Integer overflow in FFmpeg's libavfilter/vf_scale.c video scaling filter allows a remote attacker to crash the FFmpeg process by delivering a crafted video file that a user then opens or processes. Affected is FFmpeg development build N-122528-gdd2976b9e1, a git-snapshot identifier rather than a stable release. No public exploit and no active exploitation are identified at time of analysis; EPSS sits at 0.15% (4th percentile), confirming low observed exploitation probability despite the ubiquitous deployment footprint of FFmpeg.
Division-by-zero in FFmpeg's libswscale library allows remote attackers to crash the process by supplying a crafted media file that triggers an unhandled zero-divisor during scaling context initialization. The fault occurs in ff_sws_init_single_context within /libswscale/utils.c when malformed input parameters produce a zero-valued denominator, resulting in a process crash and denial of service. No active exploitation has been confirmed, and EPSS at 0.15% (4th percentile) indicates negligible observed exploitation activity.
Session tokens in HCL IntelliOps Event Management (IEM) versions 1.3 and 1.4 persist as valid on the server after a user logs out or an account is deleted, allowing an attacker who has previously captured a legitimate session token to replay it and maintain unauthorized access beyond the intended session lifecycle. The root cause is CWE-613 (Insufficient Session Expiration), where server-side session records are not destroyed upon logout or account removal. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 6.4 Medium score reflects meaningful constraints on exploitation including high attack complexity and required user interaction.
WatchGuard Dimension's web login endpoint permits unlimited automated password guessing against user accounts because rate-limiting and account lockout are both absent in the default product configuration. All versions of Dimension (CPE wildcard, no version boundary) are affected in default-configured deployments. An unauthenticated remote attacker can systematically guess credentials and gain unauthorized account access; the CWE-203 classification further indicates the endpoint may expose observable discrepancies that enable username enumeration, reducing the effort required for targeted credential attacks. No public exploit has been identified at time of analysis and no CISA KEV listing exists.
Regular expression denial of service in NLTK's Pl196xCorpusReader allows unauthenticated remote attackers to exhaust CPU resources by supplying malformed TEI corpus data containing many unmatched opening tags. Applications exposing NLTK's words() or tagged_words() public APIs over a network boundary-such as NLP services processing user-supplied corpora-are at risk of near-quadratic runtime growth in the read_block method. No public exploit code or CISA KEV listing has been identified at time of analysis; patch 3.10.3 is available.
Quadratic CPU exhaustion in NLTK before 3.10.3 allows denial of service via malformed XML corpus files processed by XMLCorpusView._read_xml_fragment(). The method rescans the entire accumulated XML buffer on every 1 KiB block read, creating O(n²) time complexity that scales severely with input size. Applications exposing XML corpus ingestion to untrusted input - such as those using BNCCorpusReader - are at realistic risk; no public exploit has been identified and this is not listed in CISA KEV.
Unsafe header deserialization in Spring Integration's EmbeddedHeadersJsonMessageMapper exposes applications to header injection across all active release trains (5.5.x through 7.1.0). The decodeNativeFormat method constructs GenericMessage objects with MutableMessageHeaders populated directly from attacker-controlled JSON-deserialized header maps, bypassing sanitization by default in the constructor. Low-privileged network attackers who can submit crafted byte payloads to an affected consumer channel can manipulate message headers, yielding partial confidentiality, integrity, and availability impacts. No public exploit has been identified at time of analysis and this CVE is not listed in CISA KEV.
Open redirect in Spring Authorization Server 1.5.0-1.5.7 allows remote unauthenticated attackers to redirect victims to attacker-controlled sites by crafting authorization requests that pair an invalid request_uri with an unvalidated redirect_uri. The CVSS scope change (S:C) reflects that the redirect escapes the authorization server's security boundary, enabling high-trust phishing attacks because victims see the legitimate authorization server domain before being redirected. No public exploit has been identified at time of analysis, and exploitation requires user interaction.
