CIRCL/vulnerability-scores huggingface dataset:
GHSA-m97m-jg28-f9x7 
Off-by-one error in libavcodec/smc.c in FFmpeg before 2.4.2 allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted Quicktime Graphics (aka SMC) video data.
RHSA-2019:4238 Red Hat Security Advisory: chromium-browser security update
chromium-browser: Use after free in Bluetooth chromium-browser: Heap buffer overflow in password manager chromium-browser: Insufficient policy enforcement in WebSockets chromium-browser: Out of bounds write in V8 chromium-browser: Use after free in WebSockets chromium-browser: Type Confusion in V8 chromium-browser: Use after free in WebAudio sqlite: fts3: improve shadow table corruption detection chromium-browser: Out of bounds write in V8 chromium-browser: Integer overflow in PDFium chromium-browser: Insufficient policy enforcement in autocomplete chromium-browser: Insufficient policy enforcement in navigation chromium-browser: Incorrect security UI in Omnibox chromium-browser: Incorrect security UI in sharing chromium-browser: Insufficient validation of untrusted input in Blink chromium-browser: Incorrect security UI in Omnibox chromium-browser: Incorrect security UI in external protocol handling chromium-browser: Insufficient policy enforcement in cookies chromium-browser: Insufficient policy enforcement in audio chromium-browser: Insufficient policy enforcement in Omnibox chromium-browser: Uninitialized Use in rendering chromium-browser: Insufficient policy enforcement in developer tools chromium-browser: Incorrect security UI in Omnibox sqlite: dropping of shadow tables not restricted in defensive mode sqlite: fts3: improve detection of corrupted records sqlite: fts3: improve shadow table corruption detection sqlite: fts3: incorrectly removed corruption check chromium-browser: Insufficient policy enforcement in extensions chromium-browser: Insufficient policy enforcement in extensions chromium-browser: Incorrect security UI in printing chromium-browser: Incorrect security UI in Omnibox chromium-browser: Insufficient policy enforcement in navigation chromium-browser: Incorrect security UI in interstitials chromium-browser: Incorrect security UI in Omnibox chromium-browser: Insufficient policy enforcement in downloads chromium-browser: Insufficient policy enforcement in payments chromium-browser: Type Confusion in V8
CVSS v3.1 score: 8.8
CVSS v3.0 score: 8.8
GHSA-r7cg-pp63-f4xg 
ChakraCore, and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, and Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016, and Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to obtain information to further compromise the user's system, due to how the scripting engine handles objects in memory, aka "Scripting Engine Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-11887 and CVE-2017-11906.
CVSS v3.0 score: 5.3
GHSA-rqhf-rjxm-7vcq 
A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /view/unread_msg.php. The manipulation of the argument my_index leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-265991.
CVSS v3.1 score: 6.3
GHSA-j57x-5h9f-j263 
In the Linux kernel, the following vulnerability has been resolved:accel/amdxdna: Fix NULL pointer dereference of mgmt_channmgmt_chann may be set to NULL if the firmware returns an unexpected
error in aie2_send_mgmt_msg_wait(). This can later lead to a NULL
pointer dereference in aie2_hw_stop().Fix this by introducing a dedicated helper to destroy mgmt_chann
and by adding proper NULL checks before accessing it.
CVSS v3.1 score: 5.5
GHSA-f3mp-m5hm-h688 
In the Linux kernel, the following vulnerability has been resolved:netfs: Fix missing barriers when accessing stream->subrequests locklesslyThe list of subrequests attached to stream->subrequests is accessed without
locks by netfs_collect_read_results() and netfs_collect_write_results(),
and then they access subreq->flags without taking a barrier after getting
the subreq pointer from the list.  Relatedly, the functions that build the
list don't use any sort of write barrier when constructing the list to make
sure that the NETFS_SREQ_IN_PROGRESS flag is perceived to be set first if
no lock is taken.Fix this by:(1) Add a new list_add_tail_release() function that uses a release barrier
     to set the pointer to the new member of the list.(2) Add a new list_first_entry_or_null_acquire() function that uses an
     acquire barrier to read the pointer to the first member in a list (or
     return NULL).(3) Use list_add_tail_release() when adding a subreq to ->subrequests.(4) Use list_first_entry_or_null_acquire() when initially accessing the
     front of the list (when an item is removed, the pointer to the new
     front iterm is obtained under the same lock).
CVSS v3.1 score: 9.8
GHSA-65hc-w5gc-vhhp 
IBM Cognos Analytics 11.1.7 and 11.2.0 could allow an authenticated to view or edit a Jupyter notebook that they should not have access to. IBM X-Force ID: 206212.
CVSS v3.1 score: 5.4
CVE-2023-49183 WordPress NextScripts Plugin <= 4.4.2 is vulnerable to Cross Site Scripting (XSS)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NextScripts NextScripts: Social Networks Auto-Poster allows Reflected XSS.This issue affects NextScripts: Social Networks Auto-Poster: from n/a through 4.4.2.
CVSS v3.1 score: 7.1
CVE-2026-7703 AV Stumpfl Pixera Two Media Server Websocket API code injection
A flaw has been found in AV Stumpfl Pixera Two Media Server up to 25.2 R2. Impacted is an unknown function of the component Websocket API. This manipulation causes code injection. The attack can be initiated remotely. The exploit has been published and may be used. Upgrading to version 25.2 R3 is recommended to address this issue. Upgrading the affected component is advised.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 7.3
CVSS v3.0 score: 7.3
CVSS v2.0 score: 7.5
GHSA-gc9v-mv77-jhqh 
Multiple cross-site scripting (XSS) vulnerabilities in Phorum 3.1 through 5.0.3 beta allow remote attackers to inject arbitrary web script or HTML via the (1) HTTP_REFERER parameter to login.php, (2) HTTP_REFERER parameter to register.php, or (3) target parameter to profile.php.
CVE-2023-23465 Media CP Media Control Panel – CSRF
Media CP Media Control Panel latest version. CSRF possible through unspecified endpoint.
CVSS v3.1 score: 9.1
CVE-2026-2705 Open Babel MOL2 File atom.h SetFormalCharge out-of-bounds
A vulnerability was detected in Open Babel up to 3.1.1. The impacted element is the function OBAtom::SetFormalCharge in the library include/openbabel/atom.h of the component MOL2 File Handler. The manipulation results in out-of-bounds read. It is possible to launch the attack remotely. The exploit is now public and may be used. The patch is identified as e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a. A patch should be applied to remediate this issue. The project was informed of the problem early through an issue report but has not responded yet.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 4.3
CVSS v3.0 score: 4.3
CVSS v2.0 score: 5
CVE-2007-4804 
Multiple SQL injection vulnerabilities in AuraCMS 1.5rc allow remote attackers to execute arbitrary SQL commands via the id parameter in (1) hal.php, (2) cetak.php, (3) lihat.php, (4) pesan.php, and (5) teman.php, different vectors than CVE-2007-4171.  NOTE: the scripts may be accessed through requests to the product's top-level default URI, using the pilih parameter, in some circumstances.
CVSS v2.0 score: 7.5
GHSA-x3wf-656r-9h9g 
An information disclosure vulnerability in AOSP Messaging could enable a local malicious application to bypass operating system protections that isolate application data from other applications. This issue is rated as High because it could be used to gain access to data that the application does not have access to. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-32161610.
CVSS v3.0 score: 5.5
CVE-2021-31421 
This vulnerability allows local attackers to delete arbitrary files on affected installations of Parallels Desktop 16.1.1-49141. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete arbitrary files in the context of the hypervisor. Was ZDI-CAN-12129.
CVSS v3.0 score: 3.2
GHSA-xg76-3pjj-pf64 
The br_mdb_ip_get function in net/bridge/br_multicast.c in the Linux kernel before 2.6.35-rc5 allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via an IGMP packet, related to lack of a multicast table.
CVSS v3.1 score: 7.5
GHSA-3w3h-97p3-6xqh 
The Sunshine Photo Cart: Free Client Photo Galleries for Photographers plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.11. This is due to the plugin not properly validating a user-supplied key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary user's passwords through the password reset functionality, including administrators, and leverage that to reset the user's password and gain access to their account.
CVSS v3.1 score: 8.8
GHSA-h6wp-xwgx-g8g4 
Improper access control vulnerability in ESConfigTool.exe in ENS for Windows all current versions allows a local administrator to alter the ENS configuration up to and including disabling all protection offered by ENS via insecurely implemented encryption of configuration for export and import.
CVSS v3.1 score: 6.7
CVE-2025-38557 HID: apple: validate feature-report field count to prevent NULL pointer dereference
In the Linux kernel, the following vulnerability has been resolved:

