CIRCL/vulnerability-scores huggingface dataset:
RHSA-2026:48864 Red Hat Security Advisory: abrt security update
abrt: TOCTOU race condition in abrt-dbus SetElement allows arbitrary file writes to dump directories abrt: ChownProblemDir succeeds during active post-create event processing due to inadequate locking
CVSS v3.1 score: 7
GHSA-c93h-6xwh-xgwm 
The Google Maps Plugin by Intergeo for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'intergeo' shortcode in versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1 score: 5.4
CVE-2020-4692 
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.2 and 5.2.0.0 through 5.2.6.5 could allow an authenticated user to obtain sensitive information from the Dashboard UI. IBM X-Force ID: 186780.
CVSS v3.0 score: 4.3
GHSA-hc5r-cmjq-47w9 
Integer Overflow or Wraparound vulnerability in the EtherNet/IP function of Mitsubishi Electric MELSEC iQ-F Series FX5-EIP EtherNet/IP module FX5-EIP versions 1.000 and prior allows a remote attacker to cause a denial-of-service (DoS) condition in the affected product by rapidly establishing a large number of TCP connections to it, resulting in an inconsistency in the product's internal connection management process and triggering improper memory access.
CVSS v4.0 score: 8.7
CVE-2022-36321 
In JetBrains TeamCity before 2022.04.2 the private SSH key could be written to the build log in some cases
CVSS v3.1 score: 4.1
CVE-2021-43214 Web Media Extensions Remote Code Execution Vulnerability
Web Media Extensions Remote Code Execution Vulnerability
CVSS v3.1 score: 7.8
GHSA-pf4h-hrv7-mq9v 
A logical error in ownCloud Server before 10.0.2 caused disclosure of valid share tokens for public calendars. Thus granting an attacker potentially access to publicly shared calendars without knowing the share token.
CVSS v3.0 score: 5.3
CVE-2023-40420 
The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.6, tvOS 17, iOS 16.7 and iPadOS 16.7, macOS Monterey 12.7, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. Processing web content may lead to a denial-of-service.
CVSS v3.1 score: 6.5
GHSA-5h44-gvxp-wqcj 
A flaw has been found in code-projects Intern Membership Management System 1.0. The impacted element is an unknown function of the file /intern/admin/edit_admin.php. This manipulation of the argument admin_id causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.
CVSS v4.0 score: 2
CVSS v3.1 score: 4.7
GHSA-828x-pwwm-pchf 
The Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.29, 8.0 before 8.0.0.7, and 8.5 before 8.5.5.0 does not properly perform caching, which allows local users to obtain sensitive information via unspecified vectors.
PYSEC-2026-2329 
A vulnerability was identified in modelscope agentscope up to 1.0.18. Affected by this issue is the function _parse_url/prepare_image/openai_audio_to_text of the file src/agentscope/tool/_multi_modality/_openai_tools.py of the component Cloud Metadata Endpoint. Such manipulation of the argument image_url/audio_file_url leads to server-side request forgery. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0 score: 5.5
CVSS v3.1 score: 7.3
GHSA-xf73-8777-6w59 
Student Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'coursecode' parameter of the marks.php resource does not validate the characters received and they are sent unfiltered to the database.
CVSS v3.1 score: 9.8
GHSA-h93p-8rwh-9568 
Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVSS v3.1 score: 4.3
GHSA-4h66-vghf-xg5x get-npm-package-version Command Injection vulnerability
The package get-npm-package-version before 1.0.7 is vulnerable to Command Injection via the `main` function in index.js.
CVSS v3.1 score: 9.8
CVE-2026-45070 Symfony: Email Header Injection via Non-Token Characters in Mime Parameter Names
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Mime\Header\ParameterizedHeader validates and encodes parameter values but emits parameter names verbatim, allowing a caller that derives a parameter name from untrusted input to include CRLF or other non-token bytes and inject additional headers into rendered structured mail headers such as Content-Type or Content-Disposition. This issue is reported as fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.
CVSS v4.0 score: 6.3
GHSA-8645-v7wf-jmfg 
Adobe Bridge version 11.1.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.
CVSS v3.1 score: 7.8
GHSA-g9jf-xxjf-qx55 
Dell EMC ECS versions 3.2.0.0 and 3.2.0.1 contain an authentication bypass vulnerability. A remote unauthenticated attacker could exploit this vulnerability to read and modify S3 objects by supplying specially crafted S3 requests.
CVSS v3.0 score: 9.8
GHSA-m5h2-r64r-63jh 
CWE-1392: Use of Default Credentials
CVSS v3.1 score: 10
CVE-2005-3265 
Buffer overflow in Skype for Windows 1.1.x.0 through 1.4.x.83 allows remote attackers to execute arbitrary code via (1) callto:// and (2) skype:// links, or (3) a non-standard VCARD, possibly due to an underlying error in the SysUtils.WideFmtStr Delphi routine.
