Complete feed
Recently updated
Advisories the vendor has revised
Android app · Google Play
Take your CVE monitoring with you.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Medium [CVE-2026-54530] Denial of Service via crafted PDF processing
pypdf is a free and open-source pure-python PDF library. Prior to 6.13.0, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires extracting the text in layout mode. This vulnerability is fixed in 6.13.0. This vulnerability results in a Denial of Service (DoS), making the affected system unresponsive. This Moderate impact flaw in pypdf affects Red Hat products that process untrusted PDF files and extract text in layout mode. An attacker could provide a specially crafted PDF, leading to an infinite loop and a Denial of Service. The vulnerability requires specific processing conditions, contributing to its Moderate severity. Affected method: extract_text(extraction_mode="layout") Red Hat severity: Moderate — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-835. Affected Red Hat products: Exploit Intelligence; OpenShift Lightspeed; Red Hat Ansible Automation Platform 2; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI); Red Hat Quay 3. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-47240] Net::IMAP: Command injection via non-synchronizing literals
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5 and 0.5.15, several Net::IMAP commands accept a "raw data" argument that is sent verbatim after validation to prevent command injection. However, if a server does not support non-synchronizing literals, it may still be possible to inject arbitrary IMAP commands inside non-synchronizing literals. A server without support for non-synchronizing literals may interpret the "+}\r\n" as the end of a malformed command line and respond with a tagged BAD. In that case, the contents of the literal will be interpreted as one or more new pipelined commands, allowing a CRLF command injection attack to succeed. This affects criteria for #search and #uid_search; search_keys for #sort, #thread, #uid_sort, and #uid_thread; and attr for #fetch and #uid_fetch. This vulnerability is fixed in 0.6.5 and 0.5.15. This command injection could enable unauthorized actions on the IMAP server. This Moderate flaw in the Net::IMAP Ruby library allows for command injection against IMAP servers that lack support for non-synchronizing literals. An attacker could exploit this by providing specially crafted input, leading to the execution of arbitrary IMAP commands and potential unauthorized actions.
Medium [CVE-2026-47241] Net::IMAP: Denial of Service via malformed command input
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5 and 0.5.15, several Net::IMAP commands accept a raw string argument which is only validated to prevent CRLF injection and then sent verbatim. If this string is derived from user-controlled input, an attacker can force the next command to be absorbed as a continuation of the first command. This will cause the first command to eventually fail, but also prevents it from returning until another command is sent (from another thread). That other command will not return until the connection is closed. This vulnerability is fixed in 0.6.5 and 0.5.15. This vulnerability allows a remote attacker to cause a denial of service by sending specially crafted input to certain Net::IMAP commands. A Moderate denial of service flaw was found in the Net::IMAP Ruby client library. This can prevent further processing of IMAP commands until the connection is manually closed, impacting the availability of services relying on the Net::IMAP client. Red Hat severity: Moderate — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-88. Affected Red Hat products: Red Hat Hardened Images. Red Hat lists Red Hat 3scale API Management Platform 2; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9 as not affected.
Medium [CVE-2026-54285] @opentelemetry/core: opentelemetry-js: @opentelemetry/core: Denial of Service via oversized baggage HTTP headers
opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 2.8.0, W3CBaggagePropagator.extract() in @opentelemetry/core does not enforce size limits when parsing inbound baggage HTTP headers. The W3C Baggage specification recommends a maximum of 8,192 bytes and 180 entries; these limits were only enforced on the outbound (inject()) path, not on the inbound (extract()) path. Parsing oversized baggage causes memory allocation proportional to the header size without any cap. This vulnerability is fixed in 2.8.0. This vulnerability allows a remote attacker to trigger uncontrolled memory allocation by sending oversized baggage HTTP headers. The system's inability to enforce size limits during inbound baggage parsing can lead to resource exhaustion, resulting in a Denial of Service (DoS). Red Hat products ship @opentelemetry/core as a transitive dependency in several components, but the vulnerable W3CBaggagePropagator.extract() code path has limited practical impact. Node.js enforces a default --max-http-header-size of 16,384 bytes, which caps the total size of all HTTP headers before they reach the propagator. The baggage header is already parsed and in memory by the HTTP layer; the additional allocation from the propagator is only the overhead of splitting into entry objects, not an unbounded read.
