CIRCL/vulnerability-scores huggingface dataset:
GHSA-6hff-5fjr-6943 
A security flaw has been discovered in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown code of the file admin/login.php. The manipulation of the argument Username results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.
CVSS v4.0 score: 5.5
CVSS v3.1 score: 7.3
CVE-2026-30813 SQL Injection in Module Search leads to Database Compromise
Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via module search. This issue affects Pandora FMS: from 777 through 800
CVSS v4.0 score: 8.7
RHSA-2009:1055 Red Hat Security Advisory: kernel security and bug fix update
kernel: sctp: memory overflow when FWD-TSN chunk is received with bad stream ID
GHSA-85fx-23xq-6336 
Multiple unspecified vulnerabilities in the web management interface in Avaya Communication Manager (CM) 3.1.x, 4.0.3, and 5.x allow remote attackers to read (1) configuration files, (2) log files, (3) binary image files, and (4) help files via unknown vectors.
GHSA-jvpp-5xxm-9qcg 
The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 does not properly validate a registry-key argument to an unspecified system call, which allows local users to cause a denial of service (reboot) via a crafted application, aka "Windows Kernel Null Pointer Vulnerability."
GHSA-v289-wfcx-99v3 
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Agent (Windows) before build 36497.
CVSS v3.0 score: 6.6
GHSA-wwgj-pf6c-p6hc 
An issue was discovered in HTCondor 9.0.x before 9.0.4 and 9.1.x before 9.1.2. When authenticating to an HTCondor daemon using a SciToken, a user may be granted authorizations beyond what the token should allow.
CVE-2019-6327 
HP Color LaserJet Pro M280-M281 Multifunction Printer series (before v. 20190419), HP LaserJet Pro MFP M28-M31 Printer series (before v. 20190426) may have an IPP Parser potentially vulnerable to Buffer Overflow.
CVSS v3.1 score: 9.8
CVSS v2.0 score: 7.5
RHSA-2019:0734 Red Hat Security Advisory: katello-installer-base security and enhancement update
katello-installer-base: QMF methods exposed to goferd via qdrouterd
CVSS v3.0 score: 8
CVE-2024-41826 
In JetBrains TeamCity before 2024.07 stored XSS was possible on Show Connection page
CVSS v3.1 score: 3.5
CVE-2026-34510 OpenClaw < 2026.3.22 - Remote File URL Acceptance in Windows Media Loaders
OpenClaw before 2026.3.22 contains a path traversal vulnerability in Windows media loaders that accepts remote-host file URLs and UNC-style paths before local-path validation. Attackers can exploit this by providing network-hosted file targets that are treated as local content, bypassing intended access restrictions.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 5.3
GHSA-9v3x-qcrj-vcrc 
Integer signedness error in Apple File Service (AFP Server) allows remote attackers to cause a denial of service (application crash) via a negative UAM string length in a FPLoginExt packet.
CVE-2012-3489 
The xml_parse function in the libxml2 support in the core server component in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 allows remote authenticated users to determine the existence of arbitrary files or URLs, and possibly obtain file or URL content that triggers a parsing error, via an XML value that refers to (1) a DTD or (2) an entity, related to an XML External Entity (aka XXE) issue.
CVSS v3.1 score: 6.5
CVSS v2.0 score: 4
CVE-2024-52370 WordPress Hive Support – WordPress Help Desk, Live Chat & AI Chat Bot Plugin for WordPress plugin <= 1.1.1 - Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in Hive Support Hive Support hive-support allows Upload a Web Shell to a Web Server.This issue affects Hive Support: from n/a through <= 1.1.1.
CVSS v3.1 score: 9.9
RHSA-2021:1350 Red Hat Security Advisory: thunderbird security update
Mozilla: More internal network hosts could have been probed by a malicious webpage Mozilla: Out of bound write due to lazy initialization Mozilla: Use-after-free in Responsive Design Mode Mozilla: Secure Lock icon could have been spoofed Mozilla: Blob URLs may have been granted additional privileges Mozilla: Arbitrary FTP command execution on FTP servers using an encoded URL Mozilla: Incorrect size computation in WebAssembly JIT could lead to null-reads Mozilla: Port blocking could be bypassed Mozilla: Race condition when reading from disk while verifying signatures
CVSS v3.1 score: 2.5
CVSS v3.0 score: 6.1
CVE-2008-7177 
Buffer overflow in the listing module in Netwide Assembler (NASM) before 2.03.01 has unknown impact and attack vectors, a different vulnerability than CVE-2008-2719.
CVSS v2.0 score: 9.3
CVE-2015-2323 
FortiOS 5.0.x before 5.0.12 and 5.2.x before 5.2.4 supports anonymous, export, RC4, and possibly other weak ciphers when using TLS to connect to FortiGuard servers, which allows man-in-the-middle attackers to spoof TLS content by modifying packets.
CVSS v2.0 score: 6.4
CVE-2013-1006 
WebKit, as used in Apple iTunes before 11.0.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-05-16-1.
CVSS v2.0 score: 9.3
GHSA-68r4-mq9j-2rrq 
Implicit intent hijacking vulnerability in Smart Suggestions prior to SMR Feb-2024 Release 1 allows attackers to get sensitive information.
