CIRCL/vulnerability-scores huggingface dataset:
GHSA-8q74-gjq9-5xcc 
A flaw has been found in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setWiFiAclRules of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument mode causes os command injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.
CVSS v4.0 score: 8.9
CVSS v3.1 score: 9.8
GHSA-h57m-jqm8-q82f 
HP Systems Insight Manager (SIM) before 7.5.0, as used in HP Matrix Operating Environment before 7.5.0 and other products, allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors.
CVE-2013-1415 
The pkinit_check_kdc_pkid function in plugins/preauth/pkinit/pkinit_crypto_openssl.c in the PKINIT implementation in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.10.4 and 1.11.x before 1.11.1 does not properly handle errors during extraction of fields from an X.509 certificate, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a malformed KRB5_PADATA_PK_AS_REQ AS-REQ request.
CVSS v2.0 score: 5
GHSA-44fc-8fm5-q62h Convict has Prototype Pollution via startsWith() function
SummaryA prototype pollution vulnerability exists in the latest version of the convict npm package (6.2.4). Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input started with a forbidden key, it is still possible to pollute `Object.prototype` via a crafted input using `String.prototype`.DetailsThe vulnerability resides in line 564 of https://github.com/mozilla/node-convict/blob/master/packages/convict/src/main.js where `startsWith()` function is used to check whether user provided input contain forbidden strings.PoCSteps to reproduceInstall latest version of convict using `npm install` or cloning from gitRun the following code snippet:Expected behaviorPrototype pollution should be prevented and {} should not gain new properties.
This should be printed on the console:Actual behavior`Object.prototype` is polluted 
This is printed on the console:ImpactThis is a prototype pollution vulnerability, which can have severe security implications depending on how convict is used by downstream applications. Any application that processes attacker-controlled input using `convict.set`  may be affected.
It could potentially lead to the following problems:Authentication bypassDenial of serviceRemote code execution (if polluted property is passed to sinks like eval or child_process)
CVSS v4.0 score: 9.4
GHSA-8526-rr9p-cjrw 
Adobe RoboHelp has a cross-site scripting (XSS) vulnerability. This affects versions before RH12.0.4.460 and RH2017 before RH2017.0.2.
CVSS v3.0 score: 6.1
CVE-2021-37672 Heap OOB in `SdcaOptimizerV2` in TensorFlow
TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can read from outside of bounds of heap allocated data by sending specially crafted illegal arguments to `tf.raw_ops.SdcaOptimizerV2`. The [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/kernels/sdca_internal.cc#L320-L353) does not check that the length of `example_labels` is the same as the number of examples. We have patched the issue in GitHub commit a4e138660270e7599793fa438cd7b2fc2ce215a6. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
CVSS v3.1 score: 5.5
GHSA-pjcq-p3fr-jpj9 
Use-after-free vulnerability in the SVGImage::setContainerSize function in core/svg/graphics/SVGImage.cpp in the SVG implementation in Blink, as used in Google Chrome before 33.0.1750.146, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the resizing of a view.
CVE-2025-50152 Windows Kernel Elevation of Privilege Vulnerability
Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVSS v3.1 score: 7.8
CVE-2024-21116 
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).  Supported versions that are affected are Prior to 7.0.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. Note: This vulnerability applies to Linux hosts only. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS v3.1 score: 7.8
CVE-2025-32776 OpenRazer Vulnerable to Out of Bounds Read
OpenRazer is an open source driver and user-space daemon to control Razer device lighting and other features on GNU/Linux. By writing specially crafted data to the `matrix_custom_frame` file, an attacker can cause the custom kernel driver to read more bytes than provided by user space. This data will be written into the RGB arguments which will be sent to the USB device. This issue has been patched in v3.10.2.
CVSS v3.1 score: 5.5
CVE-2025-48506 
Uncontrolled search paths in Vitis™ Unified installation path on local Windows machines could allow DLL injection into these install paths, potentially resulting in arbitrary code execution.
CVSS v4.0 score: 7.3
GHSA-gf3g-587j-2865 
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content  WordPress plugin before 4.16.17 does not verify that the user performing a subscription action owns the targeted subscription, allowing any authenticated user (Subscriber+) to cancel other users' active subscriptions via an Insecure Direct Object Reference.
CVSS v3.1 score: 8.1
CVE-2019-17506 
There are some web interfaces without authentication requirements on D-Link DIR-868L B1-2.03 and DIR-817LW A1-1.04 routers. An attacker can get the router's username and password (and other information) via a DEVICE.ACCOUNT value for SERVICES in conjunction with AUTHORIZED_GROUP=1%0a to getcfg.php. This could be used to control the router remotely.
CVSS v3.1 score: 9.8
CVSS v2.0 score: 10
CVE-2014-8166 
The browsing feature in the server in CUPS does not filter ANSI escape sequences from shared printer names, which might allow remote attackers to execute arbitrary code via a crafted printer name.
CVSS v3.1 score: 8.8
CVSS v2.0 score: 5.1
GHSA-9w4v-9c99-hv7r Mattermost Server exposes sensitive information via its System Console UI
An issue was discovered in Mattermost Server before 3.0.0. It potentially allows attackers to obtain sensitive information (credential fields within config.json) via the System Console UI.
