deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-14764
Published: 2025-12-17
Description: Missing cryptographic key commitment in the Amazon S3 Encryption Client for Go may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an "instruction file" instead of S3's metadata record.


To mitigate this issue, upgrade Amazon S3 Encryption Client for Go to version 4.0 or later.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-327
References: https://aws.amazon.com/security/security-bulletins/AWS-2025-032/; https://github.com/aws/amazon-s3-encryption-client-go/releases/tag/v4.0.0; https://github.com/aws/amazon-s3-encryption-client-go/security/advisories/GHSA-3g75-q268-r9r6
CVE: CVE-2025-43428
Published: 2025-12-17
Description: A configuration issue was addressed with additional restrictions. This issue is fixed in iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2. Photos in the Hidden Photos Album may be viewed without authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://support.apple.com/en-us/125884; https://support.apple.com/en-us/125886; https://support.apple.com/en-us/125891
CVE: CVE-2025-43475
Published: 2025-12-17
Description: A logging issue was addressed with improved data redaction. This issue is fixed in iOS 26.2 and iPadOS 26.2. An app may be able to access user-sensitive data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532
References: https://support.apple.com/en-us/125884
CVE: CVE-2025-43501
Published: 2025-12-17
Description: A buffer overflow issue was addressed with improved memory handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2. Processing maliciously crafted web content may lead to an unexpected process crash.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-787, CWE-120
References: https://support.apple.com/en-us/125884; https://support.apple.com/en-us/125885; https://support.apple.com/en-us/125886
CVE: CVE-2025-43514
Published: 2025-12-17
Description: The issue was addressed with improved handling of caches. This issue is fixed in macOS Tahoe 26.2. An app may be able to access protected user data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/en-us/125886
CVE: CVE-2025-43526
Published: 2025-12-17
Description: This issue was addressed with improved URL validation. This issue is fixed in Safari 26.2, macOS Tahoe 26.2. On a Mac with Lockdown Mode enabled, web content opened via a file URL may be able to use Web APIs that should be restricted.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-601
References: https://support.apple.com/en-us/125886; https://support.apple.com/en-us/125892
CVE: CVE-2025-43529
Published: 2025-12-17
Description: A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 was also issued in response to this report.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://support.apple.com/en-us/125884; https://support.apple.com/en-us/125885; https://support.apple.com/en-us/125886
CVE: CVE-2025-43531
Published: 2025-12-17
Description: A race condition was addressed with improved state handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. Processing maliciously crafted web content may lead to an unexpected process crash.
CVSS Score: 3.1 (LOW)
CWE: CWE-362, CWE-362
References: https://support.apple.com/en-us/125884; https://support.apple.com/en-us/125885; https://support.apple.com/en-us/125886
CVE: CVE-2025-43533
Published: 2025-12-17
Description: The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. A malicious HID device may cause an unexpected process crash.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-20
References: https://support.apple.com/en-us/125884; https://support.apple.com/en-us/125886; https://support.apple.com/en-us/125889
CVE: CVE-2025-43535
Published: 2025-12-17
Description: The issue was addressed with improved memory handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2. Processing maliciously crafted web content may lead to an unexpected process crash.
CVSS Score: 4.3 (MEDIUM)
References: https://support.apple.com/en-us/125884; https://support.apple.com/en-us/125885; https://support.apple.com/en-us/125886
CVE: CVE-2025-43536
Published: 2025-12-17
Description: A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2. Processing maliciously crafted web content may lead to an unexpected process crash.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-416
References: https://support.apple.com/en-us/125884; https://support.apple.com/en-us/125885; https://support.apple.com/en-us/125886
CVE: CVE-2025-43541
Published: 2025-12-17
Description: A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-843
References: https://support.apple.com/en-us/125884; https://support.apple.com/en-us/125885; https://support.apple.com/en-us/125886
CVE: CVE-2025-46277
Published: 2025-12-17
Description: A logging issue was addressed with improved data redaction. This issue is fixed in iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, watchOS 26.2. An app may be able to access a user’s Safari history.
CVSS Score: 3.3 (LOW)
CWE: CWE-532
References: https://support.apple.com/en-us/125884; https://support.apple.com/en-us/125886; https://support.apple.com/en-us/125890
CVE: CVE-2025-46278
Published: 2025-12-17
Description: The issue was addressed with improved handling of caches. This issue is fixed in macOS Tahoe 26.2. An app may be able to access protected user data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/en-us/125886
CVE: CVE-2025-46279
Published: 2025-12-17
Description: A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. An app may be able to identify what other apps a user has installed.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: https://support.apple.com/en-us/125884; https://support.apple.com/en-us/125885; https://support.apple.com/en-us/125886
CVE: CVE-2025-46281
Published: 2025-12-17
Description: A logic issue was addressed with improved checks. This issue is fixed in macOS Tahoe 26.2. An app may be able to break out of its sandbox.