CVSS v2.0 score: 9.3
CVE-2019-4176 
IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10.4.0 could allow a remote attacker to bypass security restrictions, caused by an error related to insecure HTTP Methods. An attacker could exploit this vulnerability to gain access to the system. IBM X-Force ID: 158881.
CVSS v3.0 score: 5.3
GHSA-7j6h-j855-chvw 
An Absolute Path Traversal vulnerability exists in Navtor NavBox. The application exposes an HTTP service that fails to properly sanitize user-supplied path input. Unauthenticated remote attackers can exploit this issue by submitting requests containing absolute filesystem paths. Successful exploitation allows the attacker to retrieve arbitrary files from the underlying filesystem, limited only by the privileges of the service process. This can lead to the exposure of sensitive configuration files and system information.
CVSS v3.1 score: 7.5
GHSA-qqrr-hr4w-72g2 
SAP Payment Engine version 500, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
CVE-2023-49203 
Technitium 11.5.3 allows remote attackers to cause a denial of service (bandwidth amplification) because the DNSBomb manipulation causes accumulation of low-rate DNS queries such that there is a large-sized response in a burst of traffic.
CVSS v3.1 score: 7.5
GHSA-3xwr-pg9v-wcpj 
Inappropriate implementation in Compositing in Google Chrome on Linux and Windows prior to 89.0.4389.72 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
CVE-2016-7923 
The ARP parser in tcpdump before 4.9.0 has a buffer overflow in print-arp.c:arp_print().
CVSS v3.0 score: 9.8
CVSS v2.0 score: 7.5
CVE-2017-8923 
The zend_string_extend function in Zend/zend_string.h in PHP through 7.1.5 does not prevent changes to string objects that result in a negative length, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging a script's use of .= with a long string.
CVSS v3.1 score: 9.8
CVSS v2.0 score: 7.5
GHSA-27qf-jwm8-g7f3 FPE in LSH in TFLite
ImpactAn attacker can craft a TFLite model that would trigger a division by zero error in LSH  [implementation](https://github.com/tensorflow/tensorflow/blob/149562d49faa709ea80df1d99fc41d005b81082a/tensorflow/lite/kernels/lsh_projection.cc#L118).There is no check that the first dimension of the input is non zero.PatchesWe have patched the issue in GitHub commit [0575b640091680cfb70f4dd93e70658de43b94f9](https://github.com/tensorflow/tensorflow/commit/0575b640091680cfb70f4dd93e70658de43b94f9).The fix will be included in TensorFlow 2.6.0. We will also cherrypick thiscommit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.For more informationPlease consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for  more information regarding the security model and how to contact us with issues and questions.AttributionThis vulnerability has been reported by Yakun Zhang of Baidu Security.
CVSS v4.0 score: 6.8
CVSS v3.1 score: 5.5
CVE-2024-28353 
There is a command injection vulnerability in the TRENDnet TEW-827DRU router with firmware version 2.10B01. An attacker can inject commands into the post request parameters usapps.config.smb_admin_name in the apply.cgi interface, thereby gaining root shell privileges.
CVSS v3.1 score: 8.8
CVE-2013-2316 
The Yahoo! Browser application 1.4.4 and earlier for Android allows remote attackers to spoof the address bar via vectors related to URL display, a different vulnerability than CVE-2013-2307.
CVSS v2.0 score: 5.8
GHSA-wjhx-5m6h-5x26 
Author Cross Site Scripting (XSS) in Machete <= 5.2 versions.
CVSS v3.1 score: 5.9
GHSA-9mrp-7cm9-xqxq 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of EZIX files. A crafted id in a channel element can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-11197.
CVE-2004-2067 
SQL injection vulnerability in controlpanel.php in Jaws Framework and Content Management System 0.4 allows remote attackers to execute arbitrary SQL and bypass authentication via the (1) user, (2) password, or (3) crypted_password parameters.
CVSS v2.0 score: 7.5
GHSA-7wqw-x4hm-9mw6 
Multiple "endianness errors" in libgadu in ekg before 1.6rc2 allow remote attackers to cause a denial of service (invalid behavior in applications) on big-endian systems.
GHSA-6x86-vh35-w9qc 
The Hotel Story: Resort Simulation (aka com.happylabs.hotelstory) application 1.7.9B for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
RHSA-2026:13845 Red Hat Security Advisory: webkit2gtk3 security update
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash webkitgtk: Processing maliciously crafted web content may disclose internal states of the app webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash webkitgtk: Processing maliciously crafted web content may bypass Same Origin Policy webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash webkitgtk: A remote attacker may be able to cause a denial-of-service webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash webkitgtk: Processing maliciously crafted web content may prevent Content Security Policy from being enforced webkitgtk: A website may be able to track users through Safari web extensions webkitgtk: A maliciously crafted webpage may be able to fingerprint the user webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash webkitgtk: A malicious website may be able to process restricted web content outside the sandbox webkitgtk: Visiting a maliciously crafted website may lead to a cross-site scripting attack
CVSS v3.1 score: 4.3
CVE-2014-0545 
Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows and OS X and before 14.0.0.179 on Android, Adobe AIR SDK before 14.0.0.178, and Adobe AIR SDK & Compiler before 14.0.0.178 do not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism via unspecified vectors, a different vulnerability than CVE-2014-0540, CVE-2014-0542, CVE-2014-0543, and CVE-2014-0544.
