CIRCL/vulnerability-scores huggingface dataset:
GHSA-g8rq-rjvv-4hcc 
An integer overflow vulnerability exists in the QuickJS regular expression engine (libregexp) due to an inconsistent representation of the bytecode buffer size.The regular expression bytecode is stored in a DynBuf structure, which correctly uses a $\text{size}\_\text{t}$ (an unsigned type, typically 64-bit) for its size member.However, several functions, such as re_emit_op_u32 and other internal parsing routines, incorrectly cast or store this DynBuf $\text{size}\_\text{t}$ value into a signed int (typically 32-bit).When a large or complex regular expression (such as those generated by a recursive pattern in a Proof-of-Concept) causes the bytecode size to exceed $2^{31}$ bytes (the maximum positive value for a signed 32-bit integer), the size value wraps around, resulting in a negative integer when stored in the int variable (Integer Overflow).This negative value is subsequently used in offset calculations. For example, within functions like re_parse_disjunction, the negative size is used to compute an offset (pos) for patching a jump instruction.This negative offset is then incorrectly added to the buffer pointer (s->byte\_code.buf + pos), leading to an out-of-bounds write on the first line of the snippet below:put_u32(s->byte_code.buf + pos, len);
CVSS v4.0 score: 7.1
CVSS v3.1 score: 8.8
RHSA-2026:8824 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
python: Quadratic complexity in os.path.expandvars() with user-controlled template cpython: python: Python zipfile End of Central Directory (EOCD) Locator record offset not checked cpython: Missing character filtering in Python cpython: python: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of service cpython: Excessive read buffering DoS in http.client cpython: Out-of-memory when loading Plist cpython: Header injection via newlines in data URL mediatype in Python cpython: IMAP command injection in user-controlled commands cpython: POP3 command injection in user-controlled commands cpython: wsgiref.headers.Headers allows header newline injection in Python cpython: email header injection due to unquoted newlines python: Python: HTTP header injection via CR/LF in proxy tunnel headers cpython: CPython: Logging Bypass in Legacy .pyc File Handling cpython: Incomplete control character validation in http.cookies cpython: Stack overflow parsing XML with deeply nested DTD content models python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API python: Python: Information disclosure and arbitrary code execution via remote debugging with a malicious process. python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules
CVSS v3.1 score: 8.1
GHSA-v994-f8vw-g7j4 `docker cp` allows unexpected chmod of host files in Moby Docker Engine
ImpactA bug was found in Moby (Docker Engine) where attempting to copy files using `docker cp` into a specially-crafted container can result in Unix file permission changes for existing files in the host’s filesystem, widening access to others. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process.PatchesThis bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers do not need to be restarted.WorkaroundsEnsure you only run trusted containers.CreditsThe Moby project would like to thank Lei Wang and Ruizhi Xiao for responsibly disclosing this issue in accordance with the ﻿[Moby security policy](https://github.com/moby/moby/blob/master/SECURITY.md).For more informationIf you have any questions or comments about this advisory:[Open an issue](https://github.com/moby/moby/issues/new)Email us at ﻿ security@docker.com ﻿ if you think you’ve found a security bug
CVSS v3.1 score: 2.8
CVE-2006-2507 
Multiple PHP remote file inclusion vulnerabilities in Teake Nutma Foing 0.2.0 through 0.7.0, as used with phpBB, allow remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter in (1) index.php, (2) song.php, (3) faq.php, (4) list.php, (5) gen_m3u.php, and (6) playlist.php.
CVSS v2.0 score: 7.5
CVE-2005-1525 
SQL injection vulnerability in config_settings.php for Cacti before 0.8.6e allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS v2.0 score: 7.5
GHSA-8pjr-r8qw-rq6v 
In the Linux kernel, the following vulnerability has been resolved:net/x25: fix use-after-free in x25_kill_by_neigh()x25_kill_by_neigh() walks the global X.25 socket list looking for sockets
attached to a terminating neighbour. x25_list_lock protects list membership
while the lookup is in progress, but it does not pin a socket's lifetime
after the lock is dropped.The function currently drops x25_list_lock before calling lock_sock(s). A
concurrent close can run x25_release(), remove the same socket from
x25_list, and drop the last socket reference in that window. The neighbour
teardown path can then lock or inspect a freed struct sock/struct x25_sock.Take sock_hold(s) while x25_list_lock still proves that the list entry is
live, then drop the temporary reference after the socket has been locked,
rechecked, and released. Recheck x25_sk(s)->neighbour after lock_sock(),
because another path may have disconnected the socket before this path
acquired the socket lock. Restart the list walk after each disconnect
because the list lock was dropped and the previous iterator state may no
longer be valid.A QEMU/KASAN run against origin/master reproduced a slab-use-after-free in
x25_kill_by_neigh().
CVSS v3.1 score: 9.8
GHSA-f66v-3757-hppx 
Fusionpbx v4.4 and below contains a command injection vulnerability via the download email logs function.