CVSS v3.1 score: 3.3
RHSA-2019:1264 Red Hat Security Advisory: libvirt security and bug fix update
libvirt: wrong permissions in systemd admin-sock due to missing SocketMode parameter
CVSS v3.0 score: 8.8
GHSA-5gj5-pjhv-qqc6 
Selesta Visual Access Manager < 4.42.2 is vulnerable to Cross Site Scripting (XSS) via vam/vam_visits.php.
CVSS v3.1 score: 6.1
CVE-1999-0696 
Buffer overflow in CDE Calendar Manager Service Daemon (rpc.cmsd).
CVSS v2.0 score: 10
GHSA-3qpw-mwvv-hvxg 
A vulnerability, which was classified as critical, has been found in Tenda AC15 15.03.05.18/15.03.20_multi. This issue affects the function formQuickIndex of the file /goform/QuickIndex. The manipulation of the argument PPPOEPassword leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257663. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v3.1 score: 8.8
GHSA-f6fp-28gh-x93q 
An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A number of heap-based buffer over-read instances are present in mbstring regular expression functions when supplied with invalid multibyte data. These occur in ext/mbstring/oniguruma/regcomp.c, ext/mbstring/oniguruma/regexec.c, ext/mbstring/oniguruma/regparse.c, ext/mbstring/oniguruma/enc/unicode.c, and ext/mbstring/oniguruma/src/utf32_be.c when a multibyte regular expression pattern contains invalid multibyte sequences.
CVSS v3.0 score: 9.8
GHSA-6vjj-xxg4-5gjg 
A path traversal vulnerability has been reported to affect License Center. If a local attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data.We have already fixed the vulnerability in the following version:
License Center 1.9.56 and later
CVSS v4.0 score: 6.9
CVSS v3.1 score: 4.4
CVE-2020-15862 
Net-SNMP through 5.8 has Improper Privilege Management because SNMP WRITE access to the EXTEND MIB provides the ability to run arbitrary commands as root.
CVSS v3.1 score: 7.8
CVSS v2.0 score: 7.2
GHSA-rf9c-wvjw-39jq 
Some Honor products are affected by out of bounds read vulnerability, successful exploitation could cause information leak.
CVSS v3.1 score: 3.2
CVE-2013-10043 Astium VOIP PBX <= 2.1 SQL Injection File Upload RCE
A vulnerability exists in OAstium VoIP PBX astium-confweb-2.1-25399 and earlier, where improper input validation in the logon.php script allows an attacker to bypass authentication via SQL injection. Once authenticated as an administrator, the attacker can upload arbitrary PHP code through the importcompany field in import.php, resulting in remote code execution. The malicious payload is injected into /usr/local/astium/web/php/config.php and executed with root privileges by triggering a configuration reload via sudo /sbin/service astcfgd reload. Successful exploitation leads to full system compromise.
CVSS v4.0 score: 9.5
CVE-2005-4816 
Buffer overflow in mod_radius in ProFTPD before 1.3.0rc2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long password.
CVSS v2.0 score: 7.5
GHSA-x343-93cc-jvpw 
A vulnerability classified as critical has been found in SourceCodester Simple Online Bidding System 1.0. This affects an unknown part of the file index.php. The manipulation of the argument category_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-255393 was assigned to this vulnerability.
CVSS v3.1 score: 6.3
GHSA-2x9f-j2ww-5cp9 
Solaris arp allows local users to read files via the -f parameter, which lists lines in the file that do not parse properly.
CVE-2024-26367 
Cross Site Scripting vulnerability in Evertz microsystems MViP-II Firmware 8.6.5, XPS-EDGE-* Build 1467, evEDGE-EO-* Build 0029, MMA10G-* Build 0498, 570IPG-X19-10G Build 0691 allows a remote attacker to execute arbitrary code via a crafted payload to the login parameters.
CVSS v3.1 score: 6.1
CVE-2022-36697 
Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_waste.
CVSS v3.1 score: 9.8
GHSA-2522-mrjc-m688 Apache Airflow: Sensitive configuration for providers displayed when "non-sensitive-only" config used
Airflow versions 2.7.0 through 2.8.4 have a vulnerability that allows an authenticated user to see sensitive provider configuration via the "configuration" UI page when "non-sensitive-only" was set as "webserver.expose_config" configuration (The celery provider is the only community provider currently that has sensitive configurations). You should migrate to Airflow 2.9 or change your "expose_config" configuration to False as a workaround. This is similar, but different to  CVE-2023-46288 https://github.com/advisories/GHSA-9qqg-mh7c-chfq  which concerned API, not UI configuration page.
CVSS v3.1 score: 4.3
GHSA-rv68-rxpp-wxh8 
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Innosa Probbys allows SQL Injection.This issue affects Probbys: before 2.
CVSS v3.1 score: 9.8
GHSA-xhjw-w3xm-2hg5 
bitstr_tell at bitstr.c in ffjpeg through 2019-08-21 has a NULL pointer dereference related to jfif_encode.