Medium [CVE-2026-54282] Information disclosure due to improper HTTP request path validation
Starlette is a lightweight ASGI framework/toolkit. Prior to 1.3.0, the HTTP request path is not validated before being used to reconstruct request.url. Because request.url is rebuilt by concatenating {scheme}://{host}{path} and re-parsing the result, a path that does not begin with / (for example @google.com) moves the authority boundary during re-parsing, so request.url.hostname and request.url.netloc become attacker-controlled. Code that reads request.url.hostname (rather than the Host header or scope) can therefore be misled into trusting an attacker-supplied host. This vulnerability is fixed in 1.3.0. A remote attacker could craft a malicious HTTP request path that does not begin with a forward slash, causing the framework to misinterpret the authority boundary. This could lead to `request.url.hostname` and `request.url.netloc` becoming attacker-controlled, potentially misleading applications that rely on these values into trusting an attacker-supplied host. Red Hat rates this issue as having Low impact for Red Hat AI products. Bundled Starlette versions in Red Hat OpenShift AI, Red Hat AI Inference Server, and Red Hat Enterprise Linux AI are either not vulnerable or the flawed path validation is not reachable in supported deployments. Red Hat severity: Low — CVSS 4.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). Weakness: CWE-1286.
Medium [CVE-2026-54273] Denial of Service via excessive pipelined requests
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, no limit was present on the number of pipelined requests that could be queued. An attacker may be able to use pipelined requests to use excessive amounts of memory, potentially leading to DoS. This vulnerability is fixed in 3.14.1. An attacker could exploit this vulnerability by sending an unlimited number of pipelined requests, causing the system to consume excessive amounts of memory. This could lead to a Denial of Service (DoS), making the affected system unavailable to legitimate users. This vulnerability is rated Moderate because an unauthenticated remote attacker can trigger denial of service against an affected aiohttp HTTP/1 server by sending a large number of pipelined requests, causing excessive memory consumption. Exploitation requires aiohttp to be deployed as an HTTP/1 server that accepts pipelined requests from untrusted clients. Many Red Hat products ship aiohttp as a bundled dependency for client libraries, internal automation, or services that do not expose this server behavior to untrusted users. In those configurations, practical risk may be lower, but affected packages should still be updated to aiohttp 3.14.1 or later when fixes are released. Red Hat severity: Moderate — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-770.
Medium [CVE-2026-54278] Denial of Service due to excessive memory consumption from compressed request body
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, during cleanup it is possible for a compressed request body to be decompressed into memory in one chunk. An attacker may be able to send a compressed payload in specific situations that could be decompressed into memory, potentially leading to DoS (a zip bomb edge case). This vulnerability is fixed in 3.14.1. This could potentially lead to a Denial of Service (DoS) condition, where the affected system becomes unresponsive or unavailable. Exploitation requires aiohttp deployed as a network-facing HTTP server that accepts compressed request bodies. Many Red Hat products ship aiohttp as a bundled dependency for client libraries, internal automation, or services that do not expose this server path to untrusted users. In those configurations, practical risk may be lower, but affected packages should still be updated to aiohttp 3.14.1 or later when fixes are released. Red Hat severity: Moderate — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-409. Affected products named by the advisory: Exploit Intelligence; Migration Toolkit for Applications 8; OpenShift Lightspeed; Red Hat AI Inference Server; and 6 more.
Medium [CVE-2026-54277] Denial of Service via oversized HTTP request lines bypassing max_line_size check
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, it is possible to bypass the max_line_size check in parts of an HTTP request in the C parser. If using the optimised C parser (the default in pre-built wheels), then an attacker may be able to send oversized lines through the HTTP parser and use an excessive amount of memory, potentially leading to DoS. This vulnerability is fixed in 3.14.1. A remote attacker can exploit this vulnerability by sending oversized lines within an HTTP request. This bypasses the max_line_size check in the C parser, causing the system to use an excessive amount of memory. This can lead to a Denial of Service (DoS) condition, making the affected system unavailable. Exploitation requires aiohttp to be deployed as a network-facing HTTP server using the optimised C parser (the default in pre-built wheels). Many Red Hat products ship aiohttp as a bundled dependency for client libraries, internal automation, or services that do not expose this server/parser path to untrusted users. In those configurations, practical risk may be lower, but affected packages should still be updated to aiohttp 3.14.1 or later when fixes are released. Red Hat severity: Moderate — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-131.
