CIRCL/vulnerability-scores huggingface dataset:
CVE-2007-0096 
CarbonCommunities stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for DataBase/Carbon2.4d.mdb.
CVSS v2.0 score: 7.5
GHSA-847f-9342-265h h2 allows HTTP Request Smuggling due to illegal characters in headers
SummaryHTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls.
CVSS v4.0 score: 6.9
ICSA-22-013-05 Siemens COMOS Web (Update A)
The COMOS Web component of COMOS allows to upload and store arbitrary files at the webserver. This could allow an attacker to store malicious files. The COMOS Web component of COMOS accepts arbitrary code as attachment to tasks. This could allow an attacker to inject malicious code that is executed when loading the attachment. The COMOS Web component of COMOS unpacks specially crafted archive files to relative paths. This vulnerability could allow an attacker to store files in any folder accessible by the COMOS Web webservice. The COMOS Web component of COMOS is vulnerable to SQL injections. This could allow an attacker to execute arbitrary SQL statements. The COMOS Web component of COMOS uses a flawed implementation of CSRF prevention. An attacker could exploit this vulnerability to perform cross-site request forgery attacks.
CVSS v3.1 score: 5.4
GHSA-xfcc-h2cc-43qv 
An Insecure Direct Object Reference (IDOR) vulnerability exists in Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10007 via an attachment to a request.
CVSS v3.0 score: 9.8
CVE-2025-14454 Image Slider by Ays- Responsive Slider and Carousel <= 2.7.0 - Cross-Site Request Forgery to Arbitrary Slider Deletion
The Image Slider by Ays- Responsive Slider and Carousel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.0. This is due to missing or incorrect nonce validation on the bulk delete functionality. This makes it possible for unauthenticated attackers to delete arbitrary sliders via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS v3.1 score: 4.3
GHSA-qvxh-prvr-85w2 ImageMagick: Use-After-Free in FormatMagickCaption when memory allocation fails
When a memory allocation fails inside the FormatMagickCaption method a dangling pointer still points to the freed memory.
CVSS v3.1 score: 3.7
GHSA-7c3v-2jjv-hq3c Cross-Site Request Forgery in Jenkins Autocomplete Parameter Plugin
A cross-site request forgery (CSRF) vulnerability in Jenkins Autocomplete Parameter Plugin 1.1 and earlier allows attackers to execute arbitrary code without sandbox protection if the victim is an administrator.
CVSS v3.1 score: 8.8
CVE-2015-5901 
The Secure Empty Trash feature in Finder in Apple OS X before 10.11 improperly deletes Trash files, which might allow local users to obtain sensitive information by reading storage media, as demonstrated by reading a flash drive.
CVSS v2.0 score: 2.1
GHSA-hq8w-9w8w-pmx7 WireMock Controlled Server Side Request Forgery vulnerability through URL
ImpactWireMock can be configured to only permit proxying (and therefore recording) to certain addresses. This is achieved via a list of allowed address rules and a list of denied address rules, where the allowed list is evaluated first. [Documentation](https://wiremock.org/docs/configuration/#preventing-proxying-to-and-recording-from-specific-target-addresses).Until WireMock Webhooks Extension [3.0.0-beta-15](https://github.com/wiremock/wiremock/releases/tag/3.0.0-beta-15), the filtering of target addresses from the proxy mode DID NOT work for Webhooks, so the users were potentially vulnerable regardless of the `limitProxyTargets` settings.Via the WireMock webhooks configuration, POST requests from a webhook might be forwarded to an arbitrary service reachable from WireMock’s instance. For example, If someone is running the WireMock docker Container inside a private cluster, they can trigger internal POST requests against unsecured APIs or even against secure ones by passing a token, discovered using another exploit, via authentication headers.Affected  componentsWireMock Webhooks Extension 2.x versions until 2.35.1 (security patch)WireMock 3.x version until 3.0.3 (security patch)All versions of WireMock Studio (discontinued). This distribution bundles the WireMock Webhooks Extension and activates it by defaultPatches and MitigationFor WireMock 2.x and 3.x - upgrade to the versions with the security patchesSetup network restrictions similarly to https://wiremock.org/docs/configuration/#preventing-proxying-to-and-recording-from-specific-target-addressesFor WireMock Studio: Stop using discontinued WireMock Studio, migrate to other distributions. The vendor of WireMock Studio recommends migration to [WireMock Cloud](https://www.wiremock.io/product)NOTE: It was confirmed that [WireMock Cloud](https://www.wiremock.io/product) does not expose sensitive internal APIs and hence not vulnerable to the issue. No action is needed if you use this SaaS distribution.WorkaroundsUse external firewall rules to define the list of permitted destinationsReferencesCVE-2023-39967[Preventing proxying to and recording from specific target addresses](https://wiremock.org/docs/configuration/#preventing-proxying-to-and-recording-from-specific-target-addresses)Credits@W0rty for reporting CVE-2023-39967 in WireMock StudioWireMock Inc. team for discovering similar exploits in Webhooks and the risk in the Proxy mode defaults for WireMock
CVSS v3.1 score: 4.6
CVE-2023-26158 
