CIRCL/vulnerability-scores huggingface dataset:
GHSA-xxwg-crgx-46fg 
Unspecified vulnerability in the Oracle COREid Access component in Oracle Fusion Middleware 10.1.4.3.0 allows remote attackers to affect integrity via unknown vectors related to WebGate - WebServer plugin.
CVE-2022-33911 
An issue was discovered in Couchbase Server 7.x before 7.0.4. Field names are not redacted in logged validation messages for Analytics Service. An Unauthorized Actor may be able to obtain Sensitive Information.
CVSS v3.1 score: 5.3
CVSS v2.0 score: 5
CVE-2011-3835 
Multiple cross-site scripting (XSS) vulnerabilities in Wuzly 2.0 allow remote attackers to inject arbitrary web script or HTML via the Referer header to (1) admin/login.php and (2) admin/404.php; the (3) q parameter to search.php; the (4) theme_name parameter to theme_settings.php, (5) extension_name parameter to extension_settings.php, (6) q parameter to search.php, (7) type parameter to comments.php, sort parameter to (8) pages.php and (9) posts.php, and the (10) type and (11) q parameter to media.php in admin/; the sidebar parameter to (12) add_widget.php and (13) widgets.php, id parameter to (14) category_delete.php, (15) comment.php, (16) page_delete.php, and (17) post_delete.php, (18) type parameter to media.php, and (19) id and (20) sidebar parameter to widget_delete.php in mobile/; and the (21) name, (22) email, (23) website, and (24) comment parameters to index.php; and the (25) username parameter to admin/login.php.
CVSS v2.0 score: 4.3
GHSA-w3pj-v9jr-v2wc Jenkins ElectricFlow Plugin is vulnerable to reflected cross site scripting vulnerability
The configuration forms of various post-build steps contributed by CloudBees CD Plugin were vulnerable to cross-site scripting.This allowed attackers able to control the output of connected ElectricFlow servers' APIs to inject arbitrary HTML and JavaScript into the configuration form.CloudBees CD Plugin no longer interprets HTML/JavaScript in responses from ElectricFlow server APIs on job configuration forms.
CVSS v3.0 score: 4.7
GHSA-62v9-8446-g2pq 
Opera before 12.00 Beta allows remote attackers to cause a denial of service (memory consumption or application hang) via an IFRAME element that uses the src="#" syntax to embed a parent document.
GHSA-vw5p-68qx-65mr 
aEnrich eHRD Learning Management Key Performance Indicator System 5+ exposes Sensitive Information to an Unauthorized Actor.
CVSS v3.1 score: 7.5
CVE-2005-4389 
search.cfm in CONTENS 3.0 and earlier allows remote attackers to obtain the full server path via invalid (1) submit.y, (2) bool, (3) itemsperpage, (4) submit, (5) submit.x, (6) criteria, (7) advanced, and (8) intern parameters.
CVSS v2.0 score: 5
GHSA-75vj-p7j4-jjgc 
Win32k Elevation of Privilege Vulnerability
CVSS v3.1 score: 7
GHSA-w4vw-7rfq-g926 
Multiple cross-site scripting (XSS) vulnerabilities in INSERT pages in Cisco Prime Infrastructure allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCun21869.
CVE-2012-0212 
debdiff.pl in devscripts 2.10.x before 2.10.69 and 2.11.x before 2.11.4 allows remote attackers to execute arbitrary code via shell metacharacters in the file name argument.
CVSS v2.0 score: 9.3
GHSA-rff2-25mx-hcq2 
Multiple SQL injection vulnerabilities in includes/functions.php in Pro Chat Rooms Text Chat Rooms 8.2.0 allow remote authenticated users to execute arbitrary SQL commands via the (1) password, (2) email, or (3) id parameter.
GHSA-xpch-qhw2-xgh6 
A vulnerability classified as critical has been found in Tenda AC15 15.13.07.13. This affects the function formSetDevNetName of the file /goform/SetDevNetName. The manipulation of the argument mac leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 8.7
CVSS v3.1 score: 8.8
CVE-2005-2191 
Multiple cross-site scripting (XSS) vulnerabilities in Comersus shopping cart allow remote attackers to inject arbitrary web script or HTML via the (1) name parameter to comersus_backoffice_listAssignedPricesToCustomer.asp or (2) message parameter to comersus_backoffice_message.asp.
CVSS v2.0 score: 4.3
GHSA-2x3r-qhc4-2pjr 
The Visual Sound WordPress plugin through 1.03 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVSS v3.1 score: 6.5
CVE-2025-30628 WordPress Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer) plugin <= 1.2 - SQL Injection Vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer) allows SQL Injection.This issue affects Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer): from n/a through 1.2.
CVSS v3.1 score: 8.5
GHSA-7w2h-cxpv-f987 
The DNP3 service in the Outstation component on Elecsys Director Gateway devices with kernel 2.6.32.11ael1 and earlier allows remote attackers to cause a denial of service (CPU consumption and communication outage) via crafted input.
CVE-2026-71236 Grocy - Stored XSS via HTMLPurifier Output Double-Decode
Grocy's API request-body parser (controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody) purifies incoming field values with HTMLPurifier, then manually reverses HTML-entity encoding of the resulting output by replacing &amp;lt;, &amp;gt;, and &amp;amp; back to <, >, and & immediately after purification.
CVSS v3.1 score: 8.7
GHSA-jh9x-xg8c-g83m 
NREL BEopt 2.8.0.0 contains a DLL hijacking vulnerability that allows attackers to load arbitrary libraries by tricking users into opening application files from remote shares. Attackers can exploit insecure library loading of sdl2.dll and libegl.dll by placing malicious libraries on WebDAV or SMB shares to execute unauthorized code.
CVSS v4.0 score: 8.6
CVSS v3.1 score: 9.8
