deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-6536
Published: 2025-06-24
Description: A vulnerability has been found in Tarantool up to 3.3.1 and classified as problematic. Affected by this vulnerability is the function tm_to_datetime in the library src/lib/core/datetime.c. The manipulation leads to reachable assertion. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.3 (LOW)
CWE: CWE-617
References: https://github.com/tarantool/tarantool/issues/11347; https://github.com/user-attachments/files/19613858/tarantool_crash.txt; https://vuldb.com/?ctiid.313663
CVE: CVE-2025-6551
Published: 2025-06-24
Description: A vulnerability was found in java-aodeng Hope-Boot 1.0.0 and classified as problematic. This issue affects the function Login of the file /src/main/java/com/hope/controller/WebController.java. The manipulation of the argument errorMsg leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250613-01/report.md; https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250613-01/report.md#steps-to-reproduce; https://vuldb.com/?ctiid.313691
CVE: CVE-2025-48461
Published: 2025-06-24
Description: Successful exploitation of the vulnerability could allow an unauthenticated attacker to conduct brute force guessing and account takeover as the session cookies are predictable, potentially allowing the attackers to gain root, admin or user access and reset passwords.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-341
References: https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-061/
CVE: CVE-2025-48462
Published: 2025-06-24
Description: Successful exploitation of the vulnerability could allow an attacker to consume all available session slots and block other users from logging in, thereby preventing legitimate users from gaining access to the product.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-770
References: https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-061
CVE: CVE-2025-48463
Published: 2025-06-24
Description: Successful exploitation of the vulnerability could allow an attacker to intercept data and conduct session hijacking on the exposed data as the vulnerable product uses unencrypted HTTP communication, potentially leading to unauthorised access or data tampering.
CVSS Score: 3.1 (LOW)
CWE: CWE-312
References: https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-061
CVE: CVE-2025-48466
Published: 2025-06-24
Description: Successful exploitation of the vulnerability could allow an unauthenticated, remote attacker to send Modbus TCP packets to manipulate Digital Outputs, potentially allowing remote control of relay channel which may lead to operational or safety risks.
CVSS Score: 8.1 (HIGH)
CWE: CWE-863
References: https://github.com/shipcod3/CVE-2025-48466; https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-061
CVE: CVE-2025-48467
Published: 2025-06-24
Description: Successful exploitation of the vulnerability could allow an attacker to cause repeated reboots, potentially leading to remote denial-of-service and system unavailability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-061
CVE: CVE-2025-48468
Published: 2025-06-24
Description: Successful exploitation of the vulnerability could allow an attacker that has physical access to interface with JTAG to inject or modify firmware.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-1191
References: https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-061
CVE: CVE-2025-48469
Published: 2025-06-24
Description: Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload firmware through a public update page, potentially leading to backdoor installation or privilege escalation.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-306
References: https://jro.sg/CVEs/CVE-2025-48469/; https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-061/
CVE: CVE-2025-48470
Published: 2025-06-24
Description: Successful exploitation of the stored cross-site scripting vulnerability could allow an attacker to inject malicious scripts into device fields and executed in other users’ browser, potentially leading to session hijacking, defacement, credential theft, or privilege escalation.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-79
References: https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-061
CVE: CVE-2025-52560
Published: 2025-06-24
Description: Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.46, Kanboard allows password reset emails to be sent with URLs derived from the unvalidated Host header when the application_url configuration is unset (default behavior). This allows an attacker to craft a malicious password reset link that leaks the token to an attacker-controlled domain. If a victim (including an administrator) clicks the poisoned link, their account can be taken over. This affects all users who initiate a password reset while application_url is not set. This issue has been patched in version 1.2.46.
