Lucene search
+L
CvelistRecent

374319 matches found

Cvelist
Cvelist
added 2026/07/14 7:21 p.m.49 views

CVE-2026-48310 Adobe Experience Manager | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access...

8.6CVSS0.00506EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/14 7:21 p.m.48 views

CVE-2026-48259 Adobe Experience Manager | Server-Side Request Forgery (SSRF) (CWE-918)

Adobe Experience Manager is affected by a Server-Side Request Forgery SSRF vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could leverage this vulnerability to issue unauthorized server-side requests, potentially gaining...

9.6CVSS0.00682EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/14 7:21 p.m.56 views

CVE-2026-48359 Adobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)

Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference 'XXE' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to read sensitive files, potentially...

9.6CVSS0.01705EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/14 7:21 p.m.49 views

CVE-2026-48263 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Experience Manager is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the...

5.4CVSS0.00167EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/14 7:20 p.m.55 views

CVE-2026-48260 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

5.4CVSS0.00168EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/14 7:20 p.m.48 views

CVE-2026-48355 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Experience Manager is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the...

5.4CVSS0.00167EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/14 7:20 p.m.48 views

CVE-2026-48253 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

5.4CVSS0.00168EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/14 7:20 p.m.48 views

CVE-2026-48261 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

5.4CVSS0.00168EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/14 7:20 p.m.52 views

CVE-2026-48262 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

5.4CVSS0.00168EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/14 7:20 p.m.47 views

CVE-2026-48255 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

5.4CVSS0.00168EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/14 7:20 p.m.44 views

CVE-2026-48252 Adobe Experience Manager | Missing Authentication for Critical Function (CWE-306)

Adobe Experience Manager is affected by a Missing Authentication for Critical Function vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not...

8.6CVSS0.00371EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/14 7:20 p.m.47 views

CVE-2026-48257 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

5.4CVSS0.00168EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/14 7:20 p.m.44 views

CVE-2026-48254 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

5.4CVSS0.00168EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/14 7:16 p.m.34 views

CVE-2026-48747 Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.13 and 8.0.13, MailomatRequestParser::validateSignature parsed X-MOM-Webhook-Signature as algo=signature and passed the request-selected algorithm to hashhmac, allowing a signature...

6.3CVSS0.00197EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2026/07/14 7:14 p.m.43 views

CVE-2026-48489 Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, DefaultAuthenticationFailureHandler honored the request-supplied failurepath parameter when failureforward: true was enabled, allowing an unauthenticated...

8.7CVSS0.00475EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/07/14 7:11 p.m.39 views

CVE-2026-48760 Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0 until 6.4.41, 7.4.13, and 8.0.13, UrlSanitizer::parse rejected raw BiDi formatting characters but not percent-encoded forms and used an ASCII-only whitespace check, allowing sanitized URLs...

5.3CVSS0.00259EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/07/14 7:9 p.m.43 views

CVE-2026-48736 Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.0 to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, NoPrivateNetworkHttpClient and IpUtils::PRIVATESUBNETS omitted IPv6 transition prefixes such as 6to4, NAT64, Teredo, and IPv4-compatible IPv6, allowi...

6.9CVSS0.0046EPSS
SaveExploits0References6
Cvelist
Cvelist
added 2026/07/14 7:4 p.m.41 views

CVE-2026-48784 Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, UrlGenerator::doGenerate used strtr dot-segment encoding that skipped every other chained ../ or ./ segment, allowing attacker-controlled route parameters...

5.1CVSS0.00267EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/07/14 7:2 p.m.39 views

CVE-2026-45068 Symfony: Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, SendmailTransport in -t mode appended recipient addresses to the sendmail command line without a -- end-of-options separator, allowing an address beginnin...

8.7CVSS0.00407EPSS
SaveExploits0References6
Cvelist
Cvelist
added 2026/07/14 7:0 p.m.37 views

CVE-2026-47212 Symfony: Twilio Notifier Webhook Parser Never Verifies the X-Twilio-Signature HMAC: Unauthenticated Webhook Event Injection

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, TwilioRequestParser::doParse received the configured webhook secret but ignored the X-Twilio-Signature HMAC header, allowing unauthenticated POST requests to inje...

6.9CVSS0.00238EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/07/14 6:58 p.m.37 views

CVE-2026-45071 Symfony: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Crawler::addXmlContent set DOMDocument::$validateOnParse = true before loadXML, re-enabling external entity resolution and allowing attacker-supplied XML ...

