deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-15099
Published: 2025-12-26
Description: A vulnerability was identified in simstudioai sim up to 0.5.27. This vulnerability affects unknown code of the file apps/sim/lib/auth/internal.ts of the component CRON Secret Handler. The manipulation of the argument INTERNAL_API_SECRET leads to improper authentication. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The identifier of the patch is e359dc2946b12ed5e45a0ec9c95ecf91bd18502a. Applying a patch is the recommended action to fix this issue.
CVSS Score: 7.3 (HIGH)
CWE: CWE-287
References: https://gist.github.com/H2u8s/c533741e1b36f6245d41cace89a7f4d2; https://gist.github.com/H2u8s/c533741e1b36f6245d41cace89a7f4d2#-steps-to-reproduce; https://github.com/simstudioai/sim/commit/e359dc2946b12ed5e45a0ec9c95ecf91bd18502a
CVE: CVE-2025-68943
Published: 2025-12-26
Description: Gitea before 1.21.8 inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-497
References: https://blog.gitea.com/release-of-1.21.8-and-1.21.9-and-1.21.10/; https://github.com/go-gitea/gitea/pull/29430; https://github.com/go-gitea/gitea/releases/tag/v1.21.8
CVE: CVE-2025-68944
Published: 2025-12-26
Description: Gitea before 1.22.2 sometimes mishandles the propagation of token scope for access control within one of its own package registries.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-441
References: https://blog.gitea.com/release-of-1.22.2/; https://github.com/go-gitea/gitea/pull/31967; https://github.com/go-gitea/gitea/releases/tag/v1.22.2
CVE: CVE-2025-68945
Published: 2025-12-26
Description: In Gitea before 1.21.2, an anonymous user can visit a private user's project.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-359
References: https://blog.gitea.com/release-of-1.21.2/; https://github.com/go-gitea/gitea/pull/28423; https://github.com/go-gitea/gitea/releases/tag/v1.21.2
CVE: CVE-2025-52598
Published: 2025-12-26
Description: Cybersecurity Nozomi Networks Labs, a specialized security company focused on Industrial Control Systems (ICS) and OT/IoT security, has found a flaw that camera's client service does not perform certificate validation. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds.
CVSS Score: 3.7 (LOW)
CWE: CWE-295
References: https://www.hanwhavision.com/wp-content/uploads/2025/12/Camera-Vulnerability-ReportCVE-2[PII_REDACTED]601-8075.pdf
CVE: CVE-2025-52599
Published: 2025-12-26
Description: Cybersecurity Nozomi Networks Labs, a specialized security company focused on Industrial Control Systems (ICS) and OT/IoT security, has discovered Inadequate of permission management for camera guest account. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-269
References: https://www.hanwhavision.com/wp-content/uploads/2025/12/Camera-Vulnerability-ReportCVE-2[PII_REDACTED]601-8075.pdf
CVE: CVE-2025-52600
Published: 2025-12-26
Description: Cybersecurity Nozomi Networks Labs, a specialized security company focused on Industrial Control Systems (ICS) and OT/IoT security, has discovered a vulnerability in camera video analytics that Improper input validation. This vulnerability could allow an attacker to execute specific commands on the user's host PC.The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: https://www.hanwhavision.com/wp-content/uploads/2025/12/Camera-Vulnerability-ReportCVE-2[PII_REDACTED]601-8075.pdf
CVE: CVE-2025-52601
Published: 2025-12-26
Description: Cybersecurity Nozomi Networks Labs, a specialized security company focused on Industrial Control Systems (ICS) and OT/IoT security, has discovered a vulnerability in Device Manager that a hardcoded encryption key for sensitive information. An attacker can use key to decrypt sensitive information. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds.
