CIRCL/vulnerability-scores huggingface dataset:
GHSA-26qj-5g3c-qwm4 
Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier). If this vulnerability is exploited, arbitrary files may be viewed by a remote unauthenticated attacker.
CVSS v4.0 score: 8.7
CVSS v3.0 score: 7.5
CVE-2025-23271 
NVIDIA CUDA Toolkit for all platforms contains a vulnerability in the nvdisasm binary where a user may cause an out-of-bounds read by passing a malformed ELF file to nvdisasm. A successful exploit of this vulnerability may lead to a partial denial of service.
CVSS v3.1 score: 3.3
GHSA-xwqx-x38c-cw95 Snipe-IT 6.0.2 vulnerable to Cross-site Scripting
An arbitrary file upload vulnerability in the Select User function under the People Menu component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file.
CVSS v3.1 score: 4.8
CVE-2025-14834 code-projects Simple Stock System checkuser.php sql injection
A weakness has been identified in code-projects Simple Stock System 1.0. This affects an unknown function of the file /checkuser.php. Executing a manipulation of the argument Username can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 6.3
CVSS v3.0 score: 6.3
CVSS v2.0 score: 6.5
CVE-2014-2108 
Cisco IOS 12.2 and 15.0 through 15.3 and IOS XE 3.2 through 3.7 before 3.7.5S and 3.8 through 3.10 before 3.10.1S allow remote attackers to cause a denial of service (device reload) via a malformed IKEv2 packet, aka Bug ID CSCui88426.
CVSS v2.0 score: 7.8
RHSA-2026:21433 Red Hat Security Advisory: httpd security update
Apache HTTP Server: mod_proxy_ajp: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow httpd: mod_authn_socache: NULL pointer dereference can cause a child process crash httpd: mod_proxy_ajp: off-by-one out-of-bounds reads in AJP getter functions httpd: mod_proxy_ajp: heap-based buffer over-read due to missing null-termination check httpd: mod_proxy_ajp: heap-based buffer over-read and memory disclosure in ajp_parse_data()
CVSS v3.1 score: 8.2
GHSA-3qmc-2r76-4rqp Redwood is vulnerable to account takeover via dbAuth "forgot-password"
Impact_What kind of vulnerability is it? Who is impacted?_This is an API vulnerability in Redwood's [dbAuth], specifically the dbAuth forgot password feature:only projects with the dbAuth "forgot password" feature are affectedthis vulnerability was introduced in v0.38.0User Accounts are Vulnerable to Takeover (Hijacking)A reset token for any user can be obtained given knowledge of their username or email via the forgot-password API. With the leaked reset token, a malicious user could request to reset a user's password, changing their credentials and gaining access to their account.How to Determine if Projects have been AttackedTo determine if a project has been attacked, we recommend checking logs for suspicious activity; namely, the volume of requests to the forgot-password API using emails that don't exist. Another indication is if users inform you that they can't access their accounts.If you have question or concerns, reach out via the "For More Information" section below.Patch Releases Available**The problem has been patched on the v3 and v2 release lines.** Users should upgrade to **v3.3.1+**  or **v2.2.5+** respectively.Workarounds_Is there a way for users to fix or remediate the vulnerability without upgrading?_We recommend upgrading to the Patch Releases above. If upgrading is not possible, there are several workarounds:Manually strip out `resetToken` and `resetTokenExpiresAt` in the `forgotPassword.handler()`Users on all release lines can have their `forgotPassword.handler()` function strip out the sensitive fields manually before returningUse `yarn patch` to manually apply the fixUsers on v3 and v2 can use [`yarn patch`] to apply the fix if they're using yarn v3. See the dbAuth "forgot-password" Account Takeover Vulnerability high gist for instructions.Disable the forgot password flow entirely v3 onlyUsers on v3 can disable the forgot password flow entirely.
CVSS v3.1 score: 8.2
GHSA-6vp6-c735-397c 
The Hashthemes Demo Importer Plugin <= 1.1.1 for WordPress contained several AJAX functions which relied on a nonce which was visible to all logged-in users for access control, allowing them to execute a function that truncated nearly all database tables and removed the contents of wp-content/uploads.
CVSS v3.1 score: 8.1
RHSA-2026:45128 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
rabbitmq-server: RabbitMQ: Authorization bypass via regular expression injection in MQTT client ID
CVSS v3.1 score: 8.1
CVE-1999-0246 
HP Remote Watch allows a remote user to gain root access.
CVSS v2.0 score: 10
GHSA-ph42-h265-7hfr 
The Chilkat XML ChilkatUtil.CkData.1 ActiveX control (ChilkatUtil.dll) 3.0.3.0 and earlier allows remote attackers to create, overwrite, and modify arbitrary files for execution via a call to the (1) SaveToFile, (2) SaveToTempFile, or (3) AppendBinary method.  NOTE: this issue might only be exploitable in limited environments or non-default browser settings.  NOTE: this can be leveraged for remote code execution by accessing files using hcp:// URLs.
CVE-2016-20059 IObit Malware Fighter 4.3.1 Unquoted Service Path Privilege Escalation
IObit Malware Fighter 4.3.1 contains an unquoted service path vulnerability in the IMFservice and LiveUpdateSvc services that allows local attackers to escalate privileges. Attackers can insert a malicious executable file in the unquoted service path and trigger privilege escalation when the service restarts or the system reboots, executing code with LocalSystem privileges.
