CIRCL/vulnerability-scores huggingface dataset:
GHSA-v892-hwpg-jwqp OpenClaw vulnerable to path traversal (Zip Slip) in archive extraction during explicit installation commands
SummaryA path traversal (Zip Slip) issue in archive extraction during explicit installation commands could allow a crafted archive to write files outside the intended extraction directory.Affected Packages / VersionsPackage: `openclaw` (npm)Affected versions: `>=2026.1.16-2 <2026.2.14`Fixed version: `2026.2.14`Affected Commands / FlowsThis only affects users who run installation commands against an untrusted archive (local file or download URL), for example:`openclaw skills install` (download+extract installers)`openclaw hooks install` (archive installs)`openclaw plugins install` (archive installs)`openclaw signal install` (signal-cli asset extraction)It is not triggered by receiving messages or normal gateway operation.ImpactArbitrary file write as the current user. In the worst case this can be used for persistence or code execution if an attacker can convince a user to install a crafted archive.FixFix commit: `3aa94afcfd12104c683c9cad81faf434d0dadf87`Released in: `2026.2.14`CreditsOpenClaw thanks @markmusson for reporting.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 6.1
CVE-2021-24611 Keywords & Meta <= 3.0 - CSRF to Stored Cross-Site Scripting (XSS)
The Keyword Meta WordPress plugin through 3.0 does not sanitise of escape its settings before outputting them back in the page after they are saved, allowing for Cross-Site Scripting issues. Furthermore, it is also lacking any CSRF check, allowing attacker to make a logged in high privilege user save arbitrary setting via a CSRF attack.
CVSS v3.1 score: 5.4
CVSS v2.0 score: 3.5
CVE-2026-52474 
An issue in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the JobUtil.java file.
CVSS v3.1 score: 7.5
CVE-2008-2848 
Cross-site scripting (XSS) vulnerability in the search functionality in MindTouch DekiWiki before 8.05.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS v2.0 score: 4.3
CVE-2014-4668 
The cherokee_validator_ldap_check function in validator_ldap.c in Cherokee 1.2.103 and earlier, when LDAP is used, does not properly consider unauthenticated-bind semantics, which allows remote attackers to bypass authentication via an empty password.
CVSS v2.0 score: 6.8
CVE-2006-6595 
Multiple SQL injection vulnerabilities in ScriptMate User Manager 2.1 and earlier allow remote attackers to execute arbitrary SQL commands via "Manage Resources" and possibly other unspecified components.
CVSS v2.0 score: 7.5
CVE-2025-25960 
Cross Site Scripting vulnerability in phpcmsv9 v.9.6.3 allows a remote attacker to escalate privileges via the menu interface of the member center of the background administrator.
CVSS v3.1 score: 6.1
GHSA-mxjm-rf6p-f3mh 
Multiple stack-based buffer overflow vulnerabilities exist in the FST LEB128 varint functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the fstReaderVarint32WithSkip function.
CVSS v3.1 score: 7.8
GHSA-w99c-x9xf-3prr 
A vulnerability has been identified in LineInst.exe (LINE for Windows) prior to version 26.4.0, where Msftedit.dll is loaded via a relative path without a secure DLL search path, allowing a malicious DLL placed in the installer's directory to be loaded ahead of the legitimate System32 copy.
CVSS v4.0 score: 8.4
GHSA-72pc-mw67-6f3f 
An access issue was addressed with improved access restrictions. This issue is fixed in macOS Sequoia 15.4, tvOS 18.4, macOS Ventura 13.7.5, iPadOS 17.7.6, macOS Sonoma 14.7.5, iOS 18.4 and iPadOS 18.4, visionOS 2.4. An unauthenticated user on the same network as a signed-in Mac could send it AirPlay commands without pairing.
CVSS v3.1 score: 6.2
CVE-2013-4325 
The check_permission_v1 function in base/pkit.py in HP Linux Imaging and Printing (HPLIP) through 3.13.9 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process.
CVSS v2.0 score: 6.9
GHSA-9jhc-m2f9-xm2h 
OOB read vulnerability in libsaviextractor.so library prior to SMR Sep-2021 Release 1 allows attackers to access arbitrary address through pointer via forged avi file.
GHSA-5fph-w2jf-g27h 
OleumTech Wireless Sensor Network devices allow remote attackers to obtain sensitive information about sensor nodes or spoof devices by reading cleartext protocol data.
CVSS v3.0 score: 5.9
GHSA-vv59-x63g-cp8m 
Client-Side Enforcement of Server-Side Security vulnerability in Gobito Informatics Technologies Engineering Industry and Trade Ltd. Co. Corporate Training Management System allows Input Data Manipulation.This issue affects Corporate Training Management System: before dd1a9df64.
CVSS v3.1 score: 4.3
CVE-2023-46675 Kibana Insertion of Sensitive Information into Log File
An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error or in the event where debug level logging is enabled in Kibana. Elastic has released Kibana 8.11.2 which resolves this issue. The messages recorded in the log may contain Account credentials for the kibana_system user, API Keys, and credentials of Kibana end-users, Elastic Security package policy objects which can contain private keys, bearer token, and sessions of 3rd-party integrations and finally Authorization headers, client secrets, local file paths, and stack traces. The issue may occur in any Kibana instance running an affected version that could potentially receive an unexpected error when communicating to Elasticsearch causing it to include sensitive data into Kibana error logs. It could also occur under specific circumstances when debug level logging is enabled in Kibana. Note: It was found that the fix for ESA-2023-25 in Kibana 8.11.1 for a similar issue was incomplete.

