CIRCL/vulnerability-scores huggingface dataset:
GHSA-8ph6-439g-xgw9 
Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, a different vulnerability than CVE-2010-3640, CVE-2010-3641, CVE-2010-3642, CVE-2010-3643, CVE-2010-3644, CVE-2010-3645, CVE-2010-3646, CVE-2010-3647, CVE-2010-3648, CVE-2010-3649, and CVE-2010-3650.
GHSA-f2ch-w95m-q82q 
Cross-Site Request Forgery (CSRF) vulnerability in Codex-m Sort SearchResult By Title plugin <= 10.0 versions.
CVSS v3.1 score: 4.3
CVE-2023-32325 Cross-site scripting in PostHog-js
PostHog-js is a library to interface with the PostHog analytics tool. Versions prior to 1.57.2 have the potential for cross-site scripting. Problem has been patched in 1.57.2. Users are advised to upgrade. Users unable to upgrade should ensure that their Content Security Policy is in place.
CVSS v3.1 score: 5.4
CVE-2025-1582 PHPGurukul Online Nurse Hiring System all-request.php sql injection
A vulnerability was found in PHPGurukul Online Nurse Hiring System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/all-request.php. The manipulation of the argument viewid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 6.3
CVSS v3.0 score: 6.3
CVSS v2.0 score: 6.5
GHSA-c2qw-7x7v-hp58 
The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 omits the Content-Type header's charset parameter for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving admin/customer-service-plan/list/reset-search/true/ and certain other files.  NOTE: it is possible that only clients, not the Plesk product, could be affected by this issue.
GHSA-65m7-2cv6-rjpq 
Author Broken Access Control in W3 Total Cache <= 2.9.1 versions.
CVSS v3.1 score: 4.7
CVE-2026-13931 
Inappropriate implementation in Media in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVSS v3.1 score: 6.5
CVE-2015-8646 
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8634, CVE-2015-8635, CVE-2015-8638, CVE-2015-8639, CVE-2015-8640, CVE-2015-8641, CVE-2015-8642, CVE-2015-8643, CVE-2015-8647, CVE-2015-8648, CVE-2015-8649, and CVE-2015-8650.
CVSS v3.0 score: 8.8
CVSS v2.0 score: 9.3
CVE-2025-11337 Four-Faith Water Conservancy Informatization Platform download.do;othersusrlogout.do path traversal
A vulnerability was detected in Four-Faith Water Conservancy Informatization Platform up to 2.2. This affects an unknown part of the file /aloneReport/index.do/../../aloneReport/download.do;othersusrlogout.do. Performing manipulation of the argument fileName results in path traversal. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 5.3
CVSS v3.0 score: 5.3
CVSS v2.0 score: 5
CVE-2017-9910 
XnView Classic for Windows Version 2.40 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted .fpx file, related to an "Error Code (0xc000041d) starting at wow64!Wow64NotifyDebugger+0x000000000000001d."
CVSS v3.0 score: 7.8
CVSS v2.0 score: 6.8
GHSA-62f6-qcp7-pw2w 
Adobe InCopy version 16.0 (and earlier) is affected by an path traversal vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve remote code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
GHSA-x7wj-r2hg-35fm 
In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed.
CVSS v3.1 score: 7.5
GHSA-xmh4-cqm8-6p2v 
Array index error in the __sock_diag_rcv_msg function in net/core/sock_diag.c in the Linux kernel before 3.7.10 allows local users to gain privileges via a large family value in a Netlink message.
GHSA-vr2c-pq5m-cpf7 
LimeSurvey before 4.0.0-RC4 allows SQL injection via the participant model.
CVE-2001-1093 
Buffer overflow in msgchk in Digital UNIX 4.0G and earlier allows local users to execute arbitrary code via a long command line argument.
CVSS v2.0 score: 7.2
GHSA-4fvq-5jgr-vrhq 
Directory traversal vulnerability in index.php in mUnky 0.0.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the zone parameter.
CVE-2022-41403 
OpenCart 3.x Newsletter Custom Popup was discovered to contain a SQL injection vulnerability via the email parameter at index.php?route=extension/module/so_newletter_custom_popup/newsletter.
CVSS v3.1 score: 9.8
CVE-2014-4163 
Multiple cross-site request forgery (CSRF) vulnerabilities in the Featured Comments plugin 1.2.1 for WordPress allow remote attackers to hijack the authentication of administrators for requests that change the (1) buried or (2) featured status of a comment via a request to wp-admin/admin-ajax.php.
CVSS v2.0 score: 6.8
GHSA-69j6-4w2p-2887 
lunary-ai/lunary is vulnerable to broken access control in the latest version. An attacker can view the content of any dataset without any kind of authorization by sending a GET request to the /v1/datasets endpoint without a valid authorization token.
CVSS v3.0 score: 7.5
GHSA-pc8q-hxww-6c2f 
The sd2_parse_rsrc_fork function in sd2.c in libsndfile allows attackers to have unspecified impact via vectors related to a (1) map offset or (2) rsrc marker, which triggers an out-of-bounds read.
CVE-2022-48361 
The Always On Display (AOD) has a path traversal vulnerability in theme files. Successful exploitation of this vulnerability may cause a failure in reading AOD theme resources.
CVSS v3.1 score: 5.3
CVE-2024-7208 CVE-2024-7208
A vulnerability in multi-tenant hosting allows an authenticated sender to spoof the identity of a shared, hosted domain, thus bypass security measures provided by DMARC (or SPF or DKIM) policies.
CVSS v3.1 score: 6.5
GHSA-3cm2-qc8f-9f2g 
The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'register_form' and 'restrict' shortcodes in all versions up to, and including, 3.2.15 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1 score: 6.4
GHSA-qfvv-4jjj-6cq2 
The (1) bundled GnuTLS SSL/TLS plugin and the (2) bundled OpenSSL SSL/TLS plugin in libpurple in Pidgin before 2.10.10 do not properly consider the Basic Constraints extension during verification of X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
GHSA-35q6-7298-9c8j 
A reachable assertion in the ogs_kdf_hash_mme function of Open5GS <= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a crafted NAS packet.
CVSS v3.1 score: 5.3
GHSA-c3f3-rc6v-mhx5 
The Easy Digital Downloads (EDD) Amazon S3 extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
CVSS v3.1 score: 6.1
CVE-2022-4216 Chained Quiz <= 1.3.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Facebook App ID
The Chained Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'facebook_appid' parameter in versions up to, and including, 1.3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrative privileges to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1 score: 5.5
GHSA-rv7r-2cq4-m967 
The (1) JScript and (2) VBScript engines in Microsoft Internet Explorer 9 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability."
CVE-2025-26420 
In multiple functions of GrantPermissionsActivity.java , there is a possible way to trick the user into granting the incorrect permission due to permission overload. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1 score: 4.4
GHSA-9c8h-vvrj-w2p8 Heap OOB in `RaggedGather`
ImpactIf the arguments to `tf.raw_ops.RaggedGather` don't determine a valid ragged tensor code can trigger a read from outside of bounds of heap allocated buffers.In debug mode, the same code triggers a `CHECK` failure.The [implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/ragged_gather_op.cc#L70) directly reads the first dimension of a tensor shape before checking that said tensor has rank of at least 1 (i.e., it is not a scalar). Furthermore, the implementation does not check that the list given by `params_nested_splits` is not an empty list of tensors.PatchesWe have patched the issue in GitHub commit [a2b743f6017d7b97af1fe49087ae15f0ac634373](https://github.com/tensorflow/tensorflow/commit/a2b743f6017d7b97af1fe49087ae15f0ac634373).The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.For more informationPlease consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.AttributionThis vulnerability has been reported by members of the Aivul Team from Qihoo 360.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 7.1
GHSA-83j2-pmf7-p2m2 
Insufficient enforcement of file access permission in the activeTab case in Extensions in Google Chrome prior to 68.0.3440.75 allowed an attacker who convinced a user to install a malicious extension to access files on the local file system via a crafted Chrome Extension.
CVSS v3.0 score: 6.5
CVE-2026-2393 Server-Side Request Forgery (SSRF) in mlflow/mlflow
A Server-Side Request Forgery (SSRF) vulnerability exists in MLflow versions prior to 3.9.0. The `_create_webhook()` function in `mlflow/server/handlers.py` accepts a user-controlled `url` parameter without validation, and the `_send_webhook_request()` function in `mlflow/webhooks/delivery.py` sends HTTP POST requests to this attacker-controlled URL. This allows an authenticated attacker to force the MLflow backend to send HTTP requests to internal services, cloud metadata endpoints, or arbitrary external servers. The lack of input sanitization, URL scheme filtering, or allowlist validation on the webhook URL enables exploitation, potentially leading to cloud credential theft, internal network access, and data exfiltration.
CVSS v3.0 score: 7.1
GHSA-24cr-56gf-fx38 
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVSS v3.1 score: 8.2
CVE-2022-45091 Cross-site Scripting in Smartpower Web
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Group Arge Energy and Control Systems Smartpower Web allows Cross-Site Scripting (XSS).