All versions of the package mockjs are vulnerable to Prototype Pollution via the Util.extend function due to missing check if the attribute resolves to the object prototype. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf).User controlled inputs inside the extend() method of the Mock.Handler, Mock.Random, Mock.RE.Handler or Mock.Util, will allow an attacker to exploit this vulnerability. WorkaroundBy using a denylist of dangerous attributes, this weakness can be eliminated.Add the following line in the Util.extend function:jsjs if (["__proto__", "constructor", "prototype"].includes(name)) continuejs// src/mock/handler.jsUtil.extend = function extend() {        var target = arguments[0] || {},            i = 1,            length = arguments.length,            options, name, src, copy, clone        if (length === 1) {            target = this            i = 0        }        for (; i < length; i++) {            options = arguments[i]            if (!options) continue            for (name in options) {            if (["__proto__", "constructor", "prototype"].includes(name)) continue                src = target[name]                copy = options[name]                if (target === copy) continue                if (copy === undefined) continue                if (Util.isArray(copy) || Util.isObject(copy)) {                    if (Util.isArray(copy)) clone = src && Util.isArray(src) ? src : []                    if (Util.isObject(copy)) clone = src && Util.isObject(src) ? src : {}                    target[name] = Util.extend(clone, copy)                } else {                    target[name] = copy                }            }        }        return target    }
CVSS v3.1 score: 8.2
GHSA-gf76-2v89-qf3q 
In notifyScreenshotError of ScreenshotNotificationsController.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-8.1 Android-9Android ID: A-178189250
CVSS v3.1 score: 7.8
GHSA-fvh2-gm75-j4j7 dynoxide: DNS rebinding and cross-origin CSRF via MCP HTTP transport
Summarydynoxide's MCP HTTP transport was vulnerable to DNS rebinding via its transitive `rmcp` dependency, plus a related cross-origin CSRF gap. A malicious web page could make the user's browser send requests to a local `dynoxide mcp --http` or `dynoxide serve --mcp` server with a non-loopback `Host` header, which the server would then process. Affects 0.9.3 to 0.9.12. The stdio transport (`dynoxide mcp` without `--http`, which is the default) is not affected.ImpactIf a user is running `dynoxide mcp --http` (or `dynoxide serve --mcp`) on their machine and then visits a malicious web page, the attacker's JavaScript can call any MCP tool exposed by the running dynoxide instance.Reachable tools include reads (`get_item`, `query`, `scan`, `batch_get_item`, `describe_table`, `list_tables`) and writes (`put_item`, `update_item`, `delete_item`, `create_table`, `batch_write_item`).Any data in tables that the local dynoxide instance has access to can be read, modified, or destroyed.Patchesdynoxide 0.9.13 closes both the named CVE and a related cross-origin CSRF gap:**DNS rebinding (the named CVE).** `rmcp` is upgraded from 1.1.1 to 1.6.0. rmcp 1.4+ ships a default Host-header allowlist (`["localhost", "127.0.0.1", "::1"]`) which rejects requests carrying any other Host header with a 403.**Defence in depth.** Explicit `allowed_hosts` and `allowed_origins` lists are now set on `StreamableHttpServerConfig` directly. The Host allowlist protects against a future rmcp default flip. The Origin allowlist closes a related cross-origin CSRF gap that the Host check alone does not address: a malicious page could `fetch` the loopback endpoint with `mode: 'no-cors'`, the Host header would match (it's the literal loopback address the browser is connecting to), but the Origin header would otherwise have been unchecked.Native MCP clients that don't send an Origin header (Claude Code, Cursor, the dynoxide CLI) are unaffected by the Origin check and continue to work.WorkaroundsUpgrade to dynoxide 0.9.13.If upgrade is not immediately possible: do not run the MCP HTTP transport. Run `dynoxide mcp` (stdio, the default) instead of `dynoxide mcp --http`, and don't pass `--mcp` to `dynoxide serve`.ResourcesUpstream rmcp advisory: [GHSA-89vp-x53w-74fx](https://github.com/modelcontextprotocol/rust-sdk/security/advisories/GHSA-89vp-x53w-74fx)Upstream CVE: [CVE-2026-42559](https://www.cve.org/CVERecord?id=CVE-2026-42559)dynoxide release: [v0.9.13](https://github.com/nubo-db/dynoxide/releases/tag/v0.9.13)MCP transport security guidance: <https://modelcontextprotocol.io/specification/2025-11-25/basic/transports#security-warning>CreditsVulnerability identified via GitHub Dependabot alert on the transitive rmcp dependency.
CVSS v3.1 score: 7.5
GHSA-6rpm-g6rr-f2wx 
There is Missing SSL Certificate Validation in the pw3270 terminal emulator before version 5.1.
CVSS v3.0 score: 8.1
GHSA-28c3-vcgc-4w82 
Several high privileged APIs on the Vizio P65-F1 6.0.31.4-2 and E50x-E1 10.0.31.4-2 Smart TVs do not enforce access controls, allowing an unauthenticated threat actor to access privileged functionality, leading to OS command execution. The specific attack methodology is a file upload.
CVSS v3.1 score: 9.8
PYSEC-2014-77 
Bottle 0.10.x before 0.10.12, 0.11.x before 0.11.7, and 0.12.x before 0.12.6 does not properly limit content types, which allows remote attackers to bypass intended access restrictions via an accepted Content-Type followed by a ; (semi-colon) and a Content-Type that would not be accepted, as demonstrated in YouCompleteMe to execute arbitrary code.
GHSA-37p6-33w6-w9gq 
Freelancy v1.0.0 allows remote command execution via the "file":"data:application/x-php;base64 substring (in conjunction with "type":"application/x-php"} to the /api/files/ URI.