CVSS v4.0 score: 4.9
CVSS v3.1 score: 6.5
GHSA-46qm-vrjp-cc4w 
Multiple stack-based buffer overflows in the (1) ExtractRnick and (2) decrypt_topic_332 functions in FiSH allow remote attackers to execute arbitrary code via long strings.
CVE-2023-53688 Nagios XI < 5.11.3 XSS & CSRF via Hypermap Replay
Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting (XSS) and cross-site request forgery (CSRF) via the Hypermap Replay component. An attacker can submit crafted input that is not properly validated or escaped, allowing injection of malicious script that executes in the context of a victim's browser (XSS). Additionally, the component does not enforce sufficient anti-CSRF protections on state-changing operations, enabling an attacker to induce authenticated users to perform unwanted actions.
CVSS v4.0 score: 5.1
GHSA-pq24-mpmm-9ghf 
Use after free in Audio in Google Chrome on Mac prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)
CVSS v3.1 score: 8.8
CVE-2021-47425 i2c: acpi: fix resource leak in reconfiguration device addition
In the Linux kernel, the following vulnerability has been resolved:

i2c: acpi: fix resource leak in reconfiguration device addition

acpi_i2c_find_adapter_by_handle() calls bus_find_device() which takes a
reference on the adapter which is never released which will result in a
reference count leak and render the adapter unremovable.  Make sure to
put the adapter after creating the client in the same manner that we do
for OF.

[wsa: fixed title]
CVSS v3.1 score: 5.5
GHSA-6m24-8j7f-j628 
A vulnerability was found in Kaltura mwEmbed up to 2.96.rc1 and classified as problematic. This issue affects some unknown processing of the file includes/DefaultSettings.php. The manipulation of the argument HTTP_X_FORWARDED_HOST leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 2.96.rc2 is able to address this issue. The name of the patch is 13b8812ebc8c9fa034eed91ab35ba8423a528c0b. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217427.
CVSS v3.1 score: 6.1
GHSA-mx9q-pg4v-c3fj 
WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1289, CVE-2014-1290, CVE-2014-1291, CVE-2014-1292, and CVE-2014-1294.
CVE-2007-6406 
Multiple cross-site scripting (XSS) vulnerabilities in CA (formerly Computer Associates) eTrust Threat Management Console allow remote attackers to inject arbitrary web script or HTML via the IP Address field and other unspecified fields.
CVSS v2.0 score: 4.3
CVE-2007-6268 
Directory traversal vulnerability in pages/default.aspx in Absolute News Manager.NET 5.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the template parameter.
CVSS v2.0 score: 5
GHSA-4m6w-xv4r-c7h3 
A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-19818)
CVSS v3.1 score: 7.8
GHSA-p7pf-x444-qg77 
PHP remote file inclusion vulnerability in dm-albums/template/album.php in DM FileManager 3.9.4, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the SECURITY_FILE parameter.
CVE-2010-2290 
Cross-site scripting (XSS) vulnerability in cgi-bin/cgix/help in McAfee Unified Threat Management (UTM) Firewall (formerly SnapGear) firmware 3.0.0 through 4.0.6 allows remote attackers to inject arbitrary web script or HTML via the page parameter.
CVSS v2.0 score: 4.3
PYSEC-2024-230 
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.05.30 and prior to 2024.07.4 recognized root certificates from `GLOBALTRUST`. Certifi 2024.07.04 removes root certificates from `GLOBALTRUST` from the root store. These are in the process of being removed from Mozilla's trust store. `GLOBALTRUST`'s root certificates are being removed pursuant to an investigation which identified "long-running and unresolved compliance issues."
CVSS v3.1 score: 7.5
CVE-2023-4606 
An authenticated XCC user with Read-Only permission can change a different user’s password through a crafted API command.  

This affects ThinkSystem v2 and v3 servers with XCC; ThinkSystem v1 servers are not affected.
CVSS v3.1 score: 8.1
CVE-2016-1324 
The REST interface in Cisco Spark 2015-06 allows remote attackers to cause a denial of service (resource outage) by accessing an administrative page, aka Bug ID CSCuv84125.
CVSS v3.0 score: 5.3
CVSS v2.0 score: 5
CVE-2021-33751 Windows Storage Spaces Controller Elevation of Privilege Vulnerability
Windows Storage Spaces Controller Elevation of Privilege Vulnerability
CVSS v3.1 score: 7
CVE-2018-1000173 
A session fixaction vulnerability exists in Jenkins Google Login Plugin 1.3 and older in GoogleOAuth2SecurityRealm.java that allows unauthorized attackers to impersonate another user if they can control the pre-authentication session.
CVSS v3.0 score: 5.9
CVSS v2.0 score: 4.3
CVE-2017-13716 
The C++ symbol demangler routine in cplus-dem.c in libiberty, as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted file, as demonstrated by a call from the Binary File Descriptor (BFD) library (aka libbfd).
CVSS v3.0 score: 5.5
CVSS v2.0 score: 7.1
CVE-2007-6062 
irc-channel.c in ngIRCd before 0.10.3 allows remote attackers to cause a denial of service (crash) via a JOIN command without a channel argument.
CVSS v2.0 score: 5
CVE-2022-39167 IBM Spectrum Virtualize information disclosure

IBM Spectrum Virtualize 8.5, 8.4, 8.3, 8.2, and 7.8, under certain configurations, could disclose sensitive information to an attacker using man-in-the-middle techniques. IBM X-Force ID: 235408.


