CIRCL/vulnerability-scores huggingface dataset:
GHSA-x5g3-hx3c-gfxx 
In the Linux kernel, the following vulnerability has been resolved:mm/list_lru: drain before clearing xarray entry on reparentmemcg_reparent_list_lrus() clears the dying memcg's xarray entry with
xas_store(&xas, NULL) before reparenting its per-node lists into the
parent.  This opens a window where a concurrent list_lru_del() arriving
for the dying memcg sees xa_load() == NULL, walks to the parent in
lock_list_lru_of_memcg(), takes the parent's per-node lock, and calls
list_del_init() on an item still physically linked on the dying memcg's
list.If another in-flight thread holds the dying memcg's per-node lock at the
same moment (another list_lru_del, or a list_lru_walk_one running an
isolate callback), both threads modify ->next/->prev pointers on the same
physical list under different locks.  Adjacent items can corrupt each
other's links.Fix it by reversing the order: reparent each per-node list and mark the
child's list lru dead and then clear the xarray entry.  Any concurrent
list_lru op that finds the still-set xarray entry either takes the dying
memcg's per-node lock (synchronizing with the drain) or sees LONG_MIN and
walks to the parent, where the items now live.
CVSS v3.1 score: 7.8
CVE-2026-25229 Gogs Authorization Bypass Allows Cross-Repository Label Modification
Gogs is an open source self-hosted Git service. Versions 0.13.4 and below have a broken access control vulnerability which allows authenticated users with write access to any repository to modify labels belonging to other repositories. The UpdateLabel function in the Web UI (internal/route/repo/issue.go) fails to verify that the label being modified belongs to the repository specified in the URL path, enabling cross-repository label tampering attacks. The vulnerability exists in the Web UI's label update endpoint POST /:username/:reponame/labels/edit. The handler function UpdateLabel uses an incorrect database query function that bypasses repository ownership validation. This issue has been fixed in version 0.14.1.
CVSS v4.0 score: 5.3
GHSA-2vfr-ch7v-7754 
In Meari IoT Cloud MQTT Broker deployments running EMQX 4.x, any authenticated low-privilege account can subscribe to global wildcard topics and receive telemetry from devices the user does not own. The broker enforces publish restrictions but does not enforce equivalent subscribe authorization at per-device scope.
CVSS v3.1 score: 7.7
GHSA-2w2j-gfqg-fwgm 
Stack-based buffer overflow in JDBC Applet Server in IBM DB2 8.1 allows remote attackers to execute arbitrary by connecting and sending a long username, then disconnecting gracefully and reconnecting and sending a short username and an unexpected db2java.zip version, which causes a null terminator to be removed and leads to the overflow.
GHSA-2r78-2mm9-hw6h 
Windu CMS implements weak client-side brute-force protection by using parameter loginError. Information about attempt count or timeout is not stored on the server, which allows a malicious attacker to bypass this brute-force protection by resetting this parameter.The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 4.1 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 7.5
GHSA-pr37-gvg2-qr9v 
The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to upload arbitrary files to any directory, leading to arbitrary code execution by uploading webshells.
CVSS v3.1 score: 9.8
GHSA-j75r-7p56-j76j 
Windows Fax Service Remote Code Execution Vulnerability
CVSS v3.1 score: 8.8
GHSA-p34q-fj6q-86m9 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Epsiloncool WP Fast Total Search allows Stored XSS.This issue affects WP Fast Total Search: from n/a through 1.68.232.
CVSS v3.1 score: 7.1
CVE-2022-2015 Cross-site Scripting (XSS) - Stored in jgraph/drawio
Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 19.0.2.
CVSS v3.0 score: 6.1
CVE-2026-4114 
Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN admin to bypass AMC TOTP authentication.
CVSS v3.1 score: 6.6
CVE-2026-10239 JeecgBoot edit WordUtil.addImage server-side request forgery
A vulnerability was determined in JeecgBoot up to 3.9.2. The affected element is the function WordUtil.addImage of the file /airag/word/edit. Executing a manipulation can lead to server-side request forgery. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. A fix is planned for the upcoming release.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 6.3
CVSS v3.0 score: 6.3
CVSS v2.0 score: 6.5
CVE-2018-10616 
ABB Panel Builder 800 all versions has an improper input validation vulnerability which may allow an attacker to insert and run arbitrary code on a computer where the affected product is used.
CVSS v3.0 score: 7.8
CVSS v2.0 score: 9.3
GHSA-368v-7v32-52fx Overflow in `ResizeNearestNeighborGrad`
ImpactWhen [`tf.raw_ops.ResizeNearestNeighborGrad`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/image/resize_nearest_neighbor_op.cc) is given a large `size` input, it overflows.PatchesWe have patched the issue in GitHub commit [00c821af032ba9e5f5fa3fe14690c8d28a657624](https://github.com/tensorflow/tensorflow/commit/00c821af032ba9e5f5fa3fe14690c8d28a657624).The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.For more informationPlease consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.AttributionThis vulnerability has been reported by Neophytos Christou from the Secure Systems Lab (SSL) at Brown University.
CVSS v3.1 score: 4.8
GHSA-g5r9-f6gw-wq4q 
Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS v3.1 score: 5.4
GHSA-97r7-mpr3-66vh 
In the Linux kernel, the following vulnerability has been resolved:serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platformsCommit b1b4efea05a5 ("serial: 8250_mid: Disable DMA for selected
platforms") replaced the dnv_board setup and exit callbacks with
PTR_IF(false, ...), which evaluates to NULL. However, the three call
sites in mid8250_probe() and mid8250_remove() unconditionally
dereference these function pointers without NULL checks, causing a NULL
pointer dereference (kernel oops) on any Denverton (DNV), Ice Lake Xeon
D (ICX-D/CDF), or Snowridge (SNR) platform.Fix this by adding the missing NULL checks before calling the setup and
exit callbacks.
GHSA-cgvp-2vg6-v9h6 