HID: apple: validate feature-report field count to prevent NULL pointer dereference

A malicious HID device with quirk APPLE_MAGIC_BACKLIGHT can trigger a NULL
pointer dereference whilst the power feature-report is toggled and sent to
the device in apple_magic_backlight_report_set(). The power feature-report
is expected to have two data fields, but if the descriptor declares one
field then accessing field[1] and dereferencing it in
apple_magic_backlight_report_set() becomes invalid
since field[1] will be NULL.

An example of a minimal descriptor which can cause the crash is something
like the following where the report with ID 3 (power report) only
references a single 1-byte field. When hid core parses the descriptor it
will encounter the final feature tag, allocate a hid_report (all members
of field[] will be zeroed out), create field structure and populate it,
increasing the maxfield to 1. The subsequent field[1] access and
dereference causes the crash.

  Usage Page (Vendor Defined 0xFF00)
  Usage (0x0F)
  Collection (Application)
    Report ID (1)
    Usage (0x01)
    Logical Minimum (0)
    Logical Maximum (255)
    Report Size (8)
    Report Count (1)
    Feature (Data,Var,Abs)

    Usage (0x02)
    Logical Maximum (32767)
    Report Size (16)
    Report Count (1)
    Feature (Data,Var,Abs)

    Report ID (3)
    Usage (0x03)
    Logical Minimum (0)
    Logical Maximum (1)
    Report Size (8)
    Report Count (1)
    Feature (Data,Var,Abs)
  End Collection

Here we see the KASAN splat when the kernel dereferences the
NULL pointer and crashes:

  [   15.164723] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] SMP KASAN NOPTI
  [   15.165691] KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
  [   15.165691] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted 6.15.0 #31 PREEMPT(voluntary)
  [   15.165691] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
  [   15.165691] RIP: 0010:apple_magic_backlight_report_set+0xbf/0x210
  [   15.165691] Call Trace:
  [   15.165691]  <TASK>
  [   15.165691]  apple_probe+0x571/0xa20
  [   15.165691]  hid_device_probe+0x2e2/0x6f0
  [   15.165691]  really_probe+0x1ca/0x5c0
  [   15.165691]  __driver_probe_device+0x24f/0x310
  [   15.165691]  driver_probe_device+0x4a/0xd0
  [   15.165691]  __device_attach_driver+0x169/0x220
  [   15.165691]  bus_for_each_drv+0x118/0x1b0
  [   15.165691]  __device_attach+0x1d5/0x380
  [   15.165691]  device_initial_probe+0x12/0x20
  [   15.165691]  bus_probe_device+0x13d/0x180
  [   15.165691]  device_add+0xd87/0x1510
  [...]

