deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-27183
Published: 2022-05-06
Description: The Monitoring Console app configured in Distributed mode allows for a Reflected XSS in a query parameter in Splunk Enterprise versions before 8.1.4. The Monitoring Console app is a bundled app included in Splunk Enterprise, not for download on SplunkBase, and not installed on Splunk Cloud Platform instances. Note that the Cloud Monitoring Console is not impacted.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79, CWE-79
References: https://research.splunk.com/application/splunk_xss_in_monitoring_console/; https://www.splunk.com/en_us/product-security/announcements/svd-2022-0505.html; https://research.splunk.com/application/splunk_xss_in_monitoring_console/
CVE: CVE-2022-28165
Published: 2022-05-06
Description: A vulnerability in the role-based access control (RBAC) functionality of the Brocade SANNav before 2.2.0 could allow an authenticated, remote attacker to access resources that they should not be able to access and perform actions that they should not be able to perform. The vulnerability exists because restrictions are not performed on Server side to ensure the user has required permission before processing requests.
CVSS Score: 8.8 (HIGH)
References: https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2022-1844; https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2022-1844
CVE: CVE-2022-28507
Published: 2022-05-06
Description: Dragon Path Technologies Bharti Airtel Routers Hardware BDT-121 version 1.0 is vulnerable to Cross Site Scripting (XSS) via Dragon path router admin page.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://drive.google.com/file/d/1gAssizx8A6450rIfkfeI9_7o4t5NV0MH/view?usp=sharing; https://youtu.be/Ra7tWMs5dkk; https://drive.google.com/file/d/1gAssizx8A6450rIfkfeI9_7o4t5NV0MH/view?usp=sharing
CVE: CVE-2022-28545
Published: 2022-05-06
Description: FUDforum 3.1.1 is vulnerable to Stored XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/fudforum/FUDforum/commit/8ff446881932a45ce538b84a76f833d44eada93b; https://github.com/fudforum/FUDforum/commit/aed69661b6f876c916abec9ca4fcf5035b8e2390; https://github.com/fudforum/FUDforum/commit/8ff446881932a45ce538b84a76f833d44eada93b
CVE: CVE-2022-29420
Published: 2022-05-06
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Adam Skaat Countdown & Clock (WordPress plugin) countdown-builder allows Stored XSS.This issue affects Countdown & Clock (WordPress plugin): from n/a through 2.3.2.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/countdown-builder/wordpress-countdown-clock-plugin-2-3-1-authenticated-stored-cross-site-scripting-xss-vulnerability; https://patchstack.com/database/vulnerability/countdown-builder/wordpress-countdown-clock-plugin-2-3-1-authenticated-stored-cross-site-scripting-xss-vulnerability
CVE: CVE-2022-29421
Published: 2022-05-06
Description: Reflected Cross-Site Scripting (XSS) vulnerability in Adam Skaat's Countdown & Clock plugin on WordPress via &ycd_type vulnerable parameter.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/countdown-builder/wordpress-countdown-clock-plugin-2-3-0-stored-cross-site-scripting-xss-vulnerability; https://wordpress.org/plugins/countdown-builder/; https://patchstack.com/database/vulnerability/countdown-builder/wordpress-countdown-clock-plugin-2-3-0-stored-cross-site-scripting-xss-vulnerability
CVE: CVE-2019-12254
Published: 2022-05-06
Description: In multiple Tecson Tankspion and GOKs SmartBox 4 products the affected application doesn't properly restrict access to an endpoint that is responsible for saving settings, to a unauthenticated user with limited access rights. Based on the lack of adequately implemented access-control rules, by accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to change the application settings without authenticating at all, which violates originally laid ACL rules.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://cert.vde.com/en/advisories/VDE-2019-012/; https://cert.vde.com/en/advisories/VDE-2019-012/
CVE: CVE-2021-27751
Published: 2022-05-06
Description: HCL Commerce is affected by an Insufficient Session Expiration vulnerability. After the session expires, in some circumstances, parts of the application are still accessible.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-613, CWE-613
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0097650; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0097650
CVE: CVE-2021-27758
Published: 2022-05-06
Description: There is a security vulnerability in login form related to Cross-site Request Forgery which prevents user to login after attacker spam to login and system blocked victim's account.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098006; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098006
CVE: CVE-2021-27759
Published: 2022-05-06
Description: This vulnerability arises because the application allows the user to perform some sensitive action without verifying that the request was sent intentionally. An attacker can cause a victim's browser to emit an HTTP request to an arbitrary URL in the application.