CVSS v2.0 score: 10
CVE-2019-4687 
IBM Security Guardium Data Encryption (GDE) 3.0.0.2 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 171823.
CVSS v3.0 score: 3.7
GHSA-4j3c-hhjr-6vg6 
Capgo before 12.128.2 contains a server-side validation bypass vulnerability in organization security settings that allows authenticated org admins to persist invalid security policy state. Attackers can bypass backend validation by directly updating the public.orgs table from the browser, circumventing field-level validation checks for max_apikey_expiration_days and other security-sensitive configuration parameters.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 4.3
CVE-2026-6025 Totolink A7100RU CGI cstecgi.cgi setSyslogCfg os command injection
A vulnerability was identified in Totolink A7100RU 7.4cu.2313_b20191024. This affects the function setSyslogCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument enable leads to os command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
CVSS v4.0 score: 9.3
CVSS v3.1 score: 9.8
CVSS v3.0 score: 9.8
CVSS v2.0 score: 10
CVE-2024-30922 
SQL Injection vulnerability in DerbyNet v9.0 allows a remote attacker to execute arbitrary code via the where Clause in Award Document Rendering.
CVSS v3.1 score: 9.8
CVE-2008-5387 
Buffer overflow in autoconf6 in IBM AIX 6.1.0 through 6.1.2, when Role-Based Access Control is enabled, allows local users with aix.network.config.tcpip authorization to gain privileges via unspecified vectors.
CVSS v2.0 score: 6.2
GHSA-p4hq-9rw5-2cwc 
Bandisoft BandiView 7.05 is vulnerable to Buffer Overflow via sub_0x410d1d. The vulnerability occurs due to insufficient validation of PSD files.
CVSS v3.1 score: 6.3
GHSA-vp9h-w4rm-xp28 
Directory traversal vulnerability in the PersistenceService in Sun Java Web Start in JDK and JRE 5.0 Update 11 and earlier, and Java Web Start in SDK and JRE 1.4.2_13 and earlier, for Windows allows remote attackers to perform unauthorized actions via an application that grants file overwrite privileges to itself.  NOTE: this can be leveraged to execute arbitrary code by overwriting a .java.policy file.
CVE-2025-47568 WordPress ZoomSounds plugin <= 6.91 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ZoomIt ZoomSounds dzs-zoomsounds allows Object Injection.This issue affects ZoomSounds: from n/a through <= 6.91.
CVSS v3.1 score: 9.8
GHSA-9vw8-375m-pj63 
A vulnerability was determined in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260206. This impacts an unknown function of the file /dm/dispatch/user/delete of the component User Handler. This manipulation of the argument ID causes improper access controls. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0 score: 5.5
CVSS v3.1 score: 6.5
GHSA-7h3q-9phg-4p7r 
A link following vulnerability in Trend Micro Deep Security 20.0 agents could allow a local attacker to create a denial of service (DoS) situation on affected installations.Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS v3.1 score: 5.5
CVE-2017-3475 
Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Miscellaneous). Supported versions that are affected are 2.0.0, 2.0.1, 2.2.0.1 and 12.0.1. Easily "exploitable" vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking. While the vulnerability is in Oracle FLEXCUBE Private Banking, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle FLEXCUBE Private Banking. CVSS 3.0 Base Score 5.0 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L).
CVSS v3.0 score: 5
CVSS v2.0 score: 4
GHSA-7pc9-m44p-j3cw 
WonderCMS before 2.0.3 has CSRF because of lack of a token in an unspecified context.
CVSS v3.0 score: 8.8
GHSA-v5qh-69hw-34f2 
Cross-site scripting (XSS) vulnerability in the Rendered links formatter in the Menu Reference module 7.x-1.x before 7.x-1.0 for Drupal allows remote authenticated users with the "Administer menus and menu items" permission to inject arbitrary web script or HTML via the menu link title.
GHSA-xf58-4g5r-cm9h 
src/main-win.c in GPicView 0.1.9 in Lightweight X11 Desktop Environment (LXDE) allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename.
GHSA-v6qx-c5rh-4q6q 
An issue was discovered in AtaLegacySmm in the kernel 5.0 before 05.08.46, 5.1 before 05.16.46, 5.2 before 05.26.46, 5.3 before 05.35.46, 5.4 before 05.43.46, and 5.5 before 05.51.45 in Insyde InsydeH2O. Code execution can occur because the SMI handler lacks a CommBuffer check.
CVE-2024-8913 The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.11 - Authenticated (Contributor+) Sensitive Information Exposure via content_template
The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.6.11 via the render function in modules/widgets/tp_accordion.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data.