CVSS v3.1 score: 9.8
GHSA-755j-4fg9-vf62 
In the Linux kernel, the following vulnerability has been resolved:wifi: cfg80211: bound element ID read when checking non-inheritancecfg80211_is_element_inherited() reads the first data octet of the
candidate element (id = elem->data[0]) to look it up in an extension
non-inheritance list. It does so after testing elem->id, but without
verifying that the element actually has a data octet. A zero-length
extension element (WLAN_EID_EXTENSION with length 0) therefore makes it
read one octet past the end of the element._ieee802_11_parse_elems_full() runs this check for every element of a
frame once a non-inheritance context exists -- e.g. while parsing a
per-STA profile of a Multi-Link element in a (re)association response,
or a non-transmitted BSS profile -- so a crafted frame from an AP can
trigger a one-octet slab-out-of-bounds read during element parsing:BUG: KASAN: slab-out-of-bounds in cfg80211_is_element_inherited
  Read of size 1 ... in net/wireless/scan.cReturn early (treat the element as inherited) when an extension element
carries no data, mirroring the existing handling of empty ID lists.The bug was found by fuzzing ieee802_11_parse_elems_full() under KASAN.
CVSS v3.1 score: 7.1
CVE-2025-2441 
CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could lead to loss of
confidentiality when a malicious user, having physical access, sets the radio in factory default mode where the
product does not correctly initialize all data.
CVSS v4.0 score: 4.1
CVSS v3.1 score: 4.6
CVE-2021-29499 Predictable SIF UUID Identifiers
SIF is an open source implementation of the Singularity Container Image Format. The `siftool new` command and func siftool.New() produce predictable UUID identifiers due to insecure randomness in the version of the `github.com/satori/go.uuid` module used as a dependency. A patch is available in version >= v1.2.3 of the module. Users are encouraged to upgrade. As a workaround, users passing CreateInfo struct should ensure the `ID` field is generated using a version of `github.com/satori/go.uuid` that is not vulnerable to this issue.
CVSS v3.1 score: 7.5
GHSA-f7wm-r5v3-mxr4 
IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate ownership in the deprecated POST /api/v1/build/{flow_id}/vertices endpoint, allowing an authenticated user to inject arbitrary graph data into a shared cache for any flow. This may result in cross-user cache pollution, unauthorized workflow execution, or denial of service.
CVSS v3.1 score: 5.9
CVE-2026-60406 
Vulnerability in the TimesTen In-Memory Database product of Oracle TimesTen In-Memory Database (component: Kubernetes Operator).   The supported version that is affected is 26.1.1.1.0. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where TimesTen In-Memory Database executes to compromise TimesTen In-Memory Database.  Successful attacks of this vulnerability can result in takeover of TimesTen In-Memory Database. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
CVSS v3.1 score: 6.7
CVE-2024-43585 Code Integrity Guard Security Feature Bypass Vulnerability
Code Integrity Guard Security Feature Bypass Vulnerability
CVSS v3.1 score: 5.5
GHSA-wpp4-47w3-75gj 
Buffer overflow in certain versions of South River (aka SRT) WebDrive, possibly version 6.08 build 1131 and version 8, allows remote attackers to cause a denial of service (application crash and persistent erratic behavior) via a long string in the name entry field.
GHSA-h285-56q5-4xv2 
NoMachine Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.The specific flaw exists within nxnode.exe. The process loads a library from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM.. Was ZDI-CAN-24039.
CVSS v3.0 score: 7.8
GHSA-3x52-fw35-w3mf 
Race condition in the installer for Zoom Workplace App for Windows and Zoom Rooms App for Windows may allow an authenticated user to conduct a denial of service via local access.
CVSS v3.1 score: 6.6
GHSA-9rh6-49p4-pjqq 
A vulnerability classified as critical was found in PHPGurukul Pre-School Enrollment System 1.0. This vulnerability affects unknown code of the file /admin/check_availability.php. The manipulation of the argument Username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 5.5
CVSS v3.1 score: 7.3
CVE-2023-5525 Limit Login Attempts Reloaded < 2.25.26 - Admin+ Missing Authorization to Toggle Plugin Auto-Update
The Limit Login Attempts Reloaded WordPress plugin before 2.25.26 is missing authorization on the `toggle_auto_update` AJAX action, allowing any user with a valid nonce to toggle the auto-update status of the plugin.
CVSS v3.1 score: 4.3
GHSA-gr58-j5wh-m333 Prototype Pollution in nis-utils
All versions of package nis-utils up to and including 0.6.10 are vulnerable to Prototype Pollution via the setValue function.
CVSS v3.1 score: 9.8
CVE-2025-2699 GetmeUK ContentTools Image cross site scripting
A vulnerability was found in GetmeUK ContentTools up to 1.6.16. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Image Handler. The manipulation of the argument onload leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0 score: 5.1
CVSS v3.1 score: 3.5
CVSS v3.0 score: 3.5
CVSS v2.0 score: 4
GHSA-79f9-q2cg-p5x7 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Umar Social Locker allows Stored XSS.This issue affects Social Locker: from n/a through 1.1.
CVSS v3.1 score: 6.5
GHSA-pp9j-fw5p-c6x5 
Interspire Email Marketer through 6.1.6 has SQL Injection via a checkduplicatetags tagname request to Dynamiccontenttags.php.