Medium [CVE-2026-54275] TLS SNI check bypass via connection reuse
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, the server_hostname TLS SNI check can be bypassed when an existing connection is reused. This vulnerability is fixed in 3.14.1. This vulnerability allows a remote attacker to bypass the Transport Layer Security (TLS) Server Name Indication (SNI) check. This occurs when an application reuses an existing connection for multiple requests to the same domain but with different server_hostname parameters. Consequently, later requests may succeed by reusing the existing connection, even if they should have been rejected due to the TLS SNI check, potentially leading to unintended information disclosure or integrity issues. Exploitation requires an application using aiohttp as an HTTPS client with connection pooling enabled, issuing multiple requests to the same host with differing server_hostname overrides. Many Red Hat products ship aiohttp as a bundled dependency without this usage pattern. Affected packages should still be updated to aiohttp 3.14.1 or later when fixes are released. Red Hat severity: Moderate — CVSS 4.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). Weakness: CWE-367. Affected products named by the advisory: Exploit Intelligence; Migration Toolkit for Applications 8; OpenShift Lightspeed; Red Hat AI Inference Server; and 6 more.
Medium [CVE-2026-54274] Denial of Service via incomplete websocket frame payloads
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if an attacker sends large incomplete websocket frame payloads, it may be possible to bypass the usual size limits on memory use. This vulnerability is fixed in 3.14.1. This can bypass normal memory usage limits, potentially leading to a Denial of Service (DoS) where the affected system becomes unavailable. Exploitation requires aiohttp deployed as a network-facing HTTP server that exposes WebSocket endpoints to untrusted clients. Many Red Hat products ship aiohttp as a bundled dependency for client libraries, internal automation, or services that do not expose WebSocket listeners to untrusted users. In those configurations, practical risk may be lower, but affected packages should still be updated to aiohttp 3.14.1 or later when fixes are released. Red Hat severity: Moderate — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-770. Affected Red Hat products: Exploit Intelligence; Migration Toolkit for Applications 8; OpenShift Lightspeed; Red Hat AI Inference Server; Red Hat Ansible Automation Platform 2; Red Hat Ansible Automation Platform Ansible Core 2; Red Hat Discovery 2; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI); Red Hat Satellite 6.
Medium [CVE-2026-54279] Host-Only Cookies Become Domain Cookies After CookieJar Persistence
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, host-only cookies that are saved with CookieJar.save() and then restored later with CookieJar.load() lose their host-only status. This vulnerability is fixed in 3.14.1. A flaw was found in aiohttp (before 3.14.1). aiohttp is vulnerable to improper cookie scope handling when persisting and reloading CookieJar data. After save/load, host-only cookies are treated as domain cookies, so session data meant for one host may be sent to subdomains on subsequent requests. Red Hat exposure is in Python asyncio services that bundle aiohttp and persist cookie jars to disk, including AI inference, AAP, and other hybrid platform Python containers. Red Hat severity: Low — CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N). Weakness: CWE-565. Red Hat lists Exploit Intelligence; Migration Toolkit for Applications 8; OpenShift Lightspeed; Red Hat AI Inference Server; Red Hat Ansible Automation Platform 2; Red Hat Ansible Automation Platform Ansible Core 2; Red Hat Discovery 2; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat Hardened Images; Red Hat OpenShift AI (RHOAI); Red Hat Satellite 6; Red Hat Update Infrastructure 4 for Cloud Providers as not affected.
