CIRCL/vulnerability-scores huggingface dataset:
GHSA-wr8p-964c-7vgx 
YUNUCMS 1.0.7 has XSS via the content title on an admin/content/addcontent/cid/## page (aka a news center page).
CVSS v3.0 score: 4.8
GHSA-vp4m-5q7m-677j 
Multiple cross-site scripting (XSS) vulnerabilities in BugFree 2.1.3 allow remote attackers to inject arbitrary web script or HTML via (1) the ActionType parameter to Bug.php, the ReportMode parameter to (2) Report.php or (3) ReportLeft.php, or the PATH_INFO to (4) AdminProjectList.php, (5) AdminGroupList.php, or (6) AdminUserLogList.php.
CVE-2017-16682 
SAP NetWeaver Internet Transaction Server (ITS), SAP Basis from 7.00 to 7.02, 7.30, 7.31, 7.40, from 7.50 to 7.52, allows an attacker with administrator credentials to inject code that can be executed by the application and thereby control the behavior of the application.
CVSS v3.0 score: 7.2
CVSS v2.0 score: 6.5
GHSA-4mmq-755g-j6g9 
Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, a different vulnerability than CVE-2010-3640, CVE-2010-3641, CVE-2010-3642, CVE-2010-3643, CVE-2010-3644, CVE-2010-3645, CVE-2010-3646, CVE-2010-3647, CVE-2010-3648, CVE-2010-3649, and CVE-2010-3652.
GHSA-67p8-9gwr-hm74 
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme DSK allows PHP Local File Inclusion. This issue affects DSK: from n/a through 2.2.
CVSS v3.1 score: 8.1
CVE-2021-20866 
Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in obtaining the user list which may allow a user to obtain the unauthorized information via unspecified vectors.
CVSS v3.1 score: 6.5
CVSS v2.0 score: 4
GHSA-8qxw-vh64-m92m 
An issue in the Arcadyan Livebox Fibra PRV3399B_B_LT allows a remote or local attacker to modify the GPON link value without authentication, causing an internet service disruption via the /firstconnection.cgi endpoint.
CVSS v3.1 score: 5.1
CVE-2018-11509 
ASUSTOR ADM 3.1.0.RFQ3 uses the same default root:admin username and password as it does for the NAS itself for applications that are installed from the online repository. This may allow an attacker to login and upload a webshell.
CVSS v3.0 score: 9.8
CVSS v2.0 score: 7.5
GHSA-cvxv-m6qx-4784 
Windows Layer-2 Bridge Network Driver Denial of Service Vulnerability
CVSS v3.1 score: 7.5
CVE-2015-8138 
NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to bypass the origin timestamp validation via a packet with an origin timestamp set to zero.
CVSS v3.0 score: 5.3
CVSS v2.0 score: 5
CVE-2020-16588 
A Null Pointer Deference issue exists in Academy Software Foundation OpenEXR 2.3.0 in generatePreview in makePreview.cpp that can cause a denial of service via a crafted EXR file.
CVSS v3.1 score: 5.5
CVSS v2.0 score: 4.3
GHSA-m9hr-h59x-fqmj 
Unrestricted Upload of File with Dangerous Type vulnerability in Piotnet Piotnet Forms.This issue affects Piotnet Forms: from n/a through 1.0.25.
CVSS v3.1 score: 9
GHSA-vghv-pmmq-mcwh 
The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to denial of service. aka "Microsoft Malware Protection Engine Denial of Service Vulnerability", a different vulnerability than CVE-2017-8535, CVE-2017-8537, CVE-2017-8539, and CVE-2017-8542.
CVSS v3.1 score: 5.5
RHSA-2018:1726 Red Hat Security Advisory: thunderbird security update
Mozilla: Memory safety bugs fixed in Firefox 60 and Firefox ESR 52.8 Mozilla: Use-after-free with SVG animations and clip paths Mozilla: Use-after-free with SVG animations and text paths Mozilla: Integer overflow and out-of-bounds write in Skia Mozilla: Hang via malformed headers Mozilla: Encrypted mail leaks plaintext through src attribute Mozilla: Lightweight themes can be installed without user interaction Mozilla: Filename spoofing for external attachments Mozilla: Buffer overflow during UTF-8 to Unicode string conversion through legacy extension Mozilla: Backport critical security fixes in Skia Mozilla: Full plaintext recovery in S/MIME via chosen-ciphertext attack Mozilla: Leaking plaintext through HTML forms
CVSS v3.0 score: 6.5
CVE-2025-29808 Windows Cryptographic Services Information Disclosure Vulnerability
Use of a cryptographic primitive with a risky implementation in Windows Cryptographic Services allows an authorized attacker to disclose information locally.
CVSS v3.1 score: 5.5
CVE-2020-15105 In Django Two-Factor Authentication, user passwords are stored in clear text in the Django session
Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session (base64-encoded). The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor authentication code. This means that the password is stored in clear text in the session for an arbitrary amount of time, and potentially forever if the user begins the login process by entering their username and password and then leaves before entering their two-factor authentication code. The severity of this issue depends on which type of session storage you have configured: in the worst case, if you're using Django's default database session storage, then users' passwords are stored in clear text in your database. In the best case, if you're using Django's signed cookie session, then users' passwords are only stored in clear text within their browser's cookie store. In the common case of using Django's cache session store, the users' passwords are stored in clear text in whatever cache storage you have configured (typically Memcached or Redis). This has been fixed in 1.12. After upgrading, users should be sure to delete any clear text passwords that have been stored. For example, if you're using the database session backend, you'll likely want to delete any session record from the database and purge that data from any database backups or replicas. In addition, affected organizations who have suffered a database breach while using an affected version should inform their users that their clear text passwords have been compromised. All organizations should encourage users whose passwords were insecurely stored to change these passwords on any sites where they were used. As a workaround, wwitching Django's session storage to use signed cookies instead of the database or cache lessens the impact of this issue, but should not be done without a thorough understanding of the security tradeoffs of using signed cookies rather than a server-side session storage. There is no way to fully mitigate the issue without upgrading.
