deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-62396
Published: 2025-10-23
Description: An error-handling issue in the Moodle router (r.php) could cause the application to display internal directory listings when specific HTTP headers were not properly configured.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-548
References: https://access.redhat.com/security/cve/CVE-2025-62396; https://bugzilla.redhat.com/show_bug.cgi?id=2404429
CVE: CVE-2025-62397
Published: 2025-10-23
Description: The router’s inconsistent response to invalid course IDs allowed attackers to infer which course IDs exist, potentially aiding reconnaissance.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://access.redhat.com/security/cve/CVE-2025-62397; https://bugzilla.redhat.com/show_bug.cgi?id=2404430
CVE: CVE-2025-62398
Published: 2025-10-23
Description: A serious authentication flaw allowed attackers with valid credentials to bypass multi-factor authentication under certain conditions, potentially compromising user accounts.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-287
References: https://access.redhat.com/security/cve/CVE-2025-62398; https://bugzilla.redhat.com/show_bug.cgi?id=2404431
CVE: CVE-2025-62399
Published: 2025-10-23
Description: Moodle’s mobile and web service authentication endpoints did not sufficiently restrict repeated password attempts, making them susceptible to brute-force attacks.
CVSS Score: 7.5 (HIGH)
CWE: CWE-307
References: https://access.redhat.com/security/cve/CVE-2025-62399; https://bugzilla.redhat.com/show_bug.cgi?id=2404432
CVE: CVE-2025-62400
Published: 2025-10-23
Description: Moodle exposed the names of hidden groups to users who had permission to create calendar events but not to view hidden groups. This could reveal private or restricted group information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://access.redhat.com/security/cve/CVE-2025-62400; https://bugzilla.redhat.com/show_bug.cgi?id=2404433
CVE: CVE-2025-62401
Published: 2025-10-23
Description: An issue in Moodle’s timed assignment feature allowed students to bypass the time restriction, potentially giving them more time than allowed to complete an assessment.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-285
References: https://access.redhat.com/security/cve/CVE-2025-62401; https://bugzilla.redhat.com/show_bug.cgi?id=2404434
CVE: CVE-2025-10705
Published: 2025-10-23
Description: The MxChat – AI Chatbot for WordPress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.4.6. This is due to insufficient validation of user-supplied URLs in the PDF processing functionality. This makes it possible for unauthenticated attackers to make the WordPress server perform HTTP requests to arbitrary destinations via the mxchat_handle_chat_request AJAX action.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918
References: https://plugins.trac.wordpress.org/browser/mxchat-basic/tags/2.4.1/includes/class-mxchat-integrator.php#L1090; https://plugins.trac.wordpress.org/browser/mxchat-basic/tags/2.4.1/includes/class-mxchat-integrator.php#L1108; https://plugins.trac.wordpress.org/browser/mxchat-basic/tags/2.4.1/includes/class-mxchat-integrator.php#L2360
CVE: CVE-2025-11023
Published: 2025-10-23
Description: Inclusion of Functionality from Untrusted Control Sphere, Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ArkSigner Software and Hardware Inc. AcBakImzala allows PHP Local File Inclusion.This issue affects AcBakImzala: before v5.1.4.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-98, CWE-829
References: https://www.usom.gov.tr/bildirim/tr-25-0356
CVE: CVE-2025-11128
Published: 2025-10-23
Description: The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.1.0 via the 'feedzy_sanitize_feeds' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query information from internal services.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-918
References: https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/trunk/includes/gutenberg/feedzy-rss-feeds-gutenberg-block.php#L280; https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/trunk/includes/gutenberg/feedzy-rss-feeds-gutenberg-block.php#L309; https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/trunk/includes/gutenberg/feedzy-rss-feeds-gutenberg-block.php#L336
CVE: CVE-2025-8427
Published: 2025-10-23
Description: The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘auto_play’ parameter in all versions up to, and including, 2.9.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://www.wordfence.com/threat-intel/vulnerabilities/id/afec9b5b-da37-4e12-935e-9d3bb3ca01f0?source=cve; https://www.wpbeaverbuilder.com/change-logs/
CVE: CVE-2025-11429
Published: 2025-10-23
Description: A flaw was found in Keycloak. Keycloak does not immediately enforce the disabling of the "Remember Me" realm setting on existing user sessions. Sessions created while "Remember Me" was active retain their extended session lifetime until they expire, overriding the administrator's recent security configuration change. This is a logic flaw in session management increases the potential window for successful session hijacking or unauthorized long-term access persistence. The flaw lies in the session expiration logic relying on the session-local "remember-me" flag without validating the current realm-level configuration.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-613
References: https://access.redhat.com/errata/RHSA-2025:22088; https://access.redhat.com/errata/RHSA-2025:22089; https://access.redhat.com/security/cve/CVE-2025-11429
CVE: CVE-2025-1679
Published: 2025-10-23
Description: Cross-site Scripting has been identified in Moxa’s Ethernet switches, which allows an authenticated administrative attacker to inject malicious scripts to an affected device’s web service that could impact authenticated users interacting with the device’s web interface. This vulnerability is classified as stored cross-site scripting (XSS); attackers inject malicious scripts into the system, and the scripts persist across sessions. There is no impact to the confidentiality, integrity, and availability of the affected device; no loss of availability within any subsequent systems but has some loss of confidentiality and integrity within the subsequent system.