CVSS Score: 2.3 (LOW)
CWE: CWE-352, CWE-345
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098006; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098006
CVE: CVE-2021-27760
Published: 2022-05-06
Description: An issue was discovered in the Sametime chat feature in the Notes 11.0 - 11.0.1 FP4 clients. An authenticated Sametime chat user could cause Remote Code Execution on another chat client by sending a specially formatted message through chat containing Javascript code.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-20
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0097670; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0097670
CVE: CVE-2021-27761
Published: 2022-05-06
Description: Weak web transport security (Weak TLS): An attacker may be able to decrypt the data using attacks
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-326
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098116; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098116
CVE: CVE-2021-27762
Published: 2022-05-06
Description: Misconfigured security-related HTTP headers: Several security-related headers were missing or mis-configured on the web responses
CVSS Score: 4.7 (MEDIUM)
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098116; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098116
CVE: CVE-2021-27764
Published: 2022-05-06
Description: Cookie without HTTPONLY flag set. NUMBER cookie(s) was set without Secure or HTTPOnly flags. The images show the cookie with the missing flag. (WebUI)
CVSS Score: 7.4 (HIGH)
CWE: CWE-614, CWE-311, CWE-732
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0097778; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0097778
CVE: CVE-2021-27765
Published: 2022-05-06
Description: The BigFix Server API installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the underlying vulnerability fixed.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-269, CWE-269
References: https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0023/MNDT-2022-0023.md; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098116; https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0023/MNDT-2022-0023.md
CVE: CVE-2021-27766
Published: 2022-05-06
Description: The BigFix Client installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the underlying vulnerability fixed.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-269, CWE-269
References: https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0024/MNDT-2022-0024.md; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098116; https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0024/MNDT-2022-0024.md
CVE: CVE-2021-27767
Published: 2022-05-06
Description: The BigFix Console installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the underlying vulnerability fixed.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-269, CWE-269
References: https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0025/MNDT-2022-0025.md; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098116; https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0025/MNDT-2022-0025.md
CVE: CVE-2022-23205
Published: 2022-05-06
Description: Adobe Photoshop versions 22.5.6 (and earlier)and 23.2.2 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/photoshop/apsb22-20.html; https://helpx.adobe.com/security/products/photoshop/apsb22-20.html
CVE: CVE-2022-23802
Published: 2022-05-06
Description: Joomla Guru extension 5.2.5 is affected by: Insecure Permissions. The impact is: obtain sensitive information (remote). The component is: Access to private information and components, possibility to view other users' information. Information disclosure Access to private information and components, possibility to view other users' information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-276
References: https://guru.ijoomla.com/changelog; https://guru.ijoomla.com/changelog
CVE: CVE-2022-24098
Published: 2022-05-06
Description: Adobe Photoshop versions 22.5.6 (and earlier)and 23.2.2 (and earlier) are affected by an improper input validation vulnerability when parsing a PCX file that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious PCX file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://helpx.adobe.com/security/products/photoshop/apsb22-20.html; https://helpx.adobe.com/security/products/photoshop/apsb22-20.html
CVE: CVE-2022-24099
Published: 2022-05-06
Description: Adobe Photoshop versions 22.5.6 (and earlier)and 23.2.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/photoshop/apsb22-20.html; https://helpx.adobe.com/security/products/photoshop/apsb22-20.html
CVE: CVE-2022-24105
Published: 2022-05-06
Description: Adobe Photoshop versions 22.5.6 (and earlier)and 23.2.2 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious U3D file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/photoshop/apsb22-20.html; https://helpx.adobe.com/security/products/photoshop/apsb22-20.html
CVE: CVE-2022-27783
Published: 2022-05-06
