CIRCL/vulnerability-scores huggingface dataset:
CVE-2026-47014 
Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite (component: Security).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Workbench.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Product Workbench accessible data as well as  unauthorized access to critical data or complete access to all Oracle Product Workbench accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
CVSS v3.1 score: 8.1
CVE-2015-9180 
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, the response pointer passed from user space to SDMX_process is not checked before it is used. If the given response buffer length is smaller than 16 bytes, the response values will be written to a memory outside the buffer, possibly in the secure memory area.
CVSS v3.0 score: 9.8
CVSS v2.0 score: 10
GHSA-g7cf-4hgh-v7qf 
An elevation of privilege vulnerability exists when the Windows Remote Access improperly handles file operations, aka 'Windows Remote Access Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1530.
CVSS v3.1 score: 7.8
RHSA-2025:2510 Red Hat Security Advisory: kernel-rt security update
kernel: can: bcm: Fix UAF in bcm_proc_show() kernel: HID: core: zero-initialize the report buffer kernel: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices
CVSS v3.1 score: 5.8
CVE-2024-38213 Windows Mark of the Web Security Feature Bypass Vulnerability
Windows Mark of the Web Security Feature Bypass Vulnerability
CVSS v3.1 score: 6.5
GHSA-2j6f-ff8c-5pq9 
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in tvOS 13, iTunes for Windows 12.10.1, iCloud for Windows 10.7, iCloud for Windows 7.14. Processing maliciously crafted web content may lead to arbitrary code execution.
GHSA-2wg7-w55f-33cc 
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26. An app may be able to access sensitive user data.
CVSS v3.1 score: 5.3
GHSA-8v6h-9947-g35h 
When an attacker obtaining the administrative account and password, or through a man-in-the-middle attack, the attacker could send a specified crafted packet to the vulnerable interface then lead the device to crash.
CVSS v3.1 score: 7.4
CVE-2023-31365 
An integer overflow in the SMU could allow a privileged attacker to potentially write memory beyond the end of the reserved dRAM area resulting in loss of integrity or availability.
CVSS v3.1 score: 3.9
CVE-2026-49773 WordPress FV Flowplayer Video Player plugin < 7.5.51.7212 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting (XSS) in FV Flowplayer Video Player < 7.5.51.7212 versions.
CVSS v3.1 score: 6.5
CVE-2021-35060 
/way4acs/enroll in OpenWay WAY4 ACS before 1.2.278-2693 allows unauthenticated attackers to leverage response differences to discover whether a specific payment card number is stored in the system.
CVSS v3.1 score: 5.3
CVSS v2.0 score: 5
RHSA-2026:13812 Red Hat Security Advisory: updated RHEL-8 based Middleware Containers container images
gnutls: Stack-based Buffer Overflow in gnutls_pkcs11_token_init() Function rsync: Rsync: Out of bounds array access via negative index gnutls: GnuTLS: Denial of Service via excessive resource consumption during certificate verification openssh: OpenSSH GSSAPI: Information disclosure or denial of service due to uninitialized variables libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing python: Python: Command-line option injection in webbrowser.open() via crafted URLs python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination
CVSS v3.1 score: 7.5
CVE-2025-26968 WordPress Cloak Front End Email <= 1.9.5 - Broken Access Control Vulnerability
Missing Authorization vulnerability in webbernaut Cloak Front End Email allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Cloak Front End Email: from n/a through 1.9.5.
CVSS v3.1 score: 7.5
GHSA-p55r-fqh8-ccwq 
This vulnerability exists in Digisol Router (DG-GR1321: Hardware version 3.7L;  Firmware version : v3.2.02) due to presence of root terminal access on a serial interface without proper access control. An attacker with physical access could exploit this by identifying UART pins and accessing the root shell on the vulnerable system.Successful exploitation of this vulnerability could allow the attacker to access the sensitive information on the targeted system.This vulnerability exists in Digisol Router (DG-GR1321: Hardware version 3.7L;  Firmware version : v3.2.02) due to lack of encryption or hashing in storing of passwords within the router's firmware/ database. An attacker with physical access could exploit this by extracting the firmware and reverse engineer the binary data to access the plaintext passwords on the vulnerable system.Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to the targeted system.
CVSS v4.0 score: 5.4
CVSS v3.1 score: 4.1
CVE-2018-1727 
IBM InfoSphere Information Server 9.1, 11.3, 11.5, and 11.7 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 147630.
CVSS v3.0 score: 7.1
GHSA-8644-h47r-x2w8 
Symantec pcAnywhere 8.0 allows remote attackers to cause a denial of service (CPU utilization) via a large amount of data to port 5631.
GHSA-vcfc-84hr-mgwm 
Nagios Fusion versions prior to 4.0.1 are vulnerable to cross-site scripting (XSS) via the Users and Servers pages. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS v4.0 score: 5.1
CVSS v3.1 score: 6.1
CVE-2024-45731 Potential Remote Command Execution (RCE) through arbitrary file write to Windows system root directory when Splunk Enterprise for Windows is installed on a separate disk
In Splunk Enterprise for Windows versions below 9.3.1, 9.2.3, and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could write a file to the Windows system root directory, which has a default location in the Windows System32 folder, when Splunk Enterprise for Windows is installed on a separate drive.
