Lucene search
+L
GithubRecent

34222 matches found

Github Security Blog
Github Security Blog
added 2026/06/04 2:37 p.m.21 views

Doorkeeper Openid Connect: Dynamic Client Registration feature creates public clients with client_secret

Impact The DynamicClientRegistrationControllerregister action hard-codes confidential: false when creating applications dynamicclientregistrationcontroller.rb:18-25, yet the response includes a clientsecret and advertises tokenendpointauthmethodssupported: "clientsecretbasic", "clientsecretpost"...

5.8AI score0.00058EPSS
SaveExploits0References5Affected Software1
Github Security Blog
Github Security Blog
added 2026/06/04 2:33 p.m.36 views

WebOb: Location header normalization during redirect leads to open redirect - again

Impact When WebOb normalizes the HTTP Location header to include the request hostname, it does so by parsing the URL that the user is to be redirected to with Python's urllib.parse, and joining it to the base URL. urlsplit called internally by urljoin however treats a // at the start of a string ...

6.1CVSS5.7AI score0.00162EPSS
SaveExploits0References8Affected Software1
Github Security Blog
Github Security Blog
added 2026/06/04 2:24 p.m.93 views

Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection

Summary Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a regular expression from the configured XSRF cookie name without escaping regex metacharacters. In standard browser environments, an attacker who can influence the cookie name passed to axios can cause...

7.5CVSS6AI score0.00622EPSS
SaveExploits1References4Affected Software1
Github Security Blog
Github Security Blog
added 2026/06/04 2:21 p.m.202 views

Allocation of Resources Without Limits or Throttling in Axios

Summary Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size limits when requests were sent with the fetch adapter. Applications that selected adapter: 'fetch', or ran in environments where axios resolved to the fetch adapter, could receive or send bodies large...

7.5CVSS5.8AI score0.00622EPSS
SaveExploits1References6Affected Software1
Github Security Blog
Github Security Blog
added 2026/06/04 2:19 p.m.273 views

Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter

Summary Axios’s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows. This affects Node.js usage, where an initial HTTP request is sent through an authenticated HTTP proxy, redirects are followed, and the redirected UR...

8.2CVSS5.8AI score0.00664EPSS
SaveExploits1References5Affected Software1
Github Security Blog
Github Security Blog
added 2026/06/04 2:15 p.m.330 views

Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection

Summary Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated proxy, Axios may add a Proxy-Authorization header. If Axios then follows a redirect and the redirected request is no longer sent through that...

7.5CVSS5.9AI score0.0066EPSS
SaveExploits1References7Affected Software1
Github Security Blog
Github Security Blog
added 2026/06/04 1:15 p.m.21 views

Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

Summary In affected versions, the HTTP Host request header was not validated before being used to reconstruct request.url. Because the routing algorithm relies on the raw HTTP path while request.url is rebuilt from the Host header, a malformed header could make request.url.path differ from the pa...

6.5CVSS5.9AI score0.01839EPSS
SaveExploits2References26Affected Software1
Github Security Blog
Github Security Blog
added 2026/06/04 12:30 p.m.12 views

MLflow: Deterministic sampling in dataset digest enables predictable collisions

A flaw has been found in MLflow up to 3.10.0. This issue affects the function mlflow.data.digestutils of the file mlflow/data/digestutils.py of the component Dataset Digest Computation. This manipulation causes use of weak hash. It is possible to launch the attack on the local host. The attack is...

3.6CVSS5.5AI score0.00103EPSS
SaveExploits1References10Affected Software1
Github Security Blog
Github Security Blog
added 2026/06/04 12:30 p.m.11 views

Streamlit @st.cache_data hash collision via fixed sampling seed and PIL P-mode palette omission

A vulnerability has been found in Streamlit up to 1.53.0. Impacted is an unknown function in the library lib/streamlit/runtime/caching/hashing.py of the component Palette Handler. Such manipulation leads to use of weak hash. Local access is required to approach this attack. The attack requires a...