CWE: CWE-79
References: https://www.hackrtu.com/blog/cg-technical-en-003/; https://www.moxa.com/en/support/product-support/security-advisory/mpsa-257421-cve-2025-1679,-cve-2025-1680-stored-cross-site-scripting-(xss)-and-host-header-injection-vulnerabilities-in
CVE: CVE-2025-1680
Published: 2025-10-23
Description: An acceptance of extraneous untrusted data with trusted data vulnerability has been identified in Moxa’s Ethernet switches, which allows attackers with administrative privileges to manipulate HTTP Host headers by injecting a specially crafted Host header into HTTP requests sent to an affected device’s web service. This vulnerability is classified as Host Header Injection, where invalid Host headers can manipulate to redirect users, forge links, or phishing attacks. There is no impact to the confidentiality, integrity, and availability of the affected device; no loss of confidentiality, integrity, and availability within any subsequent systems.
CWE: CWE-349
References: https://www.hackrtu.com/blog/cg-technical-en-003/; https://www.moxa.com/en/support/product-support/security-advisory/mpsa-257421-cve-2025-1679,-cve-2025-1680-stored-cross-site-scripting-(xss)-and-host-header-injection-vulnerabilities-in
CVE: CVE-2025-53701
Published: 2025-10-23
Description: Vilar VS-IPC1002 IP cameras are vulnerable to Reflected XSS (Cross-site Scripting) attacks, because parameters in GET requests sent to /cgi-bin/action endpoint are not sanitized properly, making it possible to target logged in admin users.
The vendor did not respond in any way. Only version 1.1.0.18 was tested, other versions might be vulnerable as well.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://cert.pl/en/posts/2025/10/CVE-2025-53701
CVE: CVE-2025-53702
Published: 2025-10-23
Description: Vilar VS-IPC1002 IP cameras are vulnerable to DoS (Denial-of-Service) attacks. An unauthenticated attacker on the same local network might send a crafted request to /cgi-bin/action endpoint and render the device completely unresponsive. A manual restart of the device is required. 