CVSS v4.0 score: 8.5
CVSS v3.1 score: 7.8
GHSA-4v5h-vp2v-p65r 
SQL Server Native Client Remote Code Execution Vulnerability
CVSS v3.1 score: 8.8
RHSA-2020:1267 Red Hat Security Advisory: nss-softokn security update
ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries nss: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate
CVSS v3.0 score: 8.1
GHSA-2qj4-m7p4-848p 
Multiple PHP remote file inclusion vulnerabilities in CARE2X 1.1 allow remote attackers to execute arbitrary PHP code via a URL in the root_path parameter to (1) inc_checkdate_lang.php, (2) inc_charset_fx.php, (3) inc_config_color.php, (4) inc_currency_set.php, (5) inc_db_makelink.php, (6) inc_diagnostics_report_fx.php, (7) inc_environment_global.php, (8) inc_front_chain_lang.php, (9) inc_init_crypt.php, (10) inc_load_copyrite.php, or (11) inc_news_save.php in include/; (12) diagnostics-report-index.php, (13) config_options_mascot.php, (14) barcode-labels.php, (15) chg-color.php, or (16) config_options_gui_template.php in main/; or unspecified other files.
GHSA-2wcv-jc5c-753w 
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in takeover of MySQL Server. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
CVSS v3.1 score: 7.2
CVE-2019-10027 
PHPCMS 9.6.x through 9.6.3 has XSS via the mailbox (aka E-mail) field on the personal information screen.
CVSS v3.0 score: 4.8
CVSS v2.0 score: 3.5
CVE-2017-14130 
The _bfd_elf_parse_attributes function in elf-attrs.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (_bfd_elf_attr_strdup heap-based buffer over-read and application crash) via a crafted ELF file.
CVSS v3.0 score: 5.5
CVSS v2.0 score: 4.3
CVE-2021-23974 
The DOMParser API did not properly process '<noscript>' elements for escaping. This could be used as an mXSS vector to bypass an HTML Sanitizer. This vulnerability affects Firefox < 86.
CVSS v3.1 score: 6.1
CVSS v2.0 score: 4.3
CVE-2026-2210 D-Link DIR-823X set_filtering sub_4211C8 os command injection
A vulnerability has been found in D-Link DIR-823X 250416. This affects the function sub_4211C8 of the file /goform/set_filtering. Such manipulation leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 8.6
CVSS v3.1 score: 7.2
CVSS v3.0 score: 7.2
CVSS v2.0 score: 8.3
ICSA-16-028-01A Westermo Industrial Switch Hard-coded Certificate Vulnerability (Update A)
Westermo WeOS before 4.19.0 uses the same SSL private key across different customers' installations, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by leveraging knowledge of a key.
CVSS v3.0 score: 9
RHSA-2026:10026 Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.20.4
github.com/tektoncd/pipeline: Tekton Pipelines: Denial of Service via long resolver names Tekton Pipelines: github.com/tektoncd/pipeline: Tekton Pipelines: Information disclosure via path traversal in git resolver
CVSS v3.1 score: 9.6
CVE-2009-2547 
Integer underflow in Armed Assault (aka ArmA) 1.14 and earlier, and 1.16 beta, and Armed Assault II 1.02 and earlier allows remote attackers to cause a denial of service (crash) via a VoIP over Network (VON) packet to port 2305 with a negative packet_size value, which triggers a buffer over-read.
CVSS v2.0 score: 5
GHSA-fx2v-qfhr-4chv Goutil vulnerable to path traversal when unzipping files
ImpactZipSlip issue when use fsutil package to unzip files.
When users use fsutil.Unzip to unzip zip files from a malicious attacker, they may be vulnerable to path traversal.PatchesIt has been fixed in v0.6.0, Please upgrade version to v0.6.0 or above.WorkaroundsNo, users have to upgrade version.
CVSS v3.1 score: 8.8
GHSA-8pw5-pwp5-8mcx 
A stack overflow vulnerability in Aleth Ethereum C++ client version <= 1.8.0 using a specially crafted a config.json file may result in a denial of service.
GHSA-3pj2-6fqg-5xxm 
Rejected reason: Not used
CVE-2021-27341 
OpenSIS Community Edition version <= 7.6 is affected by a local file inclusion vulnerability in DownloadWindow.php via the "filename" parameter.
CVSS v3.1 score: 9.8
CVSS v2.0 score: 7.5
CVE-2018-1363 
IBM Jazz Reporting Service (JRS) 5.0 through 5.0.2 and 6.0 through 6.0.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 137448.
CVSS v3.0 score: 5.4
CVSS v2.0 score: 3.5
GHSA-wh89-fj9h-4gr8 
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the following QTS versions. QTS 4.4.2.1270 build 20200410 and later QTS 4.4.1.1261 build 20200330 and later QTS 4.3.6.1263 build 20200330 and later QTS 4.3.4.1282 build 20200408 and later QTS 4.3.3.1252 build 20200409 and later QTS 4.2.6 build 20200421 and later
CVSS v3.1 score: 5.4
CVE-2021-24672 One User Avatar < 2.3.7 - Contributor+ Stored Cross-Site Scripting
The One User Avatar WordPress plugin before 2.3.7 does not escape the link and target attributes of its shortcode, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks
CVSS v3.1 score: 5.4
CVSS v2.0 score: 3.5
CVE-2024-20019 
In wlan driver, there is a possible memory leak due to improper input handling. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00351241; Issue ID: MSV-1173.