CVSS v3.1 score: 5.9
CVE-2019-20684 
Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects D3600 before 1.0.0.75, D6000 before 1.0.0.75, D6200 before 1.1.00.32, D7000 before 1.0.1.68, JR6150 before 1.0.1.18, PR2000 before 1.0.0.28, R6020 before 1.0.0.38, R6050 before 1.0.1.18, R6080 before 1.0.0.38, R6120 before 1.0.0.46, R6220 before 1.1.0.80, R6260 before 1.1.0.40, R6700v2 before 1.2.0.36, R6800 before 1.2.0.36, R6900v2 before 1.2.0.36, WNR2020 before 1.1.0.62, and XR500 before 2.3.2.32.
CVSS v3.0 score: 8.8
GHSA-g67h-7m25-7mmv 
An issue in dlink DIR 832x 240802 allows a remote attacker to execute arbitrary code via the function 0x41dda8
CVSS v3.1 score: 7.2
GHSA-8x34-9q3v-h7g8 Apache Airflow: Execution API HITL Endpoints Missing Per-Task Authorization
Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API's Human-in-the-Loop (HITL) endpoints that allows any authenticated task instance to read, approve, or reject HITL workflows belonging to any other task instance.Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.
CVSS v3.1 score: 8.1
GHSA-fgxq-rr9x-qcr5 
Cross-site scripting (XSS) vulnerability in Adobe ColdFusion MX 6.1 through 7.02 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving a ColdFusion error page.
CVE-2019-16182 
A reflected cross-site scripting (XSS) vulnerability was found in Limesurvey before 3.17.14 that allows remote attackers to inject arbitrary web script or HTML via extensions of uploaded files.
CVSS v3.1 score: 6.1
CVSS v2.0 score: 4.3
GHSA-pqpp-2363-649v Cross-Site Scripting in buttle
All versions of `buttle` are vulnerable to Cross-Site Scripting. Due to misconfiguration of its rendering engine, `buttle` does not sanitize the HTML output allowing attackers to run arbitrary JavaScript when processing malicious markdown files.RecommendationNo fix is currently available. Consider using an alternative module until a fix is made available.
GHSA-jhxj-w2j8-p3gf 
Improper Privilege Management vulnerability in Utarit Information Technologies SoliPay Mobile App allows Collect Data as Provided by Users.This issue affects SoliPay Mobile App: before 5.0.8.
CVSS v3.1 score: 7.5
CVE-2025-55503 
Tenda AC6 V15.03.06.23_multi has a stack overflow vulnerability via the deviceName parameter in the saveParentControlInfo function.
CVSS v3.1 score: 7.3
CVE-2020-11761 
An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read during Huffman uncompression, as demonstrated by FastHufDecoder::refill in ImfFastHuf.cpp.
CVSS v3.1 score: 5.5
CVSS v2.0 score: 4.3
CVE-2003-1257 
find_theni_home.php in E-theni allows remote attackers to obtain sensitive system information via a URL request which executes phpinfo.
CVSS v2.0 score: 5
GHSA-v7cp-3qx6-ff4r 
The Blocksy Companion WordPress plugin before 1.8.82 does not ensure that posts to be accessed via a shortcode are already public and can be viewed, allowing any authenticated users, such as subscriber to access draft posts for example
CVSS v3.1 score: 4.3
GHSA-7cf4-6qj9-hw7m 
WellinTech KingSCADA before 3.1.2, KingAlarm&Event before 3.1, and KingGraphic before 3.1.2 perform authentication on the KAEClientManager console rather than on the server, which allows remote attackers to bypass intended access restrictions and discover credentials via a crafted packet to TCP port 8130.
GHSA-jww9-vwpc-6qmf 
Kernel Streaming Service Driver Elevation of Privilege Vulnerability
CVSS v3.1 score: 7.8
GHSA-w57r-3v9h-hq4v 
lunasvg v3.0.0 was discovered to contain a segmentation violation via the component gray_record_cell.
CVSS v3.1 score: 6.5
CVE-2025-27070 Out-of-bounds Write in Windows Compute
Memory corruption while performing encryption and decryption commands.
CVSS v3.1 score: 7.8
GHSA-98r3-hhp2-gpgm 
A information disclosure vulnerability exists when WebAudio Library improperly handles audio requests, aka "Microsoft Edge Information Disclosure Vulnerability." This affects Microsoft Edge.
CVSS v3.0 score: 3.1
GHSA-vh7m-4w88-p24f 
SQL Injection vulnerability in ClickHouse Server Versions <= 26.3.9.8 allows a remote attacker to execute arbitrary code via the create dictionaries function.
CVSS v3.1 score: 9.1
CVE-2010-4818 
The GLX extension in X.Org xserver 1.7.7 allows remote authenticated users to cause a denial of service (server crash) and possibly execute arbitrary code via (1) a crafted request that triggers a client swap in glx/glxcmdsswap.c; or (2) a crafted length or (3) a negative value in the screen field in a request to glx/glxcmds.c.
CVSS v2.0 score: 8.5
GHSA-pppq-wphf-gg65 
Improper access control in Intel(R) RAID Web Console software all versions may allow an authenticated user to potentially enable denial of service via adjacent access.
