CIRCL/vulnerability-scores huggingface dataset:
RHSA-2024:5673 Red Hat Security Advisory: kernel-rt security update
kernel: efivarfs: force RO when remounting if SetVariable is not supported kernel: bpf, sockmap: Don&#39;t let sock_map_{close,destroy,unhash} call itself kernel: igc: avoid returning frame twice in XDP_REDIRECT kernel: mm/hugetlb: fix missing hugetlb_lock for resv uncharge kernel: net: fix out-of-bounds access in ops_init kernel: net/mlx5e: Fix netif state handling kernel: net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() kernel: NFSv4: Fix memory leak in nfs4_set_security_label kernel: virtio-net: tap: mlx5_core short frame denial of service kernel: virtio-net: tun: mlx5_core short frame denial of service kernel: ice: Don't process extts if PTP is disabled
CVSS v3.1 score: 5.5
GHSA-cwfp-wwxr-hhq6 
The _WriteProlog function in texttops.c in texttops in the Text Filter subsystem in CUPS before 1.4.4 does not check the return values of certain calloc calls, which allows remote attackers to cause a denial of service (NULL pointer dereference or heap memory corruption) or possibly execute arbitrary code via a crafted file.
CVE-2020-16929 Microsoft Excel Remote Code Execution Vulnerability
<p>A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.</p>
<p>Exploitation of the vulnerability requires that a user open a specially crafted file with an affected version of Microsoft Excel. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) containing a specially crafted file designed to exploit the vulnerability. An attacker would have no way to force users to visit the website. Instead, an attacker would have to convince users to click a link, typically by way of an enticement in an email or instant message, and then convince them to open the specially crafted file.</p>
<p>The security update addresses the vulnerability by correcting how Microsoft Excel handles objects in memory.</p>
CVSS v3.1 score: 7.8
CVE-2022-29972 
An argument injection vulnerability in the browser-based authentication component of the Magnitude Simba Amazon Redshift ODBC Driver (1.4.14 through 1.4.21.1001 and 1.4.22 through 1.4.x before 1.4.52) may allow a local user to execute arbitrary code.
CVSS v3.1 score: 7.8
CVSS v2.0 score: 7.2
GHSA-77p4-xr3x-7jjc 
An issue was discovered in certain Apple products. macOS before 10.12.1 is affected. The issue involves the "NVIDIA Graphics Drivers" component. It allows attackers to cause a denial of service (memory corruption) via a crafted app.
CVSS v3.0 score: 5.5
GHSA-63x7-m3j2-hxwg 
An elevation of privilege vulnerability exists in the way that ws2ifsl.sys (Winsock) handles objects in memory, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1253, CVE-2019-1278, CVE-2019-1303.
CVSS v3.1 score: 7.8
CVE-2022-41146 
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18284.
CVSS v3.0 score: 3.3
GHSA-wrx7-mg98-47qj 
A missing authentication enforcement vulnerability exists in the mutual TLS (mTLS) implementation used by System REST APIs and SOAP services in multiple WSO2 products. Due to improper validation of client certificate–based authentication in certain default configurations, the affected components may permit unauthenticated requests even when mTLS is enabled. This condition occurs when relying on the default mTLS settings for System REST APIs or when the mTLS authenticator is enabled for SOAP services, causing these interfaces to accept requests without enforcing additional authentication.Successful exploitation allows a malicious actor with network access to the affected endpoints to gain administrative privileges and perform unauthorized operations. The vulnerability is exploitable only when the impacted mTLS flows are enabled and accessible in a given deployment. Other certificate-based authentication mechanisms such as Mutual TLS OAuth client authentication and X.509 login flows are not affected, and APIs served through the API Gateway of WSO2 API Manager remain unaffected.
CVSS v3.1 score: 9.8
GHSA-w8h4-vw8f-rvvj Improper Control of Dynamically-Managed Code Resources in config-shield
scripts/cli.js in the GoDaddy node-config-shield (aka Config Shield) package before 0.2.2 for Node.js calls eval when processing a set command. **NOTE:** the vendor reportedly states that this is not a vulnerability. The set command was not intended for use with untrusted data.
CVSS v3.1 score: 5.3
CVE-2023-44995 WordPress WooCommerce Login Redirect Plugin <= 2.2.4 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in WP Doctor WooCommerce Login Redirect plugin <= 2.2.4 versions.
CVSS v3.1 score: 5.4
GHSA-jg26-f6px-55jp 
IBM Quality Manager (RQM) 5.0.x and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 124356.
CVSS v3.0 score: 5.4
CVE-2023-4272 Mali GPU Kernel Driver exposes sensitive data from freed memory
A local non-privileged user can make GPU processing operations that expose sensitive data from previously freed memory. 


