deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-54219
Published: 2025-08-12
Description: InCopy versions 20.4, 19.5.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://helpx.adobe.com/security/products/incopy/apsb25-80.html
CVE: CVE-2025-54220
Published: 2025-08-12
Description: InCopy versions 20.4, 19.5.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://helpx.adobe.com/security/products/incopy/apsb25-80.html
CVE: CVE-2025-54221
Published: 2025-08-12
Description: InCopy versions 20.4, 19.5.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/incopy/apsb25-80.html
CVE: CVE-2025-54223
Published: 2025-08-12
Description: InCopy versions 20.4, 19.5.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/incopy/apsb25-80.html
CVE: CVE-2025-54224
Published: 2025-08-12
Description: InDesign Desktop versions 20.4, 19.5.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/indesign/apsb25-79.html
CVE: CVE-2025-54225
Published: 2025-08-12
Description: InDesign Desktop versions 20.4, 19.5.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/indesign/apsb25-79.html
CVE: CVE-2025-54226
Published: 2025-08-12
Description: InDesign Desktop versions 20.4, 19.5.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/indesign/apsb25-79.html
CVE: CVE-2025-54227
Published: 2025-08-12
Description: InDesign Desktop versions 20.4, 19.5.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/indesign/apsb25-79.html
CVE: CVE-2025-54228
Published: 2025-08-12
Description: InDesign Desktop versions 20.4, 19.5.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/indesign/apsb25-79.html
CVE: CVE-2025-54235
Published: 2025-08-12
Description: Substance3D - Modeler versions 1.22.0 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/substance3d-modeler/apsb25-76.html
CVE: CVE-2025-55165
Published: 2025-08-12
Description: Autocaliweb is a web app that offers an interface for browsing, reading, and downloading eBooks using a valid Calibre database. Prior to version 0.8.3, the debug pack generated by Autocaliweb can expose sensitive configuration data, including API keys. This occurs because the to_dict() method, used to serialize configuration for the debug pack, doesn't adequately filter out sensitive fields such as API tokens. Users, unaware of the full contents, might share these debug packs, inadvertently leaking their private API keys. This issue has been patched in version 0.8.3.
CVSS Score: 8.2 (HIGH)
CWE: CWE-200
References: https://github.com/gelbphoenix/autocaliweb/commit/f455051f7c758ae[PII_REDACTED]b73e449f353b702; https://github.com/gelbphoenix/autocaliweb/releases/tag/v0.8.3; https://github.com/gelbphoenix/autocaliweb/security/advisories/GHSA-44vp-wgh9-9535
CVE: CVE-2025-55170
Published: 2025-08-12
Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, a reflected cross-site scripting (XSS) vulnerability was identified in the /html/alterar_senha.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the verificacao and redir_config parameter. This issue has been patched in version 3.4.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://github.com/LabRedesCefetRJ/WeGIA/commit/c2bd4121a2b2a076c9f2ef0bdbb[PII_REDACTED]3c8; https://github.com/LabRedesCefetRJ/WeGIA/issues/141; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-77hc-c8f4-p3hc
CVE: CVE-2025-55171
Published: 2025-08-12
Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, the application does not check authentication at endpoint /html/personalizacao_remover.php allowing anonymous attacker (without login) to delete any Image files at endpoint /html/personalizacao_remover.php by defining imagem_0 as image id to delete. This issue has been patched in version 3.4.8.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://github.com/LabRedesCefetRJ/WeGIA/commit/aa63f499a285bf91795b9836eec0425e7eafe570; https://github.com/LabRedesCefetRJ/WeGIA/issues/109; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-8rm5-3jvx-hcxv
CVE: CVE-2025-54222
Published: 2025-08-12
Description: Substance3D - Stager versions 3.1.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/substance3d_stager/apsb25-81.html
CVE: CVE-2025-49456
Published: 2025-08-12
Description: Race condition in the installer for certain Zoom Clients for Windows may allow an unauthenticated user to impact  application integrity via local access.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-426, CWE-362
References: https://www.zoom.com/en/trust/security-bulletin/zsb-25029
CVE: CVE-2025-49457
Published: 2025-08-12
Description: Untrusted search path in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-426
