deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-58712
Published: 2025-10-22
Description: A container privilege escalation flaw was found in certain AMQ Broker images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-276
References: https://access.redhat.com/errata/RHSA-2025:17562; https://access.redhat.com/security/cve/CVE-2025-58712; https://bugzilla.redhat.com/show_bug.cgi?id=2394418
CVE: CVE-2025-62248
Published: 2025-10-22
Description: A  reflected cross-site scripting (XSS) vulnerability, resulting from a regression, has been identified in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 allows a remote, authenticated attacker to inject and execute JavaScript code via the _com_liferay_dynamic_data_mapping_web_portlet_DDMPortlet_definition parameter. The malicious payload is executed within the victim's browser when they access a URL that includes the crafted parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62248
CVE: CVE-2025-62247
Published: 2025-10-22
Description: Missing Authorization in Collection Provider component in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 allows instance users to read and select unauthorized Blueprints through the Collection Providers across instances.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62247
CVE: CVE-2025-62513
Published: 2025-10-22
Description: OpenBao is an open source identity-based secrets management system. In versions 2.2.0 to 2.4.1, OpenBao's audit log experienced a regression wherein raw HTTP bodies used by few endpoints were not correctly redacted (HMAC'd). This impacts those using the ACME functionality of PKI, resulting in short-lived ACME verification challenge codes being leaked in the audit logs. Additionally, this impacts those using the OIDC issuer functionality of the identity subsystem, auth and token response codes along with claims could be leaked in the audit logs. ACME verification codes are not usable after verification or challenge expiry so are of limited long-term use. This issue has been patched in OpenBao 2.4.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-532
References: https://github.com/openbao/openbao/commit/cc2c476bac66e1d94776c2629793daec3af625f8; https://github.com/openbao/openbao/security/advisories/GHSA-ghfh-fmx4-26h8
CVE: CVE-2025-62610
Published: 2025-10-22
Description: Hono is a Web application framework that provides support for any JavaScript runtime. In versions from 1.1.0 to before 4.10.2, Hono’s JWT Auth Middleware does not provide a built-in aud (Audience) verification option, which can cause confused-deputy / token-mix-up issues: an API may accept a valid token that was issued for a different audience (e.g., another service) when multiple services share the same issuer/keys. This can lead to unintended cross-service access. Hono’s docs list verification options for iss/nbf/iat/exp only, with no aud support; RFC 7519 requires that when an aud claim is present, tokens MUST be rejected unless the processing party identifies itself in that claim. This issue has been patched in version 4.10.2.
CVSS Score: 8.1 (HIGH)
CWE: CWE-285
References: https://github.com/honojs/hono/commit/45ba3bf9e3dff8e4bd85d6b47d4b71c8d6c66bef; https://github.com/honojs/hono/security/advisories/GHSA-m732-5p4w-x69g
CVE: CVE-2025-62611
Published: 2025-10-22
Description: aiomysql is a library for accessing a MySQL database from the asyncio. Prior to version 0.3.0, the client-side settings are not checked before sending local files to MySQL server, which allows obtaining arbitrary files from the client using a rogue server. It is possible to create a rogue MySQL server that emulates authorization, ignores client flags and requests arbitrary files from the client by sending a LOAD_LOCAL instruction packet. This issue has been patched in version 0.3.0.
CWE: CWE-73