Reflected cross-site scripting (XSS) in Spring Security's built-in OAuth2 Authorization Server consent page allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser by delivering a crafted authorization request URL. Affected versions include Spring Security 7.1.0 and 7.0.0 through 7.0.6; the consent page reflects user-controlled values (such as client name or scope parameters) directly into the HTML response without encoding. No public exploit has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog, but the changed-scope CVSS vector reflects the elevated risk of token and session theft in OAuth2 flows.
Reflected XSS in Seres Software syWEB through version 27082026 allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in victims' browsers by inducing them to click a crafted URL. The vulnerability is compounded by the vendor's confirmation that syWEB is end-of-life and unsupported, meaning no patch will ever be released. No public exploit code has been identified at time of analysis, and the product has no CISA KEV listing.
Cross-site scripting (Cross Zone Scripting variant) in BilPark Informatics Technologies' DoXBASE allows unauthenticated remote attackers to inject and execute malicious scripts in a victim's browser, affecting all versions through 27082026. The CVSS 3.1 score of 6.1 reflects network-based exploitation requiring victim interaction, with a changed scope indicating the injected script executes across browser security zones. No patch is available and the vendor did not respond to TR-CERT's disclosure, leaving organizations with no official remediation path.
Reflected XSS in Spring Framework's MVC and WebFlux data-binding error rendering exposes users of vulnerable applications to arbitrary HTML and JavaScript injection. All active Spring Framework release trains are affected - versions 5.2.x through 7.0.8 - making the exposure surface extremely broad across enterprise Java deployments. An unauthenticated attacker (per CVSS PR:N) can craft a malicious URL containing injected script payloads that, when a victim clicks it, execute in the victim's browser context via reflected field-error output. No public exploit code has been identified and EPSS sits at 0.17% (7th percentile), indicating limited observed exploitation activity at time of analysis.
Open redirect in Spring Framework's UrlHandlerFilter allows unauthenticated remote attackers to silently redirect authenticated users to attacker-controlled URLs. Affected are Spring Framework 7.0.0-7.0.8 and 6.2.0-6.2.19 in both Spring MVC and Spring WebFlux deployments where UrlHandlerFilter is configured with broadly matching URL patterns. No public exploit code exists and SSVC indicates no known active exploitation; however, the no-privilege, network-reachable attack vector makes this a credible phishing enabler in affected applications. EPSS sits at 0.15% (5th percentile), consistent with low-automated-exploitation likelihood.
Open redirect in Spring Framework's UrlFileNameViewController exposes users of affected Spring MVC applications to phishing and credential-harvesting attacks across all active Spring Framework release trains (5.2.x through 7.0.x). The flaw allows an unauthenticated attacker to craft a URL that causes the vulnerable application to redirect victims to an arbitrary external domain, exploiting the controller's path-to-view-name resolution when end-of-path mapping is used without a configured prefix. No active exploitation has been confirmed - EPSS sits at 0.14% (4th percentile) and CISA SSVC reports exploitation status as none, making this a targeted patching priority rather than an emergency.
TLS bypass in Grafana's ClickHouse Datasource plugin (versions 3.1.0 through 4.20.0) silently transmits database traffic in cleartext when the Native protocol is routed through a PDC or secure SOCKS proxy, despite TLS being configured. The underlying connection library ignores the TLS request without raising an error, exposing ClickHouse usernames, passwords, SQL queries, and query results to any attacker positioned on the network hop between the proxy and the database server. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Path traversal in Eclipse SW360's optional filesystem attachment store allows authenticated low-privilege users to write files to arbitrary paths on the host operating system by crafting malicious filenames during attachment upload. Affected versions span 19.0.0 through 20.1.0 exclusively when the non-default `enable.attachment.store.to.file.system` configuration key is active. The CVSS 4.0 score of 6.0 (AT:P, PR:L, VI:H) reflects meaningful integrity impact gated behind a specific configuration requirement; no public exploit has been identified at time of analysis.
Denial of service in Silicon Labs SiSDK v2026.6.0 and earlier affects EFR32MG24 and EFR32MG26 wireless SoCs running concurrent multiprotocol Zigbee and Thread. Under high network traffic loads, ACK packets are dropped, causing the device networking stack to fail and rendering the IoT endpoint unresponsive. No public exploit has been identified and active exploitation has not been confirmed by CISA KEV, but the patch is available from the vendor.