To fix this issue we should validate the number of fields that the
backlight and power reports have and if they do not have the required
number of fields then bail.
CVSS v3.1 score: 5.5
CVE-2024-54520 
A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An app may be able to overwrite arbitrary files.
CVSS v3.1 score: 5.5
CVE-2019-10501 
Possible use after free issue due to improper input validation in volume listener library in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24
CVSS v3.1 score: 7.8
CVSS v2.0 score: 4.6
GHSA-48f3-v7r7-48gh 
IIS 4.0 allows a remote attacker to obtain the real pathname of the document root by requesting non-existent files with .ida or .idq extensions.
CVE-2008-7111 
The Scanner File Utility (aka listener) in Kyocera Mita (KM) 3.3.0.1 does not restrict the filenames or extensions of uploaded files, which makes it easier for remote attackers to execute arbitrary code or overwrite files by leveraging CVE-2008-7110 and CVE-2008-7109.
CVSS v2.0 score: 9.3
CVE-2022-0339 Server-Side Request Forgery (SSRF) in janeczku/calibre-web
Server-Side Request Forgery (SSRF) in Pypi calibreweb prior to 0.6.16.
CVSS v3.0 score: 6.5
PYSEC-2026-3331 
### Impact
`array_ops.upper_bound` causes a segfault when not given a rank 2 tensor.

### Patches
We have patched the issue in GitHub commit [915884fdf5df34aaedd00fc6ace33a2cfdefa586](https://github.com/tensorflow/tensorflow/commit/915884fdf5df34aaedd00fc6ace33a2cfdefa586).

The fix will be included in TensorFlow 2.13. We will also cherrypick this commit in TensorFlow 2.12.1.


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.