GHSA-fgp6-8g62-qx6w Malicious Package in smartsearchwp
All versions of `smartsearchwp` contain malicious code. The package is malware intended to steal credentials from websites it is loaded in. It traverses DOM elements looking for fields such as `username` and `password` and uploads it to a remote server. The package also port-scans the local gateway and uploads the information to the remote server. It has a feature to fetch commands from the remote server and execute them with `eval`. The npm security team analysis found several bugs in the malware that prevent it from actually performing its actions. The malicious code is also not invoked upon installation or require; it would require transpiling TypeScript code and using it in a website.RecommendationRemove the package from your environment. There is no indication of further compromise.
CVSS v3.1 score: 9.8
CVE-2024-37467 WordPress Hestia theme <= 3.1.2 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in themeisle Hestia hestia allows Cross Site Request Forgery.This issue affects Hestia: from n/a through <= 3.1.2.
CVSS v3.1 score: 4.3
GHSA-r9q3-942v-rjv9 
IOBit IOTransfer V4 is vulnerable to Unquoted Service Path.
CVSS v3.1 score: 7.8
CVE-2010-4435 
Unspecified vulnerability in Oracle Solaris 8, 9, and 10 allows remote attackers to affect confidentiality, integrity, and availability, related to CDE Calendar Manager Service Daemon and RPC.  NOTE: the previous information was obtained from the January 2011 CPU.  Oracle has not commented on claims from other software vendors that this affects other operating systems, such as HP-UX, or claims from a reliable third party that this is a buffer overflow in rpc.cmsd via long XDR-encoded ASCII strings in RPC call 10.
CVSS v2.0 score: 10
GHSA-352w-hccj-h98p 
Out-of-bounds read in Windows Win32K allows an authorized attacker to elevate privileges locally.
CVSS v3.1 score: 7.8
GHSA-9q4r-jrvx-7p2q 
GNOME Geary before 3.36.3 mishandles pinned TLS certificate verification for IMAP and SMTP services using invalid TLS certificates (e.g., self-signed certificates) when the client system is not configured to use a system-provided PKCS#11 store. This allows a meddler in the middle to present a different invalid certificate to intercept incoming and outgoing mail.
CVSS v3.1 score: 5.9
GHSA-j5h2-mqh2-gh66 
Multiple vulnerabilities in the web UI of Cisco Smart Software Manager Satellite could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS v3.1 score: 9.8
GHSA-3mv4-59rc-qvqm 
WordPress before 5.2.3 allows XSS in post previews by authenticated users.
CVSS v3.1 score: 5.4
GHSA-r66f-5793-9ccw 
Unauthorized access vulnerability in ROS2 Iron Irwini in ROS_VERSION is 2 and ROS_PYTHON_VERSION is 3, allows remote attackers to gain control of multiple ROS2 nodes. Unauthorized information access to these nodes could result in compromised system integrity, the execution of arbitrary commands, and disclosure of sensitive information.
CVE-2022-47583 
Terminal character injection in Mintty before 3.6.3 allows code execution via unescaped output to the terminal.
CVSS v3.1 score: 9.8
GHSA-252p-hhm3-3h4m 
The administration capability for Apple AirPort 802.11 wireless access point devices uses weak encryption (XOR with a fixed key) for protecting authentication credentials, which could allow remote attackers to obtain administrative access via sniffing when the capability is available via Ethernet or non-WEP connections.
CVE-2018-17312 
On the RICOH Aficio MP 301 printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi.
CVSS v3.0 score: 6.1
CVSS v2.0 score: 4.3
RHSA-2025:3635 Red Hat Security Advisory: Red Hat Ceph Storage 8.0 security, bug fix, and enhancement updates
oath-toolkit: Local root exploit in a PAM module
CVSS v3.1 score: 7.1
GHSA-26pg-vhv9-6fgm 
In some SAP standard roles, in SAP_ABA versions, 7.00 to 7.02, 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50, 75C to 75D, a transaction code reserved for customer is used. By implementing such transaction code a malicious user may execute unauthorized transaction functionality.
CVSS v3.0 score: 7.2
GHSA-73v6-qr33-qrch 
The uxterm terminal emulator allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands.
CVE-2026-44899 Mistune Image Directive CSS Injection Vulnerability
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, the Image directive plugin validates the :width: and :height: options with a regex compiled as _num_re = re.compile(r"^\d+(?:\.\d*)?"). When the validated value is not a plain integer, render_block_image() inserts it directly into a style="width:...;" or style="height:...;" attribute. Because the value was accepted by the prefix-only regex, any CSS after the leading digits reaches the style= attribute verbatim and without escaping. This vulnerability is fixed in 3.2.1.
CVSS v3.1 score: 4.7
CVE-2022-20752 Cisco Unified Communications Products Timing Attack Vulnerability
A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection could allow an unauthenticated, remote attacker to perform a timing attack. This vulnerability is due to insufficient protection of a system password. An attacker could exploit this vulnerability by observing the time it takes the system to respond to various queries. A successful exploit could allow the attacker to determine a sensitive system password.
CVSS v3.1 score: 5.3
CVE-2023-40633 
In phasecheckserver, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
CVSS v3.1 score: 5.5
CVE-2024-43892 memcg: protect concurrent access to mem_cgroup_idr
In the Linux kernel, the following vulnerability has been resolved:

memcg: protect concurrent access to mem_cgroup_idr

Commit 73f576c04b94 ("mm: memcontrol: fix cgroup creation failure after
many small jobs") decoupled the memcg IDs from the CSS ID space to fix the
cgroup creation failures.  It introduced IDR to maintain the memcg ID
space.  The IDR depends on external synchronization mechanisms for
modifications.  For the mem_cgroup_idr, the idr_alloc() and idr_replace()
happen within css callback and thus are protected through cgroup_mutex
from concurrent modifications.  However idr_remove() for mem_cgroup_idr
was not protected against concurrency and can be run concurrently for
different memcgs when they hit their refcnt to zero.  Fix that.

We have been seeing list_lru based kernel crashes at a low frequency in
our fleet for a long time.  These crashes were in different part of
list_lru code including list_lru_add(), list_lru_del() and reparenting
code.  Upon further inspection, it looked like for a given object (dentry
and inode), the super_block's list_lru didn't have list_lru_one for the
memcg of that object.  The initial suspicions were either the object is
not allocated through kmem_cache_alloc_lru() or somehow
memcg_list_lru_alloc() failed to allocate list_lru_one() for a memcg but
returned success.  No evidence were found for these cases.

Looking more deeply, we started seeing situations where valid memcg's id
is not present in mem_cgroup_idr and in some cases multiple valid memcgs
have same id and mem_cgroup_idr is pointing to one of them.  So, the most
reasonable explanation is that these situations can happen due to race
between multiple idr_remove() calls or race between
idr_alloc()/idr_replace() and idr_remove().  These races are causing
multiple memcgs to acquire the same ID and then offlining of one of them
would cleanup list_lrus on the system for all of them.  Later access from
other memcgs to the list_lru cause crashes due to missing list_lru_one.
CVSS v3.1 score: 7.8
CVE-2024-47270 
Improper preservation of permissions vulnerability in Archiving Push functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with administrator privileges to limited file write via unspecified vectors.
CVSS v3.1 score: 2.7
CVE-2005-1003 
Directory traversal vulnerability in index.php for ProfitCode PayProCart 3.0 allows remote attackers to include arbitrary PHP files via .. (dot dot) sequences in the modID parameter.
CVSS v2.0 score: 7.5
GHSA-mg35-fw68-x22w 
In the Linux kernel, the following vulnerability has been resolved:netdev: prevent accessing NAPI instances from another namespaceThe NAPI IDs were not fully exposed to user space prior to the netlink
API, so they were never namespaced. The netlink API must ensure that
at the very least NAPI instance belongs to the same netns as the owner
of the genl sock.napi_by_id() can become static now, but it needs to move because of
dev_get_by_napi_id().
CVSS v3.1 score: 5.5
GHSA-whx6-754g-3x5v 
An open redirect flaw was found in Kibana versions before 7.13.0 and 6.8.16. If a logged in user visits a maliciously crafted URL, it could result in Kibana redirecting the user to an arbitrary website.
CVSS v3.1 score: 6.1
CVE-2025-50647 
A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1, specifically in the handling of the wans parameter in the qos.asp endpoint.
CVSS v3.1 score: 7.5
GHSA-mwgw-4c23-7465 
In the Linux kernel, the following vulnerability has been resolved:serial: Fix not set tty->port race conditionRevert commit bfc467db60b7 ("serial: remove redundant
tty_port_link_device()") because the tty_port_link_device() is not
redundant: the tty->port has to be confured before we call
uart_configure_port(), otherwise user-space can open console without TTY
linked to the driver.This tty_port_link_device() was added explicitly to avoid this exact
issue in commit fb2b90014d78 ("tty: link tty and port before configuring
it as console"), so offending commit basically reverted the fix saying
it is redundant without addressing the actual race condition presented
there.Reproducible always as tty->port warning on Qualcomm SoC with most of
devices disabled, so with very fast boot, and one serial device being
the console:printk: legacy console [ttyMSM0] enabled
  printk: legacy console [ttyMSM0] enabled
  printk: legacy bootconsole [qcom_geni0] disabled
  printk: legacy bootconsole [qcom_geni0] disabled
  ------------[ cut here ]------------
  tty_init_dev: ttyMSM driver does not set tty->port. This would crash the kernel. Fix the driver!
  WARNING: drivers/tty/tty_io.c:1414 at tty_init_dev.part.0+0x228/0x25c, CPU#2: systemd/1
  Modules linked in: socinfo tcsrcc_eliza gcc_eliza sm3_ce fuse ipv6
  CPU: 2 UID: 0 PID: 1 Comm: systemd Tainted: G S                  6.19.0-rc4-next-20260108-00024-g2202f4d30aa8 #73 PREEMPT
  Tainted: [S]=CPU_OUT_OF_SPEC
  Hardware name: Qualcomm Technologies, Inc. Eliza (DT)
  ...
  tty_init_dev.part.0 (drivers/tty/tty_io.c:1414 (discriminator 11)) (P)
  tty_open (arch/arm64/include/asm/atomic_ll_sc.h:95 (discriminator 3) drivers/tty/tty_io.c:2073 (discriminator 3) drivers/tty/tty_io.c:2120 (discriminator 3))
  chrdev_open (fs/char_dev.c:411)
  do_dentry_open (fs/open.c:962)
  vfs_open (fs/open.c:1094)
  do_open (fs/namei.c:4634)
  path_openat (fs/namei.c:4793)
  do_filp_open (fs/namei.c:4820)
  do_sys_openat2 (fs/open.c:1391 (discriminator 3))
  ...
  Starting Network Name Resolution...Apparently the flow with this small Yocto-based ramdisk user-space is:driver (qcom_geni_serial.c):                  user-space:
============================                  ===========
qcom_geni_serial_probe()
 uart_add_one_port()
  serial_core_register_port()
   serial_core_add_one_port()
    uart_configure_port()
     register_console()
    |
    |                                         open console
    |                                          ...
    |                                          tty_init_dev()
    |                                           driver->ports[idx] is NULL
    |
    tty_port_register_device_attr_serdev()
     tty_port_link_device() <- set driver->ports[idx]
CVSS v3.1 score: 4.7
GHSA-g8h2-q2mr-m37j 
Elcomplus SmartPTT SCADA Server web application does not, or cannot, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3.1 score: 8.8
CVE-2007-5628 
PHP remote file inclusion vulnerability in src/scripture.php in The Online Web Library Site (TOWels) 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the pageHeaderFile parameter.
CVSS v2.0 score: 6.8
GHSA-c8m3-9rx4-4cq6 
Stack-based buffer overflow in the dhost module in Novell eDirectory 8.8 SP5 for Windows allows remote authenticated users to execute arbitrary code via long sadminpwd and verifypwd parameters in a submit action to /dhost/httpstk.
GHSA-3jgf-c787-2jmh 
It was not possible to govern the rate at which the broker would respond to an echo flow, enabling an authenticated attacker to cause excessive resource usage and potential denial of service.This issue affects Apache Qpid Broker-J: through 10.0.1.Users are recommended to upgrade to version 10.1.0, which fixes the issue.
CVSS v3.1 score: 6.5
GHSA-45ff-cx94-f6g5 
Snap One OvrC Pro versions prior to 7.3 use HTTP connections when downloading a program from their servers. Because they do not use HTTPS, OvrC Pro devices are susceptible to exploitation.
CVSS v3.1 score: 7.5
CVE-2023-52085 Winter CMS Local File Inclusion through Server Side Template Injection 
Winter is a free, open-source content management system. Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be included without further processing in the compilation of custom stylesheets via LESS. This had the potential to lead to a Local File Inclusion vulnerability. This issue has been patched in v1.2.4.
CVSS v3.1 score: 3.3
CVE-2019-25225 
`sanitize-html` prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS). The `sanitizeHtml()` function in `index.js` does not sanitize content when using the custom `transformTags` option, which is intended to convert attribute values into text. As a result, malicious input can be transformed into executable code.
CVSS v3.1 score: 6.1
GHSA-p6x4-h8m9-9mr2 
The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input from form submissions. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
CVSS v3.1 score: 9.8
GHSA-hg2h-r57q-9hx4 
An issue has been found in libde265 v1.0.8 due to incorrect access control. A SEGV caused by a READ memory access in function derive_boundaryStrength of deblock.cc has occurred. The vulnerability causes a segmentation fault and application crash, which leads to remote denial of service.
CVSS v3.1 score: 5.5
GHSA-6fcr-87qh-q4w5 
A vulnerability, which was classified as problematic, has been found in MRCMS 3.1.2. Affected by this issue is some unknown functionality of the component Edit Article Page. The manipulation of the argument Title leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 4.8
CVSS v3.1 score: 2.4
GHSA-fpr3-j2r5-95c5 
Themify Builder WordPress plugin before 7.5.8 does not validate a parameter before redirecting the user to its value, leading to an Open Redirect issue
CVSS v3.1 score: 6.1
CVE-2015-9424 
The multicons plugin before 3.0 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=multicons%2Fmulticons.php global_url or admin_url parameter.
CVSS v3.1 score: 6.5
CVSS v2.0 score: 4.3
GHSA-9wf6-v4mm-mrhf 
foxcms v1.2.5 was discovered to contain an arbitrary file deletion vulnerability via the delRestoreSerie method.
CVSS v3.1 score: 9.1
CVE-2023-49657 Apache Superset: Stored XSS in Dashboard Title and Chart Title
A stored cross-site scripting (XSS) vulnerability exists in Apache Superset before 3.0.3. An authenticated attacker with create/update permissions on charts or dashboards could store a script or add a specific HTML snippet that would act as a stored XSS.