CVSS v3.1 score: 5.5
GHSA-v7h7-9h84-r622 
Rejected reason: CVE ID was once reserved, but never used.
GHSA-8ffx-hxvj-6frg 
index.php in the File Manager module in Flatnuke 3 allows remote attackers to obtain sensitive information via an invalid argumentname parameter in a disc op action, which reveals the path in an error message.
GHSA-6c4r-x5cw-qvjp 
A remote reflected cross-site scripting (XSS) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in the guest portal interface of ClearPass could allow a remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the portal. A successful exploit could allow an attacker to execute arbitrary script code in a victim’s browser in the context of the guest portal interface.
GHSA-chrg-f3r7-pjcq 
An issue was discovered in libsixel 1.8.4. There is a heap-based buffer overflow in the function gif_init_frame at fromgif.c.
CVSS v3.1 score: 8.8
CVE-2014-4154 
ZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the PPPoE/PPPoA password via a direct request for basic/tc2wanfun.js.
CVSS v2.0 score: 5
GHSA-wj2m-jvpr-64cq 
A prompt injection vulnerability in Windsurf 1.9544.26 allows remote attackers to execute arbitrary commands on a victim system. When Windsurf processes attacker-controlled HTML content, malicious instructions can cause unauthorized modification of the local MCP configuration and automatic registration of a malicious MCP STDIO server, resulting in execution of arbitrary commands without further user interaction. Successful exploitation may allow attackers to execute commands on behalf of the user, persist malicious MCP configuration changes, and access sensitive information exposed through the application.
CVSS v3.1 score: 8
ICSA-22-167-02 AutomationDirect DirectLOGIC with Serial Communication
The product is vulnerable to a specifically crafted serial message to the CPU serial port that will cause the PLC to respond with the PLC password in cleartext. This could allow an attacker to access and make unauthorized changes.CVE-2022-2003 has been assigned to this vulnerability. A CVSS v3 base score of 7.7 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
CVSS v3.0 score: 7.7
CVE-2023-1396 SourceCodester Online Tours & Travels Management System traveller_details.php cross site scripting
A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file admin/traveller_details.php. The manipulation of the argument address leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-222983.
CVSS v3.1 score: 3.5
CVSS v3.0 score: 3.5
CVSS v2.0 score: 4
GHSA-w39f-4cm2-25x2 
A crafted NTFS image can trigger an out-of-bounds read, caused by an invalid attribute in ntfs_attr_find_in_attrdef, in NTFS-3G < 2021.8.22.
CVSS v3.1 score: 7.8
CVE-2022-46120 
Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/admin/?page=products/view_product&id=.
CVSS v3.1 score: 7.2
CVE-2025-47293 PowSyBl Core XML Reader allows XXE and SSRF
PowSyBl (Power System Blocks) is a framework to build power system oriented software. Prior to version 6.7.2, in certain places, powsybl-core XML parsing is vulnerable to an XML external entity (XXE) attack and to a server-side request forgery (SSRF) attack. This allows an attacker to elevate their privileges to read files that they do not have permissions to, including sensitive files on the system. The vulnerable class is com.powsybl.commons.xml.XmlReader which is considered to be untrusted in use cases where untrusted users can submit their XML to the vulnerable methods. This can be a multi-tenant application that hosts many different users perhaps with different privilege levels. This issue has been patched in com.powsybl:powsybl-commons: 6.7.2.
CVSS v4.0 score: 2.7
GHSA-369v-xrvc-8m87 
PHP Scripts Mall Naukri Clone Script 3.0.3 has Stored XSS via every profile input field.
CVSS v3.0 score: 5.4
GHSA-6p3w-w4qc-hv3r 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in salesup2019 Formulario de contacto SalesUp! allows Reflected XSS. This issue affects Formulario de contacto SalesUp!: from n/a through 1.0.14.
CVSS v3.1 score: 7.1
GHSA-49pj-869r-v4q9 
A vulnerability was detected in code-projects Simple Laundry System 1.0. This vulnerability affects unknown code of the file /delmemberinfo.php. Performing a manipulation of the argument userid results in cross site scripting. The attack can be initiated remotely. The exploit is now public and may be used.
CVSS v4.0 score: 2.1
CVSS v3.1 score: 4.3
GHSA-6ww3-pvc7-5crf 
A security vulnerability has been detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. Affected is the function CWebSessionManager_ParseSession of the file /user/bin/Kylin of the component Kylin Web Service. Such manipulation of the argument SESSION leads to insufficient entropy. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is told to be difficult.
CVSS v4.0 score: 2.9
CVSS v3.1 score: 3.7
GHSA-mgc9-7rgj-3h62 
An out of bounds read in PDFium in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file.
CVSS v3.0 score: 8.8
GHSA-p8x3-xpch-p28r 
