CIRCL/vulnerability-scores huggingface dataset:
GHSA-frqq-cjpc-xccq 
A cross-site scripting (XSS) vulnerability in Maid Hiring Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page Description of the /admin/aboutus.php component.
CVSS v3.1 score: 6.1
CVE-2026-49754 HTTP/2 CONTINUATION flood in Mint client via unbounded header-block accumulation
Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint Mint allows attacker-controlled HTTP/2 servers to exhaust memory in a Mint client (HTTP/2 CONTINUATION flood).

When Mint's HTTP/2 receive path observes a HEADERS frame without the END_HEADERS flag, the unparsed header-block fragment is parked in conn.headers_being_processed, and every subsequent CONTINUATION frame on that stream is appended to the accumulator. Nothing in the receive path caps the accumulator: there is no per-stream size limit, no CONTINUATION frame-count limit, and max_header_list_size is only enforced on outgoing requests, never on inbound header blocks (its default is :infinity).

A malicious or compromised HTTP/2 server can stream an endless sequence of CONTINUATION frames (each up to the peer-advertised SETTINGS_MAX_FRAME_SIZE) and drive the client's iolist to arbitrary size, causing memory exhaustion and BEAM process death. A single connection to an attacker-controlled HTTP/2 endpoint is sufficient.

This issue affects mint: from 0.1.0 before 1.9.0.
CVSS v4.0 score: 8.2
GHSA-74m3-5qc8-837r 
The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to time-based SQL Injection via the id parameter in all versions up to, and including, 1.13.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with accounting manager or admin access, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS v3.1 score: 7.2
GHSA-r46c-8q99-6878 
Cross-site scripting (XSS) vulnerability in admin/edit_member.php in Easebay Resources Paypal Subscription Manager allows remote attackers to inject arbitrary web script or HTML via the username parameter.
GHSA-2vrf-hg2g-ppc5 
An issue was discovered in certain Apple products. macOS before 10.12.1 is affected. The issue involves the "ImageIO" component. It allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write and application crash) via a crafted PDF file.
CVSS v3.0 score: 7.8
CVE-2026-24510 
Dell Alienware Command Center (AWCC), versions prior to 6.12.24.0, contain an Improper Privilege Management vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.
CVSS v3.1 score: 6.7
CVE-2026-68265 drm/xe/vm: Fix BO prefetch with CONSULT_MEM_ADVISE_PREF_LOC
In the Linux kernel, the following vulnerability has been resolved:

drm/xe/vm: Fix BO prefetch with CONSULT_MEM_ADVISE_PREF_LOC

When prefetch region is DRM_XE_CONSULT_MEM_ADVISE_PREF_LOC for a BO VMA,
the code used it as an index into region_to_mem_type[], causing an
out-of-bounds access since the value is -1.

Resolve the preferred location for BO VMAs directly: local VRAM on dGFX
(using the BO's tile placement) or system memory on iGPU.

Discovered using AI-assisted static analysis confirmed by Intel Product
Security.

v2:
-Fix null dereference

(cherry picked from commit d9a4906ac03be9f6ed3f3b45c56c866b867fd75b)
CVSS v3.1 score: 7.3
CVE-2019-2629 
Vulnerability in the Oracle Health Sciences Data Management Workbench component of Oracle Health Sciences Applications (subcomponent: User Interface). The supported version that is affected is 2.4.8. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Health Sciences Data Management Workbench. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Health Sciences Data Management Workbench accessible data as well as unauthorized read access to a subset of Oracle Health Sciences Data Management Workbench accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
CVSS v3.0 score: 5.4
CVSS v2.0 score: 5.5
CVE-2003-0066 
The rxvt terminal emulator 2.7.8 and earlier allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands.
CVSS v2.0 score: 7.5
GHSA-mjpw-2hx8-jvrc 
Missing Authorization vulnerability in Damian WP Popups wp-popups-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Popups: from n/a through <= 2.2.0.3.
CVSS v3.1 score: 6.5
GHSA-gm6c-c76r-gr4j 
Off-by-one error in the DecompressRTF function in ytnef.c in Yerase's TNEF Stream Reader allows remote attackers to cause a denial of service (crash) via a crafted TNEF file, which triggers a buffer overflow.
CVE-2026-64020 nvme-pci: fix dma_vecs leak on p2p memory
In the Linux kernel, the following vulnerability has been resolved:

