCCs. If the error path in
fore200e_open() executes concurrently with operations like
fore200e_close() or fore200e_change_qos() on other VCCs, a
read-modify-write race occurs.

Specifically, the error path reads the rate without the lock. If another
CPU acquires the lock and modifies the rate (e.g., releasing bandwidth in
fore200e_close()) between this read and the subsequent write, the error
path will overwrite the concurrent update with a stale value. This results
in incorrect bandwidth accounting.
References: https://git.kernel.org/stable/c/1b60f42a639999c37da7f1fbfa1ad29cf4cbdd2d; https://git.kernel.org/stable/c/[PII_REDACTED]e7eb6502dd3182f586f91fcc218039; https://git.kernel.org/stable/c/667ac[PII_REDACTED]74f819500adc5baa2889c7bc5
CVE: CVE-2025-68340
Published: 2025-12-23
Description: In the Linux kernel, the following vulnerability has been resolved:

team: Move team device type change at the end of team_port_add

Attempting to add a port device that is already up will expectedly fail,
but not before modifying the team device header_ops.

In the case of the syzbot reproducer the gre0 device is
already in state UP when it attempts to add it as a
port device of team0, this fails but before that
header_ops->create of team0 is changed from eth_header to ipgre_header
in the call to team_dev_type_check_change.

Later when we end up in ipgre_header() struct ip_tunnel* points to nonsense
as the private data of the device still holds a struct team.

Example sequence of iproute2 commands to reproduce the hang/BUG():
ip link add dev team0 type team
ip link add dev gre0 type gre
ip link set dev gre0 up
ip link set dev gre0 master team0
ip link set dev team0 up
ping -I team0 1.1.1.1

Move team_dev_type_check_change down where all other checks have passed
as it changes the dev type with no way to restore it in case
one of the checks that follow it fail.

Also make sure to preserve the origial mtu assignment:
  - If port_dev is not the same type as dev, dev takes mtu from port_dev
  - If port_dev is the same type as dev, port_dev takes mtu from dev

This is done by adding a conditional before the call to dev_set_mtu
to prevent it from assigning port_dev->mtu = dev->mtu and instead
letting team_dev_type_check_change assign dev->mtu = port_dev->mtu.
The conditional is needed because the patch moves the call to
team_dev_type_check_change past dev_set_mtu.

Testing:
  - team device driver in-tree selftests
  - Add/remove various devices as slaves of team device
  - syzbot
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0ae9cfc454ea5ead5f3ddbdfe2e70270d8e2c8ef; https://git.kernel.org/stable/c/4040b5e8963982a00aa821300cb746efc9f2947e; https://git.kernel.org/stable/c/a74ab1b532ecc5f9106621a8f75b4c3d04466b35
CVE: CVE-2025-68341
Published: 2025-12-23
Description: In the Linux kernel, the following vulnerability has been resolved:

veth: reduce XDP no_direct return section to fix race

As explain in commit fa349e396e48 ("veth: Fix race with AF_XDP exposing
old or uninitialized descriptors") for veth there is a chance after
napi_complete_done() that another CPU can manage start another NAPI
instance running veth_pool(). For NAPI this is correctly handled as the
napi_schedule_prep() check will prevent multiple instances from getting
scheduled, but for the remaining code in veth_pool() this can run
concurrent with the newly started NAPI instance.

The problem/race is that xdp_clear_return_frame_no_direct() isn't
designed to be nested.

Prior to commit 401cb7dae813 ("net: Reference bpf_redirect_info via
task_struct on PREEMPT_RT.") the temporary BPF net context
bpf_redirect_info was stored per CPU, where this wasn't an issue. Since
this commit the BPF context is stored in 'current' task_struct. When
running veth in threaded-NAPI mode, then the kthread becomes the storage
area. Now a race exists between two concurrent veth_pool() function calls
one exiting NAPI and one running new NAPI, both using the same BPF net
context.