CVSS Score: 8.1 (HIGH)
CWE: CWE-640
References: https://github.com/kanboard/kanboard/commit/bca2bd7ab95e7990e358fd35a7daf51a9c16aa75; https://github.com/kanboard/kanboard/security/advisories/GHSA-2ch5-gqjm-8p92
CVE: CVE-2025-52574
Published: 2025-06-24
Description: SysmonElixir is a system monitor HTTP service in Elixir. Prior to version 1.0.1, the /read endpoint reads any file from the server's /etc/passwd by default. In v1.0.1, a whitelist was added that limits reading to only files under priv/data. This issue has been patched in version 1.0.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/bocaletto-luca/elixir-system-monitor/commit/647a5525f6667a28f[PII_REDACTED]dd080ea11bb87; https://github.com/bocaletto-luca/elixir-system-monitor/security/advisories/GHSA-9vj4-rv7q-36qj
CVE: CVE-2025-6552
Published: 2025-06-24
Description: A vulnerability was found in java-aodeng Hope-Boot 1.0.0. It has been classified as problematic. Affected is the function doLogin of the file /src/main/java/com/hope/controller/WebController.java of the component Login. The manipulation of the argument redirect_url leads to open redirect. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-601
References: https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250613-02.md; https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250613-02.md#steps-to-reproduce; https://vuldb.com/?ctiid.313692
CVE: CVE-2025-6559
Published: 2025-06-24
Description: Multiple wireless router models from Sapido have an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server. The affected models are out of support; replacing the device is recommended.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.twcert.org.tw/en/cp-139-10195-69da1-2.html; https://www.twcert.org.tw/tw/cp-132-10196-898d3-1.html
CVE: CVE-2025-6560
Published: 2025-06-24
Description: Multiple wireless router models from Sapido have an Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to directly access a system configuration file and obtain plaintext administrator credentials. 

The affected models are out of support; replacing the device is recommended.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-256
References: https://www.twcert.org.tw/en/cp-139-10198-55217-2.html; https://www.twcert.org.tw/tw/cp-132-10197-524ea-1.html
CVE: CVE-2024-56731
Published: 2025-06-24
Description: Gogs is an open source self-hosted Git service. Prior to version 0.13.3, it's still possible to delete files under the .git directory and achieve remote command execution due to an insufficient patch for CVE-2024-39931. Unprivileged user accounts can execute arbitrary commands on the Gogs instance with the privileges of the account specified by RUN_USER in the configuration. Allowing attackers to access and alter any users' code hosted on the same instance. This issue has been patched in version 0.13.3.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-552
References: https://github.com/gogs/gogs/commit/77a4a945ae9a87f77e392e9066b560edb71b5de9; https://github.com/gogs/gogs/releases/tag/v0.13.3; https://github.com/gogs/gogs/security/advisories/GHSA-wj44-9vcg-wjq7
CVE: CVE-2025-47943
Published: 2025-06-24
Description: Gogs is an open source self-hosted Git service. In application version 0.14.0+dev and prior, there is a stored cross-site scripting (XSS) vulnerability present in Gogs, which allows client-side Javascript code execution. The vulnerability is caused by the usage of a vulnerable and outdated component: pdfjs-1.4.20 under public/plugins/. This issue has been fixed for gogs.io/gogs in version 0.13.3.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/gogs/gogs/commit/110117b2e5e5baa4809c819bec701e929d2d8d40; https://github.com/gogs/gogs/releases/tag/v0.13.3; https://github.com/gogs/gogs/security/advisories/GHSA-xh32-cx6c-cp4v
CVE: CVE-2025-52566
Published: 2025-06-24
Description: llama.cpp is an inference of several LLM models in C/C++. Prior to version b5721, there is a signed vs. unsigned integer overflow in llama.cpp's tokenizer implementation (llama_vocab::tokenize) (src/llama-vocab.cpp:3036) resulting in unintended behavior in tokens copying size comparison. Allowing heap-overflowing llama.cpp inferencing engine with carefully manipulated text input during tokenization process. This issue has been patched in version b5721.