CVSS v3.1 score: 3.5
GHSA-rc62-fgvr-76jr 
Missing Authorization vulnerability in Data443 Tracking Code Manager.This issue affects Tracking Code Manager: from n/a through 2.1.0.
CVSS v3.1 score: 4.3
CVE-2024-54129 Improper Initialization of `imc` Scheme Leading to `SIGABRT` in ION-DTN BPv7
The NASA’s Interplanetary Overlay Network (ION) is an implementation of Delay/Disruption Tolerant Networking (DTN). A vulnerability exists in the version ION-DTN BPv7 implementation version 4.1.3 when receiving a bundle with an improper reference to the imc scheme with valid Service-Specific Part (SSP) in their Previous Node Block. The vulnerability can cause ION to become unresponsive. This vulnerability is fixed in 4.1.3s.
CVSS v4.0 score: 9.2
GHSA-wx8m-v849-9cjp 
A vulnerability classified as critical was found in 1000 Projects Portfolio Management System MCA 1.0. This vulnerability affects unknown code of the file /update_personal_details.php. The manipulation of the argument q leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 7.3
GHSA-mc2h-qwcm-2rr8 
An exploitable information disclosure vulnerability exists in the apid daemon of the Circle with Disney running firmware 2.0.1. A specially crafted set of packets can make the Disney Circle dump strings from an internal database into an HTTP response. An attacker needs network connectivity to the Internet to trigger this vulnerability.
CVSS v3.0 score: 5.3
GHSA-2w49-cc6p-pggp 
Insufficient policy enforcement in installer in Google Chrome on OS X prior to 85.0.4183.102 allowed a local attacker to potentially achieve privilege escalation via a crafted binary.
CVSS v3.1 score: 7.8
GHSA-qjr8-p3mq-88g5 
DIRAPIX.dll in Adobe Shockwave Player before 11.5.8.612 does not properly validate a certain chunk size in the mmap chunk in a Director movie, which allows remote attackers to cause a denial of service (heap memory corruption) or execute arbitrary code via a crafted movie.
CVE-2001-1245 
Opera 5.0 for Linux does not properly handle malformed HTTP headers, which allows remote attackers to cause a denial of service, possibly with a header whose value is the same as a MIME header name.
CVSS v2.0 score: 5
GHSA-4p3x-8qw9-24w9 Authenticated Stored XSS in shopware/shopware
ImpactAuthenticated Stored XSS in AdministrationPatchesUse the Security Plugin:
https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.htmlWorkaroundsIf you cannot use the security plugin, add the following config to your `.htaccess` fileIf you are using nginx as server config, you can add the following to your configuration:Referenceshttps://docs.shopware.com/en/shopware-5-en/sicherheitsupdates/security-update-10-2021
CVSS v3.1 score: 5.7
CVE-1999-0415 
The HTTP server in Cisco 7xx series routers 3.2 through 4.2 is enabled by default, which allows remote attackers to change the router's configuration.
CVSS v2.0 score: 7.5
RHSA-2012:1165 Red Hat Security Advisory: JBoss Enterprise BRMS Platform 5.3.0 update
CSRF on jmx-console allows invocation of operations on mbeans
CVE-2022-39071 
There is an unauthorized access vulnerability in some ZTE mobile phones. If a malicious application is installed on the phone, it could overwrite some system configuration files and user installers without user permission.
CVSS v3.1 score: 7.1
CVE-2025-28956 WordPress Backwp plugin <= 2.0.2 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wphobby Backwp backwp allows Reflected XSS.This issue affects Backwp: from n/a through <= 2.0.2.
CVSS v3.1 score: 7.1
CVE-2006-6726 
PHP remote file inclusion vulnerability in inertianews_main.php in inertianews 0.02 beta allows remote attackers to execute arbitrary PHP code via a URL in the inews_path parameter.
CVSS v2.0 score: 7.5
GHSA-4wx6-wj3q-mf77 
A vulnerability was found in Dataease SQLBot up to 1.5.1. This impacts the function validateEmbedded of the file backend/apps/system/middleware/auth.py of the component JWT Token Handler. Performing a manipulation results in improper verification of cryptographic signature. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is said to be difficult. The exploit has been made public and could be used. A comment in the source code warns users about using this feature. The vendor was contacted early about this disclosure.
CVSS v4.0 score: 2.9
CVSS v3.1 score: 3.7
GHSA-98mg-wxrj-pfcv 
A denial of service vulnerability exists in some Xiaomi models of phones. The vulnerability is caused by out-of-bound read/write and can be exploited by attackers to make denial of service.
CVSS v3.1 score: 7.5
GHSA-9889-58r3-p8h2 
In the Linux kernel, the following vulnerability has been resolved:iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifoPrevent st_lsm6dsx_read_tagged_fifo from falling in an infinite loop in
case pattern_len is equal to zero and the device FIFO is not empty.
CVSS v3.1 score: 5.5
GHSA-whrm-ph9h-pj53 
Nagios XI before 5.5.4 has XSS in the auto login admin management page.
CVSS v3.0 score: 4.8
CVE-2023-36551 
A exposure of sensitive information to an unauthorized actor in Fortinet FortiSIEM version 6.7.0 through 6.7.5 allows attacker to information disclosure via a crafted http request.