nvme-pci: fix dma_vecs leak on p2p memory

We don't unmap P2P memory, so we don't need to track it. The dma_vec
allocation was getting leaked on the completion.
CVSS v3.1 score: 7.5
CVE-2005-2124 
Unspecified vulnerability in the Graphics Rendering Engine (GDI32.DLL) in Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1, related to "An unchecked buffer" and possibly buffer overflows, allows remote attackers to execute arbitrary code via a crafted Windows Metafile (WMF) format image, aka "Windows Metafile Vulnerability."
CVSS v2.0 score: 7.6
RHSA-2025:3542 Red Hat Security Advisory: RHODF-4.15-RHEL-9 security update
golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html
CVSS v3.1 score: 7.5
GHSA-f86m-m23j-3889 
Improper access control in launchApp of SystemUI prior to SMR Jul-2024 Release 1 allows local attackers to launch privileged activities.
CVSS v3.1 score: 7.8
GHSA-j6x9-wwrp-prcf 
Cross-Site Request Forgery (CSRF) vulnerability in Garmur While Loading allows Stored XSS.This issue affects While Loading: from n/a through 3.0.
CVSS v3.1 score: 7.1
GHSA-p8wp-fqcr-gwq9 
WebKit, as used in Apple iOS before 9.1, Safari before 9.0.1, and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-10-21-1, APPLE-SA-2015-10-21-3, and APPLE-SA-2015-10-21-5.
CVE-2026-6533 Improperly Controlled Sequential Memory Allocation in Wireshark
Dissection engine LZ77 decompression crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service
CVSS v3.1 score: 5.5
GHSA-vpxr-gggm-p35f 
Double Choco Latte (DCL) before 20020706 does not properly verify if a file was uploaded, which allows remote attackers to conduct certain operations on arbitrary files via the (1) Projects: Upload File Attachment or (2) Work Orders: Import features.
GHSA-fw4c-rcwv-gpjf 
The Hummingbird WordPress plugin before 3.3.2 does not sanitise and escape the Config Name, which could allow high privilege users, such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
CVSS v3.1 score: 4.8
GHSA-fh8q-xg2m-h3w9 
In MotionEntry::appendDescription of InputDispatcher.cpp, there is a possible log information disclosure. This could lead to local disclosure of user input with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-139945049
GHSA-vppv-9vcp-9fcg 
In Netwide Assembler (NASM) 2.14rc0, there are multiple heap use after free vulnerabilities in the tool nasm. The related heap is allocated in the token() function and freed in the detoken() function (called by pp_getline()) - it is used again at multiple positions later that could cause multiple damages. For example, it causes a corrupted double-linked list in detoken(), a double free or corruption in delete_Token(), and an out-of-bounds write in detoken(). It has a high possibility to lead to a remote code execution attack.
CVSS v3.0 score: 7.8
CVE-2025-8529 cloudfavorites favorites-web CollectController.java getCollectLogoUrl server-side request forgery
A vulnerability classified as critical was found in cloudfavorites favorites-web up to 1.3.0. Affected by this vulnerability is the function getCollectLogoUrl of the file app/src/main/java/com/favorites/web/CollectController.java. The manipulation of the argument url leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 6.3
CVSS v3.0 score: 6.3
CVSS v2.0 score: 6.5
GHSA-mrc3-wvpc-wr7p 
Wikidforum 2.20 contains a cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted HTML in the reply_text parameter. Attackers can post comments containing JavaScript code through the rpc.php endpoint that executes in other users' browsers when viewing forum replies.
CVSS v4.0 score: 5.1
CVSS v3.1 score: 5.4
GHSA-h9jh-74gh-hcpp 
Directory traversal vulnerability in optimizer.php in Seagull 0.6.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the files parameter.
CVE-2013-0218 
The GUI installer in JBoss Enterprise Application Platform (EAP) and Enterprise Web Platform (EWP) 5.2.0 and possibly 5.1.2 uses world-readable permissions for the auto-install XML file, which allows local users to obtain the administrator password and the sucker password by reading this file.
CVSS v2.0 score: 2.1
GHSA-rfrr-3g6g-x7ww 
In Softing uaToolkit Embedded before 1.40.1, a malformed PubSub discovery announcement message can cause a NULL pointer dereference or out-of-bounds memory access in the subscriber application.
CVSS v3.1 score: 7.5
GHSA-j695-2cjc-466g 
Improper Input Validation vulnerability in Avid Avid NEXIS E-series on Linux, Avid Avid NEXIS F-series on Linux, Avid Avid NEXIS PRO+ on Linux, Avid System Director Appliance (SDA+) on Linux allows code execution on underlying operating system with root permissions.This issue affects Avid NEXIS E-series: before 2024.6.0; Avid NEXIS F-series: before 2024.6.0; Avid NEXIS PRO+: before 2024.6.0; System Director Appliance (SDA+): before 2024.6.0.
CVSS v4.0 score: 8.7
CVE-2025-24886 pwn.college has Symlink LFI in Dojo repos
pwn.college is an education platform to learn about, and practice, core cybersecurity concepts in a hands-on fashion. Incorrect symlink checks on user specified dojos allows for users (admin not required) to perform an LFI from the CTFd container. When a user clones or updates repositories, a check is performed to see if the repository had contained any symlinks. A malicious user could craft a repository with symlinks pointed to sensitive files and then retrieve them using the CTFd website.