A NULL pointer dereference was found in the Linux kernel's KVM when dirty ring logging is enabled without an active vCPU context. An unprivileged local attacker on the host may use this flaw to cause a kernel oops condition and thus a denial of service by issuing a KVM_XEN_HVM_SET_ATTR ioctl. This flaw affects Linux kernel versions prior to 5.17-rc1.
CVSS v3.1 score: 5.5
CVE-2026-11666 
Insufficient validation of untrusted input in Input in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: High)
CVSS v3.1 score: 5.4
GHSA-j6g5-fc52-96jw 
IBM Security Guardium Data Encryption (GDE) 3.0.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 171825.
CVE-2026-19367 NocteDefensor LudusMCP read_range_config rangeConfig.ts server-side request forgery
A vulnerability has been found in NocteDefensor LudusMCP 1.0.24. Affected by this vulnerability is an unknown functionality of the file src/tools/rangeConfig.ts of the component read_range_config. The manipulation of the argument Source leads to server-side request forgery. The attack may be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 6.3
CVSS v3.0 score: 6.3
CVSS v2.0 score: 6.5
PYSEC-2018-100 
base/oi/doa.py in the Rope library in CPython (aka Python) allows remote attackers to execute arbitrary code by leveraging an unsafe call to pickle.load.
CVE-2006-0806 
Multiple cross-site scripting (XSS) vulnerabilities in ADOdb 4.71, as used in multiple packages such as phpESP, allow remote attackers to inject arbitrary web script or HTML via (1) the next_page parameter in adodb-pager.inc.php and (2) other unspecified vectors related to PHP_SELF.
CVSS v2.0 score: 4.3
GHSA-6v6g-j5fq-hpvw Local file inclusion in gradio
A local file inclusion vulnerability exists in the JSON component of gradio-app/gradio and was discovered in version 4.25. The vulnerability arises from improper input validation in the `postprocess()` function within `gradio/components/json_component.py`, where a user-controlled string is parsed as JSON. If the parsed JSON object contains a `path` key, the specified file is moved to a temporary directory, making it possible to retrieve it later via the `/file=..` endpoint. This issue is due to the `processing_utils.move_files_to_cache()` function traversing any object passed to it, looking for a dictionary with a `path` key, and then copying the specified file to a temporary directory. The vulnerability can be exploited by an attacker to read files on the remote system, posing a significant security risk.
CVSS v3.0 score: 7.5
GHSA-rj85-c5h6-pfrr 
An Improper Handling of Syntactically Invalid Structure vulnerability in Object Flooding Protocol (OFP) service of Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS).On all Junos OS Evolved platforms, when specific TCP packets are received on an open OFP port, the OFP crashes leading to a restart of Routine Engine (RE). Continuous receipt of these specific TCP packets will lead to a sustained Denial of Service (DoS) condition.This issue affects:Juniper Networks Junos OS EvolvedAll versions earlier than 21.2R3-S7-EVO;21.3 versions earlier than 21.3R3-S5-EVO ;21.4 versions earlier than 21.4R3-S5-EVO;22.1 versions earlier than 22.1R3-S4-EVO;22.2 versions earlier than 22.2R3-S3-EVO ;22.3 versions earlier than 22.3R3-EVO;22.4 versions earlier than 22.4R2-EVO, 22.4R3-EVO.
CVSS v3.1 score: 7.5
GHSA-r66h-x2x7-fv39 
Logitech iTouch keyboards allows attackers with physical access to the system to bypass the screen locking function and execute user-defined commands that have been assigned to a button.
CVE-2014-7307 
The ForoSocuellamos (aka com.forosocuellamos.tlcttbeukajwpeqreg) application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0 score: 5.4
GHSA-9hcj-h2qc-689p OpenStack Cinder file disclosure in image convert
OpenStack Cinder before 2014.1.5 (icehouse), 2014.2.x before 2014.2.4 (juno), and 2015.1.x before 2015.1.1 (kilo) allows remote authenticated users to read arbitrary files via a crafted qcow2 signature in an image to the upload-to-image command.
CVE-2025-66219 willitmerge has a command Injection vulnerability
willitmerge is a command line tool to check if pull requests are mergeable. In versions 0.2.1 and prior, there is a command Injection vulnerability in willitmerge. The vulnerability manifests in this package due to the use of insecure child process execution API (exec) to which it concatenates user input, whether provided to the command-line flag, or is in user control in the target repository. At time of publication, no known fix is public.
CVSS v4.0 score: 6.9
CVE-2019-13135 
ImageMagick before 7.0.8-50 has a "use of uninitialized value" vulnerability in the function ReadCUTImage in coders/cut.c.
CVSS v3.1 score: 8.8
CVSS v2.0 score: 6.8
cisco-sa-lldp-memlk-McOecPT Cisco Webex Room Phone and Cisco Webex Share Link Layer Discovery Protocol Memory Leak Vulnerability
A vulnerability in the Link Layer Discovery Protocol (LLDP) feature of Cisco Webex Room Phone and Cisco Webex Share devices could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device.