CVSS v3.1 score: 6.5
GHSA-x32x-wv35-mqp3 
Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable use after free vulnerability in the JavaScript engine. Successful exploitation could lead to arbitrary code execution.
CVSS v3.0 score: 7.8
GHSA-f6jg-8mpc-4w2q 
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper neutralization of special elements used in an OS command ('OS command Injection') vulnerability. A remote high privileged attacker could potentially exploit this vulnerability, leading to protection mechanism bypass. This is a Critical vulnerability as it allows an attacker to invoke arbitrary command execution with root privileges; so Dell recommends customers to upgrade at the earliest opportunity.
CVSS v3.1 score: 7.2
CVE-2020-12315 
Path traversal in the Intel(R) EMA before version 1.3.3 may allow an unauthenticated user to potentially enable escalation of privilege via network access.
CVSS v3.1 score: 9.8
CVSS v2.0 score: 7.5
CVE-2024-42298 ASoC: fsl: fsl_qmc_audio: Check devm_kasprintf() returned value
In the Linux kernel, the following vulnerability has been resolved:

ASoC: fsl: fsl_qmc_audio: Check devm_kasprintf() returned value

devm_kasprintf() can return a NULL pointer on failure but this returned
value is not checked.

Fix this lack and check the returned value.
CVSS v3.1 score: 5.5
CVE-2026-42062 
ELECOM wireless LAN access point devices contain an OS command injection in processing of username parameter. If processing a crafted request, an arbitrary OS command may be executed. No authentication is required.
CVSS v4.0 score: 9.3
CVSS v3.0 score: 9.8
GHSA-6jqv-j4hg-jwfq 
SQL injection vulnerability in cron/find_help.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the version parameter.
CVSS v3.0 score: 9.8
GHSA-6g7m-qq4g-xf4p 
The ultimate-weather plugin 1.0 for WordPress has XSS
CVE-2019-8447 
The ServiceExecutor resource in Jira before version 8.3.2 allows remote attackers to trigger the creation of export files via a Cross-site request forgery (CSRF) vulnerability.
CVSS v3.0 score: 4.3
CVSS v2.0 score: 4.3
GHSA-rvgr-q8fx-r93h 
CamaleonCMS 2.9.1 contains an authenticated SQL injection vulnerability that allows authenticated attackers with post creation or editing privileges to submit a crafted slug value containing SQL syntax that the database backend evaluates as part of an inadequately parameterized query. Attackers can supply malicious slug payloads using boolean- or union-style blind SQL injection techniques to extract sensitive data from the underlying SQLite database, including administrative credentials and configuration values stored in application tables.
CVSS v4.0 score: 7.1
CVSS v3.1 score: 7.1
GHSA-fvf3-jrrp-pm9m 
The Easy Forms for Mailchimp WordPress plugin before 6.8.6 does not sanitise and escape the field_name and field_type parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
GHSA-hmc6-qjjc-3rjm 
Authentication Bypass Using an Alternate Path or Channel vulnerability in Dokan, Inc. Dokan dokan-lite allows Authentication Abuse.This issue affects Dokan: from n/a through <= 4.2.4.
CVSS v3.1 score: 8.8
GHSA-j637-3f25-pg9w 
In the Linux kernel, the following vulnerability has been resolved:i2c: qcom-geni: Correct I2C TRE sequenceFor i2c read operation in GSI mode, we are getting timeout
due to malformed TRE basically incorrect TRE sequence
in gpi(drivers/dma/qcom/gpi.c) driver.I2C driver has geni_i2c_gpi(I2C_WRITE) function which generates GO TRE and
geni_i2c_gpi(I2C_READ)generates DMA TRE. Hence to generate GO TRE before
DMA TRE, we should move geni_i2c_gpi(I2C_WRITE) before
geni_i2c_gpi(I2C_READ) inside the I2C GSI mode transfer function
i.e. geni_i2c_gpi_xfer().TRE stands for Transfer Ring Element - which is basically an element with
size of 4 words. It contains all information like slave address,
clk divider, dma address value data size etc).Mainly we have 3 TREs(Config, GO and DMA tre).CONFIG TRE : consists of internal register configuration which is
             required before start of the transfer.DMA TRE :    contains DDR/Memory address, called as DMA descriptor.GO TRE :     contains Transfer directions, slave ID, Delay flags, Length
             of the transfer.I2c driver calls GPI driver API to config each TRE depending on the
protocol.For read operation tre sequence will be as below which is not aligned
to hardware programming guide.CONFIG treDMA treGO treAs per Qualcomm's internal Hardware Programming Guide, we should configure
TREs in below sequence for any RX only transfer.CONFIG treGO treDMA tre
GHSA-mv2j-mhhg-9cp3 
Cross-site scripting (XSS) vulnerability in the Drupal 4.7 Pathauto module before pathauto_node.inc 1.17.2.1 and the Drupal 4.6 Pathauto module before pathauto_node.inc 1.14.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2015-4912 
Unspecified vulnerability in the Oracle Access Manager component in Oracle Fusion Middleware 11.1.2.2 and 11.1.2.3 allows remote attackers to affect confidentiality via vectors related to SSO Engine.