CVSS v3.1 score: 5.9
GHSA-82h2-w2px-9qpc 
Buffer overflow in the browser plugin in Novell iPrint Client before 5.42 allows remote attackers to execute arbitrary code by using EMBED elements to pass parameters with long names.
GHSA-mqpf-p827-ffx5 
WordPress Sonaar Music Plugin 4.7 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts through the comment functionality. Attackers can submit JavaScript payloads in the comment parameter to wp-comments-post.php which are stored and executed in the browsers of users viewing the affected playlist pages.
CVSS v4.0 score: 5.1
CVSS v3.1 score: 7.2
CVE-2023-33921 
A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05), CP-8050 MASTER MODULE (All versions < CPCI85 V05). The affected devices contain an exposed UART console login interface. An attacker with direct physical access could try to bruteforce or crack the root password to login to the device.
CVSS v3.1 score: 6.8
GHSA-8969-qjjh-m9jj 
Missing Authorization vulnerability in Bill Minozzi WP Tools.This issue affects WP Tools: from n/a through 3.41.
CVSS v3.1 score: 8.8
GHSA-r6ph-5fp2-3w2v Microcks's POST /api/import and POST /api/export endpoints allow non-administrator access
In Microcks before 1.10.0, the POST /api/import and POST /api/export endpoints allow non-administrator access.
CVSS v4.0 score: 7.1
CVSS v3.1 score: 6.5
GHSA-w7ph-97wc-q2jr 
Integer overflow in WebGL in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVSS v3.1 score: 9.6
GHSA-3w8x-p539-469j 
In query of DownloadManager.java, there is a possible read/write of arbitrary files due to a permissions bypass. This could lead to local information disclosure and file rewriting with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1 score: 7.7
GHSA-6c3f-x526-64jj 
Cross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5, allows remote attackers to execute arbitrary code in the image manager.
GHSA-x3rx-vw9q-f2g4 
The print_html_to_file function in edit.cgi for Easy Homepage Creator 1.0 does not check user credentials, which allows remote attackers to modify home pages of other users.
GHSA-pvf7-pgpm-3q43 
In the Linux kernel, the following vulnerability has been resolved:PM / devfreq: Fix buffer overflow in trans_stat_showFix buffer overflow in trans_stat_show().Convert simple snprintf to the more secure scnprintf with size of
PAGE_SIZE.Add condition checking if we are exceeding PAGE_SIZE and exit early from
loop. Also add at the end a warning that we exceeded PAGE_SIZE and that
stats is disabled.Return -EFBIG in the case where we don't have enough space to write the
full transition table.Also document in the ABI that this function can return -EFBIG error.
CVSS v3.1 score: 7.8
CVE-2017-7862 
FFmpeg before 2017-02-07 has an out-of-bounds write caused by a heap-based buffer overflow related to the decode_frame function in libavcodec/pictordec.c.
CVSS v3.0 score: 9.8
CVSS v2.0 score: 7.5
GHSA-fpgr-8vgw-cx7x 
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.4. An application may be able to execute arbitrary code with kernel privileges.
CVSS v3.1 score: 7.8
CVE-2024-3820 wpDataTables - Tables & Table Charts (Premium) <= 6.3.1 - Unauthenticated SQL Injection
The wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin plugin for WordPress is vulnerable to SQL Injection via the 'id_key' parameter of the wdt_delete_table_row AJAX action in all versions up to, and including, 6.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Please note this only affects the premium version of the plugin.
CVSS v3.1 score: 10
GHSA-q595-fccr-c7x4 
Unauthenticated OS Command Injection (restore_settings.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform URL-decoded name parameter passed to exec() allows remote code execution.
The `/var/tdf/restore_settings.php` endpoint passes user-controlled `$_GET["name"]` parameter through `urldecode()` directly into `exec()` without validation or escaping. Attackers can inject arbitrary shell commands using metacharacters (`;`, `|`, `&&`, etc.) to achieve unauthenticated remote code execution as the web server user.
CVSS v4.0 score: 9.9
CVSS v3.1 score: 9.8
CVE-2018-1187 
Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6 is affected by a cross-site scripting vulnerability in the Network Configuration page within the OneFS web administration interface. A malicious administrator may potentially inject arbitrary HTML or JavaScript code in the user's browser session in the context of the OneFS website.
CVSS v3.0 score: 4.8
CVSS v2.0 score: 3.5
GHSA-mf77-3q9q-whxg 
A vulnerability has been found in code-projects Online Shoe Store 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /contactus.php. The manipulation of the argument email leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 5.5
CVSS v3.1 score: 7.3
GHSA-223r-m7gh-jxww 
Insufficient validation of untrusted input in Reading Mode in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVSS v3.1 score: 9.6
GHSA-jm93-vrxg-7qhg 
OS2/Warp 4.5 FTP server allows remote attackers to cause a denial of service via a long username.