Description: Adobe After Effects versions 22.2.1 (and earlier) and 18.4.5 (and earlier) are affected by a stack overflow vulnerability due to insecure handling of a crafted file, potentially resulting in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted file in After Effects.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://helpx.adobe.com/security/products/after_effects/apsb22-19.html; https://helpx.adobe.com/security/products/after_effects/apsb22-19.html
CVE: CVE-2022-27784
Published: 2022-05-06
Description: Adobe After Effects versions 22.2.1 (and earlier) and 18.4.5 (and earlier) are affected by a stack overflow vulnerability due to insecure handling of a crafted file, potentially resulting in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted file in After Effects.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://helpx.adobe.com/security/products/after_effects/apsb22-19.html; https://helpx.adobe.com/security/products/after_effects/apsb22-19.html
CVE: CVE-2022-27909
Published: 2022-05-06
Description: In Joomla component 'jDownloads 3.9.8.2 Stable' the remote user can change some parameters in the address bar and see the names of other users' files
CVSS Score: 4.3 (MEDIUM)
References: https://hackerhood.redhotcyber.com/cve-2022-27909-jdownloads/; https://www.jdownloads.com/index.php/downloads/download/57-jdownloads-3-9.html; https://hackerhood.redhotcyber.com/cve-2022-27909-jdownloads/
CVE: CVE-2022-28270
Published: 2022-05-06
Description: Adobe Photoshop versions 22.5.6 (and earlier) and 23.2.2 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious SVG file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/photoshop/apsb22-20.html; https://helpx.adobe.com/security/products/photoshop/apsb22-20.html
CVE: CVE-2022-28271
Published: 2022-05-06
Description: Adobe Photoshop versions 22.5.6 (and earlier)and 23.2.2 (and earlier) are affected by a use-after-free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious PDF file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/photoshop/apsb22-20.html; https://helpx.adobe.com/security/products/photoshop/apsb22-20.html
CVE: CVE-2022-28272
Published: 2022-05-06
Description: Adobe Photoshop versions 22.5.6 (and earlier) and 23.2.2 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/photoshop/apsb22-20.html; https://helpx.adobe.com/security/products/photoshop/apsb22-20.html
CVE: CVE-2022-28273
Published: 2022-05-06
Description: Adobe Photoshop versions 22.5.6 (and earlier) and 23.2.2 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/photoshop/apsb22-20.html; https://helpx.adobe.com/security/products/photoshop/apsb22-20.html
CVE: CVE-2022-28274
Published: 2022-05-06
Description: Adobe Photoshop versions 22.5.6 (and earlier) and 23.2.2 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/photoshop/apsb22-20.html; https://helpx.adobe.com/security/products/photoshop/apsb22-20.html
CVE: CVE-2022-28275
Published: 2022-05-06
Description: Adobe Photoshop versions 22.5.6 (and earlier) and 23.2.2 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://helpx.adobe.com/security/products/photoshop/apsb22-20.html; https://helpx.adobe.com/security/products/photoshop/apsb22-20.html
CVE: CVE-2022-28276
Published: 2022-05-06
Description: Adobe Photoshop versions 22.5.6 (and earlier) and 23.2.2 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/photoshop/apsb22-20.html; https://helpx.adobe.com/security/products/photoshop/apsb22-20.html
CVE: CVE-2022-28277
Published: 2022-05-06
Description: Adobe Photoshop versions 22.5.6 (and earlier) and 23.2.2 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious PDF file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/photoshop/apsb22-20.html; https://helpx.adobe.com/security/products/photoshop/apsb22-20.html
CVE: CVE-2022-28278
Published: 2022-05-06
Description: Adobe Photoshop versions 22.5.6 (and earlier) and 23.2.2 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/photoshop/apsb22-20.html; https://helpx.adobe.com/security/products/photoshop/apsb22-20.html
CVE: CVE-2022-28279
Published: 2022-05-06
Description: Adobe Photoshop versions 22.5.6 (and earlier)and 23.2.2 (and earlier) are affected by a use-after-free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/photoshop/apsb22-20.html; https://helpx.adobe.com/security/products/photoshop/apsb22-20.html
CVE: CVE-2022-29422
Published: 2022-05-06
Description: Multiple Authenticated (admin+) Persistent Cross-Site Scripting (XSS) vulnerabilities in Adam Skaat's Countdown & Clock plugin <= 2.3.2 at WordPress via &ycd-countdown-width, &ycd-progress-height, &ycd-progress-width, &ycd-button-margin-top, &ycd-button-margin-right, &ycd-button-margin-bottom, &ycd-button-margin-left, &ycd-circle-countdown-before-countdown, &ycd-circle-countdown-after-countdown vulnerable parameters.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/countdown-builder/wordpress-countdown-clock-plugin-2-3-0-multiple-authenticated-persistent-cross-site-scripting-xss-vulnerabilities; https://wordpress.org/plugins/countdown-builder/#developers; https://patchstack.com/database/vulnerability/countdown-builder/wordpress-countdown-clock-plugin-2-3-0-multiple-authenticated-persistent-cross-site-scripting-xss-vulnerabilities
CVE: CVE-2022-29423
Published: 2022-05-06
Description: Pro Features Lock Bypass vulnerability in Countdown & Clock plugin <= 2.3.2 at WordPress.