The Total Upkeep plugin for WordPress is vulnerable to information disclosure in versions up to, and including 1.14.13. This is due to missing authorization on the heartbeat_received() function that triggers on WordPress heartbeat. This makes it possible for authenticated attackers, with subscriber-level permissions and above to retrieve back-up paths that can subsequently be used to download the back-up.
CVSS v3.1 score: 4.3
GHSA-q358-8xv4-rg52 
A vulnerability in the command-line interface in Brocade Fabric OS before Brocade Fabric OS v8.2.2a1, 8.2.2c, v7.4.2g, v8.2.0_CBN3, v8.2.1e, v8.1.2k, v9.0.0, could allow a local authenticated attacker to modify shell variables, which may lead to an escalation of privileges or bypassing the logging.
CVE-2023-3165 SourceCodester Life Insurance Management System POST Parameter insertNominee.php cross site scripting
A vulnerability was found in SourceCodester Life Insurance Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file insertNominee.php of the component POST Parameter Handler. The manipulation of the argument nominee_id leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-231109 was assigned to this vulnerability.
CVSS v3.1 score: 3.5
CVSS v3.0 score: 3.5
CVSS v2.0 score: 4
CVE-2025-58679 WordPress AppMySite plugin <= 3.15.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in AppMySite AppMySite appmysite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AppMySite: from n/a through <= 3.15.0.
CVSS v3.1 score: 5.3
GHSA-gvgv-fvwr-v2rj 
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Query).  Supported versions that are affected are 8.61 and  8.62. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
CVSS v3.1 score: 4.3
CVE-2013-0957 
Data Protection in Apple iOS before 7 allows attackers to bypass intended limits on incorrect passcode entry, and consequently avoid a configured Erase Data setting, by leveraging the presence of an app in the third-party sandbox.
CVSS v2.0 score: 5.8
RHSA-2020:0553 Red Hat Security Advisory: rabbitmq-server security update
rabbitmq-server: not properly sanitized user input may lead to XSS
CVSS v3.0 score: 3.1
CVE-2000-0156 
Internet Explorer 4.x and 5.x allows remote web servers to access files on the client that are outside of its security domain, aka the "Image Source Redirect" vulnerability.
CVSS v2.0 score: 5.1
CVE-2020-37199 NBMonitor 1.6.6.0 - 'Key' Denial of Service
NBMonitor 1.6.6.0 contains a denial of service vulnerability in its registration key input that allows attackers to crash the application. Attackers can generate a 1000-character buffer payload and paste it into the 'Key' field to trigger an application crash.
CVSS v4.0 score: 4.6
CVSS v3.1 score: 7.5
GHSA-r55p-5rm2-vqg9 
P2M pool freeing may take excessively long The P2M pool backing second level address translation for guests may be of significant size. Therefore its freeing may take more time than is reasonable without intermediate preemption checks. Such checking for the need to preempt was so far missing.
CVSS v3.1 score: 6.5
CVE-2015-4496 
Multiple integer overflows in libstagefright in Mozilla Firefox before 38.0 allow remote attackers to execute arbitrary code via crafted sample metadata in an MPEG-4 video file, a related issue to CVE-2015-1538.
CVSS v2.0 score: 9.3
GHSA-54v2-68v5-6xj9 
RTS CryptoBuddy 1.0 and 1.2 uses a weak encryption algorithm for the passphrase and generates predictable keys, which makes it easier for attackers to guess the passphrase.
GHSA-wr5p-cr8q-h6f5 
Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in landb.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the _type POST parameter directly into an HTML form hidden input value attribute. Attackers can craft a malicious request containing a JavaScript payload that executes in the victim's browser when the response is rendered.
CVSS v4.0 score: 5.1
CVSS v3.1 score: 5.4
GHSA-76fq-c73c-746h 
A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint (CE), Cisco TelePresence Codec (TC), and Cisco RoomOS Software could allow an authenticated, remote attacker to escalate privileges to an unrestricted user of the restricted shell. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by including specific arguments when opening an SSH connection to an affected device. A successful exploit could allow the attacker to gain unrestricted user access to the restricted shell of an affected device.
GHSA-6mmm-fwjc-qrhc 
In the Linux kernel, the following vulnerability has been resolved:io_uring: check if iowq is killed before queuingtask work can be executed after the task has gone through io_uring
termination, whether it's the final task_work run or the fallback path.
In this case, task work will find ->io_wq being already killed and
null'ed, which is a problem if it then tries to forward the request to
io_queue_iowq(). Make io_queue_iowq() fail requests in this case.Note that it also checks PF_KTHREAD, because the user can first close
a DEFER_TASKRUN ring and shortly after kill the task, in which case
->iowq check would race.
CVSS v3.1 score: 5.5
GHSA-p6f8-fpcw-hg3g 
In the Linux kernel, the following vulnerability has been resolved:net: rds: fix MR cleanup on copy error__rds_rdma_map() hands sg/pages ownership to the transport after
get_mr() succeeds. If copying the generated cookie back to user space
fails after that point, the error path must not free those resources
again before dropping the MR reference.Remove the duplicate unpin/free from the put_user() failure branch so
that MR teardown is handled only through the existing final cleanup
path.
CVSS v3.1 score: 7.8
GHSA-c9q2-8cmh-3jvf 
ZyXEL ZyWALL 10 before 3.50 allows remote attackers to cause a denial of service via an ARP packet with the firewall's IP address and an incorrect MAC address, which causes the firewall to disable the LAN interface.
CVE-2023-1193 Use-after-free in setup_async_work()
A use-after-free flaw was found in setup_async_work in the KSMBD implementation of the in-kernel samba server and CIFS in the Linux kernel. This issue could allow an attacker to crash the system by accessing freed work.
CVSS v3.1 score: 6.5
cisco-sa-20180307-dcnm Cisco Data Center Network Manager Cross-Site Request Forgery Vulnerability
A vulnerability in the web-based management interface of Cisco Data Center Network Manager could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device.

