deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-53668
Published: 2025-07-09
Description: Jenkins VAddy Plugin 1.2.8 and earlier stores Vaddy API Auth Keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-311
References: https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3527; http://www.openwall.com/lists/oss-security/2025/07/09/4
CVE: CVE-2025-53669
Published: 2025-07-09
Description: Jenkins VAddy Plugin 1.2.8 and earlier does not mask Vaddy API Auth Keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-256, CWE-522
References: https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3527; http://www.openwall.com/lists/oss-security/2025/07/09/4
CVE: CVE-2025-53670
Published: 2025-07-09
Description: Jenkins Nouvola DiveCloud Plugin 1.08 and earlier stores DiveCloud API Keys and Credentials Encryption Keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-312
References: https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3526; http://www.openwall.com/lists/oss-security/2025/07/09/4
CVE: CVE-2025-53671
Published: 2025-07-09
Description: Jenkins Nouvola DiveCloud Plugin 1.08 and earlier does not mask DiveCloud API Keys and Credentials Encryption Keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-256, CWE-522
References: https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3526; http://www.openwall.com/lists/oss-security/2025/07/09/4
CVE: CVE-2025-53672
Published: 2025-07-09
Description: Jenkins Kryptowire Plugin 0.2 and earlier stores the Kryptowire API key unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-312
References: https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3525; http://www.openwall.com/lists/oss-security/2025/07/09/4
CVE: CVE-2025-53673
Published: 2025-07-09
Description: Jenkins Sensedia Api Platform tools Plugin 1.0 stores the Sensedia API Manager integration token unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-311
References: https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3551; http://www.openwall.com/lists/oss-security/2025/07/09/4
CVE: CVE-2025-53674
Published: 2025-07-09
Description: Jenkins Sensedia Api Platform tools Plugin 1.0 does not mask the Sensedia API Manager integration token on the global configuration form, increasing the potential for attackers to observe and capture it.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-256
References: https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3551; http://www.openwall.com/lists/oss-security/2025/07/09/4
CVE: CVE-2025-53675
Published: 2025-07-09
Description: Jenkins Warrior Framework Plugin 1.2 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-256
References: https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3516; http://www.openwall.com/lists/oss-security/2025/07/09/4
CVE: CVE-2025-53676
Published: 2025-07-09
Description: Jenkins Xooa Plugin 0.0.7 and earlier stores the Xooa Deployment Token unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-311
References: https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3522; http://www.openwall.com/lists/oss-security/2025/07/09/4
CVE: CVE-2025-53677
Published: 2025-07-09
Description: Jenkins Xooa Plugin 0.0.7 and earlier does not mask the Xooa Deployment Token on the global configuration form, increasing the potential for attackers to observe and capture it.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-256
References: https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3522; http://www.openwall.com/lists/oss-security/2025/07/09/4
CVE: CVE-2025-53678
Published: 2025-07-09
Description: Jenkins User1st uTester Plugin 1.1 and earlier stores the uTester JWT token unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-311
References: https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3518; http://www.openwall.com/lists/oss-security/2025/07/09/4
CVE: CVE-2025-53742
Published: 2025-07-09
Description: Jenkins Applitools Eyes Plugin 1.16.5 and earlier stores Applitools API keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-312
References: https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3510; http://www.openwall.com/lists/oss-security/2025/07/09/4
CVE: CVE-2025-53743
Published: 2025-07-09
Description: Jenkins Applitools Eyes Plugin 1.16.5 and earlier does not mask Applitools API keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-522
References: https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3510; http://www.openwall.com/lists/oss-security/2025/07/09/4
CVE: CVE-2025-7381
Published: 2025-07-09
Description: ImpactThis is an information disclosure vulnerability originating from PHP's base image. This vulnerability exposes the PHP version through an X-Powered-By header, which attackers could exploit to fingerprint the server and identify potential weaknesses.