References: https://www.zoom.com/en/trust/security-bulletin/zsb-25030
CVE: CVE-2025-54229
Published: 2025-08-12
Description: Adobe Framemaker versions 2020.8, 2022.6 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/framemaker/apsb25-83.html
CVE: CVE-2025-54230
Published: 2025-08-12
Description: Adobe Framemaker versions 2020.8, 2022.6 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/framemaker/apsb25-83.html
CVE: CVE-2025-54231
Published: 2025-08-12
Description: Adobe Framemaker versions 2020.8, 2022.6 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/framemaker/apsb25-83.html
CVE: CVE-2025-54232
Published: 2025-08-12
Description: Adobe Framemaker versions 2020.8, 2022.6 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/framemaker/apsb25-83.html
CVE: CVE-2025-54233
Published: 2025-08-12
Description: Adobe Framemaker versions 2020.8, 2022.6 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/framemaker/apsb25-83.html
CVE: CVE-2025-54238
Published: 2025-08-12
Description: Dimension versions 4.1.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/dimension/apsb25-84.html
CVE: CVE-2025-8395
Published: 2025-08-12
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2025-4276
Published: 2025-08-13
Description: UsbCoreDxe has a vulnerability which can be used to write arbitrary memory inside SMRAM and execute arbitrary code at SMM level.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.insyde.com/security-pledge/sa-2025005/
CVE: CVE-2025-4277
Published: 2025-08-13
Description: Tcg2Smm has a vulnerability which can be used to write arbitrary memory inside SMRAM and execute arbitrary code at SMM level.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.insyde.com/security-pledge/sa-2025005/
CVE: CVE-2025-4410
Published: 2025-08-13
Description: A buffer overflow vulnerability exists in the module SetupUtility. An attacker with local privileged access can exploit this vulnerability by executeing arbitrary code.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.insyde.com/security-pledge/sa-2025005/
CVE: CVE-2025-8879
Published: 2025-08-13
Description: Heap buffer overflow in libaom in Google Chrome prior to 139.0.7258.127 allowed a remote attacker to potentially exploit heap corruption via a curated set of gestures. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://chromereleases.googleblog.com/2025/08/stable-channel-update-for-desktop_12.html; https://issues.chromium.org/issues/432035817
CVE: CVE-2025-8880
Published: 2025-08-13
Description: Race in V8 in Google Chrome prior to 139.0.7258.127 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-362, CWE-362
References: https://chromereleases.googleblog.com/2025/08/stable-channel-update-for-desktop_12.html; https://issues.chromium.org/issues/433533359
CVE: CVE-2025-8881
Published: 2025-08-13
Description: Inappropriate implementation in File Picker in Google Chrome prior to 139.0.7258.127 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-303, CWE-346
References: https://chromereleases.googleblog.com/2025/08/stable-channel-update-for-desktop_12.html; https://issues.chromium.org/issues/433800617
CVE: CVE-2025-8882
Published: 2025-08-13
Description: Use after free in Aura in Google Chrome prior to 139.0.7258.127 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2025/08/stable-channel-update-for-desktop_12.html; https://issues.chromium.org/issues/435623339
CVE: CVE-2025-8901
Published: 2025-08-13
Description: Out of bounds write in ANGLE in Google Chrome prior to 139.0.7258.127 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2025/08/stable-channel-update-for-desktop_12.html; https://issues.chromium.org/issues/435139154
CVE: CVE-2025-0818
Published: 2025-08-13
Description: Several WordPress plugins using elFinder versions 2.1.64 and prior are vulnerable to Directory Traversal in various versions. This makes it possible for unauthenticated attackers to delete arbitrary files. Successful exploitation of this vulnerability requires a site owner to explicitly make an instance of the file manager available to users.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/Studio-42/elFinder; https://github.com/Studio-42/elFinder/blob/master/php/elFinder.class.php#L5367; https://plugins.trac.wordpress.org/browser/file-manager-advanced/trunk/application/library/php/elFinder.class.php#L5411
CVE: CVE-2025-8491
Published: 2025-08-13