CVSS v3.1 score: 4.2
CVE-2026-14097 
Inappropriate implementation in WebAppInstalls in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)
CVSS v3.1 score: 9.6
CVE-2025-47789 Horilla Open Redirect Vulnerability in Login
Horilla is a free and open source Human Resource Management System (HRMS). In versions up to and including 1.3, an attacker can craft a Horilla URL that refers to an external domain. Upon clicking and logging in, the user is redirected to an external domain. This allows the redirection to any arbitrary site, including phishing or malicious domains, which can be used to impersonate Horilla and trick users. Commit 1c72404df6888bb23af73c767fdaee5e6679ebd6 fixes the issue.
CVSS v3.1 score: 6.1
CVE-2026-47100 Funnel Builder for WooCommerce Checkout < 3.15.0.3 Missing Authorization via AJAX
Funnel Builder for WooCommerce Checkout prior to 3.15.0.3 contains a missing authorization vulnerability in the public checkout endpoint that allows unauthenticated attackers to invoke internal methods and write arbitrary data to the plugin's External Scripts global setting. Attackers can inject malicious JavaScript through the External Scripts setting that executes in the browsers of all checkout page visitors.
CVSS v4.0 score: 8.7
CVSS v3.1 score: 7.5
GHSA-ghwp-cqff-7h93 
Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formUpgradeMeshOnline.
CVSS v3.1 score: 9.8
CVE-1999-0785 
The INN inndstart program allows local users to gain root privileges via the "pathrun" parameter in the inn.conf file.
CVSS v2.0 score: 7.2
RHSA-2017:2841 Red Hat Security Advisory: dnsmasq security update
dnsmasq: heap overflow in the code responsible for building DNS replies
CVSS v3.0 score: 9.8
GHSA-rf4p-xq4w-3f34 
The XEN_DOMCTL_memory_mapping hypercall in Xen 3.2.x through 4.5.x, when using a PCI passthrough device, is not preemptible, which allows local x86 HVM domain users to cause a denial of service (host CPU consumption) via a crafted request to the device model (qemu-dm).
CVE-2026-15541 will-moss Isaiah Master Websocket server.go Server.Handle authorization
A flaw has been found in will-moss Isaiah up to 1.36.9. The impacted element is the function Server.Handle of the file app/server/server/server.go of the component Master Websocket Handler. Executing a manipulation of the argument Agent can lead to missing authorization. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 7.3
CVSS v3.0 score: 7.3
CVSS v2.0 score: 7.5
GHSA-3mxv-473p-h624 
Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavfilter/avf_showwaves.c:722:24 in showwaves_filter_frame
CVSS v3.1 score: 6.7
GHSA-w7jg-8v8v-4jpc 
The UPnP IGD implementation in Edimax EdiLinux on the Edimax BR-6104K with firmware before 3.25, Edimax 6114Wg, Canyon-Tech CN-WF512 with firmware 1.83, Canyon-Tech CN-WF514 with firmware 2.08, Sitecom WL-153 with firmware before 1.39, and Sweex LB000021 with firmware 3.15 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an "external forwarding" vulnerability.
CVE-2026-27189 OpenSift: Race-prone local persistence could cause state corruption/loss
OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Versions 1.1.2-alpha and below, use non-atomic and insufficiently synchronized local JSON persistence flows, potentially causing concurrent operations to lose updates or corrupt local state across sessions/study/quiz/flashcard/wellness/auth stores. This issue has been fixed in version 1.1.3-alpha.
CVSS v3.1 score: 6.6
GHSA-h7wg-2r8j-6v5c 
Adobe Experience Manager versions 6.5.18 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS v3.1 score: 5.4
CVE-2023-41146 
Autodesk Customer Support Portal allows cases created by users under an account to see cases created by other users on the same account.

CVSS v3.1 score: 4.3
GHSA-vpmf-qv5h-69q8 
Tanium addressed an improper access controls vulnerability in Patch.
CVSS v3.1 score: 4.3
RHSA-2024:5693 Red Hat Security Advisory: tomcat security update
tomcat: Improper Handling of Exceptional Conditions tomcat: Denial of Service in Tomcat
CVSS v3.1 score: 7.5
CVE-2025-21427 Buffer Over-read in Data HLOS - LNX
Information disclosure while decoding this RTP packet Payload when UE receives the RTP packet from the network.
CVSS v3.1 score: 8.2
CVE-2026-32992 
SSL verification is disabled in the DNS Cluster system. This could allow for a malicious server to man-in-the-middle the request and capture credentials.
CVSS v3.1 score: 8.2
CVE-2020-26641 
A Cross Site Request Forgery (CSRF) vulnerability was discovered in iCMS 7.0.16 which can allow an attacker to execute arbitrary web scripts.
CVSS v3.1 score: 8.8
CVSS v2.0 score: 6.8
CVE-2023-27283 IBM Aspera Orchestrator information disclosure
IBM Aspera Orchestrator 4.0.1 could allow a remote attacker to enumerate usernames due to observable response discrepancies.  IBM X-Force ID:  248545.
CVSS v3.1 score: 5.3
GHSA-3pvf-vxrv-hh9c Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR)
SummaryA low-privileged authenticated user can read private asset content by calling `assets/edit-image` with an arbitrary `assetId` that they are not authorized to view.The endpoint returns image bytes (or a preview redirect) without enforcing a per-asset view authorization check, leading to potential unauthorized disclosure of private files.DetailsRoot cause:A user-controlled object reference (`assetId`) is used to load and return sensitive content.The action does not verify whether the current user is authorized to view that asset.This creates an authenticated IDOR / authorization bypass.ImpactCraft installations where private/non-public assets exist and low-privileged users can authenticate.Resourceshttps://github.com/craftcms/cms/commit/7290d91639e
CVSS v4.0 score: 4.9
CVE-2022-36365 WordPress WHA Crossword plugin <= 1.1.10 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities
Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in WHA Crossword plugin <= 1.1.10 at WordPress.