CVSS v3.1 score: 7.7
GHSA-qwg9-63m8-jhjg 
Multiple cross-site scripting (XSS) vulnerabilities in WordPress 2.2.1 allow remote authenticated administrators to inject arbitrary web script or HTML via (1) the Options Database Table in the Admin Panel, accessed through options.php; or (2) the opml_url parameter to link-import.php.  NOTE: this might not cross privilege boundaries in some configurations, since the Administrator role has the unfiltered_html capability.
GHSA-ggr8-prr7-mw8f 
SolarWinds Access Rights Manager (ARM) was found to contain a hard-coded credential authentication bypass vulnerability. If exploited, this vulnerability would allow access to the RabbitMQ management console.We thank Trend Micro Zero Day Initiative (ZDI) for its ongoing partnership in coordinating with SolarWinds on responsible disclosure of this and other potential vulnerabilities.
CVSS v3.1 score: 6.3
CVE-2022-34477 
The MediaError message property should be consistent to avoid leaking information about cross-origin resources; however for a same-site cross-origin resource, the message could have leaked information enabling XS-Leaks attacks. This vulnerability affects Firefox < 102.
CVSS v3.1 score: 7.5
CVE-2007-3356 
NetClassifieds Premium Edition allows remote attackers to obtain sensitive information via certain requests that reveal the path in an error message, related to the display_errors setting in (1) Common.php and (2) imageresizer.php, and (3) the use of __FILE__ in error reporting by imageresizer.php; and (4) via certain requests that reveal the table name and complete query, related to the Halt_On_Error setting in Mysql_db.php.
CVSS v2.0 score: 7.8
CVE-2019-0658 
An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Microsoft Edge, aka 'Scripting Engine Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0648.
CVSS v3.0 score: 6.5
CVSS v2.0 score: 4.3
GHSA-v8pm-hrfc-rgc7 
ZTE ZXDSL 831CII has a default password of admin for the admin account, which allows remote attackers to gain administrator privileges.
CVE-2025-13589 Otsuka Information Technology｜FMS - Reflected Cross-site Scripting
FMS developed by Otsuka Information Technology has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks.
CVSS v4.0 score: 5.1
CVE-2021-4268 phpRedisAdmin cross-site request forgery
A vulnerability, which was classified as problematic, was found in phpRedisAdmin up to 1.17.3. This affects an unknown part. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 1.18.0 is able to address this issue. The name of the patch is b9039adbb264c81333328faa9575ecf8e0d2be94. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216471.
CVSS v3.1 score: 4.3
GHSA-v8q7-7qwm-fxx3 
libclamunrar in ClamAV before 0.93 allows remote attackers to cause a denial of service (crash) via crafted RAR files that trigger "memory problems," as demonstrated by the PROTOS GENOME test suite for Archive Formats.
GHSA-5v5w-p7v7-j92q 
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Olevmedia Olevmedia Shortcodes plugin <= 1.1.9 versions.
CVSS v3.1 score: 6.5
CVE-2019-5717 
In Wireshark 2.6.0 to 2.6.5 and 2.4.0 to 2.4.11, the P_MUL dissector could crash. This was addressed in epan/dissectors/packet-p_mul.c by rejecting the invalid sequence number of zero.
CVSS v3.0 score: 5.5
CVSS v2.0 score: 4.3
CVE-2007-6293 
Multiple unspecified vulnerabilities in IBM Hardware Management Console (HMC) 6 R1.3 allow attackers to gain privileges via "some HMC commands."
CVSS v2.0 score: 10
GHSA-gc35-wq89-2gc6 
A vulnerability was found in oretnom23 Fast Food Ordering System. It has been rated as critical. Affected by this issue is some unknown functionality of the file ffos/admin/reports/index.php. The manipulation of the argument date leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-207422 is the identifier assigned to this vulnerability.
CVSS v3.1 score: 8.8
CVE-2009-3560 
The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, as used in the XML-Twig module for Perl, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with malformed UTF-8 sequences that trigger a buffer over-read, related to the doProlog function in lib/xmlparse.c, a different vulnerability than CVE-2009-2625 and CVE-2009-3720.
CVSS v2.0 score: 5
GHSA-v8rv-j5gp-8rx6 
Cross-site scripting (XSS) vulnerability in the management login GUI page in Symantec LiveUpdate Administrator (LUA) before 2.3 allows remote attackers to inject arbitrary web script or HTML via the username field, as demonstrated by injecting an IFRAME element into the event log, a different vulnerability than CVE-2011-0545.
CVE-2009-3669 
SQL injection vulnerability in the foobla Suggestions (com_foobla_suggestions) component 1.5.11 for Joomla! allows remote attackers to execute arbitrary SQL commands via the idea_id parameter to index.php.
CVSS v2.0 score: 7.5
RHSA-2013:0784 Red Hat Security Advisory: Red Hat Enterprise Linux 6.1 Extended Update Support 1-Month Notice
This is the 1-Month notification for the retirement of Red Hat Enterprise
Linux 6.1 Extended Update Support (EUS).
CVE-2023-52646 aio: fix mremap after fork null-deref
In the Linux kernel, the following vulnerability has been resolved:

