CIRCL/vulnerability-scores huggingface dataset:
CVE-2019-9118 
An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body for the SetNTPServerSettings API function, as demonstrated by shell metacharacters in the system_time_timezone field.
CVSS v3.0 score: 9.8
CVSS v2.0 score: 10
GHSA-hc66-p838-6xfp 
HPE OneView may allow clusterService Authentication Bypass resulting in denial of service.
CVSS v3.1 score: 7.5
CVE-2018-9419 
In l2cble_process_sig_cmd of l2c_ble.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1 score: 7.5
GHSA-gjpw-cmmh-976v 
Cross-site scripting (XSS) vulnerability in Liferay Portal Community Edition (CE) 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to inject arbitrary web script or HTML via a message title, a different vulnerability than CVE-2004-2030.
GHSA-q346-mw87-vh24 
In DomainVerificationService, there is a possible way to access app domain verification information due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-200035185
CVSS v3.1 score: 5.5
GHSA-v7cc-2p5c-5943 
Integer overflow in the CSoundFile::ReadMed function (src/load_med.cpp) in libmodplug before 0.8.6, as used in gstreamer-plugins, TTPlayer, and other products, allows context-dependent attackers to execute arbitrary code via a MED file with a crafted (1) song comment or (2) song name, which triggers a heap-based buffer overflow, as exploited in the wild in August 2008.
CVE-2026-58315 
Cross-site request forgery vulnerability exists in SEIKO EPSON Web Config. If a user views a malicious page while logged into Web Config, unintended operations may be performed.
CVSS v4.0 score: 5.1
CVSS v3.0 score: 4.3
CVE-2005-4268 
Buffer overflow in cpio 2.6-8.FC4 on 64-bit platforms, when creating a cpio archive, allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a file whose size is represented by more than 8 digits.
CVSS v2.0 score: 3.7
CVE-2020-36842 Migration, Backup, Staging – WPvivid <= 0.9.35 - Authenticated (Subscriber+) Arbitrary File Upload
The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the wpvivid_upload_import_files and wpvivid_upload_files AJAX actions that allows low-level authenticated attackers to upload zip files that can be subsequently extracted. This affects versions up to, and including 0.9.35.
CVSS v3.1 score: 8.8
GHSA-2446-mrf6-p2h8 
Cross-site scripting vulnerability in Metabase version 0.29.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS v3.0 score: 6.1
GHSA-35qj-2v2r-6c2g 
Use of Hard-coded Cryptographic Key vulnerability in SonicWall GMS, SonicWall Analytics. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
CVSS v3.1 score: 7.5
GHSA-x5jf-hr75-g5hm 
A vulnerability classified as critical has been found in Campcodes Online Food Ordering System 1.0. This affects an unknown part of the file /routers/router.php. The manipulation of the argument Username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 7.3
GHSA-96h6-4894-p3mr 
Cross-site scripting (XSS) vulnerability in IBM InfoSphere BigInsights 1.1 through 2.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
GHSA-4c7p-c7mq-74m6 
ASPRunner.NET 10.1 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string in the table name field. Attackers can input a buffer of 10000 characters in the table name parameter during database table creation to trigger an application crash.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 6.2
GHSA-prrh-5r25-ch75 
Allocation of resources without limits or throttling vulnerability in Apache Struts. When no fixed locale is configured, the locale used for localized-text lookups is taken from the incoming request, allowing an unauthenticated remote client to cause the framework's internal localized-text caches to grow without bound and exhaust the Java heap, denying service to other users. Applications that configure a fixed locale are not affected.This issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.10.0, from 7.0.0 through 7.2.1.Users are recommended to upgrade to version 6.11.0 or 7.3.0, which fixes the issue.
CVSS v3.1 score: 7.5
GHSA-cf8w-7cf7-c7vg 
Directory traversal vulnerability in code/track.php in FuzzyLime 3.03 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the p parameter, a different vector than CVE-2007-4805 and CVE-2008-3165.
GHSA-q4mr-4vhv-6jc7 
SQL injection vulnerability in aspkat.asp in Bahar Download Script 2.0 allows remote attackers to execute arbitrary SQL commands via the kid parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVE-2019-0641 
A security feature bypass vulnerability exists in Microsoft Edge handles whitelisting, aka 'Microsoft Edge Security Feature Bypass Vulnerability'.
CVSS v3.0 score: 5.9
CVSS v2.0 score: 4.3
GHSA-2x6q-8fjr-3hj2 
Buffer overflow in the UPnP IGD (Internet Gateway Device Standardized Device Control Protocol) implementation in iChat on Apple Mac OS X 10.3.9 and 10.4.10 allows network-adjacent remote attackers to execute arbitrary code via a crafted packet.