CVSS v3.1 score: 5.4
CVE-2021-32953 MDT AutoSave SQL Injection
An attacker could utilize SQL commands to create a new user MDT AutoSave versions prior to v6.02.06 and update the user’s permissions, granting the attacker the ability to login.
CVSS v3.1 score: 9.8
CVE-2026-14231 LifterLMS < 10.0.10 - Subscriber+ Sensitive Information Disclosure via select2_query_posts
The LifterLMS  WordPress plugin before 10.0.10 does not perform a capability check in one of its select2 query AJAX handlers, only verifying that the user is logged in, allowing any authenticated user with subscriber-level access to read the titles of internal post types such as coupon codes by supplying the post type.
CVSS v3.1 score: 4.3
GHSA-pp9j-pf5c-659x Mattermost fails to sanitize sensitive data in WebSocket messages
Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to sanitize sensitive data in WebSocket messages which allows authenticated users to exfiltrate password hashes and MFA secrets via profile nickname updates or email verification events. Mattermost Advisory ID: MMSA-2025-00560
CVSS v3.1 score: 5.7
CVE-2006-6072 
SQL injection vulnerability in bpg/publications_list.asp in BPG-InfoTech Easy Publisher and Smart Publisher//Pro 2.7.7 allows remote attackers to execute arbitrary SQL commands via the vjob parameter.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS v2.0 score: 7.5
GHSA-86g9-p235-r7ff 
A Permissions, Privileges, and Access Controls issue was discovered in ABB VSN300 WiFi Logger Card versions 1.8.15 and prior, and VSN300 WiFi Logger Card for React versions 2.1.3 and prior. The web application does not properly restrict privileges of the Guest account. A malicious user may be able to gain access to configuration information that should be restricted.
CVSS v3.0 score: 6.5
RHSA-2024:1566 Red Hat Security Advisory: Red Hat build of MicroShift 4.14.19 security update
golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads
CVSS v3.1 score: 7.5
CVE-2026-47350 TYPO3 CMS - Broken Access Control in DataHandler
Backend users were able to move records to a different page without having edit permissions on the source page. This issue affects TYPO3 CMS versions 13.0.0-13.4.30 and 14.0.0-14.3.2.
CVSS v4.0 score: 5.3
CVE-2014-0723 
Cross-site scripting (XSS) vulnerability in the IP Manager Assistant (IPMA) interface in Cisco Unified Communications Manager (UCM) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCum05343.
CVSS v2.0 score: 4.3
CVE-2016-0806 
The Qualcomm Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows attackers to gain privileges via a crafted application, aka internal bug 25344453.
CVSS v3.0 score: 8.4
CVSS v2.0 score: 7.2
CVE-2026-27645 changedetection.io Vulnerable to Reflected XSS in RSS Single Watch Error Response
changedetection.io is a free open source web page change detection tool. In versions prior to 0.54.1, the RSS single-watch endpoint reflects the UUID path parameter directly in the HTTP response body without HTML escaping. Since Flask returns text/html by default for plain string responses, the browser parses and executes injected JavaScript. Version 0.54.1 contains a fix for the issue.
CVSS v3.1 score: 6.1
RHSA-2024:4264 Red Hat Security Advisory: openldap security update
openldap: null pointer dereference in  ber_memalloc_x  function
CVSS v3.1 score: 7.1
GHSA-2fqv-h3r5-m4vf Cross Site Scripting (XSS) in plotly.js
Affected versions of `plotly.js` are vulnerable to cross-site scripting if an attacker can convince a user to visit a malicious plot on a site using this package.RecommendationUpdate to 1.16.0 or later.
CVSS v3.0 score: 6.1
GHSA-cp64-jc72-8g82 
Buffer overflow in UnrealIRCd 3.2beta11 through 3.2.8, when allow::options::noident is enabled, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.
CVE-2021-26938 
A stored XSS issue exists in henriquedornas 5.2.17 via online live chat. NOTE: Third parties report that no such product exists. That henriquedornas is the web design agency and 5.2.17 is simply the PHP version running on this hosts
CVSS v3.1 score: 5.4
CVSS v2.0 score: 3.5
GHSA-pch7-6gr4-gw9w 
A vulnerability was determined in Open5GS up to 2.7.7. Affected is the function ogs_sbi_subscription_data_add/ogs_sbi_nf_service_add in the library /lib/sbi/context.c of the component NRF. Executing a manipulation can lead to denial of service. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. This patch is called 819db11a08b9736a3576c4f99ceb28f7eb99523a. A patch should be applied to remediate this issue.
CVSS v4.0 score: 2.1
CVSS v3.1 score: 4.3
GHSA-6f8w-f2r8-4fhv 
IBM DevOps Deploy 8.0 through 8.0.1.4, 8.1 through 8.1.0.0 and IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.25, 7.1 through 7.1.2.21, 7.2 through 7.2.3.14 and 7.3 through 7.3.2 could allow an authenticated user to obtain sensitive information about other users on the system due to missing authorization for a function.
CVSS v3.1 score: 4.3
GHSA-2mf7-5579-gcwx 
A User Mode Write AV in Editor+0x76af of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tiff file.