The vendor did not respond in any way. Only version 1.1.0.18 was tested, other versions might be vulnerable as well.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-755
References: https://cert.pl/en/posts/2025/10/CVE-2025-53701
CVE: CVE-2025-60852
Published: 2025-10-23
Description: A CSV Injection vulnerability existed in Instant Developer Foundation versions prior to 25.0.9600. Applications built with affected versions of the framework did not properly sanitize user-controlled input before including it in CSV exports. This issue could lead to code execution on the system where the exported CSV file is opened.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1236
References: https://doc.instantdeveloper.com/eng/default.aspx?artid=a6c69034-d1ee-4057-b19d-40505151ec8e&lang=eng; https://github.com/valeriocassoni/CSV-Injection-in-Instant-Developer-Foundation-25.0-PoC; https://instantdeveloper.com/lp/cloud-freelance/index.html
CVE: CVE-2025-62256
Published: 2025-10-23
Description: Liferay Portal 7.4.0 through 7.4.3.109, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.7, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions  does not properly restrict access to OpenAPI in certain circumstances, which allows remote attackers to access the OpenAPI YAML file via a crafted URL.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62256
CVE: CVE-2025-12110
Published: 2025-10-23
Description: A flaw was found in Keycloak. An offline session continues to be valid when the offline_access scope is removed from the client. The refresh token is accepted and you can continue to request new tokens for the session. As it can lead to a situation where an administrator removes the scope, and assumes that offline sessions are no longer available, but they are.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-613
References: https://access.redhat.com/errata/RHSA-2025:21370; https://access.redhat.com/errata/RHSA-2025:21371; https://access.redhat.com/errata/RHSA-2025:22088
CVE: CVE-2025-56007
Published: 2025-10-23
Description: CRLF-injection in KeeneticOS before 4.3 at "/auth" API endpoint allows attackers to take over the device via adding additional users with full permissions by managing the victim to open page with exploit.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-93
References: https://keenetic.com/; https://keenetic.com/global/security#october-2025-web-api-vulnerabilities
CVE: CVE-2025-56008
Published: 2025-10-23
Description: Cross site scripting (XSS) vulnerability in KeeneticOS before 4.3 at "Wireless ISP" page allows attackers located near to the router to takeover the device via adding additional users with full permissions.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://keenetic.com/; https://keenetic.com/global/security#october-2025-web-api-vulnerabilities
CVE: CVE-2025-56009
Published: 2025-10-23
Description: Cross site request forgery (CSRF) vulnerability in KeeneticOS before 4.3 at "/rci" API endpoint allows attackers to take over the device via adding additional users with full permissions by managing the victim to open page with exploit.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-352
References: https://keenetic.com/; https://keenetic.com/global/security#october-2025-web-api-vulnerabilities
CVE: CVE-2025-61132
Published: 2025-10-23
Description: A Host Header Injection vulnerability in the password reset component in levlaz braindump v0.4.14 allows remote attackers to conduct password reset poisoning and account takeover via manipulation of the Host header when Flask's url_for(_external=True) generates reset links without a fixed SERVER_NAME.
CVSS Score: 7.1 (HIGH)
CWE: CWE-620
References: https://drive.google.com/file/d/1FmkctLdOTGMdy6GgLaTzfxemdVDeiA7J/view?usp=sharing; https://gist.github.com/BrookeYangRui/94c3bee0c2cbc1ed81a21d4448550c21; https://github.com/levlaz/braindump/blob/9640dd03f99851dbd34dd6cac98a747a4a591b01/app/auth/views.py#L131-L148
CVE: CVE-2025-61136
Published: 2025-10-23
Description: A Host Header Injection vulnerability in the password reset component in axewater sharewarez v2.4.3 allows remote attackers to conduct password reset poisoning and account takeover via manipulation of the Host header when Flask's url_for(_external=True) generates reset links without a fixed SERVER_NAME.
CVSS Score: 7.1 (HIGH)
CWE: CWE-94
References: https://drive.google.com/file/d/15X5L1uEqgWOLrjKqm96cEPAWp2ph0zJp/view?usp=sharing; https://gist.github.com/BrookeYangRui/145e529b5fd4f56af299efde37edf4fa; https://github.com/axewater/sharewarez/blob/d04c90b7dc3fbae1596f731d1b168d3fb9fdd2df/modules/routes_login.py#L188-L217
CVE: CVE-2025-12114
Published: 2025-10-23
Description: Enabled serial console could potentially leak information that might help attacker to find vulnerabilities.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-1191
References: https://azure-access.com/security-advisories
CVE: CVE-2025-50949
Published: 2025-10-23
Description: FontForge v20230101 was discovered to contain a memory leak via the component DlgCreate8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401
References: https://github.com/fontforge/fontforge/pull/5491
CVE: CVE-2025-50950
Published: 2025-10-23
Description: Audiofile v0.3.7 was discovered to contain a NULL pointer dereference via the ModuleState::setup function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/mpruett/audiofile/issues/66
CVE: CVE-2025-50951
Published: 2025-10-23
Description: FontForge v20230101 was discovered to contain a memory leak via the utf7toutf8_copy function at /fontforge/sfd.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401
References: https://github.com/fontforge/fontforge/pull/5495
CVE: CVE-2025-59048
Published: 2025-10-23
Description: OpenBao's AWS Plugin generates AWS access credentials based on IAM policies. Prior to version 0.1.1, the AWS Plugin is vulnerable to cross-account IAM role Impersonation in the AWS auth method. The vulnerability allows an IAM role from an untrusted AWS account to authenticate by impersonating a role with the same name in a trusted account, leading to unauthorized access. This impacts all users of the auth-aws plugin who operate in a multi-account AWS environment where IAM role names may not be unique across accounts. This vulnerability has been patched in version 0.1.1 of the auth-aws plugin. A workaround for this issue involves guaranteeing that IAM role names are unique across all AWS accounts that could potentially interact with your OpenBao environment, and to audit for any duplicate IAM roles.