CVSS v3.1 score: 8
GHSA-fc7q-x42h-7ff2 
In the Linux kernel, the following vulnerability has been resolved:drm/i915/bios: Tolerate devdata==NULL in intel_bios_encoder_supports_dp_dual_mode()If we have no VBT, or the VBT didn't declare the encoder
in question, we won't have the 'devdata' for the encoder.
Instead of oopsing just bail early.We won't be able to tell whether the port is DP++ or not,
but so be it.(cherry picked from commit 26410896206342c8a80d2b027923e9ee7d33b733)
CVSS v3.1 score: 5.5
CVE-2026-70347 Windows Installer Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
CVSS v3.1 score: 7.8
GHSA-v356-mvg5-2vv2 
Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.10.3 allows remote attackers to inject arbitrary web script or HTML via the application 'E-mail'.
CVE-2025-53226 WordPress Comments Capcha Box Plugin <= 1.1 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in digitalzoomstudio Comments Capcha Box comments-capcha-box allows Reflected XSS.This issue affects Comments Capcha Box: from n/a through <= 1.1.
CVSS v3.1 score: 7.1
GHSA-r3x8-5j74-9fg2 
AdaptiveGRC is vulnerable to Stored XSS via text type fields across the forms. Authenticated attacker can replace the value of the text field in the HTTP POST request. Improper parameter validation by the server results in arbitrary JavaScript execution in the victim's browser.
Critically, this may allow the attacker to obtain the administrator authentication token and perform arbitrary actions with administrative privileges, which could lead to further compromise.This issue occurs in versions released before December 2025.
CVSS v4.0 score: 2.4
CVE-2021-26927 
A flaw was found in jasper before 2.0.25. A null pointer dereference in jp2_decode in jp2_dec.c may lead to program crash and denial of service.
CVSS v3.1 score: 5.5
CVSS v2.0 score: 4.3
GHSA-fvcv-8g7r-6893 
An observable response discrepancy vulnerability in the SonicWall SMA1000 series appliances allows a remote attacker to enumerate SSL VPN user credentials.
CVSS v3.1 score: 7.2
CVE-2022-1698 Allowing long password leads to denial of service in causefx/organizr
Allowing long password leads to denial of service in GitHub repository causefx/organizr prior to 2.1.2000. This vulnerability can be abused by doing a DDoS attack for which genuine users will not able to access resources/applications.
CVSS v3.0 score: 9.9
RHSA-2025:9340 Red Hat Security Advisory: Updated 7.1 container image is now available in the Red Hat Ecosystem Catalog.
moby: classic builder cache poisoning python-werkzeug: user may execute code on a developer's machine golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html
CVSS v3.1 score: 7.5
CVE-2024-30157 
A vulnerability in the Suite Applications Services component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with administrative privileges to conduct a SQL Injection attack due to insufficient validation of user input. A successful exploit could allow an attacker to execute arbitrary database and management operations.
CVSS v3.1 score: 7.2
GHSA-36jr-35r6-vp2p 
Illustrator on iPad versions 3.0.9 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1 score: 7.8
GHSA-fqc4-ffq5-4r98 
EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number. This
 vulnerability can be exploited by an attacker to gain unauthorized 
access and potentially lead to a loss of Confidentiality.
CVSS v3.1 score: 5.8
CVE-2024-43594 Microsoft System Center Elevation of Privilege Vulnerability
Microsoft System Center Elevation of Privilege Vulnerability
CVSS v3.1 score: 7.3
GHSA-xqjh-59ww-r864 
A vulnerability, which was classified as critical, was found in PCMan FTP Server 2.0.7. Affected is an unknown function of the component MKDIR Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 7.3
GHSA-5f37-m2hf-qphr 
A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution of arbitrary code.
CVSS v3.1 score: 9.8
GHSA-h6wm-mr85-4h9g Cross site scripting in facturascripts
A Cross-site Scripting (XSS) vulnerability exists in the fsNick parameter in facturascripts prior to version 2022.06
CVSS v3.1 score: 6.1
GHSA-hx93-w6p2-8rvj 
All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server may allow an attacker to use MAC addresses to enumerate potential Cloud IDs. Using this ID, the attacker can discover and connect to valid devices using one of the supported apps.
CVSS v3.0 score: 5.3
CVE-2024-12727 
A pre-auth SQL injection vulnerability in the email protection feature of Sophos Firewall versions older than 21.0 MR1 (21.0.1) allows access to the reporting database and can lead to remote code execution if a specific configuration of Secure PDF eXchange (SPX) is enabled in combination with the firewall running in High Availability (HA) mode.
CVSS v3.1 score: 9.8
RHSA-2021:3158 Red Hat Security Advisory: exiv2 security update
exiv2: Heap-based buffer overflow vulnerability in jp2image.cpp
CVSS v3.1 score: 8.1
GHSA-rwgh-gfm4-665g 
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms HubSpot gf-hubspot allows Phishing.This issue affects WP Gravity Forms HubSpot: from n/a through <= 1.2.5.
CVSS v3.1 score: 7.5
CVE-2021-22478 
The interface of a certain HarmonyOS module has a UAF vulnerability. Successful exploitation of this vulnerability may lead to information leakage.
