deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-26865
Published: 2025-03-10
Description: Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: from 18.12.17 before 18.12.18.  

It's a regression between 18.12.17 and 18.12.18.
In case you use something like that, which is not recommended!
For security, only official releases should be used.

In other words, if you use 18.12.17 you are still safe.
The version 18.12.17 is not a affected.
But something between 18.12.17 and 18.12.18 is.

In that case, users are recommended to upgrade to version 18.12.18, which fixes the issue.
CVSS Score: 3.5 (LOW)
CWE: CWE-1336
References: https://issues.apache.org/jira/browse/OFBIZ-12594; https://lists.apache.org/thread/prb48ztk01bflyyjbl6p56wlcc1n5sz7; https://ofbiz.apache.org/download.html
CVE: CVE-2025-2152
Published: 2025-03-10
Description: A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. This issue affects the function Assimp::BaseImporter::ConvertToUTF8 of the file BaseImporter.cpp of the component File Handler. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-119, CWE-122, CWE-787
References: https://github.com/assimp/assimp/issues/6027; https://github.com/assimp/assimp/issues/6027#issue[PII_REDACTED]; https://vuldb.com/?ctiid.299063
CVE: CVE-2025-2153
Published: 2025-03-10
Description: A vulnerability, which was classified as critical, was found in HDF5 1.14.6. Affected is the function H5SM_delete of the file H5SM.c of the component h5 File Handler. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119, CWE-122, CWE-787
References: https://github.com/HDFGroup/hdf5/issues/5329; https://github.com/sae-as-me/Crashes/raw/refs/heads/main/hdf5/h5_extended_crash.h5; https://vuldb.com/?ctiid.299064
CVE: CVE-2024-12604
Published: 2025-03-10
Description: Cleartext Storage of Sensitive Information in an Environment Variable, Weak Password Recovery Mechanism for Forgotten Password vulnerability in Tapandsign Technologies Tap&Sign App allows Password Recovery Exploitation, Functionality Misuse.This issue affects Tap&Sign App: before V.1.025.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-526, CWE-640, CWE-312, CWE-640
References: https://docs.tapandsign.com/tap-and-sign/tap-and-sign-v.1.025-surum-notlari; https://www.usom.gov.tr/bildirim/tr-25-0063
CVE: CVE-2025-25614
Published: 2025-03-10
Description: Incorrect Access Control in Unifiedtransform 2.0 leads to Privilege Escalation, which allows teachers to update the personal data of fellow teachers.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://github.com/armaansidana2003/CVE-2025-25614; https://github.com/changeweb/Unifiedtransform; https://github.com/armaansidana2003/CVE-2025-25614
CVE: CVE-2025-25620
Published: 2025-03-10
Description: Unifiedtransform 2.0 is vulnerable to Cross Site Scripting (XSS) in the Create assignment function.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/armaansidana2003/CVE-2025-25620; https://github.com/changeweb/Unifiedtransform
CVE: CVE-2025-26910
Published: 2025-03-10
Description: Cross-Site Request Forgery (CSRF) vulnerability in Iqonic Design WPBookit wpbookit allows Stored XSS.This issue affects WPBookit: from n/a through <= 1.0.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wpbookit/vulnerability/wordpress-wpbookit-plugin-1-0-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-26916
Published: 2025-03-10
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Pixflow Massive Dynamic massive-dynamic.This issue affects Massive Dynamic: from n/a through <= 8.2.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/massive-dynamic/vulnerability/wordpress-massive-dynamic-theme-8-2-unauthenticated-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-26933
Published: 2025-03-10
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Nitin Prakash WC Place Order Without Payment wc-place-order-without-payment allows PHP Local File Inclusion.This issue affects WC Place Order Without Payment: from n/a through <= 2.6.7.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/wc-place-order-without-payment/vulnerability/wordpress-place-order-without-payment-for-woocommerce-plugin-2-6-7-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-26936
Published: 2025-03-10
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in FRESHFACE Fresh Framework fresh-framework allows Code Injection.This issue affects Fresh Framework: from n/a through <= 1.70.0.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-94
References: https://patchstack.com/database/Wordpress/Plugin/fresh-framework/vulnerability/wordpress-fresh-framework-plugin-1-70-0-unauthenticated-remote-code-execution-rce-vulnerability?_s_id=cve
CVE: CVE-2024-47109
Published: 2025-03-10
Description: IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.3 UI could disclosure the installation path of the server which could aid in further attacks against the system.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-522
References: https://www.ibm.com/support/pages/node/7185259
CVE: CVE-2024-52905
Published: 2025-03-10
Description: IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.3 could disclose sensitive database information to a privileged user.
