CIRCL/vulnerability-scores huggingface dataset:
RHSA-2025:14574 Red Hat Security Advisory: gdk-pixbuf2 security update
gdk‑pixbuf: Heap‑buffer‑overflow in gdk‑pixbuf
CVSS v3.1 score: 7.5
CVE-2009-0569 
Buffer overflow in Becky! Internet Mail 2.48.02 and earlier allows remote attackers to execute arbitrary code via a mail message with a crafted return receipt request.
CVSS v2.0 score: 9.3
GHSA-j9r2-r33c-j8pg 
TOTOLINK A3300R 17.0.0cu.557_B20221024 contains a command injection via the file_name parameter in the UploadFirmwareFile function.
CVSS v3.1 score: 9.8
GHSA-jqg5-fvgm-8j8r 
SAP Solution Manager (Trace Analysis), version 7.20, allows an attacker to perform a log injection into the trace file, due to Incomplete XML Validation. The readability of the trace file is impaired.
CVE-2026-14618 Open5GS AMF nnrf-handler.c amf_nnrf_handle_nf_discover denial of service
A vulnerability was detected in Open5GS up to 2.7.7. Affected by this vulnerability is the function amf_nnrf_handle_nf_discover of the file src/amf/nnrf-handler.c of the component AMF. The manipulation results in denial of service. The attack may be launched remotely. The exploit is now public and may be used. The patch is identified as fb5f67703de0213fb9c6e6ef3b48b6c1707e9503. It is best practice to apply a patch to resolve this issue.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 4.3
CVSS v3.0 score: 4.3
CVSS v2.0 score: 4
GHSA-5gx4-r4vg-49w6 
A network interface of the novi_process_manager_daemon service, included in the NoviWare software distribution through NW400.2.6 and deployed on NoviSwitch devices, can be inadvertently exposed if an operator attempts to modify ACLs, because of a bug when ACL modifications are applied. This could be leveraged by remote, unauthenticated attackers to gain resultant privileged (root) code execution on the switch, because incoming packet data can contain embedded OS commands, and can also trigger a stack-based buffer overflow.
CVSS v3.0 score: 9.8
CVE-2008-5373 
mtx-changer.Adic-Scalar-24 in bacula-common 2.4.2 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/mtx.##### temporary file, probably a related issue to CVE-2005-2995.
CVSS v2.0 score: 6.9
GHSA-3v94-cf5v-6c3j 
sessions.php in phpBB 2.0.12 and earlier allows remote attackers to gain administrator privileges via the autologinid value in a cookie.
CVE-2017-10817 
MaLion for Windows and Mac 5.0.0 to 5.2.1 allows remote attackers to bypass authentication to alter settings in Relay Service Server.
CVSS v3.1 score: 9.8
CVSS v2.0 score: 7.5
CVE-2019-12137 
Typora 0.9.9.24.6 on macOS allows directory traversal, for execution of arbitrary programs, via a file:/// or ../ substring in a shared note.
CVSS v3.0 score: 7.8
CVSS v2.0 score: 6.8
CVE-2026-54417 Integer Overflow in rxi/microtar mtar_next() Causes Infinite Loop DoS
An integer overflow in the mtar_next function in src/microtar.c in rxi microtar 0.1.0 allows a remote attacker to cause a denial of service (uncontrolled CPU consumption / infinite loop) via a crafted tar archive. mtar_next computes the offset to the next record as round_up(h.size, 512) + sizeof(mtar_raw_header_t) using 32-bit arithmetic.
CVSS v4.0 score: 8.7
CVSS v3.1 score: 7.5
CVE-2013-6437 
The libvirt driver in OpenStack Compute (Nova) before 2013.2.2 and icehouse before icehouse-2 allows remote authenticated users to cause a denial of service (disk consumption) by creating and deleting instances with unique os_type settings, which triggers the creation of a new ephemeral disk backing file.
CVSS v2.0 score: 4
CVE-2022-26749 
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.4. An application may be able to execute arbitrary code with kernel privileges.
CVSS v3.1 score: 7.8
CVSS v2.0 score: 9.3
GHSA-vwj8-ggfw-43w9 
A library injection vulnerability exists in Microsoft OneNote 16.83 for macOS. A specially crafted library can leverage OneNote's access privileges, leading to a permission bypass. A malicious application could inject a library and start the program to trigger this vulnerability and then make use of the vulnerable application's permissions.
CVSS v3.1 score: 7.1
CVE-2008-1221 
Absolute path traversal vulnerability in the FTP server in MicroWorld eScan Corporate Edition 9.0.742.98 and eScan Management Console (aka eScan Server) 9.0.742.1 allows remote attackers to read arbitrary files via an absolute pathname in the RETR (get) command.
CVSS v2.0 score: 5
CVE-2013-2263 
Unspecified vulnerability in Citrix Access Gateway Standard Edition 5.0.x before 5.0.4.223524 allows remote attackers to access network resources via unknown attack vectors.
CVSS v2.0 score: 5
GHSA-gp94-h5cv-4hh6 
The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font, a different vulnerability than CVE-2016-2800.