WorkaroundsThe mitigation requires changing the expose_php variable from "On" to "Off" in the file located at /usr/local/etc/php/php.ini.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-497
References: https://github.com/mautic/docker-mautic/security/advisories/GHSA-89jm-p7jf-x8jx
CVE: CVE-2025-44525
Published: 2025-07-09
Description: Texas Instruments CC2652RB LaunchPad SimpleLink CC13XX CC26XX SDK 7.41.00.17 was discovered to utilize insufficient permission checks on critical fields within Bluetooth Low Energy (BLE) data packets. This issue allows attackers to cause a Denial of Service (DoS) via a crafted LL_Length_Req packet.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: http://cc2652rb.com; http://texas.com; https://github.com/yangting111/BLE_TEST/blob/main/result/PoC/TI/Length_Req_MaxRxBytes.md
CVE: CVE-2025-53645
Published: 2025-07-09
Description: Zimbra Collaboration (ZCS) before 9.0.0 Patch 46, 10.0.x before 10.0.15, and 10.1.x before 10.1.9 is vulnerable to a denial of service condition due to improper handling of excessive, comma-separated path segments in the Admin Console. An unauthenticated remote attacker can send specially crafted GET requests that trigger redundant processing and inflated responses. This leads to uncontrolled resource consumption, resulting in denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://wiki.zimbra.com/wiki/Security_Center; https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.15#Security_Fixes; https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.9#Security_Fixes
CVE: CVE-2025-53548
Published: 2025-07-09
Description: Clerk helps developers build user management. Applications that use the verifyWebhook() helper to verify incoming Clerk webhooks are susceptible to accepting improperly signed webhook events. The issue was resolved in @clerk/backend 2.4.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-345
References: https://github.com/clerk/javascript/security/advisories/GHSA-9mp4-77wg-rwx9
CVE: CVE-2021-27961
Published: 2025-07-09
Description: evesys 7.1 (2152) through 8.0 (2202) allows Reflected XSS via the indexeva.php action parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://evasys.de/en/blog/; https://gist.github.com/phlmox/c24bf28f12fbc0f2ea73dd9e8cfa94e3
CVE: CVE-2025-36599
Published: 2025-07-09
Description: Dell PowerFlex Manager VM, versions prior to 4.6.2.1, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the system with privileges of the compromised account.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-532
References: https://www.dell.com/support/kbdoc/en-us/000342158/dsa-2025-279-security-update-for-dell-powerflex-manager-platform-pfmp-proprietary-code-vulnerability
CVE: CVE-2025-53620
Published: 2025-07-09
Description: @builder.io/qwik-city is the meta-framework for Qwik. When a Qwik Server Action QRL is executed it dynamically load the file containing the symbol. When an invalid qfunc is sent, the server does not handle the thrown error. The error then causes Node JS to exit. This vulnerability is fixed in 1.13.0.
CWE: CWE-248
References: https://github.com/QwikDev/qwik/security/advisories/GHSA-qr9h-j6xg-2j72
CVE: CVE-2025-52357
Published: 2025-07-09
Description: Cross-Site Scripting (XSS) vulnerability exists in the ping diagnostic feature of FiberHome FD602GW-DX-R410 router (firmware V2.2.14), allowing an authenticated attacker to execute arbitrary JavaScript code in the context of the router s web interface. The vulnerability is triggered via user-supplied input in the ping form field, which fails to sanitize special characters. This can be exploited to hijack sessions or escalate privileges through social engineering or browser-based attacks.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/wrathfulDiety/CVE-2025-52357; https://github.com/wrathfulDiety/fd602gw-dx-r410-xss-advisory/blob/main/README.md
CVE: CVE-2025-53624
Published: 2025-07-09
Description: The Docusaurus gists plugin adds a page to your Docusaurus instance, displaying all public gists of a GitHub user. docusaurus-plugin-content-gists versions prior to 4.0.0 are vulnerable to exposing GitHub Personal Access Tokens in production build artifacts when passed through plugin configuration options. The token, intended for build-time API access only, is inadvertently included in client-side JavaScript bundles, making it accessible to anyone who can view the website's source code. This vulnerability is fixed in 4.0.0.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-200
References: https://github.com/webbertakken/docusaurus-plugin-content-gists/commit/8d4230b82412edb215ddfa9e609d178510a5fe31; https://github.com/webbertakken/docusaurus-plugin-content-gists/security/advisories/GHSA-qf34-qpr4-5pph
CVE: CVE-2025-6376
Published: 2025-07-09
Description: A remote
code execution security issue exists in the Rockwell Automation Arena®.  A crafted DOE
file can force Arena Simulation to write beyond the boundaries of an allocated
object. Exploitation
requires user interaction, such as opening a malicious file within the software.
If exploited, a threat actor could execute arbitrary code on the target system.
The software must run under the context of the administrator in order to cause
worse case impact. This is reflected in the Rockwell CVSS score, as AT:P.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-787
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1729.html
CVE: CVE-2025-6377
Published: 2025-07-09
Description: A remote
code execution security issue exists in the Rockwell Automation Arena®.  A crafted DOE
file can force Arena Simulation to write beyond the boundaries of an allocated
object. Exploitation
requires user interaction, such as opening a malicious file within the software.
If exploited, a threat actor could execute arbitrary code on the target system.
The software must run under the context of the administrator in order to cause
worse case impact. This is reflected in the Rockwell CVSS score, as AT:P.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-787
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1729.html
CVE: CVE-2024-10391
Published: 2025-07-09
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2025-0139
Published: 2025-07-09
Description: An incorrect privilege assignment vulnerability in Palo Alto Networks Autonomous Digital Experience Manager allows a locally authenticated low privileged user on macOS endpoints to escalate their privileges to root.
CWE: CWE-266
References: https://security.paloaltonetworks.com/CVE-2025-0139
CVE: CVE-2025-0140
Published: 2025-07-09
Description: An incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect™ App on macOS devices enables a locally authenticated non administrative user to disable the app even if the GlobalProtect app configuration would not normally permit them to do so.