CVSS Score: 2.7 (LOW)
CWE: CWE-497
References: https://www.ibm.com/support/pages/node/7185264
CVE: CVE-2025-25382
Published: 2025-03-10
Description: An issue in the Property Tax Payment Portal in Information Kerala Mission SANCHAYA v3.0.4 allows attackers to arbitrarily modify payment amounts via a crafted request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-472
References: https://github.com/edwin-0990/CVE_ID/blob/main/CVE-2025-25382/README.md; https://tax.lsgkerala.gov.in/epayment/QuickPaySearch.php; https://github.com/edwin-0990/CVE_ID/blob/main/CVE-2025-25382/README.md
CVE: CVE-2025-25940
Published: 2025-03-10
Description: VisiCut 2.1 allows code execution via Insecure XML Deserialization in the loadPlfFile method of VisicutModel.java.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://github.com/t-oster/VisiCut; https://royblume.github.io/CVE-2025-25940/; https://royblume.github.io/CVE-2025-25940/
CVE: CVE-2025-25977
Published: 2025-03-10
Description: An issue in canvg v.4.0.2 allows an attacker to execute arbitrary code via the Constructor of the class StyleElement.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321
References: https://github.com/canvg/canvg/issues/1749; https://github.com/canvg/canvg/issues/1749
CVE: CVE-2025-24813
Published: 2025-03-10
Description: Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98.
The following versions were EOL at the time the CVE was created but are 
known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions 
may also be affected.


If all of the following were true, a malicious user was able to view       security sensitive files and/or inject content into those files:
- writes enabled for the default servlet (disabled by default)
- support for partial PUT (enabled by default)
- a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads
- attacker knowledge of the names of security sensitive files being uploaded
- the security sensitive files also being uploaded via partial PUT

If all of the following were true, a malicious user was able to       perform remote code execution:
- writes enabled for the default servlet (disabled by default)
- support for partial PUT (enabled by default)
- application was using Tomcat's file based session persistence with the default storage location
- application included a library that may be leveraged in a deserialization attack

Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-44, CWE-502, CWE-502, CWE-706
References: https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq; http://www.openwall.com/lists/oss-security/2025/03/10/5; https://lists.debian.org/debian-lts-announce/2025/04/msg00003.html
CVE: CVE-2024-52812
Published: 2025-03-10
Description: LF Edge eKuiper is an internet-of-things data analytics and stream processing engine. Prior to version 2.0.8, auser with rights to modify the service (e.g. kuiperUser role) can inject a cross-site scripting payload into the rule `id` parameter. Then, after any user with access to this service (e.g. admin) tries make any modifications with the rule (update, run, stop, delete), a payload acts in the victim's browser. Version 2.0.8 fixes the issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L681; https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L716; https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L735
CVE: CVE-2024-53307
Published: 2025-03-10
Description: A reflected cross-site scripting (XSS) vulnerability in the /mw/ endpoint of Evisions MAPS v6.10.2.267 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/Xib3rR4dAr/bf754848f1cd77162f79226144b04648; https://webhelp.evisions.com/releaseguides/maps/default.htm#6.11/6.11%20Release%20Notes.htm?TocPath=MAPS%25206.11%2520Release%2520Guide%257C_____3; https://gist.github.com/Xib3rR4dAr/bf754848f1cd77162f79226144b04648
CVE: CVE-2024-55199
Published: 2025-03-10
Description: A Stored Cross Site Scripting (XSS) vulnerability in Celk Sistemas Celk Saude v.3.1.252.1 allows a remote attacker to store JavaScript code inside a PDF file through the file upload feature. When the file is rendered, the injected code is executed on the user's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/gabriel-bri/vulnerability-research/tree/main/CVE-2024-55199; https://portswigger.net/web-security/cross-site-scripting/stored; https://github.com/gabriel-bri/vulnerability-research/tree/main/CVE-2024-55199
CVE: CVE-2025-1296
Published: 2025-03-10
Description: Nomad Community and Nomad Enterprise (“Nomad”) are vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs. This vulnerability, identified as CVE-2025-1296, is fixed in Nomad Community Edition 1.9.7 and Nomad Enterprise 1.9.7, 1.8.11, and 1.7.19.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-532
References: https://discuss.hashicorp.com/t/hcsec-2025-04-nomad-exposes-sensitive-workload-identity-and-client-secret-token-in-audit-logs/73737
CVE: CVE-2024-44179
Published: 2025-03-10
Description: This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, macOS Sequoia 15. An attacker with physical access to a device may be able to read contact numbers from the lock screen.