This vulnerability is due to insufficient resource allocation. An attacker could exploit this vulnerability by sending crafted LLDP traffic to an affected device. A successful exploit could allow the attacker to exhaust the memory resources of the affected device, resulting in a crash of the LLDP process. If the affected device is configured to support LLDP only, this could cause an interruption to inbound and outbound calling. By default, these devices are configured to support both Cisco Discovery Protocol and LLDP. To recover operational state, the affected device needs a manual restart.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.


CVSS v3.1 score: 6.5
GHSA-x38j-838v-5wq3 
An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory.To exploit this vulnerability, an authenticated attacker could run a specially crafted application, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0621, CVE-2019-0661.
CVSS v3.0 score: 5.5
GHSA-cp7x-wvvh-9jrh 
Buffer Overflow vulnerability in Tenda AX1803 v.1.0.0.1 allows a remote attacker to execute arbitrary code via the wpapsk_crypto parameter in the function fromSetWirelessRepeat.
CVSS v3.1 score: 9.8
CVE-2023-22339 
Improper access control vulnerability in CONPROSYS HMI System (CHS) Ver.3.4.5 and earlier allows a remote unauthenticated attacker to bypass access restriction and obtain the server certificate including the private key of the product.
CVSS v3.1 score: 7.5
GHSA-jfxc-v5g9-38xr PraisonAI Vulnerable to Arbitrary File Write / Path Traversal in Action Orchestrator
The Action Orchestrator feature contains a Path Traversal vulnerability that allows an attacker (or compromised agent) to write to arbitrary files outside of the configured workspace directory. By supplying relative path segments (`../`) in the target path, malicious actions can overwrite sensitive system files or drop executable payloads on the host.DetailsLocation: `src/praisonai/praisonai/cli/features/action_orchestrator.py` (Lines 402, 409, 423)Vulnerable Code snippet:In the `_apply_step` method, paths are constructed by concatenating the `workspace` path with a user-supplied `step.target` string: `target = workspace / step.target`. The code fails to resolve and validate that the final absolute path remains within the bounds of the `workspace` directory. When processing `FILE_CREATE` or `FILE_EDIT` actions, this flaw permits arbitrary file modification.PoCConstruct a malicious `ActionStep` payload with path traversal characters:ImpactThis is an Arbitrary File Write vulnerability. Anyone running the Action Orchestrator to apply modifications is vulnerable. A malicious prompt could trick the agent into generating a plan that overwrites critical files (e.g., `~/.ssh/authorized_keys`, `.bashrc`) leading to Remote Code Execution (RCE) or system corruption.
CVSS v3.1 score: 9
CVE-2026-41505 RELATE: Predictable Token Generation in auth.py and exam.py
RELATE is a web-based courseware package. Prior to commit 2f68e16, RELATE is vulnerable to predictable token generation in auth.py's make_sign_in_key() function and exam.py's gen_ticket_code() function. This issue has been patched via commit 2f68e16.
CVSS v3.1 score: 8.7
CVE-2008-3218 
Multiple cross-site scripting (XSS) vulnerabilities in Drupal 6.x before 6.3 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) free tagging taxonomy terms, which are not properly handled on node preview pages, and (2) unspecified OpenID values.
CVSS v2.0 score: 4.3
CVE-2025-55454 
An authenticated arbitrary file upload vulnerability in the component /msg/sendfiles of DooTask v1.0.51 allows attackers to execute arbitrary code via uploading a crafted file.
CVSS v3.1 score: 8.8
CVE-2026-33803 Junos OS Evolved: A port which has been inadvertently exposed can be reached by an attacker
An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause a limited information disclosure and availability impact to the device.


Due to a wrong initialization, a process which should only be able to communicate internally within the device can be reached over the network via an open port. This leads to a device being inadvertently exposed and increased CPU cycles spent processing ingress packets.

This issue affects Junos OS Evolved:


