deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-36245
Published: 2025-09-29
Description: IBM InfoSphere 11.7.0.0 through 11.7.1.6 Information Server could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.ibm.com/support/pages/node/7246170
CVE: CVE-2025-43812
Published: 2025-09-29
Description: Cross-site scripting (XSS) vulnerability in web content template in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into a web content structure's Name text field
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43812
CVE: CVE-2025-43813
Published: 2025-09-29
Description: Possible path traversal vulnerability and denial-of-service in the ComboServlet in Liferay Portal 7.4.0 through 7.4.3.107, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to access arbitrary CSS and JSS files and load the files multiple times via the query string in a URL.
CVSS Score: 8.2 (HIGH)
CWE: CWE-22
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43813
CVE: CVE-2025-43817
Published: 2025-09-29
Description: Multiple reflected cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.74 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.6, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 74 through update 92 allow remote attackers to inject arbitrary web script or HTML via the `redirect` parameter to (1) Announcements, or (2) Alerts.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43817
CVE: CVE-2025-59937
Published: 2025-09-29
Description: go-mail is a comprehensive library for sending mails with Go. In versions 0.7.0 and below, due to incorrect handling of the mail.Address values when a sender- or recipient address is passed to the corresponding MAIL FROM or RCPT TO commands of the SMTP client, there is a possibility of wrong address routing or even ESMTP parameter smuggling. For successful exploitation, it is required that the user's code allows for arbitrary mail address input (i. e. through a web form or similar). If only static mail addresses are used (i. e. in a config file) and the mail addresses in use do not consist of quoted local parts, this should not affect users. This issue is fixed in version 0.7.1
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-88, CWE-88
References: https://github.com/wneessen/go-mail/commit/42e92cfe027be04aff72921adb0f72f11d517479; https://github.com/wneessen/go-mail/issues/495; https://github.com/wneessen/go-mail/pull/496
CVE: CVE-2025-59940
Published: 2025-09-29
Description: mkdocs-include-markdown-plugin is an Mkdocs Markdown includer plugin. In versions 7.1.7 and below, there is a vulnerability where unvalidated input can collide with substitution placeholders. This issue is fixed in version 7.1.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://github.com/mondeja/mkdocs-include-markdown-plugin/commit/7466d67aa0de8ffbc427204ad2475fed07678915; https://github.com/mondeja/mkdocs-include-markdown-plugin/issues/274; https://github.com/mondeja/mkdocs-include-markdown-plugin/pull/277
CVE: CVE-2025-59941
Published: 2025-09-29
Description: go-f3 is a Golang implementation of Fast Finality for Filecoin (F3). In versions 0.8.8 and below, go-f3's justification verification caching mechanism has a vulnerability where verification results are cached without properly considering the context of the message. An attacker can bypass justification verification by submitting a valid message with a correct justification and then reusing the same cached justification in contexts where it would normally be invalid. This occurs because the cached verification does not properly validate the relationship between the justification and the specific message context it's being used with. This issue is fixed in version 0.8.9.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-305
References: https://github.com/filecoin-project/go-f3/commit/76fff18cf07b21baccf537024bdb2fb41f75f6e2#diff-e1f646cea41790e1642e4e649c9e3c526344736d[PII_REDACTED]3e1c29c23e9625; https://github.com/filecoin-project/go-f3/security/advisories/GHSA-7pq9-rf9p-wcrf
CVE: CVE-2025-59942
Published: 2025-09-29