CVSS v3.1 score: 4.3
GHSA-6q5v-v3c3-5mrp 
A vulnerability was found in PHPGurukul Online Shopping Portal Project 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /category.php. The manipulation of the argument Product leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 7.3
GHSA-qwj2-2fwc-g58h 
The URL Media Uploader plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.0 via the 'url_media_uploader_url_upload' action. This makes it possible for authenticated attackers, with author-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
CVSS v3.1 score: 6.4
CVE-2021-23417 Prototype Pollution
All versions of package deepmergefn are vulnerable to Prototype Pollution via deepMerge function.
CVSS v3.1 score: 5.6
GHSA-x3w2-c49h-w7x4 
In Directus, versions 9.0.0-alpha.4 through 9.4.1 are vulnerable to stored Cross-Site Scripting (XSS) vulnerability via SVG file upload in media upload functionality. A low privileged attacker can inject arbitrary javascript code which will be executed in a victim’s browser when they open the image URL.
GHSA-q92v-3f4w-5xg8 Jenkins Applitools Eyes Plugin vulnerability exposes unencrypted keys to certain authenticated users
Jenkins Applitools Eyes Plugin 1.16.5 and earlier stores Applitools API keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
CVSS v3.1 score: 4.3
GHSA-g8mc-c5f2-mqg7 Duplicate Advisory: OpenClaw Bypasses DM Policy Separation via Synology Chat Webhook Path Collision
Duplicate AdvisoryThis advisory has been withdrawn because it is a duplicate of GHSA-rqp8-q22p-5j9q This link is maintained to preserve external references.Original DescriptionOpenClaw before 2026.3.22 contains a webhook path route replacement vulnerability in the Synology Chat extension that allows attackers to collapse multi-account configurations onto shared webhook paths. Attackers can exploit inherited or duplicate webhook paths to bypass per-account DM access control policies and replace route ownership across accounts.
CVSS v4.0 score: 6.3
CVSS v3.1 score: 4.8
GHSA-cxxq-wr83-qfr5 
Cross-site scripting (XSS) vulnerability in index.php in MoinMoin 1.5.7 allows remote attackers to inject arbitrary web script or HTML via the do parameter in an AttachFile action, a different vulnerability than CVE-2007-0857.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
GHSA-m4jp-jx56-47gq 
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 10.9.1 – 11.3 that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.  The privileges required to execute this attack are high, requiring publisher capabilities.  The impact is low to both confidentiality and integrity while having no impact to availability.
CVSS v3.1 score: 4.8
GHSA-72jc-gvwm-vwrh 
Adobe Framemaker versions 2029u8 (and earlier) and 2020u4 (and earlier) are affected by a Use-after-free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1 score: 7.8
CVE-2018-1092 
The ext4_iget function in fs/ext4/inode.c in the Linux kernel through 4.15.15 mishandles the case of a root directory with a zero i_links_count, which allows attackers to cause a denial of service (ext4_process_freed_data NULL pointer dereference and OOPS) via a crafted ext4 image.
CVSS v3.0 score: 5.5
CVSS v2.0 score: 7.1
GHSA-m8xw-66cv-rfr6 
A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) which could cause write access and the execution of commands when uploading a specially crafted file on the controller over FTP.
CVSS v3.1 score: 8.8
CVE-2024-0815 
Command injection in paddle.utils.download._wget_download (bypass filter) in paddlepaddle/paddle 2.6.0
CVSS v3.0 score: 9.3
GHSA-rr59-h6rh-v84v Apache Zeppelin SAP: connecting to a malicious SAP server allowed it to perform XXE
Improper Input Validation vulnerability in Apache Zeppelin SAP. This issue affects Apache Zeppelin SAP: from 0.8.0 before 0.11.0.As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.For more information, the fix already was merged in the source code but Zeppelin decided to retire the SAP component
NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS v3.1 score: 5.3
CVE-2013-4715 
SQL injection vulnerability in Tiki Wiki CMS Groupware 6 LTS before 6.13LTS, 9 LTS before 9.7LTS, 10.x before 10.4, and 11.x before 11.1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS v2.0 score: 7.5
GHSA-3p86-9955-h393 Arbitrary File Overwrite in Eclipse JGit
Arbitrary File Overwrite in Eclipse JGit <= 6.6.0In Eclipse JGit, all versions <= 6.6.0.202305301015-r, a symbolic link present in a specially crafted git repository can be used to write a file to locations outside the working tree when this repository is cloned with JGit to a case-insensitive filesystem, or when a checkout from a clone of such a repository is performed on a case-insensitive filesystem.This can happen on checkout (DirCacheCheckout), merge (ResolveMerger via its WorkingTreeUpdater), pull (PullCommand using merge), and when applying a patch (PatchApplier). This can be exploited for remote code execution (RCE), for instance if the file written outside the working tree is a git filter that gets executed on a subsequent git command.The issue occurs only on case-insensitive filesystems, like the default filesystems on Windows and macOS. The user performing the clone or checkout must have the rights to create symbolic links for the problem to occur, and symbolic links must be enabled in the git configuration.Setting git configuration option core.symlinks = false before checking out avoids the problem.The issue was fixed in Eclipse JGit version 6.6.1.202309021850-r and 6.7.0.202309050840-r, available via  Maven Central https://repo1.maven.org/maven2/org/eclipse/jgit/  and  repo.eclipse.org https://repo.eclipse.org/content/repositories/jgit-releases/ . A backport is available in 5.13.3 starting from 5.13.3.202401111512-r.The JGit maintainers would like to thank RyotaK for finding and reporting this issue.