EAZ EazyFix 12.9 exposes a security feature bypass (CWE-325: Missing Required Cryptographic Step) that allows a highly privileged local attacker to disable Secure Boot, undermining the firmware-level integrity chain that prevents unauthorized boot components from executing. The MSRC entry at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25250 confirms Microsoft ecosystem relevance, suggesting the flaw interacts with Windows Secure Boot validation. No public exploit is identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Timing side-channel exposure in Spring Security allows remote unauthenticated attackers to progressively infer security-sensitive string values - such as CSRF tokens, bearer tokens, or other secrets compared at the application layer - by statistically measuring the time differential between rejection responses. Multiple active Spring Security release trains are affected, spanning versions 5.7.x through 7.1.x, representing a broad swath of production Spring-based Java applications. No public exploit code has been identified at time of analysis, and CISA KEV status is absent; however, the confidentiality impact is rated High in the CVSS vector, reflecting that successful exploitation could fully compromise protected secrets under favorable network conditions.
Denial of service in jwcrypto's JWE.deserialize() function allows a remote unauthenticated attacker to crash any service that processes untrusted JWE tokens by submitting a malformed compact serialization containing an excessive number of period delimiters, triggering uncontrolled memory allocation and a MemoryError. Affected deployments include Red Hat Ansible Automation Platform 2, RHEL 9 and 10, OpenShift AI (RHOAI), and OpenStack Platform 16.2 as disclosed via Red Hat Bugzilla 2524147 and upstream advisory GHSA-96rv-c4vc-h4f4. No public exploit code or CISA KEV listing exists at time of analysis, and impact is confined to availability with no confidentiality or integrity exposure.
Resource exhaustion in Spring for GraphQL's WebSocket client allows unauthenticated remote attackers to trigger a Denial of Service when the keepAlive feature is enabled. Three release trains are affected: 1.3.x through 1.3.9, 1.4.x through 1.4.6, and 2.0.x through 2.0.4, as confirmed by the VMware/Spring vendor advisory. No public exploit code has been identified and EPSS at 0.15% (4th percentile) indicates low near-term exploitation probability, though the lack of authentication requirement warrants patching for any deployment exposing WebSocket endpoints to untrusted networks.
UpdraftPlus: WP Backup & Migration Plugin for WordPress (all versions before 1.26.7) exposes a backup restoration action without CSRF token validation, enabling a remote attacker to revert a site's entire database and files to a prior backup state by tricking a logged-in administrator into clicking a crafted link. The integrity impact is high - a successful exploit silently undoes content updates, security hardening, and user data accumulated since the backup was taken. No public exploit is identified at time of analysis; EPSS sits at the 1st percentile and SSVC marks exploitation as none, indicating low current threat activity.
CVE-2026-77117 is associated with Ubuntu based on a single vendor source tag, but no description, CVSS score, CWE, or supplementary intelligence is available to characterize the vulnerability. No meaningful impact, affected versions, or exploitation conditions can be determined from the provided data. This record should be treated as a placeholder until substantive NVD or vendor advisory data is available.
Out-of-bounds stack array access in the tdelete function affects the GNU C Library (glibc) as reported by Ubuntu. The tdelete function, part of POSIX binary tree search routines (tsearch family), contains a memory safety flaw where a stack-allocated array can be accessed beyond its bounds during tree node deletion. Exploitation depends on an application passing attacker-influenced input to tdelete, and no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in Adobe DNG SDK 1.7.1 2502 and earlier exposes sensitive memory contents when a victim opens a maliciously crafted DNG file. The flaw resides in the SDK's file parser and affects any application built on top of the DNG SDK that processes untrusted DNG inputs. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, limiting current urgency despite the High confidentiality impact.
Spring Cloud Function versions across three actively maintained release lines (4.2.x, 4.3.x, and 5.0.x) are affected by a potential arbitrary file read and SSRF vulnerability reported by VMware. The vendor-assigned CVSS 3.1 score of 2.0 reflects severe constraints on exploitability - high privilege requirements (PR:H), required user interaction (UI:R), and high attack complexity (AC:H) together make opportunistic or unauthenticated exploitation implausible. No public exploit code exists and the vulnerability has not been added to the CISA KEV catalog at time of analysis.