CVSS Score: 2.4 (LOW)
CWE: CWE-200
References: https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121246; https://support.apple.com/en-us/121250
CVE: CVE-2024-44192
Published: 2025-03-10
Description: The issue was addressed with improved checks. This issue is fixed in Safari 18, iOS 18 and iPadOS 18, macOS Sequoia 15, tvOS 18, visionOS 2, watchOS 11. Processing maliciously crafted web content may lead to an unexpected process crash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121240; https://support.apple.com/en-us/121241
CVE: CVE-2024-44227
Published: 2025-03-10
Description: The issue was addressed with improved memory handling. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15. An app may be able to cause unexpected system termination or corrupt kernel memory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121250
CVE: CVE-2024-54463
Published: 2025-03-10
Description: This issue was addressed with improved entitlements. This issue is fixed in macOS Sequoia 15. An app may be able to access removable volumes without user consent.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/en-us/121238
CVE: CVE-2024-54467
Published: 2025-03-10
Description: A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18, iOS 18 and iPadOS 18, macOS Sequoia 15, tvOS 18, visionOS 2, watchOS 11. A malicious website may exfiltrate data cross-origin.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121240; https://support.apple.com/en-us/121241
CVE: CVE-2024-54469
Published: 2025-03-10
Description: The issue was addressed with improved checks. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7, visionOS 2. A local user may be able to leak sensitive user information.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://support.apple.com/en-us/121234; https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121247
CVE: CVE-2024-54473
Published: 2025-03-10
Description: This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15. An app may be able to access user-sensitive data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://support.apple.com/en-us/121238
CVE: CVE-2024-54546
Published: 2025-03-10
Description: The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15. An app may be able to cause unexpected system termination or corrupt kernel memory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://support.apple.com/en-us/121238
CVE: CVE-2024-54558
Published: 2025-03-10
Description: A clickjacking issue was addressed with improved out-of-process view handling. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15. An app may be able to trick a user into granting access to photos from the user's photo library.
CVSS Score: 2.8 (LOW)
CWE: CWE-451
References: https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121250
CVE: CVE-2024-54560
Published: 2025-03-10
Description: A logic issue was addressed with improved checks. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15, tvOS 18, watchOS 11. A malicious app may be able to modify other apps without having App Management permission.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-269
References: https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121240; https://support.apple.com/en-us/121248
CVE: CVE-2024-56184
Published: 2025-03-10
Description: In static long dev_send of tipc_dev_ql, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2025-03-01
CVE: CVE-2024-56185
Published: 2025-03-10
Description: In ProtocolUnsolOnSSAdapter::GetServiceClass() of protocolcalladapter.cpp, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with baseband firmware compromise required. User Interaction is not needed for exploitation.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2025-03-01
CVE: CVE-2024-56186
Published: 2025-03-10
Description: In closeChannel of secureelementimpl.cpp, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2025-03-01
CVE: CVE-2024-56187
Published: 2025-03-10
Description: In ppcfw_deny_sec_dram_access of ppcfw.c, there is a possible arbitrary read from TEE memory due to a logic error in the code. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2025-03-01
CVE: CVE-2024-56188
Published: 2025-03-10
Description: there is a possible way to crash the modem due to a missing null check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-476
References: https://source.android.com/security/bulletin/pixel/2025-03-01
CVE: CVE-2025-22603
Published: 2025-03-10
Description: AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Versions prior to autogpt-platform-beta-v0.4.2 contains a server-side request forgery (SSRF) vulnerability inside component (or block) `Send Web Request`. The root cause is  that IPV6 address is not restricted or filtered, which allows attackers to perform a server side request forgery to visit an IPV6 service. autogpt-platform-beta-v0.4.2 fixes the issue.
CVSS Score: 8.1 (HIGH)
CWE: CWE-918
References: https://boatneck-faucet-cba.notion.site/SSRF-of-AutoGPT-153b650a4d88804d923ad65a015a7d61; https://github.com/Significant-Gravitas/AutoGPT/blob/2121ffd06b26a438706bf642372cc46d81c94ddc/autogpt_platform/backend/backend/util/request.py#L11; https://github.com/Significant-Gravitas/AutoGPT/commit/26214e1b2c6777e0fae866642b23420adaadd6c4
CVE: CVE-2025-25306
Published: 2025-03-10
Description: Misskey is an open source, federated social media platform. The patch for CVE-2024-52591 did not sufficiently validate the relation between the `id` and `url` fields of ActivityPub objects. An attacker can forge an object where they claim authority in the `url` field even if the specific ActivityPub object type require authority in the `id` field. Version 2025.2.1 addresses the issue.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-346, CWE-441, CWE-1025
References: https://github.com/misskey-dev/misskey/releases/tag/2025.2.1; https://github.com/misskey-dev/misskey/security/advisories/GHSA-6w2c-vf6f-xf26
CVE: CVE-2025-26695
Published: 2025-03-10
Description: When requesting an OpenPGP key from a WKD server, an incorrect padding size was used and a network observer could have learned the length of the requested email address. This vulnerability was fixed in Thunderbird 136 and Thunderbird 128.8.
