deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-10934
Published: 2025-10-29
Description: GIMP XWD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of XWD files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27823.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://gitlab.gnome.org/GNOME/gimp/-/commit/5c3e2122d53869599d77ef0f1bdece117b24fd7c; https://www.zerodayinitiative.com/advisories/ZDI-25-978/; https://lists.debian.org/debian-lts-announce/2025/11/msg00005.html
CVE: CVE-2025-11200
Published: 2025-10-29
Description: MLflow Weak Password Requirements Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of MLflow. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of passwords. The issue results from weak password requirements. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-26916.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-521
References: https://github.com/mlflow/mlflow/commit/1f74f3f24d8273927b8db392c23e108576936c54; https://www.zerodayinitiative.com/advisories/ZDI-25-932/
CVE: CVE-2025-11201
Published: 2025-10-29
Description: MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow Tracking Server. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of model file paths. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-26921.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://github.com/B-Step62/mlflow/commit/2e02bc7bb70df243e6eb792689d9b8eba0013161; https://www.zerodayinitiative.com/advisories/ZDI-25-931/
CVE: CVE-2025-11202
Published: 2025-10-29
Description: win-cli-mcp-server resolveCommandPath Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of win-cli-mcp-server. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the implementation of the resolveCommandPath method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-27787.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/simon-ami/win-cli-mcp-server/commit/521b4a34190d03bde7d433d213c36357181a6d09; https://www.zerodayinitiative.com/advisories/ZDI-25-930/
CVE: CVE-2025-11203
Published: 2025-10-29
Description: LiteLLM Information health API_KEY Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of LiteLLM. Authentication is required to exploit this vulnerability.

The specific flaw exists within the handling of the API_KEY parameter provided to the health endpoint. The issue results from exposing sensitive information to an unauthorized actor. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-26585.
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: https://docs.litellm.ai/release_notes/v1.63.14-stable; https://www.zerodayinitiative.com/advisories/ZDI-25-929/
CVE: CVE-2025-11463
Published: 2025-10-29
Description: Ashlar-Vellum Cobalt XE File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of XE files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26626.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://www.zerodayinitiative.com/advisories/ZDI-25-954/
CVE: CVE-2025-11464
Published: 2025-10-29
Description: Ashlar-Vellum Cobalt CO File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of CO files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26628.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://www.zerodayinitiative.com/advisories/ZDI-25-955/
CVE: CVE-2025-11465
Published: 2025-10-29
Description: Ashlar-Vellum Cobalt CO File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of CO files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26631.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.zerodayinitiative.com/advisories/ZDI-25-956/
CVE: CVE-2025-11466
Published: 2025-10-29
Description: Allegra DatabaseBackupBL Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Allegra. Authentication is required to exploit this vulnerability.

The specific flaw exists within the DatabaseBackupBL class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of the service account. Was ZDI-CAN-27136.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://alltena.com/en/resources/release-notes/release-notes-for-release-8-1-6; https://www.zerodayinitiative.com/advisories/ZDI-25-951/
CVE: CVE-2025-60320
Published: 2025-10-29
Description: memoQ 10.1.13.ef1b2b52aae and earlier contains an unquoted service path vulnerability in the memoQ Auto Update Service (memoQauhlp101). The affected service is installed with a path containing spaces and without surrounding quotes. This misconfiguration allows local users to escalate privileges to SYSTEM by placing a malicious executable at C:\Program.exe.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-428
References: https://docs.memoq.com/helpcenter/; https://github.com/joseraeiro/security-advisories/blob/e0b1095de8b3162fb0d9de9a688317a12fdd9be8/CVE-2025-60320.md; https://github.com/joseraeiro/security-advisories/blob/e0b1095de8b3162fb0d9de9a688317a12fdd9be8/CVE-2025-60320.md
CVE: CVE-2025-9869
Published: 2025-10-29
Description: Razer Synapse 3 Macro Module Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Razer Synapse 3. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the Razer Synapse Service. By creating a symbolic link, an attacker can abuse the service to delete arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-26374.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://www.zerodayinitiative.com/advisories/ZDI-25-919/
CVE: CVE-2025-9870
Published: 2025-10-29
Description: Razer Synapse 3 RazerPhilipsHueUninstall Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Razer Synapse 3. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the Philips HUE module installer. By creating a symbolic link, an attacker can abuse the installer to delete arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-26375.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://www.zerodayinitiative.com/advisories/ZDI-25-921/
CVE: CVE-2025-9871
Published: 2025-10-29
Description: Razer Synapse 3 Chroma Connect Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Razer Synapse 3. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the Razer Chroma SDK installer. By creating a symbolic link, an attacker can abuse the installer to delete arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-26373.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://www.zerodayinitiative.com/advisories/ZDI-25-920/
CVE: CVE-2025-54459
Published: 2025-10-29
Description: Prior to September 19, 2025, the Hospital Manager Backend Services exposed the ASP.NET tracing endpoint /trace.axd without authentication, allowing a remote attacker to obtain live request traces and sensitive information such as request metadata, session identifiers, authorization headers, server variables, and internal file paths.