CVSS v3.1 score: 5.5
CVSS v2.0 score: 2.1
GHSA-q9j2-x62q-rv7w 
The password change endpoint in Open Source Point of Sale 3.4.1 allows users to set their account password to an empty string due to missing server-side validation. When an authenticated user omits or leaves the `password` and `repeat_password` parameters empty in the password change request, the backend still returns a successful response and sets the password to an empty string. This effectively disables authentication and may allow unauthorized access to user or administrative accounts.
CVSS v3.1 score: 7.5
CVE-2018-1308 
This vulnerability in Apache Solr 1.2 to 6.6.2 and 7.0.0 to 7.2.1 relates to an XML external entity expansion (XXE) in the `&dataConfig=<inlinexml>` parameter of Solr's DataImportHandler. It can be used as XXE using file/ftp/http protocols in order to read arbitrary local files from the Solr server or the internal network.
CVSS v3.0 score: 7.5
CVSS v2.0 score: 5
GHSA-2f34-vx7g-x3mg 
OMICARD EDM’s API function has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL commands to access, modify, delete database or disrupt service.
CVSS v3.1 score: 9.8
CVE-2025-45786 
Real Estate Management 1.0 is vulnerable to Cross Site Scripting (XSS) in /store/index.php.
CVSS v3.1 score: 8.1
GHSA-p8g8-q63w-8jgm 
Links in a sandboxed iframe could open an external app on Android without the required "allow-" permission. This vulnerability affects Firefox < 144 and Thunderbird < 144.
CVSS v3.1 score: 6.5
GHSA-7mjh-m8r7-cjw8 
In the Linux kernel, the following vulnerability has been resolved:fbdev: sis: Error out if pixclock equals zeroThe userspace program could pass any values to the driver through
ioctl() interface. If the driver doesn't check the value of pixclock,
it may cause divide-by-zero error.In sisfb_check_var(), var->pixclock is used as a divisor to caculate
drate before it is checked against zero. Fix this by checking it
at the beginning.This is similar to CVE-2022-3061 in i740fb which was fixed by
commit 15cf0b8.
CVSS v3.1 score: 5.5
CVE-2021-33785 Windows AF_UNIX Socket Provider Denial of Service Vulnerability
Windows AF_UNIX Socket Provider Denial of Service Vulnerability
CVSS v3.1 score: 7.5
CVE-2023-33741 
Macrovideo v380pro v1.4.97 shares the device id and password when sharing the device.
CVSS v3.1 score: 7.5
GHSA-w54g-xv2p-9w2q 
In ion_ioctl and related functions of ion.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-205707793References: N/A
CVSS v3.1 score: 7
ICSA-25-191-04 Siemens SIMATIC CN 4100
The affected application allows to control the device by storing arbitrary files in the SFTP folder of the device. This could allow an attacker to cause a denial of service condition.
CVSS v3.1 score: 6.5
CVE-2020-13582 
A denial-of-service vulnerability exists in the HTTP Server functionality of Micrium uC-HTTP 3.01.00. A specially crafted HTTP request can lead to denial of service. An attacker can send an HTTP request to trigger this vulnerability.
CVSS v3.0 score: 8.6
CVE-2020-10116 
cPanel before 84.0.20 allows attackers to bypass intended restrictions on features and demo accounts via WebDisk UAPI calls (SEC-541).
CVSS v3.1 score: 5.3
CVSS v2.0 score: 5
RHSA-2022:1440 Red Hat Security Advisory: java-11-openjdk security, bug fix, and enhancement update
OpenJDK: Unbounded memory allocation when compiling crafted XPath expressions (JAXP, 8270504) OpenJDK: Improper object-to-string conversion in AnnotationInvocationHandler (Libraries, 8277672) OpenJDK: Missing check for negative ObjectIdentifier (Libraries, 8275151) OpenJDK: Defective secure validation in Apache Santuario (Libraries, 8278008) OpenJDK: URI parsing inconsistencies (JNDI, 8278972)
CVSS v3.1 score: 5.3
CVE-2022-39059 ChangingTec MegaServiSignAdapter - Path Traversal
ChangingTech MegaServiSignAdapter component has a path traversal vulnerability within its file reading function. An unauthenticated remote attacker can exploit this vulnerability to access arbitrary system files.
CVSS v3.1 score: 7.5
GHSA-p5xc-wr34-q7q4 
The REHub - Price Comparison, Multi Vendor Marketplace Wordpress Theme theme for WordPress is vulnerable to Information Exposure in all versions up to, and including, 19.9.7 via the 'ajax_action_re_getfullcontent' function due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected posts that they should not have access to.
CVSS v3.1 score: 5.3
CVE-2025-56430 
Directory Traversal vulnerability in Fearless Geek Media FearlessCMS v.0.0.2-15 allows a remote attacker to cause a denial of service via the plugin-handler.php and the deleteDirectory function.
CVSS v3.1 score: 7.5
GHSA-x8rh-6x6w-x2xg 
In the Linux kernel, the following vulnerability has been resolved:bpf: Take return from set_memory_rox() into account with bpf_jit_binary_lock_ro()set_memory_rox() can fail, leaving memory unprotected.Check return and bail out when bpf_jit_binary_lock_ro() returns
an error.