Medium [CVE-2026-50269] CRLF injection in multipart headers
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request. This vulnerability is fixed in 3.14.0. This vulnerability, known as CRLF (Carriage Return Line Feed) injection, allows an attacker to modify HTTP requests by injecting malicious input into multipart or payload headers. If an application processes user-controlled data in these headers, an attacker could potentially alter the request's content or inject new headers, leading to unintended application behavior. This Low impact flaw in aiohttp arises from CRLF injection when applications pass untrusted, attacker-controlled input directly into `MultipartWriter.append(headers=...)` or `Payload.headers`. Exploitation is unlikely in typical Red Hat deployments unless custom applications are specifically configured to include unvalidated user input in these HTTP multipart or payload headers, potentially allowing an attacker to inject arbitrary HTTP headers.
Medium [CVE-2026-54269] Denial of Service due to name collision with runtime helpers
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 8.6.0 and 7.6.3, protobufjs accepted certain schema-derived names that could collide with properties used by protobufjs runtime helpers. The known affected names are fields named hasOwnProperty, field or oneof names such as $type when loaded through protobufjs JSON/reflection descriptors, and service methods whose generated helper name is rpcCall. When affected message or service types were used, protobufjs could read schema-controlled data where it expected an own-property helper, reflected type metadata, or the base RPC helper. This could cause deterministic exceptions or recursive calls in affected decode post-checks, verification, object conversion, reflected JSON serialization, or protobufjs RPC helper invocation. This vulnerability is fixed in 8.6.0 and 7.6.3. A remote attacker could exploit this vulnerability by providing specially crafted protobuf definitions or message types that contain names colliding with internal protobufjs runtime helpers. This could lead to deterministic exceptions or recursive calls during various operations, ultimately causing a Denial of Service (DoS) in applications using the library. Red Hat rates this issue as having Low impact for Red Hat Enterprise Linux AI bootc images.
Medium [CVE-2026-54270] Denial of Service due to excessive memory consumption
protobufjs compiles protobuf definitions into JavaScript (JS) functions. From 8.2.0 to 8.4.2, protobufjs preserved unknown wire elements in message.$unknowns and did not provide a decode-time option to discard unknown fields before retaining them. A crafted protobuf payload containing many unknown fields could therefore cause a decoded message to retain substantially more memory than the input size would suggest, even when unknown-field round-tripping is not needed. protobufjs 8.5.0 added the relevant decode-time options, allowing applications that decode untrusted protobuf data to disable unknown-field retention during decode. protobufjs 8.6.2 flips the default so unknown fields are discarded unless explicitly opted into. A flaw was found in protobufjs. A remote attacker could send a specially crafted protobuf payload containing numerous unknown fields. This could cause the decoded message to retain substantially more memory than expected, leading to excessive memory consumption and potentially a Denial of Service (DoS) for applications processing untrusted protobuf data. Red Hat rates this issue as having Low impact for Red Hat Enterprise Linux AI bootc images. Although protobufjs is present as a transitive dependency, the vulnerable parsing path is not exercised in normal product operation. Red Hat severity: Low — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
Medium [CVE-2026-55602] Unintended backend routing due to crafted Host header
http-proxy-middleware is node.js http-proxy middleware. As a result, a crafted Host header that is only a superstring match for a configured host+path key can still route a request to an unintended backend. This vulnerability is fixed in 2.0.10, 3.0.6, and 4.1.0. Unanchored substring matching on the attacker-controlled Host header can match a configured host+path key without an exact host match, sending the request to the wrong backend. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Weakness: CWE-346.
Medium [CVE-2026-53632] Credential compromise via NTLMv2 password hash leak through UNC path access
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the user’s NTLMv2 password hash to be leaked to an attacker-controlled SMB server. This can result in credential compromise through offline hash cracking. This vulnerability is fixed in 2.14.1. This component, used in Node.js to open files, can be tricked into accessing arbitrary paths, including Windows Universal Naming Convention (UNC) paths. Red Hat rates this issue as having Moderate impact for Red Hat OpenShift AI MLflow images on Windows client scenarios. Linux-based Red Hat Enterprise Linux AI bootc images are not affected because launch-editor UNC-path behavior is Windows-specific. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N). Weakness: CWE-73. Affected Red Hat products: Red Hat OpenShift AI (RHOAI).