### Attribution
This vulnerability has been reported by dmc1778
CVSS v4.0 score: 8.7
CVSS v3.1 score: 7.5
CVE-2020-37158 AVideo Platform 8.1 - Cross Site Request Forgery (Password Reset)
AVideo Platform 8.1 contains a cross-site request forgery vulnerability that allows attackers to reset user passwords by exploiting the password recovery mechanism. Attackers can craft malicious requests to the recoverPass endpoint using the user's recovery token to change account credentials without authentication.
CVSS v4.0 score: 8.5
CVSS v3.1 score: 5.3
CVE-2026-47620 
NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause a race condition in the LoRA manager singleton initialization. A successful exploit of this vulnerability might lead to data tampering and denial of service.
CVSS v3.1 score: 6.5
GHSA-hwvm-hrp8-hmq8 
Improper Privilege Management vulnerability in Hamid Alinia – idehweb Login with phone number allows Privilege Escalation.This issue affects Login with phone number: from n/a through 1.7.16.
CVSS v3.1 score: 8.8
CVE-2017-3735 
While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of the certificate. This bug has been present since 2006 and is present in all versions of OpenSSL before 1.0.2m and 1.1.0g.
CVSS v3.0 score: 5.3
CVSS v2.0 score: 5
CVE-2024-45047 Potential mXSS vulnerability due to improper HTML escaping in svelte
svelte performance oriented web framework. A potential mXSS vulnerability exists in Svelte for versions up to but not including 4.2.19. Svelte improperly escapes HTML on server-side rendering. The assumption is that attributes will always stay as such, but in some situation the final DOM tree rendered on browsers is different from what Svelte expects on server-side rendering. This may be leveraged to perform XSS attacks, and a type of the XSS is known as mXSS (mutation XSS). More specifically, this can occur when injecting malicious content into an attribute within a `noscript` tag. This issue has been addressed in release version 4.2.19. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS v3.1 score: 5.4
GHSA-f39p-623w-5v5j 
An HTML injection vulnerability previously discovered in Trend Vision One could have allowed a malicious user to execute arbitrary code.Please note: this issue has already been addressed on the backend service and is no longer considered an active vulnerability.
CVSS v3.1 score: 0
GHSA-4gj3-6r43-3wfc IPFS go-unixfsnode subject to DOS via HAMT Decoding Panics
ImpactTrying to read malformed HAMT sharded directories can cause panics and virtual memory leaks.
If you are reading untrusted user input, an attacker can then trigger a panic.This is caused by a bogus fanout parameter in the HAMT directory nodes.
This includes checks returned in [ipfs/go-bitfield GHSA-2h6c-j3gf-xp9r](https://github.com/ipfs/go-bitfield/security/advisories/GHSA-2h6c-j3gf-xp9r), as well as limiting the fanout to <= 1024 (to avoid attempts of arbitrary sized allocations).Patcheshttps://github.com/ipfs/go-unixfsnode/commit/91b3d39d33ef0cd2aff2c95d50b2329350944b68https://github.com/ipfs/go-unixfsnode/commit/a4ed723727e0bdc2277158337c2fc0d82802d122Referenceshttps://github.com/ipfs/go-unixfs/security/advisories/GHSA-q264-w97q-q778https://github.com/ipfs/go-bitfield/security/advisories/GHSA-2h6c-j3gf-xp9r
CVSS v3.1 score: 7.5
RHSA-2020:0703 Red Hat Security Advisory: http-parser security update
nodejs: HTTP request smuggling using malformed Transfer-Encoding header
CVSS v3.1 score: 7.1
GHSA-24mr-37ph-25xf 
A remote code execution vulnerability exists in Microsoft Exchange through the deserialization of metadata via PowerShell, aka 'Microsoft Exchange Remote Code Execution Vulnerability'.
GHSA-6w6c-5vv5-gw2w 
OS Command Injection vulnerability in Revolution Pi version 2022-07-28-revpi-buster from KUNBUS GmbH. This vulnerability could allow an authenticated attacker to execute OS commands on the device via the ‘php/dal.php’ endpoint, in the ‘arrSaveConfig’ parameter.
CVSS v3.1 score: 8.3
GHSA-2536-j8mg-q936 
Adobe Bridge CC versions 9.1 and earlier have a memory corruption vulnerability. Successful exploitation could lead to information disclosure.
CVE-2020-13933 
Apache Shiro before 1.6.0, when using Apache Shiro, a specially crafted HTTP request may cause an authentication bypass.
CVSS v3.1 score: 7.5
CVSS v2.0 score: 5
CVE-2018-25015 
An issue was discovered in the Linux kernel before 4.14.16. There is a use-after-free in net/sctp/socket.c for a held lock after a peel off, aka CID-a0ff660058b8.
CVSS v3.1 score: 7.8
CVSS v2.0 score: 4.6
GHSA-vg3r-vr52-6v9g 
In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
CVSS v3.1 score: 5.5
CVE-2024-24140 
Sourcecodester Daily Habit Tracker App 1.0 allows SQL Injection via the parameter 'tracker.'
CVSS v3.1 score: 7.2
GHSA-7h92-gq8q-gpxg 
The GSheetConnector For Gravity Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions less than, or equal to, 1.3.23. This is due to missing or incorrect nonce validation on the activate_plugin and deactivate_plugin functions. This makes it possible for attackers to trick authenticated administrators into activating or deactivating specified plugins via a forged request, such as clicking on a malicious link or visiting a compromised page.
CVSS v3.1 score: 2.4
CVE-2017-16019 
GitBook is a command line tool (and Node.js library) for building beautiful books using GitHub/Git and Markdown (or AsciiDoc). Stored Cross-Site-Scripting (XSS) is possible in GitBook before 3.2.2 by including code outside of backticks in any ebook. This code will be executed on the online reader.
CVSS v3.0 score: 6.1
CVSS v2.0 score: 4.3
CVE-2022-25599 WordPress Spiffy Calendar plugin <= 4.9.0 - Event deletion via Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability leading to event deletion was discovered in Spiffy Calendar WordPress plugin (versions <= 4.9.0).
CVSS v3.1 score: 5.4
GHSA-6h5f-264c-p52f 
Lantronix SecureLinx Spider (SLS) 2.2+ devices have XSS in the auth.asp login page.
CVSS v3.0 score: 6.1
CVE-2021-3787 
A vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with local access to obtain the MQTT credentials that could result in unauthorized access to backend Hubble services.
CVSS v3.1 score: 6.4
GHSA-3mg4-6264-fvx2 
S-CMS v5.0 was discovered to contain a SQL injection vulnerability via the A_newsauth parameter at /admin/ajax.php.
CVSS v3.1 score: 9.8
CVE-2023-32563 
An unauthenticated attacker could achieve the code execution through a RemoteControl server.
CVSS v3.0 score: 8.8
PYSEC-2021-568 
TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can trigger a read from outside of bounds of heap allocated data by sending invalid arguments to `tf.raw_ops.ResourceScatterUpdate`. The [implementation](https://github.com/tensorflow/tensorflow/blob/f24faa153ad31a4b51578f8181d3aaab77a1ddeb/tensorflow/core/kernels/resource_variable_ops.cc#L919-L923) has an incomplete validation of the relationship between the shapes of `indices` and `updates`: instead of checking that the shape of `indices` is a prefix of the shape of `updates` (so that broadcasting can happen), code only checks that the number of elements in these two tensors are in a divisibility relationship. We have patched the issue in GitHub commit 01cff3f986259d661103412a20745928c727326f. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
CVE-2024-3722 Swift Performance Lite <= 2.3.6.18 - Incorrect Authorization to Authenticated (Subscriber+) Settings Modification
The Swift Performance Lite plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the ajax_handler() function in all versions up to, and including, 2.3.6.18. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve and modify settings.
CVSS v3.1 score: 5.4
GHSA-xx2h-qwcv-vv5w 
In the Linux kernel, the following vulnerability has been resolved:arm64/crc-t10dif: fix use of out-of-scope array in crc_t10dif_arch()Fix a silly bug where an array was used outside of its scope.
CVSS v3.1 score: 5.5
CVE-2020-2149 
Jenkins Repository Connector Plugin 1.2.6 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure.
CVSS v3.1 score: 5.3
CVSS v2.0 score: 5
GHSA-6cpj-3g83-q2j4 Improper Restriction of XML External Entity Reference in Apache Solr
The (1) UpdateRequestHandler for XSLT or (2) XPathEntityProcessor in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, different vectors than CVE-2013-6407.
GHSA-4r4c-x4gq-3pcw 
Bridge versions 13.0.9, 14.1.2 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial of service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1 score: 5.5
GHSA-59qp-8h5f-h6h4 
If Elastic Endpoint (v7.9.0 - v8.10.3) is configured to use a non-default option in which the logging level is explicitly set to debug, and when Elastic Agent is simultaneously configured to collect and send those logs to Elasticsearch, then Elastic Agent API keys can be viewed in Elasticsearch in plaintext. These API keys could be used to write arbitrary data and read Elastic Endpoint user artifacts.
CVSS v3.1 score: 4.6
CVE-2010-4646 
Cross-site scripting (XSS) vulnerability in Hastymail2 before 1.01 allows remote attackers to inject arbitrary web script or HTML via a crafted background attribute within a cell in a TABLE element, related to improper use of the htmLawed filter.
CVSS v2.0 score: 4.3
CVE-2021-47466 mm, slub: fix potential memoryleak in kmem_cache_open()
In the Linux kernel, the following vulnerability has been resolved:

mm, slub: fix potential memoryleak in kmem_cache_open()