CVSS v3.1 score: 8
GHSA-w93m-f8fx-95gr 
Insufficient validation of untrusted input in Skia in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVSS v3.1 score: 8.3
GHSA-5vwg-c233-4qjm 
Cross-site request forgery (CSRF) vulnerability in the BrowserID (Mozilla Persona) module 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that login a user to another web site.
GHSA-vqwm-p8j6-626q 
Use after free in Windows DNS allows an authorized attacker to execute code over a network.
CVSS v3.1 score: 7.5
GHSA-h423-w6qv-2wj3 parse-server crashes when receiving file download request with invalid byte range
ImpactParse Server crashes when a file download request is received with an invalid byte range.PatchesImproved parsing of the range parameter to properly handle invalid range requests.WorkaroundsNoneReferences[GHSA-h423-w6qv-2wj3](https://github.com/parse-community/parse-server/security/advisories/GHSA-h423-w6qv-2wj3)
CVSS v3.1 score: 7.5
RHSA-2025:8384 Red Hat Security Advisory: Red Hat multicluster global hub 1.4.1 bug fixes and container updates
golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing
CVSS v3.1 score: 7.5
CVE-2004-0506 
The SPNEGO dissector in Ethereal 0.9.8 to 0.10.3 allows remote attackers to cause a denial of service (crash) via unknown attack vectors that cause a null pointer dereference.
CVSS v2.0 score: 5
GHSA-3fx4-r3hw-w575 
Laurentiu Matei eXpandable Home Page (XHP) CMS 0.5 and earlier allows remote authenticated users to use the HTMLArea FileManager plugin to upload and execute arbitrary PHP files using (1) manager.php, (2) standalonemanager.php, and (3) images.php.
CVE-2024-12082 Ability Runtime has an out-of-bounds read permission bypass vulnerability
in OpenHarmony v4.0.0 and prior versions allow a local attacker cause information leak through out-of-bounds Read.
CVSS v3.1 score: 5.5
CVE-2025-62655 SQL injection in Cargo via Special:CargoExport
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foundation MediaWiki Cargo extension allows SQL Injection.This issue affects MediaWiki Cargo extension: 1.39, 1.43, 1.44.
CVSS v4.0 score: 2.1
GHSA-962w-cpjq-678w 
Baby FTP Server (BabyFTP) 1.2, and possibly other versions before May 31, 2003, allows remote attackers to cause a denial of service via a large number of connections from the same IP address, which triggers an access violation.
CVE-2017-10902 
PTW-WMS1 firmware version 2.000.012 allows remote attackers to execute arbitrary OS commands via unspecified vectors.
CVSS v3.0 score: 9.8
CVSS v2.0 score: 10
CVE-2007-3492 
Conti FtpServer 1.0 allows remote authenticated users to cause a denial of service (daemon crash) via a certain string containing "//A:" in the argument to the LIST command.
CVSS v2.0 score: 6.8
GHSA-qf4q-78jp-hmfh 
Unauthenticated Local File Inclusion in Reprizo <= 1.0.8 versions.
CVSS v3.1 score: 8.1
CVE-2026-15476 QILING Disk Master Kernel Driver diskbckp.sys access control
A security vulnerability has been detected in QILING Disk Master 6.0.0.0. The impacted element is an unknown function in the library diskbckp.sys of the component Kernel Driver. Such manipulation leads to improper access controls. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. It is suggested to upgrade the affected component.
CVSS v4.0 score: 4.8
CVSS v3.1 score: 5.3
CVSS v3.0 score: 5.3
CVSS v2.0 score: 4.3
GHSA-mc4m-5rw2-vpwv 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Templines TM Islamic Helper allows Reflected XSS.This issue affects TM Islamic Helper: from n/a through 1.0.1.
CVSS v3.1 score: 7.1
GHSA-34vw-m4rh-r36p Talos vulnerable dependency due to race condition in Linux kernel's IP framework XFRM
ImpactA race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem) when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read and copying it into a socket.PatchesThe fix has been backported to [5.15.64](https://www.linuxkernelcves.com/cves/CVE-2022-3028) version of the upstream Linux kernel (5.15 is the upstream Kernel long term version Talos ships with). Talos >= v1.2.0 is shipped with Linux Kernel 5.15.64 fixing the above issue.Kubernetes workloads running in Talos are not affected since user namespaces are disabled in Talos kernel config. So an unprivileged user cannot obtain CAP_NET_ADMIN by unsharing. However untrusted workloads that run with privileged: true or having NET_ADMIN capability poses a risk.WorkaroundsAudit kubernetes workloads running in the cluster with privileged: true set or having NET_ADMIN capability and assess the threat vector.Referenceshttps://nvd.nist.gov/vuln/detail/CVE-2022-3028https://access.redhat.com/security/cve/CVE-2022-3028For more informationEmail us at [security@siderolabs.com](mailto:security@siderolabs.com)
CVSS v3.1 score: 7
CVE-2022-32052 
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc parameter in the function FUN_004137a4.