CVSS Score: 7.8 (HIGH)
CWE: CWE-321
References: https://www.hanwhavision.com/wp-content/uploads/2025/12/Camera-Vulnerability-ReportCVE-2[PII_REDACTED]601-8075.pdf
CVE: CVE-2025-68946
Published: 2025-12-26
Description: In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://blog.gitea.com/release-of-1.20.1/; https://github.com/go-gitea/gitea/pull/25960; https://github.com/go-gitea/gitea/releases/tag/v1.20.1
CVE: CVE-2025-8075
Published: 2025-12-26
Description: Cybersecurity Nozomi Networks Labs, a specialized security company focused on Industrial Control Systems (ICS) and OT/IoT security, has discovered that validation of incoming XML format request messages is inadequate. This vulnerability could allow an attacker to XSS on the user's browser. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-20, CWE-79
References: https://www.hanwhavision.com/wp-content/uploads/2025/12/Camera-Vulnerability-ReportCVE-2[PII_REDACTED]601-8075.pdf
CVE: CVE-2025-62578
Published: 2025-12-26
Description: DVP-12SE - Modbus/TCP Cleartext Transmission of Sensitive Information
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2025-00021_DVP-12SE%20ModbusTCP%20Cleartext%20Transmission%20of%20Sensitive%20Info.pdf
CVE: CVE-2025-59887
Published: 2025-12-26
Description: Improper authentication of library files in the Eaton UPS Companion software installer could lead to arbitrary code execution of an attacker with the access to the software package.  This security issue has been fixed in the latest version of EUC which is available on the Eaton download center.
CVSS Score: 8.6 (HIGH)
CWE: CWE-427
References: https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2025-1026.pdf
CVE: CVE-2025-59888
Published: 2025-12-26
Description: Improper quotation in search paths in the Eaton UPS Companion software installer could lead to arbitrary code execution of an attacker with the access to the 

file system.  This security issue has been fixed in the latest version of EUC which is available on the Eaton download center.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-428
References: https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2025-1026.pdf
CVE: CVE-2025-67450
Published: 2025-12-26
Description: Due to insecure library loading in the Eaton UPS Companion software executable, an attacker with access to the software package

 could perform arbitrary code execution . This security issue has been fixed in the latest version of EUC which is available on the Eaton download center.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2025-1027.pdf
CVE: CVE-2025-12771
Published: 2025-12-26
Description: IBM Concert 1.0.0 through 2.1.0 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local user could overflow the buffer and execute arbitrary code on the system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://www.ibm.com/support/pages/node/7255549
CVE: CVE-2025-1721
Published: 2025-12-26
Description: IBM Concert 1.0.0 through 2.1.0 could allow a remote attacker to obtain sensitive information from allocated memory due to improper clearing of heap memory.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-244
References: https://www.ibm.com/support/pages/node/7255549
CVE: CVE-2025-13915
Published: 2025-12-26
Description: IBM API Connect 10.0.8.0 through 10.0.8.5, and 10.0.11.0 could allow a remote attacker to bypass authentication mechanisms and gain unauthorized access to the application.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-305
References: https://www.ibm.com/support/pages/node/7255149
CVE: CVE-2025-14687
Published: 2025-12-26
Description: IBM Db2 Intelligence Center 1.1.0, 1.1.1, 1.1.2 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of sever side security mechanisms.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-602
References: https://www.ibm.com/support/pages/node/7255160
CVE: CVE-2025-36192
Published: 2025-12-26
Description: IBM DS8A00( R10.1) 10.10.106.0 and IBM DS8A00 ( R10.0) 10.1.3.010.2.45.0 and IBM DS8900F ( R9.4) 89.40.83.089.42.18.089.44.5.0 IBM System Storage DS8000 could allow a local user with authorized CCW update permissions to delete or corrupt backups due to missing authorization in IBM Safeguarded Copy / GDPS Logical corruption protection mechanisms.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-862
References: https://www.ibm.com/support/pages/node/7255039
CVE: CVE-2025-25341
Published: 2025-12-26
Description: A vulnerability exists in the libxmljs 1.0.11 when parsing a specially crafted XML document. Accessing the internal _ref property on entity_ref and entity_decl nodes causes a segmentation fault, potentially leading to a denial-of-service (DoS).
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/libxmljs/libxmljs/issues/667
CVE: CVE-2025-36228
Published: 2025-12-26
Description: IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 may allow inconsistent permissions between the user interface and backend API allowed users to access features that appeared disabled, potentially leading to misuse.
CVSS Score: 3.8 (LOW)
CWE: CWE-279
References: https://www.ibm.com/support/pages/node/7255331
CVE: CVE-2025-36229
Published: 2025-12-26
Description: IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 could allow authenticated users to enumerate sensitive information of data due by enumerating package identifiers.