GHSA-jhvw-m4cj-8r4p 
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused
CVE-2013-3056 
Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allows remote authenticated users to bypass intended privilege requirements and delete the private messages of arbitrary users via unspecified vectors.
CVSS v2.0 score: 4
GHSA-85p6-3vc2-6v3w 
Directory traversal vulnerability in admin/about.php in contentServ 3.1 allows remote attackers to read or include arbitrary files via ".." sequences in the ctsWebsite parameter.
CVE-2017-10706 
When Antiy Antivirus Engine before 5.0.0.05171547 scans a special ZIP archive, it crashes with a stack-based buffer overflow because a fixed path length is used.
CVSS v3.0 score: 6.2
CVSS v2.0 score: 2.1
GHSA-4334-w3q6-m8g5 
A highly authenticated attacker can alter the config generator injecting a payload into future created configurations. The device is not correctly checking this configuration value before passing it to an system execute leading to code execution. This can result in a total loss of confidentiality, integrity and availability.
CVSS v3.1 score: 7.2
GHSA-q4wg-4r43-jqjx 
Radiometrics VizAir is vulnerable to any remote attacker via access to the admin panel of the VizAir system without authentication. Once inside, the attacker can modify critical weather parameters such as wind shear alerts, inversion depth, and CAPE values, which are essential for accurate weather forecasting and flight safety. This unauthorized access could result in the disabling of vital alerts, causing hazardous conditions for aircraft, and manipulating runway assignments, which could result in mid-air conflicts or runway incursions.
CVSS v4.0 score: 10
CVSS v3.1 score: 10
GHSA-7j36-gc4r-9x3r Out of bounds access in compact_arena
Affected versions of this crate did not properly implement the generativity, because the invariant lifetimes were not necessarily dropped.This allows an attacker to mix up two arenas, using indices created from one arena with another one. This might lead to an out-of-bounds read or write access into the memory reserved for the arena.The flaw was corrected by implementing generativity correctly in version 0.4.0.
CVSS v3.1 score: 9.8
CVE-1999-1288 
Samba 1.9.18 inadvertently includes a prototype application, wsmbconf, which is installed with incorrect permissions including the setgid bit, which allows local users to read and write files and possibly gain privileges via bugs in the program.
CVSS v2.0 score: 4.6
CVE-2021-37540 
In JetBrains Hub before 2021.1.13262, a potentially insufficient CSP for the Widget deployment feature was used.
CVSS v3.1 score: 6.5
CVSS v2.0 score: 6.4
GHSA-x5rr-h336-hq88 
DATEV Nutzungskontrolle 2.1 and 2.2 has insecure write permissions for critical registry keys, which allows local users to bypass access restrictions by importing NukoInfo values in certain DATEV keys, which disables Nutzungskontrolle.
CVE-2023-39925 WordPress Community by PeepSo Plugin <= 6.1.6.0 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in PeepSo Download Community by PeepSo plugin <= 6.1.6.0 versions.
CVSS v3.1 score: 5.4
CVE-2018-16639 
Typesetter 5.1 allows XSS via the index.php/Admin LABEL parameter during new page creation.
CVSS v3.0 score: 5.4
CVSS v2.0 score: 3.5
RHSA-2025:8643 Red Hat Security Advisory: kernel security update
kernel: vlan: enforce underlying device type kernel: net: gso: fix ownership in __udp_gso_segment kernel: xsk: fix an integer overflow in xp_create_and_assign_umem() kernel: net: fix geneve_opt length integer overflow kernel: ext4: fix OOB read when checking dotdot dir kernel: wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi
CVSS v3.1 score: 7
GHSA-pjc3-rv39-c4v5 
Stack-based buffer overflow in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
CVSS v3.1 score: 7
PYSEC-2026-1807 
Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; all versions of the package github.com/pubnub/go; versions of the package github.com/pubnub/go/v7 before 7.2.0; versions of the package pubnub before 7.3.0; versions of the package pubnub/pubnub before 6.1.0; versions of the package pubnub before 5.3.0; versions of the package pubnub before 0.4.0; versions of the package pubnub/c-core before 4.5.0; versions of the package com.pubnub:pubnub-kotlin before 7.7.0; versions of the package pubnub/swift before 6.2.0; versions of the package pubnub before 5.2.0; versions of the package pubnub before 4.3.0 are vulnerable to Insufficient Entropy via the getKey function, due to inefficient implementation of the AES-256-CBC cryptographic algorithm. The provided encrypt function is less secure when hex encoding and trimming are applied, leaving half of the bits in the key always the same for every encoded message or file.