CVSS v3.1 score: 5.5
CVE-2024-56173 
In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed in users' browsers under specific conditions: XSS from JavaScript in an SVG document.
CVSS v3.1 score: 4.7
CVE-2020-1058 
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1035, CVE-2020-1060, CVE-2020-1093.
CVSS v3.1 score: 7.5
CVSS v2.0 score: 7.6
GHSA-78c5-jfvv-4698 
Simple College Website 1.0 is vulnerable to unauthenticated file upload & remote code execution via UNION-based SQL injection in the username parameter on /admin/login.php.
CVE-2008-6988 
Multiple cross-site scripting (XSS) vulnerabilities in Easy Photo Gallery (aka Ezphotogallery) 2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) galleryid parameter to gallery.php, and the (2) size or (3) imageid parameters to show.php.
CVSS v2.0 score: 4.3
CVE-2020-2947 
Vulnerability in the PeopleSoft Enterprise HCM Absence Management product of Oracle PeopleSoft (component: Absence Management). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise HCM Absence Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise HCM Absence Management accessible data. CVSS 3.0 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).
CVSS v3.0 score: 4.3
GHSA-7687-8cj4-w742 
Microsoft Internet Explorer 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability."
RHSA-2009:1430 Red Hat Security Advisory: firefox security update
firefox: URL bar spoofing vulnerability Firefox 3.5 3.0.14 browser engine crashes Firefox 3.5.2 3.0.14 browser engine crashes Firefox 3.5.3 3.0.14 browser engine crashes Firefox 3.5 3.0.14 JavaScript engine crashes Firefox 3.5.2 3.0.14 JavaScript engine crashes Firefox 3.0.14 Insufficient warning for PKCS11 module installation and removal Firefox 3.5.3 3.0.14 TreeColumns dangling pointer vulnerability Firefox 3.5.3 3.0.14 Location bar spoofing via tall line-height Unicode characters Firefox 3.5.3 3.0.14 Chrome privilege escalation with FeedWriter
GHSA-3cph-63fp-2vh8 
In CAacDecoder_Init of aacdecoder.cpp, there is a possible out-of-bound write due to a missing bounds check. This could lead to remote code execution in the media server with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-112891548.
CVSS v3.1 score: 7.8
GHSA-m738-3rc4-5xv3 A user without PR can reset user authentication failures information
ImpactThe script service method used to reset the authentication failures record can be executed by any user with Script rights and does not require Programming rights as it should have.
Note that being able to reset the authentication failure record mean that an attacker with script right might use it to try performing a bruteforce attack since she'd been able to virtually deactivate the mechanism introduced to mitigate those attacks.PatchesThe problem has been patched in version 12.6.8, 12.10.4 and 13.0.WorkaroundsThere's no workaround besides upgrading and being careful on which user should have Script right access. Note that any bruteforce attack on the authentication should be visible in the logs since the authentication failures are logged.Referenceshttps://jira.xwiki.org/browse/XWIKI-18276For more informationIf you have any questions or comments about this advisory:Open an issue in [Jira](http://jira.xwiki.org)Email us at [the security mailing-list](mailto:security@xwiki.org)
CVSS v3.1 score: 2
GHSA-xq4f-j8wj-pf7x 
An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in expand_mmacro() in modules/preprocs/nasm/nasm-pp.c.
CVSS v3.1 score: 5.5
GHSA-hjff-8jgj-64p3 
Brocade SANnav before SANnav 2.3.1b 
enables weak TLS ciphers on ports 443 and 18082. In case of a successful
 exploit, an attacker can read Brocade SANnav data stream that includes 
monitored Brocade Fabric OS switches performance data, port status, 
zoning information, WWNs, IP Addresses, but no customer data, no 
personal data and no secrets or passwords, as it travels across the 
network.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 5.3
CVE-2026-8931 Critical RCE vulnerability in Disig Web Signer
A critical Remote Code Execution (RCE) vulnerability exists in Disig Web Signer versions 2.0.3 through 2.5.3.
CVSS v4.0 score: 9.4
GHSA-5584-x336-h96r 
The mint function of a smart contract implementation for HYIPCrowdsale1, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS v3.0 score: 7.5
CVE-2025-1954 PHPGurukul Human Metapneumovirus Testing Management System login.php sql injection
A vulnerability was found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /login.php. The manipulation of the argument username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 7.3
CVSS v3.0 score: 7.3
CVSS v2.0 score: 7.5
GHSA-qxm6-r385-gmwp 
A command injection remote code execution vulnerability exists in HPE StoreOnce Software.
CVSS v4.0 score: 7.5
CVSS v3.1 score: 9.8
CVE-2009-1971 
Unspecified vulnerability in the Data Pump component in Oracle Database 10.1.0.5, 10.2.0.3, and 11.1.0.7 allows remote authenticated users to affect integrity via unknown vectors.
CVSS v2.0 score: 3.5
GHSA-2wph-jf27-55c8 
Auth. Stored Cross-Site Scripting (XSS) vulnerability in GD bbPress Attachments plugin <= 4.3.1 on WordPress.