CVSS v3.0 score: 8.8
CVE-2022-43081 
Fast Food Ordering System v1.0 was discovered to contain a SQL injection vulnerability via the component /fastfood/purchase.php.
CVSS v3.1 score: 7.5
GHSA-vrxh-v8jq-xh42 
Possible buffer overflow in WLAN WMI handler due to lack of ssid length check when copying data in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8017, APQ8053, APQ8096, APQ8096AU, APQ8098, IPQ6018, IPQ8074, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8996AU, MSM8998, Nicobar, QCA6174A, QCA6574, QCA6574AU, QCA6584AU, QCA8081, QCA9377, QCA9379, QCA9886, QCN7605, QCS404, QCS405, QCS605, Rennell, SA6155P, SC8180X, SDA660, SDA845, SDM630, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX24, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130
RHSA-2025:1733 Red Hat Security Advisory: libpq security update
postgresql: PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation
CVSS v3.1 score: 8.1
GHSA-qrq4-w8rp-x888 
An infinite loop vulnerability in tiftoimage that results in heap buffer overflow in convert_32s_C1P1 was found in openjpeg 2.1.2.
CVSS v3.0 score: 8.8
RHSA-2015:2079 Red Hat Security Advisory: binutils security, bug fix, and enhancement update
binutils: invalid read flaw in libbfd binutils: lack of range checking leading to controlled write in _bfd_elf_setup_sections() binutils: out-of-bounds write when parsing specially crafted PE executable binutils: heap overflow in objdump when parsing a crafted ELF/PE binary file (incomplete fix for CVE-2014-8485) binutils: stack overflow in objdump when parsing specially crafted ihex file binutils: stack overflow in the SREC parser binutils: directory traversal vulnerability binutils: out of bounds memory write
GHSA-p24q-jv27-xq4x 
The setup resources in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to complete the setup process via a cross-site request forgery (CSRF) vulnerability.
CVE-2019-4632 
IBM Security Secret Server 10.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 170004.
CVSS v3.0 score: 6.1
GHSA-j55p-849v-8cjr 
An elevation of privilege vulnerability in the Synaptics touchscreen driver in Android before 2016-11-05 could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Android ID: A-31252388.
CVSS v3.0 score: 7.8
CVE-2021-0356 
In netdiag, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-10, Android-11; Patch ID: ALPS05442014.
CVSS v3.1 score: 6.7
CVSS v2.0 score: 4.6
CVE-2026-28426 Statamic vulnerable to privilege escalation via stored cross-site scripting
Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, stored XSS vulnerability in svg and icon related components allow authenticated users with appropriate permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. This has been fixed in 5.73.11 and 6.4.0.
CVSS v3.1 score: 8.7
CVE-2024-6913 Execution with Unnecessary Privileges
Execution with unnecessary privileges in PerkinElmer ProcessPlus allows an attacker to spawn a remote shell on the windows system.This issue affects ProcessPlus: through 1.11.6507.0.
CVSS v4.0 score: 9.3
GHSA-rc26-62rx-429v 
Dell PowerScale OneFS, versions 9.10.0.0 through 9.10.1.5 and versions 9.11.0.0 through 9.12.0.1, contains an external control of system or configuration setting vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to protection mechanism bypass.
CVSS v3.1 score: 3.4
GHSA-587p-wh25-6v5g 
This issue was addressed by removing the vulnerable code. This issue is fixed in GarageBand for macOS 10.4.8. An app may be able to gain elevated privileges during the installation of GarageBand
CVSS v3.1 score: 7.8
GHSA-2gpw-vqhh-jgrj 
The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-about page.
CVSS v3.0 score: 7.5
CVE-2006-6714 
Multiple memory leaks in Hitachi Directory Server 2 P-2444-A124 before 02-11-/K on Windows, and P-1B44-A121 before 02-10-/V on HP-UX, allow remote attackers to cause a denial of service (memory consumption) via invalid LDAP requests.
CVSS v2.0 score: 7.8
CVE-2025-21067 
Out-of-bounds read in the allocation of image buffer in Samsung Notes prior to version 4.4.30.63 allows local attackers to access out-of-bounds memory.
CVSS v3.1 score: 4
CVE-2026-18844 Pulsetto Vagus Nerve Stimulator Hidden Functionality
The firmware of the Pulsetto Vagus Nerve Stimulator accepts several undisclosed commands over its Bluetooth Low Energy (BLE) interface. These commands are sent without authentication or encryption, and are never issued by the companion mobile application, yet are fully processed by the device when it is powered on.
CVSS v4.0 score: 7.2
CVSS v3.1 score: 8.1
GHSA-28gw-xjhw-6cm5 
A stack-based buffer overflow within GNOME gcab through 0.7.4 can be exploited by malicious attackers to cause a crash or, potentially, execute arbitrary code via a crafted .cab file.