This issue affects Smartpower Web: before 23.01.01.
CVSS v3.1 score: 5.4
GHSA-99qg-2w8q-6fqv 
The WebWork 1 web application framework in Atlassian JIRA before 3.13.2 allows remote attackers to invoke exposed public JIRA methods via a crafted URL that is dynamically transformed into method calls, aka "WebWork 1 Parameter Injection Hole."
GHSA-v5h2-q2w4-gpcx Sentry improper error handling leaks Application Integration Client Secret
ImpactDuring routine testing, we identified a scenario where a specific error message generated by our platform could include a plaintext Client ID and Client Secret for an application integration. The Client ID and Client Secret would not be displayed in the UI, but would be returned in the underlying HTTP response to the end user. This could occur under the following conditions:An app installation made use of a [Search UI component](https://docs.sentry.io/organization/integrations/integration-platform/ui-components/formfield/#select) with the `async` flag set to true (default: true),A user types types into the Search Component which creates a request to the third-party for search or query results, andThat third-party response may then fail validation and Sentry would return the `select-requester.invalid-response` error code along with a serialized version of a Sentry application containing the integration Client Secret.Should this error be found, it's reasonable to assume the potential exposure of an integration Client Secret. However, an ID and Secret pair alone does not provide direct access to any data. For that secret to be abused an attacker would also need to obtain a valid API token for a Sentry application.Impact for SaaS UsersFor Sentry SaaS users, we have confirmed that only a single application integration was impacted and the owner has rotated their Client Secret. We have also confirmed that no abuse of the leaked Client Secret has occurred.Potential Impact for Self-Hosted UsersSentry self-hosted does not ship with any application integrations. This could only impact self-hosted users that maintain their own integrations. In that case, search for a `select-requester.invalid-response` event. Please note that this error was also shared with another event unrelated to this advisory so you will also need to review the parameters logged for each named event. You may review [select_requester.py](https://github.com/getsentry/sentry/blob/4a448fbb0d0b416fef9ee0ab26579e0dc16f21b7/src/sentry/sentry_apps/external_requests/select_requester.py#L78-L123) for the instances where these errors can be generated. With the security fix this is no longer a shared event type.PatchesSentry SaaS users do not need to take any action.Sentry self-hosted users should upgrade to 24.11.1 or higher.ReferencesBug introduced in https://github.com/getsentry/sentry/pull/79377Security fix in https://github.com/getsentry/sentry/pull/81038
CVSS v3.1 score: 5.3
GHSA-vf4c-cmqm-2c6v 
Users with Site-level permissions can access files containing the username-encrypted passwords of Security Console Global Administrators and clear-text passwords for restoring backups, as well as the salt for those passwords. Valid credentials are required to access these files and malicious users would still need to perform additional work to decrypt the credentials and escalate privileges. This issue affects: Rapid7 InsightVM versions 6.5.11 through 6.5.49.
CVSS v3.1 score: 6.5
CVE-2023-28498 WordPress Hotel Booking Lite Plugin <= 4.6.0 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in MotoPress Hotel Booking Lite plugin <= 4.6.0 versions.
CVSS v3.1 score: 4.3
GHSA-rqx2-5vfv-6xgq 
IBM Spectrum Protect 7.1 and 8.1 (formerly Tivoli Storage Manager) Server uses weak encryption for the password. A database administrator may be able to decrypt the IBM Spectrum protect client or administrator password which can result in information disclosure or a denial of service. IBM X-Force ID: 126247.
CVSS v3.0 score: 4.4
GHSA-7rv8-qgm5-32cr 
The TwitterPosts WordPress plugin through 1.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVSS v3.1 score: 6.5
GHSA-qjv7-88rf-3mf4 
Intelbras TELEFONE IP TIP200/200 LITE 60.0.75.29 devices allow remote authenticated admins to read arbitrary files via the /cgi-bin/cgiServer.exx page parameter, aka absolute path traversal. In some cases, authentication can be achieved via the admin account with its default admin password.
CVSS v3.1 score: 7.2
GHSA-52h3-356x-rv36 
Multiple cross-site scripting (XSS) vulnerabilities in Aeries Browser Interface (ABI) 3.8.3.14 in Eagle Software Aries Student Information System allow remote attackers to inject arbitrary web script or HTML via the (1) UserName parameter to loginproc.asp and the (2) usr parameter to Login.asp.
GHSA-rc52-c4hv-w89p Sylius Mollie Plugin vulnerable to payment status forgery via the payment webhook
ImpactThe shop payment webhook `POST /{_locale}/update-payment` (route
  `sylius_mollie_shop_payment_webhook`) accepts two independent, attacker-controlled