Medium [CVE-2026-50171] @angular/common: Angular @angular/common: Denial of Service via malformed digitsInfo parameter
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, a Denial of Service (DoS) vulnerability exists in the @angular/common package of Angular. The formatNumber function, which is also utilized by DecimalPipe, PercentPipe, and CurrencyPipe, does not properly validate the upper bounds of the digitsInfo parameter. Specifically, the minimum and maximum fraction digits parsed from the digitsInfo string (e.g., 1.2-4) are converted to integers and used without limits. When parsing a maliciously crafted digitsInfo string with excessively large fraction digit values (e.g., 1.200000000-200000000), the internal roundNumber function attempts to pad the digits array to match the requested fraction size. This results in an unbounded loop that repeatedly pushes elements into an array. This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23. This leads to an unbounded loop, causing a Denial of Service (DoS) in the affected application. Exploitation requires the application to pass user-controlled input to the digitsInfo parameter, which is not the default Angular usage pattern. Red Hat severity: Moderate — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-835. Affected Red Hat products: Red Hat Fuse 7.
Medium [CVE-2026-50184] @angular/service-worker: @angular/service-worker: Security flaw leads to session leaks and cached private data
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue in the @angular/service-worker package compromises the integrity of request-policy enforcement during request reconstruction. When the Angular Service Worker intercepts network requests for matched assets, it reconstructs a new Request object using an internal helper function. During this reconstruction process, the helper function strips explicit client-defined safety parameters: the credentials configuration (such as credentials: 'omit') and the HTTP cache mode configuration (such as cache: 'no-store'). These are reverted back to standard browser-default parameters (credentials: 'same-origin' and default HTTP cache properties). This causes the browser to include active credentials (such as cookies or Authorization headers) on outbound requests where the client-side developer explicitly instructed they should be omitted, leading to potential session leaks. Additionally, it causes private or non-cacheable resources to be cached by the service worker's engine, making private page states accessible or persistent inside the client's local cache post-logout. This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.
Medium [CVE-2026-54264] @angular/service-worker: @angular/service-worker: Information Disclosure via unstripped sensitive headers on cross-origin redirects
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, an information disclosure vulnerability exists in the @angular/service-worker package of the Angular framework. When the Service Worker fetches assets, it preserves metadata (such as headers) from the original request. However, on cross-origin redirects, the Service Worker fails to strip sensitive headers, violating the Fetch redirect algorithm. This allows a remote attacker to obtain sensitive credentials (e.g., Authorization tokens, Proxy-Authorization credentials, or session cookies) by triggering a cross-origin redirect to an untrusted external origin. This vulnerability is fixed in 22.0.1, 21.2.17, and 20.3.25. This Moderate information disclosure flaw in the Angular Service Worker could allow a remote attacker to obtain sensitive credentials by exploiting improper handling of cross-origin redirects. However, Red Hat JBoss Fuse is not affected by this vulnerability as the vulnerable code is not present in the product. Red Hat severity: Moderate — CVSS 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Weakness: CWE-212.
Medium [CVE-2026-54268] @angular/common: Angular @angular/common: Denial of Service via crafted date format string
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, a Denial of Service (DoS) vulnerability exists in the @angular/common package of the Angular framework. The formatDate function, which is also utilized by the standard Angular DatePipe, does not properly limit or validate the length of the format parameter. When parsing a maliciously crafted, excessively long date format string (e.g., a repeating pattern or very large string), the internal parser splits the string iteratively using a regular expression loop. This results in uncontrolled resource consumption (high CPU utilization and excessive memory allocations), leading to a Denial of Service (DoS). This vulnerability is fixed in 22.0.1, 21.2.17, and 20.3.25. A remote attacker could exploit a Denial of Service (DoS) vulnerability in the `formatDate` function, which is also used by the Angular DatePipe, by providing an excessively long and maliciously crafted date format string. A flaw was found in Angular's @angular/common DatePipe. A crafted date format string can cause excessive CPU consumption, resulting in a denial of service. Red Hat Integration Service Registry includes @angular/common in its UI components and is affected by this vulnerability.