CIRCL/vulnerability-scores huggingface dataset:
GHSA-f3pj-q27g-923q 
In the Linux kernel, the following vulnerability has been resolved:batman-adv: tp_meter: avoid divide-by-zero for dec_cwndThe cwnd is always MSS <= cwnd <= 0x20000000. But the calculation in
batadv_tp_update_cwnd() assumes unsigned 32 bit arithmetics.In case cwnd is actually 0x20000000, it will be shifted by 3 bit to the
left end up at 0x100000000 or U32_MAX + 1. It will therefore wrap around
and be 0 - resulting in:This is of course invalid and cannot be calculated. The calculation should
must be simplified to avoid this overflow:(mss ** 2) * 8 / cwndIt will keep the precision enhancement from the scaling (by 8) but avoid
the overflow in the divisor.In theory, there could still be an overflow in the dividend. It is at the
moment fixed to BATADV_TP_PLEN in batadv_tp_recv_ack() - so it is not an
imminent problem. But allowing it to use the whole u32 bit range, would
mean that it can still use up to 67 bits. To keep this calculation safe for
32 bit arithmetic, mss must never use more than floor((32 - 3) / 2) bits -
or in other words: must never be larger than 16383.
GHSA-29p5-jqph-prvj 
Adobe After Effects version 18.2.1 (and earlier) is affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose arbitrary memory information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
GHSA-vwf5-w456-qjfw 
Buffer overflow in Mercury MTA POP3 server for NetWare 1.48 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long APOP command.
CVE-2021-29960 
Firefox used to cache the last filename used for printing a file. When generating a filename for printing, Firefox usually suggests the web page title. The caching and suggestion techniques combined may have lead to the title of a website visited during private browsing mode being stored on disk. This vulnerability affects Firefox < 89.
CVSS v3.1 score: 4.3
CVSS v2.0 score: 4.3
CVE-2014-4265 
Unspecified vulnerability in Oracle Java SE 6u75, 7u60, and 8u5 allows remote attackers to affect integrity via unknown vectors related to Deployment.
CVSS v2.0 score: 5
GHSA-3244-863h-59jf 
The Firelight Lightbox WordPress plugin before 2.3.16 does not sanitise and escape title attributes before outputting them in the page, which could allow users with a role as low as contributors to perform stored Cross-Site Scripting attacks.
CVSS v3.1 score: 5.4
CVE-2026-49956 Hermes WebUI < 0.51.269 Profile Isolation Bypass via sessions search
Hermes WebUI before version 0.51.269 contains a profile isolation bypass vulnerability that allows authenticated users to access data belonging to other profiles by querying the session search endpoint without active-profile filtering. Attackers can send requests to the sessions search handler to retrieve session titles and transcript message content from profiles other than their own active profile.
CVSS v4.0 score: 7.1
CVSS v3.1 score: 6.5
GHSA-jxw6-4vrc-qvm7 
The Elfsight Telegram Chat CC plugin for WordPress is vulnerable to unauthorized modification of data to a missing capability check on the 'updatePreferences' function in all versions up to, and including, 1.1.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1 score: 6.4
GHSA-8vp4-x4mx-xq42 
The rc-httpd component through 2022-03-31 for 9front (Plan 9 fork) allows ..%2f directory traversal if serve-static is used.
CVSS v3.1 score: 7.5
RHSA-2011:1439 Red Hat Security Advisory: thunderbird security update
Mozilla: Security problem with loadSubScript on 1.9.2 branch (MFSA 2011-46) Mozilla: Universal XSS likely with MultiByte charset (MFSA 2011-47) Mozilla: crash while profiling page with many functions (MFSA 2011-49)
GHSA-3jvv-6xf5-32ff 
An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to obtain sensitive information or cause a denial of service (memory corruption) via a crafted web site.
CVSS v3.0 score: 8.1
GHSA-vxgw-3746-47rm 
An issue was discovered in ONOS 2.5.1. There is an incorrect comparison of flow rules installed by intents. A remote attacker can install or remove a new intent, and consequently modify or delete the existing flow rules related to other intents.
CVSS v3.1 score: 6.5
CVE-2007-3917 
The multiplayer engine in Wesnoth 1.2.x before 1.2.7 and 1.3.x before 1.3.9 allows remote servers to cause a denial of service (crash) via a long message with multibyte characters that can produce an invalid UTF-8 string after it is truncated, which triggers an uncaught exception, involving the truncate_message function in server/server.cpp.  NOTE: this issue affects both clients and servers.