RHSA-2025:19943 Red Hat Security Advisory: thunderbird security update
thunderbird: firefox: Use-after-free in MediaTrackGraphImpl::GetInstance() thunderbird: firefox: Out of bounds read/write in a privileged process triggered by WebGL textures thunderbird: firefox: Cross-process information leaked due to malicious IPC messages thunderbird: firefox: Some non-writable Object properties could be modified thunderbird: firefox: An OBJECT tag type attribute overrode browser behavior on web resources without a content-type thunderbird: firefox: Memory safety bugs thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144
CVSS v3.1 score: 7.5
CVE-2020-27464 
An insecure update feature in the /updater.php component of rConfig 3.9.6 and below allows attackers to execute arbitrary code via a crafted ZIP file.
CVSS v3.1 score: 7.8
CVSS v2.0 score: 6.8
CVE-2021-27493 Philips Vue PACS 
Philips Vue PACS versions 12.2.x.x and prior does not ensure or incorrectly ensures structured messages or data are well formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.
CVSS v3.1 score: 6.1
CVE-2022-45079 WordPress Loginizer Plugin <= 1.7.5 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in Softaculous Loginizer plugin <= 1.7.5 versions.
CVSS v3.1 score: 4.7
CVE-2004-0014 
Multiple buffer overflows in the nd WebDAV interface 0.8.2 and earlier allows remote web servers to execute arbitrary code via certain long strings.
CVSS v2.0 score: 7.5
CVE-2012-0082 
Unspecified vulnerability in the Core RDBMS component in Oracle Database Server 10.1.0.5, 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote authenticated users to affect integrity and availability via unknown vectors.
CVSS v2.0 score: 5.5
CVE-2026-20663 
The issue was resolved by sanitizing logging. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3. An app may be able to enumerate a user's installed apps.
CVSS v3.1 score: 3.3
CVE-2019-15870 
The CarSpot theme before 2.1.7 for WordPress has stored XSS via the Phone Number field.
CVSS v3.0 score: 5.4
CVSS v2.0 score: 3.5
GHSA-2qcr-qwm7-98x8 
In the FingerTipS touch screen driver, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-157156744
GHSA-c3jv-2c9g-rhj8 
Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function formGetWeiXinConfig.
CVSS v3.1 score: 9.8
GHSA-fmw8-4xqq-qh9j 
Out-of-bounds write in the PCX image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker to cause a denial-of-service condition or execute code in the context of the process using the image codec.
CVSS v3.1 score: 9.8
RHSA-2011:0491 Red Hat Security Advisory: python security update
expat: buffer over-read and crash on XML with malformed UTF-8 sequences python: audioop: incorrect integer overflow checks Python: Memory corruption in audioop module Python: SMTP proxy RFC 2821 module DoS (uncaught exception) (Issue #9129) (CGIHTTPServer): CGI script source code disclosure urllib2): Improper management of ftp:// and file:// URL schemes (Issue #11662)
GHSA-vmc5-xpp6-2j82 
Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
CVSS v3.1 score: 8.8
GHSA-vh5r-q6cj-w4q5 
Authentication Bypass by Spoofing vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT27 model versions 01.14.000 to 01.47.000, Mitsubishi Electric Corporation GOT2000 Series GT25 model versions 01.14.000 to 01.47.000 and Mitsubishi Electric Corporation GT SoftGOT2000 versions 1.265B to 1.285X allows a remote unauthenticated attacker to disclose sensitive information from users' browsers or spoof legitimate users by abusing inappropriate HTML attributes.
CVSS v3.1 score: 8.1
GHSA-fr59-fqc2-p944 
Joomla Ultimate Property Listing 1.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the sf_selectuser_id parameter. Attackers can send GET requests to index.php with the option=com_upl and view=propertylisting parameters to extract sensitive database information including table names and column structures.
CVSS v4.0 score: 8.8
CVSS v3.1 score: 8.2
RHSA-2026:54441 Red Hat Security Advisory: Red Hat Lightspeed (formerly Insights) for Runtimes security update
golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering
CVSS v3.1 score: 6.1
CVE-2010-20115 Vermillion FTP <= 1.31 Daemon PORT Command Memory Corruption
Arcane Software’s Vermillion FTP Daemon (vftpd) versions up to and including 1.31 contains a memory corruption vulnerability triggered by a malformed FTP PORT command. The flaw arises from an out-of-bounds array access during input parsing, allowing an attacker to manipulate stack memory and potentially execute arbitrary code. Exploitation requires direct access to the FTP service and is constrained by a single execution attempt if the daemon is installed as a Windows service.
CVSS v4.0 score: 9.3
GHSA-rr64-xw2h-xw8j 
Multiple cross-site request forgery (CSRF) vulnerabilities in the administrative web interface in the proxy server on Fox-IT Fox DataDiode appliances before 1.7.2 allow remote attackers to hijack the authentication of administrators for requests that (1) create administrative users, (2) remove administrative users, or (3) change permissions.
CVE-2013-3764 
Unspecified vulnerability in the Oracle Endeca Server component in Oracle Fusion Middleware 7.4.0 and 7.5.1.1 allows remote authenticated users to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2013-3763.