  parameters: `id` (the Mollie payment ID, verified against Mollie's API) and `orderId` (the
  Sylius order ID, read directly from the database). The handler never verifies that the
  Mollie payment belongs to the referenced order.An unauthenticated attacker who holds any valid **paid** Mollie payment ID, for example
  from a EUR 1 order they placed themselves, can submit it together with any victim
  `orderId`. The victim's order payment is then transitioned to `completed` (or any other
  Mollie-derived state) without any funds being transferred for that order. Sylius order IDs
  are sequential integers, and the endpoint requires no authentication, CSRF token or rate
  limiting, so the attack scales trivially across all pending orders.PatchesFixed in versions **2.2.8**, **3.2.4** and **3.3.1**. The webhook now binds the payment to
  the order: it reads the Mollie payment ID stored server-side for that order when the payment
  was created and compares it to the incoming Mollie payment ID. On mismatch the request is
  acknowledged with `HTTP 200` and no state change is applied. `HTTP 200` is intentional,
  because Mollie retries the webhook on any non-2xx response.The stored ID lives in one of two places depending on the checkout flow, and the fix reads
  both of them (mirroring `CaptureAction`):`payment.getDetails()['payment_mollie_id']` for the standard Shop API and Apple Pay Direct
flows, stored in `CreatePaymentAction`.`order.getMolliePaymentId()` for the QR-code flow, which stores the ID on the order itself
(`QrCodeAction`).Reading only the payment details would reject legitimate QR-code payments, because their
  payment details carry no `payment_mollie_id`, so both sources must be consulted.WorkaroundsIf you cannot upgrade immediately, patch the vulnerability at the project level by
  decorating the plugin's webhook controller. The decorator checks that the incoming Mollie
  id matches the id stored for that order **before** handing over to the original controller,
  so no plugin behaviour (state machine, logging) is lost and no extra Mollie API call is
  made. Works on both 2.2 and 3.x.Step 1. Create the decoratorCreate `src/Controller/Mollie/SecurePaymentWebhookController.php` in your Sylius project:Step 2. Register the decoratorAppend to your project's `config/services.yaml`:`decorates:` keeps the original service ID, so the route
`_controller: sylius_mollie.controller.shop.payment_webhook` keeps working with no route
changes. `@.inner` is the original plugin controller.Step 3. Clear the cache
CVSS v3.1 score: 7.5
GHSA-2rxm-39cm-27mj 
Due to a new NDP proxy feature for EVPN leaf nodes introduced in Junos OS 17.4, crafted NDPv6 packets could transit a Junos device configured as a Broadband Network Gateway (BNG) and reach the EVPN leaf node, causing a stale MAC address entry. This could cause legitimate traffic to be discarded, leading to a Denial of Service (DoS) condition. This issue only affects Junos OS 17.4 and later releases. Prior releases do not support this feature and are unaffected by this vulnerability. This issue only affects IPv6. IPv4 ARP proxy is unaffected by this vulnerability. This issue affects Juniper Networks Junos OS: 17.4 versions prior to 17.4R2-S9, 17.4R3 on MX Series; 18.1 versions prior to 18.1R3-S9 on MX Series; 18.2 versions prior to 18.2R2-S7, 18.2R3-S3 on MX Series; 18.2X75 versions prior to 18.2X75-D33, 18.2X75-D411, 18.2X75-D420, 18.2X75-D60 on MX Series; 18.3 versions prior to 18.3R1-S7, 18.3R2-S3, 18.3R3 on MX Series; 18.4 versions prior to 18.4R1-S5, 18.4R2-S2, 18.4R3 on MX Series; 19.1 versions prior to 19.1R1-S4, 19.1R2 on MX Series; 19.2 versions prior to 19.2R1-S3, 19.2R2 on MX Series.
CVE-2022-1554 Path Traversal due to `send_file` call in clinical-genomics/scout
Path Traversal due to `send_file` call in GitHub repository clinical-genomics/scout prior to 4.52.
CVSS v3.0 score: 6.8
CVE-2021-34185 
Miniaudio 0.10.35 has an integer-based buffer overflow caused by an out-of-bounds left shift in drwav_bytes_to_u32 in miniaudio.h
CVSS v3.1 score: 7.8
CVSS v2.0 score: 6.8
CVE-2021-24207 WP Page Builder < 1.2.4 - Insecure default configuration Allows Subscribers Editing Access to Posts
By default, the WP Page Builder WordPress plugin before 1.2.4 allows subscriber-level users to edit and make changes to any and all posts pages - user roles must be specifically blocked from editing posts and pages.
CVSS v3.1 score: 4.3
CVSS v2.0 score: 4
GHSA-j33m-2537-86jm PrestaShop XSS Vulnerability
PrestaShop before 1.5.2.0 allows XSS via the `<object data='data:text/html` substring in the message field.
CVSS v3.1 score: 6.1
GHSA-69f7-q9jg-9r54 
A vulnerability, which was classified as critical, has been found in webuidesigning NebulaX Theme up to 5.0 on WordPress. This issue affects the function nebula_send_to_hubspot of the file libs/Legacy/Legacy.php. The manipulation leads to sql injection. The attack may be initiated remotely. The patch is named 41230a81db0f671c570c2644bc2f80565ca83c5a. It is recommended to apply a patch to fix this issue.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 6.3