aio: fix mremap after fork null-deref

Commit e4a0d3e720e7 ("aio: Make it possible to remap aio ring") introduced
a null-deref if mremap is called on an old aio mapping after fork as
mm->ioctx_table will be set to NULL.

[jmoyer@redhat.com: fix 80 column issue]
CVSS v3.1 score: 5.5
CVE-2020-8208 
Improper input validation in Citrix XenMobile Server 10.12 before RP1, Citrix XenMobile Server 10.11 before RP4, Citrix XenMobile Server 10.11 before RP6 and Citrix XenMobile Server before 10.9 RP5 allows Cross-Site Scripting (XSS).
CVSS v3.1 score: 6.1
CVSS v2.0 score: 4.3
CVE-2026-6901 Untrusted Search Path
Untrusted Search Path vulnerability in B&R Industrial Automation GmbH APROL.

This issue affects APROL: before R 4.4-01P5.
CVSS v4.0 score: 8.4
CVSS v3.1 score: 7.7
CVE-2023-40112 
In ippSetValueTag of ipp.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure of past print jobs or other print-related information, with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1 score: 5.1
GHSA-5rfq-cm4h-mwv3 
ircu 2.10.12.03 and 2.10.12.04 does not associate a timestamp with ops privilege on an unused channel (zannel), which allows remote attackers to (1) set or remove certain channel modes via a "netriding" attack or (2) take over a channel by joining an unlinked server with the A/Upass and then setting a new Apass.
RHSA-2015:2081 Red Hat Security Advisory: postgresql security update
postgresql: limited memory disclosure flaw in crypt()
RHSA-2012:1549 Red Hat Security Advisory: bind security update
bind: DoS on servers using DNS64
GHSA-hhf9-cxvj-3mv7 
In the Linux kernel, the following vulnerability has been resolved:keys: Pin request_key_auth payload in instantiate pathsA: request_key()       B: KEYCTL_INSTANTIATE_IOV
================       =========================create auth key
store rka in auth key
wait for helper
                       get auth key
                       load rka from auth key
                       copy user payload
                       sleep on #PFhelper completed
detach and free rka
destroy auth key
                       wake up
                       use rka->target_key
                       **USE-AFTER-FREE**Give request_key_auth payloads a refcount.  Take a payload reference while
authkey->sem stabilizes the payload and revocation state.  Hold that
reference across the instantiate and reject paths.  Drop the auth key
owning reference from revoke and destroy.[jarkko: Replaced the first two paragraphs of text with an actual
 concurrency scenario.]
CVSS v3.1 score: 7.8
GHSA-p226-wwrr-fmww 
The Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.37 vi the user_filter function. This makes it possible for unauthenticated attackers to create admin accounts.
CVSS v3.1 score: 9.8
GHSA-wq9p-m399-c79x 
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in OpenText NetIQ Access Manager allows access the sensitive information. This issue affects NetIQ Access Manager before 5.0.4 and before 5.1.
CVSS v3.1 score: 5.7
GHSA-3g7p-5j4x-78cm 
Cross-site scripting (XSS) vulnerability in index.php in CMS Made Simple 1.0.2 allows remote attackers to inject arbitrary web script or HTML via the cntnt01searchinput parameter in a Search action.
RHSA-2026:44064 Red Hat Security Advisory: jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update
jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution
CVSS v3.1 score: 8.1
GHSA-5hv4-vxm3-hpvc 
There is a stored Cross-site Scripting vulnerability in  Esri Portal for ArcGIS  11.4 and below that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script which when loaded could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclose a privileged token which may result in the attacker gaining full control of the Portal.
CVSS v3.1 score: 4.8
CVE-2024-42145 IB/core: Implement a limit on UMAD receive List
In the Linux kernel, the following vulnerability has been resolved:

IB/core: Implement a limit on UMAD receive List

The existing behavior of ib_umad, which maintains received MAD
packets in an unbounded list, poses a risk of uncontrolled growth.
As user-space applications extract packets from this list, the rate
of extraction may not match the rate of incoming packets, leading
to potential list overflow.

To address this, we introduce a limit to the size of the list. After
considering typical scenarios, such as OpenSM processing, which can
handle approximately 100k packets per second, and the 1-second retry
timeout for most packets, we set the list size limit to 200k. Packets
received beyond this limit are dropped, assuming they are likely timed
out by the time they are handled by user-space.