For 2.X versions, users should change their config to include:

TALISMAN_CONFIG = {
    "content_security_policy": {
        "base-uri": ["'self'"],
        "default-src": ["'self'"],
        "img-src": ["'self'", "blob:", "data:"],
        "worker-src": ["'self'", "blob:"],
        "connect-src": [
            "'self'",
            " https://api.mapbox.com" https://api.mapbox.com" ;,
            " https://events.mapbox.com" https://events.mapbox.com" ;,
        ],
        "object-src": "'none'",
        "style-src": [
            "'self'",
            "'unsafe-inline'",
        ],
        "script-src": ["'self'", "'strict-dynamic'"],
    },
    "content_security_policy_nonce_in": ["script-src"],
    "force_https": False,
    "session_cookie_secure": False,
}


CVSS v3.1 score: 9.6
CVE-2004-0900 
The DHCP Server service for Microsoft Windows NT 4.0 Server and Terminal Server Edition does not properly validate the length of certain messages, which allows remote attackers to execute arbitrary code via a malformed DHCP message, aka the "DHCP Request Vulnerability."
CVSS v2.0 score: 10
CVE-2025-63294 
WorkDo HRM SaaS HR and Payroll Tool 8.1 is affected vulnerable to Insecure Permissions. An authenticated user can create leave or resignation records on behalf of other users.
CVSS v3.1 score: 6.5
CVE-2015-1657 
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS v2.0 score: 9.3
GHSA-5xqr-9392-q49j 
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.
CVSS v3.1 score: 8.8
CVE-2023-33193 Emby Server Proxy Header Spoofing Vulnerability
Emby Server is a user-installable home media server which stores and organizes a user's media files of virtually any format and makes them available for viewing at home and abroad on a broad range of client devices. This vulnerability may allow administrative access to an Emby Server system, depending on certain user account settings. By spoofing certain headers which are intended for interoperation with reverse proxy servers, it may be possible to affect the local/non-local network determination to allow logging in without password or to view a list of user accounts which may have no password configured. Impacted are all Emby Server system which are publicly accessible and where the administrator hasn't tightened the account login configuration for administrative users. This issue has been patched in Emby Server Beta version 4.8.31 and Emby Server version 4.7.12.


