deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-53367
Published: 2025-09-17
Description: In the Linux kernel, the following vulnerability has been resolved:

accel/habanalabs: fix mem leak in capture user mappings

This commit fixes a memory leak caused when clearing the user_mappings
info when a new context is opened immediately after user_mapping is
captured and a hard reset is performed.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://git.kernel.org/stable/c/314a7ffd7c196b27eedd50cb7553029e17789b55; https://git.kernel.org/stable/c/973e0890e5264cb075ef668661cad06b67777121
CVE: CVE-2024-48842
Published: 2025-09-17
Description: Use of Hard-coded Credentials vulnerability in ABB FLXEON.This issue affects FLXEON: through 9.3.5 and newer versions
CVSS Score: 7.0 (HIGH)
CWE: CWE-798
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108471A7121&LanguageCode=en&DocumentPartId=pdf&Action=Launch
CVE: CVE-2025-10205
Published: 2025-09-17
Description: Use of a One-Way Hash with a Predictable Salt vulnerability in ABB FLXEON.This issue affects FLXEON: through 9.3.5. and newer versions
CVSS Score: 8.8 (HIGH)
CWE: CWE-759
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108471A7121&LanguageCode=en&DocumentPartId=pdf&Action=Launch
CVE: CVE-2025-10595
Published: 2025-09-17
Description: A vulnerability has been found in SourceCodester Online Student File Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/delete_user.php. The manipulation of the argument user_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/qcycop0101-hash/CVE/issues/15; https://vuldb.com/?ctiid.324612; https://vuldb.com/?id.324612
CVE: CVE-2025-10596
Published: 2025-09-17
Description: A vulnerability was found in SourceCodester Online Exam Form Submission 1.0. This affects an unknown part of the file /index.php. The manipulation of the argument usn results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/qcycop0101-hash/CVE/issues/16; https://vuldb.com/?ctiid.324613; https://vuldb.com/?id.324613
CVE: CVE-2025-40933
Published: 2025-09-17
Description: Apache::AuthAny::Cookie v0.201 or earlier for Perl generates session ids insecurely.

Session ids are generated using an MD5 hash of the epoch time and a call to the built-in rand function. The epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage.

Predicable session ids could allow an attacker to gain access to systems.
CVSS Score: 7.5 (HIGH)
CWE: CWE-338, CWE-340
References: https://metacpan.org/release/KGOLDOV/Apache2-AuthAny-0.201/source/lib/Apache2/AuthAny/Cookie.pm
CVE: CVE-2025-54390
Published: 2025-09-17
Description: A Cross-Site Request Forgery (CSRF) vulnerability exists in the ResetPasswordRequest operation of Zimbra Collaboration (ZCS) when the zimbraFeatureResetPasswordStatus attribute is enabled. An attacker can exploit this by tricking an authenticated user into visiting a malicious webpage that silently sends a crafted SOAP request to reset the user's password. The vulnerability stems from a lack of CSRF token validation on the endpoint, allowing password resets without the user's consent.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-352
References: https://wiki.zimbra.com/wiki/Security_Center; https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy; https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
CVE: CVE-2025-57055
Published: 2025-09-17
Description: WonderCMS 3.5.0 is vulnerable to Server-Side Request Forgery (SSRF) in the custom module installation functionality. An authenticated administrator can supply a malicious URL via the pluginThemeUrl POST parameter. The server fetches the provided URL using curl_exec() without sufficient validation, allowing the attacker to force internal or external HTTP requests.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: https://github.com/thawphone/CVE-2025-57055; https://github.com/thawphone/CVE-2025-57055
CVE: CVE-2025-9862
Published: 2025-09-17
Description: Server-Side Request Forgery (SSRF) vulnerability in Ghost allows an attacker to access internal resources.This issue affects Ghost: from 6.0.0 through 6.0.8, from 5.99.0 through 5.130.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: https://fluidattacks.com/advisories/regida; https://github.com/TryGhost/Ghost; https://github.com/TryGhost/Ghost/releases/tag/v6.0.9
CVE: CVE-2025-10597
Published: 2025-09-17