CVSS v3.1 score: 9.8
RHSA-2024:3999 Red Hat Security Advisory: ghostscript security update
ghostscript: OPVP device arbitrary code execution via custom Driver library
CVSS v3.1 score: 8.8
GHSA-gvqx-5wm2-crr2 
Cross-site scripting (XSS) vulnerability in index.php in Jetbox CMS 2.1 allows remote attackers to inject arbitrary web script or HTML via the login parameter in a sendpwd task.
CVE-2026-38978 
transmission through 4.1.1 was found to have a clickjacking weakness in the browser-facing WebUI and RPC response paths.
CVSS v3.1 score: 5.3
CVE-2021-47612 nfc: fix segfault in nfc_genl_dump_devices_done
In the Linux kernel, the following vulnerability has been resolved:

nfc: fix segfault in nfc_genl_dump_devices_done

When kmalloc in nfc_genl_dump_devices() fails then
nfc_genl_dump_devices_done() segfaults as below

KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 0 PID: 25 Comm: kworker/0:1 Not tainted 5.16.0-rc4-01180-g2a987e65025e-dirty #5
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-6.fc35 04/01/2014
Workqueue: events netlink_sock_destruct_work
RIP: 0010:klist_iter_exit+0x26/0x80
Call Trace:
<TASK>
class_dev_iter_exit+0x15/0x20
nfc_genl_dump_devices_done+0x3b/0x50
genl_lock_done+0x84/0xd0
netlink_sock_destruct+0x8f/0x270
__sk_destruct+0x64/0x3b0
sk_destruct+0xa8/0xd0
__sk_free+0x2e8/0x3d0
sk_free+0x51/0x90
netlink_sock_destruct_work+0x1c/0x20
process_one_work+0x411/0x710
worker_thread+0x6fd/0xa80
CVSS v3.1 score: 5.5
CVE-2021-29427 Repository content filters do not work in Settings pluginManagement
In Gradle from version 5.1 and before version 7.0 there is a vulnerability which can lead to information disclosure and/or dependency poisoning. Repository content filtering is a security control Gradle introduced to help users specify what repositories are used to resolve specific dependencies. This feature was introduced in the wake of the "A Confusing Dependency" blog post. In some cases, Gradle may ignore content filters and search all repositories for dependencies. This only occurs when repository content filtering is used from within a `pluginManagement` block in a settings file. This may change how dependencies are resolved for Gradle plugins and build scripts. For builds that are vulnerable, there are two risks: 1) Information disclosure: Gradle could make dependency requests to repositories outside your organization and leak internal package identifiers. 2) Dependency poisoning/Dependency confusion: Gradle could download a malicious binary from a repository outside your organization due to name squatting. For a full example and more details refer to the referenced GitHub Security Advisory. The problem has been patched and released with Gradle 7.0. Users relying on this feature should upgrade their build as soon as possible. As a workaround, users may use a company repository which has the right rules for fetching packages from public repositories, or use project level repository content filtering, inside `buildscript.repositories`. This option is available since Gradle 5.1 when the feature was introduced.
CVSS v3.1 score: 8
CVE-2008-2170 
Unspecified vulnerability in Century routers allows remote attackers to cause a denial of service (dropped session) via crafted BGP UPDATE messages, leading to route flapping, possibly a related issue to CVE-2007-6372.
CVSS v3.1 score: 7.5
CVSS v2.0 score: 7.1
PYSEC-2014-32 
Cross-site scripting (XSS) vulnerability in kssdevel.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2026-24376 WordPress WPVulnerability plugin <= 4.2.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Javier Casares WPVulnerability wpvulnerability allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPVulnerability: from n/a through <= 4.2.1.
CVSS v3.1 score: 6.5
GHSA-chx3-h6vh-h2pv 
Incorrect access control in the HOME.php endpoint of JMBroadcast JMB0150 Firmware v1.0 allows attackers to access the Admin panel without authentication.
CVSS v3.1 score: 9.1
GHSA-2r49-j3rm-3fj2 
Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences).  Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle CRM Technical Foundation.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle CRM Technical Foundation accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N).
CVSS v3.1 score: 4.3
CVE-2020-27625 
In JetBrains YouTrack before 2020.3.888, notifications might have mentioned inaccessible issues.
CVSS v3.1 score: 5.3
CVSS v2.0 score: 5
CVE-2014-4575 
Cross-site scripting (XSS) vulnerability in js/window.php in the Wikipop plugin 2.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVSS v2.0 score: 4.3
GHSA-vjw3-r535-w8h3 
SQL injection vulnerability in auth_login.php in Cacti before 0.8.7h allows remote attackers to execute arbitrary SQL commands via the login_username parameter.
CVE-2021-4166 Out-of-bounds Read in vim/vim
vim is vulnerable to Out-of-bounds Read
CVSS v3.0 score: 7.1
GHSA-q7gg-775p-p35h 
An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x before 1.39.4, and 1.40.x before 1.40.1. BlockLogFormatter.php in BlockLogFormatter allows XSS in the partial blocks feature.
CVSS v3.1 score: 6.1
GHSA-vgg3-w2qp-x6jr 
Online Diagnostic Lab Management System v1.0 is vulnerable to SQL Injection via /diagnostic/editcategory.php?id=.
