Denial of service in IBM WebSphere Application Server (9.0, 8.5) and WebSphere Application Server Liberty (17.0.0.3 through 26.0.0.7) lets remote unauthenticated attackers exhaust server resources by sending a single crafted HTTP request, forcing the application server to become unresponsive. The flaw (CWE-400, uncontrolled resource consumption) carries CVSS 7.5 with a full availability impact and requires no privileges or user interaction, making it trivially reachable on any exposed HTTP listener. There is no public exploit identified at time of analysis, but a vendor patch is available from IBM.
Arbitrary code execution in the Banks Python LLM-templating library (versions prior to 2.4.3) allows an attacker who can influence Tool JSON definitions within a {% completion %} block to run any importable Python callable in the host process. Banks resolves the attacker-controlled import_path field via importlib.import_module() plus getattr() with no allowlist, so values like os.system or subprocess.getoutput become invokable when the LLM emits a matching tool_calls entry, passing decoded arguments as kwargs. No public exploit identified at time of analysis; this bug is explicitly distinct from and unfixed by the 2.4.2 SandboxedEnvironment patch (GHSA-gphh-9q3h-jgpp / CVE-2026-44209) because the malicious payload is plain text in the rendered body and never touches Jinja attribute access.
Uncontrolled memory consumption in IBM WebSphere Application Server Liberty (versions 17.0.0.3 through 26.0.0.7) lets a remote attacker crash or degrade the server by sending a single specially crafted request that forces excessive memory allocation. The flaw is network-reachable and requires no authentication or user interaction (PR:N/UI:N), and IBM (the reporter) has released a fix. There is no public exploit identified at time of analysis, and no EPSS or CISA KEV data was provided.
Remote unauthenticated denial of service in Performance Co-Pilot (PCP), the system performance monitoring toolkit shipped with Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4, allows an attacker to permanently disable a PCP daemon by triggering a signed integer overflow (CWE-190) in the __pmGetPDU() PDU-length handling routine. A crafted network packet sent during normal PDU processing or SASL authentication negotiation corrupts the read logic so that the daemon can no longer read any subsequent packets, requiring a manual restart. There is no public exploit identified at time of analysis and the flaw yields no code execution or data exposure - impact is availability-only (CVSS 7.5, A:H).
Sandboxed remote code execution in Google Chrome's DevTools component (versions prior to 151.0.7922.72) lets a remote attacker run arbitrary code within the renderer sandbox when a victim opens a crafted HTML page. The flaw is a use-after-free (CWE-416) rated Medium by Chromium; no public exploit has been identified and EPSS estimates only a 0.27% exploitation probability, indicating low near-term likelihood despite the high CVSS base score. Critically, code execution is confined to the sandbox and does not by itself constitute a full host compromise.
Open redirect in IBM Planning Analytics Local versions 2.1.0 through 2.1.21 lets remote attackers craft URLs that bounce authenticated users to attacker-controlled external sites. When the product is deployed with SSO authentication, the redirect can leak session tokens carried in the flow, enabling session hijacking. No public exploit identified at time of analysis; this is not on CISA KEV and no POC is referenced in the provided data.
Heap corruption in the TabStrip component of Google Chrome desktop before 151.0.7922.72 allows a remote attacker to trigger a use-after-free (CWE-416) when a user is lured to a crafted HTML page and performs specific UI gestures. Successful exploitation could lead to arbitrary code execution within the renderer process, though Chromium rates the severity as Medium and there is no public exploit identified at time of analysis. EPSS is low at 0.22% (12th percentile) and CISA SSVC records exploitation status as none.
Unauthenticated Wiki Markup rendering in Apache JSPWiki up to 2.12.3 exposes sensitive data stored in internal JSPWiki variables to remote attackers. The flaw stems from a missing authentication check (CWE-306) on the markup rendering endpoint, allowing any network-reachable attacker to trigger rendering and extract variable contents without credentials. No public exploit has been identified and EPSS sits at a low 0.21% (12th percentile), but the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivially easy remote unauthenticated exploitation against default deployments. Vendor patches are available.