CVSS v3.1 score: 7.5
CVSS v2.0 score: 5
GHSA-vqqx-jw6p-q3rf Cross-Site Scripting in Fluid view helpers
MetaCVSS: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (5.7)CWE-79ProblemIt has been discovered that system extension Fluid (`typo3/cms-fluid`) of the TYPO3 core is vulnerable to cross-site scripting passing user-controlled data as argument to Fluid view helpers.SolutionUpdate to TYPO3 versions 9.5.23 or 10.4.10 that fix the problem described.CreditsThanks to TYPO3 security team member Oliver Hader who reported this issue and to TYPO3 security team members Helmut Hummel & Oliver Hader who fixed the issue.References[TYPO3-CORE-SA-2020-010](https://typo3.org/security/advisory/typo3-core-sa-2020-010)
CVSS v3.1 score: 6.1
GHSA-wr2r-3r87-rxfx 
The Cart66 Cloud plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.3.7 through the publicly accessible phpinfo.php script. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed file.
CVSS v3.1 score: 5.3
CVE-2015-5540 
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5127, CVE-2015-5130, CVE-2015-5134, CVE-2015-5539, CVE-2015-5550, CVE-2015-5551, CVE-2015-5556, CVE-2015-5557, CVE-2015-5559, CVE-2015-5561, CVE-2015-5563, CVE-2015-5564, and CVE-2015-5565.
CVSS v2.0 score: 10
GHSA-pv6w-6xw6-fcqg 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noah Kagan Scroll Triggered Box allows Stored XSS.This issue affects Scroll Triggered Box: from n/a through 2.3.
CVSS v3.1 score: 6.5
GHSA-3w46-g3w3-qj67 
In Real Player 20.0.7.309 and 20.0.8.310, external::Import() allows download of arbitrary file types and Directory Traversal, leading to Remote Code Execution. This occurs because it is possible to plant executables in the startup folder (DLL planting could also occur).
CVSS v3.1 score: 9.8
CVE-2014-6366 
Microsoft Internet Explorer 6 and 7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS v2.0 score: 9.3
GHSA-3c8v-cfp5-9885 Electron: Out-of-bounds read in second-instance IPC on macOS and Linux
ImpactOn macOS and Linux, apps that call `app.requestSingleInstanceLock()` were vulnerable to an out-of-bounds heap read when parsing a crafted second-instance message. Leaked memory could be delivered to the app's `second-instance` event handler.This issue is limited to processes running as the same user as the Electron app.Apps that do not call `app.requestSingleInstanceLock()` are not affected. Windows is not affected by this issue.WorkaroundsThere are no app side workarounds, developers must update to a patched version of Electron.Fixed Versions`41.0.0``40.8.1``39.8.1``38.8.6`For more informationIf there are any questions or comments about this advisory, please email [security@electronjs.org](mailto:security@electronjs.org)
CVSS v3.1 score: 5.3
CVE-2025-23732 WordPress Easy Filtering plugin <= 2.5.0 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in franciscopalacios Easy Filtering easy-filtering allows Reflected XSS.This issue affects Easy Filtering: from n/a through <= 2.5.0.
CVSS v3.1 score: 7.1
GHSA-xp27-mhxx-q8mf 
A buffer overflow vulnerability in the authd component of the PAN-OS management server allows authenticated administrators to disrupt system processes and potentially execute arbitrary code with root privileges. This issue affects: All versions of PAN-OS 7.1 and PAN-OS 8.0; PAN-OS 8.1 versions earlier than PAN-OS 8.1.13; PAN-OS 9.0 versions earlier than PAN-OS 9.0.7.
CVE-2024-0717 D-Link Good Line Router v2 HTTP GET Request devinfo information disclosure
A vulnerability classified as critical was found in D-Link DAP-1360, DIR-300, DIR-615, DIR-615GF, DIR-615S, DIR-615T, DIR-620, DIR-620S, DIR-806A, DIR-815, DIR-815AC, DIR-815S, DIR-816, DIR-820, DIR-822, DIR-825, DIR-825AC, DIR-825ACF, DIR-825ACG1, DIR-841, DIR-842, DIR-842S, DIR-843, DIR-853, DIR-878, DIR-882, DIR-1210, DIR-1260, DIR-2150, DIR-X1530, DIR-X1860, DSL-224, DSL-245GR, DSL-2640U, DSL-2750U, DSL-G2452GR, DVG-5402G, DVG-5402G, DVG-5402GFRU, DVG-N5402G, DVG-N5402G-IL, DWM-312W, DWM-321, DWR-921, DWR-953 and Good Line Router v2 up to 20240112. This vulnerability affects unknown code of the file /devinfo of the component HTTP GET Request Handler. The manipulation of the argument area with the input notice|net|version leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-251542 is the identifier assigned to this vulnerability.