4.7CVSS5.3AI score0.00083EPSS
SaveExploits0References12Affected Software1
Github Security Blog
Github Security Blog
added 2026/06/04 12:30 p.m.5 views

Keystone: GraphQL API Endpoint Lacks Query Depth Limits

A vulnerability was detected in keystonejs keystone up to 20260319. This vulnerability affects unknown code in the library packages/core/src/lib/core/queries/output-field.ts of the component GraphQL API Endpoint. The manipulation results in resource consumption. It is possible to launch the attac...

5.3CVSS5.8AI score0.0031EPSS
SaveExploits0References10Affected Software1
Github Security Blog
Github Security Blog
added 2026/06/04 12:30 p.m.10 views

ms-swift: Image Cache Hash Collision via Missing Dimension Metadata

A security vulnerability has been detected in modelscope ms-swift up to 4.2.0. This affects the function Template.savepilimage of the file swift/template/base.py of the component PIL Image Cache Key Handler. The manipulation leads to use of weak hash. An attack has to be approached locally. A hig...

3.6CVSS5.3AI score0.00075EPSS
SaveExploits0References11Affected Software1
Github Security Blog
Github Security Blog
added 2026/06/04 6:30 a.m.6 views

OpenStack Mistral allows Arbitrary Remote Code Execution when the API is exposed

OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead to exfiltration of service credentials...

9.9CVSS6.2AI score0.00733EPSS
SaveExploits0References9Affected Software1
Github Security Blog
Github Security Blog
added 2026/06/04 6:30 a.m.5 views

OpenStack Ironic allows file overwrite via directory traversal during deployment with a crafted ISO image

OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image...

8.1CVSS6.1AI score0.00601EPSS
SaveExploits0References5Affected Software1
Github Security Blog
Github Security Blog
added 2026/06/04 12:30 a.m.6 views

OpenStack Ironic allows Boot Script Injection

OpenStack Ironic through 35.0.x allows Boot Script Injection...

7.7CVSS6.1AI score0.00262EPSS
SaveExploits0References6Affected Software1
Github Security Blog
Github Security Blog
added 2026/06/04 12:30 a.m.14 views

Gradio: Audio cache key ignores metadata when saving numpy audio outputs

A security flaw has been discovered in gradio-app gradio 6.14.0. This affects the function saveaudiotocache of the component Audio Cache Key Handler. Performing a manipulation results in use of weak hash. The attack must be initiated from a local position. The attack is considered to have high...

2.5CVSS5.5AI score0.00106EPSS
SaveExploits1References11Affected Software1
Github Security Blog
Github Security Blog
added 2026/06/03 9:41 p.m.34 views

Froxlor's API Authentication bypasses 2FA Authentication

Summary Froxlor's API authentication FroxlorRPC::validateAuth does not enforce Two-Factor Authentication. When a user admin or customer enables 2FA on their account, the web UI correctly requires a TOTP code after password verification. However, the API accepts requests authenticated with only an...

9.8CVSS7.3AI score0.01129EPSS
SaveExploits1References4Affected Software1
Github Security Blog
Github Security Blog
added 2026/06/03 9:39 p.m.18 views

browserstack-runner vulnerable to Remote Code Execution via vm sandbox escape in _log HTTP handler

Summary The HTTP handler /log in lib/server.js lines 491–515 of browserstack-runner passes unauthenticated user-supplied data to vm.runInNewContext combined with eval, enabling a sandbox escape and arbitrary code execution on the host system. Details When browserstack-runner starts, it creates an...

8.8CVSS6.5AI score0.00392EPSS
SaveExploits0References4Affected Software1
Github Security Blog
Github Security Blog
added 2026/06/03 9:38 p.m.15 views

browserstack-runner has an unauthenticated arbitrary file read via path traversal in HTTP server

Summary The HTTP server in browserstack-runner serves files from the project directory via the default handler. This handler uses path.joinprocess.cwd, uri to resolve file paths but does not validate that the resulting path stays within the project root. Combined with the server binding on 0.0.0....