CVSS v3.1 score: 9.1
GHSA-x4qx-c389-cj23 
Windows Cloud Files Mini Filter Driver Information Disclosure Vulnerability
CVSS v3.1 score: 5.5
PYSEC-2021-654 
TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a division by 0 in `tf.raw_ops.QuantizedMul`. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/55900e961ed4a23b438392024912154a2c2f5e85/tensorflow/core/kernels/quantized_mul_op.cc#L188-L198) does a division by a quantity that is controlled by the caller. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
CVE-2016-6239 
The mmap extension __MAP_NOFAULT in OpenBSD 5.8 and 5.9 allows attackers to cause a denial of service (kernel panic and crash) via a large size value.
CVSS v3.0 score: 5.5
CVSS v2.0 score: 4.9
CVE-2018-16330 
Pandao Editor.md 1.5.0 allows XSS via crafted attributes of an invalid IMG element.
CVSS v3.0 score: 6.1
CVSS v2.0 score: 4.3
GHSA-gjqm-92cq-36rm 
A vulnerability was found in SourceCodester Shopping Website 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file forgot-password.php. The manipulation of the argument contact leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-232675.
CVSS v3.0 score: 6.3
CVE-2010-0889 
Unspecified vulnerability in the Solaris component in Oracle Sun Product Suite OpenSolaris snv_68 through snv_128 allows local users to affect confidentiality via unknown vectors related to the Kernel.
CVSS v2.0 score: 4.9
RHSA-2025:7049 Red Hat Security Advisory: python-requests security update
requests: subsequent requests to the same host ignore cert verification
CVSS v3.1 score: 5.6
CVE-2009-2080 
admin.php in MRCGIGUY The Ticket System 2.0 does not properly restrict access, which allows remote attackers to (1) obtain sensitive configuration information via the editconfig action or (2) change the administrator's password via the id parameter in an editop action.
CVSS v2.0 score: 7.5
GHSA-mrvv-fwrw-5pgv 
An issue was discovered in the Linux kernel through 5.16-rc6. mtk_vcodec_fw_vpu_init in drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_vpu.c lacks check of the return value of devm_kzalloc() and will cause the null pointer dereference.
CVSS v3.1 score: 5.5
CVE-2024-53076 iio: gts-helper: Fix memory leaks for the error path of iio_gts_build_avail_scale_table()
In the Linux kernel, the following vulnerability has been resolved:

iio: gts-helper: Fix memory leaks for the error path of iio_gts_build_avail_scale_table()

If per_time_scales[i] or per_time_gains[i] kcalloc fails in the for loop
of iio_gts_build_avail_scale_table(), the err_free_out will fail to call
kfree() each time when i is reduced to 0, so all the per_time_scales[0]
and per_time_gains[0] will not be freed, which will cause memory leaks.