CVSS v3.1 score: 5.3
CVSS v3.0 score: 5.3
CVSS v2.0 score: 5
GHSA-2fph-6v5w-89hh Craft CMS is Vulnerable to Authenticated Remote Code Execution via Malicious Attached Behavior
SummaryA Remote Code Execution (RCE) vulnerability exists in Craft CMS 5.x and 4.x that bypasses the security fixes for GHSA-7jx7-3846-m7w7 and GHSA-255j-qw47-wjh5. This vulnerability can be exploited by any authenticated user with control panel access.The existing patches add `cleanseConfig()` to `assembleLayoutFromPost()` and various `FieldsController` actions to strip Yii2 behavior/event injection keys (`as ` and `on ` prefixed keys). However, the `fieldLayouts` parameter in `ElementIndexesController::actionFilterHud()` is passed directly to `FieldLayout::createFromConfig()` without any sanitization, enabling the same behavior injection attack chain.Impact**Attack Type**: Remote Code Execution (RCE)**Authentication Required**: Authenticated user with control panel access (`accessCp` permission)Vulnerability DetailsRoot CauseIn `ElementIndexesController::actionFilterHud()` (line 493-494), the `fieldLayouts` body parameter is passed to `FieldLayout::createFromConfig()` without `cleanseConfig()`:Note the inconsistency: `conditionConfig` is sanitized with `cleanseConfig()`, but `fieldLayouts` is not.Attack ChainSend a `fieldLayouts` array containing config with `"as <name>"` prefixed keys`FieldLayout::createFromConfig($config)` -> `new self($config)` -> `Model::__construct($config)``App::configure($this, $config)` processes each key`"as rce"` key -> `Component::__set("as rce", $value)` -> `Yii::createObject($value)` -> instantiates `AttributeTypecastBehavior` and attaches it to the FieldLayout`"on *"` key -> registers a wildcard event handler`parent::__construct()` -> `init()` -> `setTabs([])` -> `getAvailableNativeFields()` -> `trigger(EVENT_DEFINE_NATIVE_FIELDS)`The wildcard handler fires -> `AttributeTypecastBehavior::beforeSave()` -> `typecastAttributes()``$this->owner->typecastBeforeSave` -> resolved via `Component::__get()` -> returns the command string from the behavior's own property`call_user_func([ConsoleProcessus::class, 'execute'], $command)` -> `shell_exec($command)`PrerequisitesA user account with control panel access
CVSS v4.0 score: 8.7
GHSA-vjjq-q5v7-9wmx 
A privilege escalation vulnerability exists in the Remote Server functionality of Dream Report ODS Remote Connector 20.2.16900.0. A specially-crafted command injection can lead to elevated capabilities. An attacker can provide a malicious file to trigger this vulnerability.
CVSS v3.1 score: 8.8
CVE-2005-1962 
Cross-site scripting (XSS) vulnerability in Cerberus Helpdesk 0.97.3 allows remote attackers to inject arbitrary web script or HTML via the (1) errorcode parameter to index.php or (2) certain fields to clients.php.
CVSS v2.0 score: 4.3
CVE-2004-1263 
changepassword.cgi in ChangePassword 0.8, when installed setuid, allows local users to execute arbitrary code by modifying the PATH environment variable to point to a malicious "make" program.
CVSS v2.0 score: 7.2
CVE-2024-12847 NETGEAR DGN setup.cgi OS Command Injection
NETGEAR DGN1000 before 1.1.00.48 is vulnerable to an authentication bypass vulnerability. A remote and unauthenticated attacker can execute arbitrary operating system commands as root by sending crafted HTTP requests to the setup.cgi endpoint. This vulnerability has been observed to be exploited in the wild since at least 2017 and specifically by the Shadowserver Foundation on 2025-02-06 UTC.
CVSS v3.1 score: 9.8
CVE-2018-16969 
Citrix ShareFile StorageZones Controller before 5.4.2 has Information Exposure Through an Error Message.
CVSS v3.0 score: 4.3
CVSS v2.0 score: 4
CVE-2016-10101 
Information Disclosure can occur in Hitek Software's Automize 10.x and 11.x passManager.jsd. Users have the Read attribute, which allows an attacker to recover the encrypted password to access the Password Manager.
CVSS v3.0 score: 8.1
CVSS v2.0 score: 4.3
GHSA-rvv7-6w95-x7c7 
An integer underflow vulnerability exists in pixel-a.asm, the x86 assembly code for planeClipAndMax() in MulticoreWare x265 through 2.5, as used in libbpg and other products. A small height value can cause an integer underflow, which leads to a crash. This is a different vulnerability than CVE-2017-8906.
CVSS v3.0 score: 5.5
GHSA-x3v3-65v7-r727 
389 Directory Server before 1.2.11.6 (aka Red Hat Directory Server before 8.2.10-3), when the password of a LDAP user has been changed and audit logging is enabled, saves the new password to the log in plain text, which allows remote authenticated users to read the password.
GHSA-m7ch-4jv6-68jh 
Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration). Supported versions that are affected are 12.1.1 - 12.1.3 and 12.2.3 - 12.2.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Marketing. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Marketing, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Marketing accessible data as well as unauthorized update, insert or delete access to some of Oracle Marketing accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).
CVE-2016-15017 fabarea media_upload UploadFileService.php getUploadedFileList pathname traversal
A vulnerability has been found in fabarea media_upload on TYPO3 and classified as critical. This vulnerability affects the function getUploadedFileList of the file Classes/Service/UploadFileService.php. The manipulation leads to pathname traversal. Upgrading to version 0.9.0 is able to address this issue. The patch is identified as b25d42a4981072321c1a363311d8ea2a4ac8763a. It is recommended to upgrade the affected component. VDB-217786 is the identifier assigned to this vulnerability.
CVSS v3.1 score: 5.5
CVSS v3.0 score: 5.5
CVSS v2.0 score: 5.2
CVE-2026-22704 HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover
HAX CMS helps manage microsite universe with PHP or NodeJs backends. In versions 11.0.6 to before 25.0.0, HAX CMS is vulnerable to stored XSS, which could lead to account takeover. This issue has been patched in version 25.0.0.
CVSS v3.1 score: 8.1
GHSA-vcwr-rr38-mvch 
Buffer overflow in discdb.c for grip 3.1.2 allows attackers to cause a denial of service (crash) and possibly execute arbitrary code by causing the cddb lookup to return more matches than expected.