CVSS v3.0 score: 7.8
CVE-2008-3241 
SQL injection vulnerability in players-detail.php in UltraStats 0.2.136, 0.2.140, and 0.2.142 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS v2.0 score: 7.5
CVE-2023-5524 M-Files Web Companion allows Remote Code Execution for some filetypes
Insufficient blacklisting in M-Files Web Companion before release version 23.10 and LTS Service Release Versions before 23.8 LTS SR1 allows 

Remote Code Execution

 via specific file types
CVSS v3.1 score: 8.2
GHSA-v3x9-wrq5-868j Apache Answer: The link for resetting user password is not Single-Use
Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer.This issue affects Apache Answer: through 1.3.5.The password reset link remains valid within its expiration period even after it has been used. This could potentially lead to the link being misused or hijacked.
Users are recommended to upgrade to version 1.3.6, which fixes the issue.
CVSS v4.0 score: 6.3
CVSS v3.1 score: 4.8
CVE-2007-4362 
SQL injection vulnerability in category.php in Prozilla Webring allows remote attackers to execute arbitrary SQL commands via the cat parameter.
CVSS v2.0 score: 6.8
CVE-2021-30585 
Use after free in sensor handling in Google Chrome on Windows prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS v3.1 score: 8.8
CVSS v2.0 score: 6.8
CVE-2024-22318 IBM i Access Client Solutions information disclosure
IBM i Access Client Solutions (ACS) 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.4 is vulnerable to NT LAN Manager (NTLM) hash disclosure by an attacker modifying UNC capable paths within ACS configuration files to point to a hostile server. If NTLM is enabled, the Windows operating system will try to authenticate using the current user's session. The hostile server could capture the NTLM hash information to obtain the user's credentials.  IBM X-Force ID:  279091.
CVSS v3.1 score: 5.1
GHSA-34jf-34wf-852g 
HTML attribute value injection vulnerability in Movable Type series (Movable Type 7 r.4606 (7.2.1) and earlier (Movable Type 7), Movable Type Advanced 7 r.4606 (7.2.1) and earlier (Movable Type Advanced 7), Movable Type for AWS 7 r.4606 (7.2.1) and earlier (Movable Type for AWS 7), Movable Type 6.5.3 and earlier (Movable Type 6.5), Movable Type Advanced 6.5.3 and earlier (Movable Type Advanced 6.5), Movable Type 6.3.11 and earlier (Movable Type 6.3), Movable Type Advanced 6.3.11 and earlier (Movable Type 6.3), Movable Type Premium 1.29 and earlier, and Movable Type Premium Advanced 1.29 and earlier) allows remote attackers to inject arbitrary HTML attribute value via unspecified vectors.
GHSA-p77v-7332-v474 
In lunary-ai/lunary version 1.2.4, an account takeover vulnerability exists due to the exposure of password recovery tokens in API responses. Specifically, when a user initiates the password reset process, the recovery token is included in the response of the `GET /v1/users/me/org` endpoint, which lists all users in a team. This allows any authenticated user to capture the recovery token of another user and subsequently change that user's password without consent, effectively taking over the account. The issue lies in the inclusion of the `recovery_token` attribute in the users object returned by the API.
CVSS v3.0 score: 9.1
GHSA-9827-m264-fw2m 
A null pointer dereference flaw was found in the hugetlbfs_fill_super function in the Linux kernel hugetlbfs (HugeTLB pages) functionality. This issue may allow a local user to crash the system or potentially escalate their privileges on the system.
CVSS v3.1 score: 6.6
GHSA-h4x7-365q-3rm3 
In version 0.0.14 of transformeroptimus/superagi, the API endpoint `/api/users/get/{id}` returns the user's password in plaintext. This vulnerability allows an attacker to retrieve the password of another user, leading to potential account takeover.
CVSS v3.0 score: 6.5
CVE-2025-43516 
A session management issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2. A user with Voice Control enabled may be able to transcribe another user's activity.
CVSS v3.1 score: 3.3
GHSA-m6g2-mpp7-vr6r 
In the Linux kernel, the following vulnerability has been resolved:scsi: pm8001: Fix use-after-free in pm8001_queue_command()Commit e29c47fe8946 ("scsi: pm8001: Simplify pm8001_task_exec()") refactors
pm8001_queue_command(), however it introduces a potential cause of a double
free scenario when it changes the function to return -ENODEV in case of phy
down/device gone state.In this path, pm8001_queue_command() updates task status and calls
task_done to indicate to upper layer that the task has been handled.
However, this also frees the underlying SAS task. A -ENODEV is then
returned to the caller. When libsas sas_ata_qc_issue() receives this error
value, it assumes the task wasn't handled/queued by LLDD and proceeds to
clean up and free the task again, resulting in a double free.Since pm8001_queue_command() handles the SAS task in this case, it should
return 0 to the caller indicating that the task has been handled.
CVSS v3.1 score: 7.8
GHSA-3p89-8hm7-44h4 
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the tutor_delete_announcement() function in all versions up to, and including, 2.6.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary posts.
CVSS v3.1 score: 5.4
CVE-2025-40615 Reflected Cross-Site Scripting (XSS) vulnerability in Bookgy
Reflected Cross-Site Scripting (XSS) vulnerability in Bookgy. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the "TEXTO" parameter in /api/api_ajustes.php.