CVSS v3.1 score: 7.2
CVE-2017-1000399 
The Jenkins 2.73.1 and earlier, 2.83 and earlier remote API at /queue/item/(ID)/api showed information about tasks in the queue (typically builds waiting to start). This included information about tasks that the current user otherwise has no access to, e.g. due to lack of Item/Read permission. This has been fixed, and the API endpoint is now only available for tasks that the current user has access to.
CVSS v3.0 score: 4.3
CVSS v2.0 score: 4
CVE-2018-8777 
In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker can pass a large HTTP request with a crafted header to WEBrick server or a crafted body to WEBrick server/handler and cause a denial of service (memory consumption).
CVSS v3.0 score: 7.5
CVSS v2.0 score: 5
GHSA-wcm4-5593-c777 
PHP remote file inclusion vulnerability in includes/functions_weblog.php in mxBB mx_blogs 2.0.0 beta allows remote attackers to execute arbitrary PHP code via a URL in the mx_root_path parameter.
CVE-2025-27262 Ericsson Indoor Connect 8855 -  Improper Neutralization of Special Elements used in an OS Command Vulnerability
Ericsson Indoor Connect 8855 contains a command injection vulnerability which if exploited can result in an escalation of privileges.
CVSS v4.0 score: 8.5
CVE-2025-47527 WordPress Icegram Collect – Easy Form, Lead Collection and Subscription plugin <= 1.3.18 - Broken Access Control Vulnerability
Missing Authorization vulnerability in Icegram Icegram Collect icegram-rainmaker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Icegram Collect: from n/a through <= 1.3.18.
CVSS v3.1 score: 7.1
GHSA-c5wh-g3rj-mwcc 
IBM Cognos Business Intelligence 10.2.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 153179.
CVE-2011-2856 
Google V8, as used in Google Chrome before 14.0.835.163, allows remote attackers to bypass the Same Origin Policy via unspecified vectors.
CVSS v2.0 score: 7.5
CVE-2024-53271 HTTP/1.1 multiple issues with envoy.reloadable_features.http1_balsa_delay_reset in envoy
Envoy is a cloud-native high-performance edge/middle/service proxy. In affected versions envoy  does not properly handle http 1.1 non-101 1xx responses. This can lead to downstream failures in networked devices. This issue has been addressed in versions 1.31.5 and 1.32.3. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS v3.1 score: 7.1
CVE-2024-41206 
A stack-based buffer over-read in tsMuxer version nightly-2024-03-14-01-51-12 allows attackers to cause Information Disclosure via a crafted TS video file.
CVSS v3.1 score: 6.5
CVE-2013-2970 
Unspecified vulnerability in IBM QRadar Security Information and Event Manager (SIEM) 7.x before 7.1 MR2 Patch 1 allows remote authenticated users to execute operating-system commands via unknown vectors.
CVSS v2.0 score: 6.5
CVE-2019-10957 
Geutebruck IP Cameras G-Code(EEC-2xxx), G-Cam(EBC-21xx/EFD-22xx/ETHC-22xx/EWPC-22xx): All versions 1.12.0.25 and prior may allow a remote authenticated attacker with access to event configuration to store malicious code on the server, which could later be triggered by a legitimate user resulting in code execution within the user’s browser.
CVSS v3.1 score: 4.8
CVSS v2.0 score: 3.5
CVE-2020-0650 
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0651, CVE-2020-0653.
CVSS v3.1 score: 7.8
CVSS v2.0 score: 9.3
CVE-2019-7365 
DLL preloading vulnerability in Autodesk Desktop Application versions 7.0.16.29 and earlier. An attacker may trick a user into downloading a malicious DLL file into the working directory, which may then leverage a DLL preloading vulnerability and execute code on the system.
CVSS v3.1 score: 7.8
CVSS v2.0 score: 4.4
CVE-2024-38701 WordPress Academy LMS plugin <= 2.0.4 - Broken Access Control vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in Academy LMS.This issue affects Academy LMS: from n/a through 2.0.4.
CVSS v3.1 score: 4.3
GHSA-7crm-jhq9-6vhj 
Vulnerability in the Oracle Self-Service Human Resources product of Oracle E-Business Suite (component: Workforce Management).  Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Self-Service Human Resources.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Self-Service Human Resources accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
CVSS v3.1 score: 4.3
cisco-sa-20180328-ike Cisco IOS and IOS XE Software Internet Key Exchange Memory Leak Vulnerability
A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a memory leak or a reload of an affected device that leads to a denial of service (DoS) condition.

The vulnerability is due to incorrect processing of certain IKEv2 packets. An attacker could exploit this vulnerability by sending crafted IKEv2 packets to an affected device to be processed. A successful exploit could cause an affected device to continuously consume memory and eventually reload, resulting in a DoS condition.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-ike ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-ike"]

This advisory is part of the March 28, 2018, release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication, which includes 20 Cisco Security Advisories that describe 22 vulnerabilities. For a complete list of the advisories and links to them, see Cisco Event Response: March 2018 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication ["https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-66682"].
CVSS v3.0 score: 8.6
GHSA-chxm-rfr8-cf28 
Relative path traversal in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
CVSS v3.1 score: 8.8
CVE-2020-26296 XSS in Vega
Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Vega in an npm package. In Vega before version 5.17.3 there is an XSS vulnerability in Vega expressions. Through a specially crafted Vega expression, an attacker could execute arbitrary javascript on a victim's machine. This is fixed in version 5.17.3
CVSS v3.1 score: 8.7
GHSA-wm27-q845-m8xc 
In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and in Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user can perform an unauthorized transfer of data from a search using the ‘copyresults’ command if they know the search ID (SID) of a  search job that has recently run.