In error path, the random_seq of slub cache might be leaked.  Fix this
by using __kmem_cache_release() to release all the relevant resources.
CVSS v3.1 score: 5.5
GHSA-97fh-3x83-fvh6 
In the Linux kernel, the following vulnerability has been resolved:net: openvswitch: Fix Use-After-Free in ovs_ct_exitSince kfree_rcu, which is called in the hlist_for_each_entry_rcu traversal
of ovs_ct_limit_exit, is not part of the RCU read critical section, it
is possible that the RCU grace period will pass during the traversal and
the key will be free.To prevent this, it should be changed to hlist_for_each_entry_safe.
CVSS v3.1 score: 7.8
GHSA-p6rx-8rvc-vf4p 
Some Brother printers (such as the HL-L8360CDW v1.20) were affected by different information disclosure vulnerabilities that provided sensitive information to an unauthenticated user who visits a specific URL.
CVSS v3.1 score: 7.5
CVE-2023-30876 WordPress Dave's WordPress Live Search Plugin <= 4.8.1 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Dave Ross Dave's WordPress Live Search plugin <= 4.8.1 versions.
CVSS v3.1 score: 5.9
GHSA-25fp-8w8p-mx36 OpenSTAManager has an OS Command Injection in P7M File Processing
SummaryA critical OS Command Injection vulnerability exists in the P7M (signed XML) file decoding functionality. An authenticated attacker can upload a ZIP file containing a .p7m file with a malicious filename to execute arbitrary system commands on the server.Vulnerable Code**File:** `src/Util/XML.php:100`**The Problem:**The `$file` parameter is passed directly into `exec()` without sanitizationAlthough wrapped in double quotes, an attacker can escape themThe filename comes from uploaded ZIP archives (user-controlled)Attack VectorEntry Points:**plugins/importFE_ZIP/actions.php:126** (when automatic import is enabled)**plugins/importFE/src/FatturaElettronica.php:56** (constructor)Attack Flow:Attacker creates ZIP with malicious filenameUpload ZIP via importFE_ZIP pluginApplication extracts ZIP and iterates filesFor `.p7m` files, `decodeP7M()` is calledMalicious filename is injected into `exec()` commandArbitrary command executes as web server userProof of Concept**⚠️ IMPORTANT NOTE:** PHP's `ZipArchive::extractTo()` splits filenames on `/` character. Payload must NOT contain `/` in commands. Use `cd directory && command` instead of absolute paths.Step 1: Create Malicious ZIPStep 2: Upload ZIPStep 3: Exploitation Result**Response (500 error is expected - XML parsing fails AFTER command execution):****Verification - Webshell Created:**Step 4: Remote Code Execution**Webshell is publicly accessible without authentication:**Impact**Remote Code Execution:** Full server compromise**Data Exfiltration:** Access to all application data and database**Privilege Escalation:** Potential escalation if web server runs with elevated privileges**Persistence:** Install backdoors and maintain access**Lateral Movement:** Pivot to other systems on the networkPrerequisitesAuthenticated user with access to invoice import functionalityRemediationInput SanitizationorValidate Filename Before ProcessingCreditDiscovered by: Łukasz Rybak
CVSS v4.0 score: 9.4
CVE-2006-0930 
Directory traversal vulnerability in Webmail in ArGoSoft Mail Server Pro 1.8 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the UIDL parameter.
CVSS v2.0 score: 4
CVE-2025-15410 code-projects Online Guitar Store login.php sql injection
A vulnerability was identified in code-projects Online Guitar Store 1.0. Affected by this issue is some unknown functionality of the file /login.php. The manipulation of the argument L_email leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 7.3
CVSS v3.0 score: 7.3
CVSS v2.0 score: 7.5
CVE-2023-35009 IBM Cognos Analytics information disclosure
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could allow a remote attacker to obtain system information without authentication which could be used in reconnaissance to gather information that could be used for future attacks.  IBM X-Force ID:  257703.
CVSS v3.1 score: 5.3
GHSA-c88w-8m4x-2r4w 
SQL injection vulnerability in details.php in Application Dynamics Cartweaver 3.0 allows remote attackers to execute arbitrary SQL commands via the prodId parameter, possibly a related issue to CVE-2006-2046.3.
CVE-2024-50382 
Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent control flow in lib/utils/ghash/ghash.cpp in GHASH in AES-GCM. There is a branch instead of an XOR with carry. This was observed for Clang in LLVM 15 on RISC-V.
CVSS v3.1 score: 5.9
GHSA-rwvf-ppqq-h9cm 
A stack buffer overflow vulnerability has been discovered in Microsoft Skype 7.2, 7.35, and 7.36 before 7.37, involving MSFTEDIT.DLL mishandling of remote RDP clipboard content within the message box.
CVSS v3.0 score: 8.8
CVE-2025-1641 Benner ModernaNet GetHorariosDoDia sql injection
A vulnerability was found in Benner ModernaNet up to 1.1.0. It has been classified as critical. This affects an unknown part of the file /AGE0000700/GetHorariosDoDia?idespec=0&idproced=1103&data=2025-02-25+19%3A25&agserv=0&convenio=1&localatend=1&idplano=5&pesfis=01&idprofissional=0&target=.horarios--dia--d0&_=1739371223797. The manipulation leads to sql injection. It is possible to initiate the attack remotely. Upgrading to version 1.1.1 is able to address this issue. It is recommended to upgrade the affected component.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 7.3
CVSS v3.0 score: 7.3
CVSS v2.0 score: 7.5
GHSA-wh6g-3g9q-9246 
NVIDIA Megatron-LM for all platforms contains a vulnerability in the pretrain_gpt script, where malicious data created by an attacker may cause a code injection issue. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, and data tampering.
CVSS v3.1 score: 7.8
CVE-2021-31445 
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Reader 10.1.1.37576. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects embedded in PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-13244.
CVSS v3.0 score: 3.3
CVE-2024-35785 tee: optee: Fix kernel panic caused by incorrect error handling
In the Linux kernel, the following vulnerability has been resolved:

tee: optee: Fix kernel panic caused by incorrect error handling

The error path while failing to register devices on the TEE bus has a
bug leading to kernel panic as follows:

[   15.398930] Unable to handle kernel paging request at virtual address ffff07ed00626d7c
[   15.406913] Mem abort info:
[   15.409722]   ESR = 0x0000000096000005
[   15.413490]   EC = 0x25: DABT (current EL), IL = 32 bits
[   15.418814]   SET = 0, FnV = 0
[   15.421878]   EA = 0, S1PTW = 0
[   15.425031]   FSC = 0x05: level 1 translation fault
[   15.429922] Data abort info:
[   15.432813]   ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
[   15.438310]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0
[   15.443372]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[   15.448697] swapper pgtable: 4k pages, 48-bit VAs, pgdp=00000000d9e3e000
[   15.455413] [ffff07ed00626d7c] pgd=1800000bffdf9003, p4d=1800000bffdf9003, pud=0000000000000000
[   15.464146] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP

Commit 7269cba53d90 ("tee: optee: Fix supplicant based device enumeration")
lead to the introduction of this bug. So fix it appropriately.
CVSS v3.1 score: 7.8
CVE-2011-2012 
Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, Update 1, Update 2, and SP1 does not properly validate session cookies, which allows remote attackers to cause a denial of service (IIS outage) via unspecified network traffic, aka "Null Session Cookie Crash."
CVSS v2.0 score: 5
CVE-2014-4882 
Aptexx Resident Anywhere does not require authentication, which allows remote attackers to obtain sensitive information or modify data via a direct request.
CVSS v2.0 score: 7.5
cisco-sa-20190515-ise-certcreation Cisco Identity Services Engine Arbitrary Client Certificate Creation Vulnerability
A vulnerability in the External RESTful Services (ERS) API of the Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to generate arbitrary certificates signed by the Internal Certificate Authority (CA) Services on ISE.

This vulnerability is due to an incorrect implementation of role-based access control (RBAC). An attacker could exploit this vulnerability by crafting a specific HTTP request with administrative credentials. A successful exploit could allow the attacker to generate a certificate that is signed and trusted by the ISE CA with arbitrary attributes. The attacker could use this certificate to access other networks or assets that are protected by certificate authentication.


There are no workarounds that address this vulnerability.