References: https://github.com/aio-libs/aiomysql/commit/32c4520dae3711367ded74a4726dcb8bb8919538; https://github.com/aio-libs/aiomysql/pull/1044; https://github.com/aio-libs/aiomysql/security/advisories/GHSA-r397-ff8c-wv2g
CVE: CVE-2025-62612
Published: 2025-10-22
Description: FastGPT is an AI Agent building platform. Prior to version 4.11.1, in the workflow file reading node, the network link is not security-verified, posing a risk of SSRF attacks. This issue has been patched in version 4.11.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918
References: https://github.com/labring/FastGPT/security/advisories/GHSA-573g-3567-8phg
CVE: CVE-2025-62613
Published: 2025-10-22
Description: VDO.Ninja is a tool that brings remote video feeds into OBS or other studio software via WebRTC. From versions 28.0 to before 28.4, a reflected Cross-Site Scripting (XSS) vulnerability exists on examples/control.html through the room parameter, which is improperly sanitized before being rendered in the DOM. The application fails to validate and encode user input, allowing malicious scripts to be injected and executed. This issue has been patched in version 28.4.
CWE: CWE-79
References: https://github.com/steveseguin/vdo.ninja/commit/83c0ac753ad60c7a086daced3244688cabd4f6b8; https://github.com/steveseguin/vdo.ninja/releases/tag/v28.4; https://github.com/steveseguin/vdo.ninja/security/advisories/GHSA-mp9c-cpch-x73c
CVE: CVE-2025-62614
Published: 2025-10-22
Description: BookLore is a self-hosted web app for organizing and managing personal book collections. In versions 1.8.1 and prior, an authentication bypass vulnerability in the BookMediaController allows any unauthenticated user to access and download book covers, thumbnails, and complete PDF/CBX page content without authorization. The vulnerability exists because multiple media endpoints lack proper access control annotations, and the CoverJwtFilter continues request processing even when no authentication token is provided. This enables attackers to enumerate and exfiltrate all book content from the system, bypassing the intended download permissions (canDownload) entirely. This issue has been patched via commit b226c43.
CWE: CWE-862
References: https://github.com/booklore-app/booklore/commit/b226c43343cd0cef4c1cd54bc3dcdef90b147133; https://github.com/booklore-app/booklore/security/advisories/GHSA-363g-fhcq-hvqp
CVE: CVE-2025-62617
Published: 2025-10-22
Description: Admidio is an open-source user management solution. Prior to version 4.3.17, an authenticated SQL injection vulnerability exists in the member assignment data retrieval functionality of Admidio. Any authenticated user with permissions to assign members to a role (such as an administrator) can exploit this vulnerability to execute arbitrary SQL commands. This can lead to a full compromise of the application's database, including reading, modifying, or deleting all data. This issue has been patched in version 4.3.17.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/Admidio/admidio/commit/fde81ae869e88a3cf42201f2548d57df785a37cb; https://github.com/Admidio/admidio/security/advisories/GHSA-2v5m-cq9w-fc33
CVE: CVE-2025-62705
Published: 2025-10-22
Description: OpenBao is an open source identity-based secrets management system. Prior to version 2.4.2, OpenBao's audit log did not appropriately redact fields when relevant subsystems sent []byte response parameters rather than strings. This includes, but is not limited to sys/raw with use of encoding=base64, all data would be emitted unredacted to the audit log, and Transit, when performing a signing operation with a derived Ed25519 key, would emit public keys to the audit log. This issue has been patched in OpenBao 2.4.2.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-532
References: https://github.com/openbao/openbao/commit/cc2c476bac66e1d94776c2629793daec3af625f8; https://github.com/openbao/openbao/security/advisories/GHSA-rc54-2g2c-g36g
CVE: CVE-2025-62706
Published: 2025-10-22