CVE-2010-5001 
SQL injection vulnerability in view.php in esoftpro Online Contact Manager 3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS v2.0 score: 7.5
CVE-2015-6627 
The Audio component in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows remote attackers to obtain sensitive information via a crafted audio file, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 24211743.
CVSS v2.0 score: 2.6
CVE-2022-4773 cloudsync LocalFilesystemConnector.java getItem path traversal
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic was found in cloudsync. Affected by this vulnerability is the function getItem of the file src/main/java/cloudsync/connector/LocalFilesystemConnector.java. The manipulation leads to path traversal. It is possible to launch the attack on the local host. The name of the patch is 3ad796833398af257c28e0ebeade68518e0e612a. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216919. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS v3.1 score: 2.5
CVSS v3.0 score: 2.5
GHSA-c3q9-524g-cc66 
Rejected reason: Not used
GHSA-86m2-v736-85f5 
Insufficient protection of the inter-process communication functions in ABB System 800xA for MOD 300 (all published versions) enables an attacker authenticated on the local system to inject data, allowing reads and writes to the controllers or cause windows processes to crash.
CVE-2021-27468 Rockwell Automation FactoryTalk AssetCentre SQL Injection
The AosService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier exposes functions lacking proper authentication. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary SQL statements.
CVSS v3.1 score: 10
GHSA-38w8-h222-wrpp Improper Restriction of XML External Entity Reference in Jenkins Chef Sinatra
Chef Sinatra Plugin 1.20 and earlier does not perform a permission check in a method implementing form validation.As the plugin does not configure its XML parser to prevent XML external entity (XXE) attacks, attackers can have Jenkins parse a crafted XML response that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
CVSS v3.1 score: 7.1
GHSA-p2f3-23x7-8grw 
Vulnerability in the Hyperion BI+ component of Oracle Hyperion (subcomponent: Foundation UI & Servlets). The supported version that is affected is 11.1.2.4. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Hyperion BI+. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Hyperion BI+ accessible data as well as unauthorized read access to a subset of Hyperion BI+ accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Hyperion BI+. CVSS 3.0 Base Score 4.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L).
CVSS v3.0 score: 4.3
GHSA-q4w9-x3rv-4c8j Mailgen has HTML Injection and XSS Filter Bypass in Plaintext Emails
SummaryAn HTML injection vulnerability in plaintext emails generated by Mailgen has been discovered. Projecta are affected if the `Mailgen.generatePlaintext(email)` method is used and passed in user-generated content. The issue was discovered and reported by Edoardo Ottavianelli (@edoardottt).DetailsThe following function (inside index.js) is intended to strip all HTML content to produce a plaintext string.The process fails because it searches for HTML tags and attempts to strip them from the input. However, if the unicode encoded characters are present inside HTML tags, they are not removed. These encoded tags are then decoded later and become valid HTML content, which can lead to XSS vulnerabilities.A valid payload is: `<img src=x onerror=alert(1)\u2028>`.PoC**Resulting output file (emailText.html)**:ImpactDepending on the context/environment where the plaintext message is used, if HTML is rendered and executed can result in arbitrary code execution in the browser of the victim (potentially stealing secrets or sensitive information contained in the message).CreditsEdoardo Ottavianelli (@edoardottt)
CVSS v4.0 score: 1.3
CVE-2019-0289 
Under certain conditions SAP BusinessObjects Business Intelligence platform (Analysis for OLAP), versions 4.2 and 4.3, allows an attacker to access information which would otherwise be restricted.
CVSS v3.0 score: 7.1
CVSS v2.0 score: 5.8
GHSA-7m28-849j-2r38 
IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5., and 11.1 db2pdcfg is vulnerable to a stack based buffer overflow, caused by improper bounds checking which could allow an attacker to execute arbitrary code. IBM X-Force ID: 152462.
CVSS v3.0 score: 7.8
GHSA-x9qf-qp8j-75pj 
Cross-site request forgery (CSRF) vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack the authentication of users for requests to delete permalinks via a crafted request.
CVSS v3.0 score: 8.8
GHSA-85f6-ccw6-739v 
The xwd file handler in ImageMagick allows remote attackers to cause a denial of service (segmentation fault and application crash) via a malformed xwd file.
CVSS v3.0 score: 5.5
GHSA-m34w-75f4-xrpc 
MedDream PACS Server DICOM File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MedDream PACS Server. Authentication is not required to exploit this vulnerability.The specific flaw exists within the parsing of DICOM files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-25827.
CVSS v3.0 score: 9.8
CVE-2020-15101 Nested directory structure can lead to Uncontrolled Resource Consumption in freewvs
In freewvs before 0.1.1, a directory structure of more than 1000 nested directories can interrupt a freewvs scan due to Python's recursion limit and os.walk(). This can be problematic in a case where an administrator scans the dirs of potentially untrusted users. This has been patched in 0.1.1.
CVSS v3.1 score: 2.8
GHSA-v8rw-p6qg-h7qx 
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
CVSS v3.1 score: 7.8
GHSA-cfph-6w6j-c65p 
Integer signedness error in the dissect_mount_dirpath_call function in epan/dissectors/packet-mount.c in the Mount dissector in Wireshark 1.6.x before 1.6.14 and 1.8.x before 1.8.6, when nfs_file_name_snooping is enabled, allows remote attackers to cause a denial of service (application crash) via a negative length value.