Privilege escalation in Google Chrome on Android before 151.0.7922.72 lets a remote attacker who has already compromised the renderer process escape further via insufficient policy enforcement in the Speech component and a crafted HTML page. Rated Medium by Chromium but scored CVSS 7.5, it enables a second-stage sandbox/privilege boundary bypass rather than initial access. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
SGLang versions up to and including v0.5.15 expose unauthenticated network endpoints that allow complete model weight exfiltration when the server is deployed without API key authentication. Attackers can abuse distributed weight broadcasting via NCCL - the same mechanism used for legitimate inter-GPU weight distribution - to redirect all model weights to an attacker-controlled destination, resulting in total confidentiality loss of what may be highly valuable proprietary ML assets. No public exploit code or CISA KEV listing is confirmed at time of analysis; EPSS at 0.19% (9th percentile) reflects low observed exploitation activity, consistent with this being a targeted threat against specialized ML infrastructure rather than opportunistic mass exploitation.
CPU exhaustion in the Perl module Date::Manip through version 6.99 allows unauthenticated remote attackers to cause unbounded denial of service by supplying strings containing long whitespace runs to any of the three exposed parsing entry points. The flaw is quadratic backtracking (CWE-1333) in the unanchored substitution within _parse_time: no time value is needed in the input, only a large block of whitespace, making it trivially deliverable via any user-controlled field that reaches the parser. SSVC rates this automatable with no confirmed active exploitation and EPSS sits at 0.19%, but any Internet-facing application that passes unsanitised date strings to Date::Manip is a viable DoS target.
Silent date corruption in Date::Manip through version 6.99 allows any caller passing untrusted character strings to ParseDate() or Date::Manip::Date->parse() to receive silently incorrect parsed dates when non-ASCII Unicode decimal digits (such as Arabic-Indic, Devanagari, or other Unicode script numerals) appear in year, month, or day fields. Perl's \d regex shorthand matches the full Unicode decimal-digit property (\p{Nd}), so non-ASCII digits are captured; subsequent numeric range validation then passes them because Perl truncates the string-to-number conversion at the first non-ASCII character, producing an in-range but wrong value — for example, '202٤' evaluates to year 202, not 2024. No public exploit has been identified at time of analysis and EPSS is very low (0.19%), but SSVC flags the flaw as automatable and the impact is meaningful for any application where Date::Manip parses externally-supplied dates to gate expiry checks, retention windows, or access-control logic.
Cross-origin data disclosure in Google Chrome for Android before 151.0.7922.72 lets a remote attacker leak data from other origins by luring a victim to a crafted HTML page that abuses insufficient input validation in the browser UI. Rated High by Chromium and CVSS 7.5 (confidentiality-only). There is no public exploit identified at time of analysis, and EPSS is low at 0.18%, though SSVC flags the attack as automatable with partial technical impact.
Privilege escalation in Google Chrome's Extensions component before 151.0.7922.72 lets an attacker who has already compromised the renderer process break out of that sandbox context by serving a crafted HTML page. Chromium rated the underlying issue Low severity, and there is no public exploit identified at time of analysis, though the fix ships in the July 2026 Stable channel desktop update. The bug stems from insufficient validation of untrusted input (CWE-20) crossing the extensions trust boundary.
Privilege escalation in Google Chrome desktop versions prior to 151.0.7922.72 allows a remote attacker who has already compromised the renderer process to escape its intended privilege boundary through insufficient policy enforcement in the Settings component, using a crafted HTML page. Chromium rated the security severity as Low, and there is no public exploit identified at time of analysis. The vulnerability is a second-stage flaw: it presumes a prior renderer compromise, so it is not directly exploitable against a fully intact browser.
Remote code execution in Google Chrome's V8 JavaScript engine (all versions prior to 151.0.7922.72) allows a remote attacker who lures a victim to a crafted HTML page to execute arbitrary code, though confined inside the renderer sandbox rather than achieving a full sandbox escape. Google rated the Chromium security severity as Low, and there is no public exploit identified at time of analysis and no evidence of active exploitation (CISA SSVC exploitation status: none). Exploitation hinges on winning a timing race, so despite the 7.5 CVSS score it is regarded as difficult to trigger reliably.