GHSA-x3hv-g95w-vv54 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound rng-refresh allows Reflected XSS. This issue affects rng-refresh: from n/a through 1.0.
CVSS v3.1 score: 7.1
GHSA-766x-vpr9-89vr 
ClipperCMS 1.3.3 has XSS in the "Module name" field in a "Modules -> Manage modules -> edit" action to the manager/ URI.
CVSS v3.0 score: 5.4
CVE-2010-1237 
Google Chrome 4.1 BETA before 4.1.249.1036 allows remote attackers to cause a denial of service (memory error) or possibly have unspecified other impact via an empty SVG element.
CVSS v2.0 score: 7.5
CVE-2025-11550 Tenda W12 HTTP Request modules wifiScheduledSet null pointer dereference
A vulnerability was found in Tenda W12 3.0.0.6(3948). The impacted element is the function wifiScheduledSet of the file /goform/modules of the component HTTP Request Handler. The manipulation of the argument wifiScheduledSet results in null pointer dereference. The attack may be performed from remote. The exploit has been made public and could be used.
CVSS v4.0 score: 7.1
CVSS v3.1 score: 6.5
CVSS v3.0 score: 6.5
CVSS v2.0 score: 6.8
GHSA-w597-fgv7-xfmm 
Vulnerability in the Oracle E-Business Intelligence product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle E-Business Intelligence.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle E-Business Intelligence accessible data as well as  unauthorized access to critical data or complete access to all Oracle E-Business Intelligence accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N).
CVSS v3.1 score: 5.9
CVE-2023-20718 
In vcu, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07645181; Issue ID: ALPS07645181.
CVSS v3.1 score: 6.7
CVE-2023-27768 
An issue found in Wondershare Technology Co.,Ltd PDFelement v9.1.1 allows a remote attacker to execute arbitrary commands via the pdfelement-pro_setup_full5239.exe file.
CVSS v3.1 score: 7.8
CVE-2025-6497 HTACG tidy-html5 parser.c prvTidyParseNamespace assertion
A vulnerability was found in HTACG tidy-html5 5.8.0. It has been rated as problematic. This issue affects the function prvTidyParseNamespace of the file src/parser.c. The manipulation leads to reachable assertion. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 4.8
CVSS v3.1 score: 3.3
CVSS v3.0 score: 3.3
CVSS v2.0 score: 1.7
GHSA-8ccv-3j8r-hx7f 
In the Linux kernel, the following vulnerability has been resolved:jfs: reject on-disk inodes of an unsupported typeSyzbot has reported the following BUG:kernel BUG at fs/inode.c:668!
Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI
CPU: 3 UID: 0 PID: 139 Comm: jfsCommit Not tainted 6.12.0-rc4-syzkaller-00085-g4e46774408d9 #0
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014
RIP: 0010:clear_inode+0x168/0x190
Code: 4c 89 f7 e8 ba fe e5 ff e9 61 ff ff ff 44 89 f1 80 e1 07 80 c1 03 38 c1 7c c1 4c 89 f7 e8 90 ff e5 ff eb b7
 0b e8 01 5d 7f ff 90 0f 0b e8 f9 5c 7f ff 90 0f 0b e8 f1 5c 7f
RSP: 0018:ffffc900027dfae8 EFLAGS: 00010093
RAX: ffffffff82157a87 RBX: 0000000000000001 RCX: ffff888104d4b980
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc900027dfc90 R08: ffffffff82157977 R09: fffff520004fbf38
R10: dffffc0000000000 R11: fffff520004fbf38 R12: dffffc0000000000
R13: ffff88811315bc00 R14: ffff88811315bda8 R15: ffff88811315bb80
FS:  0000000000000000(0000) GS:ffff888135f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005565222e0578 CR3: 0000000026ef0000 CR4: 00000000000006f0
Call Trace:
 <TASK>
 ? __die_body+0x5f/0xb0
 ? die+0x9e/0xc0
 ? do_trap+0x15a/0x3a0
 ? clear_inode+0x168/0x190
 ? do_error_trap+0x1dc/0x2c0
 ? clear_inode+0x168/0x190
 ? __pfx_do_error_trap+0x10/0x10
 ? report_bug+0x3cd/0x500
 ? handle_invalid_op+0x34/0x40
 ? clear_inode+0x168/0x190
 ? exc_invalid_op+0x38/0x50
 ? asm_exc_invalid_op+0x1a/0x20
 ? clear_inode+0x57/0x190
 ? clear_inode+0x167/0x190
 ? clear_inode+0x168/0x190
 ? clear_inode+0x167/0x190
 jfs_evict_inode+0xb5/0x440
 ? __pfx_jfs_evict_inode+0x10/0x10
 evict+0x4ea/0x9b0
 ? __pfx_evict+0x10/0x10
 ? iput+0x713/0xa50
 txUpdateMap+0x931/0xb10
 ? __pfx_txUpdateMap+0x10/0x10
 jfs_lazycommit+0x49a/0xb80
 ? _raw_spin_unlock_irqrestore+0x8f/0x140
 ? lockdep_hardirqs_on+0x99/0x150
 ? __pfx_jfs_lazycommit+0x10/0x10
 ? __pfx_default_wake_function+0x10/0x10
 ? __kthread_parkme+0x169/0x1d0
 ? __pfx_jfs_lazycommit+0x10/0x10
 kthread+0x2f2/0x390
 ? __pfx_jfs_lazycommit+0x10/0x10
 ? __pfx_kthread+0x10/0x10
 ret_from_fork+0x4d/0x80
 ? __pfx_kthread+0x10/0x10
 ret_from_fork_asm+0x1a/0x30
 </TASK>This happens when 'clear_inode()' makes an attempt to finalize an underlying
JFS inode of unknown type. According to JFS layout description from
https://jfs.sourceforge.net/project/pub/jfslayout.pdf, inode types from 5 to
15 are reserved for future extensions and should not be encountered on a valid
filesystem. So add an extra check for valid inode type in 'copy_from_dinode()'.