CVSS v3.1 score: 5.4
GHSA-ppgf-xcg9-2c3g 
Multiple vulnerabilities in the install, uninstall, and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to hijack DLL or executable files that are used by the application. A successful exploit could allow the attacker to execute arbitrary code on an affected device with SYSTEM privileges. To exploit these vulnerabilities, the attacker must have valid credentials on the Windows system. For more information about these vulnerabilities, see the Details section of this advisory.
CVE-2022-43632 
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1935 1.03 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handling of SetQoSSettings requests to the web management portal. When parsing subelements within the QoSInfo element, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-16153.
CVSS v3.0 score: 6.8
CVE-2022-4471 YARPP - Yet Another Related Posts Plugin < 5.30.3 - Contributor+ Stored XSS
The YARPP WordPress plugin before 5.30.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS v3.1 score: 6.8
GHSA-r4q3-hfmc-666r 
Multiple cross-site scripting (XSS) vulnerabilities in Claroline 1.7.7 allow remote attackers to inject arbitrary HTML or web script via unspecified attack vectors, possibly including (1) calendar/myagenda.php, (2) document/document.php, (3) phpbb/newtopic.php, (4) tracking/userLog.php, and (5) wiki/page.php.
CVE-2025-32569 WordPress TableOn plugin <= 1.0.4.3 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in RealMag777 TableOn posts-table-filterable allows Object Injection.This issue affects TableOn: from n/a through <= 1.0.4.3.
CVSS v3.1 score: 9.8
GHSA-r6gg-58h5-pw3w 
The Aqara Cloud OAuth Authorization Endpoint (open-cn.aqara.com/oauth/authorize) is vulnerable to a redirect bypass due to lax controls on domain matching, which is an instance of "CWE-1289: Improper Validation of Unsafe Equivalence in Input" and has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N (9.3 Critical).
CVSS v3.1 score: 9.3
CVE-2012-6553 
Heap-based buffer overflow in Resource Hacker 3.6.0.92 allows remote attackers to execute arbitrary code via a Portable Executable (PE) file with a resource section containing a string that has many tab or line feed characters.
CVSS v2.0 score: 9.3
GHSA-4rr9-r8xx-fg2w 
Cross-site scripting (XSS) vulnerability in the textEncode function in classes/ezjscajaxcontent.php in eZ JS Core in eZ Publish before 1.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2021-24479 DrawBlog <= 0.90 - Authenticated Stored Cross-Site Scripting (XSS)
The DrawBlog WordPress plugin through 0.90 does not sanitise or validate some of its settings before outputting them back in the page, leading to an authenticated stored Cross-Site Scripting issue
CVSS v3.1 score: 4.8
CVSS v2.0 score: 3.5
CVE-2013-5311 
Multiple SQL injection vulnerabilities in Vastal I-Tech phpVID 1.2.3 allow remote attackers to execute arbitrary SQL commands via the "n" parameter to (1) browse_videos.php or (2) members.php.  NOTE: the cat parameter is already covered by CVE-2008-4157.
CVSS v2.0 score: 7.5
GHSA-qr4p-ppj7-4xcx 
Unspecified vulnerability in the JavaScript engine in Mozilla Firefox before 3.0.14 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVE-2018-20922 
cPanel before 70.0.23 allows stored XSS via a WHM DNS Cleanup action (SEC-376).
CVSS v3.0 score: 6.1
CVSS v2.0 score: 4.3
GHSA-phf6-mw35-xhh9 
Cross-Site Request Forgery (CSRF) vulnerability in Robert Schulz (sprd.Net AG) Spreadshop plugin <= 1.6.5 versions.
CVSS v3.1 score: 8.8
CVE-2019-10081 
HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory in the pushing request's pool, leading to crashes. The memory copied is that of the configured push link header values, not data supplied by the client.
CVSS v3.0 score: 7.5
CVSS v2.0 score: 5
GHSA-2j43-x625-hw9q 
A Missing Required Cryptographic Step vulnerability has been identified in Moxa's embedded Linux firmware for industrial computers and controllers. This vulnerability represents an incomplete remediation of CVE-2026-0714. The firmware introduced TPM2 parameter encryption as a countermeasure against CVE-2026-0714. However, an omission in the authorization session configuration causes the parameter encryption to provide no effective protection. An attacker with invasive physical access to the device can still capture TPM communications on the SPI bus and derive the LUKS disk encryption key in plaintext. While successful exploitation results in full compromise of the encrypted disk volume, the attack requires invasive physical access, including opening the device and attaching external equipment to the SPI bus. Remote exploitation is not possible, and the attack does not affect any downstream systems.