CVSS v4.0 score: 5.1
RHSA-2026:1652 Red Hat Security Advisory: Red Hat Ceph Storage
python: Invalid value for OpenSSL API may cause Buffer over-read when NPN is used systemd-coredump: race condition that allows a local attacker to crash a SUID program and gain read access to the resulting core dump cpython: Python HTMLParser quadratic complexity python: Quadratic complexity in os.path.expandvars() with user-controlled template sqlite: Integer Truncation in SQLite cpython: python: Python zipfile End of Central Directory (EOCD) Locator record offset not checked openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap libxslt: libxml2: Inifinite recursion at exsltDynMapFunction function in libexslt/dynamic.c glib: Integer overflow in in g_escape_uri_string() tar: Tar path traversal firefox: thunderbird: expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing openssh: OpenSSH: Control characters in usernames can lead to code execution via ProxyCommand openssh: OpenSSH: Null character in ssh:// URI can lead to code execution via ProxyCommand urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion urllib3: urllib3 Streaming API improperly handles highly compressed data GnuPG: GnuPG: Information disclosure and potential arbitrary code execution via out-of-bounds write urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)
CVSS v3.1 score: 7.5
GHSA-fpgp-7gxr-qx3q 
The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching session to the operator who initiated it, allowing a lower-privileged account that an operator is currently switched into to be resolved as that operator and to switch into any permitted account, including an administrator, resulting in full account takeover.
CVSS v3.1 score: 7.5
CVE-2026-11875 WP Support Plus Responsive Ticket System <= 9.1.2 - Unauthenticated Support Ticket Access via Session Cookie Forgery
The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not sign or verify its guest-session cookie, allowing unauthenticated attackers to forge it and impersonate any ticket owner (identified by email address) to read, reply to, and close that person's support tickets.
CVSS v3.1 score: 5.3
GHSA-hp23-354f-rh79 
** DISPUTED **  PHP remote file inclusion vulnerability in init.php in Jens Tkotz myIpacNG-stats (MINGS) 0.05 allows remote attackers to execute arbitrary PHP code via a URL in the MINGS_BASE parameter.  NOTE: this issue is disputed by CVE because MINGS_BASE is defined before use.
CVE-2017-16124 
node-server-forfront is a simple static file server. node-server-forfront is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS v3.0 score: 7.5
CVSS v2.0 score: 5
CVE-2026-44900 epa4all-client: VAU Signature bypass
epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. Prior to 1.2.1, in  SignedPublicKeysTrustValidatorImpl.isTrusted(), the ECDSA signature verification at line 45 discards the boolean return value of Signature.verify(). The method performs certificate chain validation, OCSP check, and signature algorithm setup, but never checks whether the signature actually matches. For any structurally valid signature, it returns true.  This vulnerability is fixed in 1.2.1.
CVSS v3.1 score: 8.1
CVE-2026-24243 
NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.
CVSS v3.1 score: 7.8
CVE-2026-65337 
This issue was addressed through improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
GHSA-v3jw-x4g9-2mmm 
A vulnerability in which an attacker can provide a crafted external URL that may redirect a user to an unintended website.
CVSS v3.1 score: 4.8
GHSA-5wgp-xgw4-h6q2 
A vulnerability classified as critical was found in LabVantage LIMS 2017. This vulnerability affects unknown code of the file /labvantage/rc?command=page&page=SampleList&_iframename=list of the component POST Request Handler. The manipulation of the argument param1 leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-267454 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v3.1 score: 6.3
CVE-2021-3035 Bridgecrew Checkov: Unsafe deserialization of Terraform files allows code execution
An unsafe deserialization vulnerability in Bridgecrew Checkov by Prisma Cloud allows arbitrary code execution when processing a malicious terraform file. This issue impacts Checkov 2.0 versions earlier than Checkov 2.0.26. Checkov 1.0 versions are not impacted.
CVSS v3.1 score: 6.7
GHSA-6g5v-72q8-r94j 
The Services module 6.x-3.x before 6.x-3.3 and 7.x-3.x before 7.x-3.3 for Drupal allows remote authenticated users with the "access user profiles" permission to access arbitrary users' emails via vectors related to the "user index method" and "the path to the user resource."
CVE-2007-3463 
Microsoft Windows XP SP2 allows local users, who have sessions created by another user's RunAs (run as) command, to kill arbitrary processes of this other user, as demonstrated by the taskkill program.  NOTE: the researcher claims a vendor dispute in which the vendor states that "RunAs and UAC are convenience features, not security boundaries. If you need a security guarantee, please log out and log back in with a different account.
CVSS v2.0 score: 4.6
GHSA-r2wx-46gp-rp3h Moodle Improper Input Validation
Unsafe direct use of $_SERVER['HTTP_REFERER'] in admin/tool/mfa/index.php. The referrer URL used by MFA required additional sanitizing, rather than being used directly.
CVE-2020-11650 
An issue was discovered in iXsystems FreeNAS (and TrueNAS) 11.2 before 11.2-u8 and 11.3 before 11.3-U1. It allows a denial of service. The login authentication component has no limits on the length of an authentication message or the rate at which such messages are sent.
CVSS v3.1 score: 7.5
CVSS v2.0 score: 5
CVE-2022-42721 
A list management bug in BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to corrupt a linked list and, in turn, potentially execute code.