CVSS v3.1 score: 5.5
GHSA-5mjf-6gr5-jvh8 
A Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in the Flow-processing Daemon (flowd) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (Dos).On SRX Series devices when two different threads try to simultaneously process a queue which is used for TCP events flowd will crash. One of these threads can not be triggered externally, so the exploitation of this race condition is outside the attackers direct control.Continued exploitation of this issue will lead to a sustained DoS.This issue affects Juniper Networks Junos OS:21.2 versions earlier than 21.2R3-S5;21.3 versions earlier than 21.3R3-S5;21.4 versions earlier than 21.4R3-S4;22.1 versions earlier than 22.1R3-S3;22.2 versions earlier than 22.2R3-S1;22.3 versions earlier than 22.3R2-S2, 22.3R3;22.4 versions earlier than 22.4R2-S1, 22.4R3.This issue does not affect Juniper Networks Junos OS versions earlier than 21.2R1.
CVSS v3.1 score: 5.9
GHSA-c58r-vwf8-vx95 
The Passster WordPress plugin before 3.5.5.9 does not properly check for password, as well as that the post to be viewed is public, allowing unauthenticated users to bypass the protection offered by the plugin, and access arbitrary posts (such as private) content, by sending a specifically crafted request.
CVSS v3.1 score: 7.5
CVE-2020-28951 
libuci in OpenWrt before 18.06.9 and 19.x before 19.07.5 may encounter a use after free when using malicious package names. This is related to uci_parse_package in file.c and uci_strdup in util.c.
CVSS v3.1 score: 9.8
CVSS v2.0 score: 10
CVE-2025-70242 
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the webPage parameter to goform/formSetWanPPTP.
CVSS v3.1 score: 7.5
CVE-2020-23312 
There is an Assertion 'context.status_flags & PARSER_SCANNING_SUCCESSFUL' failed at js-parser.c:2185 in parser_parse_source in JerryScript 2.2.0.
CVSS v3.1 score: 7.5
CVSS v2.0 score: 5
CVE-2013-2055 
Unspecified vulnerability in Apache Wicket 1.4.x before 1.4.23, 1.5.x before 1.5.11, and 6.x before 6.8.0 allows remote attackers to obtain sensitive information via vectors that cause raw HTML templates to be rendered without being processed and reading the information that is outside of wicket:panel markup.
CVSS v2.0 score: 5
CVE-2023-1013 XSS in Vira-Investing
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Virames Vira-Investing allows Cross-Site Scripting (XSS).

This issue affects Vira-Investing: before 1.0.84.86.
CVSS v3.1 score: 6.1
CVE-2019-1448 
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'.
CVSS v3.1 score: 7.8
CVSS v2.0 score: 9.3
GHSA-qr79-88qx-7qvc 
An issue was discovered in tp5cms through 2017-05-25. admin.php/system/set.html has XSS via the keywords parameter.
CVSS v3.1 score: 6.1
CVE-2018-15369 Cisco IOS and IOS XE Software TACACS+ Client Denial of Service Vulnerability
A vulnerability in the TACACS+ client subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to improper handling of crafted TACACS+ response packets by the affected software. An attacker could exploit this vulnerability by injecting a crafted TACACS+ packet into an existing TACACS+ session between an affected device and a TACACS+ server or by impersonating a known, valid TACACS+ server and sending a crafted TACACS+ packet to an affected device when establishing a connection to the device. To exploit this vulnerability by using either method, the attacker must know the shared TACACS+ secret and the crafted packet must be sent in response to a TACACS+ request from a TACACS+ client. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.
CVSS v3.0 score: 6.8
CVSS v2.0 score: 7.8
CVE-2002-0014 
URL-handling code in Pine 4.43 and earlier allows remote attackers to execute arbitrary commands via a URL enclosed in single quotes and containing shell metacharacters (&).
CVSS v2.0 score: 7.5
CVE-2004-0941 
Multiple buffer overflows in the gd graphics library (libgd) 2.0.21 and earlier may allow remote attackers to execute arbitrary code via malformed image files that trigger the overflows due to improper calls to the gdMalloc function, a different set of vulnerabilities than CVE-2004-0990.
CVSS v2.0 score: 10
GHSA-2qgm-2hjv-vq52 
This issue was addressed through improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
CVE-2024-0868 coreActivity < 2.1 - Unauthenticated IP Spoofing
The coreActivity: Activity Logging plugin for WordPress plugin before 2.1 retrieved IP addresses of requests via headers such X-FORWARDED to log them, allowing users to spoof them by providing an arbitrary value
CVSS v3.1 score: 5.3
CVE-2015-2594 
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 4.0.32, 4.1.40, 4.2.32, and 4.3.30 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core.
CVSS v2.0 score: 6.6
CVE-2017-7192 
WebSocket.swift in Starscream before 2.0.4 allows an SSL Pinning bypass because of incorrect management of the certValidated variable (it can be set to true but cannot be set to false).