**Note:**

In order to exploit this vulnerability, the attacker needs to invest resources in preparing the attack and brute-force the encryption.
CVSS v3.1 score: 5.9
GHSA-xvjj-mhxv-ccr9 
Memory leak in Cisco Unity Connection 9.x allows remote attackers to cause a denial of service (memory consumption and process crash) by sending many TCP requests, aka Bug ID CSCud59736.
GHSA-c4gp-x4h5-599j 
Multiple unspecified vulnerabilities in IBM BigFix Remote Control before 9.1.3 allow remote attackers to obtain sensitive information via unknown vectors.
CVSS v3.0 score: 5.3
CVE-2024-30224 WordPress WholesaleX plugin <= 1.3.2 - Unauthenticated PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Wholesale Team WholesaleX.This issue affects WholesaleX: from n/a through 1.3.2.
CVSS v3.1 score: 10
GHSA-2w2c-jqh6-rwvr 
The design of the dialplan functionality in Asterisk Open Source 1.2.x, 1.4.x, and 1.6.x; and Asterisk Business Edition B.x.x and C.x.x, when using the ${EXTEN} channel variable and wildcard pattern matches, allows context-dependent attackers to inject strings into the dialplan using metacharacters that are injected when the variable is expanded, as demonstrated using the Dial application to process a crafted SIP INVITE message that adds an unintended outgoing channel leg.  NOTE: it could be argued that this is not a vulnerability in Asterisk, but a class of vulnerabilities that can occur in any program that uses this feature without the associated filtering functionality that is already available.
GHSA-m385-j8ww-m9fh 
Insertion of Sensitive Information into Log File vulnerability in upKeeper Solutions upKeeper Manager allows Use of Known Domain Credentials.This issue affects upKeeper Manager: from 5.2.0 before 5.2.12.
CVSS v4.0 score: 7.3
CVSS v3.1 score: 6.5
CVE-2022-39084 
In network service, there is a missing permission check. This could lead to local escalation of privilege with System execution privileges needed.
CVSS v3.1 score: 6.7
GHSA-j893-vcpr-rgfc 
Check for certificate revocation only considers the first matching CRL and ignores other valid CRLs of the same CA in the CycloneCrypto cryptographic wrapper of S2OPC library. It might allow connection between an OPC UA client and server using a revoked certificate.
CVSS v3.1 score: 5.6
GHSA-mf83-9r63-76w5 
Multiple cross-site scripting (XSS) vulnerabilities in HTTPTranslatorServlet in Idetix Software Systems Revize CMS allow remote attackers to inject arbitrary web script or HTML via the (1) resourcetype, (2) objectmap, and (3) redirect parameters, possibly involving setWebSpace.jsp.
GHSA-frvf-6637-jq2q 
Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13.
CVSS v3.1 score: 9.8
CVE-2024-41731 Multiple Unrestricted File Upload vulnerabilities in SAP BusinessObjects Business Intelligence Platform
SAP BusinessObjects Business Intelligence
Platform allows an authenticated attacker to upload malicious code over the
network, that could be executed by the application. On successful exploitation,
the attacker can cause a low impact on the Integrity of the application.
CVSS v3.1 score: 3.1
CVE-2021-24315 Give WP < 2.10.4 - Authenticated Stored Cross-Site Scripting (XSS)
The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.4 did not sanitise or escape the Background Image field of its Stripe Checkout Setting and Logo field in its Email settings, leading to authenticated (admin+) Stored XSS issues.
CVSS v3.1 score: 4.8
CVSS v2.0 score: 3.5
CVE-2026-19681 Command Injection
An authenticated command injection vulnerability exists in Security Center related to file upload processing. An attacker could exploit this issue by uploading a specially crafted file, potentially resulting in arbitrary command execution on the underlying operating system.
CVSS v4.0 score: 9.4
CVSS v3.1 score: 9.9
GHSA-3fq7-x42r-jhxq 
A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Sonoma 14. An app may be able to access Notes attachments.
CVSS v3.1 score: 3.3
CVE-2017-2469 
An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
CVSS v3.0 score: 8.8
CVSS v2.0 score: 6.8
CVE-2026-40914 Apache Artemis Stomp Protocol, Apache ActiveMQ Artemis Stomp Protocol: Address routing-type can be updated by STOMP protocol user without the createAddress permission
A vulnerability exists in Apache Artemis whereby an application using the STOMP protocol with security credentials that grant either the consume or send permission on an address can augment the routing-type supported by that address even if said user doesn't have the createAddress permission for that particular address. A user could successfully send a message to an address or consume a message from a queue with a routing-type not supported by the corresponding address when that operation should actually be rejected on the basis that the user doesn't have permission to change the routing-type of the address. Even though the user was already granted permission to send and/or consume messages, they should not be able to augment the routing-type of the address without the createAddress permission.



This issue affects Apache Artemis: from 2.50.0 through 2.53.0; Apache ActiveMQ Artemis: from 2.0.0 through 2.44.0.

Users are recommended to upgrade to version 2.54.0, which fixes the issue.
CVSS v3.1 score: 4.3
CVE-2026-48525 PyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWS
PyJWT is a JSON Web Token implementation in Python. From 2.8.0 to 2.12.1, when verifying detached JWS tokens using the unencoded-payload option ("b64": false, RFC 7797), PyJWT performs Base64URL decoding of the compact-serialization payload segment before enforcing the detached-payload rules. For b64=false, PyJWT later discards that decoded payload and replaces it with the caller-provided detached_payload. In practice, this turns the middle segment into an attacker-controlled “work amplifier”: a remote client can supply an arbitrarily large Base64URL payload segment that forces CPU work + memory allocations even if the signature is invalid. This creates an unauthenticated DoS vector against any endpoint that verifies detached JWS using PyJWT. This vulnerability is fixed in 2.13.0.
CVSS v3.1 score: 5.3
CVE-2026-43367 drm/amd: Fix a few more NULL pointer dereference in device cleanup
In the Linux kernel, the following vulnerability has been resolved:

drm/amd: Fix a few more NULL pointer dereference in device cleanup

I found a few more paths that cleanup fails due to a NULL version pointer
on unsupported hardware.

Add NULL checks as applicable.