CVSS v3.0 score: 8.8
GHSA-c4q9-ff8m-j29w 
Access of resource using incompatible type ('type confusion') in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
CVSS v3.1 score: 7.8
CVE-2024-38117 NTFS Elevation of Privilege Vulnerability
NTFS Elevation of Privilege Vulnerability
CVSS v3.1 score: 7.8
RHSA-2026:10745 Red Hat Security Advisory: python3.12 security update
python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules
CVSS v3.1 score: 8.1
CVE-2007-1666 
The processor_request function in the debugger server for DataRescue IDA Pro 5.0 and 5.1 does not verify that authentication has taken place before invoking the perform_request function, which allows remote attackers to perform unauthorized actions.
CVSS v2.0 score: 10
GHSA-9x97-7gh3-f487 
The iBoot device’s basic discovery protocol assists in initial device configuration. The discovery protocol shows basic information about devices on the network and allows users to perform configuration changes.
CVSS v3.1 score: 8.1
CVE-2026-53913 Apache Camel Keycloak: KeycloakSecurityPolicy verifies the bearer access token only inside its role and permission checks, so in the default configuration the token is never verified and any non-null bearer value is accepted
Improper Authentication, Missing Authentication for Critical Function, Not Failing Securely ('Failing Open') vulnerability in Apache Camel Keycloak Component.

The KeycloakSecurityPolicy of camel-keycloak guards a route by running KeycloakSecurityProcessor.beforeProcess(), which performs three checks in sequence: it rejects a request that carries no access token, then - only if requiredRoles is non-empty - validates the roles, and - only if requiredPermissions is non-empty - validates the permissions. The actual cryptographic verification of the bearer access token (signature, issuer and expiry for a local JWT, or active-state and issuer for token introspection) is performed exclusively inside those role and permission checks. KeycloakSecurityPolicy defaults requiredRoles and requiredPermissions to empty - which is the documented 'Basic Setup' - so on a route configured that way the role and permission checks are skipped and the access token is therefore never verified. The token-presence check still rejects a missing token, but an invalid token is accepted: any non-null value in the Authorization: Bearer header - including an arbitrary string or a forged, unsigned JWT - passes the policy and the request reaches the protected route, with no signature, issuer or expiry check and no request to Keycloak. The token is read from the inbound request header because allowTokenFromHeader defaults to true. Because the normal reason to place a route behind this policy is that the route performs server-side work, the bypass results in unauthenticated access to that work; where the protected route forwards to a code-execution-capable producer, it can result in unauthenticated remote code execution. This defect is independent of CVE-2026-23552: that issue concerned the issuer claim and was fixed by adding a check inside the verification routine, but here the verification routine is not reached at all in the default configuration, so the defect remains.
This issue affects Apache Camel: from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0.

Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. For deployments that cannot upgrade immediately, configure a non-empty requiredRoles or requiredPermissions on every KeycloakSecurityPolicy so that the token-verification path is exercised, set allowTokenFromHeader to false where the token is not expected from the request header, or perform token verification at the framework layer ahead of the policy.
CVSS v3.1 score: 9.8
GHSA-r7h8-35pv-fwgx 
In Bouncy Castle for Java before 1.85, OpenPGP user-attribute subpacket length bounded only by JVM max memory. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).
CVSS v4.0 score: 8.7
GHSA-448c-jjx7-6xg4 
Thread start can cause invalid memory writes to arbitrary memory location since the argument is passed by user to kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in MDM9205, MDM9640, MSM8996AU, QCA6574, QCS605, Qualcomm 215, SD 425, SD 427, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, SDX24, Snapdragon_High_Med_2016, SXR1130
GHSA-43xf-6385-h592 
Unspecified vulnerability in the Export component in Oracle Database Server 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.4, 11.1.0.7, and 11.2.0.1 allows remote authenticated users to affect confidentiality via unknown vectors related to Select Any Dictionary.
GHSA-44ww-rw32-794r 
In the Linux kernel, the following vulnerability has been resolved:apparmor: Fix & Optimize table creation from possibly unaligned memorySource blob may come from userspace and might be unaligned.
Try to optize the copying process by avoiding unaligned memory accesses.Added Fixes tagAdded "Fix &" to description as this doesn't just optimize but fixes
      a potential unaligned memory access
[jj: remove duplicate word "convert" in comment trigger checkpatch warning]
CVSS v3.1 score: 7.1
GHSA-22m6-6xhc-4ffw 
HP App for Android is potentially vulnerable to cross-site scripting (XSS) when using an outdated version of the application via mobile devices. HP is releasing updates to mitigate these potential vulnerabilities.