Description: The Easy restaurant menu manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on the nsc_eprm_save_menu() function. This makes it possible for unauthenticated attackers to upload a menu file via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/easy-pdf-restaurant-menu-upload/tags/2.0.2/class/class-admin-settings-nsc_eprm.php#L95; https://plugins.trac.wordpress.org/changeset/3338246/easy-pdf-restaurant-menu-upload/trunk/class/class_admin_easy_pdf_restaurant_menu.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/a349b220-5b42-4b98-869f-ce8399fe7ec9?source=cve
CVE: CVE-2025-8891
Published: 2025-08-13
Description: The OceanWP theme for WordPress is vulnerable to Cross-Site Request Forgery in versions 4.0.9 to 4.1.1. This is due to missing or incorrect nonce validation on the oceanwp_notice_button_click() function. This makes it possible for unauthenticated attackers to install the Ocean Extra plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://research.cleantalk.org/cve-2025-8891/; https://themes.trac.wordpress.org/changeset/283264/oceanwp/4.1.2/inc/activation-notice/api.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/9c6f9a3d-54a6-4405-b42b-37fc8342af96?source=cve
CVE: CVE-2025-7384
Published: 2025-08-13
Description: The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.3 via deserialization of untrusted input in the get_lead_detail function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain in the Contact Form 7 plugin, which is likely to be used alongside, allows attackers to delete arbitrary files, leading to a denial of service or remote code execution when the wp-config.php file is deleted.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://plugins.trac.wordpress.org/browser/contact-form-entries/tags/1.4.1/includes/data.php#L525; https://plugins.trac.wordpress.org/changeset/3338764/#file9; https://www.wordfence.com/threat-intel/vulnerabilities/id/129f810d-ff83-4428-9f98-6a6aa8817783?source=cve
CVE: CVE-2025-6715
Published: 2025-08-13
Description: The LatePoint  WordPress plugin before 5.1.94 is vulnerable to Local File Inclusion via the layout parameter. This makes it possible for attackers to include and execute PHP files on the server, allowing the execution of any PHP code in those files.
CVSS Score: 9.8 (CRITICAL)
References: https://wpscan.com/vulnerability/357aba51-b65e-4691-864b-fef1c78a9362/; https://wpscan.com/vulnerability/357aba51-b65e-4691-864b-fef1c78a9362/
CVE: CVE-2025-6184
Published: 2025-08-13
Description: The Tutor LMS Pro – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter used in the get_submitted_assignments() function in all versions up to, and including, 3.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Tutor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Only the Pro version is affected.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://tutorlms.com/; https://wordpress.org/plugins/tutor/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/4b41d134-be9e-469f-b26b-ac30d95db0a3?source=cve
CVE: CVE-2025-8760
Published: 2025-08-13
Description: A vulnerability was identified in INSTAR 2K+ and 4K 3.11.1 Build 1124. This affects the function base64_decode of the component fcgi_server. The manipulation of the argument Authorization leads to buffer overflow. It is possible to initiate the attack remotely.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119, CWE-120
References: https://modzero.com/static/MZ-25-03_modzero_INSTAR.pdf; https://vuldb.com/?ctiid.319863; https://vuldb.com/?id.319863
CVE: CVE-2025-8761
Published: 2025-08-13
Description: A vulnerability has been found in INSTAR 2K+ and 4K 3.11.1 Build 1124. This vulnerability affects unknown code of the component Backend IPC Server. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.5 (HIGH)
CWE: CWE-404
References: https://modzero.com/static/MZ-25-03_modzero_INSTAR.pdf; https://vuldb.com/?ctiid.319864; https://vuldb.com/?id.319864
CVE: CVE-2025-8762
Published: 2025-08-13
Description: A vulnerability was found in INSTAR 2K+ and 4K 3.11.1 Build 1124. This issue affects some unknown processing of the component UART Interface. The manipulation leads to improper physical access control. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-284, CWE-1263
References: https://modzero.com/static/MZ-25-03_modzero_INSTAR.pdf; https://vuldb.com/?ctiid.319865; https://vuldb.com/?id.319865
CVE: CVE-2025-55345
Published: 2025-08-13
Description: Using Codex CLI in workspace-write mode inside a malicious context (repo, directory, etc) could lead to arbitrary file overwrite and potentially remote code execution due to symlinks being followed outside the allowed current working directory.