(cherry picked from commit f5a05f8414fc10f307eb965f303580c7778f8dd2)
CVSS v3.1 score: 5.5
CVE-2022-26375 WordPress AB Press Optimizer plugin <= 1.1.1 - Auth. Stored Cross-Site Scripting (XSS) vulnerability
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Mammothology AB Press Optimizer plugin <= 1.1.1 on WordPress.
CVSS v3.1 score: 4.8
CVE-2002-0719 
SQL injection vulnerability in the function that services for Microsoft Content Management Server (MCMS) 2001 allows remote attackers to execute arbitrary commands via an MCMS resource request for image files or other files.
CVSS v2.0 score: 7.5
GHSA-686g-g897-5wxx 
Adobe Substance 3D Stager version 2.0.1 (and earlier) is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1 score: 5.5
RHSA-2018:1104 Red Hat Security Advisory: qemu-kvm-rhev security, bug fix, and enhancement update
QEMU: vga: OOB read access during display update QEMU: VGA: reachable assert failure during display update QEMU: Slirp: use-after-free when sending response Qemu: stack buffer overflow in NBD server triggered via long export name qemu: DoS via large option request Qemu: memory exhaustion through framebuffer update request message in VNC server QEMU: I/O: potential memory exhaustion via websock connection to VNC Qemu: Out-of-bounds read in vga_draw_text routine
CVSS v3.0 score: 3
CVE-2026-64265 fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req
In the Linux kernel, the following vulnerability has been resolved:

fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req

When fuse_resend() moves a request from fpq->processing back to
fiq->pending, it sets FR_PENDING and clears FR_SENT but does not
remove the requests intr_entry from fiq->interrupts.  If the
request had FR_INTERRUPTED set from a prior signal, intr_entry
remains dangling on fiq->interrupts.  When the requesting task
then receives a fatal signal, fuse_remove_pending_req() sees
FR_PENDING=1, removes the request from fiq->pending and frees it
via the refcount path, also without cleaning intr_entry.  The
stale intr_entry causes use-after-free when fuse_read_interrupt()
iterates fiq->interrupts:
  - list_del_init(&req->intr_entry) -> UAF write on freed slab
  - req->in.h.unique -> UAF read, data leaked to userspace

Remove intr_entry from fiq->interrupts in fuse_resend() for
interrupted requests before they are placed back on fiq->pending.