The vulnerability is due to insufficient CSRF protections on the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on a targeted device via a web browser and with the privileges of the user.

There are no workarounds that address this vulnerability.

This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-dcnm ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-dcnm"]
CVSS v3.0 score: 5.3
GHSA-67qg-fr69-72wp 
Buffer overflow in setiathome for SETI@home 3.03, if installed setuid, could allow local users to execute arbitrary code via long command line options (1) socks_server, (2) socks_user, and (3) socks_passwd. NOTE: since the default configuration of setiathome is not setuid, perhaps this issue should not be included in CVE.
RHSA-2026:3427 Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.9.0 release
golang: net/url: Memory exhaustion in query parameter parsing in net/url
CVSS v3.1 score: 7.5
CVE-2024-11956 Pimcore customer-data-framework list sql injection
A vulnerability, which was classified as critical, has been found in Pimcore customer-data-framework up to 4.2.0. Affected by this issue is some unknown functionality of the file /admin/customermanagementframework/customers/list. The manipulation of the argument filterDefinition/filter leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.2.1 is able to address this issue. It is recommended to upgrade the affected component.
CVSS v4.0 score: 5.1
CVSS v3.1 score: 4.7
CVSS v3.0 score: 4.7
CVSS v2.0 score: 5.8
CVE-2026-45995 io_uring/zcrx: fix user_struct uaf
In the Linux kernel, the following vulnerability has been resolved:

io_uring/zcrx: fix user_struct uaf

io_free_rbuf_ring() usees a struct user_struct, which
io_zcrx_ifq_free() puts it down before destroying the ring.
CVSS v3.1 score: 7.8
CVE-2026-7325 
Improper authorization in the Active Directory browsing feature in Devolutions Server allows a low-privileged authenticated user to obtain authentication material associated with a stored PAM provider service account via authentication relay to an attacker-controlled server.

This issue affects :