CVSS v4.0 score: 5.1
GHSA-p4c6-79fv-gqjg 
In the Linux kernel, the following vulnerability has been resolved:dibs: fix use-after-free of dmb_node in loopback attach/detach/unregisterdibs_lo_attach_dmb(), dibs_lo_detach_dmb() and dibs_lo_unregister_dmb()
look up the dmb_node under dmb_ht_lock, drop the lock and only then
operate on the node's refcount. Nothing keeps the node alive across
that window: __dibs_lo_unregister_dmb() removes the node from the hash
table under the write lock and immediately frees it.A concurrent final put can therefore free the node between the lookup
and the refcount operation:CPU0 (attach)                     CPU1 (owner unregisters)read_lock_bh(&dmb_ht_lock)
find dmb_node (refcnt == 1)
read_unlock_bh(&dmb_ht_lock)
                                  refcount_dec_and_test() 1 -> 0
                                  write_lock_bh(&dmb_ht_lock)
                                  hash_del(&dmb_node->list)
                                  write_unlock_bh(&dmb_ht_lock)
                                  kfree(dmb_node)
refcount_inc_not_zero(&dmb_node->refcnt)  <-- use-after-freeThe same window exists for the refcount_dec_and_test() calls in the
detach and unregister paths.Close the race structurally by making hash table membership and the
refcount transitions atomic with respect to each other:Perform the final refcount_dec_and_test() and hash_del() in a single
dmb_ht_lock write-side critical section, in both the unregister and
the detach path. Freeing the node still happens after the lock is
dropped, which is safe because a node whose refcount reached zero has
left the hash table and can no longer be found.This establishes the invariant that any node found in the hash table
holds at least one reference, and that the final reference can only
be dropped under the write lock. dibs_lo_attach_dmb() can thus take
its reference with a plain refcount_inc() while still holding the
read lock; refcount_inc_not_zero() is no longer needed.__dibs_lo_unregister_dmb() no longer touches the hash table and is
renamed to dibs_lo_free_dmb() accordingly.Note: commit cc21191b584c ("dibs: Move data path to dibs layer") moved
the code to its current location; the race was introduced earlier by
commit c3a910f2380f ("net/smc: implement DMB-merged operations of
loopback-ism").Tested SMC-D via ISM and dibs loopback.
CVSS v3.1 score: 7.8
GHSA-7xrc-xm58-xj3r 
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
GHSA-hp88-gg5p-j7jj 
A component API of the HarmonyOS 2.0 has a permission bypass vulnerability. Local attackers may exploit this vulnerability to issue commands repeatedly, exhausting system service resources.
GHSA-3w4p-hjjh-fjwg 
FireGPG before 0.6 handle user?s passphrase and decrypted cleartext insecurely by writing pre-encrypted cleartext and the user's passphrase to disk which may result in the compromise of secure communication or a users?s private key.
CVE-2025-11587 Call Now Button <= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Settings Update
The Call Now Button – The #1 Click to Call Button for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the activate function in all versions up to, and including, 1.5.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to link the plugin to their nowbuttons.com account and add malicious buttons to the site. The vulnerability is only exploitable on fresh installs where the plugin has not been previously configured with an API key.
CVSS v3.1 score: 4.3
GHSA-v4mm-mqqh-4wf8 
Insufficient input validation in the SNP_GUEST_REQUEST command may lead to a potential data abort error and a denial of service.
GHSA-gqww-qgqj-92wg 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paytm Paytm Payment Donation allows Stored XSS.This issue affects Paytm Payment Donation: from n/a through 2.3.3.
CVSS v3.1 score: 5.9
CVE-2018-3721 
lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.
CVSS v3.1 score: 6.5
CVSS v2.0 score: 4
CVE-2021-40472 Microsoft Excel Information Disclosure Vulnerability
Microsoft Excel Information Disclosure Vulnerability
CVSS v3.1 score: 5.5
CVE-2010-2640 
Array index error in the PK font parser in the dvi-backend component in Evince 2.32 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font in conjunction with a DVI file that is processed by the thumbnailer.
CVSS v2.0 score: 7.6
GHSA-m98m-c6v8-v5rm 
Elsight – CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSS v3.1 score: 9.8
CVE-2022-3603 Export customers list CSV for WooCommerce < 2.0.69 - CSV Injection
The Export customers list csv for WooCommerce, WordPress users csv, export Guest customer list WordPress plugin before 2.0.69 does not validate data when outputting it back in a CSV file, which could lead to CSV injection.
CVSS v3.1 score: 9.8
CVE-2013-1917 
Xen 3.1 through 4.x, when running 64-bit hosts on Intel CPUs, does not clear the NT flag when using an IRET after a SYSENTER instruction, which allows PV guest users to cause a denial of service (hypervisor crash) by triggering a #GP fault, which is not properly handled by another IRET instruction.
CVSS v2.0 score: 1.9
CVE-2021-24090 Windows Error Reporting Elevation of Privilege Vulnerability
Windows Error Reporting Elevation of Privilege Vulnerability
CVSS v3.1 score: 7.8
GHSA-fcqf-hhgj-p27f 
Cross-site Scripting (XSS) - Generic in GitHub repository nuxt/framework prior to 3.2.1.
CVSS v3.1 score: 6.1
GHSA-963c-9gfg-gvcp 
Unspecified vulnerability in Oracle MySQL Server 5.6.22 and earlier allows remote authenticated users to affect availability via unknown vectors related to XA.
GHSA-wq4m-fcxw-965v 
A vulnerability has been identified in License Management Utility (LMU) (All versions < V2.4). The lmgrd service of the affected application is executed with local SYSTEM privileges on the server while its configuration can be modified by local users. The vulnerability could allow a local authenticated attacker to execute arbitrary commands on the server with local SYSTEM privileges.