Description: go-f3 is a Golang implementation of Fast Finality for Filecoin (F3). In versions 0.8.6 and below, go-f3 panics when it validates a "poison" messages causing Filecoin nodes consuming F3 messages to become vulnerable. A "poison" message can can cause integer overflow in the signer index validation, which can cause the whole node to crash. These malicious messages aren't self-propagating since the bug is in the validator. An attacker needs to directly send the message to all targets. This issue is fixed in version 0.8.7.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/filecoin-project/go-f3/security/advisories/GHSA-g99p-47x7-mq88
CVE: CVE-2025-59948
Published: 2025-09-29
Description: FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below do not sanitize certain event handler attributes in feed content, so by finding a page that renders feed entries without CSP, it is possible to execute an XSS payload. The Allow API access authentication setting needs to be enabled by the instance administrator beforehand for the attack to work as it relies on api/query.php. An account takeover is possible by sending a change password request via the XSS payload / setting UserJS for persistence / stealing the autofill password / displaying a phishing page with a spoofed URL using history.replaceState()
If the victim is an administrator, the attacker can also perform administrative actions. This issue is fixed in version 1.27.0.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-79
References: https://github.com/FreshRSS/FreshRSS/commit/7df6c201f2e6a6521d20718dfd8d9794c7437d1f; https://github.com/FreshRSS/FreshRSS/releases/tag/1.27.0; https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-rwhf-vjjx-gmm9
CVE: CVE-2025-59950
Published: 2025-09-30
Description: FreshRSS is a free, self-hostable RSS aggregator. In versions 1.26.3 and below, due to a bypass of double clickjacking protection (confirmation dialog), it is possible to trick the admin into clicking the Promote button in another user's management page after the admin double clicks on a button inside an attacker-controlled website. A successful attack can allow the attacker to promote themselves to "admin" and log into other users' accounts; the attacker has to know the specific instance URL they're targeting. This issue is fixed in version 1.27.0.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-1021
References: https://github.com/FreshRSS/FreshRSS/pull/7771; https://github.com/FreshRSS/FreshRSS/releases/tag/1.27.0; https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-j66v-hvqx-5vh3
CVE: CVE-2025-59952
Published: 2025-09-30
Description: MinIO Java SDK is a Simple Storage Service (aka S3) client to perform bucket and object operations to any Amazon S3 compatible object storage service. In minio-java versions prior to 8.6.0, XML tag values containing references to system properties or environment variables were automatically substituted with their actual values during processing. This unintended behavior could lead to the exposure of sensitive information, including credentials, file paths, or system configuration details, if such references were present in XML content from untrusted sources. This is fixed in version 8.6.0.
CWE: CWE-20, CWE-94
References: https://github.com/minio/minio-java/commit/f7a98d06b25e5464bdd4811b044e25ff9101d37f; https://github.com/minio/minio-java/releases/tag/8.6.0; https://github.com/minio/minio-java/security/advisories/GHSA-h7rh-xfpj-hpcm
CVE: CVE-2025-61586
Published: 2025-09-30
Description: FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below are vulnerable to directory enumeration by setting path in theme field, allowing attackers to gain additional information about the server by checking if certain directories exist. This issue is fixed in version 1.27.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/FreshRSS/FreshRSS/commit/6549932d59aef3b72a9da29294af0f30ffb77af5; https://github.com/FreshRSS/FreshRSS/pull/7722; https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-w35p-p867-qr4f
CVE: CVE-2024-58040
Published: 2025-09-30
Description: Crypt::RandomEncryption for Perl version 0.01 uses insecure rand() function during encryption.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-331, CWE-338
References: https://metacpan.org/release/QWER/Crypt-RandomEncryption-0.01/source/lib/Crypt/RandomEncryption.pm#L33; https://perldoc.perl.org/functions/rand; https://security.metacpan.org/docs/guides/random-data-for-security.html
CVE: CVE-2025-10000
Published: 2025-09-30