CVSS Score: 3.1 (LOW)
CWE: CWE-497
References: https://www.ibm.com/support/pages/node/7255331
CVE: CVE-2025-36230
Published: 2025-12-26
Description: IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-80
References: https://www.ibm.com/support/pages/node/7255331
CVE: CVE-2025-64645
Published: 2025-12-26
Description: IBM Concert 1.0.0 through 2.1.0 could allow a local user to escalate their privileges due to a race condition of a symbolic link.
CVSS Score: 7.7 (HIGH)
CWE: CWE-367
References: https://www.ibm.com/support/pages/node/7255549
CVE: CVE-2025-65885
Published: 2025-12-26
Description: An issue was discovered in the Delight Custom Firmware (CFW) for Nokia Symbian Belle devices on Nokia 808 (Delight v1.8), Nokia N8 (Delight v6.7), Nokia E7 (Delight v1.3), Nokia C7 (Delight v6.7), Nokia 700 (Delight v1.2), Nokia 701 (Delight v1.1), Nokia 603 (Delight v1.0), Nokia 500 (Delight v1.2), Nokia E6 (Delight v1.0), Nokia Oro (Delight v1.0), and Vertu Constellation T (Delight v1.0) allowing local attackers to inject startup scripts via crafted .txt files in the :\Data directory.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-77
References: https://gist.github.com/symbuzzer/3315e88adc2bba0b6cc66d192b49546d; https://www.symwld.com/delight/
CVE: CVE-2025-66947
Published: 2025-12-26
Description: SQL injection vulnerability in krishanmuraiji SMS v.1.0, within the /studentms/admin/edit-class-detail.php via the editid GET parameter. An attacker can trigger controlled delays using SQL SLEEP() to infer database contents. Successful exploitation may lead to full database compromise, especially within an administrative module.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/kabir0104k/CVE-2025-66947/blob/main/README.md
CVE: CVE-2025-67349
Published: 2025-12-26
Description: A cross-site scripting (XSS) vulnerability was identified in FluentCMS 1.2.3. After logging in as an admin and navigating to the "Add Page" function, the application fails to properly sanitize input in the <head> section, allowing remote attackers to inject arbitrary script tags.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/eoniboogie/CVE_Disclosures/blob/main/CVE-2025-67349/CVE-2025-67349.md; https://github.com/fluentcms/FluentCMS/issues/2403
CVE: CVE-2024-29720
Published: 2025-12-26
Description: An issue in Terra Informatica Software, Inc Sciter v.4.4.7.0 allows a local attacker to obtain sensitive information via the adopt component of the Sciter video rendering function.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://github.com/sciter-sdk/rust-sciter/issues/143
CVE: CVE-2025-13158
Published: 2025-12-26
Description: Prototype pollution vulnerability in apidoc-core versions 0.2.0 and all subsequent versions allows remote attackers to modify JavaScript object prototypes via malformed data structures, including the “define” property processed by the application, potentially leading to denial of service or unintended behavior in applications relying on the integrity of prototype chains. This affects the preProcess() function in api_group.js, api_param_title.js, api_use.js, and api_permission.js worker modules.