CVSS v2.0 score: 4.3
CVE-2020-13253 
sd_wp_addr in hw/sd/sd.c in QEMU 4.2.0 uses an unvalidated address, which leads to an out-of-bounds read during sdhci_write() operations. A guest OS user can crash the QEMU process.
CVSS v3.1 score: 5.5
CVSS v2.0 score: 2.1
GHSA-999v-2mw3-6jxp 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the getPageRotation method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6023.
CVSS v3.0 score: 8.8
GHSA-v3gw-vw4w-6f6j 
** DISPUTED **  Buffer overflow in the SQLDriverConnect function in unixODBC 2.0.10, 2.3.1, and earlier allows local users to cause a denial of service (crash) via a long string in the FILEDSN option.  NOTE: this issue might not be a vulnerability, since the ability to set this option typically implies that the attacker already has legitimate access to cause a DoS or execute code, and therefore the issue would not cross privilege boundaries. There may be limited attack scenarios if isql command-line options are exposed to an attacker, although it seems likely that other, more serious issues would also be exposed, and this issue might not cross privilege boundaries in that context.
GHSA-p339-pvxm-qhgv 
Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and Jrockit R27.8.3 and R28.3.3 allows remote attackers to affect confidentiality via vectors related to JAXP.
CVE-2025-43829 
Stored cross-site scripting (XSS) vulnerability in diagram type products in Commerce in Liferay Portal 7.4.3.18 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 18 through update 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a SVG file.
CVSS v4.0 score: 4.8
GHSA-2g98-f9jv-w8c5 robrichards/xmlseclibs XPath injection
A vulnerability has been identified in the robrichards/xmlseclibs library, specifically related to XPath injection. The issue arises from inadequate filtering of user input before it is incorporated into XPath expressions.
CVSS v3.1 score: 7.5
CVE-2015-3297 
Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.1 through 1.5.2 allows remote attackers to read arbitrary files by leveraging replacement of backslashes with slashes in the path parameter of HTTP API requests.
CVSS v3.0 score: 7.5
CVSS v2.0 score: 5
GHSA-j33g-47h2-2687 
A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed suricata package allows the suricata user to escalate to root.This issue affects openSUSE Tumbleweed: from ? before 8.0.5-2.1; openSUSE Tumbleweed: from ? before 8.0.5-2.1.
CVSS v4.0 score: 7.1
GHSA-2859-2jv7-892h 
Cross-site request forgery (CSRF) vulnerability in the web interface in Cisco Prime Infrastructure allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCue84676.
GHSA-p23p-88jv-fvg5 
Use after free in Windows Bluetooth Port Driver allows an authorized attacker to elevate privileges locally.
CVSS v3.1 score: 7
CVE-2023-47150 IBM Common Cryptographic Architecture denial of service
IBM Common Cryptographic Architecture (CCA) 7.0.0 through 7.5.36 could allow a remote user to cause a denial of service due to incorrect data handling for certain types of AES operations.  IBM X-Force ID:  270602.
CVSS v3.1 score: 7.5
CVE-2019-15893 
Sonatype Nexus Repository Manager 2.x before 2.14.15 allows Remote Code Execution.
CVSS v3.1 score: 7.2
CVSS v2.0 score: 6.5
CVE-2024-7000 
Use after free in CSS in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVSS v3.1 score: 8.8
CVE-2022-21661 SQL injection in WordPress
WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitization in WP_Query, there can be cases where SQL injection is possible through plugins or themes that use it in a certain way. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this vulnerability.
CVSS v3.1 score: 8
CVE-2026-31670 net: rfkill: prevent unlimited numbers of rfkill events from being created
In the Linux kernel, the following vulnerability has been resolved:

net: rfkill: prevent unlimited numbers of rfkill events from being created

Userspace can create an unlimited number of rfkill events if the system
is so configured, while not consuming them from the rfkill file
descriptor, causing a potential out of memory situation.  Prevent this
from bounding the number of pending rfkill events at a "large" number
(i.e. 1000) to prevent abuses like this.
CVSS v3.1 score: 5.5
GHSA-j47x-5r4f-5mpx 
An issue was discovered in the "Ultimate Addons for Elementor" plugin before 1.24.2 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-2020-13126. Unauthenticated attackers can create users with the Subscriber role even if registration is disabled.
CVE-2022-35670 Adobe Acrobat Reader Use-After-Free Memory leak
Adobe Acrobat Reader versions 22.001.20169 (and earlier), 20.005.30362 (and earlier) and 17.012.30249 (and earlier) are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1 score: 5.5
GHSA-p6wh-j563-f69f 
scponly does not properly verify the path when finding the (1) scp or (2) sftp-server programs, which could allow remote authenticated users to bypass access controls by uploading malicious programs and modifying the PATH variable in $HOME/.ssh/environment to locate those programs.
GHSA-9v3g-8955-wqqq 
The Windows Printing Service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 SP2 allows local users to read arbitrary files via a crafted separator page, aka "Print Spooler Read File Vulnerability."