CVSS v3.1 score: 5.5
CVE-2026-46301 spi: topcliff-pch: fix use-after-free on unbind
In the Linux kernel, the following vulnerability has been resolved:

spi: topcliff-pch: fix use-after-free on unbind

Give the driver a chance to flush its queue before releasing the DMA
buffers on driver unbind
CVSS v3.1 score: 7.8
GHSA-6wqx-grg2-grhw 
Mozilla developers and community members reported memory safety bugs present in Firefox 68, Firefox ESR 68, and Firefox 60.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1.
CVSS v3.1 score: 8.8
CVE-2026-2441 
Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS v3.1 score: 8.8
CVE-2025-26503 Buffer manipulation
A crafted system call argument can cause memory corruption.
CVSS v3.1 score: 6.7
GHSA-x3gx-2fx2-5hqr 
Unauthenticated Cross Site Scripting (XSS) in Super Socializer <= 7.14.5 versions.
CVSS v3.1 score: 7.1
GHSA-c429-fc87-8669 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the boundItem method of a TimeField. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-6484.
CVSS v3.0 score: 8.8
GHSA-jfh9-vp9v-wh4v 
ColdFusion ClusterCATS appends stale query string arguments to a URL during HTML redirection, which may provide sensitive information to the redirected site.
CVE-2016-5431 
The PHP JOSE Library by Gree Inc. before version 2.2.1 is vulnerable to key confusion/algorithm substitution in the JWS component resulting in bypassing the signature verification via crafted tokens.
CVSS v3.1 score: 7.5
CVSS v2.0 score: 5
CVE-2025-12875 mruby array.c ary_fill_exec out-of-bounds write
A weakness has been identified in mruby 3.4.0. This vulnerability affects the function ary_fill_exec of the file mrbgems/mruby-array-ext/src/array.c. Executing a manipulation of the argument start/length can lead to out-of-bounds write. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. This patch is called 93619f06dd378db6766666b30c08978311c7ec94. It is best practice to apply a patch to resolve this issue.
CVSS v4.0 score: 4.8
CVSS v3.1 score: 5.3
CVSS v3.0 score: 5.3
CVSS v2.0 score: 4.3
GHSA-whgh-g24c-3j5q hutool-json stack overflow vulnerability
A stack overflow in the org.json.JSONTokener.nextValue::JSONTokener.java component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) via crafted JSON or XML data.
CVE-2020-35687 
PHPFusion version 9.03.90 is vulnerable to CSRF attack which leads to deletion of all shoutbox messages by the attacker on behalf of the logged in victim.
CVSS v3.1 score: 4.3
CVSS v2.0 score: 4.3
RHSA-2026:9094 Red Hat Security Advisory: grafana-pcp security update
net/url: Incorrect parsing of IPv6 host literals in net/url
CVSS v3.1 score: 7.5
CVE-2023-4593 Path Traversal in BVRP Software SLmail
Path traversal vulnerability whose exploitation could allow an authenticated remote user to bypass SecurityManager's intended restrictions and list a parent directory via any filename, such as a multiple ..%2F value affecting the 'dodoc' parameter in the /MailAdmin_dll.htm file.
CVSS v3.1 score: 6.5
GHSA-vw62-7j4r-397q 
ZModo ZP-NE14-S and ZP-IBH-13W devices do not enforce a WPA2 configuration setting, which allows remote attackers to trigger association with an arbitrary access point by using a recognized SSID value.
CVSS v3.0 score: 7.5
CVE-2017-0588 
A remote code execution vulnerability in id3/ID3.cpp in libstagefright in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34618607.
CVSS v3.0 score: 7.8
CVSS v2.0 score: 9.3
GHSA-fxw5-mp3x-jpj6 
Multiple PHP remote file inclusion vulnerabilities in PHPauction GPL 2.51 allow remote attackers to execute arbitrary PHP code via a URL in the include_path parameter to (1) converter.inc.php, (2) messages.inc.php, and (3) settings.inc.php in includes/.
GHSA-pq75-7223-cwcc 
PDF-XChange Editor PRC File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of PRC files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26734.
CVSS v3.0 score: 7.8
CVE-2026-20676 
This issue was addressed through improved state management. This issue is fixed in Safari 26.3, iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, visionOS 26.3. A website may be able to track users through Safari web extensions.
CVSS v3.1 score: 4.3
GHSA-9vhj-8h2m-3g3m 
A vulnerability was found in Open5GS up to 2.7.6. This impacts the function ran_ue_find_by_amf_ue_ngap_id of the file src/amf/context.c of the component AMF/MME. Performing a manipulation results in improper authorization. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The patch is named 5746b8576cfceec18ed87eb7d8cf11b1fb4cd8b1. It is suggested to install a patch to address this issue.
CVSS v4.0 score: 2.1
CVSS v3.1 score: 6.3
RHSA-2026:0094 Red Hat Security Advisory: mod_md security update
mod_md: Apache HTTP Server: mod_md (ACME), unintended retry intervals
CVSS v3.1 score: 7.5
CVE-2022-23254 Microsoft Power BI Information Disclosure Vulnerability
Microsoft Power BI Information Disclosure Vulnerability
CVSS v3.1 score: 4.9
CVE-2005-2819 
DownFile 1.3 allows remote attackers to gain administrator privileges via a direct request to (1) update.php, (2) del.php, and (3) add_form.php.