CVSS Score: 8.1 (HIGH)
CWE: CWE-694, CWE-863
References: https://github.com/openbao/openbao-plugins/commit/2a77af36834746ca6d3ac9bd1049154c84b3efae; https://github.com/openbao/openbao-plugins/security/advisories/GHSA-jp7h-4f3c-9rc7
CVE: CVE-2025-62169
Published: 2025-10-23
Description: OctoPrint-SpoolManager is a plugin for managing spools and all their usage metadata. In versions 1.8.0a2 and older of the testing branch and versions 1.7.7 and older of the stable branch, the APIs of the OctoPrint-SpoolManager plugin do not correctly enforce authentication or authorization checks. This issue has been patched in versions 1.8.0a3 of the testing branch and 1.7.8 of the stable branch. The impact of this vulnerability is greatly reduced when using OctoPrint version 1.11.2 and newer.
CVSS Score: 8.1 (HIGH)
CWE: CWE-287
References: https://github.com/WildRikku/OctoPrint-SpoolManager/commit/b725e113316e177ce81238a2dbbbdb63d92c40b0; https://github.com/WildRikku/OctoPrint-SpoolManager/releases/tag/1.7.8; https://github.com/WildRikku/OctoPrint-SpoolManager/releases/tag/1.8.0a3
CVE: CVE-2025-34155
Published: 2025-10-23
Description: Tibbo AggreGate Network Manager < 6.40.05 contains an observable response discrepancy in its login functionality. Authentication failure messages differ based on whether a supplied username exists or not, allowing an unauthenticated remote attacker to infer valid account identifiers. This can facilitate user enumeration and increase the likelihood of targeted brute-force or credential-stuffing attacks.
CWE: CWE-204
References: https://aggregate.digital/downloads.html; https://aggregate.digital/products/network-manager.html; https://www.vulncheck.com/advisories/tibbo-aggregate-network-manager-login-functionality-user-enumeration
CVE: CVE-2025-34156
Published: 2025-10-23
Description: Tibbo AggreGate Network Manager < 6.40.05 exposes sensitive system information through an unauthenticated endpoint at /cwmp/happyaxis.jsp. The page discloses Java system properties, server path details, and version information to unauthorized users, resulting in information disclosure that could aid further compromise.
CWE: CWE-497
References: https://aggregate.digital/downloads.html; https://aggregate.digital/products/network-manager.html; https://www.vulncheck.com/advisories/tibbo-aggregate-network-manager-system-information-exposure
CVE: CVE-2025-62713
Published: 2025-10-23
Description: Kottster is a self hosted Node.js admin panel. From versions 3.2.0 to before 3.3.2, Kottster contains a pre-authentication remote code execution (RCE) vulnerability when running in development mode. This affects development mode only, production deployments were never affected. This issue has been fixed in version 3.3.2.