CVSS v2.0 score: 5.5
CVE-2025-46736 Umbraco Makes User Enumeration Feasible Based on Timing of Login Response
Umbraco is a free and open source .NET content management system. Prior to versions 10.8.10 and 13.8.1, based on an analysis of the timing of post login API responses, it's possible to determine whether an account exists. The issue is patched in versions 10.8.10 and 13.8.1. No known workarounds are available.
CVSS v3.1 score: 5.3
CVE-2020-7048 
The WordPress plugin, WP Database Reset through 3.1, contains a flaw that allowed any unauthenticated user to reset any table in the database to the initial WordPress set-up state (deleting all site content stored in that table), as demonstrated by a wp-admin/admin-post.php?db-reset-tables[]=comments URI.
CVSS v3.0 score: 9.1
CVE-2024-21176 
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling).  Supported versions that are affected are 8.4.0 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H).
CVSS v3.1 score: 5.3
GHSA-f89c-whfr-778h 
NTFS file system in Windows NT 4.0 and Windows 2000 SP2 allows local attackers to hide file usage activities via a hard link to the target file, which causes the link to be recorded in the audit trail instead of the target file.
CVSS v3.1 score: 5.5
CVE-2020-8870 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.916. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of TIF files from the GetTIFPalette method. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9931.
CVSS v3.0 score: 7.8
RHSA-2026:1143 Red Hat Security Advisory: kernel security update
kernel: Linux kernel: Use-after-free in device mapper due to race condition in zone reporting kernel: Linux kernel use-after-free in eventpoll kernel: drm/xe: Fix vm_bind_ioctl double free bug kernel: Linux kernel: vsock vulnerability may lead to memory corruption kernel: mptcp: fix race condition in mptcp_schedule_work() kernel: Linux kernel: Out-of-bounds write in Bluetooth MGMT can lead to information disclosure and denial of service kernel: net: atlantic: fix fragment overflow handling in RX path kernel: Bluetooth: hci_sock: Prevent race in socket write iter and sock bind
CVSS v3.1 score: 7.4
CVE-2022-27485 
A improper neutralization of special elements used in an sql command ('sql injection') vulnerability [CWE-89] in Fortinet FortiSandbox version 4.2.0, 4.0.0 through 4.0.2, 3.2.0 through 3.2.3, 3.1.x and 3.0.x allows a remote and authenticated attacker with read permission to retrieve arbitrary files from the underlying Linux system via a crafted HTTP request.
CVSS v3.1 score: 6.2
GHSA-m645-99m8-4hcp 
In the Linux kernel, the following vulnerability has been resolved:ALSA: hda/ca0132: Fix buffer overflow in add_tuning_controlThe 'sprintf' call in 'add_tuning_control' may exceed the 44-byte
buffer if either string argument is too long. This triggers a compiler
warning.
Replaced 'sprintf' with 'snprintf' to limit string lengths to prevent
overflow.
CVE-2016-3046 
IBM Security Access Manager for Web is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements which could allow the attacker to view information in the back-end database.
CVSS v3.0 score: 2.7
CVSS v2.0 score: 4
CVE-2018-17146 
A cross-site scripting vulnerability exists in Nagios XI before 5.5.4 via the 'name' parameter within the Account Information page. Exploitation of this vulnerability allows an attacker to execute arbitrary JavaScript code within the auto login admin management page.
CVSS v3.0 score: 5.4
CVSS v2.0 score: 3.5
GHSA-3xwp-cg99-2wx2 
An remote code execution vulnerability exists in Microsoft Dynamics Business Central, aka 'Dynamics Business Central Remote Code Execution Vulnerability'.
GHSA-jfr6-jpp6-f45g 
An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 2200, 1330, 1380, 1480, 1580, W920, W930, and W1000. There is unbounded memory allocation via a large buffer in a /proc/driver/unifi0/ap_certif_11ax_mode write operation, leading to kernel memory exhaustion.
CVSS v3.1 score: 6.2
GHSA-xc69-c397-p3r8 
A Server-Side Request Forgery vulnerability in DELMIA Apriso Release  2017 through Release 2022could allow an unauthenticated attacker to issue requests to arbitrary hosts on behalf of the server running the DELMIA Apriso application.
CVSS v3.1 score: 7.5
GHSA-pfj9-jrrx-g7r5 
Unrestricted Upload of File with Dangerous Type vulnerability in Themify Themify Sidepane WordPress Theme, Themify Themify Newsy, Themify Themify Folo, Themify Themify Edmin, Themify Bloggie, Themify Photobox, Themify Wigi, Themify Rezo, Themify Slide allows Upload a Web Shell to a Web Server.This issue affects Themify Sidepane WordPress Theme: from n/a through 1.9.8; Themify Newsy: from n/a through 1.9.9; Themify Folo: from n/a through 1.9.6; Themify Edmin: from n/a through 2.0.0; Bloggie: from n/a through 2.0.8; Photobox: from n/a through 2.0.1; Wigi: from n/a through 2.0.1; Rezo: from n/a through 1.9.7; Slide: from n/a through 1.7.5.
CVSS v3.1 score: 9.9
CVE-2018-17607 
Foxit PhantomPDF and Reader before 9.3 allow remote attackers to execute arbitrary code or cause a denial of service (use-after-free) because properties of Annotation objects are mishandled. This relates to one of five distinct types of Annotation objects.