CVSS Score: 8.8 (HIGH)
CWE: CWE-693
References: https://support.apple.com/en-us/125886
CVE: CVE-2025-46282
Published: 2025-12-17
Description: The issue was addressed with additional permissions checks. This issue is fixed in Safari 26.2, macOS Tahoe 26.2. An app may be able to access sensitive user data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: https://support.apple.com/en-us/125886; https://support.apple.com/en-us/125892
CVE: CVE-2025-46283
Published: 2025-12-17
Description: A logic issue was addressed with improved validation. This issue is fixed in macOS Sonoma 14.8.4, macOS Tahoe 26.2. An app may be able to access sensitive user data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/en-us/125886; https://support.apple.com/en-us/126350
CVE: CVE-2025-46288
Published: 2025-12-17
Description: A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2, watchOS 26.2. An app may be able to access sensitive payment tokens.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: https://support.apple.com/en-us/125884; https://support.apple.com/en-us/125886; https://support.apple.com/en-us/125890
CVE: CVE-2025-46291
Published: 2025-12-17
Description: A logic issue was addressed with improved validation. This issue is fixed in macOS Tahoe 26.2. An app may bypass Gatekeeper checks.
CVSS Score: 7.8 (HIGH)
CWE: CWE-693
References: https://support.apple.com/en-us/125886
CVE: CVE-2025-46292
Published: 2025-12-17
Description: This issue was addressed with additional entitlement checks. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2. An app may be able to access user-sensitive data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: https://support.apple.com/en-us/125884; https://support.apple.com/en-us/125885
CVE: CVE-2025-53000
Published: 2025-12-17
Description: The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions of nbconvert up to and including 7.16.6 on Windows have a vulnerability in which converting a notebook containing SVG output to a PDF results in unauthorized code execution. Specifically, a third party can create a `inkscape.bat` file that defines a Windows batch script, capable of arbitrary code execution. When a user runs `jupyter nbconvert --to pdf` on a notebook containing SVG output to a PDF on a Windows platform from this directory, the `inkscape.bat` file is run unexpectedly. This issue has been patched in version 7.17.0.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://github.com/jupyter/nbconvert/blob/4f61702f5c7524d8a3c4ac0d5fc33a6ac2fa36a7/nbconvert/preprocessors/svg2pdf.py#L104; https://github.com/jupyter/nbconvert/commit/c9ac1d1040459ed1ff9eb34e9918ce5a87cf9d71; https://github.com/jupyter/nbconvert/issues/2258
CVE: CVE-2025-55254
Published: 2025-12-17
Description: Improper management of Path-relative stylesheet import in HCL BigFix Remote Control Lite Web Portal (versions 10.1.0.0326 and lower) may allow to execute malicious code in certain web pages.
CVSS Score: 3.7 (LOW)
CWE: CWE-601, CWE-613
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0127332
CVE: CVE-2025-59849
Published: 2025-12-17
Description: Improper management of Content Security Policy in HCL BigFix Remote Control Lite Web Portal (versions 10.1.0.0326 and lower) may allow the execution of malicious code in web pages.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-693, CWE-1021
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0127332
CVE: CVE-2025-66647
Published: 2025-12-17
Description: RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT) devices and other embedded devices. A vulnerability was discovered in the IPv6 fragmentation reassembly implementation of RIOT OS v2025.07. When copying the contents of the first fragment (offset=0) into the reassembly buffer, no size check is performed. It is possible to force the creation of a small reassembly buffer by first sending a shorter fragment (also with offset=0). Overflowing the reassembly buffer corrupts the state of other packet buffers which an attacker might be able to used to achieve further memory corruption (potentially resulting in remote code execution). To trigger the vulnerability, the `gnrc_ipv6_ext_frag` module must be included and the attacker must be able to send arbitrary IPv6 packets to the victim. Version 2025.10 fixes the issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/RIOT-OS/RIOT/blob/eb65305cf9f1b7affb50b17af5c12341b83a8636/sys/net/gnrc/network_layer/ipv6/ext/frag/gnrc_ipv6_ext_frag.c#L411; https://github.com/RIOT-OS/RIOT/blob/eb65305cf9f1b7affb50b17af5c12341b83a8636/sys/net/gnrc/network_layer/ipv6/ext/frag/gnrc_ipv6_ext_frag.c#L481; https://github.com/RIOT-OS/RIOT/blob/eb65305cf9f1b7affb50b17af5c12341b83a8636/sys/net/gnrc/network_layer/ipv6/ext/frag/gnrc_ipv6_ext_frag.c#L532
CVE: CVE-2025-67493
Published: 2025-12-17
Description: Homarr is an open-source dashboard. Prior to version 1.45.3, it was possible to craft an input which allowed privilege escalation and getting access to groups of other users due to missing sanitization of inputs in ldap search query. The vulnerability could impact all instances using ldap authentication where a malicious actor had access to a user account. Version 1.45.3 has a patch for the issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-90
References: https://github.com/homarr-labs/homarr/security/advisories/GHSA-59gp-q3xx-489q
CVE: CVE-2025-67789
Published: 2025-12-17
Description: An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5. Authenticated users can retrieve the computer count of other DriveLock tenants via the DriveLock API.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://drivelock.help/versions/current/web/en/releasenotes/Content/ReleaseNotes_DriveLock/SecurityBulletins/25-004-DESInfoDisclosure.htm
CVE: CVE-2025-67790
Published: 2025-12-17
Description: An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5. An unprivileged user could cause occasionally a Blue Screen Of Death (BSOD) on Windows computers by using an IOCTL and an unterminated string.