CVSS v3.1 score: 4.8
GHSA-9652-39q9-6g87 
The mod_dav_svn server in Subversion 1.8.0 through 1.8.11 allows remote attackers to cause a denial of service (memory consumption) via a large number of REPORT requests, which trigger the traversal of FSFS repository nodes.
CVE-2022-0835 AVEVA System Platform Cleartext Storage of Sensitive Information in Memory
AVEVA System Platform 2020 stores sensitive information in cleartext, which may allow access to an attacker or a low-privileged user.
CVSS v3.1 score: 8.1
CVE-2018-12173 
Insufficient access protection in firmware in Intel Server Board, Intel Server System and Intel Compute Module before firmware version 00.01.0014 may allow an unauthenticated attacker to potentially execute arbitrary code resulting in information disclosure, escalation of privilege and/or denial of service via local access.
CVSS v3.0 score: 7.6
CVSS v2.0 score: 7.2
GHSA-fc2h-j9fj-rh35 
Mattermost versions 9.5.x <= 9.5.5 and 9.8.0 fail to properly sanitize the recipients of a webhook event which allows an attacker monitoring webhook events to retrieve the channel IDs of archived or restored channels.
CVSS v3.1 score: 3.1
GHSA-p7gw-hh3x-x6xm 
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpdm_modal_login_form' shortcode in all versions up to, and including, 3.2.93 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1 score: 6.4
CVE-2024-53225 iommu/tegra241-cmdqv: Fix alignment failure at max_n_shift
In the Linux kernel, the following vulnerability has been resolved:

iommu/tegra241-cmdqv: Fix alignment failure at max_n_shift

When configuring a kernel with PAGE_SIZE=4KB, depending on its setting of
CONFIG_CMA_ALIGNMENT, VCMDQ_LOG2SIZE_MAX=19 could fail the alignment test
and trigger a WARN_ON:
    WARNING: at drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c:3646
    Call trace:
     arm_smmu_init_one_queue+0x15c/0x210
     tegra241_cmdqv_init_structures+0x114/0x338
     arm_smmu_device_probe+0xb48/0x1d90

Fix it by capping max_n_shift to CMDQ_MAX_SZ_SHIFT as SMMUv3 CMDQ does.
CVSS v3.1 score: 5.5
GHSA-92j7-34x9-f3jw Apache James Denial of Service
Spooler in Apache Foundation James before 2.2.0 allows local users to cause a denial of service (memory consumption) by triggering various error conditions in the retrieve function, which prevents a lock from being released and causes a memory leak.
CVE-2013-4223 
The Gentoo Nullmailer package before 1.11-r2 uses world-readable permissions for /etc/nullmailer/remotes, which allows local users to obtain SMTP authentication credentials by reading the file.
CVSS v2.0 score: 5
CVE-2004-0404 
logcheck before 1.1.1 allows local users to overwrite arbitrary files via a symlink attack on a temporary directory in /var/tmp.
CVSS v2.0 score: 1.2
RHSA-2026:3275 Red Hat Security Advisory: kernel security update
kernel: Kernel: Double free vulnerability in exFAT filesystem can lead to denial of service kernel: drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies kernel: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() kernel: mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats
CVSS v3.1 score: 7.3
GHSA-j76x-72xr-r2qp 
SQL injection vulnerability in XOOPS 2.5.7.2 and other versions before 2.5.8.1 allows remote authenticated administrators to execute arbitrary SQL commands via the url parameter to findusers.php. An example attack uses "into outfile" to create a backdoor program.
CVSS v3.0 score: 7.2
CVE-2025-54107 MapUrlToZone Security Feature Bypass Vulnerability
Improper resolution of path equivalence in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network.
CVSS v3.1 score: 4.3
GHSA-2cx8-2967-j633 
An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-35393841. References: QC-CR#1084210.
CVSS v3.0 score: 7
GHSA-fqv7-9g8x-fxv7 
Brocade SANnav OVA before SANnav 2.3.1b enables SHA1 deprecated setting for SSH for port 22.