CVSS v3.1 score: 7.8
PYSEC-2026-1242 
### Summary
Improper input validation in the application can allow attackers to perform local file read (LFR) or path traversal attacks. These vulnerabilities occur when user input is used to construct file paths without adequate sanitization or validation. For example, using `file:../../../etc/passwd` or `file: ///etc/passwd` can bypass weak validations and allow unauthorized access to sensitive files. Even though this has been addressed in previous patch, it is still insufficient.

### Details
The check in this line of code is insufficient.
```
if re.search(r'^file:/', url.strip(), re.IGNORECASE):
```
The attacker can still bypass this by using:
-`file:../../../../etc/passwd`
-`file: ///etc/passwd` (with space before /)

### PoC
- Open up a changedetection.io instance with a webdriver configured.
- Create a new watch with `file:../../../../etc/passwd`.
- Check the watch preview.
- The contents of `/etc/passwd` should pop out.

### Screenshots
![image](https://github.com/user-attachments/assets/55c34f2e-cafb-4a7a-a7ef-ec222e3f519b)
![image](https://github.com/user-attachments/assets/d41189f5-7bf2-48b5-9ce3-c26f79cefeda)
CVSS v3.1 score: 8.6
GHSA-p978-r5x5-www2 
Dreamer CMS 4.0.1 allows SQL injection via ArchivesMapper.xml.
CVE-2025-6120 Open Asset Import Library Assimp HL1MDLLoader.cpp read_meshes heap-based overflow
A vulnerability classified as critical was found in Open Asset Import Library Assimp up to 5.4.3. Affected by this vulnerability is the function read_meshes in the library assimp/code/AssetLib/MDL/HalfLife/HL1MDLLoader.cpp. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
CVSS v4.0 score: 4.8
CVSS v3.1 score: 5.3
CVSS v3.0 score: 5.3
CVSS v2.0 score: 4.3
GHSA-m48w-5q6f-f285 
Stored cross-site scripting vulnerability in Admin Page of GROWI (v4.2 Series) versions from v4.2.0 to v4.2.7 allows remote authenticated attackers to inject an arbitrary script via unspecified vectors.
CVE-2018-5284 
The ImageInject plugin 1.15 for WordPress has XSS via the flickr_appid parameter to wp-admin/options-general.php.
CVSS v3.0 score: 4.8
CVSS v2.0 score: 3.5
CVE-2024-6665 kbucket < 4.1.6 - Admin+ Stored XSS
The KBucket: Your Curated Content in WordPress plugin before 4.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS v3.1 score: 4.8
GHSA-qqvm-66q4-vf5c Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure)
SummaryFlowise introduced SSRF protections through a centralized HTTP security wrapper (`httpSecurity.ts`) that implements deny-list validation and IP pinning logic.However, multiple tool implementations directly import and invoke raw HTTP clients (`node-fetch`, `axios`Instead of using the secured wrapper.Because enforcement is neither mandatory nor centralized, these tools bypass SSRF mitigation entirely, restoring full SSRF capability even after the patch.This issue is distinct from specification trust issues and represents incomplete mitigation of previously addressed SSRF vulnerabilities.Details**Intended Security Model:**All outbound HTTP requests should pass through the centralized validation layer implemented in:This layer performs:`HTTP_DENY_LIST` enforcementIP resolution validationIP pinningLoopback blocking**Observed Implementation Gap:**Multiple tools bypass this layer and import HTTP libraries directly.Examples include:`packages/components/nodes/tools/OpenAPIToolkit/OpenAPIToolkit.ts``packages/components/nodes/tools/WebScraperTool/WebScraperTool.ts``packages/components/nodes/tools/MCP/core.ts``packages/components/nodes/tools/Arxiv/core.ts`These files directly execute:or invoke `axios` without passing through the centralized validation wrapper.Because there is no global interceptor or enforcement mechanism, outbound requests in these components are executed without SSRF validation.This renders the mitigation introduced in GHSA-2x8m-83vc-6wv4 incomplete.Root CauseSecurity enforcement is not centralized.Outbound request validation depends on voluntary usage of a wrapper function rather than being structurally enforced.Because direct imports of HTTP clients are allowed, the mitigation is easily bypassed.This is an architectural enforcement failure rather than a single implementation bug.PoCEven when an administrator configures:The following attack succeeds if a vulnerable tool is enabled:**Chat Prompt:**Execution flow:The LLM triggers `WebScraperTool`.The tool calls raw `fetch()` directly.No `httpSecurity.ts` validation is applied.The request reaches the metadata endpoint.The response is returned to the chat context.This demonstrates that SSRF protection is opt-in rather than enforced.Impact**Severity:** Critical (CVSS v3.1: 9.1 – AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)This issue:Completely bypasses the centralized SSRF mitigation.Allows access to internal network resources.Enables the exploitation of cloud metadata and credential theft.Invalidates the security assumptions of the recent patch.Any deployment enabling affected tools remains vulnerable.Recommended RemediationRefactor all tools to use the centralized `secureFetch()` wrapper.Add ESLint `no-restricted-imports` rules to prohibit the direct usage of `node-fetch` or `axios` in tool components.Consider implementing a single internal HTTP client abstraction layer.Apply network-level egress filtering as defense-in-depth.