CVSS v2.0 score: 7.8
GHSA-98m4-j87f-4xfc 
Multiple format string vulnerabilities in zabbix before 20061006 allow attackers to cause a denial of service (application crash) and possibly execute arbitrary code via format string specifiers in information that would be recorded in the system log using (1) zabbix_log or (2) zabbix_syslog.
GHSA-79pr-x8cf-vhgw 
The ReadVIFFImage function in coders/viff.c in ImageMagick 7.0.6-6 allows remote attackers to cause a denial of service (memory consumption) via a crafted VIFF file.
CVSS v3.0 score: 6.5
CVE-2020-26903 
Certain NETGEAR devices are affected by disclosure of administrative credentials. This affects CBR40 before 2.5.0.10, RBK752 before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK852 before 3.2.10.11, RBR850 before 3.2.10.11, and RBS850 before 3.2.10.11.
CVSS v3.1 score: 9.6
cisco-sa-20190813-bluetooth Key Negotiation of Bluetooth Vulnerability
A weakness in the Bluetooth Basic Rate/Enhanced Data Rate (BR/EDR) protocol core specification exposes a vulnerability that could allow for an unauthenticated, adjacent attacker to perform a man-in-the-middle attack on an encrypted Bluetooth connection. The attack must be performed during negotiation or renegotiation of a paired device connection; existing sessions cannot be attacked.

The issue could allow the attacker to reduce the entropy of the negotiated session key that is used to secure a Bluetooth connection between a paired device and a host device.  An attacker who can successfully inject a malicious message into a Bluetooth connection during session negotiation or renegotiation could cause the strength of the session key to be susceptible to brute force attack.

This advisory will be updated as additional information becomes available. There are no workarounds that address this vulnerability.


CVSS v3.0 score: 9.3
CVE-2023-45077 
A memory leakage vulnerability was reported in the 534D0740 DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables. 
CVSS v3.1 score: 6.7
CVE-2020-28693 
An unrestricted file upload issue in HorizontCMS 1.0.0-beta allows an authenticated remote attacker to upload PHP code through a zip file by uploading a theme, and executing the PHP file via an HTTP GET request to /themes/<php_file_name>
CVSS v3.1 score: 8.8
CVSS v2.0 score: 9
CVE-2017-14182 
A Denial of Service (DoS) vulnerability in Fortinet FortiOS 5.4.0 to 5.4.5 allows an authenticated user to cause the web GUI to be temporarily unresponsive, via passing a specially crafted payload to the 'params' parameter of the JSON web API.
CVSS v3.0 score: 6.5
CVSS v2.0 score: 4
GHSA-3x3p-2fwv-2ppj 
The HwPCAssistant module has the out-of-bounds read/write vulnerability. Successful exploitation of this vulnerability may affect confidentiality and integrity.
CVSS v3.1 score: 9.1
GHSA-22c9-2rqw-7g84 
In the Linux kernel, the following vulnerability has been resolved:scsi: aic94xx: fix use-after-free in device removal pathThe asd_pci_remove() function fails to synchronize with pending tasklets
before freeing the asd_ha structure, leading to a potential
use-after-free vulnerability.When a device removal is triggered (via hot-unplug or module unload),
race condition can occur.The fix adds tasklet_kill() before freeing the asd_ha structure,
ensuring all scheduled tasklets complete before cleanup proceeds.
CVSS v3.1 score: 7.8
GHSA-54q9-347p-ccwv 
Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the 'in _TIFFmemcpy' funtion in the component 'tif_unix.c'.
CVE-2024-34352 Arbitrary file write vulnerability in 1Panel 
1Panel is an open source Linux server operation and maintenance management panel. Prior to  v1.10.3-lts, there are many command injections in the project, and some of them are not well filtered, leading to arbitrary file writes, and ultimately leading to RCEs. The mirror configuration write symbol `>` can be used to achieve arbitrary file writing. This vulnerability is fixed in  v1.10.3-lts.
CVSS v3.1 score: 6.5
GHSA-ccpj-r729-pqcf 
In the Linux kernel, the following vulnerability has been resolved:amt: fix possible memory leak in amt_rcv()If an amt receives packets and it finds socket.
If it can't find a socket, it should free a received skb.
But it doesn't.
So, a memory leak would possibly occur.