CVSS v3.0 score: 9.8
CVSS v2.0 score: 7.5
GHSA-9h9q-qhxg-89xr Filament has unvalidated ColorColumn and ColorEntry values that can be used for Cross-site Scripting
SummaryIf values passed to a `ColorColumn` or `ColumnEntry` are not valid and contain a specific set of characters, applications are vulnerable to XSS attack against a user who opens a page on which a color column or entry is rendered.Versions of Filament from v3.0.0 through v3.2.114 are affected.Please upgrade to Filament [v3.2.115](https://github.com/filamentphp/filament/releases/tag/v3.2.115).PoCFor example, using a value such as:Would get passed into the `@style()` Blade directive from Laravel to render the correct background color, where `$state` contains the value:Since Laravel does not escape special characters within the `@style` Blade directive, the effective output HTML would be:Creating the opportunity for arbitrary JS to run if it was stored in the database.ResponseThis vulnerability (in `ColorColumn` only) was reported by @sv-LayZ, who reported the issue and patched the issue during the evening of 25/09/2024. Thank you Mattis.The review process concluded on 27/09/2024, which revealed the issue was also present in `ColorEntry`. This was fixed the same day and Filament [v3.2.115](https://github.com/filamentphp/filament/releases/tag/v3.2.115) followed to escape any special characters while outputting inline styles like this:Although these components are no longer vulnerable to this type of XSS attack, it is good practice to validate colors, and since many Filament users may be accepting color input using the `ColorPicker` form component, [additional color validation documentation was published](https://filamentphp.com/docs/3.x/forms/fields/color-picker#color-picker-validation).
CVSS v3.1 score: 6.1
RHSA-2025:14434 Red Hat Security Advisory: webkit2gtk3 security update
angle: insufficient input validation can cause undefined behavior webkitgtk: Processing maliciously crafted web content may lead to memory corruption webkitgtk: Processing maliciously crafted web content may lead to memory corruption webkitgtk: Processing web content may lead to a denial-of-service webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash webkitgtk: Processing maliciously crafted web content may disclose sensitive user information webkitgtk: A download’s origin may be incorrectly associated webkitgtk: Processing maliciously crafted web content may disclose internal states of the app
CVSS v3.1 score: 6.5
CVE-2024-5096 Hipcam Device MAC Address wifi.mac information disclosure
A vulnerability classified as problematic was found in Hipcam Device up to 20240511. This vulnerability affects unknown code of the file /log/wifi.mac of the component MAC Address Handler. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-265078 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 5.3
CVSS v3.0 score: 5.3
CVSS v2.0 score: 5
CVE-2026-9709 Themeco Cornerstone < 7.8.9 (Premium, bundled with X Theme) - Subscriber+ Arbitrary User Meta Disclosure
The Cornerstone WordPress plugin before 7.8.9 does not enforce capability checks on one of its REST API routes, allowing any authenticated user to disclose the metadata of any other user, including roles, session token previews and stored billing/shipping fields. This affects the premium co Cornerstone page builder distributed bundled with the X , not the unrelated free `cornerstone` Cornerstone WordPress plugin before 7.8.9 (v0.8.x) on the .org repository.
CVSS v3.1 score: 7.7
CVE-2020-12651 
SecureCRT before 8.7.2 allows remote attackers to execute arbitrary code via an Integer Overflow and a Buffer Overflow because a banner can trigger a line number to CSI functions that exceeds INT_MAX.
CVSS v3.1 score: 9.8
CVSS v2.0 score: 10
CVE-2021-27733 
In JetBrains YouTrack before 2020.6.6441, stored XSS was possible via an issue attachment.
CVSS v3.1 score: 5.4
CVSS v2.0 score: 3.5
CVE-2025-7472 
A local privilege escalation vulnerability in the Intercept X for Windows installer prior version 1.22 can lead to a local user gaining system level privileges, if the installer is run as SYSTEM.
CVSS v3.1 score: 7.5
GHSA-hx8v-fm8j-mj2j 
A stack-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 within a configuration handling component due to insufficient input validation.  An attacker can exploit this vulnerability by supplying an excessively long value for a vulnerable configuration parameter, resulting in a stack overflow.Successful exploitation results in Denial-of-Service (DoS) condition, leading to a service crash or device reboot, impacting availability.
CVSS v4.0 score: 7.1
CVSS v3.1 score: 6.5
GHSA-jgrw-jvh2-ph7j 
The Eventer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.9.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1 score: 6.4
GHSA-m2fp-c79h-rr79 Malicious Package in tensorplow
All versions of `tensorplow` contain malicious code as a preinstall script. When installed, the package calls home to a Command and Control server to execute arbitrary commands.RecommendationAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
CVSS v3.1 score: 9.8
CVE-2021-1637 Windows DNS Query Information Disclosure Vulnerability
Windows DNS Query Information Disclosure Vulnerability
CVSS v3.1 score: 5.5
CVE-2016-5933 
IBM Tivoli Monitoring 6.2 and 6.3 is vulnerable to possible host header injection attack that could lead to HTTP cache poisoning or firewall bypass. IBM Reference #: 1997223.
CVSS v3.0 score: 4.6
CVSS v2.0 score: 4.9
cisco-sa-clamav-dos-prVGcHLd ClamAV CHM File Parsing Denial of Service Vulnerability Affecting Cisco Products: May 2022
On May 4, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed:


A vulnerability in CHM file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device.