Race is when another CPU gets within the xdp_set_return_frame_no_direct()
section before exiting veth_pool() calls the clear-function
xdp_clear_return_frame_no_direct().
References: https://git.kernel.org/stable/c/a14602fcae17a3f1cb8a8521bedf31728f9e7e39; https://git.kernel.org/stable/c/c1ceabcb347d1b0f7e70a7384ec7eff3847b7628; https://git.kernel.org/stable/c/d0bd018ad72a8a598ae[PII_REDACTED]35017f8af52
CVE: CVE-2025-68342
Published: 2025-12-23
Description: In the Linux kernel, the following vulnerability has been resolved:

can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data

The URB received in gs_usb_receive_bulk_callback() contains a struct
gs_host_frame. The length of the data after the header depends on the
gs_host_frame hf::flags and the active device features (e.g. time
stamping).

Introduce a new function gs_usb_get_minimum_length() and check that we have
at least received the required amount of data before accessing it. Only
copy the data to that skb that has actually been received.

[mkl: rename gs_usb_get_minimum_length() -> +gs_usb_get_minimum_rx_length()]
References: https://git.kernel.org/stable/c/395d988f93861101ec89d0dd9e3b876ae9392a5b; https://git.kernel.org/stable/c/4ffac725154cf6a253f5e6aa0c8946232b6a0af5; https://git.kernel.org/stable/c/ad55004a3cb5b41ef78aa6c09e7bc5a489ba652b
CVE: CVE-2025-68343
Published: 2025-12-23
Description: In the Linux kernel, the following vulnerability has been resolved:

can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header

The driver expects to receive a struct gs_host_frame in
gs_usb_receive_bulk_callback().

Use struct_group to describe the header of the struct gs_host_frame and
check that we have at least received the header before accessing any
members of it.