Description: Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.5, Authlib’s JWE zip=DEF path performs unbounded DEFLATE decompression. A very small ciphertext can expand into tens or hundreds of megabytes on decrypt, allowing an attacker who can supply decryptable tokens to exhaust memory and CPU and cause denial of service. This issue has been patched in version 1.6.5. Workarounds for this issue involve rejecting or stripping zip=DEF for inbound JWEs at the application boundary, forking and add a bounded decompression guard via decompressobj().decompress(data, MAX_SIZE)) and returning an error when output exceeds a safe limit, or enforcing strict maximum token sizes and fail fast on oversized inputs; combine with rate limiting.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400, CWE-770
References: https://github.com/authlib/authlib/commit/e0863d5129316b1790eee5f14cece32a03b8184d; https://github.com/authlib/authlib/security/advisories/GHSA-g7f3-828f-7h7m; https://lists.debian.org/debian-lts-announce/2025/10/msg00032.html
CVE: CVE-2025-62707
Published: 2025-10-22
Description: pypdf is a free and open-source pure-python PDF library. Prior to version 6.1.3, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page which has an inline image using the DCTDecode filter. This has been fixed in pypdf version 6.1.3.
CVSS Score: 7.5 (HIGH)
CWE: CWE-834
References: https://github.com/py-pdf/pypdf/commit/f2864d6dd9bac7cecd3f4f54308b25ebbfa178f8; https://github.com/py-pdf/pypdf/pull/3501; https://github.com/py-pdf/pypdf/releases/tag/6.1.3
CVE: CVE-2025-62708
Published: 2025-10-22
Description: pypdf is a free and open-source pure-python PDF library. Prior to version 6.1.3, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the content stream of a page using the LZWDecode filter. This has been fixed in pypdf version 6.1.3.
CVSS Score: 7.5 (HIGH)
CWE: CWE-409
References: https://github.com/py-pdf/pypdf/commit/e51d07807ffcdaf18077b9486dadb3dc05b368da; https://github.com/py-pdf/pypdf/pull/3502; https://github.com/py-pdf/pypdf/releases/tag/6.1.3
CVE: CVE-2025-62710
Published: 2025-10-22
Description: Sakai is a Collaboration and Learning Environment. Prior to versions 23.5 and 25.0, EncryptionUtilityServiceImpl initialized an AES256TextEncryptor password (serverSecretKey) using RandomStringUtils with the default java.util.Random. java.util.Random is a non‑cryptographic PRNG and can be predicted from limited state/seed information (e.g., start time window), substantially reducing the effective search space of the generated key. An attacker who can obtain ciphertexts (e.g., exported or at‑rest strings protected by this service) and approximate the PRNG seed can feasibly reconstruct the serverSecretKey and decrypt affected data. SAK-49866 is patched in Sakai 23.5, 25.0, and trunk.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-337
References: https://github.com/sakaiproject/sakai/commit/bde070104b1de01f4a6458dca6d9e0880a0e3c04; https://github.com/sakaiproject/sakai/security/advisories/GHSA-gr7h-xw4f-wh86
CVE: CVE-2025-11575
Published: 2025-10-23
Description: Incorrect Default Permissions vulnerability in MongoDB Atlas SQL ODBC driver on Windows allows Privilege Escalation.This issue affects MongoDB Atlas SQL ODBC driver: from 1.0.0 through 2.0.0.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://www.mongodb.com/docs/atlas/release-notes/sql/
CVE: CVE-2025-12104
Published: 2025-10-23
Description: Outdated and Vulnerable UI Dependencies might potentially lead to exploitation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1104
References: https://azure-access.com/security-advisories
CVE: CVE-2025-35981
Published: 2025-10-23
Description: Exposure of Private Personal Information to an Unauthorized Actor (CWE-359) in the Command Centre Server allows a privileged Operator to view limited personal data about a Cardholder they would not normally have permissions to view. 