  *  all versions before 23.2R2-S7-EVO,
  *  23.4 versions before 23.4R2-S8-EVO,
  *  24.2 versions before 24.2R2-S5-EVO,
  *  24.4 versions before 24.4R2-S4-EVO,
  *  25.2 versions before 25.2R2-S1-EVO,
  *  25.4 versions before 25.4R1-S2-EVO.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 6.5
GHSA-2chj-3cfx-vf64 
The _bfd_vms_slurp_egsd function in bfd/vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an arbitrary memory read via a crafted vms alpha file.
CVSS v3.0 score: 7.8
GHSA-wxc9-385j-fmh8 
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
CVSS v3.1 score: 7
CVE-2021-27312 
Server Side Request Forgery (SSRF) vulnerability in Gleez Cms 1.2.0, allows remote attackers to execute arbitrary code and obtain sensitive information via modules/gleez/classes/request.php.
CVSS v3.1 score: 9.4
CVE-2024-44172 
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. An app may be able to access contacts.
CVSS v3.1 score: 3.3
GHSA-fxqv-9rmw-4376 
Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 allow remote attackers to bypass intended restrictions on filesystem write operations via unspecified vectors, a different vulnerability than CVE-2015-3082 and CVE-2015-3085.
CVE-2025-23904 WordPress Rebrand Fluent Forms Plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rebrandpress Rebrand Fluent Forms rebrand-fluent-forms allows Reflected XSS.This issue affects Rebrand Fluent Forms: from n/a through <= 1.0.
CVSS v3.1 score: 7.1
RHSA-2022:5069 Red Hat Security Advisory: OpenShift Container Platform 4.11.0 bug fix and security update
nanoid: Information disclosure via valueOf() function sanitize-url: XSS due to improper sanitization in sanitizeUrl function opencontainers: OCI manifest and index parsing confusion golang.org/x/crypto: empty plaintext packet causes panic minimist: prototype pollution node-fetch: exposure of sensitive information to an unauthorized actor prometheus/client_golang: Denial of service using InstrumentHandlerCounter go-getter: command injection vulnerability golang: crash in a golang.org/x/crypto/ssh server go-getter: writes SSH credentials into logfile, exposing sensitive credentials to local uses go-getter: unsafe download (issue 1 of 3) go-getter: unsafe download (issue 2 of 3) go-getter: unsafe download (issue 3 of 3)
CVSS v3.1 score: 8.6
CVE-2026-40409 Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability
Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability
CVSS v3.1 score: 7.8
CVE-2011-4496 
Buffer overflow in Aviosoft DTV Player 1.0.1.2 allows remote attackers to execute arbitrary code via a crafted .plf (aka playlist) file.
CVSS v2.0 score: 9.3
GHSA-7745-326p-vhm6 
The Easy Digital Downloads WordPress Plugin, version < 3.1.0.4, is affected by an unauthenticated SQL injection vulnerability in the 's' parameter of its 'edd_download_search' action.
CVSS v3.1 score: 9.8
CVE-2024-4701 Path Traversal vulnerability via File Uploads in Genie
A path traversal issue potentially leading to remote code execution in Genie for all versions prior to 4.3.18
CVSS v3.1 score: 9.9
CVE-2018-4168 
An issue was discovered in certain Apple products. iOS before 11.3 is affected. The issue involves the "Files Widget" component. It allows physically proximate attackers to obtain sensitive information by leveraging the display of cached data on a locked device.
CVSS v3.0 score: 4.6
CVSS v2.0 score: 2.1
GHSA-2349-9g3v-jxmj 
A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52 and earlier.
CVSS v3.1 score: 7.5
CVE-2024-0804 
Insufficient policy enforcement in iOS Security UI in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVSS v3.1 score: 7.5
CVE-2017-13275 
In getVSCoverage of CmapCoverage.cpp, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional privileges needed. User interaction is needed for exploitation. Product: Android. Versions: 8.0, 8.1. Android ID: A-70808908.
CVSS v3.0 score: 5.5
CVSS v2.0 score: 1.9
CVE-2017-17412 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of GET method requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute arbitrary code in the context of the underlying database. Was ZDI-CAN-4223.
CVSS v3.0 score: 9.8
CVSS v2.0 score: 7.5
GHSA-6v27-62rg-jwq2 
A vulnerability has been found in 1000 Projects Beauty Parlour Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/about-us.php. The manipulation of the argument pagetitle leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 9.8
CVE-2023-50027 
SQL Injection vulnerability in Buy Addons baproductzoommagnifier module for PrestaShop versions 1.0.16 and before, allows remote attackers to escalate privileges and gain sensitive information via BaproductzoommagnifierZoomModuleFrontController::run() method.
CVSS v3.1 score: 9.8
RHSA-2018:2737 Red Hat Security Advisory: mod_perl security update
mod_perl: arbitrary Perl code execution in the context of the user account via a user-owned .htaccess
CVSS v3.0 score: 6.3
GHSA-g4h2-4wvh-grc5 Uncontrolled Resource Consumption in simple_asn1
An issue was discovered in the simple_asn1 crate 0.6.0 before 0.6.1 for Rust. There is a panic if UTCTime data, supplied by a remote attacker, has a second character greater than 0x7f.
CVSS v3.1 score: 7.5
GHSA-8m4g-h664-74qj 