CVSS v4.0 score: 7
GHSA-hwpq-rrpf-pgcq OpenClaw: system.run approval identity mismatch could execute a different binary than displayed
Summary`system.run` approvals in OpenClaw used rendered command text as the approval identity while trimming argv token whitespace. Runtime execution still used raw argv. A crafted trailing-space executable token could therefore execute a different binary than what the approver saw.Affected Packages / VersionsPackage: `openclaw` (npm)Affected versions: `<= 2026.2.24`Patched versions: `>= 2026.2.25`ImpactThis is an approval-integrity bypass that can lead to unexpected command execution under the OpenClaw runtime user when an attacker can influence `command` argv and reuse/obtain a matching approval context.Trust Model NoteOpenClaw does not treat adversarial multi-user sharing of one gateway host/config as a supported security boundary. This finding is still valid in supported deployments because it breaks the operator approval boundary itself (approved display command vs executed argv).Fix Commit(s)`03e689fc89bbecbcd02876a95957ef1ad9caa176`Release Process Note`patched_versions` is pre-set to the release (`2026.2.25`). Advisory published with npm release `2026.2.25`.OpenClaw thanks @tdjackey for reporting.
CVSS v4.0 score: 5.7
CVSS v3.1 score: 4.8
CVE-2018-0886 
The Credential Security Support Provider protocol (CredSSP) in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709 Windows Server 2016 and Windows Server, version 1709 allows a remote code execution vulnerability due to how CredSSP validates request during the authentication process, aka "CredSSP Remote Code Execution Vulnerability".
CVSS v3.0 score: 7
CVSS v2.0 score: 7.6
CVE-2020-28899 
The Web CGI Script on ZyXEL LTE4506-M606 V1.00(ABDO.2)C0 devices does not require authentication, which allows remote unauthenticated attackers (via crafted JSON action data to /cgi-bin/gui.cgi) to use all features provided by the router. Examples: change the router password, retrieve the Wi-Fi passphrase, send an SMS message, or modify the IP forwarding to access the internal network.
CVSS v3.1 score: 9.1
CVSS v2.0 score: 6.4
CVE-2023-24827 Credential disclosure in syft when SYFT_ATTEST_PASSWORD environment variable set in syft
syft is a a CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems. A password disclosure flaw was found in Syft versions v0.69.0 and v0.69.1. This flaw leaks the password stored in the SYFT_ATTEST_PASSWORD environment variable. The `SYFT_ATTEST_PASSWORD` environment variable is for the `syft attest` command to generate attested SBOMs for the given container image. This environment variable is used to decrypt the private key (provided with `syft attest --key <path-to-key-file>`)  during the signing process while generating an SBOM attestation. This vulnerability affects users running syft that have the `SYFT_ATTEST_PASSWORD` environment variable set with credentials (regardless of if the attest command is being used or not). Users that do not have the environment variable `SYFT_ATTEST_PASSWORD` set are not affected by this issue. The credentials are leaked in two ways: in the syft logs when `-vv` or `-vvv` are used in the syft command (which is any log level >= `DEBUG`) and in the attestation or SBOM only when the `syft-json` format is used. Note that as of v0.69.0 any generated attestations by the `syft attest` command are uploaded to the OCI registry (if you have write access to that registry) in the same way `cosign attach` is done. This means that any attestations generated for the affected versions of syft when the `SYFT_ATTEST_PASSWORD` environment variable was set would leak credentials in the attestation payload uploaded to the OCI registry. This issue has been patched in commit `9995950c70` and has been released as v0.70.0. There are no workarounds for this vulnerability. Users are advised to upgrade.
CVSS v3.1 score: 6.5
GHSA-p9r8-4cwf-v3w6 
Deserialization of Untrusted Data vulnerability in Smartdevth Advanced Advertising System allows Object Injection.This issue affects Advanced Advertising System: from n/a through 1.3.1.
CVSS v3.1 score: 9.8
CVE-2026-20985 
Improper input validation in Samsung Members prior to version 5.6.00.11 allows remote attackers to connect arbitrary URL and launch arbitrary activity with Samsung Members privilege. User interaction is required for triggering this vulnerability.
CVSS v4.0 score: 7
GHSA-c2vr-rq29-m6g9 
The President Clicker (aka com.flexymind.pclicker) application 1.0.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2007-0537 
The KDE HTML library (kdelibs), as used by Konqueror 3.5.5, does not properly parse HTML comments, which allows remote attackers to conduct cross-site scripting (XSS) attacks and bypass some XSS protection schemes by embedding certain HTML tags within a comment in a title tag, a related issue to CVE-2007-0478.
CVSS v2.0 score: 2.6
CVE-2017-3532 
Vulnerability in the Oracle Retail Warehouse Management System component of Oracle Retail Applications (subcomponent: Security). Supported versions that are affected are 13.2, 14.0 and 15.0. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Warehouse Management System. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Retail Warehouse Management System, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Retail Warehouse Management System accessible data as well as unauthorized read access to a subset of Oracle Retail Warehouse Management System accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
CVSS v3.0 score: 6.1
CVSS v2.0 score: 5.8
GHSA-ghwc-v2xp-4mwg 
A reflected cross-site scripting (XSS) vulnerability in the Captive Portal feature of Palo Alto Networks PAN-OS software enables execution of malicious JavaScript (in the context of an authenticated Captive Portal user’s browser) if a user clicks on a malicious link, allowing phishing attacks that could lead to credential theft.
CVSS v3.1 score: 4.3
CVE-2018-7419 
In Wireshark 2.2.0 to 2.2.12 and 2.4.0 to 2.4.4, the NBAP dissector could crash. This was addressed in epan/dissectors/asn1/nbap/nbap.cnf by ensuring DCH ID initialization.