RHSA-2007:0710 Red Hat Security Advisory: wireshark security update
Wireshark crashes when inspecting HTTP traffic Wireshark crashes when inspecting iSeries traffic Wireshark loops infinitely when inspecting DCP ETSI traffic Wireshark crashes when inspecting MMS traffic Wireshark corrupts the stack when inspecting BOOTP traffic
GHSA-7983-35fr-8qwm 
Elgg before 7.0.0 does not check image dimensions to prevent denial of service via a large avatar upload.
CVSS v3.1 score: 4.3
GHSA-qw96-rp4q-cvh5 
SQL injection vulnerability in the ccInvoices (com_ccinvoices) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a viewInv action to index.php.
GHSA-q2v7-x93j-phm7 
cPanel before 11.54.0.4 allows stored XSS in the WHM Feature Manager interface (SEC-86).
CVSS v3.0 score: 5.4
CVE-2016-4508 
Cross-site scripting (XSS) vulnerability in Rexroth Bosch BLADEcontrol-WebVIS 3.0.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS v3.1 score: 6.1
CVSS v2.0 score: 4.3
CVE-2024-6075 WP eStore < 8.5.5 - Coupon Deletion via CSRF
The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
CVSS v3.1 score: 8.8
CVE-2012-5371 
Ruby (aka CRuby) 1.9 before 1.9.3-p327 and 2.0 before r37575 computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table, as demonstrated by a universal multicollision attack against a variant of the MurmurHash2 algorithm, a different vulnerability than CVE-2011-4815.
CVSS v2.0 score: 5
GHSA-x5cj-q9vp-frj6 
In engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.
CVSS v3.1 score: 5.5
CVE-2025-9414 kalcaddle kodbox Download from Link serverDownload server-side request forgery
A vulnerability was found in kalcaddle kodbox 1.61. Affected by this vulnerability is an unknown functionality of the file /?explorer/upload/serverDownload of the component Download from Link Handler. Performing manipulation of the argument url results in server-side request forgery. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0 score: 5.1
CVSS v3.1 score: 4.7
CVSS v3.0 score: 4.7
CVSS v2.0 score: 5.8
GHSA-rxxp-gpv7-w3c9 
The Mime Types Extended WordPress plugin through 0.11 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
CVSS v3.1 score: 5.5
CVE-2020-0676 
An information disclosure vulnerability exists in the Cryptography Next Generation (CNG) service when it fails to properly handle objects in memory.To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.The security update addresses the vulnerability by correcting how the service handles objects in memory., aka 'Windows Key Isolation Service Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-0675, CVE-2020-0677, CVE-2020-0748, CVE-2020-0755, CVE-2020-0756.
CVSS v3.1 score: 5.5
CVSS v2.0 score: 2.1
GHSA-grp9-gmxg-jj85 
There is a stack buffer overflow in MP4Box v1.0.1 at src/filters/dmx_nhml.c:1004 in the nhmldmx_send_sample() function szXmlTo parameter which leads to a denial of service vulnerability.
CVSS v3.1 score: 7.5
GHSA-f3h8-v388-jhxw 
Cisco Content Switching Modules (CSM) 4.2 before 4.2.3a, and Cisco Content Switching Module with SSL (CSM-S) 2.1 before 2.1.2a, allow remote attackers to cause a denial of service (CPU consumption or reboot) via sets of out-of-order TCP packets with unspecified characteristics, aka CSCsd27478.
CVE-2026-27082 WordPress Love Story theme <= 1.3.12 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ThemeREX Love Story lovestory allows Object Injection.This issue affects Love Story: from n/a through <= 1.3.12.
CVSS v3.1 score: 9.8
CVE-2024-13750 Multilevel Referral Affiliate Plugin for WooCommerce <= 2.28 - Authenticated (Subscriber+) SQL Injection
The Multilevel Referral Affiliate Plugin for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 2.28 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS v3.1 score: 6.5
GHSA-9c4c-qp3h-qxm5 
Server-side request forgery (SSRF) vulnerability in the documentconverter component in Open-Xchange (OX) AppSuite before 7.4.2-rev10 and 7.6.x before 7.6.0-rev10 allows remote attackers to trigger requests to arbitrary servers and embed arbitrary images via a URL in an embedded image in a Text document, which is not properly handled by the image preview.
GHSA-8gf7-388r-rjrx 
A local file inclusion in Hospital Patient Record Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file.