CVSS v3.1 score: 5.4
GHSA-mr6p-pxvc-7864 
The Praison AI SEO WordPress plugin before 5.0.7 does not perform authorization checks on several of its REST API routes, allowing unauthenticated users to modify the permalink of any published post and to read Praison AI SEO WordPress plugin before 5.0.7 configuration data.
CVSS v3.1 score: 7.5
GHSA-hm75-34jg-v37m 
In Progress Ipswitch WhatsUp Gold 21.1.0 through 21.1.1, and 22.0.0, it is possible for an authenticated user to invoke an API transaction that would allow them to read the contents of a local file.
CVSS v3.1 score: 6.5
CVE-2026-39305 Arbitrary File Write / Path Traversal in Action Orchestrator
PraisonAI is a multi-agent teams system. Prior to 1.5.113, the Action Orchestrator feature contains a Path Traversal vulnerability that allows an attacker (or compromised agent) to write to arbitrary files outside of the configured workspace directory. By supplying relative path segments (../) in the target path, malicious actions can overwrite sensitive system files or drop executable payloads on the host. This vulnerability is fixed in 1.5.113.
CVSS v3.1 score: 9
GHSA-wj36-3pgh-3jfq 
Memory Corruption when updating prepared commands with invalid port indices based on user space input exceeds supported read client limits.
CVSS v3.1 score: 5.3
GHSA-gw4x-f295-2jpv 
The Bulk Posts Editing For WordPress plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on the plugin's AJAX actions in all versions up to, and including, 4.2.3. This makes it possible for authenticated attackers, with subscriber access and higher, to invoke their corresponding functions. This may lead to post creation and duplication, post content retrieval, post taxonomy manipulation.
CVSS v3.1 score: 4.3
GHSA-v886-3pxh-g3xp 
The WPBot  WordPress plugin before 8.5.2 does not validate administrator-configured field identifiers before using them in a SQL query, allowing users with administrator access to perform SQL injection that executes when a visitor triggers a search.
CVSS v3.1 score: 3.8
CVE-2022-27624 
A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the packet decryption functionality of Out-of-Band (OOB) Management. This allows remote attackers to execute arbitrary commands via unspecified vectors. The following models with Synology DiskStation Manager (DSM) versions before 7.1.1-42962-2 may be affected: DS3622xs+, FS3410, and HD6500.
CVSS v3.1 score: 10
CVE-2024-47846 Special:DeleteCargoTable and Special:SwitchCargoTable have no CSRF protection
Cross-Site Request Forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross Site Request Forgery.This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1.
CVSS v4.0 score: 6.9
CVE-2009-5063 
Memory leak in the embedded_profile_len function in pngwutil.c in libpng before 1.2.39beta5 allows context-dependent attackers to cause a denial of service (memory leak or segmentation fault) via a JPEG image containing an iCCP chunk with a negative embedded profile length.  NOTE: this is due to an incomplete fix for CVE-2006-7244.
CVSS v2.0 score: 5
GHSA-fgv7-7rh4-3353 
Vinchin Backup & Recovery v7.2 was discovered to use default MYSQL credentials.
CVSS v3.1 score: 9.8
CVE-2025-14287 Command Injection in mlflow/mlflow
A command injection vulnerability exists in mlflow/mlflow versions before v3.7.0, specifically in the `mlflow/sagemaker/__init__.py` file at lines 161-167. The vulnerability arises from the direct interpolation of user-supplied container image names into shell commands without proper sanitization, which are then executed using `os.system()`. This allows attackers to execute arbitrary commands by supplying malicious input through the `--container` parameter of the CLI. The issue affects environments where MLflow is used, including development setups, CI/CD pipelines, and cloud deployments.
CVSS v3.0 score: 7.5
CVE-2022-37892 
A vulnerability in the Aruba InstantOS and ArubaOS 10 web management interface could allow an unauthenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim’s browser in the context of the affected interface of Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and below; Aruba InstantOS 6.5.x: 6.5.4.23 and below; Aruba InstantOS 8.6.x: 8.6.0.18 and below; Aruba InstantOS 8.7.x: 8.7.1.9 and below; Aruba InstantOS 8.10.x: 8.10.0.1 and below; ArubaOS 10.3.x: 10.3.1.0 and below; Aruba has released upgrades for Aruba InnstantOS that address this security vulnerability.
CVSS v3.1 score: 5.4
GHSA-36r4-gjh8-q5ww 
Cross-site scripting (XSS) vulnerability in WebAccess in Novell GroupWise before 8.0.3 HP3, and 2012 before SP2, allows remote attackers to inject arbitrary web script or HTML via vectors involving an onError attribute.
CVE-2025-43010 Code injection vulnerability in SAP S/4HANA Cloud Private Edition or On Premise(SCM Master Data Layer (MDL))
SAP S/4HANA Cloud Private Edition or on Premise (SCM Master Data Layer (MDL)) allows an authenticated attacker with SAP standard authorization to execute a certain function module remotely and replace arbitrary ABAP programs, including SAP standard programs. This is due to lack of input validation and no authorization checks. This has low Confidentiality impact but high impact on integrity and availability to the application.