For a description of this vulnerability, see the ClamAV blog ["https://blog.clamav.net/2022/05/clamav-01050-01043-01036-released.html"].


CVSS v3.1 score: 8.6
CVE-2022-28935 
Totolink A830R V5.9c.4729_B20191112, Totolink A3100R V4.1.2cu.5050_B20200504, Totolink A950RG V4.1.2cu.5161_B20200903, Totolink A800R V4.1.2cu.5137_B20200730, Totolink A3000RU V5.9c.5185_B20201128, Totolink A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability.
CVSS v3.1 score: 7.2
CVSS v2.0 score: 6.5
GHSA-q553-45jw-h629 
themes/sample/theme.php in Coppermine Photo Gallery (CPG) 1.4.18 and earlier allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message.
cisco-sa-sd-wan-priv-E6e8tEdF Cisco SD-WAN Software Privilege Escalation Vulnerabilities
Multiple vulnerabilities in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges.

These vulnerabilities are due to improper access controls on commands within the application CLI. An attacker could exploit these vulnerabilities by running a malicious command on the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user.

Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.


CVSS v3.1 score: 7.8
GHSA-4mhg-w5rg-4wv7 
extras/curltest.php in Zen Cart 1.3.8 and 1.3.8a, and possibly other versions, allows remote attackers to read arbitrary files via a file:// URI.  NOTE: some of these details are obtained from third party information.
GHSA-hw4p-fj9f-2jmw 
The (1) __futex_atomic_op and (2) futex_atomic_cmpxchg_inatomic functions in Linux kernel 2.6.17-rc4 to 2.6.18-rc2 perform the atomic futex operation in the kernel address space instead of the user address space, which allows local users to cause a denial of service (crash).
CVE-2020-23718 
Cross site scripting (XSS) vulnerability in xujinliang zibbs 1.0, allows attackers to execute arbitrary code via the route parameter to index.php.
CVSS v3.1 score: 9.6
CVSS v2.0 score: 6.8
CVE-2026-59820 LiteLLM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.7-stable, LiteLLM Skills archive extraction did not sufficiently validate file paths from uploaded skill ZIP archives, allowing an authenticated user with access to LiteLLM LLM API routes or a key whose allowed_routes includes /v1/skills, anthropic_routes, or llm_api_routes to upload a crafted skill archive containing path traversal entries that could be written outside the intended extraction or staging directory. This issue is fixed in version 1.83.7-stable.
CVSS v4.0 score: 6.1
CVE-2025-53488 Stored XSS in WikiHiero
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - WikiHiero Extension allows Stored XSS.This issue affects Mediawiki - WikiHiero Extension: from 1.43.X before 1.43.2.
CVSS v3.1 score: 6.1
GHSA-h4p6-m7g5-cfp4 
Unauthenticated Cross Site Scripting (XSS) in Post SMTP <= 3.6.2 versions.
CVSS v3.1 score: 7.1
GHSA-c9rv-f9qq-jjvf 
Vulnerability in the Oracle GraalVM Enterprise Edition product of Oracle GraalVM (component: Java). The supported version that is affected is 19.3.0.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle GraalVM Enterprise Edition. Note: GraalVM Enterprise 19.3 and above includes both Java SE 8 and Java SE 11. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS v3.1 score: 8.1
CVE-2021-20429 
IBM QRadar User Behavior Analytics 1.0.0 through 4.1.0 could disclose sensitive information due an overly permissive cross-domain policy. IBM X-Force ID: 196334.
CVSS v3.0 score: 3.7
GHSA-x79x-9c8r-88hj 
The Web3 WordPress plugin before 3.0.0 is vulnerable to an authentication bypass due to incorrect authentication checking in the login flow in functions 'handle_auth_request' and 'hadle_login_request'. This makes it possible for non authenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.
CVSS v3.1 score: 9.8
CVE-2025-30934 WordPress 診断ジェネレータ作成プラグイン plugin <= 1.4.16 - Broken Access Control Vulnerability
Missing Authorization vulnerability in OLIVESYSTEM 診断ジェネレータ作成プラグイン os-diagnosis-generator allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects 診断ジェネレータ作成プラグイン: from n/a through <= 1.4.16.
CVSS v3.1 score: 5.3
CVE-2026-74393 drm/syncobj: Fix memory leak in drm_syncobj_find_fence()
In the Linux kernel, the following vulnerability has been resolved:

drm/syncobj: Fix memory leak in drm_syncobj_find_fence()

Commit 18226ba52159 ("drm/syncobj: reject invalid flags in
drm_syncobj_find_fence") forgot to take into account the fact that
drm_syncobj_find() takes a reference to syncobj and returns early
without dropping the reference, leading to memory leaks.