Fix it by checking if i >= 0.
CVSS v3.1 score: 7.8
CVE-2022-3513 
An issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. A specially crafted payload could lead to a reflected XSS on the client side which allows attackers to perform arbitrary actions on behalf of victims on self-hosted instances running without strict CSP.
CVSS v3.1 score: 6.1
CVE-2012-4390 
(1) apps/calendar/appinfo/remote.php and (2) apps/contacts/appinfo/remote.php in ownCloud before 4.0.7 allows remote authenticated users to enumerate the registered users via unspecified vectors.
CVSS v2.0 score: 4
CVE-2017-15336 
The SIP backup feature in Huawei DP300 V500R002C00, IPS Module V100R001C10, V100R001C20, V100R001C30, V500R001C00, V500R001C20, V500R001C30, V500R001C50, NGFW Module V100R001C10, V100R001C20, V100R001C30, V500R001C00, V500R001C20, V500R002C00, V500R002C10, NIP6300 V500R001C00, V500R001C20, V500R001C30, V500R001C50, NIP6600 V500R001C00, V500R001C20, V500R001C30, V500R001C50, NIP6800 V500R001C50, RP200 V500R002C00, V600R006C00, SVN5600 V200R003C00, V200R003C10, SVN5800 V200R003C00, V200R003C10, SVN5800-C V200R003C00, V200R003C10, SeMG9811 V300R001C01, Secospace USG6300 V100R001C10, V100R001C20, V100R001C30, V500R001C00, V500R001C20, V500R001C30, V500R001C50, Secospace USG6500 V100R001C10, V100R001C20, V100R001C30, V500R001C00, V500R001C20, V500R001C30, V500R001C50, Secospace USG6600 V100R001C00, V100R001C20, V100R001C30, V500R001C00, V500R001C20, V500R001C30, V500R001C50, TE30 V100R001C02, V100R001C10, V500R002C00, V600R006C00, TE40 V500R002C00, V600R006C00, TE50 V500R002C00, V600R006C00, TE60 V100R001C01, V100R001C10, V500R002C00, V600R006C00, USG9500 V500R001C00, V500R001C20, V500R001C30, USG9520 V300R001C01, V300R001C20, USG9560 V300R001C01, V300R001C20, USG9580 V300R001C01, V300R001C20, VP9660 V200R001C02, V200R001C30, V500R002C00, V500R002C10, ViewPoint 8660 V100R008C03, ViewPoint 9030 V100R011C02, V100R011C03, eSpace U1981 V100R001C20, V200R003C00, V200R003C20, V200R003C30 has a buffer overflow vulnerability. An attacker may send specially crafted messages to the affected products. Due to the insufficient validation of some values for SIP messages, successful exploit may cause services abnormal.
CVSS v3.0 score: 5.3
CVSS v2.0 score: 5
GHSA-fq9q-4qp8-fpvg 
SQL injection vulnerability in brokenlink.php in the mylinks module for XOOPS allows remote attackers to execute arbitrary SQL commands via the lid parameter.
GHSA-33v9-7cpf-3wr4 
Out-of-bounds read in Push Message Routing Service allows an authorized attacker to disclose information locally.
CVSS v3.1 score: 5.5
CVE-2020-15183 Reflected XSS leading to RCE in SoyCMS
SoyCMS 3.0.2 and earlier is affected by Reflected Cross-Site Scripting (XSS) which leads to Remote Code Execution (RCE) from a known vulnerability. This allows remote attackers to force the administrator to edit files once the adminsitrator loads a specially crafted webpage.
CVSS v3.1 score: 8.4
GHSA-83px-qcvf-3rv7 
An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider (for example) file.jsp::$DATA to the admin/comn/service/editUploadImage URI.
CVSS v3.0 score: 8.8
CVE-2021-21028 Acrobat Reader DC Use-After-Free Vulnerability Could Lead To Arbitrary Code Execution
Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by a Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.0 score: 8.8
GHSA-6pgx-qr5g-3pj9 
A vulnerability was identified in SourceCodester Online Bank Management System up to 1.0. This issue affects some unknown processing of the file /bank/statements.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely.
CVSS v4.0 score: 5.5
CVSS v3.1 score: 7.3
RHSA-2005:608 Red Hat Security Advisory: httpd security update
security flaw security flaw
CVE-2023-27512 
Use of hard-coded credentials exists in SolarView Compact SV-CPT-MC310 versions prior to Ver.8.10, and SV-CPT-MC310F versions prior to Ver.8.10, which may allow a remote authenticated attacker to login the affected product with an administrative privilege and perform an unintended operation.
CVSS v3.1 score: 7.2
GHSA-gm47-3xmp-7h63 
Cross-site scripting (XSS) vulnerability in tenfourzero Shutter 0.1.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
GHSA-8m4r-xfjr-cfgm 
Primary Source Verification in VerityStream MSOW Solutions before 3.1.1 allows an anonymous internet user to discover Social Security Number (SSN) values via a brute-force attack on a (sometimes hidden) search field, because the last four SSN digits are part of the supported combination of search selectors. This discloses doctors' and nurses' social security numbers and PII.
CVSS v3.1 score: 7.5
GHSA-w737-xjxg-h9mw 
LibTIFF is vulnerable to an integer overflow. This flaw allows remote attackers to cause a denial of service (application crash) or possibly execute an arbitrary code via a crafted tiff image, which triggers a heap-based buffer overflow.
CVSS v3.1 score: 6.5
RHSA-2017:1802 Red Hat Security Advisory: Red Hat JBoss Web Server Service Pack 1 security update
openssl: OCSP Status Request extension unbounded memory growth openssl: ECDSA P-256 timing attack key recovery SSL/TLS: Malformed plain-text ALERT packets could cause remote DoS log4j: Socket receiver deserialization vulnerability tomcat: Incorrect handling of pipelined requests when send file was used tomcat: Calls to application listeners did not use the appropriate facade object tomcat: Security constrained bypass in error page mechanism tomcat: Vary header not added by CORS filter leading to cache poisoning log4j: deserialization of untrusted data in SocketServer
CVSS v3.1 score: 9.8
CVSS v3.0 score: 5.9
CVE-2026-63821 wifi: rtw88: usb: fix memory leaks on USB write failures
In the Linux kernel, the following vulnerability has been resolved:

wifi: rtw88: usb: fix memory leaks on USB write failures

When rtw_usb_write_port() fails to submit a USB Request Block (URB)
(e.g., due to device disconnect or ENOMEM), the completion callback is
never executed.

Currently, the driver ignores the return value of rtw_usb_write_port()
in rtw_usb_write_data() and rtw_usb_tx_agg_skb(). Because these
functions rely on the completion callback to free the socket buffers
(skbs) and the transaction control block (txcb), a submission failure
results in:
1. A memory leak of the allocated skb in rtw_usb_write_data().
2. A memory leak of the txcb structure and all aggregated skbs in
   rtw_usb_tx_agg_skb().

Fix this by checking the return value of rtw_usb_write_port(). If it
fails, explicitly free the skb in rtw_usb_write_data(), and properly
purge the tx_ack_queue and free the txcb in rtw_usb_tx_agg_skb().