To resubmit the URB, do not dereference the pointer chain
"dev->parent->hf_size_rx" but use "parent->hf_size_rx" instead. Since
"urb->context" contains "parent", it is always defined, while "dev" is not
defined if the URB it too short.
References: https://git.kernel.org/stable/c/18cbce43363c9f84b90a92d57df341155eee0697; https://git.kernel.org/stable/c/3433680b759646efcacc64fe36aa2e51ae34b8f0; https://git.kernel.org/stable/c/616eee3e895b8ca0028163fcb1dce5e3e9dea322
CVE: CVE-2024-9684
Published: 2025-12-23
Description: FreyrSCADA/IEC-60870-5-104 server v21.06.008 allows remote attackers to cause a denial of service by sending specific message sequences.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://drive.google.com/drive/folders/1pBPZR59d_rlixH7ZysUmmbOEZvjZV9g1; https://github.com/FreyrSCADA/IEC-60870-5-104/issues/6
CVE: CVE-2024-10398
Published: 2025-12-23
Description: Rejected reason: This CVE id was assigned but later discarded.
CVE: CVE-2025-45493
Published: 2025-12-23
Description: Netgear EX8000 V1.0.0.126 is vulnerable to Command Injection via the iface parameter in the action_bandwidth function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: https://github.com/JZP018/vuln03/blob/main/netgear/EX8000/cve-netgear_EX8000_CI_action_bandwidth.pdf; https://github.com/JZP018/vuln03/blob/main/netgear/EX8000/netgear_EX8000_CI_action_bandwidth.mp4
CVE: CVE-2025-48863
Published: 2025-12-23
Description: Rejected reason: This CVE id was assigned but later discarded.
CVE: CVE-2025-48864
Published: 2025-12-23
Description: Rejected reason: This CVE id was assigned but later discarded.
CVE: CVE-2025-50526
Published: 2025-12-23
Description: Netgear EX8000 V1.0.0.126 was discovered to contain a command injection vulnerability via the switch_status function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/JZP018/vuln03/blob/main/netgear/EX8000/cve-netgear_EX8000_CI_switch_status.pdf; https://github.com/JZP018/vuln03/blob/main/netgear/EX8000/netgear_EX8000_CI_switch_status.mp4
CVE: CVE-2025-65865
Published: 2025-12-23
Description: An integer overflow in eProsima Fast-DDS v3.3 allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: http://eprosima.com; http://fast-dds.com; https://gist.github.com/lkloliver/7aa48cb9fc7a1dd74cb595212bb69d33
CVE: CVE-2025-67108
Published: 2025-12-23
Description: eProsima Fast-DDS v3.3 was discovered to contain improper validation for ticket revocation, resulting in insecure communications and connections.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-298, CWE-370
References: http://eprosima.com; http://fast-dds.com; https://gist.github.com/lkloliver/81b5d5a8328d712dbfd497bf11dbe913
CVE: CVE-2025-67109
Published: 2025-12-23
Description: Improper verification of the time certificate in Eclipse Cyclone DDS before v0.10.5 allows attackers to bypass certificate checks and execute commands with System privileges.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-298
References: http://eclipse.com; https://gist.github.com/lkloliver/669e15bc7e6194133e4ee1026ce157e6; https://github.com/eclipse-cyclonedds/cyclonedds/blob/master/src/ddsrt/src/time/posix/time.c#L28
CVE: CVE-2025-67111
Published: 2025-12-23
Description: An integer overflow in the RTPS protocol implementation of OpenDDS DDS before v3.33.0 allows attackers to cause a Denial of Service (DoS) via a crafted message.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://gist.github.com/lkloliver/fcc5da83b4cba137ce95177a9afc4126; https://github.com/lkloliver/poc/blob/main/POC_OpenDDS.md
CVE: CVE-2024-57521
Published: 2025-12-23
Description: SQL Injection vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute arbitrary code via the createTable function in SqlUtil.java.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-89
References: https://gitee.com/y_project/RuoYi/commit/ddd858ca732618a472b10eaab2f8e4b45812ffc5; https://gitee.com/y_project/RuoYi/issues/IBC976; https://github.com/mrlihd/CVE-2024-57521-SQL-Injection-PoC/blob/main/README.md
CVE: CVE-2025-29228
Published: 2025-12-23
Description: Linksys E5600 V1.1.0.26 is vulnerable to command injection in the runtime.macClone function via the mc.ip parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/JZP018/Vuln/blob/main/linsys/E5600/CI_macClone_mc.ip/CI_macClone_mc.ip.md
CVE: CVE-2025-29229
Published: 2025-12-23
Description: linksys E5600 V1.1.0.26 is vulnerable to command injection in the function ddnsStatus.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/JZP018/Vuln/blob/main/linsys/E5600/CI_ddnsStatus/CI_ddnsStatus.md
CVE: CVE-2025-33222
Published: 2025-12-23
Description: NVIDIA Isaac Launchable contains a vulnerability where an attacker could exploit a hard-coded credential issue. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, and data tampering.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://nvd.nist.gov/vuln/detail/CVE-2025-33222; https://nvidia.custhelp.com/app/answers/detail/a_id/5749; https://www.cve.org/CVERecord?id=CVE-2025-33222
CVE: CVE-2025-33223
Published: 2025-12-23
Description: NVIDIA Isaac Launchable contains a vulnerability where an attacker could cause an execution with unnecessary privileges. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, information disclosure and data tampering.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-250
References: https://nvd.nist.gov/vuln/detail/CVE-2025-33223; https://nvidia.custhelp.com/app/answers/detail/a_id/5749; https://www.cve.org/CVERecord?id=CVE-2025-33223
CVE: CVE-2025-33224