7.1CVSS6AI score0.00208EPSS
SaveExploits0References4Affected Software1
Github Security Blog
Github Security Blog
added 2026/06/03 9:37 p.m.15 views

Jupyter Enterprise Gateway: Kubernetes Manifest Injection in Jinja2 Template Rendering

Summary The environment variables used during the rendering of the Kubernetes manifest allow YAML injection, enabling attackers to overwrite existing keys like securityContext and inject multi-document YAML to create additional unintended Kubernetes resources. Details The server interpolates...

10CVSS6.2AI score0.00348EPSS
SaveExploits1References2Affected Software1
Github Security Blog
Github Security Blog
added 2026/06/03 9:36 p.m.15 views

Jupyter Enterprise Gateway: Jinja2 Template Server Side Template Injection resulting in Remote Code Execution

Summary The environment variables KERNELXXX used during the rendering of the Kubernetes manifest are vulnerable to Server Side Template Injection SSTI. By including Jinja2 template expressions it is possible to execution Python code and OS Commands in the Enterprise Gateway service. The code can...

10CVSS6.4AI score0.00461EPSS
SaveExploits1References2Affected Software1
Github Security Blog
Github Security Blog
added 2026/06/03 9:34 p.m.20 views

AIOHTTP is vulnerable to cross-origin redirect with per-request cookies

Summary Cookies set with the cookies parameter on requests are sent after following a cross-origin redirect. Impact If a developer uses the cookies parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect. Workaround If unable to...

8.7CVSS5.8AI score0.0015EPSS
SaveExploits0References4Affected Software1
Github Security Blog
Github Security Blog
added 2026/06/03 9:30 p.m.7 views

mlrun: DataFrame hash collisions can cause dataset artifact path conflicts and silent data corruption

A vulnerability has been found in mlrun up to 1.12.0-rc3. This impacts the function mlrun.utils.helpers.calculatedataframehash of the file mlrun/utils/helpers.py of the component DataFrame Hash Handler. The manipulation leads to use of weak hash. The attack can only be performed from a local...

3.6CVSS5.1AI score0.00075EPSS
SaveExploits0References9Affected Software1
Github Security Blog
Github Security Blog
added 2026/06/03 9:30 p.m.7 views

Concrete CMS is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components

Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize calls in the Workflow, Form block, and File/Set components that lack the allowedclasses restriction. An unauthenticated attacker may trigger arbitrary PHP object instantiation if a malicious serialized payload has been...

8.4CVSS6.1AI score0.00175EPSS
SaveExploits0References4Affected Software1
Github Security Blog
Github Security Blog
added 2026/06/03 9:30 p.m.13 views

Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_prohibited_ids Bypass

Summary Jupyter Enterprise Gateway has a prohibited UID and GID feature that by default prevents launching kernels with UID or GID 0 root. This can be bypassed. It is possible to launch kernels with a prohibited UID and/or GID by using a specially crafted KERNELUID or KERNELGID value. The feature...

9.8CVSS6.1AI score0.00463EPSS
SaveExploits1References3Affected Software1
Github Security Blog
Github Security Blog
added 2026/06/03 9:16 p.m.17 views

Docling Core: Unsafe remote filename resolution

Impact In versions = 1.5.0, = 2.74.1 Workarounds If upgrading is not immediately possible, avoid passing untrusted URLs into remote fetch functionality. References - Fix release: v2.74.1...

8.6CVSS5.8AI score0.00286EPSS
SaveExploits0References3Affected Software1
Github Security Blog
Github Security Blog
added 2026/06/03 9:15 p.m.19 views

Docling Core: Insufficient validation of image reference URIs

Impact In versions = 2.5.0, = 2.74.1 Workarounds If upgrading is not immediately possible: - reject file: and data: image references from untrusted input - allow only approved local or remote image sources - apply input size and memory limits to processing workers References - Fix release: v2.74....