CVSS v4.0 score: 8.2
CVSS v3.1 score: 9.8
GHSA-3h9h-qfvw-98hq OpenEXR Makes Use of Uninitialized Memory
SummaryWhile fuzzing `openexr_exrcheck_fuzzer`, Valgrind reports a conditional branch depending on uninitialized data inside `generic_unpack`. This indicates a use of uninitialized memory (CWE-457). The issue is reproducible with the current OSS-Fuzz harness and a single-file PoC.Details**Environment:**Tooling: `valgrind --tool=memcheck --track-origins=yes`Target: `openexr_exrcheck_fuzzer`OS: Ubuntu 20.04.6 LTS focal x86_64openexr version and Git-commit hash: ` openexr 3.4.2 | commit fd657e8a41e157e5841c7cc2e2a5efe094b069a1 (grafted, HEAD -> main, origin/main, origin/HEAD)`Function: `generic_unpack`Possible root cause (based on observed symptoms):
The unpacker is branching on bytes in a scratch buffer that were never written because the decode step didn’t fully populate it.The first use flagged is in `generic_unpack()`. That function reads from the decompressed/expanded pixel buffer to scatter data into the framebuffer. A “conditional jump depends on uninitialised value(s)” means it’s consulting bytes in that buffer before they were written.Valgrind says the uninitialised value “was created by a heap allocation (malloc)”, not the stack: this matches a per-tile/per-scanline decode scratch buffer allocated in `exr_decoding_run()`.**Valgrind Trace (top frames):**PoCIn the attached archive, you will find:The executable used for our tests.The testcase used to trigger the bug.To observe the bug, simply run the OSS-Fuzz helper script:ImpactUndefined BehaviorPotential crashDenial of Service**Credit:** Aldo Ristori
[archive0.zip](https://github.com/user-attachments/files/23024726/archive0.zip)Update Note:Other saved testcases from the fuzzing campaign trigger the same underlying bug, but with a different manifestation. So there is one root cause (missing post-decode validation / zero-init before any unpack), with different call-sites. Below there are several archives, formatted like the previous one, that reproduce the other test cases.**Other observed sinks (distinct manifestations of the same bug):****Deep pointers path:**
generic_unpack_deep_pointers (deep scanline/tiled)
[archive1.zip](https://github.com/user-attachments/files/23024736/archive1.zip)**Deep sample table path:**
unpack_sample_table (deep scanline)
[archive2.zip](https://github.com/user-attachments/files/23024740/archive2.zip)**Half conversion path:**
half_to_float_buffer_f16c via unpack_half_to_float_3chan_planar
[archive3.zip](https://github.com/user-attachments/files/23024744/archive3.zip)**Deep compositing:**
CompositeDeepScanLine::readPixels → ThreadPool::addTask → LineCompositeTask::execute
[archive4.zip](https://github.com/user-attachments/files/23024746/archive4.zip)
CVSS v4.0 score: 2
CVSS v3.1 score: 7.5
CVE-2021-43736 
CmsWing CMS 1.3.7 is affected by a Remote Code Execution (RCE) vulnerability via parameter: log rule
CVSS v3.1 score: 9.8
CVSS v2.0 score: 7.5
CVE-2022-30506 
An arbitrary file upload vulnerability was discovered in MCMS 5.2.7, allowing an attacker to execute arbitrary code through a crafted ZIP file.
CVSS v3.1 score: 9.8
CVSS v2.0 score: 7.5
CVE-2026-19679 Improper Input Validation
An input validation vulnerability exists in Security Center's file upload handling, where insufficient sanitization of uploaded filenames could contribute to a downstream command injection issue.
CVSS v4.0 score: 8.7
CVSS v3.1 score: 8.8
GHSA-hwg8-9qf4-vr6j 
In the Linux kernel, the following vulnerability has been resolved:btrfs: fix zero size inode with non-zero size after log replayWhen logging that an inode exists, as part of logging a new name or
logging new dir entries for a directory, we always set the generation of
the logged inode item to 0. This is to signal during log replay (in
overwrite_item()), that we should not set the i_size since we only logged
that an inode exists, so the i_size of the inode in the subvolume tree
must be preserved (as when we log new names or that an inode exists, we
don't log extents).This works fine except when we have already logged an inode in full mode
or it's the first time we are logging an inode created in a past
transaction, that inode has a new i_size of 0 and then we log a new name
for the inode (due to a new hardlink or a rename), in which case we log
an i_size of 0 for the inode and a generation of 0, which causes the log
replay code to not update the inode's i_size to 0 (in overwrite_item()).An example scenario:mkdir /mnt/dir
  xfs_io -f -c "pwrite 0 64K" /mnt/dir/foosyncxfs_io -c "truncate 0" -c "fsync" /mnt/dir/fooln /mnt/dir/foo /mnt/dir/barxfs_io -c "fsync" /mnt/dirAfter log replay the file remains with a size of 64K. This is because when
we first log the inode, when we fsync file foo, we log its current i_size
of 0, and then when we create a hard link we log again the inode in exists
mode (LOG_INODE_EXISTS) but we set a generation of 0 for the inode item we
add to the log tree, so during log replay overwrite_item() sees that the
generation is 0 and i_size is 0 so we skip updating the inode's i_size
from 64K to 0.Fix this by making sure at fill_inode_item() we always log the real
generation of the inode if it was logged in the current transaction with
the i_size we logged before. Also if an inode created in a previous
transaction is logged in exists mode only, make sure we log the i_size
stored in the inode item located from the commit root, so that if we log
multiple times that the inode exists we get the correct i_size.A test case for fstests will follow soon.
CVSS v3.1 score: 5.5
GHSA-vwpm-799j-8hxq 
IBM Control Center 6.2.1 and 6.3.1could allow an authenticated user to obtain sensitive information exposed through a directory listing.
CVSS v3.1 score: 4.3
GHSA-6hwc-564p-37h2 
MariaDB Server v10.7 and below was discovered to contain a segmentation fault via the component Item_field::used_tables/update_depend_map_for_order.
CVSS v3.1 score: 7.5
GHSA-2w7q-mj4w-9cm2 
An improper access control vulnerability exists in GitLab Remote Development affecting all versions prior to 16.5.6, 16.6 prior to 16.6.4 and 16.7 prior to 16.7.2. This condition allows an attacker to create a workspace in one group that is associated with an agent from another group.
CVSS v3.1 score: 6.6
CVE-2016-5978 
Cross-site scripting (XSS) vulnerability in the Web UI in the web portal in IBM Tealeaf Customer Experience before 8.7.1.8847 FP10, 8.8 before 8.8.0.9049 FP9, 9.0.0 and 9.0.1 before 9.0.1.1117 FP5, 9.0.1A before 9.0.1.5108_9.0.1A FP5, 9.0.2 before 9.0.2.1223 FP3, and 9.0.2A before 9.0.2.5224_9.0.2A FP3 allows remote authenticated users to inject arbitrary web script or HTML via an embedded string, a different vulnerability than CVE-2016-5975.