Out-of-bounds write in Adobe DNG Software Development Kit versions 1.7.1 2502 and earlier allows memory corruption when a victim opens a maliciously crafted DNG file, causing the consuming application to crash or become unresponsive. The flaw (CWE-787) is constrained to a local, user-interaction-dependent attack path, limiting automated exploitation. No public exploit code has been identified at time of analysis and no CISA KEV listing exists.
Broken access control in the Push Notification for Post and BuddyPress WordPress plugin (version <= 3.20) allows authenticated users with subscriber-level privileges to perform actions restricted to higher-privileged roles, resulting in unauthorized read and write access. Exploitation requires only a valid WordPress subscriber account on the target site, making it relevant wherever the plugin is installed on community-oriented or membership-based WordPress sites running BuddyPress. No public exploit has been identified at time of analysis, and the CVSS score of 5.4 (Medium) reflects limited but real integrity and confidentiality impact without availability consequences.
Spring Integration JMS inbound components copy inbound JMS message properties verbatim into Spring MessageHeaders without filtering reserved internal header names, enabling any authorized JMS producer to inject routing and type-resolution headers. All supported release lines are affected - from 5.5.21 and earlier through the current 7.1.0 - making this a broad exposure across enterprise Java integration deployments. No public exploit has been identified at time of analysis; however, injection of the json__TypeId__ header may interact with Jackson polymorphic deserialization if enabled, potentially elevating practical impact beyond the assigned CVSS 5.4 Medium.
Cross-organization IDOR in Katello's Content View Filter Rules API allows authenticated low-privileged users to access and modify filter rules belonging to Content View Filters in other organizations by supplying a foreign filter identifier. Red Hat Satellite 6 deployments running multi-organization configurations are affected, as the API enforces authorization on the Content View but fails to validate the parent Content View Filter's organizational boundary. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS score of 5.4 (Medium) reflects the limited scope - authenticated access and Satellite's enterprise context constrain real-world exposure.
Concurrent message processing in Spring Integration's script-backed channels causes shared ScriptEngine state corruption when using JSR-223 engines that declare THREADING=null, such as the Kotlin KTS engine. Affected Spring Integration versions from 5.5.21 and earlier through 7.1.0 are susceptible to cross-message data leakage, where one message's payload or header bindings can bleed into another message's script evaluation context under concurrent load. No public exploit has been identified at time of analysis, and the CVSS 4.2 Medium rating reflects the high attack complexity imposed by the required race condition, though the information disclosure and partial integrity impact are real concerns in multi-tenant or high-throughput deployments.
Reflected XSS in doggo's Phoenix date field component (versions 0.1.0 through 0.14.7) allows network-accessible, unauthenticated attackers to inject HTML into the rendered page when a form validation failure re-renders a user-supplied date value. The root cause is `Doggo.normalize_value/2` wrapping the raw user input in Phoenix.HTML's `{:safe, ...}` marker - bypassing the framework's built-in escaping - before emitting it verbatim into the `value` attribute of the generated `<input>` element. Payloads are constrained to ten bytes by the original truncation logic, which prevents full inline script injection but still permits attribute-breaking strings (e.g., `" onload=x`) sufficient to attach short event handlers. No public exploit has been identified and the vulnerability is not listed in CISA KEV; a vendor patch is available in doggo 0.14.8.
Denial of Service in Spring Cloud Config's Monitor component allows unauthenticated remote attackers to crash or degrade the configuration server by submitting malicious payloads to the webhook endpoint. Affected versions span the 3.x, 4.x, and 5.x release lines, covering a broad installed base of Spring Boot microservice environments. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the unauthenticated network-accessible attack surface (PR:N, AV:N, AC:L) means exploitation requires minimal capability.