CVSS v3.1 score: 8.3
CVE-2025-54655 
Race condition vulnerability in the virtualization base module. Successful exploitation of this vulnerability may affect the confidentiality and integrity of the virtualization graphics module.
CVSS v3.1 score: 8.1
CVE-2020-11611 
An issue was discovered in xdLocalStorage through 2.0.5. The buildMessage() function in xdLocalStorage.js specifies the wildcard (*) as the targetOrigin when calling the postMessage() function on the iframe object. Therefore any domain that is currently loaded within the iframe can receive the messages that the client sends.
CVSS v3.1 score: 6.1
CVSS v2.0 score: 5.8
CVE-2026-30118 
scalar/astro v0.1.13 was discovered to contain a Server-Side Request Forgery (SSRF) in the scalar_url query parameter of the Scalar Proxy endpoint. This vulnerability allows unauthenticated attackers to force the backend server to send HTTP requests to attacker-controlled URLs, leading to authentication cookies and headers exposure and possible privilege escalation.
CVSS v3.1 score: 9.8
GHSA-7w84-8m96-m73j 
SQL injection vulnerability in submit.php in PHP-Fusion 6.01.14 and 6.00.307, when magic_quotes_gpc is disabled and the database table prefix is known, allows remote authenticated users to execute arbitrary SQL commands via the submit_info[] parameter in a link submission action.  NOTE: it was later reported that 7.00.2 is also affected.
CVE-2018-20339 
Zoho ManageEngine OpManager 12.3 before build 123239 allows XSS in the Notes column of the Alarms section.
CVSS v3.0 score: 6.1
CVSS v2.0 score: 4.3
RHSA-2026:54634 Red Hat Security Advisory: webkit2gtk3 security update
Mozilla: Arbitrary JavaScript execution in PDF.js webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash webkitgtk: webkitgtk: A malicious website may process restricted web content outside the sandbox webkitgtk: webkitgtk: Maliciously crafted web content may lead to memory corruption webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash webkitgtk: webkitgtk: Visiting a website may leak sensitive data webkitgtk: webkitgtk: Maliciously crafted web content may lead to memory corruption webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash webkitgtk: webkitgtk: A malicious website may silently hijack clipboard data webkitgtk: webkitgtk: A malicious website may process restricted web content outside the sandbox webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash webkitgtk: webkitgtk: Maliciously crafted web content may lead to memory corruption webkitgtk: webkitgtk: Maliciously crafted web content may disclose sensitive user information webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash webkitgtk: webkitgtk: Maliciously crafted web content may disclose process memory webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash
CVSS v3.1 score: 6.5
CVE-2023-30542 GovernorCompatibilityBravo may trim proposal calldata
OpenZeppelin Contracts is a library for secure smart contract development. The proposal creation entrypoint (`propose`) in `GovernorCompatibilityBravo` allows the creation of proposals with a `signatures` array shorter than the `calldatas` array. This causes the additional elements of the latter to be ignored, and if the proposal succeeds the corresponding actions would eventually execute without any calldata. The `ProposalCreated` event correctly represents what will eventually execute, but the proposal parameters as queried through `getActions` appear to respect the original intended calldata. This issue has been patched in 4.8.3. As a workaround, ensure that all proposals that pass through governance have equal length `signatures` and `calldatas` parameters.
CVSS v3.1 score: 6.8
GHSA-q42x-mphp-89mv 
Cross site scripting vulnerability in eDirectory prior to 9.1 SP2
CVSS v3.0 score: 6.1
GHSA-857c-g6r6-mj7p 
An issue was discovered in the demo/LINUXTCP implementation of cwalter-at freemodbus v.2018-09-12 allowing attackers to reach an infinite loop via a crafted length value for a packet.
CVSS v3.1 score: 7.5
CVE-2026-70489 Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, automation recurrence parsing in backend/open_webui/utils/automations.py anchored minutely and hourly rules at a fixed date of 2000-01-01 and then walked forward one interval at a time to find the next run. A single FREQ=MINUTELY rule enumerates roughly a quarter-century of occurrences synchronously on the event loop that also serves scheduler, HTTP, and WebSocket traffic, and the scheduler recomputes the next run for every claimed row on each poll. This causes availability impact for every other user of the instance. This issue is fixed in 0.11.0.
CVSS v3.1 score: 6.5
GHSA-4cpp-fg52-rfff 
Use-after-free vulnerability in the HTML5 Audio implementation in Google Chrome before 27.0.1453.110 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVE-2026-9538 Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header
Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header.

_read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value.

A crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size.
CVSS v3.1 score: 7.5
CVE-2023-25663 TensorFlow has Null Pointer Error in TensorArrayConcatV2
TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, when `ctx->step_containter()` is a null ptr, the Lookup function will be executed with a null pointer. A fix is included in TensorFlow 2.12.0 and 2.11.1.
CVSS v3.1 score: 7.5
GHSA-w9xh-7f24-r92w 
Adobe Animate version 21.0.9 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious BMP file.