CVSS v3.1 score: 8.8
CVE-2016-6265 
Use-after-free vulnerability in the pdf_load_xref function in pdf/pdf-xref.c in MuPDF allows remote attackers to cause a denial of service (crash) via a crafted PDF file.
CVSS v3.0 score: 5.5
CVSS v2.0 score: 4.3
RHSA-2015:0800 Red Hat Security Advisory: openssl security update
openssl: Fix various certificate fingerprint issues openssl: only allow ephemeral RSA keys in export ciphersuites (FREAK) openssl: ASN.1 structure reuse memory corruption openssl: X509_to_X509_REQ NULL pointer dereference openssl: PKCS7 NULL pointer dereference openssl: integer underflow leading to buffer overflow in base64 decoding openssl: assertion failure in SSLv2 servers openssl: Divide-and-conquer session key recovery in SSLv2 openssl: SSLv2 Bleichenbacher protection overwrites wrong bytes for export ciphers
CVSS v3.0 score: 5.3
GHSA-2v37-mp24-r94r 
Improper access control in Citrix ADC Gateway Linux client versions before 1.0.0.137 results in local privilege escalation to root.
CVE-2016-2301 
SQL injection vulnerability in Ecava IntegraXor before 5.0 build 4522 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS v3.0 score: 6.3
CVSS v2.0 score: 6.5
CVE-2025-62296 Stored XSS in SOPlanning
SOPlanning is vulnerable to Stored XSS in /taches endpoint. Malicious attacker with medium privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when opening editor.

This issue was fixed in version 1.55.
CVSS v4.0 score: 5.1
CVE-2024-32114 Apache ActiveMQ: Jolokia and REST API were not secured with default configuration
In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located).
It means that anyone can use these layers without any required authentication. Potentially, anyone can interact with the broker (using Jolokia JMX REST API) and/or produce/consume messages or purge/delete destinations (using the Message REST API).

To mitigate, users can update the default conf/jetty.xml configuration file to add authentication requirement:
<bean id="securityConstraintMapping" class="org.eclipse.jetty.security.ConstraintMapping">
  <property name="constraint" ref="securityConstraint" />
  <property name="pathSpec" value="/" />
</bean>

Or we encourage users to upgrade to Apache ActiveMQ 6.1.2 where the default configuration has been updated with authentication by default.

CVSS v3.1 score: 8.5
GHSA-5c27-m4xg-q78c 
An elevation of privilege vulnerability exists when the Windows Network Connection Broker improperly handles memory.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Windows Network Connection Broker Elevation of Privilege Vulnerability'.
CVSS v3.1 score: 7.8
PYSEC-2017-40 
Sanic before 0.5.1 allows reading arbitrary files with directory traversal, as demonstrated by the /static/..%2f substring.
CVE-2023-43662 Arbitrary file read vulnerability in Shoko Server
ShokoServer is a media server which specializes in organizing anime. In affected versions the `/api/Image/WithPath` endpoint is accessible without authentication and is supposed to return default server images. The endpoint accepts the parameter `serverImagePath`, which is not sanitized in any way before being passed to `System.IO.File.OpenRead`, which results in an arbitrary file read. This issue may lead to an arbitrary file read which is exacerbated in the windows installer which installs the ShokoServer as administrator. Any unauthenticated attacker may be able to access sensitive information and read files stored on the server. The `/api/Image/WithPath` endpoint has been removed in commit `6c57ba0f0` which will be included in subsequent releases. Users should limit access to the `/api/Image/WithPath` endpoint or manually patch their installations until a patched release is made. This issue was discovered by the GitHub Security lab and is also indexed as GHSL-2023-191.
CVSS v3.1 score: 8.6
CVE-2026-24307 M365 Copilot Information Disclosure Vulnerability
Improper validation of specified type of input in M365 Copilot allows an unauthorized attacker to disclose information over a network.
