CIRCL/vulnerability-scores huggingface dataset:
GHSA-mhpc-25wr-qcwq 
IBM Tivoli Endpoint Manager is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 123859.
CVSS v3.0 score: 6.5
GHSA-fcjj-3vvm-98fr 
A post-auth SQL injection vulnerability in the Mail Manager potentially allows an authenticated attacker to execute code in Sophos UTM before version 9.710.
CVSS v3.1 score: 8.8
GHSA-rj5w-mq87-3g4g 
On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, internal methods used to prevent arbitrary file overwrites in Appliance Mode were not fully effective. An authenticated attacker with a high privilege level may be able to bypass protections implemented in appliance mode to overwrite arbitrary system files.
CVSS v3.1 score: 6.5
GHSA-fm3h-p9wm-h74h Directus's webhook trigger flows can leak sensitive data
Describe the BugIn Directus, when a **Flow** with the "_Webhook_" trigger and the "_Data of Last Operation_" response body encounters a ValidationError thrown by a failed condition operation, the API response includes sensitive data. This includes environmental variables, sensitive API keys, user accountability information, and operational data.This issue poses a significant security risk, as any unintended exposure of this data could lead to potential misuse.![Image](https://github.com/user-attachments/assets/fb894347-cd10-4e79-9469-8fc1b2289794)
![Image](https://github.com/user-attachments/assets/a20337a2-005f-4cfd-ba30-fc5f579ed6c4)
![Image](https://github.com/user-attachments/assets/9b776248-4a20-46f0-92a4-3760d8e53df9)To Reproduce**Steps to Reproduce:**Create a Flow in Directus with:Trigger: WebhookResponse Body: Data of Last OperationAdd a condition that is likely to fail.Trigger the Flow with any input data that will fail the condition.Observe the API response, which includes sensitive information like:Environmental variables (`$env`)Authorization headersUser details under `$accountability`Previous operational data.**Expected Behavior:**
In the event of a ValidationError, the API response should only contain relevant error messages and details, avoiding the exposure of sensitive data.**Actual Behavior:**
The API response includes sensitive information such as:Environment keys (`FLOWS_ENV_ALLOW_LIST`)User accountability (`role`, `user`, etc.)Operational logs (`current_payments`, `$last`), which might contain private details.
CVSS v3.1 score: 8.6
CVE-2013-4006 
IBM WebSphere Application Server (WAS) Liberty Profile 8.5 before 8.5.5.1 uses weak permissions for unspecified files, which allows local users to obtain sensitive information via standard filesystem operations.
CVSS v2.0 score: 4.3
CVE-2025-24448 Illustrator | Out-of-bounds Read (CWE-125)
Illustrator versions 29.2.1, 28.7.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1 score: 5.5
CVE-2023-23474 IBM Cognos Controller information disclosure
IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 could allow a remote attacker to obtain sensitive information when a stack trace is returned in the browser.  IBM X-Force ID:  245403.
CVSS v3.1 score: 3.7
GHSA-f3q2-v6jc-rpmv 
NUUO's NVRMini2 3.8.0 and below contains a backdoor that would allow an unauthenticated remote attacker to take over user accounts if the file /tmp/moses exists.
CVSS v3.0 score: 7.3
CVE-2023-42693 
In wifi service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed
CVSS v3.1 score: 7.8
GHSA-4w2c-mfgm-ff7r 
By design, BEA WebLogic Server and WebLogic Express 7.0 and 6.1, when creating multiple domains from the same WebLogic instance on the same machine, allows administrators of any created domain to access other created domains, which could allow administrators to gain privileges that were not intended.
GHSA-6wwq-69q4-fc36 
Philips Hue Bridge hk_hap Ed25519 Signature Verification Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge. Authentication is not required to exploit this vulnerability.The specific flaw exists within the ed25519_sign_open function. The issue results from improper verification of a cryptographic signature. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-28480.
CVSS v3.0 score: 6.3
GHSA-3vr8-mxjc-h34x 
Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24100.
CVSS v3.0 score: 7.8
CVE-2026-53825 OpenClaw < 2026.4.7 - Arbitrary Local File Read via memory-wiki Ingest with operator.write Scope
OpenClaw before 2026.4.7 contains an arbitrary file read vulnerability in the memory-wiki ingest feature that allows authenticated Gateway operators with operator.write scope to read local files outside intended ingest sources. Attackers with operator.write access can specify arbitrary local file paths to import file content into wiki memory, bypassing access restrictions.
CVSS v4.0 score: 7.1
CVSS v3.1 score: 6.5
GHSA-m4h2-vq52-xvqg 
Nagios XI versions prior to 2011R1.9 are vulnerable to cross-site scripting (XSS) via the handling of the "backend_url" JavaScript link. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS v4.0 score: 5.1
CVSS v3.1 score: 5.4
GHSA-f74w-488g-8x5r Craft CMS: Potential authenticated Remote Code Execution via referrer redirect
Requirements:Control panel accessPermissions to edit an entryDetailsControl panel users with the ability to edit entries can execute unsandboxed Twig code via the HTTP Referrer header.The issue happens when a user is saving entries. Strings for a signed redirect URL are being compiled as a Twig template via `renderObjectTemplate()`, and while a sandboxed alternative already exists (`renderSandboxedObjectTemplate()`), it is not used in this case. This signed URL can be specified by users, as it is reflected in the “Referer” HTTP request header, which is under attacker control.This has been fixed in Craft 5.10.0. Affected users should update to that version or higher to get the fix.Resourceshttps://github.com/craftcms/cms/pull/18680
CVSS v4.0 score: 8.7
CVE-2020-26511 
The wpo365-login plugin before v11.7 for WordPress allows use of a symmetric algorithm to decrypt a JWT token. This leads to authentication bypass.
CVSS v3.1 score: 7.5
CVSS v2.0 score: 5
CVE-2022-50545 r6040: Fix kmemleak in probe and remove
In the Linux kernel, the following vulnerability has been resolved:

r6040: Fix kmemleak in probe and remove

There is a memory leaks reported by kmemleak:

  unreferenced object 0xffff888116111000 (size 2048):
    comm "modprobe", pid 817, jiffies 4294759745 (age 76.502s)
    hex dump (first 32 bytes):
      00 c4 0a 04 81 88 ff ff 08 10 11 16 81 88 ff ff  ................
      08 10 11 16 81 88 ff ff 00 00 00 00 00 00 00 00  ................
    backtrace:
      [<ffffffff815bcd82>] kmalloc_trace+0x22/0x60
      [<ffffffff827e20ee>] phy_device_create+0x4e/0x90
      [<ffffffff827e6072>] get_phy_device+0xd2/0x220
      [<ffffffff827e7844>] mdiobus_scan+0xa4/0x2e0
      [<ffffffff827e8be2>] __mdiobus_register+0x482/0x8b0
      [<ffffffffa01f5d24>] r6040_init_one+0x714/0xd2c [r6040]
      ...

The problem occurs in probe process as follows:
  r6040_init_one:
    mdiobus_register
      mdiobus_scan    <- alloc and register phy_device,
                         the reference count of phy_device is 3
    r6040_mii_probe
      phy_connect     <- connect to the first phy_device,
                         so the reference count of the first
                         phy_device is 4, others are 3
    register_netdev   <- fault inject succeeded, goto error handling path

    // error handling path
    err_out_mdio_unregister:
      mdiobus_unregister(lp->mii_bus);
    err_out_mdio:
      mdiobus_free(lp->mii_bus);    <- the reference count of the first
                                       phy_device is 1, it is not released
                                       and other phy_devices are released
  // similarly, the remove process also has the same problem

The root cause is traced to the phy_device is not disconnected when
removes one r6040 device in r6040_remove_one() or on error handling path
after r6040_mii probed successfully. In r6040_mii_probe(), a net ethernet
device is connected to the first PHY device of mii_bus, in order to
notify the connected driver when the link status changes, which is the
default behavior of the PHY infrastructure to handle everything.
Therefore the phy_device should be disconnected when removes one r6040
device or on error handling path.