CVSS v3.0 score: 7.5
CVSS v2.0 score: 5
RHSA-2015:2184 Red Hat Security Advisory: realmd security, bug fix, and enhancement update
realmd: untrusted data is used when configuring sssd.conf and/or smb.conf
CVE-2024-27065 netfilter: nf_tables: do not compare internal table flags on updates
In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: do not compare internal table flags on updates

Restore skipping transaction if table update does not modify flags.
CVSS v3.1 score: 7.8
GHSA-259p-rvjx-ffwg Panel::Software Customized WiX .be TEMP folder is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges
Summary.be TEMP folder is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges.DetailsIf the bundle is not run as admin, the user's TEMP folder is used and not the system TEMP folder. A utility is able to monitor the user's TEMP folder for changes and drop its own DLL into the .be/.Local folder immediately when the .be folder is created. When the burn engine elevates, the malicious DLL receives elevated privileges.PoCAs a standard, non-admin user:Monitor the user's TEMP folder for changes using ReadDirectoryChangesWOn FILE_ACTION_ADDED, check if the folder name is .beCreate a folder in .be named after the bundle + .Local (e.g. MyInstaller.exe.Local)Put the malicious COMCTL32.DLL in the .Local folder following the naming used for the real DLL (e.g. MyInstaller.exe.Local/x86_microsoft.windows.common-controls_.../COMCTL32.dll)Do hacker things when the engine escalates and the malicious DLL is loadedProper naming for the path can be obtained by using GetModuleHandle("comctl32.dll") and GetModuleFileName.ImpactDLL redirection utilizing .exe.Local Windows capability. This impacts any installer built with the WiX installer framework.
CVSS v3.1 score: 8.2
CVE-2021-32809 Arbitrary HTML injection vulnerability in ckeditor
ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Clipboard](https://ckeditor.com/cke4/addon/clipboard) package. The vulnerability allowed to abuse paste functionality using malformed HTML, which could result in injecting arbitrary HTML into the editor. It affects all users using the CKEditor 4 plugins listed above at version >= 4.5.2. The problem has been recognized and patched. The fix will be available in version 4.16.2.
CVSS v3.1 score: 4.6
CVE-2024-51106 
A cross-site scripting (XSS) vulnerability in the component mcgs/admin/aboutus.php of PHPGURUKUL Medical Card Generation System using PHP and MySQL v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the pagetitle parameter.
CVSS v3.1 score: 4.6
RHSA-2025:12013 Red Hat Security Advisory: rsync security update
zlib: Out-of-bound pointer arithmetic in inftrees.c
CVSS v3.0 score: 8.8
GHSA-3f6w-864h-4prm 
An out-of-bounds heap buffer access issue was found in the ARM Generic Interrupt Controller emulator of QEMU up to and including qemu 4.2.0on aarch64 platform. The issue occurs because while writing an interrupt ID to the controller memory area, it is not masked to be 4 bits wide. It may lead to the said issue while updating controller state fields and their subsequent processing. A privileged guest user may use this flaw to crash the QEMU process on the host resulting in DoS scenario.
CVSS v3.1 score: 6
CVE-2025-27916 
An issue was discovered in AnyDesk for Windows before 9.0.6 and AnyDesk for Android before 8.0.0. When the connection between two clients is established via an IP address, it is possible to manipulate the data and spoof the AnyDesk ID.
CVSS v3.1 score: 7.5
GHSA-jf75-x4f2-r8c9 
Infoblox NIOS through 8.6.4 and 9.x through 9.0.3 has Improper Input Validation.
CVSS v3.1 score: 9.8
GHSA-qc26-5j5x-3jw8 
The Wp Cookie Choice WordPress plugin through 1.1.0 is lacking any CSRF check when saving its options, and do not escape them when outputting them in attributes. As a result, an attacker could make a logged in admin change them to arbitrary values including XSS payloads via a CSRF attack.
CVSS v3.1 score: 6.5
GHSA-j6g4-hg9x-qfvx 
A vulnerability was found in LakshayD02 Hostel-Management-System-PHP up to f87e67c283bab6f718faf2fec6ae39a13bd7036b. This issue affects some unknown processing of the file hostel/index.php of the component Admin Dashboard Page. The manipulation of the argument ID results in missing authorization. The attack can be launched remotely. The exploit has been made public and could be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
CVSS v4.0 score: 2.1
CVSS v3.1 score: 6.3
CVE-2001-1072 
Apache with mod_rewrite enabled on most UNIX systems allows remote attackers to bypass RewriteRules by inserting extra / (slash) characters into the requested path, which causes the regular expression in the RewriteRule to fail.
CVSS v2.0 score: 5
GHSA-3mmm-g63g-fr84 
The Sixfab-Tool in PyPI v0.0.2 to v0.0.3 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
CVSS v3.1 score: 9.8
CVE-2018-4451 
This issue is fixed in macOS Mojave 10.14. A memory corruption issue was addressed with improved input validation.
CVSS v3.1 score: 7.8
CVSS v2.0 score: 9.3
GHSA-qgrw-j67r-q423 
An issue was discovered in ABOOT in OnePlus 3 and 3T OxygenOS before 4.0.2. The attacker can reboot the device into the fastboot mode, which could be done without any authentication. A physical attacker can press the "Volume Up" button during device boot, where an attacker with ADB access can issue the adb reboot bootloader command. Then, the attacker can put the platform's SELinux in permissive mode, which severely weakens it, by issuing: fastboot oem selinux permissive.
CVSS v3.0 score: 8.1
CVE-2019-5692 
NVIDIA Windows GPU Display Driver, all versions, contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape in which the product uses untrusted input when calculating or using an array index, which may lead to escalation of privileges or denial of service.