Apache JSPWiki versions up to and including 2.12.3 expose sensitive application internals through debug messages returned in HTTP responses, classified under CWE-1295 (Debug Messages Revealing Unnecessary Information). The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates any unauthenticated remote user can trigger disclosure of high-confidentiality data - potentially including session tokens, internal paths, configuration details, or stack traces - without requiring special privileges or user interaction. Despite the high CVSS score of 7.5, real-world exploitation probability is notably low at 0.17% EPSS (7th percentile), and no public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Unauthenticated credential leakage in SGLang's /server_info HTTP endpoint exposes configured API keys and SSL keyfile paths to any network-reachable caller on all versions through v0.5.15. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, and SSVC classifies the attack as automatable with a proof-of-concept available, making mass scanning for exposed instances a realistic threat. EPSS sits at just 0.14% (4th percentile), reflecting SGLang's niche deployment footprint rather than any technical difficulty - for internet-facing deployments using --admin-api-key, this is a high-priority credential-rotation and patching event.
Heap corruption in Google Chrome's Variations component before 151.0.7922.72 lets an attacker holding a privileged network position (an on-path / man-in-the-middle attacker) corrupt memory by delivering malicious network traffic, stemming from CWE-20 insufficient input validation. Google rates the Chromium severity as Medium and has shipped a fixed Stable-channel build; there is no public exploit identified at time of analysis and the flaw is not in CISA KEV. Because Variations (Chrome's server-driven feature-flag/experiment system) is fetched at startup in the browser process, a successful attacker could turn intercepted config traffic into a memory-safety primitive.
Sandbox-constrained arbitrary code execution in Google Chrome's V8 JavaScript engine affects all desktop builds prior to 151.0.7922.72, where a crafted Chrome extension abuses an inappropriate V8 implementation to run attacker code inside the renderer sandbox. Exploitation requires convincing a user to install a malicious extension, and Google internally rated the Chromium security severity as Low. There is no public exploit identified at time of analysis and CISA SSVC records exploitation status as 'none'.
Arbitrary code execution in Google Chrome's V8 JavaScript engine (versions prior to 151.0.7922.72) is possible when a user is convinced to install a malicious Chrome extension that triggers a type-confusion condition (CWE-843), letting the attacker run code inside the renderer sandbox. Google has shipped a fixed stable build, and while the Chromium team rated the security severity as Low, the CVSS base score is 7.5 due to full confidentiality, integrity, and availability impact on the compromised process. There is no public exploit identified at time of analysis and CISA SSVC marks exploitation as 'none.'
Sandboxed arbitrary code execution in Google Chrome's DevTools component affects all desktop builds prior to 151.0.7922.72, where a use-after-free (CWE-416) can be triggered by a crafted Chrome Extension. An attacker must first convince the victim to install a malicious extension, after which they can run code confined to the browser sandbox. Chromium rated this Low severity; no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.13%, 3rd percentile).
Arbitrary file disclosure in the Banks Python prompt-templating library (masci/banks) before 2.4.4 lets attackers who control template variables read any file the Python process can access. All four media filters (image, audio, video, document) wrap untrusted input in Path(value) and feed it straight to open(file_path, "rb") with no sanitization, so path traversal (../) reads files like .env, SSH keys, cloud credentials, source, /etc/passwd and /etc/shadow, returning them base64-encoded in the rendered prompt for trivial exfiltration. No public exploit identified at time of analysis and it is not in CISA KEV, but the fix in 2.4.4 is straightforward to reverse-engineer.
Denial of service in IBM Enterprise Build of Quarkus (versions 3.27.1 through 3.27.4.SP2 and 3.33.1 through 3.33.2.SP2) allows a remote, unauthenticated attacker to exhaust memory by sending multipart requests whose MIME part-headers are accumulated without bound in the Quarkus REST layer. Because each part-header buffer grows without a size cap, an attacker can force excessive heap allocation and crash or hang the service, degrading availability for all users. There is no public exploit identified at time of analysis, but the flaw is trivially reachable (AV:N/AC:L/PR:N/UI:N) against any endpoint that accepts multipart input.