8.1CVSS5.8AI score0.00235EPSS
SaveExploits0References3Affected Software1
Github Security Blog
Github Security Blog
added 2026/06/03 9:15 p.m.20 views

Docling: Unsafe URI and Path Handling in HTML Backend

Impact The HTML backend did not perform sufficient validation during resource handling: - Accepted file:// URIs enabling local file system access when enablelocalfetch=True - Path resolution allowed traversal outside intended directories via ../ sequences and absolute paths - Did not block intern...

7.1CVSS5.8AI score0.00217EPSS
SaveExploits0References6Affected Software1
Github Security Blog
Github Security Blog
added 2026/06/03 9:14 p.m.15 views

Docling: Potential Path Traversal via LaTeX \includegraphics and \input Commands

Impact The LaTeX backend's handling of \includegraphics, \input, and \include commands lacked path containment validation. Attackers could craft malicious LaTeX documents with path traversal sequences e.g., ../../../etc/passwd to: - Read arbitrary files from the file system accessible to the...

5.5CVSS5.9AI score0.00163EPSS
SaveExploits0References5Affected Software1
Github Security Blog
Github Security Blog
added 2026/06/03 9:14 p.m.27 views

Docling: Unsafe XML Entity Expansion in USPTO Patent Backend

Impact The USPTO patent XML parser used the standard xml.sax.parseString without protection against XML External Entity XXE attacks. An attacker could craft malicious USPTO patent XML files with external entity references that could: - Read arbitrary files from the server filesystem - Perform...

9.4CVSS6AI score0.0033EPSS
SaveExploits0References8Affected Software1
Github Security Blog
Github Security Blog
added 2026/06/03 9:13 p.m.19 views

Docling: Unsafe Archive Extraction and XML Parsing in METS-GBS Backend

Impact The METS-GBS backend's XML parsing and the input document format detection lacked security controls, enabling: - XML External Entity XXE attacks to read local files or cause denial of service - Decompression bombs zip bombs to exhaust memory and disk space - Unbounded archive extraction...

7.1CVSS5.8AI score0.00113EPSS
SaveExploits0References5Affected Software1
Github Security Blog
Github Security Blog
added 2026/06/03 9:9 p.m.21 views

Docling: Unsafe Playwright-based HTML Rendering

Impact In versions = 2.82.0, 2.91.0, if the HTML backend was explicitly configured for rendering rendering option by default deactivated, then the Playwright-based rendering feature could allow JavaScript execution and unrestricted network access when processing untrusted HTML documents. An...

8.2CVSS6.5AI score0.00384EPSS
SaveExploits0References8Affected Software1
Github Security Blog
Github Security Blog
added 2026/06/03 9:6 p.m.17 views

malla: Stored XSS via Meshtastic node names in multiple frontend pages

Node names longname, shortname received via MQTT are stored in SQLite without sanitization and rendered into the DOM without escaping. Any participant on a public Meshtastic MQTT broker can set a malicious node name that executes JavaScript in the browser of every Malla dashboard visitor. Affecte...

6.1AI score0.00174EPSS
SaveExploits0References3Affected Software1
Github Security Blog
Github Security Blog
added 2026/06/03 9:5 p.m.19 views

React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint

There exists a potential DOS attack vector in React Router Framework Mode applications as well as Remix v2.10.0 - 2.17.4. Certain requests can be crafted to consume disproportionate resources on the server, resulting in response time degredation and/or service unavailability for end users. !NOTE...

7.5CVSS5.8AI score0.00299EPSS
SaveExploits0References3Affected Software2
Github Security Blog
Github Security Blog
added 2026/06/03 9:3 p.m.18 views

React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE

When using React Router v7 in Framework Mode, there exists a combination of steps that could potentially allow unauthorized RCE through external requests. This first requires the application code to have an existing prototype pollution vulnerability. This can be leveraged into a 2-step attack in...