CVSS v4.0 score: 5.3
GHSA-4xc5-wrx2-6vr3 
Cross-site scripting (XSS) vulnerability in FlipBuilder Flip PDF allows remote attackers to inject arbitrary web script or HTML via the currentHTMLURL parameter.
CVSS v3.0 score: 6.1
GHSA-qjjj-qpm9-gfxc 
Cross-site scripting (XSS) vulnerability in search.php in OkScripts OkArticles 1.0 allows remote attackers to inject arbitrary web script or HTML via the q parameter.
GHSA-j678-p965-44g9 
Buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors.
CVE-2020-0988 
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0889, CVE-2020-0953, CVE-2020-0959, CVE-2020-0960, CVE-2020-0992, CVE-2020-0994, CVE-2020-0995, CVE-2020-0999, CVE-2020-1008.
CVSS v3.1 score: 7.8
CVSS v2.0 score: 9.3
CVE-2014-4661 
Cross-site scripting (XSS) vulnerability in HP Records Manager before 7.3.5 and 8.x before 8.1 Patch 3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS v2.0 score: 4.3
RHSA-2017:2029 Red Hat Security Advisory: openssh security, bug fix, and enhancement update
openssh: User enumeration via covert timing channel openssh: Denial of service via very long passwords openssh: loading of untrusted PKCS#11 modules in ssh-agent openssh: Leak of host private key material to privilege-separated child process via realloc() openssh: Bounds check can be evaded in the shared memory manager used by pre-authentication compression support openssh: Out of sequence NEWKEYS message can allow remote attacker to cause denial of service
CVSS v3.0 score: 5.3
CVE-2025-57218 
Tenda AC10 v4.0 firmware v16.03.10.09_multi_TDE01 was discovered to contain a stack overflow via the security_5g parameter in the function sub_46284C.
CVSS v3.1 score: 5.3
GHSA-hwwx-9pq5-8p52 
Windows Scripting Host (WSH) in Windows 10 versions 1703 and 1709 and Windows Server, version 1709 allows a Device Guard security feature bypass vulnerability due to the way objects are handled in memory, aka "Windows Security Feature Bypass Vulnerability".
CVSS v3.0 score: 5.3
GHSA-9fxm-vc8v-hj55 jackson-databind's renamed @JsonIgnore'd setters can deserialize via private fields
Summary`POJOPropertiesCollector._renameProperties()` allows a property with `@JsonProperty("renamed")` on the getter and `@JsonIgnore` on the setter to be renamed rather than dropped. With `MapperFeature.INFER_PROPERTY_MUTATORS` enabled (default), the private backing field is retained; during deserialization `BeanDeserializerFactory.addBeanProps()` sees `hasField()==true`, builds a `FieldProperty`, and makes the backing field writable. An attacker supplying the renamed JSON key writes the backing field directly, bypassing the `@JsonIgnore` on the setter.ImpactPOJOs combining a renamed getter with an ignored setter (a read-only-over-the-wire pattern) have that field silently set from attacker input (property tampering / mass assignment). Not a general gadget; no RCE.Affected / Patched (verified via `git tag --contains`)2.21 line: `>= 2.21.0, < 2.21.4` -> fixed in **2.21.4** (backport `c3d56dd`, #5968)3.x line: `>= 3.0.0, < 3.1.4` -> fixed in **3.1.4** (#5967, `e88cb17`)Severity / CWEMaintainer: minor. Reporter: HIGH. CWE-915.CreditsOmkhar Arasaratnam (@omkhar) - finder.
CVSS v3.1 score: 5.3
RHSA-2003:016 Red Hat Security Advisory: fileutils security update
security flaw
GHSA-qwwx-fhv3-c8q4 
A security vulnerability has been detected in deco-cx apps up to 0.120.1. Affected by this vulnerability is the function AnalyticsScript of the file website/loaders/analyticsScript.ts of the component Parameter Handler. Such manipulation of the argument url leads to server-side request forgery. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.120.2 addresses this issue. It is suggested to upgrade the affected component.
CVSS v4.0 score: 2.1
CVSS v3.1 score: 6.3
CVE-2018-8122 
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory Corruption Vulnerability." This affects Internet Explorer 11. This CVE ID is unique from CVE-2018-0945, CVE-2018-0946, CVE-2018-0951, CVE-2018-0953, CVE-2018-0954, CVE-2018-0955, CVE-2018-1022, CVE-2018-8114, CVE-2018-8128, CVE-2018-8137, CVE-2018-8139.
CVSS v3.0 score: 7.5
CVSS v2.0 score: 7.6
CVE-2022-42272 
NVIDIA BMC contains a vulnerability in IPMI handler, where an authorized attacker can cause a buffer overflow, which may lead to code execution, denial of service or escalation of privileges.
CVSS v3.1 score: 8.1
CVE-2021-24221 Quiz And Survey Master < 7.1.12 - Authenticated SQL injection via shortcode
The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin before 7.1.12 did not sanitise the result_id GET parameter on pages with the [qsm_result] shortcode without id attribute, concatenating it in a SQL statement and leading to an SQL injection. The lowest role allowed to use this shortcode in post or pages being author, such user could gain unauthorised access to the DBMS. If the shortcode (without the id attribute) is embed on a public page or post, then unauthenticated users could exploit the injection.