CVSS v2.0 score: 7.5
GHSA-cp9p-hq5q-j2j2 
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_add_mailbox.php. When parsing the username parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-9729.
CVSS v3.1 score: 7.5
CVE-2021-4021 
A vulnerability was found in Radare2 in versions prior to 5.6.2, 5.6.0, 5.5.4 and 5.5.2. Mapping a huge section filled with zeros of an ELF64 binary for MIPS architecture can lead to uncontrolled resource consumption and DoS.
CVSS v3.1 score: 7.5
CVSS v2.0 score: 5
GHSA-4rmm-hmcx-2hg3 
An issue was discovered in Cloud Foundry Foundation Cloud Foundry release versions prior to v245 and cf-mysql-release versions prior to v31. A command injection vulnerability was discovered in a common script used by many Cloud Foundry components. A malicious user may exploit numerous vectors to execute arbitrary commands on servers running Cloud Foundry.
CVSS v3.0 score: 9.8
GHSA-x2j4-7cp7-cff7 
While a user account for the IBM Spectrum Protect Server 8.1.0.000 through 8.1.14 is being established, it may be configured to use SESSIONSECURITY=TRANSITIONAL. While in this mode, it may be susceptible to an offline dictionary attack. IBM X-Force ID: 226942.
CVSS v3.1 score: 6.5
CVE-2018-1900 
IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, 7.0.1, and 7.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152529.
CVSS v3.0 score: 5.4
CVE-2003-0875 
Symbolic link vulnerability in the slpd script slpd.all_init for OpenSLP before 1.0.11 allows local users to overwrite arbitrary files via the route.check temporary file.
CVSS v2.0 score: 2.1
CVE-2013-6643 
The OneClickSigninBubbleView::WindowClosing function in browser/ui/views/sync/one_click_signin_bubble_view.cc in Google Chrome before 32.0.1700.76 on Windows and before 32.0.1700.77 on Mac OS X and Linux allows attackers to trigger a sync with an arbitrary Google account by leveraging improper handling of the closing of an untrusted signin confirm dialog.
CVSS v2.0 score: 7.5
CVE-2026-74461 i2c: imx: Cancel hrtimer before clearing slave pointer
In the Linux kernel, the following vulnerability has been resolved:

i2c: imx: Cancel hrtimer before clearing slave pointer

In i2c_imx_unreg_slave(), the slave pointer is set to NULL after
disabling interrupts.  However, a pending interrupt might already
have started the hrtimer (i2c_imx_slave_timeout) before the pointer
was cleared.  If the hrtimer fires after i2c_imx->slave is set to
NULL, the timer callback i2c_imx_slave_finish_op() will call
i2c_imx_slave_event() with a NULL slave pointer, which results in a
use-after-free / NULL pointer dereference.

Fix by canceling the hrtimer and waiting for it to complete after
disabling interrupts, before clearing the slave pointer.
CVSS v3.1 score: 8.4
CVE-2018-19624 
In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the PVFS dissector could crash. This was addressed in epan/dissectors/packet-pvfs2.c by preventing a NULL pointer dereference.
CVSS v3.0 score: 5.5
CVSS v2.0 score: 4.3
GHSA-77w9-6m5g-vpj2 
HarfBuzz 2.9.0 has an out-of-bounds write in hb_bit_set_invertible_t::set (called from hb_sparseset_t<hb_bit_set_invertible_t>::set and hb_set_copy).
CVSS v3.1 score: 6.5
GHSA-fh65-c5x2-5936 
LeapFTP < 3.1.x contains a stack-based buffer overflow vulnerability in its FTP client parser. When the client receives a directory listing containing a filename longer than 528 bytes, the application fails to properly bound-check the input and overwrites the Structured Exception Handler (SEH) chain. This allows an attacker operating a malicious FTP server to execute arbitrary code on the victim’s machine when the file is listed or downloaded.
CVSS v4.0 score: 9.3
GHSA-4jcp-gxvj-75jh 
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 14.8 and iPadOS 14.8, watchOS 8, Safari 15, tvOS 15, iOS 15 and iPadOS 15, iTunes 12.12 for Windows. Processing maliciously crafted web content may lead to arbitrary code execution.
CVE-2025-30033 
The affected setup component is vulnerable to DLL hijacking. This could allow an attacker to execute arbitrary code when a legitimate user installs an application that uses the affected setup component.
CVSS v4.0 score: 8.5
CVSS v3.1 score: 7.8
GHSA-58p7-5qf7-xprq 
A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability manifests on line 8719 of biosig.c on the current master branch (35a819fa), when the Tag is 0:
CVSS v3.1 score: 9.8
CVE-2021-1799 
A port redirection issue was addressed with additional port validation. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, tvOS 14.4, watchOS 7.3, iOS 14.4 and iPadOS 14.4, Safari 14.0.3. A malicious website may be able to access restricted ports on arbitrary servers.