8.1CVSS5.9AI score0.00416EPSS
SaveExploits0References3Affected Software1
Github Security Blog
Github Security Blog
added 2026/06/03 9:2 p.m.16 views

Froxlor: BIND Zone File Injection via TXT Record Content

Summary The DomainZones.add API endpoint does not sanitize newline characters in TXT record content. An authenticated customer with DNS editing enabled can inject newlines into TXT record values, which break out of the record line in the generated BIND zone file. This enables injection of arbitra...

8.8CVSS6AI score0.00544EPSS
SaveExploits1References5Affected Software1
Github Security Blog
Github Security Blog
added 2026/06/03 8:59 p.m.38 views

quic-go: HTTP/3 QPACK Trailer Expansion Memory Exhaustion

Summary An attacker can cause excessive memory allocation in quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large trailer field section with many unique field names and/or large values. The implementation builds an http.Header for t...

7.5CVSS6.8AI score0.00367EPSS
SaveExploits0References7Affected Software1
Github Security Blog
Github Security Blog
added 2026/06/03 8:58 p.m.20 views

React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation

Certain URLs passed to the redirect function can trigger an open redirect to an external domain depending on the level of validation done by the application prior to returning the redirect. !NOTE This does not impact your React Router application if you are using Declarative Mode...

8.7CVSS5.8AI score0.00162EPSS
SaveExploits0References4Affected Software2
Github Security Blog
Github Security Blog
added 2026/06/03 8:56 p.m.21 views

AIOHTTP is Vulnerable to Deserialization of Untrusted Data

Summary Using CookieJar.load with untrusted input may allow arbitrary code execution. Impact Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications. Workaround If an application does allow attacker controlled files to be...

7.3CVSS6.1AI score0.00137EPSS
SaveExploits0References4Affected Software1
Github Security Blog
Github Security Blog
added 2026/06/03 8:33 p.m.14 views

React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets

When using React Router v7's unstable RSC APIs, there exists a potential client-side XSS issue in the RSC redirect handling if redirects are coming from untrusted sources !NOTE This only impacts your application if you are using the unstable RSC APIs in React Router...

8CVSS5.8AI score0.00188EPSS
SaveExploits0References3Affected Software1
Github Security Blog
Github Security Blog
added 2026/06/03 8:33 p.m.18 views

React Router has stored XSS via unescaped Location header in prerendered redirect HTML

When using React Router v7 Framework Mode with Pre-rendering enabled, an improper neutralization of the HTTP Location header value can permit Cross-Site Scripting XSS in statically generated HTML files if the redirect location comes from an untrusted source. !NOTE This does not impact your React...

5.4CVSS5.8AI score0.00144EPSS
SaveExploits0References3Affected Software1
Github Security Blog
Github Security Blog
added 2026/06/03 8:25 p.m.19 views

backpack/crud is vulnerable to Cross-Site Scripting (XSS)

Impact It’s a “moderate” vulnerability… but being an admin panel, take this seriously. It’s difficult… but an attacker could conduct a targeted phishing campaign, in order to trick your users or admins to click a malicious link, which under very specific circumstances could give them information...

5.1CVSS5.7AI score0.00303EPSS
SaveExploits0References4Affected Software1
Github Security Blog
Github Security Blog
added 2026/06/03 8:2 p.m.18 views

Docling: Unsafe Zip Extraction in EasyOCR Model Download

Impact In versions 2.91.0, The EasyOCR model download functionality extracted ZIP archives without validating member paths, enabling Zip Slip attacks. If an attacker could compromise the model download source via supply chain attack, DNS spoofing, or MITM, they could write arbitrary files to any...