CVSS v3.1 score: 7.8
CVSS v2.0 score: 7.2
CVE-2000-0086 
Netopia Timbuktu Pro sends user IDs and passwords in cleartext, which allows remote attackers to obtain them via sniffing.
CVSS v2.0 score: 5
GHSA-wgp5-w6wq-7x25 
The ReadOneDJVUImage function in coders/djvu.c in ImageMagick through 6.9.9-0 and 7.x through 7.0.6-1 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a malformed DJVU image.
CVSS v3.0 score: 6.5
GHSA-vw94-38cw-wj37 
In the Linux kernel, the following vulnerability has been resolved:usb: phy: phy-tahvo: fix memory leak in tahvo_usb_probe()Smatch reports:
drivers/usb/phy/phy-tahvo.c: tahvo_usb_probe()
warn: missing unwind goto?After geting irq, if ret < 0, it will return without error handling to
free memory.
Just add error handling to fix this problem.
CVSS v3.1 score: 5.5
CVE-2024-31369 WordPress Soledad theme <= 8.4.2 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in PenciDesign Soledad.This issue affects Soledad: from n/a through 8.4.2.
CVSS v3.1 score: 5.4
CVE-2001-0188 
GoodTech FTP server 3.0.1.2.1.0 and earlier allows remote attackers to cause a denial of service via a flood of connections to the server, which causes it to crash.
CVSS v2.0 score: 5
CVE-2021-47063 drm: bridge/panel: Cleanup connector on bridge detach
In the Linux kernel, the following vulnerability has been resolved:

drm: bridge/panel: Cleanup connector on bridge detach

If we don't call drm_connector_cleanup() manually in
panel_bridge_detach(), the connector will be cleaned up with the other
DRM objects in the call to drm_mode_config_cleanup(). However, since our
drm_connector is devm-allocated, by the time drm_mode_config_cleanup()
will be called, our connector will be long gone. Therefore, the
connector must be cleaned up when the bridge is detached to avoid
use-after-free conditions.

v2: Cleanup connector only if it was created

v3: Add FIXME

v4: (Use connector->dev) directly in if() block
CVSS v3.1 score: 7.8
GHSA-gp65-637x-5v3w 
Vulnerability in Wikimedia Foundation ConfirmEdit. This vulnerability is associated with program files includes/FancyCaptcha/ApiFancyCaptchaReload.Php.This issue affects ConfirmEdit: *.
CVSS v4.0 score: 0
GHSA-5wmv-gcg2-v47h 
An authorization flaw was found in Pacemaker before 1.1.16, where it did not properly guard its IPC interface. An attacker with an unprivileged account on a Pacemaker node could use this flaw to, for example, force the Local Resource Manager daemon to execute a script as root and thereby gain root access on the machine.
CVSS v3.0 score: 7.8
GHSA-85fp-523q-5xwc rdiffweb vulnerable to Cross-Site Request Forgery
rdiffweb prior to version 2.5.4 is vulnerable to Cross-Site Request Forgery (CSRF).
CVSS v4.0 score: 7.1
CVSS v3.1 score: 6.5
CVE-2026-21226 Azure Core shared client library for Python Remote Code Execution Vulnerability
Deserialization of untrusted data in Azure Core shared client library for Python allows an authorized attacker to execute code over a network.
CVSS v3.1 score: 7.5
GHSA-jm45-hjcw-qv8r 
Potential out of bound read exception when UE receives unusually large number of padding octets in the beginning of ROHC header in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVE-2014-1743 
Use-after-free vulnerability in the StyleElement::removedFromDocument function in core/dom/StyleElement.cpp in Blink, as used in Google Chrome before 35.0.1916.114, allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted JavaScript code that triggers tree mutation.
CVSS v2.0 score: 7.5
CVE-2006-0854 
PHP remote file inclusion vulnerability in common.php in Intensive Point iUser Ecommerce allows remote attackers to include arbitrary files via a URL in the include_path variable, which is not initialized before being used.
CVSS v2.0 score: 7.5
CVE-2018-18391 
User Privilege Escalation in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.
CVSS v3.0 score: 8.8
CVSS v2.0 score: 6.5
CVE-2010-1021 
Cross-site scripting (XSS) vulnerability in the Typo3 Quixplorer (t3quixplorer) extension before 1.7.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS v2.0 score: 4.3
ICSA-26-113-01 Yadea T5 Electric Bicycle
Yadea T5 Electric Bicycles have a weak authentication mechanism which is vulnerable to signal forgery after a local attacker intercepts any legitimate key fob transmissions.
CVSS v3.1 score: 7.3
CVE-2016-6415 
The server IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.6, IOS XE through 3.18S, IOS XR 4.3.x and 5.0.x through 5.2.x, and PIX before 7.0 allows remote attackers to obtain sensitive information from device memory via a Security Association (SA) negotiation request, aka Bug IDs CSCvb29204 and CSCvb36055 or BENIGNCERTAIN.
CVSS v3.1 score: 7.5
CVSS v2.0 score: 5
CVE-2026-33565 kernel_linux_common_modules has a Race Condition vulnerability
in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS.
CVSS v3.1 score: 3.3
CVE-2011-0203 
Absolute path traversal vulnerability in xftpd in the FTP Server component in Apple Mac OS X before 10.6.8 allows remote attackers to list arbitrary directories by using the root directory as the starting point of a recursive listing.
CVSS v2.0 score: 5
GHSA-4frg-rpx6-96qh Liferay Portal Layout Module and Liferay DXP Exposes the Cross-Site Request Forgery (CSRF) Token in URLs
The Layout module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 6, exposes the CSRF token in URLs, which allows man-in-the-middle attackers to obtain the token and conduct Cross-Site Request Forgery (CSRF) attacks via the p_auth parameter.