The GlobalProtect app on Windows, Linux, iOS, Android, Chrome OS and GlobalProtect UWP app are not affected.
CWE: CWE-266
References: https://security.paloaltonetworks.com/CVE-2025-0140
CVE: CVE-2025-0141
Published: 2025-07-09
Description: An incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect™ App on enables a locally authenticated non administrative user to escalate their privileges to root on macOS and Linux or NT AUTHORITY\SYSTEM on Windows.

The GlobalProtect app on iOS, Android, Chrome OS and GlobalProtect UWP app are not affected.
CWE: CWE-426
References: https://security.paloaltonetworks.com/CVE-2025-0141
CVE: CVE-2025-0646
Published: 2025-07-09
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2025-6970
Published: 2025-07-09
Description: The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 7.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/events-manager/tags/7.0.3/classes/em-object.php#L1060; https://plugins.trac.wordpress.org/changeset/3321403/events-manager; https://www.wordfence.com/threat-intel/vulnerabilities/id/7320c06e-a7a7-4ed0-93cd-e85d74bae73f?source=cve
CVE: CVE-2025-6975
Published: 2025-07-09
Description: The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘calendar_header’ parameter in all versions up to, and including, 7.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/events-manager/tags/7.0.3/templates/calendar/section-header-navigation.php#L8; https://plugins.trac.wordpress.org/changeset/3321403/events-manager; https://www.wordfence.com/threat-intel/vulnerabilities/id/b6e3e59b-837b-4058-b7bc-a22cff22afb4?source=cve
CVE: CVE-2025-6976
Published: 2025-07-09
Description: The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's  shortcodes in all versions up to, and including, 7.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/events-manager/tags/7.0.3/classes/em-events.php#L287; https://plugins.trac.wordpress.org/browser/events-manager/tags/7.0.3/classes/em-events.php#L335; https://plugins.trac.wordpress.org/browser/events-manager/tags/7.0.3/classes/em-events.php#L357
CVE: CVE-2025-4406
Published: 2025-07-10
Description: The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wpforo/tags/2.4.5/includes/functions.php#L2139; https://plugins.trac.wordpress.org/browser/wpforo/tags/2.4.5/includes/functions.php#L2177; https://www.wordfence.com/threat-intel/vulnerabilities/id/05b15f33-0f95-458f-8c21-16c0dd98c8bc?source=cve
CVE: CVE-2025-5807
Published: 2025-07-10
Description: The Gwolle Guestbook plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘gwolle_gb_content’ parameter in all versions up to, and including, 4.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3316455/; https://www.wordfence.com/threat-intel/vulnerabilities/id/956f86c5-05af-41c3-a779-5b25f62122dd?source=cve
CVE: CVE-2025-35983
Published: 2025-07-10
Description: Improper Certificate Validation (CWE-295) in the Controller 7000 OneLink implementation could allow an unprivileged attacker to perform a limited denial of service or perform privileged overrides during the initial configuration of the Controller, there is no risk for Controllers once they are connected. 