Notably, packets queued on the receive list due to reasons like
timed-out sends are preserved even when the list is full.
CVSS v3.1 score: 7.5
CVE-2015-4908 
Unspecified vulnerability in Oracle Java SE 8u60 and JavaFX 2.2.85 allows remote attackers to affect confidentiality via unknown vectors, a different vulnerability than CVE-2015-4906 and CVE-2015-4916.
CVSS v2.0 score: 5
GHSA-r55c-q3r9-vpfj 
An Improper Neutralization of Escape Sequences vulnerability could allow an Authentication Bypass with a Remote Code Execution (RCE) by a malicious actor with access to UniFi Protect Cameras adjacent network.
CVSS v3.0 score: 7.5
GHSA-3p9r-c4f8-vv7m 
Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the page parameter in the fromVirtualSer function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS v3.1 score: 7.5
GHSA-4526-pqcm-97mm 
Denial of Service through Resource Depletion vulnerability in the agent in non-Windows McAfee Agent (MA) 5.0.0 through 5.0.6, 5.5.0, and 5.5.1 allows local users to cause DoS, unexpected behavior, or potentially unauthorized code execution via knowledge of the internal trust mechanism.
CVSS v3.0 score: 7
GHSA-x6g3-x68w-mv5x 
EasyFlow .NET developed by Digiwin has a Stored Cross-Site Scripting vulnerability, allowing authenticated remote attackers to inject persistent JavaScript code executed in users' browsers upon page load.
CVSS v4.0 score: 5.1
CVSS v3.1 score: 5.4
GHSA-3mhq-jqrv-fc88 
In the Linux kernel, the following vulnerability has been resolved:tee: optee: Fix incorrect page free bugPointer to the allocated pages (struct page *page) has already
progressed towards the end of allocation. It is incorrect to perform
__free_pages(page, order) using this pointer as we would free any
arbitrary pages. Fix this by stop modifying the page pointer.
CVSS v3.1 score: 7.8
GHSA-m7qq-f4rg-v5m5 
The GET /api/v1/user/actions/runners/registration-token endpoint (and its owner- and repository-level equivalents) creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token can therefore mint a registration token and register a malicious Actions runner that executes workflow jobs with access to repository secrets and source code.
CVSS v3.1 score: 6.5
RHSA-2023:7265 Red Hat Security Advisory: open-vm-tools security update
open-vm-tools: SAML token signature bypass open-vm-tools: file descriptor hijack vulnerability in the vmware-user-suid-wrapper
CVSS v3.1 score: 7.4
GHSA-j2q2-q6cc-jr5h 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YouTube Embed Plugin Support YouTube Embed allows Stored XSS. This issue affects YouTube Embed: from n/a through 5.3.1.
CVSS v3.1 score: 5.9
CVE-2019-4394 
IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 contain APIs that could be used by a local user to send email. IBM X-Force ID: 162232.
CVSS v3.0 score: 2.3
RHSA-2020:0593 Red Hat Security Advisory: systemd security update
systemd: line splitting via fgets() allows for state injection during daemon-reexec systemd: out-of-bounds read when parsing a crafted syslog message
CVSS v3.0 score: 4.3
GHSA-vp8m-pwx8-8rhh 
A vulnerability in the restricted shell of Cisco Expressway Series could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, the attacker must have Administrator-level credentials with read-write privileges on an affected device.This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a series of crafted CLI commands. A successful exploit could allow the attacker to escape the restricted shell and gain root privileges on the underlying operating system of the affected device.
Note: Cisco Expressway Series refers to Cisco Expressway Control (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices.
CVSS v3.1 score: 6
GHSA-vwv7-36jv-h55v 
Path traversal in Google Web Designer's template handling versions prior to 16.3.0.0407 on Windows allows attacker to achieve remote code execution by tricking users into downloading a malicious ad template
CVSS v4.0 score: 7.1
CVSS v3.1 score: 8.8
GHSA-8q42-rp7q-f493 
A vulnerability was detected in code-projects Student Web Portal 1.0. This impacts an unknown function of the file /check_user.php. Performing a manipulation of the argument Username results in sql injection. It is possible to initiate the attack remotely.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 7.3
CVE-2022-43967 
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS in the multilingual report due to un-sanitized output. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.
CVSS v3.1 score: 6.1
CVE-2020-7260 MACC installer DLL side loading
DLL Side Loading vulnerability in the installer for McAfee Application and Change Control (MACC) prior to 8.3 allows local users to execute arbitrary code via execution from a compromised folder.
CVSS v3.1 score: 7.3
GHSA-hmc5-79qw-62gj 