Description: A vulnerability was determined in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464. This vulnerability affects unknown code of the file /Profilers/PriProfile/COUNT2.php. This manipulation of the argument cname causes sql injection. The attack may be initiated remotely. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/shang-hh/shang/blob/main/sql.txt; https://vuldb.com/?ctiid.324614; https://vuldb.com/?id.324614
CVE: CVE-2025-10598
Published: 2025-09-17
Description: A vulnerability was identified in SourceCodester Pet Grooming Management Software 1.0. This issue affects some unknown processing of the file /admin/search_product.php. Such manipulation of the argument group_id leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Jacob-z691/CVE/issues/3; https://vuldb.com/?ctiid.324615; https://vuldb.com/?id.324615
CVE: CVE-2025-10599
Published: 2025-09-17
Description: A security flaw has been discovered in itsourcecode Web-Based Internet Laboratory Management System 1.0. Impacted is the function User::AuthenticateUser of the file login.php. Performing manipulation of the argument user_email results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/drew-byte/Web-Based-Internet-Laboratory-Management-System_SQLi-PoC/blob/main/README.md; https://itsourcecode.com/; https://vuldb.com/?ctiid.324616
CVE: CVE-2025-10600
Published: 2025-09-17
Description: A flaw has been found in SourceCodester Online Exam Form Submission 1.0. This impacts an unknown function of the file /register.php. This manipulation of the argument img causes unrestricted upload. It is possible to initiate the attack remotely. The exploit has been published and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/qcycop0101-hash/CVE/issues/18; https://vuldb.com/?ctiid.324620; https://vuldb.com/?id.324620
CVE: CVE-2025-10601
Published: 2025-09-17
Description: A vulnerability has been found in SourceCodester Online Exam Form Submission 1.0. Affected is an unknown function of the file /admin/index.php. Such manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/qcycop0101-hash/CVE/issues/19; https://vuldb.com/?ctiid.324621; https://vuldb.com/?id.324621
CVE: CVE-2025-10602
Published: 2025-09-17
Description: A vulnerability was found in SourceCodester Online Exam Form Submission 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/delete_s1.php. Performing manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/qcycop0101-hash/CVE/issues/20; https://vuldb.com/?ctiid.324622; https://vuldb.com/?id.324622
CVE: CVE-2025-10603
Published: 2025-09-17
Description: A vulnerability was determined in PHPGurukul Online Discussion Forum 1.0. Affected by this issue is some unknown functionality of the file /admin/admin_forum/search_result.php. Executing manipulation of the argument Search can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/maximdevere/cve/issues/1; https://phpgurukul.com/; https://vuldb.com/?ctiid.324623
CVE: CVE-2025-35430
Published: 2025-09-17
Description: CISA Thorium does not adequately validate the paths of downloaded files via 'download_ephemeral' and 'download_children'. A remote, authenticated attacker could access arbitrary files subject to file system permissions. Fixed in 1.1.2.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: https://github.com/cisagov/thorium/blob/main/api/src/utils/bounder.rs#L120-L158; https://github.com/cisagov/thorium/releases/tag/1.1.2; https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-259-01.json
CVE: CVE-2025-35431
Published: 2025-09-17
Description: CISA Thorium does not escape user controlled strings used in LDAP queries. An authenticated remote attacker can modify LDAP authorization data such as group memberships. Fixed in 1.1.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-90
References: https://github.com/cisagov/thorium/commit/7c94a0b9bc2dc55e0c307360452f348bac06820c#diff-45e1e58dfb6faacf9efe778c31ead287d8e13ae07c5dad084c792bc4a0605a68R1007-R1008; https://github.com/cisagov/thorium/releases/tag/1.1.1; https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-259-01.json
CVE: CVE-2025-35432
Published: 2025-09-17
Description: CISA Thorium does not rate limit requests to send account verification email messages. A remote unauthenticated attacker can send unlimited messages to a user who is pending verification. Fixed in 1.1.1 by adding a rate limit set by default to 10 minutes.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400