8.7CVSS0.00462EPSS
SaveExploits0References6
Cvelist
Cvelist
added 2026/07/14 6:56 p.m.39 views

CVE-2026-45755 Symfony: Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.12 and 8.0.12, MailtrapRequestParser::doParse received the configured webhook secret but ignored the X-Mt-Signature HMAC header, allowing unauthenticated POST requests to inject forged...

6.9CVSS0.00238EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2026/07/14 6:54 p.m.44 views

CVE-2026-45754 Symfony: Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, the Mailjet mailer bridge and LOX24 notifier bridge webhook parsers received configured webhook secrets but did not verify them, allowing unauthenticated POST...

6.9CVSS0.00348EPSS
SaveExploits0References6
Cvelist
Cvelist
added 2026/07/14 6:50 p.m.39 views

CVE-2026-45305 Symfony: YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Yaml\Parser::cleanup used regular expressions with overlapping quantifiers for YAML directive, comment, and document marker cleanup,...

8.7CVSS0.00804EPSS
SaveExploits0References6
Cvelist
Cvelist
added 2026/07/14 6:48 p.m.37 views

CVE-2026-45304 Symfony: YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Yaml\Parser resolved YAML collection aliases recursively, allowing a small untrusted YAML input to expand into a multi-gigabyte structur...

8.7CVSS0.00804EPSS
SaveExploits0References6
Cvelist
Cvelist
added 2026/07/14 6:46 p.m.41 views

CVE-2026-45069 Symfony: OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, OidcTokenHandler::verifyClaims registered audience aud, issuer iss, and expiry exp checkers but did not pass the mandatory claims list to...

8.8CVSS0.00237EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2026/07/14 6:45 p.m.90 views

CVE-2026-47305 Visual Studio Remote Code Execution Vulnerability

...

7.8CVSS0.00335EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/14 6:45 p.m.92 views

CVE-2026-47304 .NET Security Feature Bypass Vulnerability

...

8.1CVSS0.00216EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/14 6:45 p.m.58 views

CVE-2026-47303 ASP.NET Core Elevation of Privilege Vulnerability

...

8.8CVSS0.00736EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/14 6:45 p.m.64 views

CVE-2026-47302 .NET Denial of Service Vulnerability

...

7.5CVSS0.01029EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/14 6:45 p.m.55 views

CVE-2026-47301 Configuration Manager Elevation of Privilege Vulnerability

...

8.8CVSS0.00537EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/14 6:45 p.m.41 views

CVE-2026-45133 Symfony: [Yaml] Harden the parser when handling untrusted input

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, when the parser is exposed to attacker-controlled input, deeply nested mappings or sequences cause both the block-level Parser::parseBlock and inline...

8.2CVSS0.0074EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/07/14 6:40 p.m.41 views

CVE-2026-45075 Symfony: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.12 and 8.0.12, method-scoped IsGranted, IsSignatureValid, and IsCsrfTokenValid attributes can be configured for GET only, but Symfony routes HEAD requests to the GET handler while the...

8.3CVSS0.00382EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/07/14 6:38 p.m.38 views

CVE-2026-47767 Symfony: SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.46 until 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the CVE-2024-50340 fix gated runtime argv parsing on empty$GET, but parsestr and the web SAPI can disagree, allowing a crafted query string to...

8.3CVSS0.00389EPSS
SaveExploits0References6
Cvelist
Cvelist
added 2026/07/14 6:35 p.m.42 views

CVE-2026-45064 Symfony: HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, UrlSanitizer::parse passes Unicode explicit-direction BiDi formatting characters through into sanitized href and src attributes, allowing sanitized...

2.3CVSS0.00293EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/07/14 6:28 p.m.39 views

CVE-2026-45063 Symfony: Identity Spoofing via Unanchored DN Regex in X509Authenticator

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, X509Authenticator extracts the user identifier from $SERVER'SSLCLIENTSDN' with an unanchored regex that matches emailAddress= anywhere in the distinguishe...

9.1CVSS0.0033EPSS
SaveExploits0References6
Cvelist
Cvelist
added 2026/07/14 6:25 p.m.52 views

CVE-2026-45070 Symfony: Email Header Injection via Non-Token Characters in Mime Parameter Names

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Mime\Header\ParameterizedHeader validates and encodes parameter values but emits parameter names verbatim, allowing a caller that derive...