CVSS Score: 5.3 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1883039; https://www.mozilla.org/security/advisories/mfsa2025-17/; https://www.mozilla.org/security/advisories/mfsa2025-18/
CVE: CVE-2025-26696
Published: 2025-03-10
Description: Certain crafted MIME email messages that claimed to contain an encrypted OpenPGP message, which instead contained an OpenPGP signed message, were wrongly shown as being encrypted. This vulnerability was fixed in Thunderbird 136 and Thunderbird 128.8.
CVSS Score: 7.0 (HIGH)
CWE: CWE-290
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1864205; https://www.mozilla.org/security/advisories/mfsa2025-17/; https://www.mozilla.org/security/advisories/mfsa2025-18/
CVE: CVE-2025-27136
Published: 2025-03-10
Description: LocalS3 is an Amazon S3 mock service for testing and local development. Prior to version 1.21, the LocalS3 service's bucket creation endpoint is vulnerable to XML External Entity (XXE) injection. When processing the CreateBucketConfiguration XML document during bucket creation, the service's XML parser is configured to resolve external entities. This allows an attacker to declare an external entity that references an internal URL, which the server will then attempt to fetch when parsing the XML. The vulnerability specifically occurs in the location constraint processing, where the XML parser resolves external entities without proper validation or restrictions. When the external entity is resolved, the server makes an HTTP request to the specified URL and includes the response content in the parsed XML document. This vulnerability can be exploited to perform server-side request forgery (SSRF) attacks, allowing an attacker to make requests to internal services or resources that should not be accessible from external networks. The server will include the responses from these internal requests in the resulting bucket configuration, effectively leaking sensitive information. The attacker only needs to be able to send HTTP requests to the LocalS3 service to exploit this vulnerability.
CWE: CWE-611
References: https://github.com/Robothy/local-s3/commit/d6ed756ceb30c1eb9d4263321ac683d734f8836f; https://github.com/Robothy/local-s3/security/advisories/GHSA-g6wm-2v64-wq36
CVE: CVE-2025-27615
Published: 2025-03-10
Description: umatiGateway is software for connecting OPC Unified Architecture servers with an MQTT broker utilizing JSON messages. The user interface may possibly be publicly accessible with umatiGateway's provided docker-compose file. With this access, the configuration can be viewed and altered. Commit 5d81a3412bc0051754a3095d89a06d6d743f2b16 uses `127.0.0.1:8080:8080` to limit access to the local network. For those who are unable to use this proposed patch, a firewall on Port 8080 may block remote access, but the workaround may not be perfect because Docker may also bypass a firewall by its iptable based rules for port forwarding.
CVSS Score: 8.2 (HIGH)
CWE: CWE-200
References: https://github.com/umati/umatiGateway/blob/abe73096a17307327f0d6dc0ed4db1fb93464521/README.md?plain=1#L34-L35; https://github.com/umati/umatiGateway/commit/5d81a3412bc0051754a3095d89a06d6d743f2b16; https://github.com/umati/umatiGateway/pull/101
CVE: CVE-2025-27616
Published: 2025-03-10
Description: Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. Prior to versions 0.25.3 and 0.26.3, by spoofing a webhook payload with a specific set of headers and body data, an attacker could transfer ownership of a repository and its repo level secrets to a separate repository. These secrets could be exfiltrated by follow up builds to the repository. Users with an enabled repository with access to repo level CI secrets in Vela are vulnerable to the exploit, and any user with access to the CI instance and the linked source control manager can perform the exploit. Versions 0.25.3 and 0.26.3 fix the issue. No known workarounds are available.
CVSS Score: 8.5 (HIGH)
CWE: CWE-290, CWE-345
References: https://github.com/go-vela/server/commit/257886e5a3eea[PII_REDACTED]85894e239668584f5; https://github.com/go-vela/server/commit/67c1892e2464dc54b8d2588815dfb[PII_REDACTED]b; https://github.com/go-vela/server/releases/tag/v0.25.3