References: https://github.com/cisagov/thorium/commit/7c94a0b9bc2dc55e0c307360452f348bac06820c#diff-bf9baa11b76cd169902a976bd17a5a6ee95a4098b2d3d150ba7d8f85b7e21dc9R281-R334; https://github.com/cisagov/thorium/releases/tag/1.1.1; https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-259-01.json
CVE: CVE-2025-35433
Published: 2025-09-17
Description: CISA Thorium does not properly invalidate previously used tokens when resetting passwords. An attacker that possesses a previously used token could still log in after a password reset. Fixed in 1.1.1.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-613
References: https://github.com/cisagov/thorium/commit/7c94a0b9bc2dc55e0c307360452f348bac06820c#diff-57a8b13962b268bcc3690df0f6c0d6ddeca7cbc7b05c3c20903cb07e659330eaR844-R849; https://github.com/cisagov/thorium/releases/tag/1.1.1; https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-259-01.json
CVE: CVE-2025-35434
Published: 2025-09-17
Description: CISA Thorium does not validate TLS certificates when connecting to Elasticsearch. An unauthenticated attacker with access to a Thorium cluster could impersonate the Elasticsearch service. Fixed in 1.1.2.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-295
References: https://github.com/cisagov/thorium/blob/main/api/src/models/backends/setup/elastic_setup.rs#L36-L43; https://github.com/cisagov/thorium/releases/tag/1.1.2; https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-259-01.json
CVE: CVE-2025-35435
Published: 2025-09-17
Description: CISA Thorium accepts a stream split size of zero then divides by this value. A remote, authenticated attacker could cause the service to crash. Fixed in commit 89101a6.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-369
References: https://github.com/cisagov/thorium/commit/7c94a0b9bc2dc55e0c307360452f348bac06820c; https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-259-01.json; https://www.cve.org/CVERecord?id=CVE-2025-CVE-2025-35435
CVE: CVE-2025-35436
Published: 2025-09-17
Description: CISA Thorium uses '.unwrap()' to handle errors related to account verification email messages. An unauthenticated remote attacker could cause a crash by providing a specially crafted email address or response. Fixed in commit 6a65a27.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-248
References: https://github.com/mjcarson/thorium/commit/6a65a2711fb2387e8c3eacebc774053741bf5aeb; https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-259-01.json; https://www.cve.org/CVERecord?id=CVE-2025-35436
CVE: CVE-2025-59304
Published: 2025-09-17
Description: A directory traversal issue in Swetrix Web Analytics API 3.1.1 before 7d8b972 allows a remote attacker to achieve Remote Code Execution via a crafted HTTP request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://github.com/Swetrix/swetrix/pull/397; https://www.depthfirst.com/post/anatomy-of-an-automated-patch-fixing-a-file-upload-rce-cve-2025-59304
CVE: CVE-2025-10604
Published: 2025-09-17
Description: A vulnerability was identified in PHPGurukul Online Discussion Forum 1.0. This affects an unknown part of the file /admin/edit_member.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/maximdevere/cve/issues/2; https://phpgurukul.com/; https://vuldb.com/?ctiid.324624
CVE: CVE-2025-10605
Published: 2025-09-17
Description: A security flaw has been discovered in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /agenda_preferencias.php. The manipulation of the argument tipoacao results in cross site scripting. The attack may be launched remotely. The exploit has been released to the public and may be exploited.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-10605.md; https://github.com/marcelomulder/CVE/blob/main/i-educar/Cross-Site%20Scripting%20(XSS)%20Reflected%20endpoint%20%60agenda_preferencias.php%60%20parameter%20%60tipoacao%60.md; https://vuldb.com/?ctiid.324625
CVE: CVE-2025-10606
Published: 2025-09-17
Description: A weakness has been identified in Portabilis i-Educar up to 2.10. This issue affects some unknown processing of the file /module/Configuracao/ConfiguracaoMovimentoGeral. This manipulation of the argument tipoacao causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-10606.md; https://github.com/marcelomulder/CVE/blob/main/i-educar/Cross-Site%20Scripting%20(XSS)%20Reflected%20endpoint%20%60.module.Configuracao.ConfiguracaoMovimentoGeral%60%20parameter%20%60tipoacao%60.md; https://vuldb.com/?ctiid.324626