CVE-2017-18448 
cPanel before 64.0.21 allows certain file-read operations via a Serverinfo_manpage API call (SEC-252).
CVSS v3.0 score: 5.3
CVSS v2.0 score: 5
CVE-2025-3977 iteachyou Dreamer CMS Attachment download improper authorization
A vulnerability was found in iteachyou Dreamer CMS up to 4.1.3. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/attachment/download of the component Attachment Handler. The manipulation of the argument ID leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 4.3
CVSS v3.0 score: 4.3
CVSS v2.0 score: 4
CVE-2023-0165 Cost Calculator <= 1.8 - Contributor+ Stored XSS
The Cost Calculator WordPress plugin through 1.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS v3.1 score: 5.4
CVE-2021-37913 HGiga OAKlouds - Command Injection-2
The HGiga OAKlouds mobile portal does not filter special characters of the IPv6 Gateway parameter of the network interface card setting page. Remote attackers can use this vulnerability to perform command injection and execute arbitrary commands in the system without logging in.
CVSS v3.1 score: 9.8
GHSA-f844-6jvw-2mjm 
Out of bounds write in Dawn in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)
CVSS v3.1 score: 4.3
RHSA-2014:2024 Red Hat Security Advisory: ntp security update
ntp: automatic generation of weak default key in config_auth() ntp: ntp-keygen uses weak random number generator and seed when generating MD5 keys ntp: Multiple buffer overflows via specially-crafted packets ntp: receive() missing return on error
CVE-2018-8650 
A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft Office SharePoint XSS Vulnerability." This affects Microsoft SharePoint.
CVSS v3.1 score: 5.4
CVSS v3.0 score: 5.4
CVSS v2.0 score: 3.5
GHSA-v2r7-frxx-fmq5 
Because the web management interface for Unified Intents' Unified Remote solution does not itself require authentication, a remote, unauthenticated attacker can change or disable authentication requirements for the Unified Remote protocol, and leverage this now-unauthenticated access to run code of the attacker's choosing.
CVSS v3.1 score: 9.8
CVE-2025-59447 
The YoSmart YoLink Smart Hub device 0382 exposes a UART debug interface. An attacker with direct physical access can leverage this interface to read a boot log, which includes network access credentials.
CVSS v3.1 score: 2.2
GHSA-49v5-wqh2-vj5q 
The hb_buffer_ensure function in hb-buffer.c in HarfBuzz, as used in Pango 1.28.3, Firefox, and other products, does not verify that memory reallocations succeed, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly execute arbitrary code via crafted OpenType font data that triggers use of an incorrect index.
CVE-2023-51623 D-Link DIR-X3260 prog.cgi SetAPClientSettings Stack-based Buffer Overflow Remote Code Execution Vulnerability
D-Link DIR-X3260 prog.cgi SetAPClientSettings Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 routers. Authentication is required to exploit this vulnerability.

The specific flaw exists within the prog.cgi binary, which handles HNAP requests made to the lighttpd webserver listening on TCP ports 80 and 443. The issue results from the lack of proper validation of a user-supplied string before copying it to a fixed-size stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21673.
CVSS v3.0 score: 6.8
GHSA-m9wj-p6m9-p28q 
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jgwhite33 WP Airbnb Review Slider allows Blind SQL Injection. This issue affects WP Airbnb Review Slider: from n/a through 3.9.
CVSS v3.1 score: 7.6
GHSA-2wch-9pmc-8h8m 
In cPanel before 66.0.2, weak log-file permissions can occur after account modification (SEC-289).
CVSS v3.0 score: 3.3
GHSA-mr95-5fwr-mf38 
Multiple vulnerabilities in the multi-instance feature of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to escape the container for their FTD instance and execute commands with root privileges in the host namespace. These vulnerabilities are due to insufficient protections on the underlying filesystem. An attacker could exploit these vulnerabilities by modifying critical files on the underlying filesystem. A successful exploit could allow the attacker to execute commands with root privileges within the host namespace. This could allow the attacker to impact other running FTD instances.
CVSS v3.1 score: 8.8
GHSA-rvf2-2r2v-x27p 
WebSocket endpoints lack proper authentication mechanisms, enabling 
attackers to perform unauthorized station impersonation and manipulate 
data sent to the backend. An unauthenticated attacker can connect to the
 OCPP WebSocket endpoint using a known or discovered charging station 
identifier, then issue or receive OCPP commands as a legitimate charger.
 Given that no authentication is required, this can lead to privilege 
escalation, unauthorized control of charging infrastructure, and 
corruption of charging network data reported to the backend.
CVSS v4.0 score: 9.3
CVSS v3.1 score: 9.4
GHSA-55pg-vx6v-2jfh 
A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. A remote attacker may be able to cause a denial-of-service.
CVSS v3.1 score: 7.5
GHSA-fcx3-mx84-8j3q 
Windows Secure Channel Denial of Service Vulnerability
CVSS v3.1 score: 7.5
GHSA-c8pc-qq5m-x5p4 
Multiple cross-site scripting (XSS) vulnerabilities in graph.php in pfSense 1.2.3 and 2 beta 4 allow remote attackers to inject arbitrary web script or HTML via the (1) ifnum or (2) ifname parameter, a different vulnerability than CVE-2008-1182.