Insufficient authorization on the Flowintel /my_assignment/user API endpoint allows any authenticated API user to retrieve assignment records belonging to other users by supplying an arbitrary user_id parameter. Affected are Flowintel instances up to and including version 3.3.0, per EUVD-2026-67127. The fix, confirmed via commit 10ec32e7, elevates the required privilege level by replacing the api_required decorator with admin_or_org_admin_required, restricting cross-user assignment queries to administrators only. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Broken access control in the Kali Forms WordPress plugin (versions ≤ 2.4.23) exposes one or more plugin endpoints to unauthenticated remote attackers due to missing authorization checks (CWE-862). The CVSS vector AV:N/AC:L/PR:N/UI:N confirms exploitation requires no authentication and no user interaction against any internet-exposed WordPress site running an affected version. Impact is constrained to integrity (I:L), indicating unauthorized modification of form data or plugin state, with no confidentiality or availability consequences identified. No public exploit or active exploitation has been identified at time of analysis.
Broken access control in the Ditty WordPress plugin (versions up to and including 3.1.67) allows subscriber-level authenticated users to perform actions beyond their authorized scope, classified under CWE-862 (Missing Authorization). Reported by Patchstack with a CVSS 3.1 score of 5.3 Medium, the flaw is particularly impactful on WordPress sites with open user registration, where any self-registered subscriber could exploit it. No public exploit code and no CISA KEV listing are identified at time of analysis.
HTTP response splitting in cpp-httplib 0.49.0 allows an attacker who can influence chunked response trailer values to inject arbitrary headers into the HTTP response stream, potentially forging responses seen by downstream clients. The trailer-writing path in write_content_chunked() is the sole code path in the library that omits the CRLF validation applied by set_header() and every other header-writing function, meaning attacker-controlled CR/LF sequences pass directly to the socket. No public exploit code and no CISA KEV listing have been identified; the fix is confirmed in version 0.50.0 via upstream security advisory GHSA-2r2h-jc8w-w66c.
Reflected XSS in Joomla Events Manager versions prior to 5.0.1 allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser via a crafted PDF export URL. The root cause is in `buildCurrentPdfLink`, which blindly copies the raw HTTP request query string into a PDF button URL, and `pdfbutton()` subsequently renders that value in HTML without any output escaping. Exploitation requires social engineering to lure an authenticated or unauthenticated Joomla site visitor into clicking a malicious link; no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Account footprinting via observable discrepancy in Seres Software syWEB exposes valid user account existence to unauthenticated remote attackers. All versions through 27082026 are affected, and the vendor has confirmed the product is end-of-life with no support - meaning no patch will ever be released. No public exploit code or CISA KEV listing has been identified, but the permanently unpatched status elevates long-term risk for any remaining deployments.
Spring Security 7.1.0's InetAddressMatchers utility contains a flaw in its IP address classification logic - the matchInternal() and matchExternal() builders may incorrectly categorize certain IP addresses as belonging to internal or external networks, enabling unauthenticated remote attackers to bypass IP-based access controls under high-complexity conditions. Applications that rely on InetAddressMatchers to enforce network-level access restrictions are exposed to limited information disclosure where restricted endpoints or data may become accessible to external parties. No public exploit code exists and no CISA KEV listing is present, indicating no confirmed active exploitation at time of analysis.
Server-side request forgery in WatchGuard Dimension's Remote Backup Connection Test configuration feature allows authenticated privileged users to enumerate exposed network services on adjacent systems. The CVSS 4.0 score of 5.3 reflects confined impact - no direct compromise of the Dimension host itself, but meaningful secondary-system reconnaissance capability. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Broken object-level authorization in Joomla Event Manager before 5.0.1 allows any authenticated Joomla user to read attendee lists - including names, usernames, registration dates, and statuses - for events they do not manage. The exposure extends to unpublished events, meaning data intended to remain private before an event goes live is also accessible. No public exploit has been identified at time of analysis, and the flaw is not listed in the CISA KEV catalog.
Integer underflow in the wicked DHCPv4 packet capture daemon (wickedd-dhcp4) on SUSE Linux systems allows an unauthenticated adjacent-network attacker to crash the daemon by sending a malformed DHCPv4 packet with an IP total length field smaller than the IP header length. The missing bounds check in ni_capture_inspect_udp_header() triggers an out-of-bounds read, causing a process crash depending on memory layout - resulting in a denial of service to network configuration. No information disclosure has been demonstrated, and no public exploit or CISA KEV listing exists at time of analysis.