CVSS v3.1 score: 5.5
GHSA-hj26-rh6r-85r8 
** UNSUPPORTED WHEN ASSIGNED ** WebAdmin Control Panel in Atmail 6.5.0 (a version released in 2012) allows XSS via the format parameter to the default URI. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS v3.1 score: 6.1
GHSA-6gxv-ch26-86wv 
An file upload vulnerability in Ivanti ITSM before 2023.4, allows an authenticated remote user to perform file writes to the server. Successful exploitation may lead to execution of commands in the context of non-root user.
CVSS v3.0 score: 9.9
GHSA-9f2j-hwhw-8fxw 
Cross Site Scripting (XSS) vulnerability in gnuboard5 <=v5.3.2.8 via the act parameter in bbs/move_update.php.
CVSS v3.1 score: 6.1
GHSA-5x39-mv3c-q6cc 
The pciej_write function in hw/acpi_piix4.c in the PIIX4 Power Management emulation in qemu-kvm does not check if a device is hotpluggable before unplugging the PCI-ISA bridge, which allows privileged guest users to cause a denial of service (guest crash) and possibly execute arbitrary code by sending a crafted value to the 0xae08 (PCI_EJ_BASE) I/O port, which leads to a use-after-free related to "active qemu timers."
GHSA-3g9w-x9xq-cq9g 
Integer overflow in Skia in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Critical)
CVSS v3.1 score: 8.8
GHSA-25fq-6qgg-qpj8 SCEditor has DOM XSS via emoticon URL/HTML injection
If an attacker has the ability control configuration options passed to `sceditor.create()`, like `emoticons`, `charset`, etc. then it's possible for them to trigger an XSS attack due to lack of sanitisation of configuration options.Proof of concept:
CVSS v3.1 score: 5.4
GHSA-mg4x-c4g8-f6h5 
The mx4200_send function in the legacy MX4200 refclock in NTP before 4.2.8p10 and 4.3.x before 4.3.94 does not properly handle the return value of the snprintf function, which allows local users to execute arbitrary code via unspecified vectors, which trigger an out-of-bounds memory write.
CVSS v3.0 score: 7.8
GHSA-r97x-9xgg-cf5w 
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2013-0425 and CVE-2013-0426.  NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "incorrect checks for proxy classes" in the Reflection API.
CVE-2021-43013 Adobe Media Encoder memory corruption vulnerability could lead to remote code execution
Adobe Media Encoder version 15.4.1 (and earlier) are affected by a memory corruption vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1 score: 7.8
GHSA-3953-gjxx-vgwp 
A vulnerability was found in GE Voluson S8. It has been rated as critical. This issue affects the Service Browser which itroduces hard-coded credentials. Attacking locally is a requirement. It is recommended to change the configuration settings.
CVSS v3.1 score: 7.8
CVE-2021-38108 
Word97Import200.dll in Corel WordPerfect 2020 20.0.0.200 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to access unauthorized system memory in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious DOC file.
CVSS v3.1 score: 5.5
CVSS v2.0 score: 4.3
GHSA-23x2-c6m6-m9c7 
Vulnerability in ppl in HP-UX 10.x and earlier allows local users to gain root privileges by forcing ppl to core dump.
CVE-2025-15079 libssh global known_hosts override
When doing SSH-based transfers using either SCP or SFTP, and setting the
known_hosts file, libcurl could still mistakenly accept connecting to hosts
*not present* in the specified file if they were added as recognized in the
libssh *global* known_hosts file.
CVSS v3.1 score: 5.3
RHSA-2020:3936 Red Hat Security Advisory: ipa security, bug fix, and enhancement update
jquery: Cross-site scripting via cross-domain ajax requests bootstrap: XSS in the data-target attribute bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip bootstrap: XSS in the tooltip data-viewport attribute bootstrap: XSS in the affix configuration target property bootstrap: XSS in the tooltip or popover data-template attribute jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection ipa: No password length restriction leads to denial of service jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method
CVSS v3.1 score: 6.1
CVSS v3.0 score: 5.6
GHSA-rg4h-fpcp-2qm8 Microsoft Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref
SummaryMicrosoft Kiota resolved OpenAPI `$ref`s by fetching remote `http(s)` URLs and reading local files
(including absolute / out-of-tree paths), inlining the referenced schema into the generated client.