CVSS v3.1 score: 7.5
GHSA-6ghc-48vx-2m7g 
In core_info_read and inst_info_read in all Android releases from CAF using the Linux kernel, variable "dbg_buf", "dbg_buf->curr" and "dbg_buf->filled_size" could be modified by different threads at the same time, but they are not protected with mutex or locks. Buffer overflow is possible on race conditions. "buffer->curr" itself could also be overwritten, which means that it may point to anywhere of kernel memory (for write).
CVSS v3.1 score: 7
RHSA-2022:0843 Red Hat Security Advisory: thunderbird security update
thunderbird: Crafted email could trigger an out-of-bounds write expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution expat: Namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution expat: Integer overflow in storeRawNames() Mozilla: Use-after-free in text reflows Mozilla: Browser window spoof using fullscreen mode Mozilla: iframe allow-scripts sandbox bypass Mozilla: Temporary files downloaded to /tmp and accessible by other local users Mozilla: Time-of-check time-of-use bug when verifying add-on signatures Mozilla: Use-after-free in XSLT parameter processing Mozilla: Use-after-free in WebGPU IPC Framework
CVSS v3.1 score: 8.8
CVSS v3.0 score: 7.5
GHSA-qhhf-5wqx-9f99 
IBM Cognos Business Intelligence 10.2, 10.2.1, 10.2.1.1, and 10.2.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 128624.
CVSS v3.0 score: 6.1
CVE-2017-18673 
An issue was discovered on Samsung mobile devices with N(7.x) software. An attacker can disable the Location service on a locked device, making it impossible for the rightful owner to find a stolen device. The Samsung ID is SVE-2017-8524 (May 2017).
CVSS v3.1 score: 2.4
CVSS v2.0 score: 2.1
RHSA-2022:1539 Red Hat Security Advisory: xmlrpc-c security update
expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution
CVSS v3.1 score: 9.8
CVE-2026-56774 Kanboard - Cross-User Deletion of Persistent Login Sessions via Unvalidated Session ID
Kanboard through 1.2.52, fixed in commit 928c68a, UserViewController::removeSession fails to validate the session id parameter before passing it to RememberMeSessionModel::remove, allowing authenticated users to delete other users' Remember Me sessions. Attackers can enumerate sequential session IDs and mass-invalidate persistent login sessions of any user, including administrators, forcing re-authentication and causing denial of service.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 5.4
GHSA-cx98-m4w9-fjjw 
Stored XSS in the Filters page (Name field) in ZoneMinder 1.32.3 allows a malicious user to embed and execute JavaScript code in the browser of any user who navigates to this page.
CVSS v3.1 score: 5.4
GHSA-q66x-hpg8-2g43 
Lout 3.40 has a heap-based buffer overflow in the srcnext() function in z02.c.
CVSS v3.1 score: 7.8
CVE-2024-37064 
Deseriliazation of untrusted data can occur in versions 3.7.0 or newer of Ydata's ydata-profiling open-source library, enabling a maliciously crafted dataset to run arbitrary code on an end user's system when loaded.
CVSS v3.1 score: 7.8
GHSA-pxj4-78jw-m85v 
The web interface of the Silicon Labs Simplicity Device Manager is exposed publicly and can be used to extract the NTLMv2 hash which an attacker could use to crack the user's domain password.
CVSS v4.0 score: 7.4
GHSA-m7fx-pjvc-f2ch 
Online Book Store Project v1.0 is vulnerable to SQL Injection via /bookstore/bookPerPub.php.
CVSS v3.1 score: 9.8
GHSA-mc74-x78c-h295 
In the Linux kernel, the following vulnerability has been resolved:wifi: mwifiex: fix permanently busy scans after multiple roam iterationsIn order for the firmware to sleep, the driver has to confirm a
previously received sleep request. The normal sequence of evets goes
like this:
EVENT_SLEEP -> adapter->ps_state = PS_STATE_PRE_SLEEP -> sleep-confirm
-> SLEEP -> EVENT_AWAKE -> AWAKE.
Before sending the sleep-confirm command, the driver must make sure
there are no commands either running or waiting to be completed.mwifiex_ret_802_11_associate() unconditionally sets
ps_state = PS_STATE_AWAKE when it processes the association command
response, outside of the normal powersave management flow. If
EVENT_SLEEP arrives while the association command is in flight,
ps_state is PRE_SLEEP when the association command response is parsed,
and the forced AWAKE overwrites it. The deferred sleep-confirm is
never sent.A subsequent scan_start command is correctly acknowledged, but the
firmware doesn't generate scan_result events. The scan request never
finishes, and additional requests from userspace fail with -EBUSY.After testing on both IW412 and W8997, I could only trigger the bug on
the IW412 and observed the firmwares behave differently. On the IW412
the firmware still sends EVENT_SLEEP while the authentication /
association process is ongoing. A W8997 under the same
conditions seems to suppress power-save for the duration of the
association, so PRE_SLEEP never coincided with the association response
even after extended periods of testing using the loops
described below (>12hours).On the IW412, the delay between commands that triggers an EVENT_SLEEP
was empirically determined to be ~20ms. This delay can naturally occur
when the driver is outputting debugging information
(debug_mask = 0x00000037), in which situation the busy scans issue is
repeatable while running "test 1)" as described below. If the delay
between commands is less than ~20ms, the firmware stays awake and
the issue was not reproducible running the same test.The host_mlme=false path also behaves differently. In this case, the
entire authentication / association transaction is executed by one
command (HostCmd_CMD_802_11_ASSOCIATE), and the firmware doesn't emit
EVENT_SLEEP while the command is running.Remove the assignment so the ps_state is only manipulated in the paths
that are related to powersave event handling and on the main workqueue
for correct sleep confirmation.The following loop tests were performed (with debugging output enabled):force roaming between two AP's, one 5GHz and one 2.4GHz, same
SSID. Use wpa_cli to trigger the roaming behavior, sleep 2s
between iterations.force a disconnection to AP 1 and a connection to AP 2, test
scan. Use wpa_cli to trigger the connection changes, sleep 2s
between iterations.Each test ran in each device for at least 3 hours.