CVSS v3.1 score: 9.3
RHSA-2026:54259 Red Hat Security Advisory: firefox security update
firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component firefox: thunderbird: Site isolation issue in the DOM: Navigation component firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component firefox: thunderbird: Information disclosure in the Graphics: ImageLib component firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component firefox: thunderbird: Incorrect boundary conditions in the Graphics component firefox: thunderbird: Site isolation issue in the Graphics: WebRender component firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component firefox: thunderbird: Privilege escalation in the DOM: Navigation component firefox: thunderbird: Information disclosure in the Framework component in DevTools firefox: thunderbird: Site isolation issue in the Networking: HTTP component firefox: thunderbird: Mitigation bypass in the PDF Viewer component firefox: thunderbird: Privilege escalation in the DOM: Content Processes component firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component firefox: thunderbird: Mitigation bypass in the DOM: Networking component firefox: thunderbird: Site isolation issue in the Networking component firefox: thunderbird: Mitigation bypass in the Enterprise Policies component firefox: thunderbird: Information disclosure in the Storage: IndexedDB component firefox: thunderbird: Privilege escalation in WebExtensions firefox: thunderbird: Information disclosure in the Networking: WebSockets component firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode
CVSS v3.1 score: 7.6
ICSA-25-044-11 Siemens Apogee PXC100 Devices
Affected devices contain a weak encryption mechanism based on a hard-coded key.
This could allow an attacker to guess or decrypt the password from the cyphertext. Affected devices contain an out-of-bounds read in the memory dump function.
This could allow an attacker with Medium (MED) or higher privileges to cause the device to enter an insecure cold start state.
CVSS v3.1 score: 5.9
CVE-2022-1045 Stored XSS viva .svg file upload in polonel/trudesk
Stored XSS viva .svg file upload in GitHub repository polonel/trudesk prior to v1.2.0.
CVSS v3.0 score: 9
GHSA-xqqc-58qj-9w8r 
The MaxiBlocks Builder plugin for WordPress is vulnerable to arbitrary media file deletion due to insufficient file ownership validation on the 'maxi_remove_custom_image_size' AJAX action in all versions up to, and including, 2.1.8. This makes it possible for authenticated attackers, with Author-level access and above, to delete arbitrary files in the wp-content/uploads directory, including files uploaded by other users and administrators.
CVSS v3.1 score: 5.3
GHSA-vfxp-4fv7-7wjm 
Heap-based buffer overflow in BOM BOMArchiveHelper 10.4 (6.3) Build 312, as used in Mac OS X 10.4.6 and earlier, allows user-assisted attackers to execute arbitrary code via a crafted archive (such as ZIP) that contains long path names, which triggers an error in the BOMStackPop function.
GHSA-q68v-wp7g-96w4 
IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 147164.
CVSS v3.0 score: 6.1
GHSA-xrpw-3fmw-45qf 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpbits WPBITS Addons For Elementor Page Builder wpbits-addons-for-elementor allows Stored XSS.This issue affects WPBITS Addons For Elementor Page Builder: from n/a through <= 1.8.1.
CVSS v3.1 score: 6.5
CVE-2017-5831 
Session fixation vulnerability in the forgot password mechanism in Revive Adserver before 4.0.1, when setting a new password, allows remote attackers to hijack web sessions via the session ID.
CVSS v3.0 score: 5.9
CVSS v2.0 score: 5.5
CVE-2008-6548 
The rst parser (parser/text_rst.py) in MoinMoin 1.6.1 does not check the ACL of an included page, which allows attackers to read unauthorized include files via unknown vectors.
CVSS v2.0 score: 5
GHSA-rm35-r82j-m277 
Directory traversal vulnerability in knowns-dev/knowns 0.11.4 via crafted folder name value to the create_doc tool.
CVSS v3.1 score: 7.5
CVE-2023-26248 
The Kademlia DHT (go-libp2p-kad-dht 0.20.0 and earlier) used in IPFS (0.18.1 and earlier) assigns routing information for content (i.e., information about who holds the content) to be stored by peers whose peer IDs have a small DHT distance from the content ID. This allows an attacker to censor content by generating many Sybil peers whose peer IDs have a small distance from the content ID, thus hijacking the content resolution process.
CVSS v3.1 score: 5.3
RHSA-2024:0958 Red Hat Security Advisory: thunderbird security update
Mozilla: Out-of-bounds memory read in networking channels Mozilla: Alert dialog could have been spoofed on another site Mozilla: Fullscreen Notification could have been hidden by select element Mozilla: Custom cursor could obscure the permission dialog Mozilla: Mouse cursor re-positioned unexpectedly could have led to unintended permission grants Mozilla: Multipart HTTP Responses would accept the Set-Cookie header in response parts Mozilla: Incorrect code generation on 32-bit ARM devices Mozilla: Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8
CVSS v3.1 score: 7.5
GHSA-996g-m3p2-jr77 
An Improper Handling of Exceptional Conditions vulnerability in Berkeley Packet Filter (BPF) processing of Juniper Networks Junos OS allows an attacker, in rare cases, sending specific, unknown traffic patterns to cause the FPC and system to crash and restart.BPF provides a raw interface to data link layers in a protocol independent fashion. Internally within the Junos kernel, due to a rare timing issue (race condition), when a BPF instance is cloned, the newly created interface causes an internal structure leakage, leading to a system crash. The precise content and timing of the traffic patterns is indeterminate, but has been seen in a lab environment multiple times.This issue is more likely to occur when packet capturing is enabled.  See required configuration below.This issue affects Junos OS:all versions before 21.2R3-S9,from 21.4 before 21.4R3-S10,from 22.2 before 22.2R3-S6,from 22.4 before 22.4R3-S7,from 23.2 before 23.2R2-S3,from 23.4 before 23.4R2-S3,from 24.2 before 24.2R1-S1, 24.2R2.