GHSA-8hhg-crp9-v482 
A security vulnerability has been detected in Telegram Desktop up to 6.7.5. This vulnerability affects the function RequestButton of the file Telegram/SourceFiles/boxes/url_auth_box.cpp of the component Bot API. The manipulation of the argument login_url leads to null pointer dereference. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0 score: 2.1
CVSS v3.1 score: 4.3
GHSA-2q65-4cp8-mqj7 
An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, and 11.0.22 and earlier versions. This vulnerability is an instance of a type confusion vulnerability in the EMF processing module. The issue causes the program to access an object using an incompatible type, leading to an out of bounds memory access. Attackers can exploit the vulnerability by using the out of bounds access for unintended reads, writes, or frees -- potentially leading to code corruption, control-flow hijack, or information leak attack.
CVSS v3.0 score: 8.8
GHSA-mgq7-pc7j-7mm4 
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
GHSA-mf74-qq7w-6j7v Zmarkdown Server-Side Request Forgery (SSRF) in remark-download-images
ImpactA major blind SSRF has been found in `remark-images-download`, which allowed
for requests to be made to neighboring servers on local IP ranges.
The issue came from a loose filtering of URLs inside the module.Imagine a server running on a private network `192.168.1.0/24`.
A private service serving images is running on `192.168.1.2`, and
is not expected to be accessed by users. A machine is running
`remark-images-download` on the neighboring `192.168.1.3` host.
An user enters the following Markdown:The image is downloaded by the server and included inside the resulting
document. Hence, the user has access to the private image.It has been corrected by preventing images downloads from
local IP ranges, both in IPv4 and IPv6.
To avoid malicious domain names, resolved local IPs from are also
forbidden inside the module.
This vulnerability impact is moderate, as it is can allow access to
unexposed documents on the local network, and is very easy
to exploit.PatchesThe vulnerability has been patched in version 3.1.0.
If impacted, you should update to this version as soon as possible.Please note that a minor version has been released instead of a bugfix.
This is due to a new option included to prevent another vulnerability,
upgrading to the new version will not break compatibility.WorkaroundsNo workaround is known, the package should be upgraded.For more informationIf you have any questions or comments about this advisory, open an issue in [ZMarkdown](https://github.com/zestedesavoir/zmarkdown/issues).
CVE-2022-23452 
An authorization flaw was found in openstack-barbican, where anyone with an admin role could add secrets to a different project container. This flaw allows an attacker on the network to consume protected resources and cause a denial of service.
CVSS v3.1 score: 4.9
CVE-2015-9547 
An issue was discovered on Samsung mobile devices with JBP(4.3) and KK(4.4.2) software. Because the READ_LOGS permission is mishandled, sensitive information is disclosed in a world-readable copy of the log file if the error message is "Unhandled exception in Dalvik VM," "Application not responding ANR event," or "Crash on an application's native code." The Samsung ID is SVE-2015-2885 (October 2015).
CVSS v3.1 score: 7.5
CVSS v2.0 score: 7.8
CVE-2024-36021 net: hns3: fix kernel crash when devlink reload during pf initialization
In the Linux kernel, the following vulnerability has been resolved:

net: hns3: fix kernel crash when devlink reload during pf initialization

The devlink reload process will access the hardware resources,
but the register operation is done before the hardware is initialized.
So, processing the devlink reload during initialization may lead to kernel
crash. This patch fixes this by taking devl_lock during initialization.
CVSS v3.1 score: 5.5
GHSA-jf3j-gf83-hhg3 
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally.
CVSS v3.1 score: 8.4
GHSA-jxpj-9j24-w337 Apollo Portal: There is a risk of unauthorized access to the Apollo configuration center
SummaryApollo Portal versions before 2.5.0 do not verify application and namespace permissions when an authenticated user requests a release by ID through `GET /envs/{env}/releases/{releaseId}`.When `configView.memberOnly.envs` is enabled for the requested environment, a low-privileged Portal user can supply a valid release ID belonging to an application or namespace they are not authorized to view. The endpoint returns the release data without calling `UserPermissionValidator.shouldHideConfigToCurrentUser(...)`.ImpactAn authenticated attacker who obtains or guesses a valid release ID can read configuration data from other applications and namespaces. Exposed configuration may contain sensitive values such as credentials or service endpoints. The issue does not allow configuration modification and does not directly affect availability.Affected versionsApollo Portal versions earlier than 2.5.0 are affected when `configView.memberOnly.envs` is enabled.PatchesThe issue is fixed in Apollo 2.5.0. The fix adds the missing application and namespace permission check before returning release data.Fix: https://github.com/apolloconfig/apollo/pull/5378Fix commit: https://github.com/apolloconfig/apollo/commit/362735ded4f13b62f6ab9df135d7096066e8e291Patched release: https://github.com/apolloconfig/apollo/releases/tag/v2.5.0WorkaroundsUpgrade to Apollo 2.5.0 or later. If an immediate upgrade is not possible, backport the permission check from [PR #5378](https://github.com/apolloconfig/apollo/pull/5378) and restrict Apollo Portal access to trusted users until the fix is deployed.CreditsApollo Portal thanks [@lesignals](https://github.com/lesignals) for reporting this issue.