GHSA-5qxq-vgmm-q39m RCE vulnerability in Pimcore/Mail & Dynamic Text Layout
ImpactThe user controlled twig templates rendering in `Pimcore/Mail` & `ClassDefinition\Layout\Text` is vulnerable to server-side template Injection RCE.PatchesUpdate to version 10.5.9 or apply this patch manually https://github.com/pimcore/pimcore/pull/13347.patchWorkaroundsApply https://github.com/pimcore/pimcore/pull/13347.patch manually.ReferencesCredits: @nth347 from Viettel Cyber Security
CVSS v3.1 score: 9.8
CVE-2020-4422 
IBM i2 Intelligent Analyis Platform 9.2.1 could allow a remote attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a victim to open a specially crafted file, a remote attacker could exploit this vulnerability to execute arbitrary code on the system or cause the application to crash. IBM X-Force ID: 180167.
CVSS v3.0 score: 7.8
CVE-2024-42788 
A Stored Cross Site Scripting (XSS) vulnerability was found in "/music/ajax.php?action=save_music" in Kashipara Music Management System v1.0. This vulnerability allows remote attackers to execute arbitrary code via "title" & "artist" parameter fields.
CVSS v3.1 score: 6.1
GHSA-fqfx-pf4p-4w43 
Adobe Experience Manager versions 6.2 and earlier have a vulnerability that could be used in Cross-Site Request Forgery attacks.
CVSS v3.0 score: 8.8
GHSA-3h64-fx5v-2f3q 
The WP User Manager plugin for WordPress is vulnerable to Arbitrary File Deletion in all versions up to, and including, 2.9.12. This is due to insufficient validation of user-supplied file paths in the profile update functionality combined with improper handling of array inputs by PHP's filter_input() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server via the 'current_user_avatar' parameter in a two-stage attack which can make remote code execution possible. This only affects sites with the custom avatar setting enabled.
CVSS v3.1 score: 6.8
CVE-2020-15927 
Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated SQL Injection via a crafted jsp request in the SAP module.
CVSS v3.1 score: 8.8
CVSS v2.0 score: 6.5
RHSA-2025:16455 Red Hat Security Advisory: Red Hat Product OCP Tools 4.18 Openshift Jenkins security update
jetty: HTTP/2 (including DNS over HTTPS) contains a design flaw and is vulnerable to "MadeYouReset" DoS attack through HTTP/2 control frames
CVSS v3.1 score: 7.5
CVE-2025-55123 
Improper neutralization of input in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes manager accounts to be able to craft XSS attacks to their own advertiser users.
CVSS v3.0 score: 3.5
CVE-2024-28955 
Affected devices create coredump files when crashed, storing them with world-readable permission. Any local user of the device can examine the coredump files, and research the memory contents. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].
CVSS v3.1 score: 5.9
GHSA-422f-2r32-f82h 
In the Linux kernel, the following vulnerability has been resolved:scsi: qla2xxx: Wait for io return on terminate rportSystem crash due to use after free.
Current code allows terminate_rport_io to exit before making
sure all IOs has returned. For FCP-2 device, IO's can hang
on in HW because driver has not tear down the session in FW at
first sign of cable pull. When dev_loss_tmo timer pops,
terminate_rport_io is called and upper layer is about to
free various resources. Terminate_rport_io trigger qla to do
the final cleanup, but the cleanup might not be fast enough where it
leave qla still holding on to the same resource.Wait for IO's to return to upper layer before resources are freed.
CVSS v3.1 score: 7.8
GHSA-5c59-7337-gvv9 
A vulnerability where a WebExtension can run content scripts in disallowed contexts following navigation or other events. This allows for potential privilege escalation by the WebExtension on sites where content scripts should not be run. This vulnerability affects Firefox ESR < 60.3 and Firefox < 63.
CVSS v3.0 score: 6.5
CVE-2023-52195 WordPress Posts to Page Plugin <= 1.7 is vulnerable to Cross Site Scripting (XSS)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Posts to Page Kerry James allows Stored XSS.This issue affects Kerry James: from n/a through 1.7.
CVSS v3.1 score: 6.5
CVE-2026-5604 Tenda CH22 Parameter CertLocalPrecreate formCertLocalPrecreate stack-based overflow
A security flaw has been discovered in Tenda CH22 1.0.0.1. The impacted element is the function formCertLocalPrecreate of the file /goform/CertLocalPrecreate of the component Parameter Handler. Performing a manipulation of the argument standard results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
CVSS v4.0 score: 8.7
CVSS v3.1 score: 8.8
CVSS v3.0 score: 8.8
CVSS v2.0 score: 9
PYSEC-2025-149 
A remote code execution (RCE) vulnerability in the Plugin Management component of OpenC3 COSMOS v6.0.0 allows attackers to execute arbitrary code via uploading a crafted .txt file.
CVSS v3.1 score: 9.8