Remote unauthenticated access-control bypass in the Performance Co-Pilot (PCP) pmproxy component lets attackers reach the /store endpoint and overwrite arbitrary PMDA (Performance Metrics Domain Agent) metric values, which the reporter (Red Hat) states can escalate to arbitrary code execution and full system takeover. The flaw affects PCP as shipped across Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication attack surface makes exposed pmproxy instances a meaningful risk.
Arbitrary code execution in the IBM Aspera Desktop App (versions 1.0.5 through 1.0.19) arises from insecure DLL loading at application start-up, allowing a local low-privileged attacker who can place a malicious DLL in a path the app searches to run code in the context of the launching user. IBM (the reporter and vendor) has published a fix, and there is no public exploit identified at time of analysis. Impact is high to confidentiality, integrity, and availability, but exploitation is gated by local access and the user launching the application.
Local privilege escalation in ASUS Armoury Crate lets a low-privileged local user execute arbitrary code with elevated privileges by winning a race condition (CWE-362) and substituting a crafted file during a time-of-check/time-of-use window. The flaw affects the Armoury Crate system-management/control software bundled on ASUS consumer and gaming hardware, and although CVSS 4.0 rates it 7.3 (High), exploitation is local-only and requires precise timing (AT:P). There is no public exploit identified at time of analysis and no CISA KEV listing.
Arbitrary plugin installation in the WP Swings Subscriptions for WooCommerce plugin (versions up to and including 2.0.0) lets authenticated users with shop manager privileges or higher install and activate any plugin from the WordPress.org repository through the wps_sfw_install_plugin_configuration AJAX handler, which performs no capability check (CWE-862). Because a shop manager is normally barred from managing plugins, this grants an unauthorized privileged capability that can be chained to full site compromise by installing a separately vulnerable plugin. Reported by Wordfence with a CVSS 7.2; no public exploit is identified at time of analysis and it is not on CISA KEV.
Path traversal in the IHM Log handling of ASUSTOR ADM (the operating system for ASUSTOR NAS appliances) lets an authenticated attacker manipulate the disk-serial input used to build an IHM log database file path, redirecting the component to read an unintended filesystem path or log database. The CVSS 4.0 score is 7.1 with a confidentiality-only impact and no public exploit identified at time of analysis. Affected releases span ADM 4.1.0 through 4.3.3.RUN1 and ADM 5.0.0 through 5.1.3.RI81.
Sensitive information disclosure in RapidRAW before 1.6.0 (an open-source cross-platform RAW photo editor) allows a remote attacker to steal a Windows victim's NTLMv2 credentials by embedding a UNC path in the lutPath field of a preset file. Because RapidRAW passes lutPath directly to File::open() without validation, opening the poisoned preset forces an outbound SMB authentication to an attacker-controlled host. There is no public exploit identified at time of analysis, but the technique (UNC-path credential coercion) is well understood and trivially reproducible, so real-world abuse is realistic once a malicious preset is shared.
Heap buffer overflow in GoAccess 1.10.2's parse_browser() routine lets a remote attacker corrupt or crash the analyzer by planting a crafted User-Agent string in a web server access log that an operator later processes. Because the code assumes any Opera-matched token starts with the literal 'Opera' and relocates the trailing version substring to a fixed match+5 offset, a specially formed UA drives a memmove that writes one to four attacker-influenced bytes past a heap allocation. There is no public exploit identified at time of analysis, and the flaw is fixed in version 1.11.
Memory disclosure and denial of service in ASUSTOR ADM (versions 4.1.0 through 4.3.3.RUN1 and 5.0.0 through 5.1.3.RI81) arise from an unsafe format string operation in the Rsync Backup component, where user-controlled backup configuration or log data reaches a format function without a fixed format specifier. An authenticated attacker on the NAS management interface can leak process memory contents or crash the backup component. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Memory disclosure and denial of service in ASUSTOR ADM (versions 4.1.0-4.3.3.RUN1 and 5.0.0-5.1.3.RI81) allow an authenticated attacker to abuse a format string flaw in the Internal Backup component. Because user-controlled task input is echoed into an error response and passed to an unsafe format string operation, the attacker can leak process memory or crash the handling CGI process. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Memory disclosure and denial of service in ASUSTOR ADM (versions 4.1.0 through 4.3.3.RUN1 and 5.0.0 through 5.1.3.RI81) allow an authenticated attacker to abuse the FTP Backup feature, whose user-controlled backup configuration data is written to a task log and later processed through an unsafe format string operation. Exploitation leaks CGI process memory or crashes the affected CGI process. No public exploit identified at time of analysis and the issue is not on the CISA KEV list; low-privilege authentication is required per the CVSS vector.