CVSS v3.1 score: 6.5
CVSS v2.0 score: 4.3
CVE-2022-42806 
A race condition was addressed with improved locking. This issue is fixed in iOS 16.1 and iPadOS 16, macOS Ventura 13. An app may be able to execute arbitrary code with kernel privileges.
CVSS v3.1 score: 7
CVE-2006-1786 
Cross-site scripting (XSS) vulnerability in Adobe Document Server for Reader Extensions 6.0 allows remote attackers to inject arbitrary web script or HTML via (1) the actionID parameter in ads-readerext and (2) the op parameter in AlterCast. NOTE: it is not clear whether the vendor advisory addresses this issue.
CVSS v2.0 score: 2.6
GHSA-wjwh-qfxf-rmcq 
A vulnerability, which was classified as critical, was found in D-Link DIR-619L 2.06B01. This affects the function formAutoDetecWAN_wizard4 of the file /goform/formAutoDetecWAN_wizard4. The manipulation of the argument curTime leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS v4.0 score: 7.4
CVSS v3.1 score: 8.8
GHSA-wvqx-v3f6-w8rh jsrsasign: DSA signatures or X.509 certificates can be forged via DSA domain-parameter validation in KJUR.crypto.DSA.setPublic
Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signature via the DSA domain-parameter validation in KJUR.crypto.DSA.setPublic (and the related DSA/X509 verification flow in src/dsa-2.0.js). An attacker can forge DSA signatures or X.509 certificates that X509.verifySignature() accepts by supplying malicious domain parameters such as g=1, y=1, and a fixed r=1, which make the verification equation true for any hash.
CVSS v4.0 score: 8.1
CVSS v3.1 score: 7.4
CVE-2024-45769 Pcp: pmcd heap corruption through metric pmstore operations
A vulnerability was found in Performance Co-Pilot (PCP).  This flaw allows an attacker to send specially crafted data to the system, which could cause the program to misbehave or crash.
CVSS v3.1 score: 5.5
GHSA-94hm-2957-3gcc 
A stored cross-site scripting (XSS) vulnerability in the Create Regions (/dcim/regions/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
CVSS v3.1 score: 5.4
CVE-2018-14666 
An improper authorization flaw was found in the Smart Class feature of Foreman. An attacker can use it to change configuration of any host registered in Red Hat Satellite, independent of the organization the host belongs to. This flaw affects all Red Hat Satellite 6 versions.
CVSS v3.0 score: 6.8
GHSA-mqw7-c5gg-xq97 Jervis Has a RSA PKCS#1 Padding Vulnerability
Vulnerabilityhttps://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L463-L465https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L495-L497Uses `PKCS1Encoding` which is vulnerable to Bleichenbacher padding oracle attacks. Modern systems should use OAEP (Optimal Asymmetric Encryption Padding).ImpactSeverity is considered low for internal uses of this library but if there's any consumer using these methods directly then this is considered critical.An attacker with access to a decryption oracle (e.g., timing differences or error messages) could potentially decrypt ciphertext without knowing the private key.Jervis uses RSA to encrypt AES keys in local-only storage inaccessible from the web.  The data stored is GitHub App authentication tokens which will expire within one hour or less.PatchesJervis patch will migrate from `PKCS1Encoding` to `OAEPEncoding`.Upgrade to Jervis 2.2.WorkaroundsNoneReferences[Bleichenbacher's Attack on PKCS#1](https://en.wikipedia.org/wiki/Adaptive_chosen-ciphertext_attack)
CVSS v4.0 score: 8.7
CVSS v3.1 score: 7.5
GHSA-7fj8-g5x7-m9v3 
A flaw in the binding process of Govee’s cloud platform and devices allows a remote attacker to bind an existing, online Govee device to the attacker’s account, resulting in full control of the device and removal of the device from its legitimate owner’s account.
The server‑side API allows device association using a set of identifiers: "device", "sku", "type", and a client‑computed "value", that are not cryptographically bound to a secret originating from the device itself.The vulnerability has been verified for the Govee H6056 - lamp device in firmware version 1.08.13, but may affect also other Govee cloud‑connected devices. The vendor is not able to provide a list of affected products, but rolls out a firmware and server-side fixes. Devices that reached end‑of‑life for security support need replacement with newer models supporting updates.
CVSS v4.0 score: 9.3
CVE-2024-24812 Frappe Authenticated Reflected Cross site scripting (XSS) in portal pages
Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and a tightly integrated client side library. Prior to versions 14.59.0 and 15.5.0, portal pages are susceptible to Cross-Site Scripting (XSS) which can be used to inject malicious JS code if user clicks on a malicious link. This vulnerability has been patched in versions 14.59.0 and 15.5.0. No known workarounds are available.
CVSS v3.1 score: 5.4
GHSA-pw7h-6fp2-pvmv 
The Optimize Your Campaigns – Google Shopping – Google Ads – Google Adwords plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.1 due to the print_php_information.php being publicly accessible. This makes it possible for unauthenticated attackers to extract sensitive configuration data that can be leveraged in another attack.
CVSS v3.1 score: 5.3