Fix it by adding phy_disconnect() when removes one r6040 device or on
error handling path after r6040_mii probed successfully.
CVSS v3.1 score: 5.5
GHSA-8j7j-4m45-jv28 
In the Linux kernel, the following vulnerability has been resolved:wifi: mt76: mt7996: use hweight16 to get correct tx antennaThe chainmask is u16 so using hweight8 cannot get correct tx_ant.
Without this patch, the tx_ant of band 2 would be -1 and lead to the
following issue:
BUG: KASAN: stack-out-of-bounds in mt7996_mcu_add_sta+0x12e0/0x16e0 [mt7996e]
CVSS v3.1 score: 5.5
CVE-2005-4170 
SQL injection vulnerability in eFiction 1.1 allows remote attackers to execute arbitrary SQL commands via the uid parameter to viewuser.php.
CVSS v2.0 score: 7.5
GHSA-23qv-wr7m-3w34 
In the Linux kernel, the following vulnerability has been resolved:USB: isp1362: fix memory leak with using debugfs_lookup()When calling debugfs_lookup() the result must have dput() called on it,
otherwise the memory will leak over time.  To make things simpler, just
call debugfs_lookup_and_remove() instead which handles all of the logic
at once.
CVSS v3.1 score: 5.5
GHSA-9vmw-8f7f-qhch 
A flaw was found in the Linux kernel's netdevsim device driver, within the scheduling of events. This issue results from the improper management of a reference count. This may allow an attacker to create a denial of service condition on the system.
CVSS v3.1 score: 4.4
RHSA-2008:0638 Red Hat Security Advisory: Red Hat Network Satellite Server IBM Java Runtime security update
java-1.5.0 Privilege escalation via unstrusted applet and application Untrusted applet and application XSLT processing privilege escalation Buffer overflow security vulnerabilities in Java Web Start (CVE-2008-1189, CVE-2008-1190) Buffer overflow security vulnerabilities in Java Web Start (CVE-2008-1189, CVE-2008-1190) Buffer overflow security vulnerabilities in Java Web Start (CVE-2008-1189, CVE-2008-1190) Java Plugin same-origin-policy bypass JRE image parsing library allows privilege escalation (CVE-2008-1194) JRE image parsing library allows privilege escalation (CVE-2008-1194) Java-API calls in untrusted Javascript allow network privilege escalation Buffer overflow security vulnerabilities in Java Web Start Java RE allows Same Origin Policy to be Bypassed (6687932) security flaw Security Vulnerability with JRE fonts processing may allow Elevation of Privileges (6450319) Java Web Start Buffer overflow vulnerabilities (6557220) Java Web Start, arbitrary file creation (6703909) Java Web Start arbitrary file creation/deletion file with user permissions (6704077) Java Web Start, untrusted application may determine Cache Location  (6704074)
CVE-2019-9854 Unsafe URL assembly flaw in allowed script location check
LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python sub-directories of the LibreOffice install. Protection was added, to address CVE-2019-9852, to avoid a directory traversal attack where scripts in arbitrary locations on the file system could be executed by employing a URL encoding attack to defeat the path verification step. However this protection could be bypassed by taking advantage of a flaw in how LibreOffice assembled the final script URL location directly from components of the passed in path as opposed to solely from the sanitized output of the path verification step. This issue affects: Document Foundation LibreOffice 6.2 versions prior to 6.2.7; 6.3 versions prior to 6.3.1.
CVSS v3.1 score: 7.8
CVSS v2.0 score: 6.8
CVE-2025-5225 Campcodes Advanced Online Voting System index.php sql injection
A vulnerability, which was classified as critical, was found in Campcodes Advanced Online Voting System 1.0. This affects an unknown part of the file /index.php. The manipulation of the argument voter leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 7.3
CVSS v3.0 score: 7.3
CVSS v2.0 score: 7.5
GHSA-w6wm-hqx9-7cq8 
Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior implement an authentication token (X-User-Token) with insufficient expiration. An attacker who obtains a valid token (for example via interception, log exposure, or token reuse on a shared system) can continue to authenticate to the management interface until the token is revoked, enabling unauthorized access to device functions and data.
CVSS v4.0 score: 8.7
CVSS v3.1 score: 9.8
GHSA-r629-xj8x-3hfx 
Buffer overflow in Adobe Flash Player before 10.3.183.29 and 11.x before 11.4.402.287 on Windows and Mac OS X, before 10.3.183.29 and 11.x before 11.2.202.243 on Linux, before 11.1.111.19 on Android 2.x and 3.x, and before 11.1.115.20 on Android 4.x; Adobe AIR before 3.4.0.2710; and Adobe AIR SDK before 3.4.0.2710 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than other Flash Player buffer overflow CVEs listed in APSB12-22.
CVE-2007-5479 
Cross-site scripting (XSS) vulnerability in Search.asp in Xcomputer allows remote attackers to inject arbitrary web script or HTML via the EXPS parameter.
CVSS v2.0 score: 4.3
CVE-2024-6199 Unauthenticated Remote Code Execution
An unauthenticated attacker on the WAN interface, with the ability to intercept Dynamic DNS (DDNS) traffic between DDNS services and the modem, could manipulate specific responses to include code that forces a buffer overflow on the modem.

Customers that have not enabled Dynamic DNS on their modem are not vulnerable.
CVSS v4.0 score: 7.7
CVE-2018-25412 Delta Sql 1.8.2 Arbitrary File Upload via docs_upload.php
Delta Sql 1.8.2 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by sending POST requests to docs_upload.php with crafted multipart form data. Attackers can upload PHP files with arbitrary content to the upload directory and execute them on the server for remote code execution.
CVSS v4.0 score: 9.3
CVSS v3.1 score: 9.8
GHSA-85cp-p426-42f5 Prototype Pollution in deep-get-set
All versions of package deep-get-set prior to version 1.1.1 are vulnerable to Prototype Pollution via the main function.
CVSS v3.1 score: 9.8
GHSA-53rf-mqh4-c9m2 
IBM Curam Social Program Management 6.1.x before 6.1.1.1 allows remote authenticated users to bypass intended access restrictions and obtain sensitive document information by guessing the document id. IBM X-Force ID: 107106.
CVSS v3.0 score: 4.3
CVE-2017-13697 
controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the dirname variable.
CVSS v3.0 score: 6.1
CVSS v2.0 score: 4.3
GHSA-2x69-9fjp-rrmj 
Race condition in the client in Symantec Endpoint Protection (SEP) 12.1 before RU6 MP5 allows local users to bypass intended restrictions on USB file transfer by conducting filesystem operations before the SEP device manager recognizes a new USB device.
CVSS v3.0 score: 2.9
CVE-2022-20029 
In cmdq driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05747150; Issue ID: ALPS05747150.
CVSS v3.1 score: 4.4
CVSS v2.0 score: 2.1
GHSA-6hmv-g545-7x8f 
Live.me - live stream video chat, 3.7.20, 2017-11-06, Android application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key.
CVSS v3.1 score: 7.5
GHSA-878x-rm8q-c4xm 
The jira.editor.user.mode cookie set by the Jira Editor Plugin in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before version 8.13.4, and from version 8.14.0 before version 8.15.0 allows remote anonymous attackers who can perform an attacker in the middle attack to learn which mode a user is editing in due to the cookie not being set with a secure attribute if Jira was configured to use https.
CVSS v3.1 score: 3.7
GHSA-h5vc-c65p-cgj9 
Unspecified vulnerability in the Oracle VM VirtualBox component before 5.1.4 in Oracle Virtualization allows remote attackers to affect confidentiality and integrity via vectors related to VRDE.
CVSS v3.0 score: 9.1
GHSA-f493-gq25-5c5x 
A security vulnerability has been detected in SourceCodester Online Boat Reservation System 1.0. Affected by this vulnerability is an unknown functionality of the component Administrative Endpoint. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Multiple endpoints are affected.
CVSS v4.0 score: 2.1
CVSS v3.1 score: 6.3
CVE-2019-19745 
Contao 4.0 through 4.8.5 allows PHP local file inclusion. A back end user with access to the form generator can upload arbitrary files and execute them on the server.
CVSS v3.1 score: 8.8
CVSS v2.0 score: 6.5
CVE-2019-7873 
A cross-site request forgery vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can result in unintended deletion of the store design schedule.
CVSS v3.0 score: 4.3
CVSS v2.0 score: 5.8
CVE-2024-57800 ALSA: memalloc: prefer dma_mapping_error() over explicit address checking
In the Linux kernel, the following vulnerability has been resolved:

ALSA: memalloc: prefer dma_mapping_error() over explicit address checking

With CONFIG_DMA_API_DEBUG enabled, the following warning is observed:

DMA-API: snd_hda_intel 0000:03:00.1: device driver failed to check map error[device address=0x00000000ffff0000] [size=20480 bytes] [mapped as single]
WARNING: CPU: 28 PID: 2255 at kernel/dma/debug.c:1036 check_unmap+0x1408/0x2430
CPU: 28 UID: 42 PID: 2255 Comm: wireplumber Tainted: G  W L  6.12.0-10-133577cad6bf48e5a7848c4338124081393bfe8a+ #759
debug_dma_unmap_page+0xe9/0xf0
snd_dma_wc_free+0x85/0x130 [snd_pcm]
snd_pcm_lib_free_pages+0x1e3/0x440 [snd_pcm]
snd_pcm_common_ioctl+0x1c9a/0x2960 [snd_pcm]
snd_pcm_ioctl+0x6a/0xc0 [snd_pcm]
...

Check for returned DMA addresses using specialized dma_mapping_error()
helper which is generally recommended for this purpose by
Documentation/core-api/dma-api.rst.
CVSS v3.1 score: 5.5
GHSA-xfw6-4rhw-32pm 
A security flaw has been discovered in PropertyGuru AgentNet Singapore App up to 23.7.10 on Android. This affects an unknown function of the file com/allproperty/android/agentnet/BuildConfig.java of the component com.allproperty.android.agentnet. The manipulation of the argument SEGMENT_ANDROID_WRITE_KEY/SEGMENT_TOS_WRITE_KEY results in use of hard-coded cryptographic key
 . The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0 score: 1.9
CVSS v3.1 score: 3.3
CVE-2025-50756 
Wavlink WN535K3 20191010 was found to contain a command injection vulnerability in the set_sys_adm function via the newpass parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVSS v3.1 score: 9.8
CVE-2017-2333 
A persistent denial of service vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow a malicious, network-based, authenticated attacker to consume enough system resources to cause a persistent denial of service by visiting certain specific URLs on the server.
CVSS v3.0 score: 6.5
CVSS v2.0 score: 4
CVE-2026-13190 PersistenceFramework Unsafe Type Resolution Vulnerability in Telerik UI for ASP.NET AJAX
In Progress® Telerik® UI for AJAX prior to v2026.2.708, a deserialization vulnerability in the persistence utilities allows unsafe type instantiation from attacker-influenced persisted state, which can lead to remote code execution.
CVSS v3.1 score: 8.1
GHSA-qmg2-c98g-p46x 
The ip_expire function in net/ipv4/ip_fragment.c in the Linux kernel before 2.6.39 does not properly construct ICMP_TIME_EXCEEDED packets after a timeout, which allows remote attackers to cause a denial of service (invalid pointer dereference) via crafted fragmented packets.
GHSA-4mqg-h5jf-j9m7 TorchServe Pre-Auth Remote Code Execution
Impact**Use of Open Source Library potentially exposed to RCE**
    **Issue**: Use of a version of the SnakeYAML `v1.31 `open source library with multiple issues that potentially exposes the user to unsafe deserialization of Java objects. This could allow third parties to execute arbitrary code on the target system. This issue is present in versions `0.3.0` to `0.8.1`.
    **Mitigation**: A pull request to address this issue has been merged - https://github.com/pytorch/serve/pull/2523. TorchServe release `0.8.2` includes this fix.PatchesTorchServe release 0.8.2 includes fixes to address the previously listed issue:https://github.com/pytorch/serve/releases/tag/v0.8.2**Tags for upgraded DLC release**
User can use the following new image tags to pull DLCs that ship with patched TorchServe version 0.8.2:
x86 GPUv1.9-pt-ec2-2.0.1-inf-gpu-py310v1.8-pt-sagemaker-2.0.1-inf-gpu-py310x86 CPUv1.8-pt-ec2-2.0.1-inf-cpu-py310v1.7-pt-sagemaker-2.0.1-inf-cpu-py310Gravitonv1.7-pt-graviton-ec2-2.0.1-inf-cpu-py310v1.5-pt-graviton-sagemaker-2.0.1-inf-cpu-py310Neuron1.13.1-neuron-py310-sdk2.13.2-ubuntu20.041.13.1-neuronx-py310-sdk2.13.2-ubuntu20.041.13.1-neuronx-py310-sdk2.13.2-ubuntu20.04The full DLC image URI details can be found at: https://github.com/aws/deep-learning-containers/blob/master/available_images.md#available-deep-learning-containers-imagesReferenceshttps://github.com/pytorch/serve/pull/2523
https://github.com/pytorch/serve/releases/tag/v0.8.2
https://github.com/aws/deep-learning-containers/blob/master/available_images.md#available-deep-learning-containers-imagesCreditWe would like to thank Oligo Security for responsibly disclosing this issue and working with us on its resolution.
If you have any questions or comments about this advisory, we ask that you contact AWS/Amazon Security via our [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting[)](https://aws.amazon.com/security/vulnerability-reporting)) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.
CVSS v3.1 score: 9.9
GHSA-wqcc-mfhw-53pc Apache Answer User Using External Images Potentially Discloses User Information
Private Data Structure Returned From A Public Method vulnerability in Apache Answer.This issue affects Apache Answer: through 1.4.2.If a user uses an externally referenced image, when a user accesses this image, the provider of the image may obtain private information about the ip address of that accessing user.
Users are recommended to upgrade to version 1.4.5, which fixes the issue. In the new version, administrators can set whether external content can be displayed.
CVSS v4.0 score: 1.1
CVSS v3.1 score: 6.5
CVE-2015-4966 
IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.9 FP009, and 7.6.0 before 7.6.0.2 IFIX001; Maximo Asset Management 7.5.0 before 7.5.0.9 FP009, 7.5.1, and 7.6.0 before 7.6.0.2 IFIX001 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products have a default administrator account, which makes it easier for remote authenticated users to obtain access via unspecified vectors.