  *  Devolutions Server 2026.1.6.0 through 2026.1.16.0
  *  Devolutions Server 2025.3.20.0 and earlier
CVSS v3.1 score: 7.1
GHSA-gwpm-4xfr-x3gg 
Remote code execution
CVSS v3.1 score: 9.8
GHSA-jr5v-q344-7hjg 
A vulnerability, which was classified as critical, was found in 1000 Projects Beauty Parlour Management System 1.0. This affects an unknown part of the file /admin/add-services.php. The manipulation of the argument sername leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 9.8
GHSA-chq6-pgcm-wg35 
libvirt 0.7.5 through 1.2.x before 1.2.5 allows local users to cause a denial of service (read block and hang) via a crafted XML document containing an XML external entity declaration in conjunction with an entity reference to the (1) virConnectCompareCPU or (2) virConnectBaselineCPU API method, related to an XML External Entity (XXE) issue.  NOTE: this issue was SPLIT per ADT3 due to different affected versions of some vectors. CVE-2014-5177 is used for other API methods.
CVE-2025-66384 
app/Controller/EventsController.php in MISP before 2.5.24 has invalid logic in checking for uploaded file validity, related to tmp_name.
CVSS v3.1 score: 8.2
GHSA-g349-wjvj-vxpr 
An out-of-bounds read vulnerability in the Productivity Suite allows a 
local attacker to trigger kernel memory corruption by sending a crafted 
IOCTL request. This could lead to limited information disclosure or 
disruption of the affected product.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 6.1
GHSA-p7p5-24gv-9755 
SQL injection vulnerability in publico/ficha.php in NetHoteles 3.0 allows remote attackers to execute arbitrary SQL commands via the id_establecimiento parameter.
CVE-2017-16731 
An Unprotected Transport of Credentials issue was discovered in ABB Ellipse 8.3 through Ellipse 8.9 released prior to December 2017 (including Ellipse Select). A vulnerability exists in the authentication of Ellipse to LDAP/AD using the LDAP protocol. An attacker could exploit the vulnerability by sniffing local network traffic, allowing the discovery of authentication credentials.
CVSS v3.0 score: 8.8
CVSS v2.0 score: 2.9
GHSA-hqw7-x8rp-q6j4 
LG SuperSign Media Editor getSubFolderList Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG SuperSign Media Editor. Authentication is not required to exploit this vulnerability.The specific flaw exists within the getSubFolderList method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-20330.
CVSS v3.0 score: 5.3
RHSA-2017:0359 Red Hat Security Advisory: openstack-puppet-modules security update
puppet-swift: installs config file with world readable permissions
CVSS v3.0 score: 6.5
GHSA-7g5r-fqfh-59j6 
In the Linux kernel, the following vulnerability has been resolved:ASoC: qcom: Fix uninitialized pointer dmactlIn the case where __lpass_get_dmactl_handle is called and the driver
id dai_id is invalid the pointer dmactl is not being assigned a value,
and dmactl contains a garbage value since it has not been initialized
and so the null check may not work. Fix this to initialize dmactl to
NULL. One could argue that modern compilers will set this to zero, but
it is useful to keep this initialized as per the same way in functions
__lpass_platform_codec_intf_init and lpass_cdc_dma_daiops_hw_params.Cleans up clang scan build warning:
sound/soc/qcom/lpass-cdc-dma.c:275:7: warning: Branch condition
evaluates to a garbage value [core.uninitialized.Branch]
CVSS v3.1 score: 6.2
CVE-2018-18438 
Qemu has integer overflows because IOReadHandler and its associated functions use a signed integer data type for a size value.
CVSS v3.0 score: 5.5
CVSS v2.0 score: 2.1
GHSA-hgcm-ph3v-mp4j 
A vulnerability in the password reset workflow of the Touch Lebanon Mobile App 2.20.2 allows an attacker to bypass the OTP reset password mechanism. By manipulating the reset process, an unauthorized user may be able to reset the password and gain access to the account without needing to provide a legitimate authentication factor, such as an OTP. This compromises account security and allows for potential unauthorized access to user data.
CVSS v3.1 score: 8.8
GHSA-5qg3-f5jq-39vc 
Veritas APTARE versions prior to 10.5 did not perform adequate authorization checks. This vulnerability could allow for remote code execution by an unauthenticated user.
GHSA-2j6v-xpf3-xvrv Use of Externally-Controlled Format String in wire-avs
ImpactA remote format string vulnerability allowed an attacker to cause a denial of service or possibly execute arbitrary code.PatchesThe issue has been fixed in wire-avs 7.1.12 and is already included on all Wire products (currently used version is 8.0.x)WorkaroundsNo workaround knownReferencesFixed in commit https://github.com/wireapp/wire-avs/commit/40d373ede795443ae6f2f756e9fb1f4f4ae90bbeFor more informationIf you have any questions or comments about this advisory feel free to email us at [vulnerability-report@wire.com](mailto:vulnerability-report@wire.com)
CVSS v3.1 score: 9.8
GHSA-8rw5-5q8r-v7wp 
Insertion of Sensitive Information Into Sent Data vulnerability in Essekia Tablesome tablesome allows Retrieve Embedded Sensitive Data.This issue affects Tablesome: from n/a through <= 1.1.35.1.
CVSS v3.1 score: 7.5
GHSA-qgg3-3qc5-h6ch 
Unspecified vulnerability in the (1) web cache or (2) web proxy in Fujitsu NetShelter/FW allows remote attackers to cause a denial of service (device unresponsiveness) via certain DNS packets, as demonstrated by the OUSPG PROTOS DNS test suite.
GHSA-4j42-4g6h-g8rv 
Windows 95 and Windows 98 systems, when configured with multiple TCP/IP stacks bound to the same MAC address, allow remote attackers to cause a denial of service (traffic amplification) via a certain ICMP echo (ping) packet, which causes all stacks to send a ping response, aka TCP Chorusing.
CVE-2017-17885 
In ImageMagick 7.0.7-12 Q16, a memory leak vulnerability was found in the function ReadPICTImage in coders/pict.c, which allows attackers to cause a denial of service via a crafted PICT image file.
CVSS v3.0 score: 6.5
CVSS v2.0 score: 4.3
CVE-2023-43666 Apache InLong: General user Unauthorized access User Management
Insufficient Verification of Data Authenticity vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, 

General user can view all user data like Admin account.

Users are advised to upgrade to Apache InLong's 1.9.0 or cherry-pick [1] to solve it.