CVSS Score: 8.6 (HIGH)
CWE: CWE-119, CWE-195
References: https://github.com/ggml-org/llama.cpp/commit/dd6e6d0b6a4bbe3ebfc931d1eb14db2f2b1d70af; https://github.com/ggml-org/llama.cpp/security/advisories/GHSA-7rxv-5jhh-j6xx; https://github.com/ggml-org/llama.cpp/security/advisories/GHSA-7rxv-5jhh-j6xx
CVE: CVE-2025-52568
Published: 2025-06-24
Description: NeKernal is a free and open-source operating system stack. Prior to version 0.0.3, there are several memory safety issues that can lead to memory corruption, disk image corruption, denial of service, and potential code execution. These issues stem from unchecked memory operations, unsafe typecasting, and improper input validation. This issue has been patched in version 0.0.3.
CWE: CWE-20, CWE-770
References: https://github.com/nekernel-org/nekernel/commit/6506875ad0ab210b82a5c4ce227bf851508de17d; https://github.com/nekernel-org/nekernel/commit/6511afbf405c31513bc88ab06bca58218610a994; https://github.com/nekernel-org/nekernel/pull/35
CVE: CVE-2025-52570
Published: 2025-06-24
Description: Letmein is an authenticating port knocker. Prior to version 10.2.1, The connection limiter is implemented incorrectly. It allows an arbitrary amount of simultaneously incoming connections (TCP, UDP and Unix socket) for the services letmeind and letmeinfwd. Therefore, the command line option num-connections is not effective and does not limit the number of simultaneously incoming connections. This issue has been patched in version 10.2.1.
CWE: CWE-770, CWE-799
References: https://github.com/mbuesch/letmein/commit/43207cd77580410d97165d1e3c07361ba6f3558c; https://github.com/mbuesch/letmein/security/advisories/GHSA-jpv7-p47h-f43j
CVE: CVE-2025-36519
Published: 2025-06-24
Description: Unrestricted upload of file with dangerous type issue exists in WRC-2533GST2, WRC-1167GST2, WRC-2533GST2, WRC-2533GS2V-B,WRC-2533GS2-B v1.69 and earlier, WRC-2533GS2-W, WRC-1167GST2, WRC-1167GS2-B, and WRC-1167GS2H-B. If a specially crafted file is uploaded by a remote authenticated attacker, arbitrary code may be executed on the product.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-434
References: https://jvn.jp/en/jp/JVN39435597/; https://www.elecom.co.jp/news/security/20250624-01/
CVE: CVE-2025-41427
Published: 2025-06-24
Description: WRC-X3000GS, WRC-X3000GSA, and WRC-X3000GSN contain an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Connection Diagnostics page. If a remote authenticated attacker sends a specially crafted request to the affected product, an arbitrary OS command may be executed.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://jvn.jp/en/jp/JVN39435597/; https://www.elecom.co.jp/news/security/20250624-01/
CVE: CVE-2025-43877
Published: 2025-06-24
Description: WRC-1167GHBK2-S contains a stored cross-site scripting vulnerability in WebGUI. If exploited, an arbitrary script may be executed on the web browser of the user who accessed WebGUI of the product.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN39435597/; https://www.elecom.co.jp/news/security/20250624-02/
CVE: CVE-2025-43879
Published: 2025-06-24
Description: WRH-733GBK and WRH-733GWH contain an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in the telnet function. If a remote unauthenticated attacker sends a specially crafted request to the affected product, an arbitrary OS command may be executed.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://jvn.jp/en/jp/JVN39435597/; https://www.elecom.co.jp/news/security/20250624-02/
CVE: CVE-2025-48890
Published: 2025-06-24
Description: WRH-733GBK and WRH-733GWH contain an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in miniigd SOAP service. If a remote unauthenticated attacker sends a specially crafted request to the affected product, an arbitrary OS command may be executed.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://jvn.jp/en/jp/JVN39435597/; https://www.elecom.co.jp/news/security/20250624-02/
CVE: CVE-2025-2962
Published: 2025-06-24
Description: A denial-of-service issue in the dns implemenation could cause an infinite loop.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-2qp5-c2vq-g2ww
CVE: CVE-2025-3090
Published: 2025-06-24
Description: An unauthenticated remote attacker can obtain limited sensitive information and/or DoS the device due to missing authentication for critical function.