This issue affects Command Centre Server: 9.30.1874 (MR1), 9.20.2337 (MR3), 9.10.3194 (MR6).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-359
References: https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2025-35981
CVE: CVE-2025-41402
Published: 2025-10-23
Description: Client-Side Enforcement of Server-Side Security (CWE-602) in the Command Centre Server allows a privileged operator to enter invalid competency data, bypassing expiry checks. 

This issue affects Command Centre Server: 

 9.30 prior to vEL9.30.2482 (MR2), 9.20 prior to vEL9.20.2819 (MR4), 9.10 prior to vEL9.10.3672 (MR7), all versions of 9.00 and prior.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-602
References: https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2025-41402
CVE: CVE-2025-47699
Published: 2025-10-23
Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497) in the Gallagher Morpho integration could allow an authenticated operator with limited site permissions to make critical changes to local Morpho devices. 

This issue affects Command Centre Server:

9.30 prior to vEL9.30.2482 (MR2), 9.20 prior to vEL9.20.2819 (MR4), 9.10 prior to vEL9.10.3672 (MR7), 9.00 prior to vEL9.00.3831 (MR8), all versions of 8.90 and prior.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-497
References: https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2025-47699
CVE: CVE-2025-48428
Published: 2025-10-23
Description: Cleartext Storage of Sensitive Information (CWE-312) in the Gallagher Morpho integration could allow an authenticated user with access to the Command Centre Server to export a specific signing key while in use allowing them to deploy a compromised or counterfeit device on that site. 
This issue affects Command Centre Server: 9.20 prior to vEL9.20.2819 (MR4), 9.10 prior to vEL9.10.3672 (MR7), 9.00 prior to vEL9.00.3831 (MR8), all versions of 8.90 and prior.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-312
References: https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2025-48428
CVE: CVE-2025-48430
Published: 2025-10-23
Description: Uncaught Exception (CWE-248) in the Command Centre Server allows an Authorized and Privileged Operator to crash the Command Centre Server at will.

This issue affects Command Centre Server: 

9.30 prior to vEL9.30.2482 (MR2), 9.20 prior to vEL9.20.2819 (MR4), 9.10 prior to vEL9.10.3672 (MR7), 9.00 prior to vEL9.00.3831 (MR8), all versions of 8.90 and prior.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-248
References: https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2025-48430
CVE: CVE-2025-62813
Published: 2025-10-23
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2025-62820
Published: 2025-10-23
Description: Slack Nebula before 1.9.7 mishandles CIDR in some configurations and thus accepts arbitrary source IP addresses within the Nebula network.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-420
References: https://github.com/slackhq/nebula/pull/1493; https://github.com/slackhq/nebula/pull/1494
CVE: CVE-2025-54806
Published: 2025-10-23
Description: GROWI v4.2.7 and earlier contains a cross-site scripting vulnerability  in the page alert function. If a user accesses a crafted URL while logged in to the affected product, an arbitrary script may be executed on the user's web browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://growi.co.jp/news/38/; https://jvn.jp/en/jp/JVN46526244/
CVE: CVE-2025-54856
Published: 2025-10-23
Description: Movable Type contains a stored cross-site scripting vulnerability in Edit ContentData page. If crafted input is stored by an attacker with "ContentType Management" privilege, an arbitrary script may be executed on the web browser of the user who accesses Edit ContentData page.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN24333679/; https://movabletype.org/news/2025/10/mt-880-released.html; https://www.sixapart.jp/movabletype/news/2025/10/22-1055.html
CVE: CVE-2025-61865
Published: 2025-10-23
Description: Multiple NAS management applications provided by I-O DATA DEVICE, INC. register Windows services with unquoted file paths. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-428
References: https://jvn.jp/en/jp/JVN03295012/; https://www.iodata.jp/support/information/2025/10_NarSuS_App/; https://www.iodata.jp/support/information/2025/12_CloneforWindows/
CVE: CVE-2025-62499
Published: 2025-10-23
Description: Movable Type contains a stored cross-site scripting vulnerability in Edit CategorySet of ContentType page. If crafted input is stored by an attacker with "ContentType Management" privilege, an arbitrary script may be executed on the web browser of the user who accesses Edit CategorySet of ContentType page.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN24333679/; https://movabletype.org/news/2025/10/mt-880-released.html; https://www.sixapart.jp/movabletype/news/2025/10/22-1055.html
CVE: CVE-2025-10727
Published: 2025-10-23
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ArkSigner Software and Hardware Inc. AcBakImzala allows Reflected XSS.This issue affects AcBakImzala: before v5.1.4.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.usom.gov.tr/bildirim/tr-25-0356
CVE: CVE-2025-10914
Published: 2025-10-23
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Proliz Software Ltd. Co. OBS (Student Affairs Information System) allows Reflected XSS.This issue affects OBS (Student Affairs Information System): before V26.0401.
CVSS Score: 7.6 (HIGH)
CWE: CWE-79
References: https://www.usom.gov.tr/bildirim/tr-25-0357
CVE: CVE-2025-12105
Published: 2025-10-23
Description: A flaw was found in the asynchronous message queue handling of the libsoup library, widely used by GNOME and WebKit-based applications to manage HTTP/2 communications. When network operations are aborted at specific timing intervals, an internal message queue item may be freed twice due to missing state synchronization. This leads to a use-after-free memory access, potentially crashing the affected application. Attackers could exploit this behavior remotely by triggering specific HTTP/2 read and cancel sequences, resulting in a denial-of-service condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://access.redhat.com/errata/RHSA-2025:23139; https://access.redhat.com/errata/RHSA-2025:23437; https://access.redhat.com/security/cve/CVE-2025-12105
CVE: CVE-2025-9980
Published: 2025-10-23
Description: QuickCMS is vulnerable to multiple Stored XSS in page editor functionality (pages-form). Malicious attacker with admin privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. By default admin user is not able to add JavaScript into the website.