Running `kiota generate` on a spec whose `$ref` pointed at an attacker/internal URL or an arbitrary
local file yielded SSRF, remote file inclusion, and local file inclusion. Verified on **1.32.3 / 1.32.4**.Details`$ref: http://attacker/internal-evil.json#/...` → build host fetches the URL (SSRF) and inlines the
remote schema (RFI); confirmed property `REMOTE_KIOTA_PROP` in the generated client.`$ref: /abs/path.json#/...` or `../../secret.json#/...` → Kiota reads the out-of-tree local file and
inlines its schema (LFI); confirmed `Leaked` schema in the generated client. Resolution is transitive
across nesting levels.Kiota **escapes** its output sinks (comments/strings/identifiers), so attacker-controlled remote/local
content cannot break out into code — no RCE. The chain stops at SSRF + RFI + LFI.ImpactBuild-time SSRF (CWE-918) from the developer or CI host, disclosure of arbitrary local files (CWE-22), and
inclusion of untrusted remote content (CWE-829), from running the generator on an attacker-controlled or
attacker-influenced OpenAPI description. No code execution. Notable because Kiota is otherwise the hardened
generator (it resists the code-injection class).The relevant threat is not "change the generated output" (an attacker who fully controls the description can
already do that) but the **side effects on the build host**: outbound requests from inside the CI network
(cloud metadata, internal-only services) and reads of local files the attacker never possessed, whose contents
are then inlined into the generated — and typically committed/published — client. It also bypasses controls
that review the description document but not externally-referenced content.PatchesFixed in **1.29.1 and 1.32.5** (https://github.com/microsoft/kiota/pull/7888). External reference resolution is now
**default-deny**: a new `AllowedExternalOriginsStreamLoader` refuses to load any external `$ref` — remote
`http(s)` URLs and local file paths alike — unless its origin/path is explicitly allow-listed. A new
`--allowed-external-origins` parameter (added to the commands that load OpenAPI descriptions) opts specific
origins back in, accepting `*`, full URIs, URI patterns, full paths, relative paths, or path patterns
(wildcards supported). With no allow-list entries, external references are not loaded at all.RemediationUpgrade to Kiota **1.29.1, 1.32.5,** or later. External references now require explicit opt-in via
`--allowed-external-origins`; add only trusted origins/paths.
CVSS v3.1 score: 7.1
GHSA-89ch-hqf9-rgp3 Using JS libraries with known security vulnerabilities
An insecure component vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. Magento 2 codebase leveraged outdated versions of JS libraries (Bootstrap, jquery, Knockout) with known security vulnerabilities.
GHSA-4rj4-mjp8-mcgg 
Untrusted search path vulnerability in OpenLDAP before 2.2.28-r3 on Gentoo Linux allows local users in the portage group to gain privileges via a malicious shared object in the Portage temporary build directory, which is part of the RUNPATH.
GHSA-2388-fgq3-x3rp 
In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple SQL injection vulnerabilities exists which allow a low privileged and administrative user to access the database and its content.
CVSS v3.1 score: 5.4
CVE-2015-10071 gitter-badger ezpublish-modern-legacy forgotpassword.php password recovery
A vulnerability was found in gitter-badger ezpublish-modern-legacy. It has been rated as problematic. This issue affects some unknown processing of the file kernel/user/forgotpassword.php. The manipulation leads to weak password recovery. The complexity of an attack is rather high. The exploitation is known to be difficult. Upgrading to version 1.0 is able to address this issue. The patch is named 5908d5ee65fec61ce0e321d586530461a210bf2a. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-218951.
CVSS v3.1 score: 2.6
CVSS v3.0 score: 2.6
CVSS v2.0 score: 1.4
GHSA-5h3g-6xhh-rg6p OpenClaw: OpenShell FS bridge reads pin and verify the opened file before returning bytes
SummaryOpenShell FS bridge reads pin and verify the opened file before returning bytesAffected Packages / VersionsPackage: openclaw (npm)Affected versions: <= 2026.4.21Fixed version: 2026.4.22ImpactA time-of-check/time-of-use race around OpenShell sandbox filesystem reads could let a symlink swap cause bytes outside the intended mount root to be read.FixOpenShell reads now open the file with no-follow semantics where available, validate the pinned file descriptor against the canonical mount root, reject unsafe hardlink/symlink cases, and use a strict fallback ancestor walk on platforms without fd-path readback.Fix Commit(s)95119017c847c737bd113f0bff728c4666d79c45VerificationThe fix commit is contained in the public v2026.4.22 tag.openclaw@2026.4.22 is published on npm and the compiled package contains the fix.Focused regression coverage for this path passed before publication.Thanks @VladimirEliTokarev for reporting.
CVSS v4.0 score: 6
CVSS v3.1 score: 5.3
CVE-2009-1154 
Cisco IOS XR 3.8.1 and earlier allows remote attackers to cause a denial of service (process crash) via a long BGP UPDATE message, as demonstrated by a message with many AS numbers in the AS Path Attribute.