A vulnerability in the web-based management interface of Cisco&nbsp;Prime Access Registrar Appliance could allow an authenticated, remote attacker to conduct a cross-site scripting attack against a user of the interface. The attacker would require valid credentials for the device.
This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.Cisco&nbsp;has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
CVSS v3.1 score: 5.5
CVE-2025-54128 HAX CMS NodeJs's Disabled Content Security Policy Enables Cross-Site Scripting
HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend. In versions 11.0.7 and below, the NodeJS version of HAX CMS has a disabled Content Security Policy (CSP). This configuration is insecure for a production application because it does not protect against cross-site-scripting attacks. The contentSecurityPolicy value is explicitly disabled in the application's Helmet configuration in app.js. This is fixed in version 11.0.8.
CVSS v4.0 score: 7.2
CVE-2026-69259 Flowise RCE via SQLite Record Manager Node
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the SQLite Record Manager node in packages/components/nodes/recordmanager/SQLiteRecordManager/SQLiteRecordManager.ts accepted user-controlled additionalConfig and spread it after the intended database setting, allowing additionalConfig.database to overwrite the SQLite database path. An authenticated attacker using the published Docker image, which ran as root, could write a SQLite database to paths such as /etc/chromium/exploit.conf; by controlling the table name and namespace value, the attacker could place shell syntax into the database file and trigger execution when Puppeteer launched Chromium and sourced /etc/chromium/*.conf. This issue is fixed in version 3.1.3.
CVSS v4.0 score: 9.4
CVE-2005-3816 
Multiple SQL injection vulnerabilities in forum.php in freeForum 1.1 and earlier and earlier allow remote attackers to execute arbitrary SQL commands via the (1) cat parameter or (2) thread parameter in thread mode.
CVSS v2.0 score: 7.5
GHSA-gwmx-h2p5-m8jh 
Cross-site scripting (XSS) vulnerability in RAMSite R|1 CMS 1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the searchfield parameter.
GHSA-rr87-h7hq-m7h7 
A vulnerability was found in quequnlong shiyi-blog up to 1.2.1. This impacts an unknown function of the file src/main/java/com/mojian/controller/SysJobController.java of the component Job Handler. The manipulation results in deserialization. The attack can be executed remotely. The exploit has been made public and could be used.
CVSS v4.0 score: 2.1
CVSS v3.1 score: 6.3
GHSA-w66h-ccg8-f6hg 
The Easycom/Safecom Print Server (firmware 404.590) PrintGuide server allows remote attackers to cause a denial of service via a large number of connections that send null characters.
CVE-2012-2494 
The VPN downloader implementation in the WebLaunch feature in Cisco AnyConnect Secure Mobility Client 2.x before 2.5 MR6 and 3.x before 3.0 MR8 does not compare the timestamp of offered software to the timestamp of installed software, which allows remote attackers to force a version downgrade by using (1) ActiveX or (2) Java components to offer signed code that corresponds to an older software release, aka Bug ID CSCtw48681.
CVSS v2.0 score: 4.3
GHSA-7h33-9rg2-h2qq 
Contributor PHP Object Injection in Events Calendar for GeoDirectory <= 2.3.25 versions.
CVSS v3.1 score: 8.8
GHSA-jf7f-vrfj-wcgc 
Rejected reason: This CVE ID has been rejected.
GHSA-pgv5-pw9f-4x5j 
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.
CVE-2014-3214 
The prefetch implementation in named in ISC BIND 9.10.0, when a recursive nameserver is enabled, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via a DNS query that triggers a response with unspecified attributes.
CVSS v2.0 score: 5
CVE-2017-11029 
In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, camera application triggers "user-memory-access" issue as the Camera CPP module Linux driver directly accesses the application provided buffer, which resides in user space. An unchecked userspace value (ioctl_ptr->len) is used to copy contents to a kernel buffer which can lead to kernel buffer overflow.
CVSS v3.0 score: 7.8
CVSS v2.0 score: 4.6
GHSA-xvjf-wwff-cwgg 
Cross-site scripting (XSS) vulnerability in FortiGuard FortiWeb before 5.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
GHSA-vvq6-g3fh-pj8q 
Time Slots Booking Calendar 4.0 is vulnerable to CSV Injection via the unique ID field of the Reservations List.
CVSS v3.1 score: 8.8
CVE-2026-40544 Stored XSS in SOPlanning
SOPlanning is vulnerable to Stored Cross-Site Scripting (XSS) via /process/upload_backup endpoint. An authenticated attacker with access to the backup functionality can upload a crafted ZIP archive containing a malicious user.csv file with embedded JavaScript. The injected code is executed in the victim’s browser when a user clicks the Edit button for the malicious backup.