Published: 2025-12-23
Description: NVIDIA Isaac Launchable contains a vulnerability where an attacker could cause an execution with unnecessary privileges. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, information disclosure and data tampering.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-250
References: https://nvd.nist.gov/vuln/detail/CVE-2025-33224; https://nvidia.custhelp.com/app/answers/detail/a_id/5749; https://www.cve.org/CVERecord?id=CVE-2025-33224
CVE: CVE-2025-65410
Published: 2025-12-23
Description: A stack overflow in the src/main.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecting a crafted input into the filename parameter.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-121
References: https://github.com/MAXEUR5/Vulnerability_Disclosures/blob/main/2025/CVE-2025-65410.md; https://hg.savannah.gnu.org/hgweb/unrtf/rev/a5d3b025a8b1; https://lists.gnu.org/archive/html/bug-unrtf/2025-11/msg00001.html
CVE: CVE-2025-65713
Published: 2025-12-23
Description: Home Assistant Core before v2025.8.0 is vulnerable to Directory Traversal. The Downloader integration does not fully validate file paths during concatenation, leaving a path traversal vulnerability.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: https://gist.github.com/GenoWang/[PII_REDACTED]e0fe21a7a58d10ff71d032; https://github.com/home-assistant/core/pull/150046
CVE: CVE-2025-13074
Published: 2025-12-23
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2025-51511
Published: 2025-12-23
Description: Cadmium CMS v.0.4.9 has a background arbitrary file upload vulnerability in /admin/content/filemanager/uploads.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/cadmium-org/cadmium-cms/issues/23
CVE: CVE-2025-10863
Published: 2025-12-23
Description: Rejected reason: This CVE id was assigned but later discarded.
CVE: CVE-2025-25364
Published: 2025-12-23
Description: A command injection vulnerability in the me.connectify.SMJobBlessHelper XPC service of Speedify VPN up to v15.0.0 allows attackers to execute arbitrary commands with root-level privileges.
CVSS Score: 8.4 (HIGH)
CWE: CWE-77
References: https://connectify.me; https://speedify.com/; https://speedify.com/blog/news/speedify-macos-vpn-application-vulnerability/
CVE: CVE-2021-47716
Published: 2025-12-23
Description: Orangescrum 1.8.0 contains multiple cross-site scripting vulnerabilities that allow authenticated attackers to inject malicious scripts through various input parameters. Attackers can exploit parameters like 'projid', 'CS_message', and 'name' to execute arbitrary JavaScript code in victim's browsers by submitting crafted payloads through application endpoints.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.exploit-db.com/exploits/50554; https://www.orangescrum.org/; https://www.vulncheck.com/advisories/orangescrum-cross-site-scripting-via-authenticated-endpoints
CVE: CVE-2021-47720
Published: 2025-12-23
Description: Orangescrum 1.8.0 contains an authenticated SQL injection vulnerability that allows authorized users to manipulate database queries through multiple vulnerable parameters. Attackers can inject malicious SQL code into parameters like old_project_id, project_id, uuid, and uniqid to potentially extract or modify database information.
CVSS Score: 7.1 (HIGH)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/50553; https://www.orangescrum.org/; https://www.vulncheck.com/advisories/orangescrum-authenticated-sql-injection-via-multiple-parameters
CVE: CVE-2021-47721
Published: 2025-12-23
Description: Orangescrum 1.8.0 contains a privilege escalation vulnerability that allows authenticated users to take over other project-assigned accounts by manipulating session cookies. Attackers can extract the victim's unique ID from the page source and replace their own session cookie to gain unauthorized access to another user's account.
CVSS Score: 8.8 (HIGH)
CWE: CWE-639
References: https://www.exploit-db.com/exploits/50551; https://www.orangescrum.org/; https://www.vulncheck.com/advisories/orangescrum-authenticated-privilege-escalation-via-user-session-manipulation
CVE: CVE-2021-47722
Published: 2025-12-23
Description: Zucchetti Axess CLOKI Access Control 1.64 contains a cross-site request forgery vulnerability that allows attackers to manipulate access control settings without user interaction. Attackers can craft malicious web pages with hidden forms to disable or modify access control parameters by tricking authenticated users into loading the page.
CVSS Score: 3.5 (LOW)
CWE: CWE-352
References: https://www.axesstmc.com; https://www.exploit-db.com/exploits/50595; https://www.vulncheck.com/advisories/zucchetti-axess-cloki-access-control-cross-site-request-forgery
CVE: CVE-2021-47732
Published: 2025-12-23
Description: CMSimple 5.2 contains a stored cross-site scripting vulnerability in the Filebrowser External input field that allows attackers to inject malicious JavaScript. Attackers can place unfiltered JavaScript code that executes when users click on Page or Files tabs, enabling persistent script injection.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.cmsimple.org/en/; https://www.exploit-db.com/exploits/49751; https://www.vulncheck.com/advisories/cmsimple-stored-cross-site-scripting-via-filebrowser-external-input
CVE: CVE-2021-47733
Published: 2025-12-23