CVSS v3.1 score: 8.8
CVSS v2.0 score: 6.5
GHSA-g4pg-gr8x-mfcf 
Privacyware Privatefirewall 3.0 does not block certain incoming packets when in "Filter Internet Traffic" or Deny Internet Traffic" modes, which allows remote attackers to identify running services via FIN scans or Xmas scans.
GHSA-6gph-3ccw-c7m6 
IBM QRadar Incident Forensics (IBM QRadar SIEM 7.2, and 7.3) could allow a remote attacker to bypass authentication and obtain sensitive information. IBM X-Force ID: 144164.
CVSS v3.0 score: 5.8
CVE-2015-4431 
Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3117, CVE-2015-3123, CVE-2015-3130, CVE-2015-3133, and CVE-2015-3134.
CVSS v2.0 score: 10
CVE-2017-0039 
Microsoft Windows Vista SP2 and Server 2008 SP2 mishandle dynamic link library (DLL) loading, which allows local users to gain privileges via a crafted application, aka "Library Loading Input Validation Remote Code Execution Vulnerability."
CVSS v3.0 score: 7.8
CVSS v2.0 score: 9.3
CVE-2022-1464 Stored xss bug  in gogs/gogs
Stored xss bug in GitHub repository gogs/gogs prior to 0.12.7. As the repo is public , any user can view the report and when open the attachment then xss is executed. This bug allow executed any javascript code in victim account .
CVSS v3.0 score: 7.3
CVE-2025-31987 HCL Connections Docs is vulnerable to a Denial of Service (DoS) attack
HCL Connections Docs may mishandle validation of certain uploaded documents leading to denial of service due to resource exhaustion.
CVSS v3.1 score: 4.8
GHSA-xr6r-96rx-v9v2 
Improper Validation of Consistency within input in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM) Wi-Fi in Windows 10 and 11 may allow a unauthenticated user to potentially enable denial of service via adjacent access.
CVSS v3.1 score: 6.5
CVE-2020-9139 
There is a improper input validation vulnerability in some Huawei Smartphone.Successful exploit of this vulnerability can cause memory access errors and denial of service.
CVSS v3.1 score: 9.1
CVSS v2.0 score: 6.4
GHSA-r4v2-qg7m-3xrh 
The web server in InterNiche NicheStack through 4.0.1 allows remote attackers to cause a denial of service (infinite loop and networking outage) via an unexpected valid HTTP request such as OPTIONS. This occurs because the HTTP request handler enters a miscoded wbs_loop() debugger hook.
GHSA-ffq4-j9j8-23g6 
The GL-iNet Comet (GL-RM1) KVM does not require authentication on the UART serial console. This attack requires physically opening the device and connecting to the UART pins.
CVSS v4.0 score: 7
CVSS v3.1 score: 6.8
CVE-2017-10258 
Vulnerability in the PeopleSoft Enterprise PRTL Interaction Hub component of Oracle PeopleSoft Products (subcomponent: Add New Image). The supported version that is affected is 9.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PRTL Interaction Hub. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PRTL Interaction Hub, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PRTL Interaction Hub accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PRTL Interaction Hub accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
CVSS v3.0 score: 6.1
CVSS v2.0 score: 5.8
GHSA-9q43-jrc4-8mmg 
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in NotFound Coming Soon, Maintenance Mode allows PHP Local File Inclusion. This issue affects Coming Soon, Maintenance Mode: from n/a through 1.1.1.
CVSS v3.1 score: 7.5
GHSA-56wx-rr26-54fr 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPKube Cool Tag Cloud cool-tag-cloud allows Stored XSS.This issue affects Cool Tag Cloud: from n/a through <= 2.29.
CVSS v3.1 score: 6.5
CVE-2024-28908 Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
CVSS v3.1 score: 8.8
GHSA-x7p6-qrr5-jv3j 
Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Contracts Integration.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Contracts Integration accessible data as well as  unauthorized read access to a subset of Oracle Contracts Integration accessible data. CVSS 3.1 Base Score 4.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N).
CVSS v3.1 score: 4.2
CVE-2019-7736 
D-Link DIR-600M C1 3.04 devices allow authentication bypass via a direct request to the wan.htm page. NOTE: this may overlap CVE-2019-13101.
CVSS v3.0 score: 9.8
CVSS v2.0 score: 7.5
GHSA-j9qw-8pqm-vfx8 
The Mozilla Maintenance Service in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 on Windows allows local users to bypass integrity verification and gain privileges via vectors involving junctions.
GHSA-h376-x6h9-h5f3 
The Document Embedder – Embed PDFs, Word, Excel, and Other Files plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.4. This is due to the plugin not verifying that a user has permission to access the requested resource in the 'bplde_save_document_library', 'bplde_get_single', and 'bplde_delete_document_library' AJAX actions. This makes it possible for authenticated attackers, with Author-level access and above, to read, modify, and delete Document Library entries created by other users, including administrators, via the 'id' parameter.