This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-ise-certcreation ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-ise-certcreation"]
CVSS v3.0 score: 6.8
CVE-2026-18739 Popt-devel: popt-static: off-by-one in poptstuffargs
A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application or through deep alias nesting, can lead to corruption of internal program data. This corruption could potentially enable a local attacker to execute arbitrary code if the host application then unsafely processes the altered data.
CVSS v3.1 score: 2.5
GHSA-f5wx-pf3m-r4f3 
A potential divide by zero vulnerability was reported in the Lenovo Virtual Bus driver used in Smart Connect that could allow a local authenticated user to cause a Windows blue screen error.
CVSS v4.0 score: 6.8
CVSS v3.1 score: 5.5
CVE-2008-2199 
PHP remote file inclusion vulnerability in kmitaadmin/kmitam/htmlcode.php in Kmita Mail 3.0 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the file parameter.
CVSS v2.0 score: 6.8
CVE-2021-45547 
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R7850 before 1.0.5.74, R7900P before 1.4.2.84, R7960P before 1.4.2.84, R8000 before 1.0.4.74, R8000P before 1.4.2.84, RAX200 before 1.0.4.120, RAX75 before 1.0.4.120, RAX80 before 1.0.4.120, RBK752 before 3.2.17.12, RBK852 before 3.2.17.12, RBR750 before 3.2.17.12, RBR850 before 3.2.17.12, RBS750 before 3.2.17.12, and RBS850 before 3.2.17.12.
CVSS v3.1 score: 8.4
GHSA-3q33-8vfh-xphh 
Multiple untrusted search path vulnerabilities in Cyberlink Power2Go 7.0.0.0816 allow local users to gain privileges via a Trojan horse (1) dwmapi.dll or (2) MFC71LOC.DLL file in the current working directory, as demonstrated by a directory that contains a .p2g, .iso, .pdl, .pds, or .p2i file.  NOTE: some of these details are obtained from third party information.
RHSA-2026:54070 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
libssh2: libssh2: Heap buffer overflow via integer overflow in publickey attribute allocation
CVSS v3.1 score: 7
GHSA-8crc-g3j5-4x7j 
Bento4 v1.6.0-639 was discovered to contain a segmentation violation in the mp4fragment component.
CVSS v3.1 score: 6.5
CVE-2011-4126 
Race condition issues were found in Calibre at devices/linux_mount_helper.c allowing unprivileged users the ability to mount any device to anywhere.
CVSS v3.1 score: 8.1
CVSS v2.0 score: 9.3
GHSA-gf29-3f4w-753g 
A vulnerability classified as problematic has been found in SourceCodester Online Food Ordering System 2.0. This affects an unknown part of the file index.php of the component Create an Account Page. The manipulation of the argument First Name/Last Name leads to cross site scripting. It is possible to initiate the attack remotely.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 4.3
CVE-2025-2380 PHPGurukul Apartment Visitors Management System admin-profile.php sql injection
A vulnerability was found in PHPGurukul Apartment Visitors Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin-profile.php. The manipulation of the argument mobilenumber leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 7.3
CVSS v3.0 score: 7.3
CVSS v2.0 score: 7.5
CVE-2015-2654 
Unspecified vulnerability in the Data Store component in Oracle Berkeley DB 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, and 12.1.6.0.35 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-2583, CVE-2015-2624, CVE-2015-2626, CVE-2015-2640, CVE-2015-2656, CVE-2015-4754, CVE-2015-4764, CVE-2015-4775, CVE-2015-4776, CVE-2015-4777, CVE-2015-4778, CVE-2015-4780, CVE-2015-4781, CVE-2015-4782, CVE-2015-4783, CVE-2015-4784, CVE-2015-4785, CVE-2015-4786, CVE-2015-4787, CVE-2015-4789, and CVE-2015-4790.
CVSS v2.0 score: 6.9
CVE-2012-3255 
Cross-site scripting (XSS) vulnerability in HP Business Availability Center (BAC) 8.07 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS v2.0 score: 4.3
GHSA-974j-wjxx-wggj Incorrect Access Control vulnerability in api-platform/core
API Platform version from 2.2.0 to 2.3.5 contains an Incorrect Access Control vulnerability in GraphQL delete mutations that can result in a user authorized to delete a resource can delete any resource. This attack appears to be exploitable via the user must be authorized. This vulnerability appears to have been fixed in 2.3.6.
CVSS v3.0 score: 6.5
GHSA-c674-ffgg-qqwp 
An access issue was addressed with additional sandbox restrictions on applications. This issue is fixed in macOS High Sierra 10.13. An application may be able to access restricted files.
GHSA-g5mr-95rv-q4hc 
A flaw was found in Openstack manilla owning a Ceph File system "share", which enables the owner to read/write any manilla share or entire file system. The vulnerability is due to a bug in the "volumes" plugin in Ceph Manager. This allows an attacker to compromise Confidentiality and Integrity of a file system. Fixed in RHCS 5.2 and Ceph 17.2.2.
CVSS v3.1 score: 9.1
GHSA-gq9r-3cg3-g24m 
Crestron Airmedia AM-100 devices with firmware before 1.6.0 and AM-101 devices with firmware before 2.7.0 allows remote authenticated administrators to execute arbitrary code via unspecified vectors.
CVSS v3.0 score: 7.2
CVE-2024-57965 
In axios before 1.7.8, lib/helpers/isURLSameOrigin.js does not use a URL object when determining an origin, and has a potentially unwanted setAttribute('href',href) call. NOTE: some parties feel that the code change only addresses a warning message from a SAST tool and does not fix a vulnerability.
CVSS v3.1 score: 0
GHSA-83hw-j99p-2rr2 
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PINPOINT.WORLD Pinpoint Booking System allows Blind SQL Injection.This issue affects Pinpoint Booking System: from n/a through 2.9.9.5.1.
CVSS v3.1 score: 8.5
CVE-2019-19526 
In the Linux kernel before 5.3.9, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/nfc/pn533/usb.c driver, aka CID-6af3aa57a098.
CVSS v3.1 score: 4.6
CVSS v2.0 score: 4.9
CVE-2022-2088 Elcomplus SmartICS Access Control
An authenticated user with admin privileges may be able to terminate any process on the system running Elcomplus SmartICS v2.3.4.0.
CVSS v3.1 score: 6.8
GHSA-p877-j5pf-2q72 
Multiple unspecified vulnerabilities in chetcpasswd 2.4.1 allow local users to gain privileges via unspecified vectors related to executing (1) the cp program, (2) the mail program, or (3) the program specified in the post_change configuration line.