CVSS Score: 7.5 (HIGH)
CWE: CWE-497
References: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-301-01
CVE: CVE-2025-61959
Published: 2025-10-29
Description: Prior to September 19, 2025, the Hospital Manager Backend Services returned verbose ASP.NET error pages for invalid WebResource.axd requests, disclosing framework and ASP.NET version information, stack traces, internal paths, and the insecure configuration 'customErrors mode="Off"', which could have facilitated reconnaissance by unauthenticated attackers.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-301-01; https://www.vertikalsystems.com/en/products/pm/contact.php
CVE: CVE-2025-11428
Published: 2025-10-29
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2025-47912
Published: 2025-10-29
Description: The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://[::1]/". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement.
CVSS Score: 5.3 (MEDIUM)
References: https://go.dev/cl/709857; https://go.dev/issue/75678; https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI
CVE: CVE-2025-54545
Published: 2025-10-29
Description: On affected platforms, a restricted user could break out of the CLI sandbox to the system shell and elevate their privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732, CWE-732
References: https://www.arista.com/en/support/advisories-notices/security-advisory/22538-security-advisory-0124
CVE: CVE-2025-54546
Published: 2025-10-29
Description: On affected platforms, restricted users could use SSH port forwarding to access host-internal services
CVSS Score: 7.5 (HIGH)
CWE: CWE-732, CWE-732
References: https://www.arista.com/en/support/advisories-notices/security-advisory/22538-security-advisory-0124
CVE: CVE-2025-54547
Published: 2025-10-29
Description: On affected platforms, if SSH session multiplexing was configured on the client side, SSH sessions (e.g, scp, sftp) multiplexed onto the same channel could perform file-system operations after a configured session timeout expired
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-613, CWE-613
References: https://www.arista.com/en/support/advisories-notices/security-advisory/22538-security-advisory-0124
CVE: CVE-2025-54548
Published: 2025-10-29
Description: On affected platforms, restricted users could view sensitive portions of the config database via a debug API (e.g., user password hashes)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://www.arista.com/en/support/advisories-notices/security-advisory/22538-security-advisory-0124
CVE: CVE-2025-54549
Published: 2025-10-29
Description: Cryptographic validation of upgrade images could be circumventing by dropping a specifically crafted file into the upgrade ISO
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-347
References: https://www.arista.com/en/support/advisories-notices/security-advisory/22538-security-advisory-0124
CVE: CVE-2025-58183
Published: 2025-10-29
Description: tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a compressed source, a small compressed input can result in large allocations.
CVSS Score: 4.3 (MEDIUM)
References: https://go.dev/cl/709861; https://go.dev/issue/75677; https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI
CVE: CVE-2025-58185
Published: 2025-10-29
Description: Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-770
References: https://go.dev/cl/709856; https://go.dev/issue/75671; https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI
CVE: CVE-2025-58186
Published: 2025-10-29
Description: Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such as "a=;", an attacker can make an HTTP server allocate a large amount of structs, causing large memory consumption.
CVSS Score: 5.3 (MEDIUM)
References: https://go.dev/cl/709855; https://go.dev/issue/75672; https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI
CVE: CVE-2025-58187
Published: 2025-10-29
Description: Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains.
CVSS Score: 7.5 (HIGH)
CWE: CWE-407
References: https://go.dev/cl/709854; https://go.dev/issue/75681; https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI
CVE: CVE-2025-58188
Published: 2025-10-29
Description: Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method. This affects programs which validate arbitrary certificate chains.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: https://go.dev/cl/709853; https://go.dev/issue/75675; https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI
CVE: CVE-2025-58189
Published: 2025-10-29
Description: When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-532
References: https://go.dev/cl/707776; https://go.dev/issue/75652; https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI
CVE: CVE-2025-61723
Published: 2025-10-29
Description: The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which parse untrusted PEM inputs.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://go.dev/cl/709858; https://go.dev/issue/75676; https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI
CVE: CVE-2025-61724
Published: 2025-10-29
Description: The Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. When the number of lines in a response is large, this can cause excessive CPU consumption.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-770
References: https://go.dev/cl/709859; https://go.dev/issue/75716; https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI
CVE: CVE-2025-61725
Published: 2025-10-29
Description: The ParseAddress function constructs domain-literal address components through repeated string concatenation. When parsing large domain-literal components, this can cause excessive CPU consumption.