Broken object-level authorization in IBM Langflow OSS 1.0.0 through 1.10.1 lets an authenticated low-privileged user read and tamper with build jobs belonging to other users by abusing improper access control on log-retrieval and unauthenticated build endpoints. Because Langflow orchestrates LLM/agent workflow builds, a cross-tenant attacker can view sensitive build logs (high confidentiality impact) and interfere with others' jobs (limited availability impact). A vendor patch is available; there is no public exploit identified at time of analysis and the flaw is not on CISA KEV.
Sandbox escape in Google Chrome's ANGLE graphics component affects all desktop builds prior to 151.0.7922.72, where a remote attacker can serve a crafted HTML page to trigger a use-after-free and potentially break out of the renderer sandbox. Google rates the Chromium security severity as Medium; there is no public exploit identified at time of analysis and it is not in CISA KEV, with a low EPSS of 0.21% (11th percentile). Exploitation requires the victim to visit an attacker-controlled page (UI:R), and a vendor patch is already available.
Sandbox escape in Google Chrome on Linux before 151.0.7922.72 lets a remote attacker break out of the renderer sandbox when a victim opens a crafted HTML page, abusing an inappropriate implementation in the File Input component (CWE-269, improper privilege management). Rated Medium by Chromium and scored CVSS 7.1 with a scope change, it requires user interaction (visiting a malicious page) but no authentication; there is no public exploit identified and EPSS exploitation probability is low at 0.21% (11th percentile).
Sandbox escape in Google Chrome's Android WebView (versions prior to 151.0.7922.72) allows a remote attacker to break out of the renderer sandbox when a victim views a crafted HTML page. Rated Medium by Chromium and CVSS 7.1, it carries a scope-changing impact but requires user interaction; there is no public exploit identified at time of analysis and EPSS is low (0.21%, 11th percentile), indicating limited near-term mass exploitation likelihood.
Sandbox escape in Google Chrome's Dawn (WebGPU) component affects all desktop Chrome builds prior to 151.0.7922.72, where insufficient validation of untrusted input lets a remote attacker who lures a victim to a crafted HTML page potentially break out of the renderer sandbox. Chromium rates the severity Medium and the issue carries a CVSS 7.1 with scope change, but there is no public exploit identified at time of analysis and EPSS is very low at 0.18% (8th percentile). Google has shipped a patched Stable channel release addressing it.
SQL injection in LG Electronics SmartShare (all versions through 2.3.1712.1202 on Windows 10 and earlier) lets an adjacent-network attacker inject crafted SQL into the application's database queries, primarily exposing sensitive data (CVSS 4.0 base 7.1, VC:H). The flaw was reported by LG's own product security team (product.security@lge.com) and requires no authentication or user interaction, but is constrained to the local/adjacent network. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Sandbox escape in Google Chrome's ANGLE graphics layer on Windows (versions prior to 151.0.7922.72) lets a remote attacker who lures a victim to a crafted HTML page trigger a use-after-free that can potentially break out of the renderer/GPU sandbox. Google rated the Chromium security severity Medium and has shipped a fix; there is no public exploit identified at time of analysis and the EPSS score is low (0.17%, 7th percentile), indicating limited near-term exploitation likelihood despite the serious impact class.
Sandbox escape in Google Chrome desktop before 151.0.7922.72 stems from insufficient validation of untrusted input in a WebUI component, letting a remote attacker on the same network segment potentially break out of the renderer sandbox via malicious network traffic. Google rates the Chromium severity as Medium and vendor-tagged intelligence flags it as 'Potential RCE'; a vendor patch is available, but no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile). CISA SSVC records no observed exploitation and only partial technical impact.