CVSS Score: 7.5 (HIGH)
CWE: CWE-170
References: https://drivelock.help/versions/2025_1/web/en/releasenotes/Content/ReleaseNotes_DriveLock/SecurityBulletins/25-005-BufferOverreadBSOD.htm
CVE: CVE-2025-67792
Published: 2025-12-17
Description: An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5. Local unprivileged users can manipulate a DriveLock process to execute arbitrary commands on Windows computers.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://drivelock.help/versions/current/web/en/releasenotes/Content/ReleaseNotes_DriveLock/SecurityBulletins/25-007-LocalPrivilegeEsc.htm
CVE: CVE-2025-67793
Published: 2025-12-17
Description: An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1 before 25.1.6. Users with the "Manage roles and permissions" privilege can promote themselves or other DOC users to the Supervisor role through an API call. This privilege is included by default in the Administrator role. This issue mainly affects cloud multi-tenant deployments; on-prem single-tenant installations are typically not impacted because local admins usually already have Supervisor privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://drivelock.help/sb/Content/SecurityBulletins/25-008-DESPrivilegeEsc.htm
CVE: CVE-2025-14832
Published: 2025-12-17
Description: A vulnerability was identified in itsourcecode Online Cake Ordering System 1.0. The affected element is an unknown function of the file /updateproduct.php?action=edit. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/ZhangYu-del/cve/issues/1; https://itsourcecode.com/; https://vuldb.com/?ctiid.336981
CVE: CVE-2025-67791
Published: 2025-12-17
Description: An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1 through 25.1.*. An incomplete configuration (agent authentication) in DriveLock tenant allows attackers to impersonate any DriveLock agent on the network against the DES (DriveLock Enterprise Service).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://drivelock.help/versions/current/web/en/releasenotes/Content/ReleaseNotes_DriveLock/SecurityBulletins/25-006-DESMisconfig.htm
CVE: CVE-2025-67794
Published: 2025-12-17
Description: An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 before 24.2.8, and 25.1 before 25.1.6. Directories and files created by the agent are created with overly permissive ACLs, allowing local users without administrator rights to trigger actions or destabilize the agent.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-732
References: https://drivelock.help/sb/Content/SecurityBulletins/25-009-AgIncPermissions.htm
CVE: CVE-2025-67873
Published: 2025-12-17
Description: Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, Skipdata length is not bounds-checked, so a user-provided skipdata callback can make cs_disasm/cs_disasm_iter memcpy more than 24 bytes into cs_insn.bytes, causing a heap buffer overflow in the disassembly path. Commit cbef767ab33b82166d263895f24084b75b316df3 fixes the issue.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-122
References: https://github.com/capstone-engine/capstone/commit/cbef767ab33b82166d263895f24084b75b316df3; https://github.com/capstone-engine/capstone/security/advisories/GHSA-hj6g-v545-v7jg; https://github.com/capstone-engine/capstone/security/advisories/GHSA-hj6g-v545-v7jg
CVE: CVE-2025-67875
Published: 2025-12-17
Description: ChurchCRM is an open-source church management system. A privilege escalation vulnerability exists in ChurchCRM prior to version 6.5.3. An authenticated user with specific mid-level permissions ("Edit Records" and "Manage Properties and Classifications") can inject a persistent Cross-Site Scripting (XSS) payload into an administrator's profile. The payload executes when the administrator views their own profile page, allowing the attacker to hijack the administrator's session, perform administrative actions, and achieve a full account takeover. This vulnerability is a combination of two separate flaws: an Insecure Direct Object Reference (IDOR) that allows any user to view any other user's profile, and a Broken Access Control vulnerability that allows a user with general edit permissions to modify any other user's record properties. Version 6.5.3 fixes the issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/ChurchCRM/CRM/security/advisories/GHSA-fcw7-mmfh-7vjm; https://github.com/ChurchCRM/CRM/security/advisories/GHSA-fcw7-mmfh-7vjm
CVE: CVE-2025-67876
Published: 2025-12-17