CVSS Score: 7.5 (HIGH)
References: https://go.dev/cl/709860; https://go.dev/issue/75680; https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI
CVE: CVE-2025-10926
Published: 2025-10-30
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal JSON Field allows Cross-Site Scripting (XSS).This issue affects JSON Field: from 0.0.0 before 1.5.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.drupal.org/sa-contrib-2025-106
CVE: CVE-2025-10927
Published: 2025-10-30
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Plausible tracking allows Cross-Site Scripting (XSS).This issue affects Plausible tracking: from 0.0.0 before 1.0.2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.drupal.org/sa-contrib-2025-107
CVE: CVE-2025-10928
Published: 2025-10-30
Description: Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This issue affects Access code: from 0.0.0 before 2.0.5.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-307
References: https://www.drupal.org/sa-contrib-2025-108
CVE: CVE-2025-10929
Published: 2025-10-30
Description: Improper Validation of Consistency within Input vulnerability in Drupal Reverse Proxy Header allows Manipulating User-Controlled Variables.This issue affects Reverse Proxy Header: from 0.0.0 before 1.1.2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1288
References: https://www.drupal.org/sa-contrib-2025-111
CVE: CVE-2025-10930
Published: 2025-10-30
Description: Cross-Site Request Forgery (CSRF) vulnerability in Drupal Currency allows Cross Site Request Forgery.This issue affects Currency: from 0.0.0 before 3.5.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://www.drupal.org/sa-contrib-2025-110
CVE: CVE-2025-10931
Published: 2025-10-30
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Umami Analytics allows Cross-Site Scripting (XSS).This issue affects Umami Analytics: from 0.0.0 before 1.0.1.
CVSS Score: 3.8 (LOW)
CWE: CWE-79
References: https://www.drupal.org/sa-contrib-2025-109
CVE: CVE-2025-12082
Published: 2025-10-30
Description: Incorrect Authorization vulnerability in Drupal CivicTheme Design System allows Forceful Browsing.This issue affects CivicTheme Design System: from 0.0.0 before 1.12.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: https://www.drupal.org/sa-contrib-2025-112
CVE: CVE-2025-12083
Published: 2025-10-30
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CivicTheme Design System allows Cross-Site Scripting (XSS).This issue affects CivicTheme Design System: from 0.0.0 before 1.12.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.drupal.org/sa-contrib-2025-113
CVE: CVE-2025-12466
Published: 2025-10-30
Description: Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Simple OAuth (OAuth2) & OpenID Connect allows Authentication Bypass.This issue affects Simple OAuth (OAuth2) & OpenID Connect: from 6.0.0 before 6.0.7.
CVSS Score: 7.5 (HIGH)
CWE: CWE-288
References: https://www.drupal.org/sa-contrib-2025-114
CVE: CVE-2025-62257
Published: 2025-10-30
Description: Password enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows remote attackers to determine a user’s password even if account lockout is enabled via brute force attack.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-307
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62257
CVE: CVE-2025-9954
Published: 2025-10-30
Description: Missing Authorization vulnerability in Drupal Acquia DAM allows Forceful Browsing.This issue affects Acquia DAM: from 0.0.0 before 1.1.5.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://www.drupal.org/sa-contrib-2025-105
CVE: CVE-2025-12475
Published: 2025-10-30
Description: The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'blocksy_newsletter_subscribe' shortcode in all versions up to, and including, 2.1.14 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3371878/blocksy-companion/trunk/framework/extensions/newsletter-subscribe/helpers.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/dd13eb67-3bd5-41c4-a47f-5f55656ea5b9?source=cve
CVE: CVE-2025-62231
Published: 2025-10-30
Description: A flaw was identified in the X.Org X server’s X Keyboard (Xkb) extension where improper bounds checking in the XkbSetCompatMap() function can cause an unsigned short overflow. If an attacker sends specially crafted input data, the value calculation may overflow, leading to memory corruption or a crash.
CVSS Score: 7.3 (HIGH)
CWE: CWE-190
References: https://access.redhat.com/errata/RHSA-2025:19432; https://access.redhat.com/errata/RHSA-2025:19433; https://access.redhat.com/errata/RHSA-2025:19434
CVE: CVE-2025-10008
Published: 2025-10-30
Description: The Translate WordPress and go Multilingual – Weglot plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'clean_options' function in all versions up to, and including, 5.1. This makes it possible for unauthenticated attackers to delete limited transients that contain cached plugin options.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/weglot/trunk/src/actions/front/class-clean-options.php#L33; https://plugins.trac.wordpress.org/changeset/3383165/; https://www.wordfence.com/threat-intel/vulnerabilities/id/bb2a8a6f-fe97-4588-a084-64f502a40c51?source=cve
CVE: CVE-2025-10636
Published: 2025-10-30
Description: The NS Maintenance Mode for WP WordPress plugin through 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 3.5 (LOW)
References: https://wpscan.com/vulnerability/a1ab1d82-108e-4f66-9d06-5036cde9678a/