CVSS v3.1 score: 5.3
GHSA-4v2q-hjx3-c4vr Magento remote code execution vulnerability
A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with privileges to modify product catalogs can trigger PHP file inclusion through a crafted XML file that specifies product design update.As per [the Magento Release 2.3.3](https://web.archive.org/web/20201126132230/https://devdocs.magento.com/guides/v2.3/release-notes/release-notes-2-3-3-commerce.html#new-security-only-patch-available), if you have already implemented the pre-release version of this patch (2.3.2-p1), it is highly recommended to promptly upgrade to 2.3.2-p2.
CVSS v3.1 score: 8.8
GHSA-wwvq-j7g5-3qrf 
In the Linux kernel, the following vulnerability has been resolved:ext4: fix use-after-free in update_super_work when racing with umountCommit b98535d09179 ("ext4: fix bug_on in start_this_handle during umount
filesystem") moved ext4_unregister_sysfs() before flushing s_sb_upd_work
to prevent new error work from being queued via /proc/fs/ext4/xx/mb_groups
reads during unmount. However, this introduced a use-after-free because
update_super_work calls ext4_notify_error_sysfs() -> sysfs_notify() which
accesses the kobject's kernfs_node after it has been freed by kobject_del()
in ext4_unregister_sysfs():update_super_work                ext4_put_superext4_notify_error_sysfs(sbi)
    sysfs_notify(&sbi->s_kobj)
      kn = kobj->sd              // stale pointer
      kernfs_get(kn)             // UAF on freed kernfs_node
                                   ext4_journal_destroy()
                                     flush_work(&sbi->s_sb_upd_work)Instead of reordering the teardown sequence, fix this by making
ext4_notify_error_sysfs() detect that sysfs has already been torn down
by checking s_kobj.state_in_sysfs, and skipping the sysfs_notify() call
in that case. A dedicated mutex (s_error_notify_mutex) serializes
ext4_notify_error_sysfs() against kobject_del() in ext4_unregister_sysfs()
to prevent TOCTOU races where the kobject could be deleted between the
state_in_sysfs check and the sysfs_notify() call.
CVSS v3.1 score: 7.8
GHSA-27gg-q2pj-f574 
User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump file. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].
CVSS v3.1 score: 5.9
CVE-2023-48218 Strapi Protected Populate Plugin leaking fields if the request fields where empty or only fields selected where not populatable
The Strapi Protected Populate Plugin protects `get` endpoints from revealing too much information. Prior to version 1.3.4, users were able to bypass the field level security. Users who tried to populate something that they didn't have access to could populate those fields anyway. This issue has been patched in version 1.3.4. There are no known workarounds.
CVSS v3.1 score: 5.3
RHSA-2026:2044 Red Hat Security Advisory: firefox security update
firefox: Spoofing issue in the Downloads Panel component firefox: thunderbird: Mitigation bypass in the DOM: Security component firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics component firefox: thunderbird: Sandbox escape due to integer overflow in the Graphics component firefox: thunderbird: Use-after-free in the IPC component firefox: thunderbird: Information disclosure in the Networking component firefox: thunderbird: Use-after-free in the JavaScript Engine component firefox: thunderbird: Use-after-free in the JavaScript: GC component firefox: thunderbird: Incorrect boundary conditions in the Graphics component firefox: thunderbird: Clickjacking issue, information disclosure in the PDF Viewer component firefox: thunderbird: Spoofing issue in the DOM: Copy & Paste and Drag & Drop component firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147
CVSS v3.1 score: 7.5
CVE-2012-2038 
Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before 11.1.111.10 on Android 2.x and 3.x; and before 11.1.115.9 on Android 4.x, and Adobe AIR before 3.3.0.3610, allows attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors.
CVSS v2.0 score: 4.3
CVE-2019-0121 
Improper permissions in Intel(R) Matrix Storage Manager 8.9.0.1023 and before may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS v3.0 score: 7.8
CVSS v2.0 score: 4.6
CVE-2025-23861 WordPress Debt Calculator plugin <= 1.0.1 - CSRF to Stored XSS vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Zack Katz Debt Calculator debt-calculator allows Cross Site Request Forgery.This issue affects Debt Calculator: from n/a through <= 1.0.1.
CVSS v3.1 score: 7.1
CVE-2021-40906 
CheckMK Raw Edition software (versions 1.5.0 to 1.6.0) does not sanitise the input of a web service parameter that is in an unauthenticated zone. This Reflected XSS allows an attacker to open a backdoor on the device with HTML content and interpreted by the browser (such as JavaScript or other client-side scripts) or to steal the session cookies of a user who has previously authenticated via a man in the middle. Successful exploitation requires access to the web service resource without authentication.
CVSS v3.1 score: 6.1
CVSS v2.0 score: 4.3
GHSA-pf27-g8mf-ccwq 
backend.py in Jockey before 0.9.7-0ubuntu7.11 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.
CVE-2024-32577 WordPress CBX Bookmark & Favorite plugin <= 1.7.20 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codeboxr Team CBX Bookmark & Favorite cbxwpbookmark allows Stored XSS.This issue affects CBX Bookmark & Favorite: from n/a through 1.7.20.