[1]  https://github.com/apache/inlong/pull/8623 


CVSS v3.1 score: 6.5
CVE-2022-28224 Calico and Calico Enterprise may be vulnerable to route hijacking with the floating IP feature
Clusters using Calico (version 3.22.1 and below), Calico Enterprise (version 3.12.0 and below), may be vulnerable to route hijacking with the floating IP feature. Due to insufficient validation, a privileged attacker may be able to set a floating IP annotation to a pod even if the feature is not enabled. This may allow the attacker to intercept and reroute traffic to their compromised pod.
CVSS v3.1 score: 5.5
CVE-2021-31757 
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setVLAN allows attackers to execute arbitrary code on the system via a crafted post request.
CVSS v3.1 score: 9.8
CVSS v2.0 score: 10
RHSA-2026:47248 Red Hat Security Advisory: kernel security update
kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception level resources kernel: xen/privcmd: fix double free via VMA splitting kernel: ipc: limit next_id allocation to the valid ID range kernel: dm log: fix out-of-bounds write due to region_count overflow
CVSS v3.1 score: 6.3
CVE-2017-13127 
The VIP.com application for IOS and Android allows remote attackers to obtain sensitive information and hijack the authentication of users via a rogue access point and a man-in-the-middle attack.
CVSS v3.0 score: 8.1
CVSS v2.0 score: 6.8
CVE-2023-6097 SQL Injection on ICSSolution ICS Business Manager
A SQL injection vulnerability has been found in ICS Business Manager, affecting version 7.06.0028.7089. This vulnerability could allow a remote user to send a specially crafted SQL query and retrieve all the information stored in the database. The data could also be modified or deleted, causing the application to malfunction.
CVSS v3.1 score: 9.4
GHSA-mq4f-73j7-jxvq 
admin/sauvBase.php in Blog Pixel Motion (aka Blog PixelMotion) does not require authentication, which allows remote attackers to trigger a database backup dump, and obtain the resulting blogPM.sql file that contains sensitive information.
CVE-2023-23728 WordPress WP Flipclock Plugin <= 1.7.4 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Winwar Media WP Flipclock plugin <= 1.7.4 versions.
CVSS v3.1 score: 6.5
GHSA-35fm-pgcc-7jwh 
The DownloadLoop function in main.c for greed 0.81p allows remote attackers to execute arbitrary code via a GRX file containing a filename with shell metacharacters.
GHSA-2rcg-mm5h-xchx PraisonAI: Arbitrary File Read via `@file:` Mention Path Traversal
SummaryThe MentionsParser in `src/praisonai-agents/praisonaiagents/tools/mentions.py` processes `@file:` mentions in agent prompts by reading arbitrary files from the filesystem. When a file path is not found relative to the workspace, the parser falls back to using the path as an absolute path without any validation or boundary check. This allows an attacker who can influence agent prompts (via chat messages, Telegram/Discord/Slack bot inputs, or YAML workflow configs) to read any file on the filesystem accessible to the process user.Details**Vulnerable code (lines 165–178):****The vulnerability is in the fallback at line 171–172:** When the file is not found relative to `workspace_path`, the code constructs `full_path = Path(file_path)`, which accepts any absolute or relative path without validation. There is no:`..` path traversal checkWorkspace boundary validationSymlink resolution against workspaceProtected path guardThe `file_path` parameter originates from parsing `@file:` mentions in user/LLM prompts. The `MentionsParser` is used across the framework to process mentions in agent instructions and user messages.**Contrast with `skill_tools.py` `read_skill_file`** (lines 140–193), which properly validates:PoC**Setup:** Clean checkout at commit `d5f1114a`.**Positive trigger — arbitrary file read via @file: mention:****Expected output:****Negative control — non-existent file:****Cleanup:** No persistence or side effects — read-only operation.ImpactAn attacker who can inject `@file:` mentions into agent prompts (via chat messages in Telegram/Discord/Slack bots, user input in web UI, or YAML workflow configurations) can read any file accessible to the process user, including:**Secrets and credentials:** `.env` files, `~/.aws/credentials`, `~/.ssh/id_rsa`, API keys**Configuration files:** Database passwords, JWT secrets, OAuth tokens**Source code:** Application internals, database schemas**System files:** `/etc/passwd`, `/etc/shadow` (if process has read access)This is particularly dangerous in bot deployments where `auto_approve_tools` defaults to `True` and untrusted users can send messages containing `@file:` mentions.Suggested remediation**Remove the absolute path fallback.** Only resolve files within `workspace_path`:Add symlink resolution via `.resolve()` to prevent symlink-based traversal.Add a protected path guard (`.env`, `.git`, `.ssh`, keys, credentials).Apply the same `os.path.commonpath` pattern used by `skill_tools.py`.CreditsThai Son Dinh from VinSOC Labs (R&D)