CVSS Score: 8.2 (HIGH)
CWE: CWE-306
References: https://certvde.com/en/advisories/VDE-2025-034; https://certvde.com/en/advisories/VDE-2025-037
CVE: CVE-2025-50213
Published: 2025-06-24
Description: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) vulnerability in Apache Airflow Providers Snowflake.

This issue affects Apache Airflow Providers Snowflake: before 6.4.0.

Sanitation of table and stage parameters were added in CopyFromExternalStageToSnowflakeOperator to prevent SQL injection
Users are recommended to upgrade to version 6.4.0, which fixes the issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-75
References: https://github.com/apache/airflow/pull/51734; https://lists.apache.org/thread/2kqfmyt2pghg5f6797g8hzvq331v8qx3
CVE: CVE-2025-5258
Published: 2025-06-24
Description: The Conference Scheduler plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘className’ parameter in all versions up to, and including, 2.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/conference-scheduler/trunk/conf-scheduler.php#L1703; https://plugins.trac.wordpress.org/changeset/3316436/; https://wordpress.org/plugins/conference-scheduler/#developers
CVE: CVE-2025-3091
Published: 2025-06-24
Description: An low privileged remote attacker in possession of the second factor for another user can login as that user without knowledge of the other user`s password.
CVSS Score: 7.5 (HIGH)
CWE: CWE-639
References: https://certvde.com/en/advisories/VDE-2025-035; https://certvde.com/en/advisories/VDE-2025-038
CVE: CVE-2025-3092
Published: 2025-06-24
Description: An unauthenticated remote attacker can enumerate valid user names from an unprotected endpoint.
CVSS Score: 7.5 (HIGH)
CWE: CWE-204
References: https://certvde.com/en/advisories/VDE-2025-035; https://certvde.com/en/advisories/VDE-2025-038
CVE: CVE-2025-6206
Published: 2025-06-24
Description: The Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'aiomatic_image_editor_ajax_submit' function in all versions up to, and including, 2.5.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. In order to exploit the vulnerability, there must be a value entered for the Stability.AI API key. The value can be arbitrary.
CVSS Score: 7.5 (HIGH)
CWE: CWE-434
References: https://codecanyon.net/item/aiomatic-automatic-ai-content-writer/38877369#item-description__changelog; https://www.wordfence.com/threat-intel/vulnerabilities/id/8e0ff2d6-65d2-4a54-b3e5-64b424013313?source=cve
CVE: CVE-2025-1718
Published: 2025-06-24
Description: An authenticated user with file access privilege via FTP access can cause the Relion 670/650 and SAM600-IO series device to reboot due to improper disk space management.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-754
References: https://publisher.hitachienergy.com/preview?DocumentID=8DBD000174&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2025-2403
Published: 2025-06-24
Description: A denial-of-service vulnerability due to improper prioritization of network traffic over protection mechanism exists in Relion 670/650 and SAM600-IO series device that if exploited could potentially cause critical functions like LDCM (Line Distance Communication Module) to malfunction.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://publisher.hitachienergy.com/preview?DocumentID=8DBD000216&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2025-39201
Published: 2025-06-24
Description: A vulnerability exists in MicroSCADA X SYS600 product. If exploited this could allow a local unauthenticated attacker to tamper a system file, making denial of Notify service.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-276
References: https://publisher.hitachienergy.com/preview?DocumentID=8DBD000218&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2025-39202
Published: 2025-06-24
Description: A vulnerability exists in in the Monitor Pro interface of the MicroSCADA X SYS600 product. An authenticated user with low privileges can see and overwrite files causing information leak and data corruption.