Description: CMSimple 5.4 contains a cross-site scripting vulnerability that allows attackers to bypass input filtering by using HTML to Unicode encoding. Attackers can inject malicious scripts by encoding payloads like ')-alert(1)// and execute arbitrary JavaScript when victims interact with delete buttons.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.cmsimple.org/en/; https://www.exploit-db.com/exploits/50612; https://www.vulncheck.com/advisories/cmsimple-cross-site-scripting-via-html-unicode-encoding
CVE: CVE-2021-47734
Published: 2025-12-23
Description: CMSimple 5.4 contains an authenticated local file inclusion vulnerability that allows remote attackers to manipulate PHP session files and execute arbitrary code. Attackers can leverage the vulnerability by changing the functions file path and uploading malicious PHP code through session file upload mechanisms.
CVSS Score: 7.8 (HIGH)
CWE: CWE-98
References: https://www.cmsimple.org/en/; https://www.exploit-db.com/exploits/50547; https://www.vulncheck.com/advisories/cmsimple-authenticated-local-file-inclusion-remote-code-execution
CVE: CVE-2021-47735
Published: 2025-12-23
Description: CMSimple 5.4 contains an authenticated remote code execution vulnerability that allows logged-in attackers to inject malicious PHP code into template files. Attackers can exploit the template editing functionality by crafting a reverse shell payload and saving it through the template editing endpoint with a valid CSRF token.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://www.cmsimple.org/; https://www.exploit-db.com/exploits/50356; https://www.vulncheck.com/advisories/cmsimple-authenticated-remote-code-execution-via-template-editing
CVE: CVE-2021-47736
Published: 2025-12-23
Description: CMSimple_XH 1.7.4 contains an authenticated remote code execution vulnerability in the content editing functionality that allows administrative users to upload malicious PHP files. Attackers with valid credentials can exploit the CSRF token mechanism to create a PHP shell file that enables arbitrary command execution on the server.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://www.cmsimple-xh.org/; https://www.exploit-db.com/exploits/50367; https://www.vulncheck.com/advisories/cmsimplexh-authenticated-remote-code-execution-via-content-editing
CVE: CVE-2021-47737
Published: 2025-12-23
Description: CSZ CMS 1.2.7 contains an HTML injection vulnerability that allows authenticated users to insert malicious hyperlinks in message titles. Attackers can craft POST requests to the member messaging system with HTML-based links to potentially conduct phishing or social engineering attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://sourceforge.net/projects/cszcms/; https://www.cszcms.com/; https://www.exploit-db.com/exploits/48357
CVE: CVE-2021-47738
Published: 2025-12-23
Description: CSZ CMS 1.2.7 contains a persistent cross-site scripting vulnerability that allows unauthorized users to embed malicious JavaScript in private messages. Attackers can send messages with script payloads in the user-agent header, which will execute when an admin views the message in the backend dashboard.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://sourceforge.net/projects/cszcms/; https://www.cszcms.com/; https://www.exploit-db.com/exploits/48354
CVE: CVE-2021-47739
Published: 2025-12-23
Description: Epic Games Easy Anti-Cheat 4.0 contains an unquoted service path vulnerability that allows local non-privileged users to execute arbitrary code with elevated system privileges. Attackers can exploit the service configuration by inserting malicious code in the system root path that would execute with LocalSystem privileges during application startup.
CVSS Score: 8.4 (HIGH)
CWE: CWE-428
References: https://www.easy.ac; https://www.epicgames.com; https://www.exploit-db.com/exploits/49841
CVE: CVE-2023-53982
Published: 2025-12-23
Description: PMB 7.4.6 contains a SQL injection vulnerability in the storage parameter of the ajax.php endpoint that allows remote attackers to manipulate database queries. Attackers can exploit the unsanitized 'id' parameter by injecting conditional sleep statements to extract information or perform time-based blind SQL injection attacks.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://forge.sigb.net/redmine/projects/pmb/files; http://www.sigb.net; https://www.exploit-db.com/exploits/51197
CVE: CVE-2025-65354
Published: 2025-12-23
Description: Improper input handling in /Grocery/search_products_itname.php inPuneethReddyHC event-management 1.0 permits SQL injection via the sitem_name POST parameter. Crafted payloads can alter query logic and disclose database contents. Exploitation may result in sensitive data disclosure and backend compromise.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/amaansiddd787/CVE-2025-65354
CVE: CVE-2025-11419
Published: 2025-12-23
Description: A flaw was found in Keycloak. This vulnerability allows an unauthenticated remote attacker to cause a denial of service (DoS) by repeatedly initiating TLS 1.2 client-initiated renegotiation requests to exhaust server CPU resources, making the service unavailable.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://access.redhat.com/errata/RHSA-2025:18254; https://access.redhat.com/errata/RHSA-2025:18255; https://access.redhat.com/errata/RHSA-2025:18889
CVE: CVE-2025-14920
Published: 2025-12-23
Description: Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of model files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-25423.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502
References: https://www.zerodayinitiative.com/advisories/ZDI-25-1150/