CVE: CVE-2025-10607
Published: 2025-09-17
Description: A security vulnerability has been detected in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /module/Avaliacao/diarioApi. Such manipulation leads to information disclosure. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-284
References: https://github.com/marcelomulder/CVE/blob/main/i-educar/Broken%20Object%20Level%20Authorization%20(BOLA)%20allows%20enumeration%20of%20classes%20informations%20via%20.module.Avaliacao.diarioApi.md; https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-10607.md; https://vuldb.com/?ctiid.324627
CVE: CVE-2025-58431
Published: 2025-09-17
Description: ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.4.1 and earlier, the /v2_1/files/file/download endpoint allows file read from ANY USER who has access to localhost. File reads are performed AS ROOT.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-250
References: https://github.com/IceWhaleTech/ZimaOS/security/advisories/GHSA-vqrw-9v9m-6g87; https://github.com/IceWhaleTech/ZimaOS/security/advisories/GHSA-vqrw-9v9m-6g87
CVE: CVE-2025-58432
Published: 2025-09-17
Description: ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.4.1 and all prior versions, the /v2_1/files/file/uploadV2 endpoint allows file upload from ANY USER who has access to localhost. File uploads are performed AS ROOT.
CVSS Score: 7.8 (HIGH)
CWE: CWE-250, CWE-269
References: https://github.com/IceWhaleTech/ZimaOS/security/advisories/GHSA-3gp9-43rg-xrcc; https://github.com/IceWhaleTech/ZimaOS/security/advisories/GHSA-3gp9-43rg-xrcc
CVE: CVE-2025-58766
Published: 2025-09-17
Description: Dyad is a local AI app builder. A critical security vulnerability has been discovered that affected Dyad v0.19.0 and earlier versions that allows attackers to execute arbitrary code on users' systems. The vulnerability affects the application's preview window functionality and can bypass Docker container protections.  An attacker can craft web content that automatically executes when the preview loads. The malicious content can break out of the application's security boundaries and gain control of the system. This has been fixed in Dyad v0.20.0 and later.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-94
References: https://github.com/dyad-sh/dyad/commit/1c0255ab126d3b38ae9e78b17cdab9a07e5f0185; https://github.com/dyad-sh/dyad/commit/ebcf89ee6cead83a33add5ef1e19c8d4f9b4ce9b; https://github.com/dyad-sh/dyad/security/advisories/GHSA-7fxm-c5xx-7vpq
CVE: CVE-2025-58767
Published: 2025-09-17
Description: REXML is an XML toolkit for Ruby. The REXML gems from 3.3.3 to 3.4.1 has a DoS vulnerability when parsing XML containing multiple XML declarations. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities. The REXML gem 3.4.2 or later include the patches to fix these vulnerabilities.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400
References: https://github.com/ruby/rexml/commit/5859bdeac792687eaf93d8e8f0b7e3c1e2ed5c23; https://github.com/ruby/rexml/security/advisories/GHSA-c2f4-jgmc-q2r5
CVE: CVE-2025-59339
Published: 2025-09-17
Description: The Bastion provides authentication, authorization, traceability and auditability for SSH accesses. Session-recording ttyrec files, may be handled by the provided osh-encrypt-rsync script that is a helper to rotate, encrypt, sign, copy, and optionally move them to a remote storage periodically, if configured to. When running, the script properly rotates and encrypts the files using the provided GPG key(s), but silently fails to sign them, even if asked to.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-325
References: https://github.com/ovh/the-bastion/commit/9bc85ec3f4b724f903773ba64909777c4826a13f; https://github.com/ovh/the-bastion/security/advisories/GHSA-h66q-g57p-rgg6
CVE: CVE-2025-59341
Published: 2025-09-17
Description: esm.sh is a nobuild content delivery network(CDN) for modern web development. In 136 and earlier, a Local File Inclusion (LFI) issue was identified in the esm.sh service URL handling. An attacker could craft a request that causes the server to read and return files from the host filesystem (or other unintended file sources).