CVSS v3.1 score: 7.5
GHSA-jf2h-frpc-5873 
Stack overflow in XHCI for EDK II may allow an unauthenticated user to potentially enable denial of service via local access.
CVSS v3.0 score: 5.5
CVE-2025-69393 WordPress Exzo theme <= 1.2.4 - Broken Access Control vulnerability
Missing Authorization vulnerability in Jthemes Exzo exzo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Exzo: from n/a through <= 1.2.4.
CVSS v3.1 score: 7.5
GHSA-xgh5-gwq5-rpx8 Arbitrary javascript injection in Apache Jena
There is insufficient checking of user queries in Apache Jena versions 4.7.0 and earlier, when invoking custom scripts. It allows a remote user to execute arbitrary javascript via a SPARQL query.
CVSS v3.1 score: 5.4
GHSA-c8wj-q36q-3wg4 phpMyAdmin Arbitrary file read vulnerability
An issue was discovered in phpMyAdmin before 4.8.5. When the AllowArbitraryServer configuration setting is set to true, with the use of a rogue MySQL server, an attacker can read any file on the server that the web server's user can access. This is related to the mysql.allow_local_infile PHP configuration, and the inadvertent ignoring of "options(MYSQLI_OPT_LOCAL_INFILE" calls.
CVSS v3.0 score: 5.9
GHSA-g7w4-j39f-84mq 
Certain NETGEAR devices are affected by vertical privilege escalation. This affects M4300-28G before 12.0.2.15, M4300-52G before 12.0.2.15, M4300-28G-POE+ before 12.0.2.15, M4300-52G-POE+ before 12.0.2.15, M4300-8X8F before 12.0.2.15, M4300-12X12F before 12.0.2.15, M4300-24X24F before 12.0.2.15, M4300-24X before 12.0.2.15, M4300-48X before 12.0.2.15, and M4200 before 12.0.2.15.
CVE-2022-4093  SQL Injection in dolibarr/dolibarr
SQL injection attacks can result in unauthorized access to sensitive data, such as passwords, credit card details, or personal user information. Many high-profile data breaches in recent years have been the result of SQL injection attacks, leading to reputational damage and regulatory fines. In some cases, an attacker can obtain a persistent backdoor into an organization's systems, leading to a long-term compromise that can go unnoticed for an extended period. This affect 16.0.1 and 16.0.2 only. 16.0.0 or lower, and 16.0.3 or higher are not affected
CVSS v3.0 score: 8.1
GHSA-p9j9-qqwf-j574 
MaxQueryDuration not honoured in Samba AD DC LDAP
CVSS v3.1 score: 6.5
CVE-2024-46054 
OpenVidReview 1.0 is vulnerable to Incorrect Access Control. The /upload route is accessible without authentication, allowing any user to upload files.
CVSS v3.1 score: 9.8
RHSA-2024:4561 Red Hat Security Advisory: OpenJDK 8u422 Windows Security Update
OpenJDK: potential UTF8 size overflow (8314794) OpenJDK: Excessive symbol length can lead to infinite loop (8319859) OpenJDK: Range Check Elimination (RCE) pre-loop limit overflow (8320548) OpenJDK: Pack200 increase loading time due to improper header validation (8322106) OpenJDK: Out-of-bounds access in 2D image handling (8324559) OpenJDK: RangeCheckElimination array index overflow (8323231)
CVSS v3.1 score: 7.4
CVE-2010-1934 
Multiple PHP remote file inclusion vulnerabilities in openMairie openPlanning 1.00, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the path_om parameter to (1) categorie.class.php, (2) profil.class.php, (3) collectivite.class.php, (4) ressource.class.php, (5) droit.class.php, (6) utilisateur.class.php, and (7) planning.class.php in obj/.
CVSS v2.0 score: 6.8
GHSA-x8rx-wj73-hw35 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in prismtechstudios Modern Footnotes allows Stored XSS. This issue affects Modern Footnotes: from n/a through 1.4.19.
CVSS v3.1 score: 6.5
CVE-2023-52904 ALSA: usb-audio: Fix possible NULL pointer dereference in snd_usb_pcm_has_fixed_rate()
In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: Fix possible NULL pointer dereference in snd_usb_pcm_has_fixed_rate()