CVSS v4.0 score: 8.2
CVSS v3.1 score: 5.9
GHSA-m43m-9cwc-jq98 
A security vulnerability has been detected in Mapnik up to 4.2.0. This issue affects the function mapnik::dbf_file::string_value of the file plugins/input/shape/dbfile.cpp. Such manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS v4.0 score: 1.9
CVSS v3.1 score: 5.3
CVE-2024-41046 net: ethernet: lantiq_etop: fix double free in detach
In the Linux kernel, the following vulnerability has been resolved:

net: ethernet: lantiq_etop: fix double free in detach

The number of the currently released descriptor is never incremented
which results in the same skb being released multiple times.
CVSS v3.1 score: 8.8
CVE-2026-1448 D-Link DIR-615 Web Management wiz_policy_3_machine.php os command injection
A vulnerability was detected in D-Link DIR-615 up to 4.10. This impacts an unknown function of the file /wiz_policy_3_machine.php of the component Web Management Interface. Performing a manipulation of the argument ipaddr results in os command injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS v4.0 score: 8.6
CVSS v3.1 score: 7.2
CVSS v3.0 score: 7.2
CVSS v2.0 score: 8.3
CVE-2018-25425 Yot CMS 3.3.1 SQL Injection via aid and cid Parameters
Yot CMS 3.3.1 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the aid and cid parameters. Attackers can send GET requests to index.php with crafted SQL payloads in the aid or cid parameters to extract database information including table and column names.
CVSS v4.0 score: 8.8
CVSS v3.1 score: 8.2
GHSA-xgq3-h8hp-5qjg 
Multiple PHP remote file inclusion vulnerabilities in Open Education System (OES) 0.1 beta allow remote attackers to execute arbitrary PHP code via a URL in the CONF_INCLUDE_PATH parameter to (1) forum/admin.php and (2) plotgraph/index.php in admin/modules/modules/, and (3) admin_user/mod_admuser.php and (4) ogroup/mod_group.php in admin/modules/user_account/, different vectors than CVE-2007-1446.
CVE-2020-12963 
An insufficient pointer validation vulnerability in the AMD Graphics Driver for Windows may allow unprivileged users to compromise the system.
CVSS v3.1 score: 7.8
CVSS v2.0 score: 7.2
GHSA-7fqm-jc4w-fgpm 
Cross-site scripting (XSS) vulnerability in /toendaCMS in toendaCMS stable 1.0.3 and earlier, and unstable 1.1 and earlier, allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVE-2021-41125 HTTP authentication credential leak to target websites in scrapy
Scrapy is a high-level web crawling and scraping framework for Python. If you use `HttpAuthMiddleware` (i.e. the `http_user` and `http_pass` spider attributes) for HTTP authentication, all requests will expose your credentials to the request target. This includes requests generated by Scrapy components, such as `robots.txt` requests sent by Scrapy when the `ROBOTSTXT_OBEY` setting is set to `True`, or as requests reached through redirects. Upgrade to Scrapy 2.5.1 and use the new `http_auth_domain` spider attribute to control which domains are allowed to receive the configured HTTP authentication credentials. If you are using Scrapy 1.8 or a lower version, and upgrading to Scrapy 2.5.1 is not an option, you may upgrade to Scrapy 1.8.1 instead. If you cannot upgrade, set your HTTP authentication credentials on a per-request basis, using for example the `w3lib.http.basic_auth_header` function to convert your credentials into a value that you can assign to the `Authorization` header of your request, instead of defining your credentials globally using `HttpAuthMiddleware`.