CWE: CWE-78, CWE-284
References: https://github.com/kottster/kottster/commit/0a7d24922a23aac[PII_REDACTED][PII_REDACTED]eef89; https://github.com/kottster/kottster/security/advisories/GHSA-j3w7-9qc3-g96p
CVE: CVE-2025-57240
Published: 2025-10-23
Description: Cross site scripting (XSS) vulnerability in 17gz International Student service system 1.0 allows attackers to execute arbitrary code via the registration step.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/samllpotato1/xss/blob/main/xss.txt
CVE: CVE-2025-61413
Published: 2025-10-23
Description: A stored cross-site scripting (XSS) vulnerability in the /manager/pages component of Piranha CMS v12.0 allows attackers to execute arbitrary web scripts or HTML via creating a page and injecting a crafted payload into the Markdown blocks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://piranhacms.org/; https://github.com/PiranhaCMS/piranha.core; https://github.com/Saconyfx/security-advisories/blob/main/CVE-2025-61413/advisory.md
CVE: CVE-2025-61464
Published: 2025-10-23
Description: gnuboard gnuboard4 v4.36.04 and before is vulnerable to Second-order SQL Injection via the search_table in bbs/search.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/gnuboard/gnuboard4/issues/1; https://github.com/gnuboard/gnuboard4/issues/1#issue[PII_REDACTED]
CVE: CVE-2025-10937
Published: 2025-10-23
Description: Oxford Nanopore Technologies' MinKNOW software at or prior to version 24.11 creates a temporary file to store the local authentication token during startup, before copying it to its final location. This temporary file is created in a directory accessible to all users on the system. An unauthorized local user or process can exploit this behavior by placing a file lock on the temporary token file using the flock system call. This prevents MinKNOW from completing the token generation process. As a result, no valid local token is created, and the software is unable to execute commands on the sequencer. This leads to a denial-of-service (DoS) condition, blocking sequencing operations.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-754
References: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsma-25-294-01.json; https://nanoporetech.com/about/contact; https://nanoporetech.com/software/
CVE: CVE-2025-11621
Published: 2025-10-23
Description: Vault and Vault Enterprise’s (“Vault”) AWS Auth method may be susceptible to authentication bypass if the role of the configured bound_principal_iam is the same across AWS accounts, or uses a wildcard. This vulnerability, CVE-2025-11621, is fixed in Vault Community Edition 1.21.0 and Vault Enterprise 1.21.0, 1.20.5, 1.19.11, and 1.16.27
CVSS Score: 8.1 (HIGH)
CWE: CWE-288
References: https://discuss.hashicorp.com/t/hcsec-2025-30-vault-aws-auth-method-authentication-bypass-through-mishandling-of-cache-entries/76709
CVE: CVE-2025-23300
Published: 2025-10-23
Description: NVIDIA Display Driver for Linux contains a vulnerability in the kernel driver, where a user could cause a null pointer dereference by allocating a specific memory resource. A successful exploit of this vulnerability might lead to denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://nvd.nist.gov/vuln/detail/CVE-2025-23300; https://nvidia.custhelp.com/app/answers/detail/a_id/5703; https://www.cve.org/CVERecord?id=CVE-2025-23300
CVE: CVE-2025-23330
Published: 2025-10-23
Description: NVIDIA Display Driver for Linux contains a vulnerability where an attacker might be able to trigger a null pointer dereference. A successful exploit of this vulnerability might lead to denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://nvd.nist.gov/vuln/detail/CVE-2025-23330; https://nvidia.custhelp.com/app/answers/detail/a_id/5703; https://www.cve.org/CVERecord?id=CVE-2025-23330
CVE: CVE-2025-23332
Published: 2025-10-23
Description: NVIDIA Display Driver for Linux contains a vulnerability in a kernel module, where an attacker might be able to trigger a null pointer deference. A successful exploit of this vulnerability might lead to denial of service.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-476
References: https://nvd.nist.gov/vuln/detail/CVE-2025-23332; https://nvidia.custhelp.com/app/answers/detail/a_id/5703; https://www.cve.org/CVERecord?id=CVE-2025-23332
CVE: CVE-2025-23345
Published: 2025-10-23
Description: NVIDIA Display Driver for Windows and Linux contains a vulnerability in a video decoder, where an attacker might cause an out-of-bounds read. A successful exploit of this vulnerability might lead to information disclosure or denial of service.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://nvd.nist.gov/vuln/detail/CVE-2025-23345; https://nvidia.custhelp.com/app/answers/detail/a_id/5703; https://www.cve.org/CVERecord?id=CVE-2025-23345
CVE: CVE-2025-23347
Published: 2025-10-23
Description: NVIDIA Project G-Assist contains a vulnerability where an attacker might be able to escalate permissions. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://nvd.nist.gov/vuln/detail/CVE-2025-23347; https://nvidia.custhelp.com/app/answers/detail/a_id/5703; https://www.cve.org/CVERecord?id=CVE-2025-23347
CVE: CVE-2025-23352
Published: 2025-10-23
Description: NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where a malicious guest could cause uninitialized pointer access. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
CVSS Score: 7.8 (HIGH)
CWE: CWE-824
References: https://nvd.nist.gov/vuln/detail/CVE-2025-23352; https://nvidia.custhelp.com/app/answers/detail/a_id/5703; https://www.cve.org/CVERecord?id=CVE-2025-23352