The issue was discovered in practice during device disconnect/reconnect
scenarios and memory pressure conditions. Tested by verifying normal TX
operation continues after the fix without regressions.
CVE-2017-11833 
Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to determine the origin of all webpages in the affected browser, due to how Microsoft Edge handles cross-origin requests, aka "Microsoft Edge Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-11803 and CVE-2017-11844.
CVSS v3.0 score: 3.1
CVSS v2.0 score: 2.6
GHSA-fjfg-mw6f-pr6w 
RAONWIZ v2018.0.2.50 and eariler versions contains a vulnerability that could allow remote files to be downloaded and excuted by lack of validation to file extension, witch can used as remote-code-excution attacks by hackers File download & execution vulnerability in ____COMPONENT____ of RAONWIZ RAON KUpload allows ____ATTACKER/ATTACK____ to cause ____IMPACT____. This issue affects: RAONWIZ RAON KUpload 2018.0.2.50 versions prior to 2018.0.2.51 on Windows.
CVE-2006-1592 
Buffer overflow in the is_client_wad_ok function in w_wad.cpp for (1) Zdaemon 1.08.01 and (2) X-Doom allows remote attackers to execute arbitrary code via a long filename argument.
CVSS v2.0 score: 7.5
CVE-2014-0618 
Juniper Junos before 10.4 before 10.4R16, 11.4 before 11.4R8, 12.1R before 12.1R7, 12.1X44 before 12.1X44-D20, and 12.1X45 before 12.1X45-D10 on SRX Series service gateways, when used as a UAC enforcer and captive portal is enabled, allows remote attackers to cause a denial of service (flowd crash) via a crafted HTTP message.
CVSS v2.0 score: 7.8
CVE-2006-2126 
SQL injection vulnerability in pocategories.php in MaxTrade 1.0.1 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) categori and (2) stranica parameters.
CVSS v2.0 score: 6.4
CVE-2022-35262 
A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can lead to denial of service. An attacker can send a sequence of requests to trigger this vulnerability.This denial of service is in the `/action/import_xml_file/` API.
CVSS v3.0 score: 4.9
RHSA-2015:0079 Red Hat Security Advisory: java-1.7.0-oracle security update
SSL/TLS: Padding Oracle On Downgraded Legacy Encryption attack ICU: font parsing OOB read (OpenJDK 2D, 8055489) OpenJDK: MulticastSocket NULL pointer dereference (Libraries, 8056264) ICU: font parsing OOB read (OpenJDK 2D, 8056276) OpenJDK: incorrect tracking of ChangeCipherSpec during SSL/TLS handshake (JSSE, 8057555) OpenJDK: class verifier insufficient invokespecial calls verification (Hotspot, 8058982) OpenJDK: insecure hsperfdata temporary file handling (Hotspot, 8050807) OpenJDK: phantom references handling issue in garbage collector (Hotspot, 8047125) JDK: unspecified vulnerability fixed in 6u91, 7u75 and 8u31 (Deployment) JDK: unspecified vulnerability fixed in 6u91, 7u75 and 8u31 (Deployment) OpenJDK: directory information leak via file chooser (Swing, 8055304) OpenJDK: incorrect context class loader use in RMI transport (RMI, 8055309) OpenJDK: DER decoder infinite loop  (Security, 8059485) OpenJDK: insufficient code privileges checks (JAX-WS, 8054367) JDK: unspecified vulnerability fixed in 7u75 and 8u31 (Serviceability)
CVE-2026-12349 Premium Addons for KingComposer <= 1.1.1 - Missing Authorization to Unauthenticated Arbitrary Custom Sidebar Creation and Deletion via 'add_custom_sidebar' and 'remove_custom_sidebar' AJAX actions
The Premium Addons for KingComposer plugin for WordPress is vulnerable to unauthorized modification and loss of data in versions up to, and including, 1.1.1. This is due to missing authorization and capability checks on the add_custom_sidebar() and remove_custom_sidebar() AJAX handlers, both of which are exposed through wp_ajax_nopriv_* hooks and write directly to the octagon_custom_sidebar option via update_option(). This makes it possible for unauthenticated attackers to create arbitrary custom widget areas or delete existing custom sidebars, which can cause widgets assigned to those areas to silently lose their registration and stop rendering.
CVSS v3.1 score: 5.3
CVE-2000-0524 
Microsoft Outlook and Outlook Express allow remote attackers to cause a denial of service by sending email messages with blank fields such as BCC, Reply-To, Return-Path, or From.
CVSS v2.0 score: 5
GHSA-4rf6-pvq6-2g27 
Inappropriate implementation in CORS in Google Chrome prior to 113.0.5672.63 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVSS v3.1 score: 4.3
CVE-2025-54970 
An issue was discovered in BAE SOCET GXP before 4.6.0.2. The SOCET GXP Job Status Service fails to authenticate requests. In some configurations, this may allow remote or local users to abort jobs or read information without the permissions of the job owner.
CVSS v3.1 score: 6.5
GHSA-5g4j-78x8-fff7 
All versions of ETIC Telecom Remote Access Server (RAS) 4.5.0 and prior’s web portal is vulnerable to accepting malicious firmware packages that could provide a backdoor to an attacker and provide privilege escalation to the device.
CVSS v3.1 score: 10
RHSA-2024:10273 Red Hat Security Advisory: kernel security update
kernel: vsock: remove vsock from connected table when connect is interrupted by a signal
CVSS v3.1 score: 4.4
CVE-2025-1773 Traveler <= 3.1.8  - Reflected Cross-Site Scripting
The Traveler theme for WordPress is vulnerable to Reflected Cross-Site Scripting via multiple parameters in all versions up to, and including, 3.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS v3.1 score: 6.1
CVE-2025-9091 Tenda AC20 shadow hard-coded credentials
A security flaw has been discovered in Tenda AC20 16.03.08.12. Affected by this vulnerability is an unknown functionality of the file /etc_ro/shadow. The manipulation leads to hard-coded credentials. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 2
CVSS v3.1 score: 2.5
CVSS v3.0 score: 2.5
CVSS v2.0 score: 1
CVE-2006-4611 