The Ubuntu One Client for Ubuntu 10.04 LTS, 11.04, 11.10, and 12.04 LTS does not properly validate SSL certificates, which allows remote attackers to spoof a server and modify or read sensitive information via a man-in-the-middle (MITM) attack.
GHSA-hg9c-gvjm-p267 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PineWise WP Google Analytics Events allows Reflected XSS.This issue affects WP Google Analytics Events: from n/a through 2.8.0.
CVSS v3.1 score: 7.1
CVE-2007-1172 
SQL injection vulnerability in nukesentinel.php in NukeSentinel 2.5.05, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the Client-IP HTTP header, aka the "File Disclosure Exploit."
CVSS v2.0 score: 6.4
CVE-2024-57678 
An access control issue in the component form2WlAc.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the 2.4G and 5G mac access control list of the device via a crafted POST request.
CVSS v3.1 score: 6.5
ICSA-21-159-09 Siemens Solid Edge
The ugeom2d.dll library lacks proper validation of user-supplied data when parsing DFT files. This could result in an out of bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-12993) The jutil.dll library lacks proper validation of user-supplied data when parsing DFT files. This could result in an out of bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-12994)
CVSS v3.1 score: 7.8
GHSA-5jc6-h9w7-jm3p Mobile Security Framework (MobSF) Stored Cross-Site Scripting Vulnerability in "Diff or Compare" Functionality
SummaryThe application allows users to upload files with scripts in the filename parameter. As a result, a malicious user can upload a script file to the system. When users in the application use the "Diff or Compare" functionality, they are affected by a Stored Cross-Site Scripting vulnerability.DetailsI found a Stored Cross-Site Scripting vulnerability in the "Diff or Compare" functionality. This issue occurs because the upload functionality allows users to upload files with special characters such as <, >, /, and " in the filename. This vulnerability can be mitigated by restricting file uploads to filenames containing only whitelisted characters, such as A-Z, 0-9, and specific special characters permitted by business requirements, like - or _ .PoC_Complete instructions, including specific configuration details, to reproduce the vulnerability._On MobSF version 4.2.8, I clicked on "Unload & Analyze" button.
![0](https://github.com/user-attachments/assets/489013fe-cf21-4839-bd39-35eebad01a3a)I uploaded zip file as a name `test.zip`.
![1](https://github.com/user-attachments/assets/c26a18ec-c276-43d5-97df-fb189b8d5a6a)I used an intercepting proxy tool while uploading a file and changed the value of the filename parameter from `test.zip` to `<image src onerror=prompt(document.domain)>test.zip`. This means I uploaded a file and set its name to a script value. As a result, the server allowed the file to be uploaded successfully.
![2](https://github.com/user-attachments/assets/90e275a2-58a4-4c0d-9b6a-399ec071cdf2)I accessed /recent_scans/ and found a file named `<image src onerror=prompt(document.domain)>test.zip` in the recent scans. Then, I clicked on the "Differ or Compare" button."
![3](https://github.com/user-attachments/assets/0997a437-5841-49c1-ae94-e0e76173bdb6)I found that the application requires selecting a file to compare, and I selected the file `<image src onerror=prompt(document.domain)>test.zip`
![4](https://github.com/user-attachments/assets/a156f058-732f-4763-8753-b0cef4075d53)I found that the JavaScript in the filename value was executed in the web browser.
![5](https://github.com/user-attachments/assets/b0a9bcbf-af70-4ec6-a22d-6224dfc55639)ImpactAllowing a malicious user to upload a script in the filename parameter can be used to steal information from other users or administrators when they perform the compare functionality. The script will be stored in the system permanently in this vulnerability.
CVSS v4.0 score: 6.2
CVSS v3.1 score: 6.1
CVE-2021-39738 
In CarSetings, there is a possible to pair BT device bypassing user's consent due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-216190509
CVSS v3.1 score: 7.8
CVSS v2.0 score: 7.2
CVE-2020-7377 Rapid7 Metasploit Framework Relative Path Traversal in telpho10_credential_dump module
The Metasploit Framework module "auxiliary/admin/http/telpho10_credential_dump" module is affected by a relative path traversal vulnerability in the untar method which can be exploited to write arbitrary files to arbitrary locations on the host file system when the module is run on a malicious HTTP server.
CVSS v3.1 score: 8.1
CVE-2024-6466 
NEC Corporation's WebSAM DeploymentManager v6.0 to v6.80 allows an attacker to reset configurations or restart products via network with X-FRAME-OPTIONS is not specified.
CVSS v3.1 score: 5.3
GHSA-xhfc-wp5r-c2r5 
An insecure storage of sensitive information vulnerability is present in Hickory Smart for Android mobile devices from Belwith Products, LLC. The application's database was found to contain information that could be used to control the lock devices remotely. This issue affects Hickory Smart for Android, version 01.01.43 and prior versions.
CVE-2022-39017 XSS in all comments fields in M-Files Hubshare