CVSS v3.0 score: 5.4
CVSS v2.0 score: 3.5
GHSA-hv93-r4j3-q65f OpenClaw Hook Session Key Override Enables Targeted Cross-Session Routing
SummaryThe issue is not deterministic session keys by itself. The exploitable path was accepting externally supplied `sessionKey` values on authenticated hook ingress, allowing a hook token holder to route messages into chosen sessions.Affected Behavior`POST /hooks/agent` accepted payload `sessionKey` and used it directly for session routing.Common session-key shapes (for example `agent:main:dm:<peerId>`) were often derivable from known metadata, making targeted routing practical when request-level override was enabled.Attack PreconditionsAttacker can call hook endpoints with a valid hook token.Hook ingress allows request-selected `sessionKey` values.Target session keys can be derived or guessed.Without those preconditions, deterministic key formats alone do not provide access.ImpactIntegrity: targeted message/prompt injection into chosen sessions.Persistence: poisoned context can affect subsequent turns when the same session key is reused.Confidentiality impact is secondary and depends on additional weaknesses.Affected Versions`openclaw` `>= 2.0.0-beta3` and `< 2026.2.12`Patched Versions`openclaw` `>= 2026.2.12`FixOpenClaw now uses secure defaults for hook session routing:`POST /hooks/agent` rejects payload `sessionKey` unless `hooks.allowRequestSessionKey=true`.Added `hooks.defaultSessionKey` for fixed ingress routing.Added `hooks.allowedSessionKeyPrefixes` to constrain explicit routing keys.Security audit warns on unsafe hook session-routing settings.Recommended ConfigurationCreditThanks @alpernae for responsible reporting.
CVSS v3.1 score: 7.1
GHSA-c7qp-pc4p-62xw 
A vulnerability was found in code-projects Online Music Site 1.0. This impacts an unknown function of the file /Frontend/Feedback.php. Performing manipulation of the argument fname results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used.
CVSS v4.0 score: 5.5
CVSS v3.1 score: 7.3
GHSA-pxw8-cr7g-xv95 
Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.3.5 and 8.3.7 allows context-dependent users to affect availability via unknown vectors related to Outside In Filters.
CVE-2022-28525 
ED01-CMS v20180505 was discovered to contain an arbitrary file upload vulnerability via /admin/users.php?source=edit_user&id=1.
CVSS v3.1 score: 8.8
CVSS v2.0 score: 6.5
GHSA-qq2h-3v2m-x37f 
Missing Authorization vulnerability in raratheme Construction Landing Page construction-landing-page allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Construction Landing Page: from n/a through <= 1.4.1.
CVSS v3.1 score: 5.3
GHSA-3x9f-jgfq-gjmx 
A spoofing issue was addressed with improved truncation when displaying the fully qualified domain name This issue is fixed in Safari 18.5, macOS Sequoia 15.5. A website may be able to spoof the domain name in the title of a pop-up window.
CVSS v3.1 score: 4.3
CVE-2009-4607 
The command line interface in Overland Storage Snap Server 410 with GuardianOS 5.1.041 runs the "less" utility with a higher-privileged uid than the CLI user and without sufficient restriction on shell escapes, which allows local users to gain privileges using the "!" character within less to access a privileged shell.
CVSS v2.0 score: 7.2
GHSA-g7f8-4qm9-qgg5 
The originates_from_local_legacy_unicast_socket function in avahi-core/server.c in avahi-daemon 0.6.23 does not account for the network byte order of a port number when processing incoming multicast packets, which allows remote attackers to cause a denial of service (network bandwidth and CPU consumption) via a crafted legacy unicast mDNS query packet that triggers a multicast packet storm.
CVE-2014-100017 
Cross-site scripting (XSS) vulnerability in canned_opr.php in PhpOnlineChat 3.0 allows remote attackers to inject arbitrary web script or HTML via the message field.
CVSS v2.0 score: 4.3
CVE-2012-0216 
The default configuration of the apache2 package in Debian GNU/Linux squeeze before 2.2.16-6+squeeze7, wheezy before 2.2.22-4, and sid before 2.2.22-4, when mod_php or mod_rivet is used, provides example scripts under the doc/ URI, which might allow local users to conduct cross-site scripting (XSS) attacks, gain privileges, or obtain sensitive information via vectors involving localhost HTTP requests to the Apache HTTP Server.
CVSS v2.0 score: 4.4
GHSA-grp2-x34r-x38c 
SAP Commerce - versions 2105.3, 2011.13, 2005.18, 1905.34, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. Authenticated attackers will be able to access and edit data from B2B units they do not belong to.
GHSA-frr9-jr53-8x43 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in validas Wireless Butler allows Reflected XSS.This issue affects Wireless Butler: from n/a through 1.0.11.