The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://cert.pl/posts/2025/10/CVE-2025-9980; https://opensolution.org/cms-system-quick-cms.html
CVE: CVE-2025-9981
Published: 2025-10-23
Description: QuickCMS is vulnerable to multiple Stored XSS in slider editor functionality (sliders-form). Malicious attacker with admin privileges can inject arbitrary HTML and JS into website, which will be rendered/executed on every page. By default admin user is not able to add JavaScript into the website.

The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://cert.pl/posts/2025/10/CVE-2025-9980; https://opensolution.org/cms-system-quick-cms.html
CVE: CVE-2025-40643
Published: 2025-10-23
Description: Stored Cross-Site Scripting (XSS) vulnerability in Energy CRM v2025 by Status Tracker Ltd, consisting of a stored XSS due to lack of proper validation of user input by sending a POST request to “/crm/create_job_submit.php”, using the “JobCreatedBy” parameter. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their cookie session details.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-energy-crm-status-tracker
CVE: CVE-2025-41073
Published: 2025-10-23
Description: Path Traversal vulnerability in version 4.4.2236.1 of TESI Gandia Integra Total. This issue allows an authenticated attacker to download a ZIP file containing files from the server, including those located in parent directories (e.g., ..\..\..), by exploiting the “direstudio” parameter in “/encuestas/integraweb[_v4]/integra/html/view/comprimir.php”.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://www.incibe.es/en/incibe-cert/notices/aviso/path-traversal-gandia-integra-total-tesi
CVE: CVE-2024-14011
Published: 2025-10-23
Description: Rejected reason: This is a duplicate.
CVE: CVE-2025-10355
Published: 2025-10-23
Description: Open redirection vulnerability in MOLGENIS EMX2 v11.14.0. This vulnerability allows an attacker to create a malicious URL using a manipulated redirection parameter, potentially leading users to phishing sites or other malicious destinations via “/%2f%2f<MALICIOUS_DOMAIN>”.
CWE: CWE-601
References: https://www.incibe.es/en/incibe-cert/notices/aviso/open-redirection-vulnerability-molgenis-emx2
CVE: CVE-2025-62393
Published: 2025-10-23
Description: A flaw was found in the course overview output function where user access permissions were not fully enforced. This could allow unauthorized users to view information about courses they should not have access to, potentially exposing limited course details.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://access.redhat.com/security/cve/CVE-2025-62393; https://bugzilla.redhat.com/show_bug.cgi?id=2404426; https://moodle.org/mod/forum/discuss.php?d=470381
CVE: CVE-2025-62394
Published: 2025-10-23
Description: Moodle failed to verify enrolment status correctly when sending quiz notifications. As a result, suspended or inactive users might receive quiz-related messages, leaking limited course information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://access.redhat.com/security/cve/CVE-2025-62394; https://bugzilla.redhat.com/show_bug.cgi?id=2404427
CVE: CVE-2025-62395
Published: 2025-10-23
Description: A flaw in the cohort search web service allowed users with permissions in lower contexts to access cohort information from the system context, revealing restricted administrative data.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://access.redhat.com/security/cve/CVE-2025-62395; https://bugzilla.redhat.com/show_bug.cgi?id=2404428