6.3CVSS0.00292EPSS
SaveExploits0References6
Cvelist
Cvelist
added 2026/07/14 6:23 p.m.39 views

CVE-2026-45073 Symfony: SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, PdoAdapter::doClear builds a DELETE statement using a namespace derived from the caller-supplied $prefix without binding or escaping it, allowing a caller...

6.3CVSS0.0041EPSS
SaveExploits0References6
Cvelist
Cvelist
added 2026/07/14 6:21 p.m.43 views

CVE-2026-45753 Symfony: HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — javascript: URI Survives Sanitization (XSS)

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, UrlAttributeSanitizer::getSupportedAttributes omits URL-valued attributes including action, formaction, poster, and cite, so configurations that adm...

2.1CVSS0.00293EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/07/14 6:20 p.m.45 views

CVE-2026-15720 Pre-auth heap out-of-bounds read in the AMF NAS 5GS mobile-identity handler

In Open5GS through version 2.7.7 a pre-authentication heap out-of-bounds read in the AMF NAS 5GS mobile-identity handler may result in subscriber-wide denial of service...

8.6CVSS0.00371EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/14 6:20 p.m.68 views

CVE-2026-47300 ASP.NET Core Elevation of Privilege Vulnerability

...

8.8CVSS0.00527EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/14 6:11 p.m.39 views

CVE-2026-15712 Soupclientmessageiohttp2: libsoup3: libsoup: http/2 goaway frame parsing heap buffer over-read via invalid nul-termination assumption

A heap buffer over-read vulnerability was discovered in libsoup's versions: libsoup 3.0 to 3.7.0 HTTP/2 connection tracking framework. When the library processes an HTTP/2 GOAWAY frame, it improperly handles the "Additional Debug Data" payload by assuming the data stream is a safely NUL-terminate...

5.9CVSS0.00498EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/07/14 6:11 p.m.44 views

CVE-2026-15058

Improper authorization in the secure messages deletion endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated user to delete another user's messages via a direct object reference to the message identifier...

0.00162EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/14 6:11 p.m.43 views

CVE-2026-45072 Symfony: Stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.4.24 until 6.4.40, 7.4.12, and 8.0.12, the development profiler fileexcerpt Twig filter escapes PHP files through highlightstring but interpolates lines from non-PHP files directly into...

2CVSS0.00232EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/07/14 6:9 p.m.43 views

CVE-2026-15642

Insertion of sensitive information into a file in the Recovery Kit response file generation feature in Devolutions Server 2026.1.22.0, 2026.2.11.0 allows an attacker with access to the generated response file to obtain the Azure Key Vault client secret in cleartext, even when the option to exclud...

0.00115EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/14 6:9 p.m.49 views

CVE-2026-15641

Improper authorization in the access request status endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileged user to approve their own pending access request via a direct call to the request status endpoint, bypassing the required approver review...

0.00213EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/14 6:5 p.m.40 views

CVE-2026-15637

Improper authorization in the PAM SSH key and certificate retrieval endpoints in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileged user to disclose the private key of an SSH key or certificate PAM credential via a direct object reference to the credential identifier...

0.00192EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/14 6:0 p.m.59 views

CVE-2026-5040 Weak Password Hashing Mechanism in TP-Link Deco M5

TP-Link Deco M5 v1 uses a weak password hashing mechanism to store user credentials. An attacker who obtains the password hash through system compromise or privileged access could perform brute-force or dictionary attacks. Successful exploitation may result in disclosure of authentication...

7.1CVSS0.00093EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/07/14 5:57 p.m.31 views

CVE-2026-45756 Symfony: JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoS

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 7.3.0-BETA1 until 7.4.12 and 8.0.12, the JsonPath component compiles attacker-controlled match and search filter patterns directly into pregmatch without a length cap, i-regexp restriction, or...

8.2CVSS0.00598EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2026/07/14 5:53 p.m.34 views

CVE-2026-45066 Symfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, HtmlSanitizer URL sanitization can allow off-allowlist URLs through allowLinkHosts or allowMediaHosts because UrlSanitizer::parse follows RFC 3986...

2.3CVSS0.00298EPSS
SaveExploits0References5
Total number of security vulnerabilities374319