CVE-2026-56694 NanoClaw < 2.1.0 - Privilege Escalation via Forged Channel Approval Callback
NanoClaw before 2.1.0 contains a privilege escalation vulnerability in the channel-registration approval flow where handleChannelApprovalResponse fails to validate admin privileges over target agent groups. Scoped admins can submit forged or stale connect callback values to wire messaging channels into out-of-scope agent groups, exposing unauthorized groups to unapproved channels and enabling unauthorized observation or control of restricted agent group activity.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 5.4
GHSA-68j5-4m99-w9w9 File Browser has an Authorization Policy Bypass in Public Share Download Flow
SummaryA permission enforcement flaw allows users without download privileges (`download=false`) to still expose and retrieve file content via public share links when they retain share privileges (`share=true`). This bypasses intended access control policy and enables unauthorized data exfiltration to unauthenticated users. Where download restrictions are used for data-loss prevention or role separation.DetailsThe backend applies inconsistent authorization checks across download paths:Direct raw download correctly enforces `Perm.Download`:[[raw.go](https://github.com/filebrowser/filebrowser/blob/master/http/raw.go#82)](filebrowser/http/raw.go:82)Share creation only enforces `Perm.Share`:[[share.go](https://github.com/filebrowser/filebrowser/blob/master/http/share.go#21)](filebrowser/http/share.go:21)Public share/download handlers serve shared content without verifying owner `Perm.Download`:[public.go](https://github.com/filebrowser/filebrowser/blob/master/http/public.go#18)(filebrowser/http/public.go:18)[public.go](https://github.com/filebrowser/filebrowser/blob/master/http/public.go#116)(filebrowser/http/public.go:116)As a result, a user who is blocked from direct downloads can create a share and obtain the same file via `/api/public/dl/<hash>`.PoCCreate a non-admin user with:`perm.share = true``perm.download = false`Login as that user and upload a **PDF** file:`POST /api/resources/nodl_secret_<rand>.pdf` with `Content-Type: application/pdf`Verify direct raw download is denied:`GET /api/raw/nodl_secret_<rand>.pdf`Expected and observed: `202 Accepted` (blocked)Create share for same file:`POST /api/share/nodl_secret_<rand>.pdf`Observed: `200`, response includes `hash` (example: `qxfK3JMG`)Download publicly without authentication:`GET /api/public/dl/<hash>`Observed (vulnerable): `200`, `Content-Type: application/pdf`, and PDF bytes are returnedLive evidence captured (March 1, 2026):`create user`: `201``create file`: `200``direct /api/raw`: `202 Accepted``create share`: `200``public download /api/public/dl/mxK-ppZb`: `200``public download content-type`: `application/pdf``public download body length`: `327` bytesImpactThis is an **access control / authorization policy bypass** vulnerability.**Who can exploit:** Any authenticated user granted `share=true` but denied `download`.**Who is impacted:** Operators and organizations relying on download restrictions to prevent data export.**What can happen:** Restricted users can still distribute and retrieve files publicly, including unauthenticated access through share URLs.
CVSS v3.1 score: 6.5
GHSA-x799-m636-fcmx 
Cross-site scripting (XSS) vulnerability in adv_pwd_cgi in the web management interface on Arris DG860A, TG862A, and TG862G devices with firmware TS0703128_100611 through TS0705125D_031115 allows remote attackers to inject arbitrary web script or HTML via the pwd parameter.
CVE-2009-1365 
Unspecified vulnerability in Adobe Flash Media Server (FMS) before 3.0.4 and 3.5.x before 3.5.2, as used in Flash Media Interactive Server and Flash Media Streaming Server, allows remote attackers to execute arbitrary remote procedures within an ActionScript file on the server via RPC requests.
CVSS v2.0 score: 7.5
GHSA-pg5g-hrxm-397x 
A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.3, Security Update 2021-002 Catalina. A malicious application may bypass Gatekeeper checks.
CVE-2024-11713 WP Job Portal <= 2.2.2 - Authenticated (Admin+) SQL Injection via wpjobportal_deactivate()
The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to SQL Injection via the 'page_id' parameter of the wpjobportal_deactivate() function in all versions up to, and including, 2.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS v3.1 score: 4.9
CVE-2021-29213 
A potential local bypass of security restrictions vulnerability has been identified in HPE ProLiant DL20 Gen10, HPE ProLiant ML30 Gen10, and HPE ProLiant MicroServer Gen10 Plus server's system ROMs prior to version 2.52. The vulnerability could be locally exploited to cause disclosure of sensitive information, denial of service (DoS), and/or compromise system integrity.
CVSS v3.1 score: 6.7
CVSS v2.0 score: 7.2
CVE-2020-3482 Cisco Expressway Software Unauthorized Access Information Disclosure Vulnerability
A vulnerability in the Traversal Using Relays around NAT (TURN) server component of Cisco Expressway software could allow an unauthenticated, remote attacker to bypass security controls and send network traffic to restricted destinations. The vulnerability is due to improper validation of specific connection information by the TURN server within the affected software. An attacker could exploit this issue by sending specially crafted network traffic to the affected software. A successful exploit could allow the attacker to send traffic through the affected software to destinations beyond the application, possibly allowing the attacker to gain unauthorized network access.
CVSS v3.0 score: 6.5
GHSA-xf63-228h-qhch 
In the Linux kernel, the following vulnerability has been resolved:Revert "kobject: Remove redundant checks for whether ktype is NULL"This reverts commit 1b28cb81dab7c1eedc6034206f4e8d644046ad31.It is reported to cause problems, so revert it for now until the root
cause can be found.
CVSS v3.1 score: 5.5
GHSA-7c6j-gm9g-qhcj 
An issue was discovered in Mahara before 18.10.0. It mishandled user requests that could discontinue a user's ability to maintain their own account (changing username, changing primary email address, deleting account). The correct behavior was to either prompt them for their password and/or send a warning to their primary email address.
CVSS v3.0 score: 6.5
GHSA-jjhg-qw5v-r8xx Malicious Package in anarchy
All versions of `anarchy` contain malicious code. The package ran `rm - rf /` as an install script.RecommendationRemove the package from your environment.
CVSS v3.1 score: 9.8
GHSA-gg4m-38pj-gwmc 
A vulnerability was identified in SohuTV CacheCloud up to 3.2.0. This affects the function index of the file src/main/java/com/sohu/cache/web/controller/ServerController.java. The manipulation leads to cross site scripting. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS v4.0 score: 2
CVSS v3.1 score: 3.5
CVE-2025-24714 WordPress Bubble Menu  Plugin <= 4.0.2 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Bubble Menu – circle floating menu bubble-menu allows Cross Site Request Forgery.This issue affects Bubble Menu – circle floating menu: from n/a through <= 4.0.2.