CVSS v3.1 score: 6.5
CVE-2014-3741 
The printDirect function in lib/printer.js in the node-printer module 0.0.1 and earlier for Node.js allows remote attackers to execute arbitrary commands via unspecified characters in the lpr command.
CVSS v3.0 score: 9.8
CVSS v2.0 score: 7.5
GHSA-g4cp-jcg9-qf3p 
Multiple cross-site scripting (XSS) vulnerabilities in templates/link_temp.php in PHPNews 1.3.0 allow remote attackers to inject arbitrary web script or HTML via the (1) url, (2) id, (3) subject, (4) username, or (5) time parameter.
GHSA-8v4w-j3mg-5x2r 
Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
CVE-2026-57624 WordPress Blocksy Companion Pro plugin <= 2.1.46 - Remote Code Execution (RCE) vulnerability
Unauthenticated Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.46 versions.
CVSS v3.1 score: 10
CVE-2018-15752 
An issue was discovered in the MensaMax (aka com.breustedt.mensamax) application 4.3 for Android. Cleartext Transmission of Sensitive Information allows man-in-the-middle attackers to eavesdrop authentication information between the application and the server.
CVSS v3.0 score: 8.1
CVSS v2.0 score: 4.3
GHSA-j526-pj9q-28j3 
IBM Cloud Pak for Security (CP4S) 1.4.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 189703.
GHSA-67f4-59mc-w493 
A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software running on certain models of Cisco Catalyst Switches could allow an authenticated, remote attacker to cause a denial of service (DoS) condition, aka a GET MIB Object ID Denial of Service Vulnerability. The vulnerability is due to a condition that could occur when the affected software processes an SNMP read request that contains a request for the ciscoFlashMIB object ID (OID). An attacker could trigger this vulnerability by issuing an SNMP GET request for the ciscoFlashMIB OID on an affected device. A successful exploit could cause the affected device to restart due to a SYS-3-CPUHOG. This vulnerability affects the following Cisco devices if they are running a vulnerable release of Cisco IOS Software and are configured to use SNMP Version 2 (SNMPv2) or SNMP Version 3 (SNMPv3): Cisco Catalyst 2960-L Series Switches, Cisco Catalyst Digital Building Series Switches 8P, Cisco Catalyst Digital Building Series Switches 8U. Cisco Bug IDs: CSCvd89541.
CVSS v3.0 score: 6.3
CVE-2016-9278 
The Samsung Exynos fimg2d driver for Android with Exynos 5433, 54xx, or 7420 chipsets allows local users to cause a denial of service (kernel panic) via a crafted ioctl command. The Samsung ID is SVE-2016-6736.
CVSS v3.0 score: 5.5
CVSS v2.0 score: 4.9
CVE-2025-20094 
Unprotected Windows messaging channel ('Shatter') issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker sends a specially crafted message to the specific process of the Windows system where the product is running, arbitrary code may be executed with SYSTEM privilege.
CVSS v3.0 score: 8.8
GHSA-qqxw-wjc4-f4pj 
An issue was discovered in Stormshield Network Security (SNS) 4.0.0 through 4.3.25, 4.4.0 through 4.7.5, and 4.8.0. Certain manipulations allow restarting in single-user mode despite the activation of secure boot. The following versions fix this: 4.3.27, 4.7.6, and 4.8.1.
CVSS v3.1 score: 4.2
GHSA-2xch-p52g-f698 
Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS v3.1 score: 5.4
CVE-2026-50429 Windows Kernel Information Disclosure Vulnerability
Out-of-bounds read in Windows Kernel allows an unauthorized attacker to disclose information over a network.
CVSS v3.1 score: 8.2
CVE-2024-20993 
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.35 and prior and  8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS v3.1 score: 4.9
GHSA-hfw9-q3f6-gv7r 
Cross-site scripting (XSS) vulnerability in atl.cgi in AtlantForum 4.02 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) sch_allsubct, (2) before, and (3) ct parameters.
GHSA-79vv-2m5g-frvv 
The Error Log Viewer by BestWebSoft WordPress plugin before 1.1.3 contains a vulnerability that allows you to read and download PHP logs without authorization
CVSS v3.1 score: 6.5
GHSA-95xp-598v-c534 
Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.
CVSS v3.1 score: 7
CVE-2014-7420 
The Just Bureaucracy (aka com.magzter.justbureaucracy) application 3.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0 score: 5.4
GHSA-v86m-j5f7-ccwh Passbolt Api E-mail HTML injection
Passbolt sends e-mail to users to warn them about different type of events such as the creation, modification or deletion of a password. Those e-mails may contain user-specified input, such as a password’s title or description.Passbolt does not escape the user’s input properly, resulting in the user being able to inject HTML code in an e-mail.An authenticated attacker could share a password containing an img HTML tag in its description with an other user to obtain information about their mail user-agent.This vulnerability has a very low impact. Most MUA do not embed remote images to protect their users’ privacy.