CVSS v3.1 score: 5.7
GHSA-r294-2894-92j3 OpenClaw has stored XSS in exported session HTML viewer via markdown/raw-HTML rendering
SummaryThe exported session HTML viewer allowed stored XSS when untrusted session content included raw HTML markdown tokens or unescaped metadata fields.ImpactOpening a crafted exported HTML session could execute attacker-controlled JavaScript in the viewer context. This can expose session content in the page and enable phishing or UI spoofing in the trusted export view.Affected Packages / VersionsPackage: `openclaw` (npm)Affected versions: `<= 2026.2.22-2`Patched version (released): `>= 2026.2.23`Technical DetailsThe exporter rendered markdown with `marked.parse(...)` and inserted HTML via `innerHTML`, but did not override the `html` renderer token path. Raw HTML (for example `<img ... onerror=...>`) was passed through. Additional tree/header metadata fields were interpolated without escaping in the export template.ReproductionCreate a session containing content like `<img src=x onerror=alert(1)>`.Export the session to HTML.Open the exported file.Observe script execution from injected content.RemediationAdded a `marked` `html(token)` renderer override that escapes raw HTML tokens.Escaped previously unescaped tree/header metadata fields in the export template.Added image MIME sanitization for exported data-URL image rendering.Added regression tests for markdown/token and metadata escaping paths.Fix Commit(s)`f8524ec77a3999d573e6c6b8a5055bf35c49a2e6`Release Process Note`patched_versions` is pre-set to the released version (`>= 2026.2.23`). This advisory now reflects released fix version `2026.2.23`.OpenClaw thanks @allsmog for reporting.
CVSS v4.0 score: 5.3
GHSA-8cwx-fgm6-xr5h 
Multiple stack-based and heap-based buffer overflows in Dafolo DafoloControl ActiveX control (DafoloFFControl.dll) 1.108.6.195 allow remote attackers to execute arbitrary code via long (1) baseurl, (2) kommune, (3) felter, (4) afdeling, (5) Flags, (6) HelpURL, (7) caburl, or (8) filename properties; or (9) a long argument to the Open method. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
RHSA-2017:1308 Red Hat Security Advisory: kernel security, bug fix, and enhancement update
kernel: Use after free in seq file kernel: Oops in shash_async_export() kernel: EXT4 memory corruption / SLAB out-of-bounds read kernel: Reachable BUG_ON from userspace in sctp_wait_for_sndbuf kernel: net/packet: overflow in check for priv area size
CVSS v3.0 score: 7
GHSA-ww89-94rw-5jpj 
In Archibus Web Central before 26.2, multiple SQL Injection vulnerabilities occur in dwr/call/plaincall/workflow.runWorkflowRule.dwr. Through the injection of arbitrary SQL statements, a potential attacker can modify query syntax and perform unauthorized (and unexpected) operations against the remote database. This is fixed in all recent versions, such as version 26.2.
CVSS v3.1 score: 9.8
CVE-2020-3374 Cisco SD-WAN vManage Software Authorization Bypass Vulnerability
A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authorization, enabling them to access sensitive information, modify the system configuration, or impact the availability of the affected system. The vulnerability is due to insufficient authorization checking on the affected system. An attacker could exploit this vulnerability by sending crafted HTTP requests to the web-based management interface of an affected system. A successful exploit could allow the attacker to gain privileges beyond what would normally be authorized for their configured user authorization level. The attacker may be able to access sensitive information, modify the system configuration, or impact the availability of the affected system.
CVSS v3.0 score: 9.9
CVE-2023-29657 
eXtplorer 2.1.15 is vulnerable to Insecure Permissions. File upload in file manager allows uploading zip file containing php pages with arbitrary code executions.
CVSS v3.1 score: 8.8
CVE-2017-9770 
A specially crafted IOCTL can be issued to the rzpnk.sys driver in Razer Synapse that can cause an out of bounds read operation to occur due to a field within the IOCTL data being used as a length.
CVSS v3.0 score: 5.5
CVSS v2.0 score: 2.1
GHSA-9xmq-7rwm-gr8h 
Apple QuickTime / Darwin Streaming Server before 4.1.3f allows remote attackers to obtain the source code for scripts by appending encoded space (%20) or . (%2e) characters to an HTTP request for the script, e.g. view_broadcast.cgi.
CVE-2005-2180 
gen-index in GNATS 4.0, 4.1.0, and possibly earlier versions, when installed setuid, does not properly check files passed to the -o argument and opens the file with write access, which allows local users to overwrite arbitrary files.
CVSS v2.0 score: 2.1
CVE-2017-8973 
An improper input validation vulnerability in HPE Matrix Operating Environment version 7.6 LR1 was found.
CVSS v3.0 score: 4.3
CVSS v2.0 score: 4
CVE-2008-3073 
Unspecified vulnerability in Simple Machines Forum (SMF) 1.1.x before 1.1.5 and 1.0.x before 1.0.13 has unknown impact and attack vectors, probably cross-site scripting (XSS), related to "use of the html-tag."
CVSS v2.0 score: 7.5
CVE-2015-4893 
Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2015-4803 and CVE-2015-4911.
CVSS v2.0 score: 5
CVE-2024-8316 Progress UI for WPF format provider unsafe deserialization vulnerability
In Progress Telerik UI for WPF versions prior to 2024 Q3 (2024.3.924), a code execution attack is possible through an insecure deserialization vulnerability.
CVSS v3.1 score: 7.8
GHSA-5gmc-fcvv-mc5c 
An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'.
CVE-2023-35394 Azure HDInsight Jupyter Notebook Spoofing Vulnerability
Azure HDInsight Jupyter Notebook Spoofing Vulnerability
CVSS v3.1 score: 4.6