Description: The Qyrr – simply and modern QR-Code creation plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the blob_to_file() function in all versions up to, and including, 2.0.7. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-434
References: https://plugins.trac.wordpress.org/browser/qyrr-code/trunk/inc/class-qyrr-rest.php#L94; https://plugins.trac.wordpress.org/changeset/3454683/; https://www.wordfence.com/threat-intel/vulnerabilities/id/3ff54694-64c4-4112-b126-aabd3e09144b?source=cve
CVE: CVE-2025-10128
Published: 2025-09-30
Description: The Eulerpool Research Systems plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'aaq' shortcode in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-80
References: https://plugins.trac.wordpress.org/browser/alleaktien-quantitativ/trunk/aaq-fundamentals-plugin.php#L36; https://www.wordfence.com/threat-intel/vulnerabilities/id/e0b4267b-2929-489b-86b8-cd256708c5bd?source=cve
CVE: CVE-2025-10130
Published: 2025-09-30
Description: The Layers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'webcam' shortcode in all versions up to, and including, 0.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/layers/trunk/layers.php#L36; https://plugins.trac.wordpress.org/changeset/3370063/; https://wordpress.org/plugins/layers
CVE: CVE-2025-10131
Published: 2025-09-30
Description: The All Social Share Options plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sc' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/all-social-share-options/trunk/shortcodes.php#L14; https://www.wordfence.com/threat-intel/vulnerabilities/id/8761c046-35da-4fc9-a839-c06405ff4b31?source=cve
CVE: CVE-2025-10168
Published: 2025-09-30
Description: The Any News Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'any-ticker' shortcode in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/any-news-ticker/trunk/src/ticker-main.php#L66; https://wordpress.org/plugins/any-news-ticker; https://www.wordfence.com/threat-intel/vulnerabilities/id/c0e7bcae-fcb9-4802-b5f5-9c07a2038baa?source=cve
CVE: CVE-2025-10179
Published: 2025-09-30
Description: The My AskAI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'myaskai' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/my-askai/trunk/myaskai.php#L40; https://www.wordfence.com/threat-intel/vulnerabilities/id/2eaebf25-905c-4a57-96d4-5c3ebbd77b98?source=cve
CVE: CVE-2025-10182
Published: 2025-09-30
Description: The dbview plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dbview' shortcode in all versions up to, and including, 0.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/dbview/trunk/DBView.class.php#L459; https://www.wordfence.com/threat-intel/vulnerabilities/id/acf69e07-884c-4eaf-8b58-c1fd3810e086?source=cve
CVE: CVE-2025-10189
Published: 2025-09-30
Description: The BP Direct Menus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bpdm_login' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/bp-direct-menus/trunk/inc/frontend-noajax.inc.php#L175; https://www.wordfence.com/threat-intel/vulnerabilities/id/c97c0191-1ef4-4a37-a93d-bceb2be298b4?source=cve
CVE: CVE-2025-10191
Published: 2025-09-30
Description: The Big Post Shipping for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wooboigpost_shipping_status' shortcode in all versions up to, and including, 2.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/woo-bigpost-shipping/trunk/includes/class-woobigpost-shortcodes.php#L36; https://plugins.trac.wordpress.org/changeset/3370259/; https://wordpress.org/plugins/woo-bigpost-shipping
CVE: CVE-2025-10196
Published: 2025-09-30
Description: The Survey Anyplace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'surveyanyplace_embed' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.svn.wordpress.org/surveyanyplace/trunk/resources/library/surveyanyplace-shortcodes.php; https://plugins.svn.wordpress.org/surveyanyplace/trunk/resources/templates/surveyanyplace.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/efdb6ec5-e6a8-4279-b637-38267a852472?source=cve
CVE: CVE-2025-10991
Published: 2025-09-30
Description: The attacker may obtain root access by connecting to the UART port and this vulnerability requires the attacker to have the physical access to the device.

This issue affects Tapo D230S1 V1.20: before 1.2.2 Build 20250907.