CVSS v2.0 score: 6.5
CVE-2006-2265 
Cross-site scripting vulnerability in admin/main.asp in Ocean12 Calendar Manager Pro 1.00 allows remote attackers to inject arbitrary web script or HTML via the date parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS v2.0 score: 2.6
GHSA-jxc5-x72r-w93v 
An off-by-one error in WLInfoRailService in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to crash the service, resulting in a DoS.
CVSS v3.0 score: 7.5
CVE-2015-4488 
Use-after-free vulnerability in the StyleAnimationValue class in Mozilla Firefox before 40.0, Firefox ESR 38.x before 38.2, and Firefox OS before 2.2 allows remote attackers to have an unspecified impact by leveraging a StyleAnimationValue::operator self assignment.
CVSS v2.0 score: 7.5
GHSA-chxg-v5fx-95h2 
Secom Co. Dr.ID, a Door Access Control and Personnel Attendance Management system, allows attackers to enumerate and exam user account in the system.
GHSA-p743-vm74-r5x3 
An issue in the component ATSZIO64.sys of ASUSTeK Computer Inc ASUS ATSZIO Driver v0.2.1.7 allows attackers to escalate privileges and execute arbitrary code via sending crafted IOCTL requests.
CVSS v3.1 score: 8.4
GHSA-47q7-97xp-m272 OpenClaw: Config writes could persist resolved ${VAR} secrets to disk
SummaryOpenClaw hooks previously compared the provided hook token using a regular string comparison. Because this comparison is not constant-time, an attacker with network access to the hooks endpoint could potentially use timing measurements across many requests to gradually infer the token.In practice, this typically requires hooks to be exposed to an untrusted network and a large number of requests; real-world latency and jitter can make reliable measurement difficult.Affected Packages / Versionsopenclaw (npm): < 2026.2.12Patched Versionsopenclaw (npm): >= 2026.2.12MitigationsUpgrade to openclaw >= 2026.2.12.If users cannot upgrade immediately: restrict network access to the hooks endpoint and rotate the hooks token after updating.Fix Commit(s)113ebfd6a23c4beb8a575d48f7482593254506ecOpenClaw thanks @akhmittra for reporting.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 4.8
CVE-2026-59693 
A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.233.16-7862), Desigo PXC3 (All versions < V01.21.233.16-7862), Desigo PXC4 (All versions < V02.21.194.36-2715), Desigo PXC5.E003 (All versions < V02.21.194.36-2715), Desigo PXC5.E24 (All versions < V02.21.194.36-2715), Desigo PXC7 (All versions < V02.21.194.36-2715). The affected devices are vulnerable to a denial-of-service (DoS) vulnerability. An attacker can exploit this issue by sending a malformed BACnet packet, causing the device to stop responding to BACnet queries. Recovery requires a device reset or reboot to restore normal functionality.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 4.3
GHSA-rg4c-f6cj-x9w8 
Curl_smtp_escape_eob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that might be exploitable by an attacker who can control the data that curl transmits over SMTP with certain settings (i.e., use of a nonstandard --limit-rate argument or CURLOPT_BUFFERSIZE value).
CVSS v3.0 score: 9.8
CVE-2018-8740 
In SQLite through 3.22.0, databases whose schema is corrupted using a CREATE TABLE AS statement could cause a NULL pointer dereference, related to build.c and prepare.c.
CVSS v3.0 score: 7.5
CVSS v2.0 score: 5
CVE-2009-2053 
Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 4.x, 5.x before 5.1(3g), 6.x before 6.1(4), 7.0 before 7.0(2a)su1, and 7.1 before 7.1(2) allows remote attackers to cause a denial of service (file-descriptor exhaustion and SCCP outage) via a flood of TCP packets, aka Bug ID CSCsx32236.
CVSS v2.0 score: 7.8
GHSA-x9w7-fj93-8rc4 
A vulnerability was determined in CRMEB up to 5.6.1. This vulnerability affects unknown code of the file /adminapi/export/product_list. This manipulation of the argument cate_id causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0 score: 2
CVSS v3.1 score: 4.7
CVE-2022-40485 
Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /package_detail.php.
CVSS v3.1 score: 9.8
CVE-2026-32265 Amazon S3 for Craft CMS has an Information Disclosure vulnerability
The Amazon S3 for Craft CMS plugin provides an Amazon S3 integration for Craft CMS. In versions 2.0.2 through 2.2.4, unauthenticated users can view a list of buckets the plugin has access to. The `BucketsController->actionLoadBucketData()` endpoint allows unauthenticated users with a valid CSRF token to view a list of buckets that the plugin is allowed to see. Users should update to version 2.2.5 of the plugin to mitigate the issue.
CVSS v4.0 score: 6.9
GHSA-4jc6-946f-3mgf 
IBM CICS TX 11.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 229436.
CVSS v3.1 score: 4.3
GHSA-9578-hx54-ppx6 
In eemgpu, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08713302; Issue ID: MSV-1393.
CVSS v3.1 score: 6.7
GHSA-wv9r-7rjw-43h7 
Cross-site scripting (XSS) vulnerability in Default.asp in RapidShare Database allows remote attackers to inject arbitrary web script or HTML via the Arayalim parameter.
GHSA-3wfx-mj93-vf8v 
Type Confusion in V8 in Google Chrome prior to 130.0.6723.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS v3.1 score: 8.8
GHSA-v744-vp6m-fvh3 
I-gear 3.5.7 and earlier does not properly process log entries in which a URL is longer than 255 characters, which allows an attacker to cause reporting errors.
CVE-2025-40193 xtensa: simdisk: add input size check in proc_write_simdisk
In the Linux kernel, the following vulnerability has been resolved:

xtensa: simdisk: add input size check in proc_write_simdisk

A malicious user could pass an arbitrarily bad value
to memdup_user_nul(), potentially causing kernel crash.

This follows the same pattern as commit ee76746387f6
("netdevsim: prevent bad user input in nsim_dev_health_break_write()")
CVE-2026-12216 svaarala duktape duk_api_bytecode.c memory corruption
A weakness has been identified in svaarala duktape up to 2.99.99. This issue affects some unknown processing of the file duk_api_bytecode.c. Executing a manipulation of the argument count_instr can lead to memory corruption. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0 score: 4.8
CVSS v3.1 score: 5.3
CVSS v3.0 score: 5.3
CVSS v2.0 score: 4.3
GHSA-jf28-ccw2-vr7h 
TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a command injection vulnerability via the command parameter at setting/setTracerouteCfg.
CVSS v3.1 score: 7.8
GHSA-6mgp-v465-x83g 
A vulnerability in the web UI of Cisco Spark Messaging Software could allow an authenticated, remote attacker to perform a stored cross-site scripting (XSS) attack. The vulnerability is due to insufficient input validation by the web UI of the affected software. An attacker could exploit this vulnerability by injecting XSS content into the web UI of the affected software. A successful exploit could allow the attacker to force a user to execute code of the attacker's choosing or allow the attacker to retrieve sensitive information from the user. Cisco Bug IDs: CSCvf70587, CSCvf70592.
CVSS v3.0 score: 5.4
GHSA-84qm-c4vp-p823 
SQL Injection exists in the Social Factory 3.8.3 component for Joomla! via the radius[lat], radius[lng], or radius[radius] parameter.
CVSS v3.0 score: 9.8
CVE-2026-55003 Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability
Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network.
CVSS v3.1 score: 6.5
GHSA-m893-832r-qfw5 
Use after free in Cart in Google Chrome prior to 109.0.5414.74 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via database corruption and a crafted HTML page. (Chromium security severity: Medium)
CVSS v3.1 score: 8.8
GHSA-qmc2-fr3x-59pg 
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
CVSS v3.1 score: 8.8
GHSA-2vgx-9h8g-j98m 
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and prior, 7.6.20 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Cluster accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Cluster. CVSS 3.1 Base Score 2.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:L).
CVE-2024-31955 
An issue was discovered in Samsung eMMC with KLMAG2GE4A and KLM8G1WEMB firmware. Code bypass through Electromagnetic Fault Injection allows an attacker to successfully authenticate and write to the RPMB (Replay Protected Memory Block) area without possessing secret information.
CVSS v3.1 score: 4.9
GHSA-mprf-9g5r-6vxv 
Trusty TLK contains a vulnerability in the NVIDIA TLK kernel where an integer overflow in the calloc size calculation can cause the multiplication of count and size can overflow, which might lead to heap overflows.
CVE-2012-5815 
The Rackspace app 2.1.5 for iOS does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS v2.0 score: 5.8
CVE-2025-25457 
Tenda AC10 V4.0si_V16.03.10.20 is vulnerable to Buffer Overflow in AdvSetMacMtuWan via cloneType2.
CVSS v3.1 score: 7.5
CVE-2023-3193 
Cross-site scripting (XSS) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.73, and Liferay DXP 7.4 update 70 through 73 allows remote attackers to inject arbitrary web script or HTML via the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter.
CVSS v3.1 score: 6.1
CVE-2022-1753 WoWonder Group requests.php access control
A vulnerability, which was classified as critical, was found in WoWonder. Affected is the file /requests.php which is responsible to handle group messages. The manipulation of the argument group_id allows posting messages in other groups. It is possible to launch the attack remotely but it might require authentication. A video explaining the attack has been disclosed to the public.
CVSS v3.1 score: 5.4
CVE-2023-3417 File Extension Spoofing using the Text Direction Override Character
Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email attachment could be incorrectly shown as being a document file, while in  fact it was an executable file. Newer versions of Thunderbird will strip the character and show the correct file extension. This vulnerability affects Thunderbird < 115.0.1 and Thunderbird < 102.13.1.
CVSS v3.1 score: 7.5
CVE-2019-16467 
Adobe Experience Manager versions 6.5, 6.4, 6.3, 6.2, 6.1, and 6.0 have a reflected cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVSS v3.1 score: 6.1
CVSS v2.0 score: 4.3
CVE-2014-8502 
Heap-based buffer overflow in the pe_print_edata function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly have other unspecified impact via a truncated export table in a PE file.
CVSS v2.0 score: 7.5
GHSA-c75r-fv95-pffp 
Use of hard-coded cryptographic key vulnerability in August Connect Wi-Fi Bridge App, Connect Firmware allows an attacker to decrypt an intercepted payload containing the Wi-Fi network authentication credentials. This issue affects: August Connect Wi-Fi Bridge App version v10.11.0 and prior versions on Android. August Connect Firmware version 2.2.12 and prior versions.
GHSA-4qhv-qjg6-r699 
Untrusted pointer dereference in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVSS v3.1 score: 7.8
CVE-2019-0038 SRX Series: Crafted packets destined to fxp0 management interface on SRX340/SRX345 devices can lead to DoS
Crafted packets destined to the management interface (fxp0) of an SRX340 or SRX345 services gateway may create a denial of service (DoS) condition due to buffer space exhaustion. This issue only affects the SRX340 and SRX345 services gateways. No other products or platforms are affected by this vulnerability. Affected releases are Juniper Networks Junos OS: 15.1X49 versions prior to 15.1X49-D160 on SRX340/SRX345; 17.3 on SRX340/SRX345; 17.4 versions prior to 17.4R2-S3, 17.4R3 on SRX340/SRX345; 18.1 versions prior to 18.1R3-S1 on SRX340/SRX345; 18.2 versions prior to 18.2R2 on SRX340/SRX345; 18.3 versions prior to 18.3R1-S2, 18.3R2 on SRX340/SRX345. This issue does not affect Junos OS releases prior to 15.1X49 on any platform.