Add a WARN_ON if the intr_entry is not empty on request destruction.
CVSS v3.1 score: 7.8
GHSA-jpv2-hwjh-97c7 
** DISPUTED ** OpenStack Keystone through 14.0.1 has a user enumeration vulnerability because invalid usernames have much faster responses than valid ones for a POST /v3/auth/tokens request. NOTE: the vendor's position is that this is a hardening opportunity, and not necessarily an issue that should have an OpenStack Security Advisory.
CVSS v3.0 score: 5.3
CVE-2022-48309 
A CSRF vulnerability allows malicious websites to retrieve logs and technical support archives in Sophos Connect versions older than 2.2.90.
CVSS v3.1 score: 4.3
GHSA-5355-h7h8-637c 
A vulnerability has been identified in SIMATIC S7-PLCSIM V16 (All versions), SIMATIC S7-PLCSIM V17 (All versions), SIMATIC STEP 7 Safety V16 (All versions), SIMATIC STEP 7 Safety V17 (All versions < V17 Update 8), SIMATIC STEP 7 Safety V18 (All versions < V18 Update 5), SIMATIC STEP 7 V16 (All versions), SIMATIC STEP 7 V17 (All versions < V17 Update 8), SIMATIC STEP 7 V18 (All versions < V18 Update 5), SIMATIC WinCC Unified V16 (All versions), SIMATIC WinCC Unified V17 (All versions < V17 Update 8), SIMATIC WinCC Unified V18 (All versions < V18 Update 5), SIMATIC WinCC V16 (All versions), SIMATIC WinCC V17 (All versions < V17 Update 8), SIMATIC WinCC V18 (All versions < V18 Update 5), SIMOCODE ES V16 (All versions), SIMOCODE ES V17 (All versions < V17 Update 8), SIMOCODE ES V18 (All versions), SIMOTION SCOUT TIA V5.4 SP1 (All versions), SIMOTION SCOUT TIA V5.4 SP3 (All versions), SIMOTION SCOUT TIA V5.5 SP1 (All versions), SINAMICS Startdrive V16 (All versions), SINAMICS Startdrive V17 (All versions), SINAMICS Startdrive V18 (All versions), SIRIUS Safety ES V17 (All versions < V17 Update 8), SIRIUS Safety ES V18 (All versions), SIRIUS Soft Starter ES V17 (All versions < V17 Update 8), SIRIUS Soft Starter ES V18 (All versions), TIA Portal Cloud V16 (All versions), TIA Portal Cloud V17 (All versions < V4.6.0.1), TIA Portal Cloud V18 (All versions < V4.6.1.0). Affected products do not properly sanitize user-controllable input when parsing user settings. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application.
CVSS v4.0 score: 7
CVSS v3.1 score: 7.3
CVE-2023-41705 
Processing of user-defined DAV user-agent strings is not limited. Availability of OX App Suite could be reduced due to high processing load. Please deploy the provided updates and patch releases. Processing time of DAV user-agents now gets monitored, and the related request is terminated if a resource threshold is reached. No publicly available exploits are known.
CVSS v3.1 score: 6.5
CVE-2025-23671 WordPress WP OpenSearch plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sav WP OpenSearch wp-opensearch allows Stored XSS.This issue affects WP OpenSearch: from n/a through <= 1.0.
CVSS v3.1 score: 7.1
GHSA-5494-m8hp-j85p 
A vulnerability was found in Tenda AC10 16.03.10.13 and classified as critical. This issue affects the function fromSetRouteStatic of the file /goform/SetStaticRouteCfg. The manipulation of the argument list leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257081 was assigned to this vulnerability.
CVSS v3.1 score: 8.8
CVE-2014-6646 
The bellyhoodcom (aka com.tapatalk.bellyhoodcom) application 3.4.23 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0 score: 5.4
CVE-2023-23548 XSS in business intelligence
Reflected XSS in business intelligence in Checkmk <2.2.0p8, <2.1.0p32, <2.0.0p38, <=1.6.0p30.
CVSS v3.1 score: 5.4
CVE-2025-29944 
A buffer overflow vulnerability within AMD Sensor Fusion Hub Driver can allow a local attacker to write out of bounds, potentially resulting in denial of service or crash
CVSS v4.0 score: 6.8
GHSA-h369-f67q-2q4c 
libpoppler.so in Poppler through 24.12.0 has an out-of-bounds read vulnerability within the JBIG2Bitmap::combine function in JBIG2Stream.cc.
CVSS v3.1 score: 4.3
CVE-2007-6585 
PHP remote file inclusion vulnerability in confirmUnsubscription.php in NmnNewsletter 1.0.7 allows remote attackers to execute arbitrary PHP code via a URL in the output parameter.
CVSS v2.0 score: 6.8
CVE-2020-7512 
A CWE-1103: Use of Platform-Dependent Third Party Components with vulnerabilities vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an attacker to exploit the component.
CVSS v3.1 score: 9.8
CVSS v2.0 score: 7.5
CVE-2024-45246 Diebold Nixdorf – CWE-427: Uncontrolled Search Path Element
Diebold Nixdorf – CWE-427: Uncontrolled Search Path Element
CVSS v3.1 score: 7.3
CVE-2023-39959 Existence of calendars and address books can be checked by unauthenticated users
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.9, 26.0.4, and 27.0.1, unauthenticated users could send a DAV request which reveals whether a calendar or an address book with the given identifier exists for the victim. Nextcloud Server versions 25.0.9, 26.0.4, and 27.0.1 and Nextcloud Enterprise Server versions 25.0.9, 26.0.4, and 27.0.1 contain a patch for this issue. No known workarounds are available.
CVSS v3.1 score: 3.5
GHSA-q672-hfc7-g833 Apache Druid Vulnerable to Authentication Bypass
Affected Products and VersionsApache DruidAffected Versions: 0.17.0 through 35.x (all versions prior to 36.0.0)Prerequisites:  *  druid-basic-security extension enabledLDAP authenticator configuredUnderlying LDAP server permits anonymous bindVulnerability DescriptionAn authentication bypass vulnerability exists in Apache Druid when using the druid-basic-security extension with LDAP authentication. If the underlying LDAP server is configured to allow anonymous
binds, an attacker can bypass authentication by providing an existing username with an empty password. This allows unauthorized access to otherwise restricted Druid resources without valid credentials.The vulnerability stems from improper validation of LDAP authentication responses when anonymous binds are permitted, effectively treating anonymous bind success as valid user authentication.ImpactA remote, unauthenticated attacker can:Gain unauthorized access to the Apache Druid clusterAccess sensitive data stored in Druid datasourcesExecute queries and potentially manipulate dataAccess administrative interfaces if the bypassed account has elevated privilegesCompletely compromise the confidentiality, integrity, and availability of the Druid deploymentMitigation
 
Immediate Mitigation (No Druid Upgrade Required):Disable anonymous bind on your LDAP server. This prevents the vulnerability from being exploitable and is the recommended immediate action.ResolutionUpgrade Apache Druid to version 36.0.0 or later, which includes fixes to properly reject anonymous LDAP bind attempts.
CVSS v4.0 score: 9.3
GHSA-5cch-gjr9-6pjq 
The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before reflecting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS v3.1 score: 7.1
CVE-2024-57046 
A vulnerability in the Netgear DGN2200 router with firmware version v1.0.0.46 and earlier permits unauthorized individuals to bypass the authentication. When adding "?x=1.gif" to the the requested url, it will be recognized as passing the authentication.
CVSS v3.1 score: 8.8
GHSA-3j2h-fq3g-cjhp 
Buffer overflow in KDE kdesud on Linux allows local uses to gain privileges via a long DISPLAY environmental variable.
GHSA-7vxw-69v7-42x7 
A high-severity vulnerability in the deployment of Genetec RabbitMQ that allows a privilege escalation attack.
CVSS v3.1 score: 7.8
CVE-2005-4743 
Multiple SQL injection vulnerabilities in index.php in NeLogic Nephp Publisher 4.5.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id and (2) nnet_catid parameters.
CVSS v2.0 score: 5
CVE-2024-0166 

Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc_tcpdump utility. An authenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands with elevated privileges.