CWE: CWE-1321
References: https://www.sonatype.com/security-advisories/cve-2025-13158
CVE: CVE-2025-57403
Published: 2025-12-26
Description: Cola Dnslog v1.3.2 is vulnerable to Directory Traversal. When a DNS query for a TXT record is processed, the application concatenates the requested URL (or a portion of it) directly with a base path using os.path.join. This bypass allows directory traversal or absolute path injection, leading to the potential exposure of sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-23
References: https://gist.github.com/Captaince/99b728c792c72b2666c[PII_REDACTED]df0; https://github.com/AbelChe/cola_dnslog/issues/29
CVE: CVE-2025-66738
Published: 2025-12-26
Description: An issue in Yealink T21P_E2 Phone 52.84.0.15 allows a remote normal privileged attacker to execute arbitrary code via a crafted request the ping function of the diagnostic component.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: http://yealink.com; https://drive.google.com/file/d/13t5ywSPJMx4487njJcH3ZTNuc_k3h4ty/view?usp=sharing
CVE: CVE-2025-67013
Published: 2025-12-26
Description: The web management interface in ETL Systems Ltd DEXTRA Series ' Digital L-Band Distribution System v1.8 does not implement Cross-Site Request Forgery (CSRF) protection mechanisms (no tokens, no Origin/Referer validation) on critical configuration endpoints.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-67013%20_%20ETL%20Systems%20Ltd%20DEXTRA%20Series%20_%20CSRF; https://www.etlsystems.com/
CVE: CVE-2025-67014
Published: 2025-12-26
Description: Incorrect access control in DEV Systemtechnik GmbH DEV 7113 RF over Fiber Distribution System 32-0078 H.01 allows unauthenticated attackers to access an administrative endpoint.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://dev-systemtechnik.com; https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-67014%20_%20DEV%20Systemtechnik%20GmbH%20DEV%207113%20RF%20over%20_%20Broken%20Access%20Control
CVE: CVE-2025-67015
Published: 2025-12-26
Description: Incorrect access control in Comtech EF Data CDM-625 / CDM-625A Advanced Satellite Modem with firmware v2.5.1 allows attackers to change the Administrator password and escalate privileges via sending a crafted POST request to /Forms/admin_access_1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-67015%20_%20Comtech%20EF%20Data%20CDM-625%20_%20CDM-625A%20Advanced%20_%20Broken%20Access%20Control; https://www.comtechefdata.com/
CVE: CVE-2024-42718
Published: 2025-12-26
Description: A path traversal vulnerability in Croogo CMS 4.0.7 allows remote attackers to read arbitrary files via a specially crafted path in the 'edit-file' parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/croogo/croogo; https://github.com/jacopo1223/jacopo.github/tree/main/CVE-2024-42718
CVE: CVE-2024-44065
Published: 2025-12-26
Description: Time-based blind SQL Injection vulnerability in Cloudlog v2.6.15 at the endpoint /index.php/logbookadvanced/search in the qsoresults parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/jacopo1223/jacopo.github/tree/main/CVE-2024-44065; https://github.com/magicbug/Cloudlog
CVE: CVE-2025-66737
Published: 2025-12-26
Description: Yealink T21P_E2 Phone 52.84.0.15 is vulnerable to Directory Traversal. A remote normal privileged attacker can read arbitrary files via a crafted request result read function of the diagnostic component.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-23
References: http://yealink.com; https://drive.google.com/file/d/1MpxnCL4koKupqWWDmY3ljlybjIPD8ieD/view?usp=sharing
CVE: CVE-2025-61914
Published: 2025-12-26
Description: n8n is an open source workflow automation platform. Prior to version 1.114.0, a stored Cross-Site Scripting (XSS) vulnerability may occur in n8n when using the “Respond to Webhook” node. When this node responds with HTML content containing executable scripts, the payload may execute directly in the top-level window, rather than within the expected sandbox introduced in version 1.103.0. This behavior can enable a malicious actor with workflow creation permissions to execute arbitrary JavaScript in the context of the n8n editor interface. This issue has been patched in version 1.114.0. Workarounds for this issue involve restricting workflow creation and modification privileges to trusted users only, avoiding use of untrusted HTML responses in the “Respond to Webhook” node, and using an external reverse proxy or HTML sanitizer to filter responses that include executable scripts.