This issue affects SOPlanning version 1.55 and below.
CVSS v4.0 score: 5.1
GHSA-9wc7-mj3f-74xv Flowise: Code Injection in CSVAgent leads to Authenticated RCE
SummaryThe CSVAgent allows providing a custom Pandas CSV read code. Due to lack of sanitization, an attacker can provide the following payload: `DataFrame({'foo': ['bar!']});import os;os.system('whoami')` that will get interpolated and executed by the server.DetailsThe code in question that introduces the issue is in [CSVAgent.ts](https://github.com/FlowiseAI/Flowise/blob/78674897270d58a7086c6c7ccefcc44a5fe9fbf6/packages/components/nodes/agents/CSVAgent/CSVAgent.ts#L157]).
`customReadCSVFunc` is user-controlled and gets interpolated directly without sanitization into the `code` variable which gets executed by `pyodide` one line later in: `dataframeColDict = await pyodide.runPythonAsync(code)`.
An authenticated attacker can issue the following chain of requests:Create a new chat flow by sending a `POST` request to `/api/v1/chatflows`. This will return the `chatflowId` in the response.Send a `POST` request to `/api/v1/prediction/[CHATFLOWID]` to trigger the execution of the chatflow. NOTE: the chatflow can contain only this node in order for the exploit to work.Optionally: send a `DELETE` request to `/api/v1/chatflows` to cleanup and delete the chat flow.Since `/chatflows` is not whitelisted [here](https://github.com/FlowiseAI/Flowise/blob/78674897270d58a7086c6c7ccefcc44a5fe9fbf6/packages/server/src/utils/constants.ts#L1), this mandates the user to be authenticated. But, if `FLOWISE_USERNAME` and `FLOWISE_PQSSWORD` aren't set, it's sufficient to provide the `"x-request-from": "internal"` header to bypass authentication.PoCHere's the PoC code:ImpactThis results in Remote Code Execution (RCE) and can allow an attacker to compromise the underlying server.
CVSS v4.0 score: 9.4
CVSS v3.1 score: 8.8
GHSA-665p-mhgh-xxcv 
NetWin dMailWeb and cwMail 2.6i and earlier allows remote attackers to cause a denial of service via a long POP parameter (pophost).
GHSA-gg4v-v8j8-ph43 
IBM Sterling Integrator 5.1 before 5010004_8 and Sterling B2B Integrator 5.2 before 5020500_9 allow remote authenticated users to read or upload files by leveraging a password-change requirement.
CVE-2020-10845 
An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. There is a race condition leading to a use-after-free in MTP. The Samsung ID is SVE-2019-16520 (February 2020).
CVSS v3.1 score: 6.4
CVSS v2.0 score: 4.4
CVE-2024-10301 PHPGurukul Medical Card Generation System Search search-medicalcard.php sql injection
A vulnerability, which was classified as critical, was found in PHPGurukul Medical Card Generation System 1.0. Affected is an unknown function of the file /admin/search-medicalcard.php of the component Search. The manipulation of the argument searchdata leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 5.1
CVSS v3.1 score: 4.7
CVSS v3.0 score: 4.7
CVSS v2.0 score: 5.8
CVE-2006-3272 
Cross-site request forgery (CSRF) vulnerability in menu.php in Some Chess 1.5 rc2 allows remote attackers to conduct actions as another user, such as changing usernames and passwords, via unspecified vectors.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS v2.0 score: 5
GHSA-f2hc-4phx-xcm3 
readelf in ToaruOS 2.0.1 has a global overflow allowing RCE when parsing a crafted ELF file.
CVSS v3.1 score: 7.8
CVE-2026-22341 WordPress Booked plugin <= 3.0.0 - Account Takeover vulnerability
Authentication Bypass Using an Alternate Path or Channel vulnerability in Case-Themes Booked booked allows Authentication Abuse.This issue affects Booked: from n/a through <= 3.0.0.
CVSS v3.1 score: 6.7
CVE-2012-0755 
Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows attackers to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2012-0756.
CVSS v2.0 score: 9.3
CVE-2022-3376 Weak Password Requirements in ikus060/rdiffweb
Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.5.0a4.
CVSS v3.0 score: 3.5
CVE-2015-6273 
Cisco IOS XE before 3.1.2S on ASR 1000 devices mishandles the automatic setup of Virtual Fragment Reassembly (VFR) by certain firewall and NAT components, which allows remote attackers to cause a denial of service (Embedded Services Processor crash) via crafted IP packets, aka Bug IDs CSCtf87624, CSCte93229, CSCtd19103, and CSCti63623.
CVSS v2.0 score: 7.8
CVE-2024-5834 
Inappropriate implementation in Dawn in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
CVSS v3.1 score: 5.6
GHSA-wr3q-48h2-426r 
A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authorization, enabling them to access sensitive information, modify the system configuration, or impact the availability of the affected system. The vulnerability is due to insufficient authorization checking on the affected system. An attacker could exploit this vulnerability by sending crafted HTTP requests to the web-based management interface of an affected system. A successful exploit could allow the attacker to gain privileges beyond what would normally be authorized for their configured user authorization level. The attacker may be able to access sensitive information, modify the system configuration, or impact the availability of the affected system.
GHSA-56wm-h6f8-c34v 
Use after free in CameraCapture in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVSS v3.1 score: 9.6
GHSA-8rcx-6793-p6gv 
An issue was discovered in CutePHP CuteNews 2.1.2. An attacker can infiltrate the server through the avatar upload process in the profile area via the avatar_file field to index.php?mod=main&opt=personal. There is no effective control of $imgsize in /core/modules/dashboard.php. The header content of a file can be changed and the control can be bypassed for code execution. (An attacker can use the GIF header for this.)
CVSS v3.0 score: 8.8
CVE-2021-29417 
gitjacker before 0.1.0 allows remote attackers to execute arbitrary code via a crafted .git directory because of directory traversal.
CVSS v3.1 score: 9.8
CVSS v2.0 score: 7.5
GHSA-6657-fppr-qr38 
SQL injection vulnerability in Lyris ListManager 5.0 through 8.9a allows remote attackers to execute arbitrary SQL commands via SQL code after a numeric argument to a /read/attachment URL.
GHSA-85qg-778w-mp8h 
