dbist fix CVEs reported by GitHub