CVSS Score: 8.8 (HIGH)
CWE: CWE-61
References: https://github.com/openai/codex/pull/1705; https://research.jfrog.com/vulnerabilities/codex-cli-symlink-arbitrary-file-overwrite-jfsa-2[PII_REDACTED]31/; https://research.jfrog.com/vulnerabilities/codex-cli-symlink-arbitrary-file-overwrite-jfsa-2[PII_REDACTED]31/
CVE: CVE-2025-8909
Published: 2025-08-13
Description: Organization Portal System developed by WellChoose has an Arbitrary File Reading vulnerability, allowing remote attackers with regular privileges to exploit Absolute Path Traversal to download arbitrary system files.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-36, CWE-22
References: https://www.twcert.org.tw/en/cp-139-10325-70192-2.html; https://www.twcert.org.tw/tw/cp-132-10321-3cae5-1.html
CVE: CVE-2025-8910
Published: 2025-08-13
Description: Organization Portal System developed by WellChoose has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.twcert.org.tw/en/cp-139-10325-70192-2.html; https://www.twcert.org.tw/tw/cp-132-10321-3cae5-1.html
CVE: CVE-2025-8911
Published: 2025-08-13
Description: Organization Portal System developed by WellChoose has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.twcert.org.tw/en/cp-139-10325-70192-2.html; https://www.twcert.org.tw/tw/cp-132-10321-3cae5-1.html
CVE: CVE-2025-8912
Published: 2025-08-13
Description: Organization Portal System developed by WellChoose has an Arbitrary File Reading vulnerability, allowing unauthenticated remote attackers to exploit Absolute Path Traversal to download arbitrary system files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-36, CWE-22
References: https://www.twcert.org.tw/en/cp-139-10325-70192-2.html; https://www.twcert.org.tw/tw/cp-132-10321-3cae5-1.html
CVE: CVE-2025-8913
Published: 2025-08-13
Description: Organization Portal System developed by WellChoose has a Local File Inclusion vulnerability, allowing unauthenticated remote attackers to execute arbitrary code on the server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-98
References: https://www.twcert.org.tw/en/cp-139-10325-70192-2.html; https://www.twcert.org.tw/tw/cp-132-10321-3cae5-1.html
CVE: CVE-2025-8914
Published: 2025-08-13
Description: Organization Portal System developed by WellChoose has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://www.twcert.org.tw/en/cp-139-10325-70192-2.html; https://www.twcert.org.tw/tw/cp-132-10321-3cae5-1.html
CVE: CVE-2025-8916
Published: 2025-08-13
Description: Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcpkix on All (API modules), Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BCPKIX FIPS bcpkix-fips on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertPathReviewer.Java, https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.Java.

This issue affects BC Java: from 1.44 through 1.78; BC Java: from 1.44 through 1.78; BCPKIX FIPS: from 1.0.0 through 1.0.7, from 2.0.0 through 2.0.7.
CWE: CWE-770
References: https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%908916