CVSS v3.1 score: 7.8
GHSA-3jh9-f674-f46f 
Unknown vulnerability in ImagePage for MediaWiki 1.3.5, related to "filename validation," has unknown impact and attack vectors.
CVE-2024-8828 PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of EMF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24313.
CVSS v3.0 score: 3.3
RHSA-2017:0004 Red Hat Security Advisory: kernel security and bug fix update
kernel: Remotely triggerable recursion in GRE code leading to kernel crash
CVSS v3.0 score: 7.5
GHSA-29jw-9pjp-p7x2 
An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the "Kernel" component. It allows attackers to bypass intended memory-read restrictions via a /dev/dtracehelper attack involving the dtrace_dif_variable and dtrace_getarg functions.
CVSS v3.0 score: 5.5
GHSA-xqj5-x7c8-6f4h 
Uncontrolled search path in software installer for Intel(R) PROSet/Wireless WiFi in Windows 10 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2026-21256 GitHub Copilot and Visual Studio Remote Code Execution Vulnerability
Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to execute code over a network.
CVSS v3.1 score: 8.8
GHSA-w8xv-qx85-22qq 
The device-management command-line interface in Palo Alto Networks PAN-OS before 3.1.12, 4.0.x before 4.0.10, and 4.1.x before 4.1.4 allows remote attackers to execute arbitrary code via unspecified vectors, aka Ref ID 36983.
CVE-2007-6057 
PHP remote file inclusion vulnerability in index.php in datecomm Social Networking Script (aka Myspace Clone Script) allows remote attackers to execute arbitrary PHP code via a URL in the pg parameter.
CVSS v2.0 score: 6.8
GHSA-3fx2-9cxr-pgrx 
The SP Project & Document Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the cdm_save_category AJAX action in all versions up to, and including, 4.70. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary folder name that do not belong to them.
CVSS v3.1 score: 4.3
GHSA-fm5j-qm9h-3w36 
Multiple cross-site request forgery (CSRF) vulnerabilities in Revive Adserver before 3.0.5 allow remote attackers to hijack the authentication of administrators for requests that (1) delete data via a request to agency-delete.php, (2) tracker-delete.php, or (3) userlog-delete.php in admin/ or (4) unlink accounts via a request to admin-user-unlink.php. (5) advertiser-user-unlink.php, or (6) affiliate-user-unlink.php in admin/.
CVE-2023-23804 WordPress HT Feed Plugin <= 1.2.7 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in HasThemes HT Feed plugin <= 1.2.7 versions.
CVSS v3.1 score: 4.3
GHSA-fpgv-9v95-hrgv 
A url redirection to untrusted site ('open redirect') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows attacker to use the device as proxy via crafted GET parameters in requests to error handlers
GHSA-x5j3-2q4h-rfvw 
The baby days (aka jp.co.cyberagent.babydays) application 1.5.8 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
GHSA-7cv6-52m7-636w 
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).
CVSS v3.1 score: 8.3
RHSA-2003:166 Red Hat Security Advisory: : : : Updated MySQL packages fix vulnerabilities
security flaw security flaw security flaw security flaw security flaw security flaw
GHSA-gw92-cf78-427q 
Microsoft Exchange Server Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-21855, CVE-2022-21969.
CVSS v3.1 score: 9
GHSA-vqc4-v8hc-h2jg Polynomial regular expression used on uncontrolled data in nitrado.js
ImpactPossible ReDoS with lib input of `{{` and with many repetitions of `{{|`PatchesPatched in all versions above `0.2.5`WorkaroundsNo known work arounds.ReferencesOWASP: [Regular expression Denial of Service - ReDoS](https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS)Wikipedia: [ReDoS](https://en.wikipedia.org/wiki/ReDoS).Wikipedia: [Time complexity](https://en.wikipedia.org/wiki/Time_complexity).James Kirrage, Asiri Rathnayake, Hayo Thielecke: [Static Analysis for Regular Expression Denial-of-Service Attack](http://www.cs.bham.ac.uk/~hxt/research/reg-exp-sec.pdf).Common Weakness Enumeration: [CWE-1333](https://cwe.mitre.org/data/definitions/1333.html).Common Weakness Enumeration: [CWE-400](https://cwe.mitre.org/data/definitions/400.html).
CVSS v3.1 score: 7.5
CVE-2025-10696 OpenSupports 4.11.0 — Insecure Direct Object Reference in supervised list
OpenSupports exposes an endpoint that allows the list of 'supervised users' for any account to be edited, but it does not validate whether the actor is the owner of that list. A Level 1 staff member can modify the supervision relationship of a third party (the target user), who can then view the tickets of the added 'supervised' users. This breaks the authorization model and filters the content of other users' tickets.This issue affects OpenSupports: 4.11.0.
CVSS v4.0 score: 7.1
CVE-2025-13888 Openshift-gitops-operator: openshift gitops: namespace admin cluster takeover via privileged jobs
A flaw was found in OpenShift GitOps. Namespace admins can create ArgoCD Custom Resources (CRs) that trick the system into granting them elevated permissions in other namespaces, including privileged namespaces. An authenticated attacker can then use these elevated permissions to create privileged workloads that run on master nodes, effectively giving them root access to the entire cluster.
CVSS v3.1 score: 9.1
ICSA-25-135-04 Siemens Desigo
The affected server application fails to authenticate specific client requests. Modification of the client binary could allow an unauthenticated remote attacker to execute arbitrary SQL queries on the server database via the event port (default: 4998/tcp) If access from Installed Clients to Desigo CC server is only allowed within highly protected zones:
Exploitation of this issue requires an attacker to get access to an Installed Client application in the "highly protected zone" (i.e. a physically separated private network), and bypass the hardening measures as described by Desigo CC Cybersecurity Guideline.
CVSS v3.1 score: 5.7
GHSA-vrc7-6g8w-jh56 Improper Input Validation in xdLocalStorage
An issue was discovered in xdLocalStorage through 2.0.5. The receiveMessage() function in xdLocalStoragePostMessageApi.js does not implement any validation of the origin of web messages. Remote attackers who can entice a user to load a malicious site can exploit this issue to impact the confidentiality and integrity of data in the local storage of the vulnerable site via malicious web messages.
CVSS v3.1 score: 7.1
GHSA-5h43-mgm6-g27r 
Multiple unspecified vulnerabilities in Google Chrome before 16.0.912.44 on the Acer AC700, Samsung Series 5, and Cr-48 Chromebook platforms have unknown impact and attack vectors.
CVE-2017-15756 
IrfanView 4.50 - 64bit with BabaCAD4Image plugin version 1.3 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file, related to "Data from Faulting Address controls subsequent Write Address starting at BabaCAD4Image!ShowPlugInOptions+0x000000000004d7c4."
CVSS v3.0 score: 7.8
CVSS v2.0 score: 6.8
CVE-2016-10943 
The zx-csv-upload plugin 1 for WordPress has SQL injection via the id parameter.
CVSS v3.1 score: 7.2
CVSS v2.0 score: 6.5
GHSA-8mmq-vpxh-4872 
The NotificationRepresentationFactoryImpl class in Atlassian Universal Plugin Manager before version 2.22.9 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of user submitted add-on names.
CVSS v3.0 score: 5.4
GHSA-8qc4-xrrp-xx3v 
In the Linux kernel, the following vulnerability has been resolved:net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()kalmia_rx_fixup() computes usb_packet_length = skb->len - (2 *
KALMIA_HEADER_LENGTH) as a u16, guarded only by a pre-loop check that
skb->len is at least KALMIA_HEADER_LENGTH, which is 6. A device can
deliver a short bulk-IN frame with skb->len in the 6 to 11 range, or
leave a short trailing remainder on a later loop iteration. Either case
underflows usb_packet_length to about 65530.That bypasses the usb_packet_length < ether_packet_length truncation path.
The device-supplied ether_packet_length, a le16 up to 65535 read from
header_start[2], then drives a memcmp() and the following skb_trim() and
skb_pull() past the end of the rx buffer. The rx buffer is hard_mtu * 10,
which is 14000 bytes. That is an out of bounds read.Require both the start and end framing headers to be present before
subtracting them, on every loop iteration.
GHSA-5rhg-q7gx-pwvw 
Improper privilege management in Microsoft Dynamics 365 Customer Insights allows an authorized attacker to elevate privileges over a network.
CVSS v3.1 score: 7.7
GHSA-9mcr-4gp8-f783 
ImageIO in Apple OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted metadata in an image.
PYSEC-2022-270 
indy-node is the server portion of Hyperledger Indy, a distributed ledger purpose-built for decentralized identity. In vulnerable versions of indy-node, an attacker can max out the number of client connections allowed by the ledger, leaving the ledger unable to be used for its intended purpose. However, the ledger content will not be impacted and the ledger will resume functioning after the attack. This attack exploits the trade-off between resilience and availability. Any protection against abusive client connections will also prevent the network being accessed by certain legitimate users. As a result, validator nodes must tune their firewall rules to ensure the right trade-off for their network's expected users. The guidance to network operators for the use of firewall rules in the deployment of Indy networks has been modified to better protect against denial of service attacks by increasing the cost and complexity in mounting such attacks. The mitigation for this vulnerability is not in the Hyperledger Indy code per se, but rather in the individual deployments of Indy. The mitigations should be applied to all deployments of Indy, and are not related to a particular release.
GHSA-mc9r-rc7r-x444 
Unauthenticated PHP Object Injection in Booking Activities <= 1.18.4 versions.
CVSS v3.1 score: 8.8
CVE-2019-17222 
An issue was discovered on Intelbras WRN 150 1.0.17 devices. There is stored XSS in the Service Name tab of the WAN configuration screen, leading to a denial of service (inability to change the configuration).
CVSS v3.1 score: 6.1
CVSS v2.0 score: 4.3
GHSA-jhg8-f96w-x397 
Shop manager PHP Object Injection in WooCommerce PDF Invoices & Packing Slips < 5.9.0 versions.
CVSS v3.1 score: 7.2
GHSA-c97w-qxq4-p2rg 
Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as the view _monitor_filters.php contains takes in input from the user and saves it into the session, and retrieves it later (insecurely). The values of the MonitorName and Source parameters are being displayed without any output filtration being applied. This relates to the view=cycle value.
CVSS v3.0 score: 6.1
RHSA-2026:0930 Red Hat Security Advisory: pcs security update
tornado: Tornado Quadratic DoS via Repeated Header Coalescing tornado: Tornado Quadratic DoS via Crafted Multipart Parameters
CVSS v3.1 score: 5.3
GHSA-xg2h-5xr2-29jw Microsoft Kiota: Code Generation Literal Injection in Kiota Ruby Generator