CVSS Score: 3.8 (LOW)
CWE: CWE-264
References: https://patchstack.com/database/vulnerability/countdown-builder/wordpress-countdown-clock-plugin-2-3-0-pro-features-lock-bypass-vulnerability; https://wordpress.org/plugins/countdown-builder/#developers; https://patchstack.com/database/vulnerability/countdown-builder/wordpress-countdown-clock-plugin-2-3-0-pro-features-lock-bypass-vulnerability
CVE: CVE-2021-23592
Published: 2022-05-06
Description: The package topthink/framework before 6.0.12 are vulnerable to Deserialization of Untrusted Data due to insecure unserialize method in the Driver class.
CVSS Score: 7.7 (HIGH)
CWE: CWE-502
References: https://github.com/top-think/framework/commit/d3b5aeae94bc71bae97977d05cd12c3e0550905c; https://github.com/top-think/framework/releases/tag/v6.0.12; https://snyk.io/vuln/SNYK-PHP-TOPTHINKFRAMEWORK-2385695
CVE: CVE-2021-23792
Published: 2022-05-06
Description: The package com.twelvemonkeys.imageio:imageio-metadata before 3.7.1 are vulnerable to XML External Entity (XXE) Injection due to an insecurely initialized XML parser for reading XMP Metadata. An attacker can exploit this vulnerability if they are able to supply a file (e.g. when an online profile picture is processed) with a malicious XMP segment. If the XMP metadata of the uploaded image is parsed, then the XXE vulnerability is triggered.
CVSS Score: 7.3 (HIGH)
CWE: CWE-611
References: https://github.com/haraldk/TwelveMonkeys/commit/da4efe98bf09e1cce91b7633cb251958a200fc80; https://snyk.io/vuln/SNYK-JAVA-COMTWELVEMONKEYSIMAGEIO-2316763; https://github.com/haraldk/TwelveMonkeys/commit/da4efe98bf09e1cce91b7633cb251958a200fc80
CVE: CVE-2022-25324
Published: 2022-05-06
Description: All versions of package bignum are vulnerable to Denial of Service (DoS) due to a type-check exception in V8, when verifying the type of the second argument to the .powm function, V8 will crash regardless of Node try/catch blocks.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1321
References: https://github.com/justmoon/node-bignum/blob/ef2e02533e598d6df[PII_REDACTED]c4753cde89ee2/index.js%23L111; https://snyk.io/vuln/SNYK-JS-BIGNUM-2388581; https://github.com/justmoon/node-bignum/blob/ef2e02533e598d6df[PII_REDACTED]c4753cde89ee2/index.js%23L111
CVE: CVE-2022-29180
Published: 2022-05-07
Description: A vulnerability in which attackers could forge HTTP requests to manipulate the `charm` data directory to access or delete anything on the server. This has been patched and is available in release [v0.12.1](https://github.com/charmbracelet/charm/releases/tag/v0.12.1). We recommend that all users running self-hosted `charm` instances update immediately. This vulnerability was found in-house and we haven't been notified of any potential exploiters. ### Additional notes * Encrypted user data uploaded to the Charm server is safe as Charm servers cannot decrypt user data. This includes filenames, paths, and all key-value data. * Users running the official Charm [Docker images](https://github.com/charmbracelet/charm/blob/main/docker.md) are at minimal risk because the exploit is limited to the containerized filesystem.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://github.com/charmbracelet/charm/commit/3c90668f955c7ce5ef721e4fc9faee7053232fd3; https://github.com/charmbracelet/charm/security/advisories/GHSA-4wpp-w5r4-7v5v; https://github.com/charmbracelet/charm/commit/3c90668f955c7ce5ef721e4fc9faee7053232fd3