CVE-2022-50917 ProtonVPN 1.26.0 - Unquoted Service Path
ProtonVPN 1.26.0 contains an unquoted service path vulnerability in its WireGuard service configuration that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path by placing malicious executables in specific file system locations to gain elevated privileges during service startup.
CVSS v4.0 score: 8.5
CVSS v3.1 score: 7.8
CVE-2008-6553 
microcms-admin-home.php in Implied by Design Micro CMS (Micro-CMS) 3.5 (aka 0.3.5) does not require authentication as an administrator, which allows remote attackers to (1) create administrative accounts via an add_admin action, (2) remove administrative accounts via a delete_admin action, and (3) modify administrative passwords via a change_password action.
CVSS v2.0 score: 7.5
GHSA-83rq-mxvp-fh45 
An issue was discovered in certain Apple products. iOS before 11.2 is affected. The issue involves the "Mail Message Framework" component. It allows remote attackers to spoof the address bar via a crafted web site.
CVSS v3.0 score: 4.3
CVE-2026-43658 
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.
CVSS v3.1 score: 8.8
CVE-2024-30270 mailcow Path Traversal and Arbitrary Code Execution Vulnerability
mailcow: dockerized is an open source groupware/email suite based on docker. A security vulnerability has been identified in mailcow affecting versions prior to 2024-04. This vulnerability is a combination of path traversal and arbitrary code execution, specifically targeting the `rspamd_maps()` function. It allows authenticated admin users to overwrite any file writable by the www-data user by exploiting improper path validation. The exploit chain can lead to the execution of arbitrary commands on the server. Version 2024-04 contains a patch for the issue.
CVSS v3.1 score: 6.2
CVE-2021-27424 GE UR family exposure of sensitive information to an unauthorized actor
GE UR firmware versions prior to version 8.1x shares MODBUS memory map as part of the communications guide. GE was made aware a “Last-key pressed” MODBUS register can be used to gain unauthorized information.
CVSS v3.1 score: 5.3
GHSA-wp73-m8wc-m2mm 
A Cross-Site Request Forgery issue was discovered in Sierra Wireless AirLink Raven XE, all versions prior to 4.0.14, and AirLink Raven XT, all versions prior to 4.0.11. Affected devices do not verify if a request was intentionally sent by the logged-in user, which may allow an attacker to trick a client into making an unintentional request to the web server that will be treated as an authentic request.
CVSS v3.0 score: 8.8
CVE-2018-11189 
Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 1 of 6).
CVSS v3.0 score: 8.8
CVSS v2.0 score: 9
GHSA-79jm-hgj4-5mpx 
In the Linux kernel, the following vulnerability has been resolved:rxrpc: Fix leak of rxgk context in rxgk_verify_response()Fix rxgk_verify_response() to clean up the rxgk context it creates.
CVSS v3.1 score: 5.5
GHSA-7f74-7q5w-hj4r Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differential
ImpactThe external URL detection used for redirect validation on unauthenticated endpoints could be bypassed, allowing users to be redirected to external URLs after actions like form submissions and authentication flows.PatchesThis has been fixed in 5.73.16 and 6.7.2.
CVSS v3.1 score: 6.1
CVE-2022-23537 PJSIP vulnerable to heap buffer overflow when decoding STUN message
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. Buffer overread is possible when parsing a specially crafted STUN message with unknown attribute. The vulnerability affects applications that uses STUN including PJNATH and PJSUA-LIB. The patch is available as a commit in the master branch (2.13.1).
CVSS v3.1 score: 6.5
RHSA-2021:3296 Red Hat Security Advisory: libX11 security update
libX11: missing request length checks
CVSS v3.1 score: 8.1
GHSA-73c3-fg37-wh5m 
The Location module 6.x before 6.x-3.2 and 7.x before 7.x-3.0-alpha1 for Drupal does not properly check user or node access permissions, which allows remote attackers to read node or user results via the location search page.
CVE-2024-8641 Privilege Context Switching Error in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2. It may have been possible for an attacker with a victim's CI_JOB_TOKEN to obtain a GitLab session token belonging to the victim.
CVSS v3.1 score: 6.7
GHSA-3mpj-92q9-pvw2 
Unknown vulnerability in the PKINIT Protocol for Microsoft Windows 2000, Windows XP, and Windows Server 2003 could allow a local user to obtain information and spoof a server via a man-in-the-middle (MITM) attack between a client and a domain controller when PKINIT smart card authentication is being used.
CVE-2009-4390 
SQL injection vulnerability in the Car (car) extension 0.1.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS v2.0 score: 7.5
CVE-2026-23062 platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro
In the Linux kernel, the following vulnerability has been resolved:

platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro

The GET_INSTANCE_ID macro that caused a kernel panic when accessing sysfs
attributes:

1. Off-by-one error: The loop condition used '<=' instead of '<',
   causing access beyond array bounds. Since array indices are 0-based
   and go from 0 to instances_count-1, the loop should use '<'.

2. Missing NULL check: The code dereferenced attr_name_kobj->name
   without checking if attr_name_kobj was NULL, causing a null pointer
   dereference in min_length_show() and other attribute show functions.

The panic occurred when fwupd tried to read BIOS configuration attributes:

  Oops: general protection fault [#1] SMP KASAN NOPTI
  KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
  RIP: 0010:min_length_show+0xcf/0x1d0 [hp_bioscfg]

Add a NULL check for attr_name_kobj before dereferencing and corrects
the loop boundary to match the pattern used elsewhere in the driver.
CVSS v3.1 score: 5.5
CVE-2024-53147 exfat: fix out-of-bounds access of directory entries
In the Linux kernel, the following vulnerability has been resolved:

exfat: fix out-of-bounds access of directory entries

In the case of the directory size is greater than or equal to
the cluster size, if start_clu becomes an EOF cluster(an invalid
cluster) due to file system corruption, then the directory entry
where ei->hint_femp.eidx hint is outside the directory, resulting
in an out-of-bounds access, which may cause further file system
corruption.

This commit adds a check for start_clu, if it is an invalid cluster,
the file or directory will be treated as empty.
CVSS v3.1 score: 7.8
CVE-2026-27689 Denial of service (DOS) in SAP Supply Chain Management
Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular user privileges and network access can repeatedly invoke a remote-enabled function module with an excessively large loop-control parameter. This triggers prolonged loop execution that consumes excessive system resources, potentially rendering the system unavailable. Successful exploitation results in a denial-of-service condition that impacts availability, while confidentiality and integrity remain unaffected.
CVSS v3.1 score: 7.7
GHSA-89mg-6p9g-4jfj 
In the Linux kernel through 6.2.7, fs/ntfs3/inode.c has an invalid kfree because it does not validate MFT flags before replaying logs.
CVSS v3.1 score: 7.8
GHSA-cfcv-65jq-76jw 
The Custom Block Builder  WordPress plugin before 4.3.0 does not consistently check the unfiltered_html capability across all paths that write to its block template code fields, allowing administrators on multisite installations (or single-site installs with DISALLOW_UNFILTERED_HTML defined) to inject arbitrary JavaScript that executes for any visitor of pages embedding the affected block.
CVSS v3.1 score: 3.5
CVE-2022-49050 memory: renesas-rpc-if: fix platform-device leak in error path
In the Linux kernel, the following vulnerability has been resolved:

memory: renesas-rpc-if: fix platform-device leak in error path

Make sure to free the flash platform device in the event that
registration fails during probe.
CVSS v3.1 score: 5.5
GHSA-vx5g-jgx3-6mx9 
Potential DoS was identified in gitlab-shell in GitLab CE/EE version 12.6.0 or above, which allows an attacker to spike the server resource utilization via gitlab-shell command.
GHSA-pjpj-c8p5-7mqj 
An issue was discovered in function filter_frame in libavfilter/vf_lenscorrection.c in Ffmpeg 4.2.1, allows attackers to cause a Denial of Service or other unspecified impacts due to a division by zero.
GHSA-53mg-6xcj-rxjq 
idn in libidn before 1.33 might allow remote attackers to obtain sensitive memory information by reading a zero byte as input, which triggers an out-of-bounds read, a different vulnerability than CVE-2015-8948.
CVSS v3.0 score: 7.5
CVE-2019-19087 
Gitlab Enterprise Edition (EE) before 12.5.1 has Insecure Permissions (issue 2 of 2).
CVSS v3.1 score: 4.3
CVSS v2.0 score: 4
CVE-2020-16969 Microsoft Exchange Information Disclosure Vulnerability
<p>An information disclosure vulnerability exists in how Microsoft Exchange validates tokens when handling certain messages. An attacker who successfully exploited the vulnerability could use this to gain further information from a user.</p>
<p>To exploit the vulnerability, an attacker could include specially crafted OWA messages that could be loaded, without warning or filtering, from the attacker-controlled URL. This callback vector provides an information disclosure tactic used in web beacons and other types of tracking systems.</p>
<p>The security update corrects the way that Exchange handles these token validations.</p>
CVSS v3.1 score: 7.1
GHSA-j385-2ppr-7766 
In the Linux kernel, the following vulnerability has been resolved:net/smc: Transitional solution for clcsock race issueWe encountered a crash in smc_setsockopt() and it is caused by
accessing smc->clcsock after clcsock was released.BUG: kernel NULL pointer dereference, address: 0000000000000020
 #PF: supervisor read access in kernel mode
 #PF: error_code(0x0000) - not-present page
 PGD 0 P4D 0
 Oops: 0000 [#1] PREEMPT SMP PTI
 CPU: 1 PID: 50309 Comm: nginx Kdump: loaded Tainted: G E     5.16.0-rc4+ #53
 RIP: 0010:smc_setsockopt+0x59/0x280 [smc]
 Call Trace:
  <TASK>
  __sys_setsockopt+0xfc/0x190
  __x64_sys_setsockopt+0x20/0x30
  do_syscall_64+0x34/0x90
  entry_SYSCALL_64_after_hwframe+0x44/0xae
 RIP: 0033:0x7f16ba83918e
  </TASK>This patch tries to fix it by holding clcsock_release_lock and
checking whether clcsock has already been released before access.In case that a crash of the same reason happens in smc_getsockopt()
or smc_switch_to_fallback(), this patch also checkes smc->clcsock
in them too. And the caller of smc_switch_to_fallback() will identify
whether fallback succeeds according to the return value.
CVSS v3.1 score: 4.7
CVE-2026-3482 IBM Sterling B2B Integrator and IBM Sterling File Gateway Authorization Bypass
IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.5_2,  6.2.1.0 through 6.2.1.1_2, and  6.2.2.0 through 6.2.2.0_1 could allow an unauthenticated user to read sensitive information by bypassing authentication through a specially crafted HTTP request.
CVSS v3.1 score: 5.3
CVE-2019-5040 
An exploitable information disclosure vulnerability exists in the Weave MessageLayer parsing of Openweave-core version 4.0.2 and Nest Cam IQ Indoor version 4620002. A specially crafted weave packet can cause an integer overflow to occur, resulting in PacketBuffer data reuse. An attacker can send a packet to trigger this vulnerability.
CVSS v3.0 score: 8.2
GHSA-g287-f5qw-f97f 
Cross-Site Request Forgery (CSRF) vulnerability in straightvisions GmbH SV Proven Expert allows Cross Site Request Forgery. This issue affects SV Proven Expert: from n/a through 2.0.06.
CVSS v3.1 score: 4.3
GHSA-h74w-79wh-vrpx 
Unspecified vulnerability in Kerio MailServer allows attackers to cause a denial of service, as demonstrated by vd_kms4.pm, a "Kerio MailServer DoS." NOTE: As of 20061108, this disclosure has no actionable information. However, since it is from a reliable researcher, it is being assigned a CVE identifier for tracking purposes.
CVE-2021-40363 
A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMATIC WinCC V15 and earlier (All versions < V15 SP1 Update 7), SIMATIC WinCC V16 (All versions < V16 Update 5), SIMATIC WinCC V17 (All versions < V17 Update 2), SIMATIC WinCC V17 (All versions <= V17 Update 4), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 19), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 6). The affected component stores the credentials of a local system account in a potentially publicly accessible project file using an outdated cipher algorithm. An attacker may use this to brute force the credentials and take over the system.
CVSS v3.1 score: 7.8
CVSS v2.0 score: 2.1
CVE-2025-14283 BlockArt Blocks – Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library <= 2.2.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
The BlockArt Blocks – Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the BlockArt Counter in all versions up to, and including, 2.2.14 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1 score: 6.4
GHSA-xqwc-4844-xj34 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Optimize Worldwide Find Content IDs allows Reflected XSS. This issue affects Find Content IDs: from n/a through 1.0.
CVSS v3.1 score: 7.1
GHSA-h9jc-284h-533g Context isolation bypass via contextBridge in Electron
ImpactApps using both `contextIsolation` and `contextBridge` are affected.This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions.WorkaroundsThere are no app-side workarounds, you must update your Electron version to be protected.Fixed Versions`9.0.0-beta.21``8.2.4``7.2.4`For more informationIf you have any questions or comments about this advisory:Email us at [security@electronjs.org](mailto:security@electronjs.org)
CVSS v3.1 score: 7.7
GHSA-3jpc-c4hr-jcph 
Cross-site request forgery (CSRF) vulnerability in LOCKON EC-CUBE 2.11.0 through 2.13.0 allows remote attackers to hijack the authentication of arbitrary users via unspecified vectors related to refusals.
CVE-2026-40046 Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT: Missing fix for CVE-2025-66168: MQTT control packet remaining length field is not properly validated
Integer Overflow or Wraparound vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT.