Arbitrary file write in the VPN Client component of ASUSTOR ADM (the ADM NAS operating system) lets an authenticated, high-privileged attacker place uploaded certificate files outside the intended VPN certificate directory. The flaw stems from insufficient validation of the user-supplied certificate name when building the upload destination path, enabling directory traversal (CWE-22). No public exploit identified at time of analysis; the issue is not listed in CISA KEV and no POC is referenced.
Local privilege escalation in the Google Chrome Updater on Windows (versions prior to 151.0.7922.72) lets a low-privileged local attacker win a race condition and substitute a malicious file to elevate privileges. The flaw carries a CVSS 7.0 score, and while Chromium rates its security severity as Low, the SSVC technical impact is Total. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
The /unpack endpoint in Apache Tika's server component (tika-server 4.0.0-alpha-1) fails to enforce the operator-configured enableUnsecureFeatures=false security control, classified as Improper Protection of Alternate Path. This means the /unpack endpoint remains fully operational even when administrators have explicitly disabled unsafe features, bypassing the intended security boundary and allowing archive extraction or untrusted content processing through a restricted interface. No public exploit code has been identified and the vulnerability is confined to a pre-production alpha release, significantly limiting real-world exposure.
Path traversal in the Wallpaper component of ASUSTOR Data Master (ADM) exposes arbitrary files to authenticated high-privileged attackers across two separate version branches. Affected NAS appliances running ADM 4.1.0-4.3.3.RUN1 or 5.0.0-5.1.3.RI81 allow an attacker who controls an admin-level account to submit crafted wallpaper path inputs containing traversal sequences, escaping the intended directory and reading files restricted only by the underlying OS user permissions. No public exploit code or CISA KEV listing exists at time of analysis, and the PR:H requirement substantially limits the realistic attacker population.
Arbitrary file write in Apache Kyuubi (1.7.0 through 1.11.1) lets a remote attacker abuse the REST batch multipart upload endpoint, which trusts the client-supplied filename, to plant controlled content anywhere the server process can write. Because the server never sanitizes path traversal sequences (../) in the multipart filename, an attacker can escape the intended upload directory and overwrite or create files subject only to filesystem permissions. EPSS is low (0.28%, 21st percentile) and there is no public exploit identified at time of analysis, but the primitive is powerful and the fix is available in 1.12.0.
Unauthenticated remote firmware injection in Phoenix Contact CHARX SEC EV charging controllers (SEC-3000, 3050, 3100, 3150) exposes all devices running firmware 1.0.0 through 1.9.0 to arbitrary firmware replacement on the internal charging module. The JupiCore service, responsible for firmware update delivery, performs no cryptographic integrity or authenticity verification before transmitting payloads to the charging module, making this exploitable by any network-reachable attacker with no credentials or user interaction. The vendor confirms a patch exists in firmware 1.9.1, and the vulnerability can be chained with CVE-2026-44104 for compounded impact; no public exploit identified at time of analysis.
Firmware update handling in Phoenix Contact CHARX SEC EV charging controllers (versions 1.0.0 through 1.8.x) exposes a race condition exploitable by unauthenticated remote attackers via the OCPP backend. By supplying an invalid firmware file, an attacker can cause the file to persist temporarily in accessible device storage during the flawed cleanup window before deletion, resulting in low-impact integrity interference with the firmware management process. No public exploit code and no CISA KEV entry have been identified; a vendor-released patch is confirmed at version 1.9.1.
Uncontrolled decompression in aiohttp's WebSocket client prior to version 3.14.2 allows a malicious server to exhaust CPU and memory on connecting clients by sending RSV1-flagged compressed frames without having negotiated the permessage-deflate extension. The root cause is a missing constructor argument in `client.py:_ws_connect` that caused `WebSocketReader` to default to `compress=True`, violating RFC 6455 §5.2 which mandates failing the connection on undefined reserved bits. This is client-side exposure only - aiohttp server deployments are not affected. No active exploitation has been identified and no public exploit code exists at time of analysis.