Improper input validation and output encoding in all comments fields, in M-Files Hubshare before 3.3.10.9 allows authenticated attackers to introduce cross-site scripting attacks via specially crafted comments.


CVSS v3.1 score: 8.2
ICSA-24-303-01 Siemens InterMesh Subscriber Devices
The web server of affected devices does not sanitize the input parameters in specific GET requests that allow for code execution on operating system level. In combination with other vulnerabilities (CVE-2024-47902, CVE-2024-47903, CVE-2024-47904) this could allow an unauthenticated remote attacker to execute arbitrary code with root privileges. The web server of affected devices does not authenticate GET requests that execute specific commands (such as `ping`) on operating system level. The web server of affected devices allows to write arbitrary files to the web server's DocumentRoot directory. The affected devices contain a SUID binary that could allow an authenticated local attacker to execute arbitrary commands with root privileges.
CVSS v3.1 score: 7.8
GHSA-828p-92r7-xw6x 
SugarCRM before 13.0.4 and 14.x before 14.0.1 allows SSRF in the API module because a limited type of code injection can occur.
CVSS v3.1 score: 7.2
RHSA-2020:5369 Red Hat Security Advisory: microcode_ctl security, bug fix and enhancement update
hw: Information disclosure issue in Intel SGX via RAPL interface hw: Vector Register Leakage-Active hw: Fast forward store predictor
CVSS v3.1 score: 5.5
GHSA-gjxp-f524-fgrv 
Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; and Java SE Embedded 8u101 allows remote attackers to affect integrity via vectors related to Libraries.
CVSS v3.0 score: 3.1
GHSA-7c77-5hjp-3754 
In the Linux kernel, the following vulnerability has been resolved:batman-adv: v: stop OGMv2 on disabled interfaceWhen a batadv_hard_iface is disabled, its mesh_iface pointer is set to
NULL. However, batadv_v_ogm_send_meshif() may still dispatch OGMs via
batadv_v_ogm_queue_on_if() for interfaces that have since lost their
mesh_iface association. This results in a NULL pointer dereference when
batadv_v_ogm_queue_on_if() unconditionally calls netdev_priv() on the
now NULL hard_iface->mesh_iface to retrieve the batadv_priv.It is necessary to ensure that the batadv_v_ogm_queue_on_if() checks that
it is using the same mesh_iface for which batadv_v_ogm_send_meshif() was
called.
CVSS v3.1 score: 5.5
GHSA-p87c-hmgx-wg42 
URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino.This issue affects Apache Gravitino: from 1.0.0 before 1.2.1.Users are recommended to upgrade to version 1.2.1, which fixes the issue.
CVSS v3.1 score: 9.1
GHSA-h949-qrpv-p29v 
In klibc 1.5.20 and 1.5.21, the DHCP options written by ipconfig to /tmp/net-$DEVICE.conf are not properly escaped. This may allow a remote attacker to send a specially crafted DHCP reply which could execute arbitrary code with the privileges of any process which sources DHCP options.
CVSS v3.1 score: 9.8
CVE-2019-2525 
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and prior to 6.0.2. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 5.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N).
CVSS v3.0 score: 5.6
CVSS v2.0 score: 1.9
CVE-2026-22499 WordPress Lella theme <= 1.2 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Lella lella allows PHP Local File Inclusion.This issue affects Lella: from n/a through <= 1.2.
CVSS v3.1 score: 8.1
CVE-2025-40272 mm/secretmem: fix use-after-free race in fault handler
In the Linux kernel, the following vulnerability has been resolved:

mm/secretmem: fix use-after-free race in fault handler

When a page fault occurs in a secret memory file created with
`memfd_secret(2)`, the kernel will allocate a new folio for it, mark the
underlying page as not-present in the direct map, and add it to the file
mapping.

If two tasks cause a fault in the same page concurrently, both could end
up allocating a folio and removing the page from the direct map, but only
one would succeed in adding the folio to the file mapping.  The task that
failed undoes the effects of its attempt by (a) freeing the folio again
and (b) putting the page back into the direct map.  However, by doing
these two operations in this order, the page becomes available to the
allocator again before it is placed back in the direct mapping.

If another task attempts to allocate the page between (a) and (b), and the
kernel tries to access it via the direct map, it would result in a
supervisor not-present page fault.

Fix the ordering to restore the direct map before the folio is freed.
CVSS v3.1 score: 7.8
CVE-2024-9072 GDPR-Extensions-com – Consent Manager <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
The GDPR-Extensions-com – Consent Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS v3.1 score: 6.4
CVE-2026-34170 Coolify: Server-Side Request Forgery via attacker-controlled GitHub App API URL
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the GithubApp api_url field is used as the base URL for server-side HTTP requests without allowlisting or private IP blocking, allowing an authenticated user to configure a GitHub App source that causes Coolify to request internal services or cloud metadata endpoints. This issue is reported as fixed in version 4.0.0-beta.471.
CVSS v3.1 score: 4.3
CVE-2022-31772 IBM MQ denial of service

IBM MQ 8.0, 9.0 LTS, 9.1 CD, 9.1 LTS, 9.2 CD, and 9.2 LTS could allow an authenticated and authorized user to cause a denial of service to the MQTT channels. IBM X-Force ID: 228335.