Out-of-bounds heap read in the DHCPv4 packet capture code of wicked (all versions through 0.6.80) allows an unauthenticated attacker on the same Layer-2 network segment to send a crafted DHCP/UDP packet that causes wickedd-dhcp4 to read up to 68 bytes past the end of its 1500-byte receive buffer. Adjacent heap contents - including allocator metadata and pointer values - may be parsed as DHCP options and stored into lease fields, constituting limited information disclosure with a secondary low-integrity configuration impact. No public exploit code and no CISA KEV listing have been identified at time of analysis; an upstream fix exists in GitHub PR #1079, though a tagged release version has not been independently confirmed.
NoSQL injection in the MongoDB C# Driver's document-replacement code path allows network-accessible, low-privileged attackers to inject MongoDB query-language operators into database operations. The driver omits the element-name and shape validation applied by other write paths, so untrusted loosely-typed input (BsonDocument, Dictionary, dynamic) is forwarded to the MongoDB server unfiltered, enabling attacker-controlled data to be interpreted as update logic under the application's own database credentials. No public exploit or CISA KEV listing has been identified at time of analysis; exploitation is bounded to applications that use loosely-typed replacement patterns rather than strongly-typed C# document mappings.
Unauthenticated log extraction in Veno File Manager 4.4.9 exposes all application log data to any network-reachable attacker via a missing access control check on a PHP admin endpoint. The `/vfm-admin/admin-panel/view/save-cvs.php` script performs no authentication or authorization before processing POST requests, allowing arbitrary retrieval of log records from any specified date onward. A public proof-of-concept repository exists on GitHub (jfs-jfs/CVE-2026-37067); EPSS sits at 0.16% (6th percentile), indicating no widespread exploitation has been observed at time of analysis.
Absolute server filesystem path disclosure in Veno File Manager 4.4.9 is exploitable by unauthenticated remote attackers via a bundled third-party library example file left accessible in production. The file /vfm-admin/assets/zipstream/grandt/relativepath/RelativePath.Example1.php - a demo script from the grandt/php-relativepath Composer package - outputs the server's absolute installation path when retrieved with a plain GET request, requiring no credentials or special conditions. A public proof-of-concept repository exists at github.com/jfs-jfs/CVE-2026-37069; no active exploitation has been confirmed in CISA KEV, and EPSS stands at 0.16% (6th percentile), indicating minimal in-the-wild interest.
Unauthenticated SMTP abuse in Veno File Manager 4.4.9 exposes the `/vfm-admin/ajax/sendfiles.php` endpoint without any access control, allowing any remote attacker to send arbitrary emails through the application's pre-configured SMTP server. By submitting a crafted POST request with the appropriate parameters, an attacker can impersonate the legitimate server's email identity without knowing SMTP credentials - enabling spam delivery, phishing, or targeted social engineering from a trusted domain. No CISA KEV listing exists and EPSS is 0.16% (6th percentile), but a public proof-of-concept repository on GitHub lowers the exploitation barrier.
User enumeration in Veno File Manager 4.4.9 exposes the unauthenticated admin AJAX endpoint `/vfm-admin/ajax/usr-check.php` to remote attackers, who can systematically harvest valid usernames by sending POST requests with varying `user_name` values and observing observable response discrepancies (CWE-203). The vulnerability requires no credentials, no user interaction, and no special configuration beyond the admin panel being network-reachable. A publicly available proof-of-concept is hosted on GitHub; EPSS is low at 0.16% (6th percentile), indicating no widespread exploitation has been observed, and the vulnerability is not listed in the CISA KEV catalog.
Namespace injection in MongoDB C Driver (libmongoc) allows any caller-controlled database or collection name containing a '.' separator or NUL byte to redirect a MongoDB operation to an unintended resource. Applications that incorporate unsanitized user input into these name components are affected across all libmongoc versions prior to 2.5.1. No public exploit has been identified at time of analysis; the vendor released a validated fix in version 2.5.1.