CVSS v3.0 score: 6.5
RHSA-2023:7641 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.14 security update
guava: insecure temporary directory creation eap-galleon: custom provisioning creates unsecured http-invoker xnio: StackOverflowException when the chain of notifier states becomes problematically big apache-mina-sshd: information exposure in SFTP server implementations apache-avro: Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)
CVSS v3.1 score: 7.5
CVE-2017-9531 
IrfanView version 4.44 (32bit) with FPX Plugin 4.46 allows attackers to execute arbitrary code or cause a denial of service via a crafted .fpx file, related to a "User Mode Write AV starting at FPX+0x000000000000176c."
CVSS v3.0 score: 7.8
CVSS v2.0 score: 6.8
CVE-2019-17583 
idreamsoft iCMS 7.0.15 allows remote attackers to cause a denial of service (resource consumption) via a query for many comments, as demonstrated by the admincp.php?app=comment&perpage= substring followed by a large positive integer.
CVSS v3.1 score: 7.5
CVSS v2.0 score: 5
GHSA-xvv2-p83f-ppgf 
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in YAHMAN Word Balloon allows PHP Local File Inclusion.This issue affects Word Balloon: from n/a through 4.21.1.
CVSS v3.1 score: 6.5
GHSA-rcrp-hqvr-vx5g 
An issue was discovered in the MBeans Server in Wowza Streaming Engine before 4.7.1. The file system may be read and written to via JMX using the default JMX credentials (remote code execution may be possible as well).
CVSS v3.0 score: 9.8
CVE-2010-3848 
Stack-based buffer overflow in the econet_sendmsg function in net/econet/af_econet.c in the Linux kernel before 2.6.36.2, when an econet address is configured, allows local users to gain privileges by providing a large number of iovec structures.
CVSS v2.0 score: 6.9
GHSA-x3hv-22gr-7q5j 
Symantec Messaging Gateway, prior to 10.7.1, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user.
GHSA-c6h8-mf9p-xjxm 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension allows Stored XSS.This issue affects Mediawiki - WikiLambda Extension: master.
CVSS v4.0 score: 6.9
CVE-2022-48493 
Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.
CVSS v3.1 score: 7.5
GHSA-rgj5-vhq5-p9jc 
Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/admin.php in the StatPressCN plugin 1.9.0 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) what1, (2) what2, (3) what3, (4) what4, and (5) what5 parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
GHSA-49r3-2549-3633 omniauth-apple allows attacker to fake their email address during authentication
ImpactThis vulnerability impacts applications using the [omniauth-apple](https://github.com/nhosoya/omniauth-apple) strategy of OmniAuth and using the `info.email` field of OmniAuth's [Auth Hash Schema](https://github.com/omniauth/omniauth/wiki/Auth-Hash-Schema) for any kind of identification.  The value of this field may be set to any value of the attacker's choice including email addresses of other users.For example, an application using omniauth-apple with the following code will be impacted:Applications not using `info.email` for identification but are instead using the `uid` field are not impacted in the same manner.  Note, these applications may still be negatively affected if the value of `info.email` is being used for other purposes.PatchesApplications using affected versions of omniauth-apple are advised to upgrade to omniauth-apple version 1.0.1 or later.WorkaroundsIf unable to upgrade to a patched version, monkey patching `OmniAuth::Strategies::Apple#email` as follows is advised as a workaround:
CVSS v3.1 score: 7.7
CVE-2023-44827 
An issue in ZenTao Community Edition v.18.6 and before, ZenTao Biz v.8.6 and before, ZenTao Max v.4.7 and before allows an attacker to execute arbitrary code via a crafted script to the Office Conversion Settings function.
CVSS v3.1 score: 8.8
GHSA-w9x9-rr93-3wvr 
Cross-site request forgery (CSRF) vulnerability in IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.
CVE-2025-46230 WordPress Popup Builder plugin <= 1.1.35 - Local File Inclusion Vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in GhozyLab Popup Builder easy-notify-lite allows PHP Local File Inclusion.This issue affects Popup Builder: from n/a through <= 1.1.35.
CVSS v3.1 score: 7.5
GHSA-7g7j-45fm-hprx 
Improper access control in Azure Virtual Machines allows an authorized attacker to perform spoofing locally.
CVSS v3.1 score: 7.9
CVE-2026-32142 shopware/commercial: `/api/_info/config` route exposes information about licenses
Shopware is an open commerce platform. /api/_info/config route exposes information about licenses. This vulnerability is fixed in 7.8.1 and 6.10.15.
CVSS v3.1 score: 5.3
CVE-2021-27067 Azure DevOps Server and Team Foundation Server Information Disclosure Vulnerability
Azure DevOps Server and Team Foundation Server Information Disclosure Vulnerability
CVSS v3.1 score: 6.5
GHSA-c348-hjj9-x39v 
On TP-Link Tapo C260 v1, path traversal is possible due to improper handling of specific GET request paths via https, allowing local unauthenticated probing of filesystem paths. An attacker on the local network can determine whether certain files exists on the device, with no read, write or code execution possibilities.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 7.8
RHSA-2025:9432 Red Hat Security Advisory: iputils security update
iputils: Signed Integer Overflow in Timestamp Multiplication in iputils ping
CVSS v3.1 score: 6.5
CVE-2019-10411 
Jenkins Inedo BuildMaster Plugin 2.4.0 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
CVSS v3.1 score: 7.5
CVSS v2.0 score: 5
CVE-2024-39557 Junos OS Evolved: MAC table changes cause a memory leak
An Uncontrolled Resource Consumption vulnerability in the 