CVSS v3.1 score: 5.3
CVE-2021-21425 Unauthenticated Arbitrary YAML Write/Update leads to Code Execution
Grav Admin Plugin is an HTML user interface that provides a way to configure Grav and create and modify pages. In versions 1.10.7 and earlier, an unauthenticated user can execute some methods of administrator controller without needing any credentials. Particular method execution will result in arbitrary YAML file creation or content change of existing YAML files on the system. Successfully exploitation of that vulnerability results in configuration changes, such as general site information change, custom scheduler job definition, etc. Due to the nature of the vulnerability, an adversary can change some part of the webpage, or hijack an administrator account, or execute operating system command under the context of the web-server user. This vulnerability is fixed in version 1.10.8. Blocking access to the `/admin` path from untrusted sources can be applied as a workaround.
CVSS v3.1 score: 9.3
RHSA-2026:5578 Red Hat Security Advisory: virt:rhel and virt-devel:rhel security update
qemu-kvm: VNC WebSocket handshake use-after-free
CVSS v3.1 score: 7.5
CVE-2016-9711 
IBM Predictive Solutions Foundation (IBM Cognos Analytics 11.0) reveals sensitive information in detailed error messages that could aid an attacker in further attacks against the system. IBM X-Force ID: 119619.
CVSS v3.0 score: 5.3
CVE-2005-0325 
Xpand Rally 1.0.0.0 allows remote attackers or remote malicious game servers to cause a denial of service (application crash) via a packet with large values that are not properly handled in certain malloc or memcpy operations.
CVSS v2.0 score: 5
ICSA-23-187-01 PiiGAB M-Bus
PiiGAB M-Bus does not correctly sanitize user input, which could allow an attacker to inject arbitrary commands. The number of login attempts is not limited.  This could allow an attacker to perform a brute force  on HTTP basic authentication. PiiGAB M-Bus transmits credentials  in  plaintext format. PiiGAB M-Bus contains hard-coded credentials, which it uses for authentication. PiiGAB M-Bus stores credentials in a plaintext file, which could allow a low-level user to gain admin credentials. The affected product does not validate identification strings before processing, which could make it vulnerable to cross-site scripting attacks. There are no requirements for setting a complex password, which could contribute to a successful brute force attack if the password is inline with recommended password guidelines. PiiGAB M-Bus stores passwords using a weak hash algorithm. PiiGAB M-Bus is vulnerable to cross-site request forgery. An attacker who wants to execute a certain command could send a phishing mail to the owner of the device and hope that the owner clicks on the link. If the owner of the device has a cookie stored that allows the owner to be logged in, then the device could execute the GET or POST link request.
CVSS v3.0 score: 8.8
GHSA-4gr2-3x37-2h92 
Unspecified vulnerability in the EnterpriseOne Tools component in Oracle JD Edwards 8.98 SP 24 allows remote authenticated users to affect integrity, related to Enterprise Infrastructure SEC (JDENET).
GHSA-329m-37p4-j9m8 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Chris Coyier CodePen Embedded Pens Shortcode allows Stored XSS.This issue affects CodePen Embedded Pens Shortcode: from n/a through 1.0.2.
CVSS v3.1 score: 6.5
GHSA-xgfc-f3gp-3mp4 
SQL injection vulnerability in plugins/users/index.php in Galatolo WebManager 1.3a and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
GHSA-q6qm-26ch-2w94 
In the Linux kernel, the following vulnerability has been resolved:wifi: nl80211: reject oversized EMA RNR listsnl80211_parse_rnr_elems() stores the parsed element count in a
u8-backed cfg80211_rnr_elems::cnt field and uses that count to size
the flexible array allocation.Reject nested NL80211_ATTR_EMA_RNR_ELEMS input once the count reaches
255, before incrementing it again. This keeps the parser aligned with
the data structure it fills and matches the existing bound check used
by nl80211_parse_mbssid_elems().
CVSS v3.1 score: 7.8
CVE-2017-12299 
A vulnerability exists in the process of creating default IP blocks during device initialization for Cisco ASA Next-Generation Firewall Services that could allow an unauthenticated, remote attacker to send traffic to the local IP address of the device, bypassing any filters that are configured to deny local IP management traffic. The vulnerability is due to an implementation error that exists in the process of creating default IP blocks when the device is initialized, and the way in which those IP blocks interact with user-configured filters for local IP management traffic (for example, SSH to the device). An attacker could exploit this vulnerability by sending traffic to the local IP address of the targeted device. A successful exploit could allow the attacker to connect to the local IP address of the device even when there are filters configured to deny the traffic. Cisco Bug IDs: CSCvd97962.
CVSS v3.0 score: 5.3
CVSS v2.0 score: 5
CVE-2018-7210 
An issue was discovered in iDashboards 9.6b. It allows remote attackers to obtain sensitive information via a direct request for the idb/config?CMD=installLicense URI, as demonstrated by intranet IP addresses and names of guest accounts.
CVSS v3.0 score: 7.5
CVSS v2.0 score: 5
CVE-2022-0262 Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.7.
CVSS v3.0 score: 6.6
GHSA-5rrv-m36h-qwf8 Use-after-free in chttp
The From implementation for Vec was not properly implemented, returning a vector backed by freed memory. This could lead to memory corruption or be exploited to cause undefined behavior.A fix was published in version 0.1.3.
CVSS v3.1 score: 9.8
GHSA-3w7q-pf6h-jf9g 
Multiple cross-site scripting (XSS) vulnerabilities in EJ3 BlackBook 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) bookCopyright and (2) ver parameters to (a) footer.php, and the (3) bookName, (4) bookMetaTags, and (5) estiloCSS parameters to (b) header.php.
GHSA-fv2f-rw9f-v9cm smtp-server's command parser memory exhaustion denial-of-service
smtp-server prior to v3.18.3 are vulnerable to unauthenticated memory exhaustion denial-of-service. smtp-server's command parser allows any remote client to consume server memory by sending data without newline characters. The server's `_remainder` buffer in `SMTPStream._write` grows without limit, leading to heap exhaustion, prolonged GC pauses that freeze the event loop, and in some cases, process crash.The `_write` method in `lib/smtp-stream.js` appends incoming TCP chunks to `this._remainder` in command mode. The buffer is only emptied when a newline is found. If a client never sends a newline, the `_remainder` value will grow indefinitely, causing excess memory consumption.
CVSS v4.0 score: 8.7