CVSS Score: 7.3 (HIGH)
CWE: CWE-269
References: https://publisher.hitachienergy.com/preview?DocumentID=8DBD000218&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2025-39203
Published: 2025-06-24
Description: A vulnerability exists in the IEC 61850 of the MicroSCADA X SYS600 product. An IEC 61850-8 crafted message content from IED or remote system can cause a denial of service resulting in disconnection loop.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-354
References: https://publisher.hitachienergy.com/preview?DocumentID=8DBD000218&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2025-39204
Published: 2025-06-24
Description: A vulnerability exists in the Web interface of the MicroSCADA X SYS600 product. The filtering query in the Web interface can be malformed, so returning data can leak unauthorized information to the user.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://publisher.hitachienergy.com/preview?DocumentID=8DBD000218&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2025-39205
Published: 2025-06-24
Description: A vulnerability exists in the IEC 61850 in MicroSCADA X SYS600 product. The certificate validation of the TLS protocol allows remote Man-in-the-Middle attack due to missing proper validation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-295
References: https://publisher.hitachienergy.com/preview?DocumentID=8DBD000218&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2025-6424
Published: 2025-06-24
Description: A use-after-free in FontFaceSet resulted in a potentially exploitable crash. This vulnerability was fixed in Firefox 140, Firefox ESR 115.25, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1966423; https://www.mozilla.org/security/advisories/mfsa2025-51/; https://www.mozilla.org/security/advisories/mfsa2025-52/
CVE: CVE-2025-6425
Published: 2025-06-24
Description: An attacker who enumerated resources from the WebCompat extension could have obtained a persistent UUID that identified the browser, and persisted between containers and normal/private browsing mode, but not profiles. This vulnerability was fixed in Firefox 140, Firefox ESR 115.25, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1717672; https://www.mozilla.org/security/advisories/mfsa2025-51/; https://www.mozilla.org/security/advisories/mfsa2025-52/
CVE: CVE-2025-6426
Published: 2025-06-24
Description: The executable file warning did not warn users before opening files with the `terminal` extension. 
*This bug only affects Firefox for macOS. Other versions of Firefox are unaffected.*. This vulnerability was fixed in Firefox 140, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12.
CVSS Score: 8.8 (HIGH)
CWE: CWE-345
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1964385; https://www.mozilla.org/security/advisories/mfsa2025-51/; https://www.mozilla.org/security/advisories/mfsa2025-53/
CVE: CVE-2025-6427
Published: 2025-06-24
Description: An attacker was able to bypass the `connect-src` directive of a Content Security Policy by manipulating subdocuments. This would have also hidden the connections from the Network tab in Devtools. This vulnerability was fixed in Firefox 140 and Thunderbird 140.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-693
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1966927; https://www.mozilla.org/security/advisories/mfsa2025-51/; https://www.mozilla.org/security/advisories/mfsa2025-54/
CVE: CVE-2025-6428
Published: 2025-06-24
Description: When a URL was provided in a link querystring parameter, Firefox for Android would follow that URL instead of the correct URL, potentially leading to phishing attacks.
*This bug only affects Firefox for Android. Other versions of Firefox are unaffected.*. This vulnerability was fixed in Firefox 140.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-601
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1970151; https://www.mozilla.org/security/advisories/mfsa2025-51/
CVE: CVE-2025-6429
Published: 2025-06-24
Description: Firefox could have incorrectly parsed a URL and rewritten it to the youtube.com domain when parsing the URL specified in an `embed` tag.  This could have bypassed website security checks that restricted which domains users were allowed to embed. This vulnerability was fixed in Firefox 140, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-116
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1970658; https://www.mozilla.org/security/advisories/mfsa2025-51/; https://www.mozilla.org/security/advisories/mfsa2025-53/