Buffer overflow in the _tor_resolve function in dsocks.c in dsocks before 1.4 allows remote attackers to execute arbitrary code via unspecified vectors, possibly involving a long node name.
CVSS v2.0 score: 7.5
GHSA-gj2x-phgq-7g9q 
In the Linux kernel, the following vulnerability has been resolved:ASoC: SOF: Intel: hda: Fix UAF when reloading modulehda_generic_machine_select() appends -idisp to the tplg filename by
allocating a new string with devm_kasprintf(), then stores the string
right back into the global variable snd_soc_acpi_intel_hda_machines.
When the module is unloaded, this memory is freed, resulting in a global
variable pointing to freed memory.  Reloading the module then triggers
a use-after-free:BUG: KFENCE: use-after-free read in string+0x48/0xe0Use-after-free read at 0x00000000967e0109 (in kfence-#99):
 string+0x48/0xe0
 vsnprintf+0x329/0x6e0
 devm_kvasprintf+0x54/0xb0
 devm_kasprintf+0x58/0x80
 hda_machine_select.cold+0x198/0x17a2 [snd_sof_intel_hda_generic]
 sof_probe_work+0x7f/0x600 [snd_sof]
 process_one_work+0x17b/0x330
 worker_thread+0x2ce/0x3f0
 kthread+0xcf/0x100
 ret_from_fork+0x31/0x50
 ret_from_fork_asm+0x1a/0x30kfence-#99: 0x00000000198a940f-0x00000000ace47d9d, size=64, cache=kmalloc-64allocated by task 333 on cpu 8 at 17.798069s (130.453553s ago):
 devm_kmalloc+0x52/0x120
 devm_kvasprintf+0x66/0xb0
 devm_kasprintf+0x58/0x80
 hda_machine_select.cold+0x198/0x17a2 [snd_sof_intel_hda_generic]
 sof_probe_work+0x7f/0x600 [snd_sof]
 process_one_work+0x17b/0x330
 worker_thread+0x2ce/0x3f0
 kthread+0xcf/0x100
 ret_from_fork+0x31/0x50
 ret_from_fork_asm+0x1a/0x30freed by task 1543 on cpu 4 at 141.586686s (6.665010s ago):
 release_nodes+0x43/0xb0
 devres_release_all+0x90/0xf0
 device_unbind_cleanup+0xe/0x70
 device_release_driver_internal+0x1c1/0x200
 driver_detach+0x48/0x90
 bus_remove_driver+0x6d/0xf0
 pci_unregister_driver+0x42/0xb0
 __do_sys_delete_module+0x1d1/0x310
 do_syscall_64+0x82/0x190
 entry_SYSCALL_64_after_hwframe+0x76/0x7eFix it by copying the match array with devm_kmemdup_array() before we
modify it.
CVSS v3.1 score: 7.8
RHSA-2024:8856 Red Hat Security Advisory: kernel security update
kernel: xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create kernel: gso: do not skip outer ip header in case of ipip and net_failover kernel: cifs: fix oops during encryption kernel: dmaengine: fix NULL pointer in channel unregistration function kernel: memcontrol: ensure memcg acquired by id is properly set up kernel: net/bluetooth: race condition in conn_info_{min,max}_age_set() kernel: netfilter: nf_conntrack_h323: Add protection for bmp length out of range kernel: netfilter: nft_set_pipapo: do not free live element kernel: KVM: Always flush async #PF workqueue when vCPU is being destroyed kernel: netfilter: nft_set_pipapo: walk over current view on netlink dump kernel: nouveau: lock the client object tree. kernel: netfilter: bridge: replace physindev with physinif in nf_bridge_info kernel: netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() kernel: dma-direct: Leak pages on dma_set_decrypted() failure kernel: bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq kernel: of: module: add buffer overflow check in of_modalias() kernel: r8169: Fix possible ring buffer corruption on fragmented Tx packets. kernel: net/mlx5e: Fix netif state handling kernel: netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type kernel: drm/i915/dpt: Make DPT object unshrinkable kernel: ipv6: prevent possible NULL deref in fib6_nh_init() kernel: tipc: force a dst refcount before doing decryption kernel: ACPICA: Revert &#34;ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine.&#34; kernel: bpf: Fix overrunning reservations in ringbuf kernel: netfilter: nf_tables: prefer nft_chain_validate kernel: ibmvnic: Add tx check to prevent skb leak kernel: drm/i915/gt: Fix potential UAF by revoke of fence registers kernel: drm/amdgpu: avoid using null object of framebuffer kernel: netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers kernel: gfs2: Fix NULL pointer dereference in gfs2_log_flush kernel: USB: serial: mos7840: fix crash on resume kernel: tipc: Return non-zero value from tipc_udp_addr2str() on error kernel: kobject_uevent: Fix OOB access within zap_modalias_env() kernel: dev/parport: fix the array out-of-bounds risk kernel: block: initialize integrity buffer to zero before writing it to media kernel: mlxsw: spectrum_acl_erp: Fix object nesting warning kernel: padata: Fix possible divide-by-0 panic in padata_mt_helper() kernel: memcg: protect concurrent access to mem_cgroup_idr kernel: sctp: Fix null-ptr-deref in reuseport_add_sock(). kernel: bonding: fix xfrm real_dev null pointer dereference kernel: bonding: fix null pointer deref in bond_ipsec_offload_ok kernel: netfilter: flowtable: initialise extack before use kernel: ethtool: check device is present when getting link settings kernel: ELF: fix kernel.randomize_va_space double read kernel: lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc()
CVSS v3.1 score: 4.7
CVE-2020-1583 Microsoft Word Information Disclosure Vulnerability
An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents of its memory. An attacker who exploited the vulnerability could use the information to compromise the user’s computer or data.
To exploit the vulnerability, an attacker could craft a special document file and then convince the user to open it. An attacker must know the memory address location where the object was created.
The update addresses the vulnerability by changing the way certain Word functions handle objects in memory.
CVSS v3.1 score: 8.8
CVE-2022-40282 
The web server of Hirschmann BAT-C2 before 09.13.01.00R04 allows authenticated command injection. This allows an authenticated attacker to pass commands to the shell of the system because the dir parameter of the FsCreateDir Ajax function is not sufficiently sanitized. The vendor's ID is BSECV-2022-21.
CVSS v3.1 score: 8.8