Reported by: Sam Spencer <sam.spencer@arm.com>
GHSA-pqqv-8xrg-2jg9 
In the Linux kernel, the following vulnerability has been resolved:cxl/port: Fix delete_endpoint() vs parent unregistration raceThe CXL subsystem, at cxl_mem ->probe() time, establishes a lineage of
ports (struct cxl_port objects) between an endpoint and the root of a
CXL topology. Each port including the endpoint port is attached to the
cxl_port driver.Given that setup, it follows that when either any port in that lineage
goes through a cxl_port ->remove() event, or the memdev goes through a
cxl_mem ->remove() event. The hierarchy below the removed port, or the
entire hierarchy if the memdev is removed needs to come down.The delete_endpoint() callback is careful to check whether it is being
called to tear down the hierarchy, or if it is only being called to
teardown the memdev because an ancestor port is going through
->remove().That care needs to take the device_lock() of the endpoint's parent.
Which requires 2 bugs to be fixed:1/ A reference on the parent is needed to prevent use-after-free
   scenarios like this signature:2/ In the case of RCH topologies, the parent device that needs to be
   locked is not always @port->dev as returned by cxl_mem_find_port(), use
   endpoint->dev.parent instead.
CVSS v3.1 score: 4.4
CVE-2025-65267 
In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers to embed malicious JavaScript. The payload executes when an administrator clicks the image link to view the avatar, resulting in stored cross-site scripting (XSS). Successful exploitation may lead to account takeover, privilege escalation, or full compromise of the affected ERPNext instance.
CVSS v3.1 score: 9
CVE-2025-30610 WordPress WP Social Widget plugin <= 2.2.7 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catchsquare WP Social Widget wp-social-widget allows Stored XSS.This issue affects WP Social Widget: from n/a through <= 2.2.7.
CVSS v3.1 score: 6.5
CVE-2025-23384 
A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.2.1), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions < V8.2.1), SCALANCE M804PB (6GK5804-0AP00-2AA2) (All versions < V8.2.1), SCALANCE M812-1 ADSL-Router family (All versions < V8.2.1), SCALANCE M816-1 ADSL-Router family (All versions < V8.2.1), SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) (All versions < V8.2.1), SCALANCE M874-2 (6GK5874-2AA00-2AA2) (All versions < V8.2.1), SCALANCE M874-3 (6GK5874-3AA00-2AA2) (All versions < V8.2.1), SCALANCE M874-3 3G-Router (CN) (6GK5874-3AA00-2FA2) (All versions < V8.2.1), SCALANCE M876-3 (6GK5876-3AA02-2BA2) (All versions < V8.2.1), SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) (All versions < V8.2.1), SCALANCE M876-4 (6GK5876-4AA10-2BA2) (All versions < V8.2.1), SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) (All versions < V8.2.1), SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2) (All versions < V8.2.1), SCALANCE MUB852-1 (A1) (6GK5852-1EA10-1AA1) (All versions < V8.2.1), SCALANCE MUB852-1 (B1) (6GK5852-1EA10-1BA1) (All versions < V8.2.1), SCALANCE MUM853-1 (A1) (6GK5853-2EA10-2AA1) (All versions < V8.2.1), SCALANCE MUM853-1 (B1) (6GK5853-2EA10-2BA1) (All versions < V8.2.1), SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1) (All versions < V8.2.1), SCALANCE MUM856-1 (A1) (6GK5856-2EA10-3AA1) (All versions < V8.2.1), SCALANCE MUM856-1 (B1) (6GK5856-2EA10-3BA1) (All versions < V8.2.1), SCALANCE MUM856-1 (CN) (6GK5856-2EA00-3FA1) (All versions < V8.2.1), SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1) (All versions < V8.2.1), SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1) (All versions < V8.2.1), SCALANCE S615 EEC LAN-Router (6GK5615-0AA01-2AA2) (All versions < V8.2.1), SCALANCE S615 LAN-Router (6GK5615-0AA00-2AA2) (All versions < V8.2.1), SCALANCE SC622-2C (6GK5622-2GS00-2AC2) (All versions < V3.2), SCALANCE SC626-2C (6GK5626-2GS00-2AC2) (All versions < V3.2), SCALANCE SC632-2C (6GK5632-2GS00-2AC2) (All versions < V3.2), SCALANCE SC636-2C (6GK5636-2GS00-2AC2) (All versions < V3.2), SCALANCE SC642-2C (6GK5642-2GS00-2AC2) (All versions < V3.2), SCALANCE SC646-2C (6GK5646-2GS00-2AC2) (All versions < V3.2). Affected devices improperly validate usernames during OpenVPN authentication. This could allow an attacker to get partial invalid usernames accepted by the server.
CVSS v4.0 score: 6.3
CVSS v3.1 score: 3.7
CVE-2018-18860 
A local privilege escalation vulnerability has been identified in the SwitchVPN client 2.1012.03 for macOS. Due to over-permissive configuration settings and a SUID binary, an attacker is able to execute arbitrary binaries as root.
CVSS v3.0 score: 7.8
CVSS v2.0 score: 7.2
GHSA-335x-vvmj-55qx 
A flaw was found in the Red Hat OpenShift AI (RHOAI) MaaS Gateway. Improper configuration of the Gateway in a model-serving context allows a standard user with low privileges to intercept, read, log, and alter all MaaS model traffic. This includes sensitive information such as access keys, input prompts, and outputs, leading to significant information disclosure and data tampering.
CVSS v3.1 score: 8.8
GHSA-wmhg-j6wx-r9rg 
Stack-based buffer overflow in op before Changeset 563, when xauth support is enabled, allows local users to gain privileges via a long XAUTHORITY environment variable.