Description: ChurchCRM is an open-source church management system. A stored cross-site scripting (XSS) vulnerability exists in ChurchCRM versions 6.4.0 and prior that allows a low-privilege user with the “Manage Groups” permission to inject persistent JavaScript into group role names. The payload is saved in the database and executed whenever any user (including administrators) views a page that displays that role, such as GroupView.php or PersonView.php. This allows full session hijacking and account takeover. As of time of publication, no known patched versions are available.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/ChurchCRM/CRM/security/advisories/GHSA-j9gv-26c7-3qrh; https://github.com/ChurchCRM/CRM/security/advisories/GHSA-j9gv-26c7-3qrh
CVE: CVE-2025-67877
Published: 2025-12-17
Description: ChurchCRM is an open-source church management system. Versions prior to 6.5.3 have a SQL injection vulnerability in the `src/CartToFamily.php` file, specifically in how the `PersonAddress` POST parameter is handled. Unlike other parameters in the same file which are correctly cast to integers using the `InputUtils` class, the `PersonAddress` parameter is missing the type definition. This allows an attacker to inject arbitrary SQL commands directly into the query. Version 6.5.3 fixes the issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/ChurchCRM/CRM/security/advisories/GHSA-h3vq-9gr6-h9r4; https://github.com/ChurchCRM/CRM/security/advisories/GHSA-h3vq-9gr6-h9r4
CVE: CVE-2025-68109
Published: 2025-12-17
Description: ChurchCRM is an open-source church management system. In versions prior to 6.5.3, the Database Restore functionality does not validate the content or file extension of uploaded files. As a result, an attacker can upload a web shell file and subsequently upload a .htaccess file to enable direct access to it. Once accessed, the uploaded web shell allows remote code execution (RCE) on the server. Version 6.5.3 fixes the issue.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-78, CWE-434, CWE-494, CWE-552, CWE-915
References: https://github.com/ChurchCRM/CRM/security/advisories/GHSA-pqm7-g8px-9r77
CVE: CVE-2025-68110
Published: 2025-12-17
Description: ChurchCRM is an open-source church management system. Versions prior to 6.5.3 may disclose database information in an error message including the host, ip, username, and password. Version 6.5.3 fixes the issue.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-200, CWE-209, CWE-209
References: https://github.com/ChurchCRM/CRM/security/advisories/GHSA-82mq-xc2j-3qv2; https://github.com/ChurchCRM/CRM/security/advisories/GHSA-82mq-xc2j-3qv2
CVE: CVE-2025-68111
Published: 2025-12-17
Description: ChurchCRM is an open-source church management system. In versions prior to 6.5.3, a SQL injection vulnerability exists in the `eGive.php` file within the "ReImport" functionality. An authenticated user with finance privileges can execute arbitrary SQL queries by manipulating the `MissingEgive_FamID_...` POST parameter. This can lead to unauthorized data access, modification, or deletion within the database. Version 6.5.3 has a patch for the issue.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/ChurchCRM/CRM/security/advisories/GHSA-c4vm-87vf-hmx9
CVE: CVE-2025-68112
Published: 2025-12-17
Description: ChurchCRM is an open-source church management system. In versions prior to 6.5.3, a SQL injection vulnerability in ChurchCRM's Event Attendee Editor allows authenticated users to execute arbitrary SQL commands, leading to complete database compromise, administrative credential theft, and potential system takeover. The vulnerability enables attackers to extract sensitive member data, authentication credentials, and financial information from the church management system. Version 6.5.3 contains a patch for the issue.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-89
References: https://github.com/ChurchCRM/CRM/security/advisories/GHSA-hxf4-3vhp-wqcq; https://github.com/ChurchCRM/CRM/security/advisories/GHSA-hxf4-3vhp-wqcq
CVE: CVE-2025-68114
Published: 2025-12-17
Description: Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, an unchecked vsnprintf return in SStream_concat lets a malicious cs_opt_mem.vsnprintf drive SStream’s index negative or past the end, leading to a stack buffer underflow/overflow when the next write occurs. Commit 2c7797182a1618be12017d7d41e0b6581d5d529e fixes the issue.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-120, CWE-124
References: https://github.com/capstone-engine/capstone/commit/2c7797182a1618be12017d7d41e0b6581d5d529e; https://github.com/capstone-engine/capstone/security/advisories/GHSA-85f5-6xr3-q76r; https://github.com/capstone-engine/capstone/security/advisories/GHSA-85f5-6xr3-q76r