The fix for "CVE-2025-66168: MQTT control packet remaining length field is not properly validated" was only applied to 5.19.2 (and future 5.19.x) releases but was missed for all 6.0.0+ versions.


This issue affects Apache ActiveMQ: from 6.0.0 before 6.2.4; Apache ActiveMQ All: from 6.0.0 before 6.2.4; Apache ActiveMQ MQTT: from 6.0.0 before 6.2.4.



Users are recommended to upgrade to version 6.2.4 or a 5.19.x version starting with 5.19.2 or later (currently latest is 5.19.5), which fixes the issue.
CVSS v3.1 score: 7.5
GHSA-fwg2-gr34-q3w8 SurrealDB: ES512 silently downgraded to ES384 due to jsonwebtoken crate limitation
When a user configures `ALGORITHM ES512` for any JWT access method (`DEFINE ACCESS ... TYPE JWT ALGORITHM ES512`), SurrealDB silently substitutes ES384 at all four internal algorithm conversion points. This occurs because the underlying `jsonwebtoken` crate (v10.x) does not include an ES512 algorithm variant, so the mapping defaults to ES384 without raising an error, warning, or log message.Users who provide the correct P-521 key type for ES512 will experience authentication handshake failures due to the curve mismatch with ES384 (which expects P-384).ImpactAuthentication handshake failures when using ES512 with the correct P-521 key type, and when tokens are verified by external systems expecting real ES512 signatures.This vulnerability cannot be exploited to forge tokens or compromise the integrity or confidentiality of data handled by SurrealDB, as ES384 remains cryptographically strong.PatchesVersions prior to SurrealDB `v3.1.0` are vulnerable.The patches for SurrealDB `v3.1.0` block new `DEFINE ACCESS` statements using `ALGORITHM ES512` with a clear error message and add deprecation warnings at runtime for existing stored ES512 definitions.WorkaroundsUsers should reconfigure affected JWT access methods to use a supported algorithm such as ES384 (with a P-384 key pair) or another supported algorithm. Review any `DEFINE ACCESS` statements specifying `ALGORITHM ES512` and update them accordingly.
CVSS v3.1 score: 4.3
CVE-2020-0946 
An information disclosure vulnerability exists when Media Foundation improperly handles objects in memory, aka 'Media Foundation Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2020-0937, CVE-2020-0939, CVE-2020-0945, CVE-2020-0947.
CVSS v3.1 score: 5.5
CVSS v2.0 score: 4.3
CVE-2022-44532 
An authenticated path traversal vulnerability exists in the Aruba EdgeConnect Enterprise command line interface. Successful exploitation of this vulnerability results in the ability to read arbitrary files on the underlying operating system, including sensitive system files in Aruba EdgeConnect Enterprise Software version(s): ECOS 9.2.1.0 and below; ECOS 9.1.3.0 and below; ECOS 9.0.7.0 and below; ECOS 8.3.7.1 and below.


CVSS v3.1 score: 4.9
CVE-2018-15323 
On BIG-IP 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, in certain circumstances, when processing traffic through a Virtual Server with an associated MQTT profile, the TMM process may produce a core file and take the configured HA action.
CVSS v3.0 score: 5.9
CVSS v2.0 score: 4.3
CVE-2024-10182 Cognito Forms <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
The Cognito Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 2.0.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1 score: 6.4
CVE-2022-2606 
Use after free in Managed devices API in Google Chrome prior to 104.0.5112.79 allowed a remote attacker who convinced a user to enable a specific Enterprise policy to potentially exploit heap corruption via a crafted HTML page.
CVSS v3.1 score: 8.8
CVE-2011-4785 
Directory traversal vulnerability in the HP-ChaiSOE/1.0 web server on the HP LaserJet P3015 printer with firmware before 07.080.3, LaserJet 4650 printer with firmware 07.006.0, and LaserJet 2430 printer with firmware 08.113.0_I35128 allows remote attackers to read arbitrary files via unspecified vectors, a different vulnerability than CVE-2008-4419.
CVSS v2.0 score: 7.8
CVE-2005-0308 
Buffer overflow in the wsprintf function in W32Dasm 8.93 and earlier allows remote attackers to execute arbitrary code via a large import or export function name.
CVSS v2.0 score: 7.5
GHSA-hjw9-48pp-6r55 
Philips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have a vulnerability where code debugging methods are enabled, which could allow an attacker to remotely execute arbitrary code during runtime.
CVSS v3.0 score: 8.1
CVE-2025-54484 
A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability manifests on line 8779 of biosig.c on the current master branch (35a819fa), when the Tag is 6:

				else if (tag==6) 	// 0x06 "number of sequences"
				{
					// NRec
					if (len>4) fprintf(stderr,"Warning MFER tag6 incorrect length %i>4\n",len);
					curPos += ifread(buf,1,len,hdr);
CVSS v3.1 score: 9.8
CVE-2026-0131 
In RtpPacket::decodePacket, there is a possible out of bounds access due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
CVSS v3.1 score: 7.3
GHSA-prhc-jq43-ww89 
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in bslthemes Kinsley kinsley allows PHP Local File Inclusion.This issue affects Kinsley: from n/a through <= 3.4.4.
CVSS v3.1 score: 9.8
CVE-2024-47059 Users enumeration - weak password login
When logging in with the correct username and incorrect weak password, the user receives the notification, that their password is too weak.

However when an incorrect username is provided alongside with a weak password, the application responds with ’Invalid credentials’ notification.

This difference could be used to perform username enumeration.
CVSS v3.1 score: 4.3
CVE-2011-1073 
crontab.c in crontab in FreeBSD and Apple Mac OS X allows local users to (1) determine the existence of arbitrary files via a symlink attack on a /tmp/crontab.XXXXXXXXXX temporary file and (2) perform MD5 checksum comparisons on arbitrary pairs of files via two symlink attacks on /tmp/crontab.XXXXXXXXXX temporary files.
CVSS v2.0 score: 1.9
CVE-2019-8087 
Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a xml external entity injection vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVSS v3.1 score: 7.5
CVSS v2.0 score: 5
CVE-2020-9668 AGSService program mishandling symbolic links
Adobe Genuine Service version 6.6 (and earlier) is affected by an Improper Access control vulnerability when handling symbolic links. An unauthenticated attacker could exploit this to elevate privileges in the context of the current user.
CVSS v3.0 score: 7.8
CVE-2004-2054 
CRLF injection vulnerability in PhpBB 2.0.4 and 2.0.9 allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML content from the server via (1) the mode parameter to privmsg.php or (2) the redirect parameter to login.php.
CVSS v2.0 score: 5
GHSA-f23x-4gf4-m9ff Cross-site Scripting in Microweber
Microweber prior to version 1.2.16 is vulnerable to cross-site scripting. This vulnerability allows an attacker to execute JavaScript as the victim.
CVSS v3.0 score: 6.3
GHSA-8rqw-rwvr-r288 
Unknown vulnerability in phpGroupWare before 0.9.14.002 has unknown attack vectors and impact, related to a "security hole" in the Setup/Config functionality.
GHSA-mp6j-7g85-8pg2 
A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an authenticated, local attacker to gain DCA user privileges on an affected system. To exploit this vulnerability, the attacker must have valid&nbsp;vmanage credentials on the affected system.This vulnerability is due to the presence of a credential file for the DCA user on an affected system. An attacker could exploit this vulnerability by accessing the filesystem as a low-privileged user and reading the file that contains the DCA password from that affected system. A successful exploit could allow the attacker to access another affected system and gain DCA user privileges.
Note: Cisco Catalyst SD-WAN Manager releases 20.18 and later are not affected by this vulnerability.
CVSS v3.1 score: 7.5
GHSA-6v38-q3q9-62pv 
Missing Authorization vulnerability in vowelweb VW School Education vw-school-education allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW School Education: from n/a through <= 1.4.6.
CVSS v3.1 score: 5.3
GHSA-4hpg-x5qx-73m8 
Unchecked return value in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.
CVSS v3.1 score: 5.5
CVE-2007-0380 
DocMan 1.3 RC2 allows remote attackers to obtain sensitive information (the full path) via unspecified vectors.
CVSS v2.0 score: 5
CVE-2023-32014 Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability
Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability
CVSS v3.1 score: 9.8
RHSA-2025:13946 Red Hat Security Advisory: kernel security update
kernel: quota: Fix potential NULL pointer dereference kernel: USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor kernel: memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove kernel: nfsd: don't ignore the return code of svc_proc_register() kernel: net_sched: hfsc: Fix a UAF vulnerability in class handling kernel: net: ch9200: fix uninitialised access during mii_nway_restart
CVSS v3.1 score: 7
GHSA-97jv-jj7x-ghgg 
SQL injection vulnerability in Jabode horoscope extension (com_jabode) for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a sign task to index.php.
CVE-2007-1079 
Stack-based buffer overflow in Rhino Software, Inc. FTP Voyager 14.0.0.3 and earlier allows remote servers to cause a denial of service (crash) via a long response to a CWD command, which triggers the overflow when the user aborts the command.
CVSS v2.0 score: 7.8