CVSS v3.1 score: 6.5
GHSA-vjjh-5286-68ch 
forma.lms 2.3.0.2 is affected by Cross Site Request Forgery (CSRF) in formalms/appCore/index.php?r=lms/profile/show&ap=saveinfo via a GET request to change the admin email address in order to accomplish an account takeover.
CVE-2017-18909 
An issue was discovered in Mattermost Server before 3.9.0 when SAML is used. Encryption and signature verification are not mandatory.
CVSS v3.1 score: 7.5
CVSS v2.0 score: 4.3
CVE-2025-15264 FeehiCMS TimThumb timthumb.php server-side request forgery
A vulnerability was determined in FeehiCMS up to 2.1.1. Impacted is an unknown function of the file frontend/web/timthumb.php of the component TimThumb. Executing manipulation of the argument src can lead to server-side request forgery. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 7.3
CVSS v3.0 score: 7.3
CVSS v2.0 score: 7.5
CVE-2023-27001 
An issue discovered in Egerie Risk Manager v4.0.5 allows attackers to bypass the signature mechanism and tamper with the values inside the JWT payload resulting in privilege escalation.
CVSS v3.1 score: 8.8
GHSA-wrh7-vv7r-8w3q 
Untrusted search path vulnerability in the client in Symantec Endpoint Protection 12.1 before 12.1-RU6-MP1 allows local users to gain privileges via a Trojan horse DLL in a client install package.
GHSA-f386-w386-pj3f 
In the Linux kernel, the following vulnerability has been resolved:s390/entry: Mark IRQ entries to fix stack depot warningsThe stack depot filters out everything outside of the top interrupt
context as an uninteresting or irrelevant part of the stack traces. This
helps with stack trace de-duplication, avoiding an explosion of saved
stack traces that share the same IRQ context code path but originate
from different randomly interrupted points, eventually exhausting the
stack depot.Filtering uses in_irqentry_text() to identify functions within the
.irqentry.text and .softirqentry.text sections, which then become the
last stack trace entries being saved.While __do_softirq() is placed into the .softirqentry.text section by
common code, populating .irqentry.text is architecture-specific.Currently, the .irqentry.text section on s390 is empty, which prevents
stack depot filtering and de-duplication and could result in warnings
like:Stack depot reached limit capacity
WARNING: CPU: 0 PID: 286113 at lib/stackdepot.c:252 depot_alloc_stack+0x39a/0x3c8with PREEMPT and KASAN enabled.Fix this by moving the IO/EXT interrupt handlers from .kprobes.text into
the .irqentry.text section and updating the kprobes blacklist to include
the .irqentry.text section.This is done only for asynchronous interrupts and explicitly not for
program checks, which are synchronous and where the context beyond the
program check is important to preserve. Despite machine checks being
somewhat in between, they are extremely rare, and preserving context
when possible is also of value.SVCs and Restart Interrupts are not relevant, one being always at the
boundary to user space and the other being a one-time thing.IRQ entries filtering is also optionally used in ftrace function graph,
where the same logic applies.
CVSS v3.1 score: 7.1
CVE-2024-9968 NewType WebEIP v3.0 - SQL injection
WebEIP v3.0 from 

NewType does not properly validate user input, allowing remote attackers with regular privilege to inject SQL commands to read, modify, and delete data stored in database. The affected product is no longer maintained. It is recommended to upgrade to the new product.
CVSS v3.1 score: 8.8
CVE-2025-20047 
Improper locking in the Intel(R) Integrated Connectivity I/O interface (CNVi) for some Intel(R) Core™ Ultra Processors may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 5.7
CVE-2025-25176 GPU DDK - GPU Register value contents leaked from secure workloads to non-secure world
Intermediate register values of secure workloads can be exfiltrated in workloads scheduled from applications running in the non-secure environment of a platform.
CVSS v3.1 score: 9.1
GHSA-v6r5-wp7h-cj77 
A mismatch between allocator and deallocator could have lead to memory corruption. This vulnerability affects Firefox < 128 and Firefox ESR < 115.13.
CVSS v3.1 score: 9.8
GHSA-3545-2cxj-jfvg 
The Email Log WordPress plugin before 2.4.7 does not properly validate, sanitise and escape the "orderby" and "order" GET parameters before using them in SQL statement in the admin dashboard, leading to SQL injections
RHSA-2025:0485 Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.15.0
golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html
CVSS v3.1 score: 7.5
CVE-2026-60653 
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Content accessible data as well as  unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
CVSS v3.1 score: 8.1
CVE-2024-29954 password management API prints sensitive information in log files
A vulnerability in a password management API in Brocade Fabric OS versions before v9.2.1, v9.2.0b, v9.1.1d, and v8.2.3e prints sensitive information in log files. This could allow an authenticated user to view the server passwords for protocols such as scp and sftp.

Detail.
When the firmwaredownload command is incorrectly entered or points to an erroneous file, the firmware download log captures the failed command, including any password entered in the command line.
CVSS v3.1 score: 5.9
RHSA-2026:8577 Red Hat Security Advisory: perl-XML-Parser security update
perl-xml-parser: XML::Parser for Perl: Heap corruption and denial of service from crafted XML input perl-xml-parser: XML::Parser: Memory corruption via deeply nested XML files
CVSS v3.1 score: 8.8