CVSS v3.1 score: 5.4
CVE-2002-1978 
IPFilter 3.1.1 through 3.4.28 allows remote attackers to bypass firewall rules by sending a PASV command string as the argument of another command to an FTP server, which generates a response that contains the string, causing IPFilter to treat the response as if it were a legitimate PASV command from the server.
CVSS v2.0 score: 7.5
CVE-2023-1992 
RPCoRDMA dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file
CVSS v3.1 score: 6.3
GHSA-43ww-vg8r-97hv 
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Zio Alberto zioalberto allows PHP Local File Inclusion.This issue affects Zio Alberto: from n/a through <= 1.2.2.
CVSS v3.1 score: 8.1
GHSA-frrf-pwhq-w5pw 
In the Linux kernel, the following vulnerability has been resolved:wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter()In rtw89_sta_info_get_iter() 'status->he_gi' is compared to array size.
But then 'rate->he_gi' is used as array index instead of 'status->he_gi'.
This can lead to go beyond array boundaries in case of 'rate->he_gi' is
not equal to 'status->he_gi' and is bigger than array size. Looks like
"copy-paste" mistake.Fix this mistake by replacing 'rate->he_gi' with 'status->he_gi'.Found by Linux Verification Center (linuxtesting.org) with SVACE.
CVSS v3.1 score: 7.8
GHSA-9jh4-hwp3-hcgv 
CRLF injection vulnerability in links.php in NX5Linx 1.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a CRLF sequence in the url parameter.
GHSA-c4hm-r2pc-jgj3 
Multiple SQL injection vulnerabilities in Virtual Access Monitor 3.10.17 and earlier allow attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2025-45466 
Unitree Go1 <= Go1_2022_05_11 is vulnerale to Incorrect Access Control due to authentication credentials being hardcoded in plaintext.
CVSS v3.1 score: 8.8
CVE-2024-45012 nouveau/firmware: use dma non-coherent allocator
In the Linux kernel, the following vulnerability has been resolved:

nouveau/firmware: use dma non-coherent allocator

Currently, enabling SG_DEBUG in the kernel will cause nouveau to hit a
BUG() on startup, when the iommu is enabled:

kernel BUG at include/linux/scatterlist.h:187!
invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
CPU: 7 PID: 930 Comm: (udev-worker) Not tainted 6.9.0-rc3Lyude-Test+ #30
Hardware name: MSI MS-7A39/A320M GAMING PRO (MS-7A39), BIOS 1.I0 01/22/2019
RIP: 0010:sg_init_one+0x85/0xa0
Code: 69 88 32 01 83 e1 03 f6 c3 03 75 20 a8 01 75 1e 48 09 cb 41 89 54
24 08 49 89 1c 24 41 89 6c 24 0c 5b 5d 41 5c e9 7b b9 88 00 <0f> 0b 0f 0b
0f 0b 48 8b 05 5e 46 9a 01 eb b2 66 66 2e 0f 1f 84 00
RSP: 0018:ffffa776017bf6a0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffffa77600d87000 RCX: 000000000000002b
RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffffa77680d87000
RBP: 000000000000e000 R08: 0000000000000000 R09: 0000000000000000
R10: ffff98f4c46aa508 R11: 0000000000000000 R12: ffff98f4c46aa508
R13: ffff98f4c46aa008 R14: ffffa77600d4a000 R15: ffffa77600d4a018
FS:  00007feeb5aae980(0000) GS:ffff98f5c4dc0000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f22cb9a4520 CR3: 00000001043ba000 CR4: 00000000003506f0
Call Trace:
 <TASK>
 ? die+0x36/0x90
 ? do_trap+0xdd/0x100
 ? sg_init_one+0x85/0xa0
 ? do_error_trap+0x65/0x80
 ? sg_init_one+0x85/0xa0
 ? exc_invalid_op+0x50/0x70
 ? sg_init_one+0x85/0xa0
 ? asm_exc_invalid_op+0x1a/0x20
 ? sg_init_one+0x85/0xa0
 nvkm_firmware_ctor+0x14a/0x250 [nouveau]
 nvkm_falcon_fw_ctor+0x42/0x70 [nouveau]
 ga102_gsp_booter_ctor+0xb4/0x1a0 [nouveau]
 r535_gsp_oneinit+0xb3/0x15f0 [nouveau]
 ? srso_return_thunk+0x5/0x5f
 ? srso_return_thunk+0x5/0x5f
 ? nvkm_udevice_new+0x95/0x140 [nouveau]
 ? srso_return_thunk+0x5/0x5f
 ? srso_return_thunk+0x5/0x5f
 ? ktime_get+0x47/0xb0

Fix this by using the non-coherent allocator instead, I think there
might be a better answer to this, but it involve ripping up some of
APIs using sg lists.
CVSS v3.1 score: 5.5
RHSA-2011:1506 Red Hat Security Advisory: Red Hat Enterprise Linux 4 - 3-Month End Of Life Notice
This is the 3-month notification of the End Of Life plans for Red Hat
Enterprise Linux 4.
CVE-2022-25962 
All versions of the package vagrant.js are vulnerable to Command Injection via the boxAdd function due to improper input sanitization.
CVSS v3.1 score: 7.4
GHSA-j2v6-c8rw-m58j 
admin.php in phpMyBlockchecker 1.0.0055 allows remote attackers to bypass authentication and gain administrative access by setting the PHPMYBCAdmin cookie to LOGGEDIN.
CVSS v3.1 score: 9.8