This issue affects Controller 7000: 

9.30 prior to vCR9.30.250624a (distributed in 9.30.1871 (MR1)).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-295
References: https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2025-35983
CVE: CVE-2025-44003
Published: 2025-07-10
Description: Missing Release of Resource after Effective Lifetime (CWE-772) in the Gallagher T-Series Reader allows an attacker with physical access to the reader to perform a limited denial of service when 125 kHz Card Technology is enabled.

This issue affects T-Series Readers: 9.20 prior to vCR9.20.250213a (distributed in 9.20.1827 (MR2)), 9.10 prior to vCR9.10.250213a (distributed in 9.10.2692(MR5)), 9.00 prior to vCR9.00.250619a (distributed in  vEL9.00.3371 (MR7)),  all versions of 8.90 and prior.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-772
References: https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2025-44003
CVE: CVE-2025-46406
Published: 2025-07-10
Description: A Privilege Context Switching Error (CWE-270) in the Command Center Server could allow a privileged Operator with high level access in one Division to perform limited privileged activities across the Division boundary.

This issue affects Command Centre Server: 

9.30 prior to 9.30.1874 (MR1), 9.20 prior to 9.20.2337 (MR3), 9.10 prior to 9.10.3194 (MR6), 9.00 prior to 9.00.3371 (MR7), all versions of 8.90 and prior.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-270
References: https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2025-46406
CVE: CVE-2023-50458
Published: 2025-07-10
Description: In Dradis before 4.11.0, the Output Console shows a job queue that may contain information about other users' jobs.
CVSS Score: 3.5 (LOW)
CWE: CWE-1230
References: https://github.com/dradis/dradis-ce/tags; https://securiteam.io/2025/07/03/cve-2023-50458-dradis-information-disclosure-output-console/
CVE: CVE-2025-6234
Published: 2025-07-10
Description: The Hostel WordPress plugin before 1.1.5.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/7447c4e1-81b9-4415-b425-27491ff692b2/; https://wpscan.com/vulnerability/7447c4e1-81b9-4415-b425-27491ff692b2/
CVE: CVE-2025-6236
Published: 2025-07-10
Description: The Hostel WordPress plugin before 1.1.5.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/ff4d312b-a4d1-40cd-a555-a0a1b46f9959/; https://wpscan.com/vulnerability/ff4d312b-a4d1-40cd-a555-a0a1b46f9959/
CVE: CVE-2025-7387
Published: 2025-07-10
Description: The Lana Downloads Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the endpoint parameters in versions up to, and including, 1.10.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with administrator-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/lana-downloads-manager/tags/1.10.0/lana-downloads-manager.php#L763; https://plugins.trac.wordpress.org/changeset/3324923/lana-downloads-manager; https://www.wordfence.com/threat-intel/vulnerabilities/id/be0db9ff-dc95-4c92-8dc4-472c5df9c0dd?source=cve
CVE: CVE-2025-32988
Published: 2025-07-10
Description: A flaw was found in GnuTLS. A double-free vulnerability exists in GnuTLS due to incorrect ownership handling in the export logic of Subject Alternative Name (SAN) entries containing an otherName. If the type-id OID is invalid or malformed, GnuTLS will call asn1_delete_structure() on an ASN.1 node it does not own, leading to a double-free condition when the parent function or caller later attempts to free the same structure.

This vulnerability can be triggered using only public GnuTLS APIs and may result in denial of service or memory corruption, depending on allocator behavior.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-415
References: https://access.redhat.com/errata/RHSA-2025:16115; https://access.redhat.com/errata/RHSA-2025:16116; https://access.redhat.com/errata/RHSA-2025:17181
CVE: CVE-2025-32989
Published: 2025-07-10
Description: A heap-buffer-overread vulnerability was found in GnuTLS in how it handles the Certificate Transparency (CT) Signed Certificate Timestamp (SCT) extension during X.509 certificate parsing. This flaw allows a malicious user to create a certificate containing a malformed SCT extension (OID 1.3.6.1.4.1.11129.2.4.2) that contains sensitive data. This issue leads to the exposure of confidential information when GnuTLS verifies certificates from certain websites when the certificate (SCT) is not checked correctly.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-295
References: https://access.redhat.com/errata/RHSA-2025:16115; https://access.redhat.com/errata/RHSA-2025:16116; https://access.redhat.com/errata/RHSA-2025:17181