CVSS v3.1 score: 4.4
CVE-2024-23493  Team associated AD/LDAP Groups Leaked due to missing authorization
Mattermost fails to properly authorize the requests fetching team associated AD/LDAP groups, allowing a user to fetch details of AD/LDAP groups of a team that they are not a member of. 


CVSS v3.1 score: 4.3
GHSA-xh84-5f5q-96wv 
The License Logging service for Windows NT Server, Windows 2000 Server, and Windows Server 2003 does not properly validate the length of messages, which leads to an "unchecked buffer" and allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, aka the "License Logging Service Vulnerability."
RHSA-2019:1623 Red Hat Security Advisory: thunderbird security update
libical: Heap buffer over read in icalparser.c parser_get_next_char libical: Heap buffer overflow in icalmemory_strdup_and_dequote function in icalvalue.c libical: Stack buffer overflow in icalrecur_add_bydayrules in icalrecur.c libical: Type confusion in icaltimezone_get_vtimezone_properties function in icalproperty.c Mozilla: Type confusion in Array.pop Mozilla: Sandbox escape using Prompt:Open
CVSS v3.0 score: 10
CVE-2004-0917 
The default installation of Vignette Application Portal installs the diagnostic utility without authentication requirements, which allows remote attackers to gain sensitive information, such as server and OS version, and conduct unauthorized activities via an HTTP request to /diag.
CVSS v2.0 score: 5
CVE-2017-14641 
A NULL pointer dereference was discovered in the AP4_DataAtom class in MetaData/Ap4MetaData.cpp in Bento4 version 1.5.0-617. The vulnerability causes a segmentation fault and application crash, which leads to remote denial of service.
CVSS v3.0 score: 6.5
CVSS v2.0 score: 4.3
CVE-2025-36756 Device Takeover vulnerability in SolaX Cloud
A problem with missing authorization on SolaX Cloud platform allows taking over any SolaX solarpanel inverter of which the serial number is known.
CVSS v4.0 score: 5.8
CVE-2024-44175 
This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7.1. An app may be able to access sensitive user data.
CVSS v3.1 score: 7.5
GHSA-rh2h-wrf9-gh69 
A vulnerability in the persistent Telnet/Secure Shell (SSH) CLI of Cisco IOS XE Software could allow an authenticated, local attacker to gain shell access on an affected device and execute commands on the underlying operating system (OS) with root privileges. The vulnerability is due to insufficient enforcement of the consent token in authorizing shell access. An attacker could exploit this vulnerability by authenticating to the persistent Telnet/SSH CLI on an affected device and requesting shell access. A successful exploit could allow the attacker to gain shell access on the affected device and execute commands on the underlying OS with root privileges.
CVSS v3.1 score: 7.8
CVE-2025-14785 Website Builder by SeedProd - Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode <= 6.20.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'seedprodnestedmenuwidget' Shortcode
The Website Builder by SeedProd - Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `seedprodnestedmenuwidget` shortcode in all versions up to, and including, 6.20.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1 score: 6.4
RHSA-2008:0244 Red Hat Security Advisory: java-1.5.0-bea security update
Untrusted applet and application XSLT processing privilege escalation JRE image parsing library allows privilege escalation (CVE-2008-1194) JRE image parsing library allows privilege escalation (CVE-2008-1194)
GHSA-wwfg-grx5-fq38 
Format string vulnerability in Tripwire commercial 4.0.1 and earlier, including 2.4, and open source 2.3.1 and earlier, allows local users to gain privileges via format string specifiers in a file name, which is used in the generation of an email report.
CVE-2012-5217 
HP System Management Homepage (SMH) before 7.2.1 allows remote attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors, a different vulnerability than CVE-2013-2355.
CVSS v2.0 score: 5
GHSA-957p-h4rq-65r9 
zenAdminSrv.exe in Ing. Punzenberger COPA-DATA zenon 6.51 SP0 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted packet to TCP port 50777, aka Reference Number 25240.
CVE-2022-0205 YOP Poll < 6.3.5 - Author+ Stored Cross-Site Scripting
The YOP Poll WordPress plugin before 6.3.5 does not sanitise and escape some of the settings (available to users with a role as low as author) before outputting them, leading to a Stored Cross-Site Scripting issue
CVSS v3.1 score: 5.4
CVSS v2.0 score: 3.5
CVE-2005-1317 
Cross-site scripting (XSS) vulnerability in Horde Chora module before 1.2.3 allows remote attackers to inject arbitrary web script or HTML via the parent's frame page title.
CVSS v2.0 score: 6.8
CVE-2025-4589 Bon Toolkit <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Bon Toolkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bt-map' shortcode in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1 score: 6.4
CVE-2024-51116 
Tenda AC6 v2.0 V15.03.06.50 was discovered to contain a buffer overflow in the function 'formSetPPTPServer'.
CVSS v3.1 score: 8.8
GHSA-fhwr-843x-gg38 
Buffer overflow in the save_embedded_address function in filter.c for elm/bolthole filter 2.6.1 allows remote attackers to execute arbitrary code via a crafted email message.