Layer 2 Address Learning Daemon (l2ald)

 of Juniper Networks Junos OS Evolved allows an unauthenticated, adjacent attacker to cause a memory leak, eventually exhausting all system memory, leading to a system crash and Denial of Service (DoS).

Certain MAC table updates cause a small amount of memory to leak.  Once memory utilization reaches its limit, the issue will result in a system crash and restart.

To identify the issue, execute the CLI command:
 
user@device> show platform application-info allocations app l2ald-agent
EVL Object Allocation Statistics:
 
 Node    Application       Context   Name                                 Live     Allocs     Fails       Guids
 re0     l2ald-agent                 net::juniper::rtnh::L2Rtinfo         1069096  1069302    0           1069302
 re0     l2ald-agent                 net::juniper::rtnh::NHOpaqueTlv       114      195        0           195



This issue affects Junos OS Evolved: 


  *  All versions before 21.4R3-S8-EVO,

  *  from 22.2-EVO before 22.2R3-S4-EVO, 
  *  from 22.3-EVO before 22.3R3-S3-EVO, 
  *  from 22.4-EVO before 22.4R3-EVO, 
  *  from 23.2-EVO before 23.2R2-EVO.
CVSS v4.0 score: 7.1
CVSS v3.1 score: 6.5
GHSA-6cr3-7r4p-pwrg 
Unrestricted Upload of File with Dangerous Type vulnerability in WEN Solutions WP Child Theme Generator.This issue affects WP Child Theme Generator: from n/a through 1.0.9.
CVSS v3.1 score: 9.1
CVE-2019-14934 
An issue was discovered in PDFResurrect before 0.18. pdf_load_pages_kids in pdf.c doesn't validate a certain size value, which leads to a malloc failure and out-of-bounds write.
CVSS v3.1 score: 7.8
CVSS v2.0 score: 6.8
GHSA-65mq-j423-r6fc 
Product: AndroidVersions: Android kernelAndroid ID: A-208744915References: N/A
CVSS v3.1 score: 7.5