CVSS Score: 7.3 (HIGH)
CWE: CWE-79
References: https://github.com/n8n-io/n8n/security/advisories/GHSA-58jc-rcg5-95f3
CVE: CVE-2025-67729
Published: 2025-12-26
Description: LMDeploy is a toolkit for compressing, deploying, and serving LLMs. Prior to version 0.11.1, an insecure deserialization vulnerability exists in lmdeploy where torch.load() is called without the weights_only=True parameter when loading model checkpoint files. This allows an attacker to execute arbitrary code on the victim's machine when they load a malicious .bin or .pt model file. This issue has been patched in version 0.11.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://github.com/InternLM/lmdeploy/commit/eb04b4281c5784a5cff5ea639c8f96b33b3ae5ee; https://github.com/InternLM/lmdeploy/security/advisories/GHSA-9pf3-7rrr-x5jh; https://github.com/InternLM/lmdeploy/security/advisories/GHSA-9pf3-7rrr-x5jh
CVE: CVE-2025-68668
Published: 2025-12-26
Description: n8n is an open source workflow automation platform. From version 1.0.0 to before 2.0.0, a sandbox bypass vulnerability exists in the Python Code Node that uses Pyodide. An authenticated user with permission to create or modify workflows can exploit this vulnerability to execute arbitrary commands on the host system running n8n, using the same privileges as the n8n process. This issue has been patched in version 2.0.0. Workarounds for this issue involve disabling the Code Node by setting the environment variable NODES_EXCLUDE: "[\"n8n-nodes-base.code\"]", disabling Python support in the Code node by setting the environment variable N8N_PYTHON_ENABLED=false, which was introduced in n8n version 1.104.0, and configuring n8n to use the task runner based Python sandbox via the N8N_RUNNERS_ENABLED and N8N_NATIVE_PYTHON_RUNNER environment variables.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-693
References: https://github.com/n8n-io/n8n/security/advisories/GHSA-62r4-hw23-cc8v; https://www.smartkeyss.com/post/cve-2025-68668-breaking-out-of-the-python-sandbox-in-n8n
CVE: CVE-2025-68697
Published: 2025-12-26
Description: n8n is an open source workflow automation platform. Prior to version 2.0.0, in self-hosted n8n instances where the Code node runs in legacy (non-task-runner) JavaScript execution mode, authenticated users with workflow editing access can invoke internal helper functions from within the Code node. This allows a workflow editor to perform actions on the n8n host with the same privileges as the n8n process, including: reading files from the host filesystem (subject to any file-access restrictions configured on the instance and OS/container permissions), and writing files to the host filesystem (subject to the same restrictions). This issue has been patched in version 2.0.0. Workarounds for this issue involve limiting file operations by setting N8N_RESTRICT_FILE_ACCESS_TO to a dedicated directory (e.g., ~/.n8n-files) and ensure it contains no sensitive data, keeping N8N_BLOCK_FILE_ACCESS_TO_N8N_FILES=true (default) to block access to .n8n and user-defined config files, and disabling high-risk nodes (including the Code node) using NODES_EXCLUDE if workflow editors are not fully trusted.
CVSS Score: 7.1 (HIGH)
CWE: CWE-269, CWE-749
References: https://github.com/n8n-io/n8n/security/advisories/GHSA-j4p8-h8mh-rh8q
CVE: CVE-2025-66203
Published: 2025-12-27
Description: StreamVault is a video download integration solution. Prior to version 251126, a Remote Code Execution (RCE) vulnerability exists in the stream-vault application (SpiritApplication). The application allows administrators to configure yt-dlp arguments via the /admin/api/saveConfig endpoint without sufficient validation. These arguments are stored globally and subsequently used in YtDlpUtil.java when constructing the command line to execute yt-dlp. This issue has been patched in version 251126.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-78
References: https://github.com/lemon8866/StreamVault/releases/tag/251226; https://github.com/lemon8866/StreamVault/security/advisories/GHSA-c747-q388-3v6m
CVE: CVE-2025-68148
Published: 2025-12-27
Description: FreshRSS is a free, self-hostable RSS aggregator. From version 1.27.0 to before 1.28.0, An attacker could globally deny access to feeds via proxy modifying to 429 Retry-After for a large list of feeds on given instance, making it unusable for majority of users. This issue has been patched in version 1.28.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-770
References: https://github.com/FreshRSS/FreshRSS/commit/7d4854a0a4f5665db599f18c[PII_REDACTED]5639f3; https://github.com/FreshRSS/FreshRSS/pull/8029; https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-qw34-frg7-gf78
CVE: CVE-2025-68473
Published: 2025-12-27
Description: ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, in the ESP-IDF Bluetooth host stack (BlueDroid), the function bta_dm_sdp_result() used a fixed-size array uuid_list[32][MAX_UUID_SIZE] to store discovered service UUIDs during the SDP (Service Discovery Protocol) process. On modern Bluetooth devices, it is possible for the number of available services to exceed this fixed limit (32). In such cases, if more than 32 services are discovered, subsequent writes to uuid_list could exceed the bounds of the array, resulting in a potential out-of-bounds write condition.
CVSS Score: 8.6 (HIGH)
CWE: CWE-787
References: https://github.com/espressif/esp-idf/commit/3286e45349b0b5c2b1422ef7e8d088b95eef895d; https://github.com/espressif/esp-idf/commit/4d928f2265c394d2abc85024228e920a5b26bcab; https://github.com/espressif/esp-idf/commit/5b3185168dae83d42aa[PII_REDACTED]fffd931f16c