Composr CMS 10.0.34 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts through the banner management interface. Attackers with admin credentials can inject XSS payloads in the Description field of the Add banner functionality, which execute for all website visitors when they access the home page.
CVSS v4.0 score: 5.1
CVSS v3.1 score: 6.4
CVE-2025-63745 
A NULL pointer dereference vulnerability was discovered in radare2 6.0.5 and earlier within the info() function of bin_ne.c. A crafted binary input can trigger a segmentation fault, leading to a denial of service when the tool processes malformed data.
CVSS v3.1 score: 5.5
CVE-2026-10890 
Use after free in Cast in Google Chrome prior to 149.0.7827.53 allowed an attacker on the local network segment to potentially exploit heap corruption via malicious network traffic. (Chromium security severity: Critical)
CVSS v3.1 score: 8.8
CVE-2006-1112 
Aztek Forum 4.0 allows remote attackers to obtain sensitive information via a long login value in a register form, which displays the installation path in a MySQL error message.
CVSS v2.0 score: 5
GHSA-cwp3-834g-x79g Moderate severity vulnerability that affects archive-tar-minitar and minitar
Withdrawn, accidental duplicate publish.Directory traversal vulnerability in the minitar before 0.6 and archive-tar-minitar 0.5.2 gems for Ruby allows remote attackers to write to arbitrary files via a .. (dot dot) in a TAR archive entry.
GHSA-2jqc-4vc4-2j4m 
A vulnerability was found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This issue affects the function fast_atoreal_move in the library include/assimp/fast_atof.h of the component CSM File Handler. The manipulation leads to out-of-bounds read. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 4.3
CVE-2024-41701 AccuPOS – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
AccuPOS - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CVSS v3.1 score: 5.3
GHSA-cf88-f64q-c626 
A vulnerability in Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to view sensitive information on an affected system.This vulnerability is due to insufficient file system access restrictions. An attacker could exploit this vulnerability by accessing the API of an affected system. A successful exploit could allow the attacker to read sensitive information on the underlying operating system.
CVSS v3.1 score: 6.5
GHSA-hmww-h9vv-9rgj 
Addressed multiple stack buffer overflow vulnerabilities that could allow an attacker to carry out escalation of privileges through unauthorized remote code execution in Western Digital My Cloud devices before 5.04.114.
GHSA-7jhp-ff4f-8fx7 
An unauthenticated remote attacker can use SMA 100 as an unintended proxy or intermediary undetectable proxy to bypass firewall rules. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances.
CVSS v3.1 score: 9.8
CVE-2020-9689 
Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a path traversal vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS v3.1 score: 6.5
CVSS v2.0 score: 8.5
GHSA-qrhm-66h9-79gh 
Mozilla developers and community members reported memory safety bugs present in Firefox 68 and Firefox ESR 68. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 69 and Firefox ESR < 68.1.
CVSS v3.1 score: 8.8
CVE-2018-8716 
WSO2 Identity Server before 5.5.0 has XSS via the dashboard, allowing attacks by low-privileged attackers.
CVSS v3.0 score: 5.4
CVSS v2.0 score: 3.5
GHSA-86qp-448h-m269 
SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on the remote host.
CVSS v3.1 score: 4.9
CVE-2019-0403 
SAP Enable Now, before version 1911, allows an attacker to input commands into the CSV files, which will be executed when opened, leading to CSV Command Injection.
CVSS v3.1 score: 9.8
CVSS v2.0 score: 7.5
GHSA-v5qq-55x5-h5qq 
cPanel before 11.54.0.4 allows arbitrary file-read and file-write operations via scripts/fixmailboxpath (SEC-80).
CVSS v3.0 score: 8.1
RHSA-2009:1662 Red Hat Security Advisory: Red Hat Network Satellite Server Sun Java Runtime security update
Untrusted applet causes DoS by filling up disk space Java Web Start File Inclusion via System Properties Override OpenJDK remote LDAP Denial-Of-Service (6717680) OpenJDK  LDAP client remote code execution (6737315) OpenJDK Pack200 Buffer overflow vulnerability (6792554) OpenJDK Pack200 Buffer overflow vulnerability (6792554) OpenJDK GIF processing buffer overflow vulnerability (6804998) OpenJDK: Type1 font processing buffer overflow vulnerability OpenJDK: DoS (disk consumption) via handling of temporary font files OpenJDK: Files disclosure, arbitrary code execution via "deserializing applets" (6646860) OpenJDK: Intended access restrictions bypass via LiveConnect (6724331) OpenJDK: Signed applet remote misuse possibility (6782871) deprecate MD2 in SSL cert validation (Kaminsky) OpenJDK information leaks in mutable variables (6588003,6656586,6656610,6656625,6657133,6657619,6657625,6657695,6660049,6660539,6813167) JDK: XML parsing Denial-Of-Service (6845701) OpenJDK Untrusted applet System properties access (6738524) OpenJDK Proxy mechanism information leaks  (6801071) OpenJDK Proxy mechanism information leaks  (6801071) OpenJDK proxy mechanism allows non-authorized socket connections  (6801497) Java Web Start Buffer unpack200 processing integer overflow (6830335) JRE applet launcher vulnerability OpenJDK JDK13Services grants unnecessary privileges  (6777448) OpenJDK ICC_Profile file existence detection information leak (6631533) OpenJDK JPEG Image Writer quantization problem (6862968) OpenJDK ASN.1/DER input stream parser denial of service (6864911) CVE-2009-3877 OpenJDK ASN.1/DER input stream parser denial of service (6864911) CVE-2009-3877 OpenJDK GraphicsConfiguration information leak(6822057) OpenJDK UI logging information leakage(6664512) OpenJDK resurrected classloaders can still have children (6636650) OpenJDK information leaks in mutable variables (6657026,6657138) OpenJDK information leaks in mutable variables (6657026,6657138) OpenJDK zoneinfo file existence information leak (6824265)
CVE-2026-11570 User Submitted Posts < 20260608 - Unauthenticated Stored XSS via Author Name
The User Submitted Posts  WordPress plugin before 20260608 does not escape a submitted value before outputting it in an admin-configured display template, leading to a Stored Cross-Site Scripting that can be triggered by unauthenticated users when a non-default display option is enabled.
CVSS v3.1 score: 4.2