CVSS v3.0 score: 7.5
CVSS v2.0 score: 5
CVE-2018-21103 
NETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user.
CVSS v3.0 score: 6.8
GHSA-83jj-67jw-3xvv 
GraphicsMagick before 1.3.35 has an integer overflow and resultant heap-based buffer overflow in HuffmanDecodeImage in magick/compress.c.
GHSA-g88p-ppwj-3qff 
A vulnerability in the IPv6 Router Advertisement (RA) packet processing of Cisco Access Point Software could allow an unauthenticated, adjacent attacker to modify the IPv6 gateway on an affected device.This vulnerability is due to a logic error in the processing of IPv6 RA packets that are received from wireless clients. An attacker could exploit this vulnerability by associating to a wireless network and sending a series of crafted IPv6 RA packets. A successful exploit could allow the attacker to temporarily change the IPv6 gateway of an affected device. This could also lead to intermittent packet loss for any wireless clients that are associated with the affected device.
CVSS v3.1 score: 4.3
CVE-2024-45509 
In MISP through 2.4.196, app/Controller/BookmarksController.php does not properly restrict access to bookmarks data in the case where the user is not an org admin.
CVSS v3.1 score: 9.8
GHSA-r464-pwqp-f636 
Relative path traversal in Windows User Interface Core allows an authorized attacker to elevate privileges locally.
CVSS v3.1 score: 7.8
CVE-2023-39434 
A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 17 and iPadOS 17, watchOS 10, macOS Sonoma 14. Processing web content may lead to arbitrary code execution.
CVSS v3.1 score: 8.8
GHSA-cpqx-fhwg-cr7g 
Server-side request forgery in the METS and IIIF import URI handling in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to make the server issue arbitrary HTTP requests to internal hosts, including the cloud instance metadata service, via the mets_uri or iiif_uri parameter of POST /api/documents/{pk}/imports/, because the IMPORT_ALLOWED_DOMAINS setting defaults to '*' and no address filtering, redirect cap or timeout is applied
CVSS v3.1 score: 8.5
CVE-2022-1653 Social Share Buttons by Supsystic < 2.2.4 - Multiple CSRF
The Social Share Buttons by Supsystic WordPress plugin before 2.2.4 does not perform CSRF checks in it's ajax endpoints and admin pages, allowing an attacker to trick any logged in user to manipulate or change the plugin settings, as well as create, delete and rename projects and networks.
CVSS v3.1 score: 4.3
CVSS v2.0 score: 4.3
CVE-2016-0266 
IBM AIX 5.3, 6.1, 7.1, and 7.2 and VIOS 2.2.x do not default to the latest TLS version, which makes it easier for man-in-the-middle attackers to obtain sensitive information via unspecified vectors.
CVSS v3.0 score: 3.7
CVSS v2.0 score: 4.3
CVE-2016-5193 
Google Chrome prior to 54.0 for iOS had insufficient validation of URLs for windows open by DOM, which allowed a remote attacker to bypass restrictions on navigation to certain URL schemes via crafted HTML pages.
CVSS v3.0 score: 4.3
CVSS v2.0 score: 4.3
CVE-2022-29960 
Emerson OpenBSI through 2022-04-29 uses weak cryptography. It is an engineering environment for the ControlWave and Bristol Babcock line of RTUs. DES with hardcoded cryptographic keys is used for protection of certain system credentials, engineering files, and sensitive utilities.
CVSS v3.1 score: 5.5
CVE-2018-17481 
Incorrect object lifecycle handling in PDFium in Google Chrome prior to 71.0.3578.98 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
CVSS v3.0 score: 8.8
CVSS v2.0 score: 6.8
CVE-2026-0958 Interpretation Conflict in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an unauthenticated user to cause denial of service through memory or CPU exhaustion by bypassing JSON validation middleware limits.
CVSS v3.1 score: 7.5
GHSA-cr7m-pjw9-g2r9 
Xen, possibly before 4.0.2, allows local 64-bit PV guests to cause a denial of service (host crash) by specifying user mode execution without user-mode pagetables.
RHSA-2022:6856 Red Hat Security Advisory: rh-ruby27-ruby security, bug fix, and enhancement update
ruby: buffer overflow in CGI.escape_html ruby: Regular expression denial of service vulnerability of Date parsing methods ruby: Cookie prefix spoofing in CGI::Cookie.parse ruby: Buffer overrun in String-to-Float conversion
CVSS v3.1 score: 6.2
GHSA-3j2c-8pr2-w8qp 
MilleGPG5 5.7.2 contains a local privilege escalation vulnerability that allows authenticated users to modify service executable files in the MariaDB bin directory. Attackers can replace the mysqld.exe with a malicious executable, which will execute with system privileges when the computer restarts.
CVSS v4.0 score: 8.5
CVSS v3.1 score: 7.8
CVE-2019-15333 
The Lava Flair Z1 Android device with a build fingerprint of LAVA/Z1/Z1:8.1.0/O11019/1536680131:user/release-keys contains a pre-installed app with a package name of com.android.lava.powersave app (versionCode=400, versionName=v4.0.27) that allows any app co-located on the device to programmatically disable and enable Wi-Fi without the corresponding access permission through an exported interface.