CWE: CWE-306
References: https://www.tp-link.com/en/support/faq/4693/
CVE: CVE-2025-11148
Published: 2025-09-30
Description: All versions of the package check-branches are vulnerable to Command Injection check-branches is a command-line tool that is interacted with locally, or via CI, to confirm no conflicts exist in git branches.However, the library follows these conventions which can be abused:1. It trusts branch names as they are (plain text)2. It spawns git commands by concatenating user inputSince a branch name is potentially a user input - as users can create branches remotely via pull requests, or simply due to privileged access to a repository - it can effectively be abused to run any command.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://gist.github.com/lirantal/054b4ad039a86c418f2c84e3e884d6ec; https://security.snyk.io/vuln/SNYK-JS-CHECKBRANCHES-2766494
CVE: CVE-2025-11149
Published: 2025-09-30
Description: This affects all versions of the package node-static; all versions of the package @nubosoftware/node-static. The package fails to catch an exception when user input includes null bytes. This allows attackers to access http://host/%00 and crash the server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://github.com/cloudhead/node-static/commit/78879dc665f0f[PII_REDACTED]b6e0b6203a81c7f67; https://security.snyk.io/vuln/SNYK-JS-NODESTATIC-1297183; https://security.snyk.io/vuln/SNYK-JS-NUBOSOFTWARENODESTATIC-3330728
CVE: CVE-2025-11163
Published: 2025-09-30
Description: The SmartCrawl SEO checker, analyzer & optimizer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_submodule() function in all versions up to, and including, 3.14.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's setttings.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://plugins.trac.wordpress.org/browser/smartcrawl-seo/tags/3.14.2/includes/core/controllers/class-submodule-controller.php#L123; https://plugins.trac.wordpress.org/changeset/3366486/smartcrawl-seo/trunk/includes/core/controllers/class-submodule-controller.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/8a63a9b3-c056-45f3-952c-9aee997d1d27?source=cve
CVE: CVE-2025-41091
Published: 2025-09-30
Description: Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to calendar details using unauthorised internal identifiers.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://www.incibe.es/en/incibe-cert/notices/aviso/insecure-direct-object-reference-gps-bold-workplanner
CVE: CVE-2025-41092
Published: 2025-09-30
Description: Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to time records details using unauthorised internal identifiers.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://www.incibe.es/en/incibe-cert/notices/aviso/insecure-direct-object-reference-gps-bold-workplanner
CVE: CVE-2025-41093
Published: 2025-09-30
Description: Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to basic contract details using unauthorised internal identifiers.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://www.incibe.es/en/incibe-cert/notices/aviso/insecure-direct-object-reference-gps-bold-workplanner
CVE: CVE-2025-41094
Published: 2025-09-30
Description: Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to functional contract details using unauthorised internal identifiers.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://www.incibe.es/en/incibe-cert/notices/aviso/insecure-direct-object-reference-gps-bold-workplanner
CVE: CVE-2025-41095
Published: 2025-09-30
Description: Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to planning counter details using unauthorised internal identifiers.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://www.incibe.es/en/incibe-cert/notices/aviso/insecure-direct-object-reference-gps-bold-workplanner
CVE: CVE-2025-41096
Published: 2025-09-30
Description: Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to the dates of the current contract details using unauthorised internal identifiers.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://www.incibe.es/en/incibe-cert/notices/aviso/insecure-direct-object-reference-gps-bold-workplanner
CVE: CVE-2025-41097
Published: 2025-09-30
Description: Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to basic employee  details using unauthorised internal identifiers.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://www.incibe.es/en/incibe-cert/notices/aviso/insecure-direct-object-reference-gps-bold-workplanner
CVE: CVE-2025-41098
Published: 2025-09-30
Description: Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a  misuse of the general enquiry web service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-639
References: https://www.incibe.es/en/incibe-cert/notices/aviso/insecure-direct-object-reference-gps-bold-workplanner
CVE: CVE-2025-41099
Published: 2025-09-30
Description: Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to the list of permissions using unauthorised internal identifiers.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639
References: https://www.incibe.es/en/incibe-cert/notices/aviso/insecure-direct-object-reference-gps-bold-workplanner
CVE: CVE-2025-59668
Published: 2025-09-30
Description: Multiple versions of Central Monitor CNS-6201 contain a NULL pointer dereference vulnerability. When processing a crafted certain UDP packet, the affected device may abnormally terminate.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://jvn.jp/en/vu/JVNVU96989989/; https://www.nihonkohden.com/security.html; https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-296-01