Code Generation Literal Injection in Kiota Ruby Generator Leads to Arbitrary Code ExecutionImpactThe Kiota Ruby code generator is vulnerable to a code generation literal injection attack. The generator embeds string values from OpenAPI default fields and property names directly into Ruby double-quoted string literals without properly escaping the # character. Since Ruby evaluates string interpolation expressions like #{expr}, #$var, and #@var within double-quoted strings at runtime, an attacker who controls an OpenAPI specification file can inject arbitrary Ruby code into generated model classes.Who is impactedDevelopers using Kiota to generate Ruby API clients from external or untrusted OpenAPI specifications
Teams with CI/CD pipelines configured to automatically regenerate client code from remote specs
Applications that deploy generated Ruby code to production serversVulnerability detailsAffected component: CodeMethodWriter.cs
Root cause: The shared SanitizeForQuotedLiteral() function in Writers/StringExtensions.cs does not escape the # characterAttack vectorsOpenAPI default fields in schema properties
Property wire-name hash keys in deserializer/serializer methods
Any schema-derived string embedded in Ruby double-quoted literals
Severity: Critical when generated code reaches production; High for CI/CD environments with access to production secrets; Medium for public third-party specs; Low for developer-controlled specs.Patcheshttps://github.com/microsoft/kiota/pull/7746WorkaroundsIf you cannot upgrade immediately:Audit and sanitize OpenAPI specifications: Review all OpenAPI specification files for any default values or property names containing the # character. Remove or replace any suspicious strings before code generation.Code review of generated files: Implement mandatory code review of all generated Ruby files before merging into any branch. Look for double-quoted strings containing #{, #$, or #@ patterns.Restrict specification sources: Only consume OpenAPI specifications from trusted internal sources. Avoid automatic code generation from external or third-party APIs until this patch is applied.Isolate generated code from production: Do not deploy generated Ruby models to production environments unless the specification source has been verified and reviewed.Manual escaping (temporary): If regeneration is not possible, manually inspect and edit generated files to escape any # characters in string literals (replace # with \# in double-quoted strings).RemediationUpgrade Kiota to 1.29.1, 1.32.0, or later.
Regenerate/refresh existing generated clients as a precaution:Refreshing generated clients ensures previously generated vulnerable code is replaced with hardened output.
CVSS v3.1 score: 7.5
GHSA-9589-mq83-f749 Mattermost Server is vulnerable to DoS through maliciously crafted posts
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows crafted posts that potentially cause a web browser to hang.
CVSS v3.1 score: 5.3
GHSA-hvp3-26wx-g2w4 Strapi: Password Reset Does Not Revoke Existing Refresh Sessions
Summary of CVE-2026-22706 Vulnerability DetailsCVE: CVE-2026-22706CVSS v3.1 Vector: `CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N` (2.1 — Low)Affected Versions: `@strapi/admin` and `@strapi/plugin-users-permissions` <=5.33.2How to Patch: Immediately update your Strapi to >=5.33.3Description of CVE-2026-22706In Strapi versions prior to 5.33.3, changing or resetting a user's password did not invalidate the user's existing refresh-token sessions by default. The refresh-token invalidation step in the users-permissions and admin authentication controllers was conditional on a caller-supplied `deviceId`. When a password change or reset request did not include a `deviceId`, no refresh tokens were revoked, leaving every prior session active.An attacker who had previously obtained a refresh token could continue minting new access tokens after the legitimate user reset their password, allowing persistent unauthorized access for the lifetime of the refresh token (up to 30 days by default). Rotating credentials no longer terminated an active attacker session, defeating password reset as a containment measure.The patch invalidates all refresh tokens associated with the user on every password change and password reset, regardless of whether a `deviceId` is supplied. A new device-scoped session is then issued to the caller as part of the response.IoC's for CVE-2026-22706Indicators that an instance running an unpatched version may have been exploited:Successful `POST /api/auth/refresh` or `POST /admin/access-token` requests using a refresh token issued before the user's most recent password change. Reviewable by correlating refresh-token `iat` claims against password-change events in audit logsNew access-token issuances for a user whose password was reset within the past 30 days, originating from an IP or User-Agent that did not perform the resetMultiple active refresh tokens for a single user across distinct IPs after a password reset eventDatabase query: rows in `strapi_session` with `created_at` earlier than the user's most recent password-reset timestamp and `status = 'active'`ReferencesOWASP ASVS 4.0 – V2.1.1: Session invalidation on credential changeOWASP Top 10 – A2: Broken AuthenticationCreditsbugbunny.aiAndyAnh174 (concurrent report, 2026-04-09 — originally filed as GHSA-c6gj-8rxm-jrf2, closed as duplicate)Aastha2602 (concurrent report, 2026-03-10 — originally filed as GHSA-5qvg-4jch-gvf4, closed as duplicate)
CVSS v4.0 score: 2.1