CVSS v3.1 score: 7.1
GHSA-3qjf-qh38-x73v Unauthenticated Miniflux user can bypass allowed networks check to obtain Prometheus metrics
ImpactAn unauthenticated user can retrieve Prometheus metrics from a publicly reachable Miniflux instance where the `METRICS_COLLECTOR` [configuration option](https://miniflux.app/docs/configuration.html#metrics-collector) is enabled and `METRICS_ALLOWED_NETWORKS` is set to `127.0.0.1/8` (the default).PatchesPR #1745 fixes the problem. Available in Miniflux >= 2.0.43.WorkaroundsSet `METRICS_COLLECTOR` to `false` (default) or run Miniflux behind a trusted reverse-proxy.Referenceshttps://miniflux.app/docs/configuration.html#metrics-collectorhttps://miniflux.app/docs/configuration.html#metrics-allowed-networks
CVSS v3.1 score: 7.5
CVE-2005-4753 
BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, and 7.0 SP6 and earlier, in certain "heavy usage" scenarios, report incorrect severity levels for an audit event, which might allow attackers to perform unauthorized actions and avoid detection.
CVSS v2.0 score: 5
CVE-2026-26107 Microsoft Excel Remote Code Execution Vulnerability
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVSS v3.1 score: 7.8
GHSA-5pfv-82jm-4j3f 
Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) in Shea Bunge's Footer Text plugin <= 2.0.3 on WordPress.
CVSS v3.1 score: 6.1
GHSA-m762-6293-qf93 
A vulnerability classified as critical was found in lenve VBlog up to 1.0.0. Affected by this vulnerability is the function configure of the file blogserver/src/main/java/org/sang/config/WebSecurityConfig.java. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 6.3
CVE-2006-1680 
Jupiter CMS 1.1.5, when display_errors is enabled, allows remote attackers to obtain the full server path via a direct request to modules/online.php.
CVSS v2.0 score: 2.6
GHSA-mrr5-8hm7-42xh 
ORDAT FOSS-Online before v2.24.01 was discovered to contain a SQL injection vulnerability via the forgot password function.
CVSS v3.1 score: 9.3
CVE-2014-4518 
Cross-site scripting (XSS) vulnerability in xd_resize.php in the Contact Form by ContactMe.com plugin 2.3 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the width parameter.
CVSS v2.0 score: 4.3
GHSA-9gg6-h9w5-q53h 
Information Disclosure can occur in Hitek Software's Automize 10.x and 11.x passManager.jsd. Users have the Read attribute, which allows an attacker to recover the encrypted password to access the Password Manager.
CVSS v3.0 score: 8.1
CVE-2016-6083 
IBM Tivoli Monitoring V6 could allow an unauthenticated user to access SOAP queries that could contain sensitive information. IBM X-Force ID: 117696.
CVSS v3.0 score: 5.3
CVSS v2.0 score: 5
GHSA-76xr-9c9c-5rjm 
Multiple cross-site scripting (XSS) vulnerabilities in Cisco FireSight Management Center (MC) 5.3.1.5 and 5.4.x through 5.4.1.3 allow remote authenticated users to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuu28922.
CVE-2022-3521 Linux Kernel kcm kcmsock.c kcm_tx_work race condition
A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function kcm_tx_work of the file net/kcm/kcmsock.c of the component kcm. The manipulation leads to race condition. It is recommended to apply a patch to fix this issue. VDB-211018 is the identifier assigned to this vulnerability.
CVSS v3.1 score: 2.6
GHSA-8h36-898g-vfff 
IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126242.
CVSS v3.0 score: 5.4
CVE-2026-8798 Native entropy source retries the CPU entropy instructions without limit
In Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.1.3, the native entropy source used on Intel platforms retried the CPU entropy instructions without any bound. RDSEED and RDRAND report failure through their carry flag, and the JNI seeding routine spun re-issuing the instruction for as long as that flag stayed clear, so a persistent failure of the on-chip entropy source - whether from a hardware fault, from the underlying DRBG being exhausted by contention across many cores, or from a hypervisor that does not provide the instruction - left the calling thread looping indefinitely inside the JNI call, where it could be neither interrupted nor timed out. Any operation drawing from the native entropy source could therefore hang, denying service to the application. The retry loops are now bounded (200 attempts for RDSEED and 20 for RDRAND, twice the baselines given in Intel's Digital Random Number Generator software implementation guide), pausing between attempts and, on exhaustion, clearing any partially written buffer and throwing rather than continuing to spin. The clear is performed by an un-elidable memzero, which uses a volatile pointer and an assembly memory barrier so that a compiler cannot optimise the erase away as a dead store. Bouncy Castle for Java (bcprov) is not affected, as it has no native entropy source; the 1.0.X and 2.0.X FIPS series are not affected.
CVSS v4.0 score: 8.7
CVE-2024-30335 Foxit PDF Reader AcroForm Annotation Out-Of-Bounds Read Information Disclosure Vulnerability
Foxit PDF Reader AcroForm Annotation Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of Annotation objects. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22641.
CVSS v3.0 score: 3.3
ICSA-22-333-01 Mitsubishi Electric GOT2000
The affected GOT2000 Series devices with FTP server versions 01.39.000 and prior are vulnerable to improper input validation, which could allow an attacker to cause a denial-of-service condition by sending a specially crafted command.CVE-2022-40266 has been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H).
CVSS v3.0 score: 5.3
GHSA-3rp6-rjw4-cq39 Cross-origin Resource Sharing bypass in ASP.NET Core
ASP.NET Core 1.0, 1.1, and 2.0 allow an attacker to bypass Cross-origin Resource Sharing (CORS) configurations and retrieve normally restricted content from a web application, aka "ASP.NET Core Information Disclosure Vulnerability".
CVSS v3.0 score: 7.5