CVSS v3.1 score: 3.3
CVSS v2.0 score: 2.1
GHSA-wp4r-c6wp-5m5q 
SQL Injection in download student learning course function of Easytest Online Test Platform ver.24E01 and earlier allow remote attackers to execute arbitrary SQL commands via the uid parameter.
CVSS v4.0 score: 9.3
CVSS v3.1 score: 9.8
CVE-2023-27033 
Prestashop cdesigner v3.1.3 to v3.1.8 was discovered to contain a code injection vulnerability via the component CdesignerSaverotateModuleFrontController::initContent().
CVSS v3.1 score: 9.8
CVE-2025-48907 
Deserialization vulnerability in the IPC module
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS v3.1 score: 6.2
CVE-2015-2110 
Buffer overflow in HP LoadRunner 11.52 allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS v2.0 score: 10
CVE-2019-7474 
A vulnerability in SonicWall SonicOS and SonicOSv, allow authenticated read-only admin to leave the firewall in an unstable state by downloading certificate with specific extension. This vulnerability affected SonicOS Gen 5 version 5.9.1.10 and earlier, Gen 6 version 6.2.7.3, 6.5.1.3, 6.5.2.2, 6.5.3.1, 6.2.7.8, 6.4.0.0, 6.5.1.8, 6.0.5.3-86o and SonicOSv 6.5.0.2-8v_RC363 (VMWARE), 6.5.0.2.8v_RC367 (AZURE), SonicOSv 6.5.0.2.8v_RC368 (AWS), SonicOSv 6.5.0.2.8v_RC366 (HYPER_V).
CVSS v3.1 score: 6.5
CVSS v2.0 score: 4
CVE-2021-38491 
Mixed-content checks were unable to analyze opaque origins which led to some mixed content being loaded. This vulnerability affects Firefox < 92.
CVSS v3.1 score: 6.5
CVSS v2.0 score: 4.3
CVE-2021-27860 Arbitrary file upload vulnerability in FatPipe software
A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p92 and 10.2.2r44p1 allows a remote, unauthenticated attacker to upload a file to any location on the filesystem. The FatPipe advisory identifier for this vulnerability is FPSA006.
CVSS v3.1 score: 9.8
CVE-2025-5450 
Improper access control in the certificate management component of Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticated admin with read-only rights to modify settings that should be restricted.
CVSS v3.1 score: 6.3
GHSA-j4r5-9qqm-p694 
A use-after-free vulnerability in the Linux Kernel io_uring subsystem can be exploited to achieve local privilege escalation.Both io_install_fixed_file and its callers call fput in a file in case of an error, causing a reference underflow which leads to a use-after-free vulnerability.We recommend upgrading past commit 9d94c04c0db024922e886c9fd429659f22f48ea4.
CVSS v3.1 score: 7.8
CVE-2017-18296 
Access control on applications is not applied while accessing SafeSwitch services can lead to improper access in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear in version MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SD 845, SDA660, SDX20.
CVSS v3.0 score: 7.8
CVSS v2.0 score: 7.2
GHSA-m329-g327-9vjx 
Stack-based buffer overflow in the asf_mmst_streaming.c functionality for MPlayer 1.0pre5 allows remote attackers to execute arbitrary code via a large MMST stream packet.
GHSA-fmvc-vq6r-76m5 
An issue was discovered on FIRSTNUM JC21A-04 devices through 2.01ME/FN that allows authenticated attackers to execute arbitrary OS system commands with root privileges via crafted payloads to the xml_action.cgi?method= endpoint.
CVSS v3.1 score: 7.4
GHSA-j2hp-jqgm-85pf 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AccessAlly PopupAlly allows Stored XSS.This issue affects PopupAlly: from n/a through 2.1.1.
CVSS v3.1 score: 5.9
CVE-2018-19067 
An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. There is a hardcoded Ak47@99 password for the factory~ account.
CVSS v3.0 score: 9.8
CVSS v2.0 score: 10
GHSA-6g64-jqg9-j3wf 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemesGrove WidgetKit allows Stored XSS.This issue affects WidgetKit: from n/a through 2.5.4.
CVSS v3.1 score: 6.5
GHSA-7j49-vjx9-cwp7 
An issue was discovered in Spiceworks Help Desk Server before 1.3.3. A Blind Boolean SQL injection vulnerability within the order_by_for_ticket function in app/models/reporting/database_query.rb allows an authenticated attacker to execute arbitrary SQL commands via the sort parameter. This can be leveraged to leak local files from the host system, leading to remote code execution (RCE) through deserialization of malicious data.
CVSS v3.1 score: 9.9
CVE-2023-24954 Microsoft SharePoint Server Information Disclosure Vulnerability
Microsoft SharePoint Server Information Disclosure Vulnerability
CVSS v3.1 score: 6.5
CVE-2023-22883 Local Privilege Escalation in Zoom for Windows Installers
Zoom Client for IT Admin Windows installers before version 5.13.5 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability in an attack chain during the installation process to escalate their privileges to the SYSTEM user.
CVSS v3.1 score: 7.2
GHSA-vcfj-m4g8-j8jv 
Inappropriate implementation in Tab Strip in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
CVSS v3.1 score: 5.4