CVE-2026-4163 Wavlink WL-WN579A3 POST Request wireless.cgi GuestWifi command injection
A vulnerability was detected in Wavlink WL-WN579A3 220323. This issue affects the function SetName/GuestWifi of the file /cgi-bin/wireless.cgi of the component POST Request Handler. Performing a manipulation results in command injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading the affected component is recommended.
CVSS v4.0 score: 9.3
CVSS v3.1 score: 9.8
CVSS v3.0 score: 9.8
CVSS v2.0 score: 10
CVE-2023-1092 OAuth Single Sign On - SSO (OAuth Client) - IdP Deletion via CSRF
The OAuth Single Sign On Free WordPress plugin before 6.24.2, OAuth Single Sign On Standard WordPress plugin before 28.4.9, OAuth Single Sign On Premium WordPress plugin before 38.4.9 and OAuth Single Sign On Enterprise WordPress plugin before 48.4.9 do not have CSRF checks when deleting Identity Providers (IdP), which could allow attackers to make logged in admins delete arbitrary IdP via a CSRF attack
CVSS v3.1 score: 6.5
GHSA-5949-9w89-hx26 
UniSharp Laravel File Manager v2.0.0-alpha7 and v2.0 contain an arbitrary file upload vulnerability that allows authenticated attackers to upload malicious files by sending multipart form data to the upload endpoint. Attackers can upload PHP files with the type parameter set to Files and execute arbitrary code by accessing the uploaded file through the working directory path.
CVSS v4.0 score: 8.7
CVSS v3.1 score: 8.8
GHSA-466r-grw5-cc98 
This issue is not applicable to NFX NextGen Software. On NFX Series devices the use of Hard-coded Credentials in Juniper Networks Junos OS allows an attacker to take over any instance of an NFX deployment. This issue is only exploitable through administrative interfaces. This issue affects: Juniper Networks Junos OS versions prior to 19.1R1 on NFX Series. No other platforms besides NFX Series devices are affected.
GHSA-2c6g-pfx3-w7h8 Insecure Temporary File in RESTEasy
ImpactIn RESTEasy the insecure `File.createTempFile()` is used in the `DataSourceProvider`, `FileProvider` and `Mime4JWorkaround` classes which creates temp files with insecure permissions that could be read by a local user.PatchesFixed in the following pull requests:https://github.com/resteasy/resteasy/pull/3409 (7.0.0.Alpha1)https://github.com/resteasy/resteasy/pull/3423 (6.2.3.Final)https://github.com/resteasy/resteasy/pull/3412 (5.0.6.Final)https://github.com/resteasy/resteasy/pull/3413 (4.7.8.Final)https://github.com/resteasy/resteasy/pull/3410 (3.15.5.Final)WorkaroundsThere is no workaround for this issue.Referenceshttps://nvd.nist.gov/vuln/detail/CVE-2023-0482https://bugzilla.redhat.com/show_bug.cgi?id=2166004https://github.com/advisories/GHSA-jrmh-v64j-mjm9
CVSS v3.1 score: 5.5
GHSA-f686-hw9c-xw9c Snowflake JDBC Security Advisory
Impacted ProductsSnowflake JDBC driver versions >= 3.2.6 & <= 3.19.1 are affected.IntroductionSnowflake recently identified an issue affecting JDBC drivers that can result in data being uploaded to an encrypted stage without the additional layer of protection provided by client side encryption. The issue, which affects only a subset of accounts hosted on Azure and GCP deployments (AWS deployments are not affected), manifests in instances where customers create a stage using a JDBC driver with the CLIENT_ENCRYPTION_KEY_SIZE account parameter set to 256-bit rather than the default 128-bit. The data is still protected by TLS in transit and server side encryption at rest. This missed layer of the additional protection is not visible to the affected customers.Incorrect Security Setting VulnerabilityDescriptionSnowflake identified an incorrect security setting in Snowflake JDBC drivers. Snowflake has evaluated the severity of the issue and determined it was in medium range with a maximum CVSSv3 base score of 5.9.Scenarios and attack vector(s)Users of Snowflake JDBC drivers with accounts on Azure and GCP deployments who set the parameter CLIENT_ENCRYPTION_KEY_SIZE = 256 were subject to this incorrect security setting vulnerability as it could result in data being uploaded to a stage without an additional layer for encryption.Our responseOn July 23, 2024, Snowflake discovered this vulnerability. On 10/28/2024, Snowflake released a patch in Snowflake JDBC driver Version 3.20.0. The patch fixes the incorrect security setting.ResolutionWe strongly recommend users to upgrade to 3.20.0 or later versions as soon as possible.ContactIf you discover a security vulnerability in one of our products or websites, please report the issue to HackerOne. For more information, please see our [Vulnerability Disclosure Policy](https://hackerone.com/snowflake?type=team).
CVSS v4.0 score: 6.5
CVSS v3.1 score: 5.9
GHSA-6rgv-qr47-8w9g 
flatCore-CMS version 2.0.8 calls dangerous functions, causing server-side request forgery vulnerabilities.
CVSS v3.1 score: 9.8
CVE-2022-41444 
Cross Site Scripting (XSS) vulnerability in Cacti 1.2.21 via crafted POST request to graphs_new.php.
CVSS v3.1 score: 6.1
GHSA-mv9w-pp72-p7j5 
FFmpeg before 0.5.4, as used in MPlayer and other products, allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly execute arbitrary code via a malformed RealMedia file.
GHSA-c5rf-v994-q29q 
Use-after-free vulnerability in Google Chrome before 17.0.963.46 allows user-assisted remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to mousemove events.
CVE-2023-32218 Avaya IX Workforce Engagement - CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Avaya IX Workforce Engagement v15.2.7.1195 - CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
CVSS v3.1 score: 6.1
CVE-2013-2370 
Unspecified vulnerability in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1671.
CVSS v2.0 score: 7.5
CVE-2025-56089 
OS Command Injection vulnerability in Ruijie M18 EW_3.0(1)B11P226_M18_10223116 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_sta/nbr_cwmp.lua.
CVSS v3.1 score: 8.8
CVE-2026-32445 WordPress Elementor Website Builder plugin <= 3.35.5 - Broken Access Control vulnerability
Missing Authorization vulnerability in Elementor Elementor Website Builder elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elementor Website Builder: from n/a through <= 3.35.5.
CVSS v3.1 score: 2.7