GHSA-8m37-836g-p9g7 
SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain a reflected cross-site scripting vulnerability in the management interface where user input is not properly encoded before output. Attackers can craft malicious URLs that execute arbitrary JavaScript in the web interface when visited by authenticated users.
CVSS v4.0 score: 5.1
CVSS v3.1 score: 6.1
GHSA-fxv2-2jj5-v5wc 
Cisco VPN 3000 series concentrators and Cisco VPN 3002 Hardware Client 2.x.x through 3.6.7 allows remote attackers to cause a denial of service (reload) via a malformed SSH initialization packet.
GHSA-hq9p-pm7w-8p54 pgjdbc Client Allows Fallback to Insecure Authentication Despite channelBinding=require Configuration
ImpactWhen the PostgreSQL JDBC driver is configured with channel binding set to `required` (default value is `prefer`), the driver would incorrectly allow connections to proceed with authentication methods that do not support channel binding (such as password, MD5, GSS, or SSPI  authentication). This could allow a man-in-the-middle attacker to intercept connections that users believed were protected by channel binding requirements.PatchesTBDWorkaroundsConfigure `sslMode=verify-full` to prevent MITM attacks.Referenceshttps://www.postgresql.org/docs/current/sasl-authentication.html#SASL-SCRAM-SHA-256https://datatracker.ietf.org/doc/html/rfc7677https://datatracker.ietf.org/doc/html/rfc5802
CVSS v3.1 score: 8.2
GHSA-jqrp-5gxv-5jhg 
A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition (SME) could allow an authenticated, remote attacker to impact the confidentiality of an affected system by executing arbitrary SQL queries. The vulnerability exists because the affected software improperly validates user-supplied input in SQL queries. An attacker could exploit this vulnerability by sending crafted requests that contain malicious SQL statements to the affected application. A successful exploit could allow the attacker to determine the presence of certain values in the database, impacting the confidentiality of the system.
CVSS v3.1 score: 4.9
GHSA-rhc4-ghfc-mwxg 
The "Oculina Mobile Banking" by Oculina Bank app 3.0.0 -- aka oculina-mobile-banking/id867025690 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v3.0 score: 5.9
GHSA-qxfx-cg86-j76f 
Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /manage/vpnauthentication/user/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.
CVSS v4.0 score: 5.1
CVSS v3.1 score: 6.4
CVE-2007-4423 
Stack-based buffer overflow in the AUTH_LIST_GROUPS_FOR_AUTHID function in IBM DB2 UDB 9.1 before Fixpak 3 allows attackers to cause a denial of service and possibly execute arbitrary code via a long argument.
CVSS v2.0 score: 5
GHSA-8v46-q2gc-hg88 
Coppermine Photo Gallery 1.3.2 stores passwords in plaintext, which allows remote attackers to obtain sensitive information.
CVE-2023-4004 Kernel: netfilter: use-after-free due to improper element removal in nft_pipapo_remove()
A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local user to crash the system or potentially escalate their privileges on the system.
CVSS v3.1 score: 7.8
CVE-2021-21687 
Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create symbolic links when unarchiving a symbolic link in FilePath#untar.
CVSS v3.1 score: 9.1
CVSS v2.0 score: 6.4
CVE-2010-0752 
The week_post_page function in the Weekly Archive by Node Type module 6.x before 6.x-2.7 for Drupal does not properly implement node access restrictions when constructing SQL queries, which allows remote attackers to read restricted node listings via unspecified vectors.
CVSS v2.0 score: 5
CVE-2017-4945 
VMware Workstation (14.x and 12.x) and Fusion (10.x and 8.x) contain a guest access control vulnerability. This issue may allow program execution via Unity on locked Windows VMs. VMware Tools must be updated to 10.2.0 for each VM to resolve CVE-2017-4945. VMware Tools 10.2.0 is consumed by Workstation 14.1.0 and Fusion 10.1.0 by default.
CVSS v3.0 score: 5.5
CVSS v2.0 score: 2.1
CVE-2022-2345 Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 9.0.0046.
CVSS v3.0 score: 7.8
CVE-2018-7284 
A Buffer Overflow issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Certified Asterisk through 13.18-cert2. When processing a SUBSCRIBE request, the res_pjsip_pubsub module stores the accepted formats present in the Accept headers of the request. This code did not limit the number of headers it processed, despite having a fixed limit of 32. If more than 32 Accept headers were present, the code would write outside of its memory and cause a crash.
CVSS v3.0 score: 7.5
CVSS v2.0 score: 5
GHSA-p577-3r2w-6mfh 
The ff_log2_16bit_c function in libavutil/intmath.h in FFmpeg before 3.1.4 is vulnerable to reading out-of-bounds memory when it decodes a malformed AIFF file.
CVSS v3.0 score: 7.8
RHSA-2024:9624 Red Hat Security Advisory: squid:4 security update
squid: Denial of Service processing ESI response content
CVSS v3.1 score: 7.5
RHSA-2015:0377 Red Hat Security Advisory: libreoffice security, bug fix, and enhancement update
libreoffice: VBA macros executed unconditionally openoffice: Arbitrary file disclosure via crafted OLE objects libreoffice: Use-After-Free in socket manager of Impress Remote
GHSA-qh97-33pg-j9vx 
An elevation of privilege vulnerability exists when the Windows Work Folder Service improperly handles file operations, aka 'Windows Work Folder Service Elevation of Privilege Vulnerability'.
CVSS v3.1 score: 8