The subs function argument may be NULL, so do not use it before the NULL check.
CVSS v3.1 score: 5.5
CVE-2011-3767 
osCommerce 3.0a5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by redirect.php.
CVSS v2.0 score: 5
CVE-2019-13146 
The field_test gem 0.3.0 for Ruby has unvalidated input. A method call that is expected to return a value from a certain set of inputs can be made to return any input, which can be dangerous depending on how applications use it. If an application treats arbitrary variants as trusted, this can lead to a variety of potential vulnerabilities like SQL injection or cross-site scripting (XSS).
CVSS v3.0 score: 5.3
CVSS v2.0 score: 5
GHSA-p69r-wq85-rjcx 
An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, watchOS 6.2.5. A local user may be able to read kernel memory.
CVSS v3.1 score: 5.5
CVE-2010-4471 
Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, and 5.0 Update 27 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality via unknown vectors related to 2D.  NOTE: the previous information was obtained from the February 2011 CPU.  Oracle has not commented on claims from a downstream vendor that this issue is related to the exposure of system properties via vectors related to Font.createFont and exception text.
CVSS v2.0 score: 5
GHSA-462w-mhhh-chgq 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Adam Dehnel Simple Modal allows Reflected XSS.This issue affects Simple Modal: from n/a through 0.3.3.
CVSS v3.1 score: 7.1
CVE-2024-10098 ApplyOnline – Application Form Builder and Manager < 2.6.3 - Unauthenticated Application File Access
The ApplyOnline  WordPress plugin before 2.6.3 does not protect uploaded files during the application process, allowing unauthenticated users to access them and any private information they contain
CVSS v3.1 score: 2.7
CVE-2016-0889 
An HTTP servlet in vApp Manager in EMC Unisphere for VMAX Virtual Appliance before 8.2.0 allows remote attackers to write to arbitrary files via a crafted pathname.
CVSS v3.0 score: 9.8
CVSS v2.0 score: 10
CVE-2022-45186 
An issue was discovered in SuiteCRM 7.12.7. Authenticated users can recover an arbitrary field of a database.
CVSS v3.1 score: 8.1
CVE-2009-4595 
SQL injection vulnerability in index.php in PHP Inventory 1.2 allows remote authenticated users to execute arbitrary SQL commands via the sup_id parameter in a suppliers details action.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS v2.0 score: 6
GHSA-ch5w-2994-6h82 Cross-site Scripting in thorsten/phpmyfaq
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
CVSS v3.1 score: 5.4
CVE-2020-16863 Windows Remote Desktop Service Denial of Service Vulnerability
<p>A denial of service vulnerability exists in Windows Remote Desktop Service when an attacker connects to the target system using RDP and sends specially crafted requests. An attacker who successfully exploited this vulnerability could cause the Remote Desktop Service on the target system to stop responding.</p>
<p>To exploit this vulnerability, an attacker would need to run a specially crafted application against a server which provides Remote Desktop Service.</p>
<p>The update addresses the vulnerability by correcting how Remote Desktop Service handles connection requests.</p>
CVSS v3.1 score: 7.5
CVE-2024-31648 
Cross Site Scripting (XSS) in Insurance Management System v1.0, allows remote attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Category Name parameter at /core/new_category2.
CVSS v3.1 score: 6.1
GHSA-jr6c-jc92-gv6c 
In Config Manager, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilege from a proximal attacker with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: A20210009; Issue ID: OSBNB00123234.
CVSS v3.1 score: 9.8
CVE-2019-18271 
OSIsoft PI Vision, All versions of PI Vision prior to 2019. The affected product is vulnerable to a cross-site request forgery that may be introduced on the PI Vision administration site.
CVSS v3.1 score: 8.8
CVSS v2.0 score: 6.8
GHSA-p685-qr9c-hw62 
An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. It has circular reference mishandling that causes a loop.
CVE-2021-22761 
A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in disclosure of information or remote code e+F15xecution due to missing length check on user supplied data, when a malicious CGF file is imported to IGSS Definition.
CVSS v3.1 score: 7.8
CVSS v2.0 score: 6.8
CVE-2023-50774 
A cross-site request forgery (CSRF) vulnerability in Jenkins HTMLResource Plugin 1.02 and earlier allows attackers to delete arbitrary files on the Jenkins controller file system.
CVSS v3.1 score: 8.1
GHSA-356v-2cpg-fj3v 
An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.18. Android ID: A-33899363. References: N-CVE-2017-0333.
CVSS v3.0 score: 7.8
CVE-2020-11598 
An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. Upload.ashx allows remote attackers to execute arbitrary code by uploading and executing an ASHX file.
CVSS v3.1 score: 9.8
CVSS v2.0 score: 7.5
CVE-2020-27796 
A heap-based buffer over-read was discovered in the invert_pt_dynamic function in p_lx_elf.cpp in UPX 4.0.0 via a crafted Mach-O file.
CVSS v3.1 score: 7.8
CVE-2023-2272 Tiempo.com <= 0.1.2 - Reflected XSS
The Tiempo.com WordPress plugin through 0.1.2 does not sanitise and escape the page parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS v3.1 score: 6.1
GHSA-h7w3-v34v-748v 
Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
CVSS v3.1 score: 6.8
CVE-2023-20101 
A vulnerability in Cisco Emergency Responder could allow an unauthenticated, remote attacker to log in to an affected device using the root account, which has default, static credentials that cannot be changed or deleted.
 This vulnerability is due to the presence of static user credentials for the root account that are typically reserved for use during development. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and execute arbitrary commands as the root user.
CVSS v3.1 score: 9.8
CVE-2026-47927 DNG SDK | Out-of-bounds Read (CWE-125)
DNG SDK versions 1.7.1 2536 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1 score: 5.5
CVE-2025-68200 bpf: Add bpf_prog_run_data_pointers()
In the Linux kernel, the following vulnerability has been resolved:

bpf: Add bpf_prog_run_data_pointers()

syzbot found that cls_bpf_classify() is able to change
tc_skb_cb(skb)->drop_reason triggering a warning in sk_skb_reason_drop().

WARNING: CPU: 0 PID: 5965 at net/core/skbuff.c:1192 __sk_skb_reason_drop net/core/skbuff.c:1189 [inline]
WARNING: CPU: 0 PID: 5965 at net/core/skbuff.c:1192 sk_skb_reason_drop+0x76/0x170 net/core/skbuff.c:1214

struct tc_skb_cb has been added in commit ec624fe740b4 ("net/sched:
Extend qdisc control block with tc control block"), which added a wrong
interaction with db58ba459202 ("bpf: wire in data and data_end for
cls_act_bpf").

drop_reason was added later.

Add bpf_prog_run_data_pointers() helper to save/restore the net_sched
storage colliding with BPF data_meta/data_end.
CVE-2019-14117 
u'Whenever the page list is updated via privileged user, the previous list elements are freed but are not deleted from the list which results in a use after free causing an unhandled page fault exception in rmnet driver' in Snapdragon Auto, Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in Bitra, MDM9607, QCS405, Saipan, SC8180X, SDX55, SM6150, SM7150, SM8150, SM8250, SXR2130
CVSS v3.1 score: 7.8
CVSS v2.0 score: 7.2
CVE-2025-31754 WordPress DobsonDev Shortcodes plugin <= 2.1.12 - Stored Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DobsonDev DobsonDev Shortcodes dobsondev-shortcodes allows Stored XSS.This issue affects DobsonDev Shortcodes: from n/a through <= 2.1.12.
CVSS v3.1 score: 6.5
RHSA-2009:0420 Red Hat Security Advisory: ghostscript security update
ghostscript: DoS (crash) in CCITTFax decoding filter argyllcms: Incomplete fix for CVE-2009-0583
GHSA-4w88-q6w3-v8qg 
Unreal engine 3, as used in Unreal Tournament 3 1.3, Frontlines: Fuel of War 1.1.1, and other products, allows remote attackers to cause a denial of service (server exit) via a packet with a large length value that triggers a memory allocation failure.
CVE-2015-1694 
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1710.
CVSS v2.0 score: 9.3
CVE-2023-3445 Cross-site Scripting (XSS) - Stored in spinacms/spina
Cross-site Scripting (XSS) - Stored in GitHub repository spinacms/spina prior to 2.15.1.
CVSS v3.0 score: 3.5
GHSA-qr82-4rg7-7243 
Missing Authorization vulnerability in Pankaj Kumar WpXmas-Snow wpxmas-snow allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpXmas-Snow: from n/a through <= 1.1.
CVSS v3.1 score: 5.3
CVE-2025-67579 WordPress User Extra Fields plugin <= 16.8 - Broken Access Control vulnerability
Missing Authorization vulnerability in vanquish User Extra Fields wp-user-extra-fields allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Extra Fields: from n/a through <= 16.8.
CVSS v3.1 score: 5.3
GHSA-vpjg-mf6g-q65x 
Cross-site scripting (XSS) vulnerability in article.php in Anchor CMS 0.9.1, when comments are enabled, allows remote attackers to inject arbitrary web script or HTML via the Name field.  NOTE: some sources have reported that comments.php is vulnerable, but certain functions from comments.php are used by article.php.
GHSA-f6h6-4q4r-v83x 
A vulnerability, which was classified as problematic, was found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. Affected is an unknown function of the file /profile.php of the component Admin Profile Page. The manipulation of the argument email leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 5.1
CVSS v3.1 score: 3.5
RHSA-2023:4153 Red Hat Security Advisory: bind security update
bind: named's configured cache size limit can be significantly exceeded
CVSS v3.1 score: 7.5
CVE-2022-27082 
Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/SetInternetLanInfo.
CVSS v3.1 score: 9.8
CVSS v2.0 score: 10
GHSA-pvfh-jx2m-6m8c 
RSA Access Manager Server 5.5.3 before 5.5.3.172, 6.0.4 before 6.0.4.53, and 6.1 before 6.1.2.01 does not properly perform cache updates, which allows remote attackers to obtain sensitive information via unspecified vectors.
CVE-2004-1786 
PortalApp places user credentials under the web root with insufficient access control, which allows remote attackers to gain access to sensitive information via a direct request to 8275.mdb.
CVSS v2.0 score: 5
GHSA-66ch-52fc-j7qp 
There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.8.1 and below which may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the victim’s browser.
CVSS v3.1 score: 6.1
CVE-2025-21277 Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
CVSS v3.1 score: 7.5
GHSA-wjv3-548m-qhxx 
A vulnerability was found in code-projects Chat System up to 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /user/addnewmember.php. The manipulation of the argument user leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 6.3
CVE-2025-54879 Mastodon e‑mail throttle misconfiguration allows unlimited email confirmations against unconfirmed emails
Mastodon is a free, open-source social network server based on ActivityPub Mastodon which facilitates LDAP configuration for authentication. In versions 3.1.5 through 4.2.24, 4.3.0 through 4.3.11 and 4.4.0 through 4.4.3, Mastodon's rate-limiting system has a critical configuration error where the email-based throttle for confirmation emails incorrectly checks the password reset path instead of the confirmation path, effectively disabling per-email limits for confirmation requests. This allows attackers to bypass rate limits by rotating IP addresses and send unlimited confirmation emails to any email address, as only a weak IP-based throttle (25 requests per 5 minutes) remains active. The vulnerability enables denial-of-service attacks that can overwhelm mail queues and facilitate user harassment through confirmation email spam. This is fixed in versions 4.2.24, 4.3.11 and 4.4.3.
CVSS v3.1 score: 5.3
GHSA-fgxx-ch38-43gw 
The existence of a specifically requested local file can be found due to the double firing of the "onerror" when the "source" attribute on a "<track>" tag refers to a file that does not exist if the source page is loaded locally. This vulnerability affects Firefox < 51.
CVSS v3.0 score: 3.3