8.3CVSS6.3AI score0.00472EPSS
SaveExploits0References8Affected Software1
Github Security Blog
Github Security Blog
added 2026/06/03 6:33 p.m.9 views

Duplicate Advisory: jupyter-server is vulnerable to CORS origin validation bypass when the `allow_origin_pat` configuration is used

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-24qx-w28j-9m6p. This link is maintained to preserve external references. Original Description A vulnerability in jupyter-server versions 1.12.0 through 2.17.0 allows an attacker to bypass CORS origin validation...

8.8CVSS6.4AI score0.00197EPSS
SaveExploits1References6Affected Software1
Github Security Blog
Github Security Blog
added 2026/06/03 6:33 p.m.11 views

GoBGP: Integer underflow in the BGPUpdate.DecodeFromBytes function

An integer underflow in the BGPUpdate.DecodeFromBytes function /bgp/bgp.go of gobgp v4.3.0 allows attackers to cause a Denial of Service DoS via supplying a crafted BGP UPDATE message...

7.5CVSS6.1AI score0.00279EPSS
SaveExploits0References4Affected Software1
Github Security Blog
Github Security Blog
added 2026/06/03 6:2 p.m.28 views

launch-editor vulnerable to command injection via the crafted request on Windows

Summary Due to the insufficient sanitization of the file argument in the launchEditor, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters. Impact If the following conditions are met, an attacker can execute arbitrary commands on the...

8.3CVSS6AI score0.00514EPSS
SaveExploits0References5Affected Software2
Github Security Blog
Github Security Blog
added 2026/06/03 3:30 p.m.10 views

daphne: WebSocket handshake header smuggling through autobahn splitlines() mishandling of non-standard line separators

daphne before 4.2.2 reconstructs a raw HTTP request from Twisted's parsed headers and feeds it to autobahn for WebSocket handshake processing. Twisted does not treat \x0b, \x0c, \x1c, \x1d, \x1e, or \x85 as header line separators, but autobahn decodes header values to str and calls splitlines. An...

5.3CVSS6.1AI score0.00172EPSS
SaveExploits0References4Affected Software1
Github Security Blog
Github Security Blog
added 2026/06/03 3:30 p.m.6 views

Django fails to prevent reuse of a partially-initialized connection after a failed `STARTTLS` handshake

An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15. django.core.mail.backends.smtp.EmailBackend in Django fails to prevent reuse of a partially-initialized connection after a failed STARTTLS handshake when failsilently=True, which allows on-path network attackers to read ema...

3.1CVSS6AI score0.0015EPSS
SaveExploits0References6Affected Software1
Github Security Blog
Github Security Blog
added 2026/06/03 3:30 p.m.11 views

huggingface/transformers: Arbitrary Code Execution During Model Initialization in the LightGlue Model Loading Path

A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitrary code during model initialization. The issue arises because the trustremotecode parameter, intended to prevent remote code execution, is...

9.6CVSS7.4AI score0.00547EPSS
SaveExploits1References11Affected Software1
Github Security Blog
Github Security Blog
added 2026/06/03 3:30 p.m.9 views

daphne: Unauthenticated attackers can cause excessive memory consumption by sending arbitrarily large WebSocket messages/frames

daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory. Because Autobahn defaults both values to 0 unlimited, an unauthenticated remote attacker could send arbitrarily large WebSocket messages or frames, causing excessive memory...

7.5CVSS6.1AI score0.00328EPSS
SaveExploits0References4Affected Software1
Github Security Blog
Github Security Blog
added 2026/06/03 12:30 p.m.8 views

Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass

ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy Assessment: Fully addressed. When the serialised stream contains a TCPROXYCLASSDESC the marker for a java.lang.reflect.Proxy , JDK’s ObjectInputStream.readProxyDesc is dispatched. JDK then calls...

9.8CVSS6.1AI score0.005EPSS
SaveExploits0References3Affected Software1
Total number of security vulnerabilities34222