CWE: CWE-23
References: https://github.com/esm-dev/esm.sh/blob/c62f191d32639314ff0525d1c3c0e19ea2b16143/server/router.go#L1168; https://github.com/esm-dev/esm.sh/security/advisories/GHSA-49pv-gwxp-532r
CVE: CVE-2025-59342
Published: 2025-09-17
Description: esm.sh is a nobuild content delivery network(CDN) for modern web development. In 136 and earlier, a path-traversal flaw in the handling of the X-Zone-Id HTTP header allows an attacker to cause the application to write files outside the intended storage location. The header value is used to build a filesystem path but is not properly canonicalized or restricted to the application’s storage base directory. As a result, supplying ../ sequences in X-Zone-Id causes files to be written to arbitrary directories. Version 136.1 contains a patch.
CWE: CWE-24
References: https://github.com/esm-dev/esm.sh/blob/main/server/router.go#L116; https://github.com/esm-dev/esm.sh/blob/main/server/router.go#L411; https://github.com/esm-dev/esm.sh/commit/833a29f42aeb0acbd7089a71be11dd0a292d3151
CVE: CVE-2025-10608
Published: 2025-09-17
Description: A vulnerability was detected in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /enrollment-history/. Performing manipulation results in improper access controls. The attack is possible to be carried out remotely. The exploit is now public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-266, CWE-284
References: https://github.com/marcelomulder/CVE/blob/main/i-educar/Broken%20Access%20Control%20Vulnerability%20%20in%20%60.enrollment-history.(ID)%60%20Endpoint.md; https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-10608.md; https://vuldb.com/?ctiid.324628
CVE: CVE-2025-10613
Published: 2025-09-17
Description: A vulnerability has been found in itsourcecode Student Information System 1.0. The affected element is an unknown function of the file /leveledit1.php. Such manipulation of the argument level_id leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/jianx0i/CVE/issues/1; https://itsourcecode.com/; https://vuldb.com/?ctiid.324639
CVE: CVE-2025-56648
Published: 2025-09-17
Description: npm parcel 2.0.0-alpha and before has an Origin Validation Error vulnerability. Malicious websites can send XMLHTTPRequests to the application's development server and read the response to steal source code when developers visit them.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-346
References: https://gist.github.com/R4356th/41f468def606b2406e36f7193f5322b8; https://github.com/parcel-bundler/parcel/commit/4bc56e3242a85491c7edf589966e9b44c6330c49; https://github.com/parcel-bundler/parcel/discussions/10089
CVE: CVE-2025-59345
Published: 2025-09-17
Description: Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, The /api/v1/jobs and /preheats endpoints in Manager web UI are accessible without authentication. Any user with network access to the Manager can create, delete, and modify jobs, and create preheat jobs. An unauthenticated adversary with network access to a Manager web UI uses /api/v1/jobs endpoint to create hundreds of useless jobs. The Manager is in a denial-of-service state, and stops accepting requests from valid administrators. This vulnerability is fixed in 2.1.0.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-306
References: https://github.com/dragonflyoss/dragonfly/blob/main/docs/security/dragonfly-comprehensive-report-2023.pdf; https://github.com/dragonflyoss/dragonfly/security/advisories/GHSA-89vc-vf32-ch59