CVSS v2.0 score: 3.3
GHSA-fm9r-6h86-jc5q 
Cross-site scripting (XSS) vulnerability in images_archive.asp in Uapplication Uphotogallery 1.1 allows remote authenticated administrators to inject arbitrary web script or HTML via the s parameter.  NOTE: the thumbnails.asp vector is already covered by CVE-2006-3023.
CVE-2016-6414 
iox in Cisco IOS, possibly 15.6 and earlier, and IOS XE, possibly 3.18 and earlier, allows local users to execute arbitrary IOx Linux commands on the guest OS via crafted iox command-line options, aka Bug ID CSCuz59223.
CVSS v3.0 score: 7.8
CVSS v2.0 score: 7.2
CVE-2019-8158 
An XPath entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An attacker can craft a GET request to page cache block rendering module that gets passed to XML data processing engine without validation. The crafted key/value GET request data allows an attacker to limited access to underlying XML data.
CVSS v3.1 score: 9.8
CVSS v2.0 score: 7.5
GHSA-rhjf-qfgh-pmw6 
Improper restriction of excessive authentication attempts vulnerability in Turkiye Electricity Transmission Corporation (TEİAŞ) Mobile Application allows Brute Force.This issue affects Mobile Application: from 1.6.2 before 1.13.
CVSS v3.1 score: 6.3
GHSA-84g2-hv74-xvjc 
Multiple cross-site request forgery (CSRF) vulnerabilities in Ipswitch MOVEit Mobile 1.2.0.962 and earlier allow remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS v3.0 score: 8.8
CVE-2020-9833 
A memory initialization issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15.5. A local user may be able to read kernel memory.
CVSS v3.1 score: 5.5
CVSS v2.0 score: 4.9
CVE-2016-2413 
media/libmedia/IOMX.cpp in mediaserver in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not initialize a handle pointer, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26403627.
CVSS v3.0 score: 7.8
CVSS v2.0 score: 9.3
GHSA-qf7h-2v85-whcw 
Cross-site request forgery (CSRF) vulnerability in WordPress before 4.7.1 allows remote attackers to hijack the authentication of unspecified victims via vectors involving a Flash file upload.
CVSS v3.0 score: 8.8
GHSA-fw73-7p7w-p28m 
In PyTorch before 2.7.0, when inductor is used, nn.Fold has an assertion error.
CVSS v3.1 score: 5.3
CVE-2020-7727 Prototype Pollution
All versions of package gedi are vulnerable to Prototype Pollution via the set function.
CVSS v3.1 score: 9.8
CVE-2023-21461 
Improper authorization vulnerability in AutoPowerOnOffConfirmDialog in Settings prior to SMR Mar-2023 Release 1 allows local attacker to turn device off via unprotected activity.
CVSS v3.1 score: 4
CVE-2016-2094 
The HTTPS NIO Connector allows remote attackers to cause a denial of service (thread consumption) by opening a socket and not sending an SSL handshake, aka a read-timeout vulnerability.
CVSS v3.0 score: 7.5
CVSS v2.0 score: 5
CVE-2010-3097 
Directory traversal vulnerability in WinFrigate Frigate 3 FTP client 3.36 and earlier allows remote FTP servers to overwrite arbitrary files via a "..\" (dot dot backslash) in a filename.
CVSS v2.0 score: 9.3
GHSA-9f4m-xrm4-4h98 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Hotech Software Inc. Otello allows Stored XSS.This issue affects Otello: from 2.4.0 before 2.4.4.
CVSS v3.1 score: 7.3
RHSA-2021:2634 Red Hat Security Advisory: go-toolset-1.15 and go-toolset-1.15-golang security and bug fix update
golang: archive/zip: malformed archive may cause panic or memory exhaustion
CVSS v3.1 score: 7.5
CVE-2009-4534 
Open redirect vulnerability in the FAQ Ask module 5.x and 6.x before 6.x-2.0, a module for Drupal, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVSS v2.0 score: 4.3
CVE-2007-0813 
Cross-site scripting (XSS) vulnerability in Home production MySearchEngine allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS v2.0 score: 4.3
GHSA-w7jw-mp2h-ch44 
Missing Authorization vulnerability in WP iCal Availability WP iCal Availability allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP iCal Availability: from n/a through 1.0.3.
CVSS v3.1 score: 5.4
CVE-2024-47882 OpenRefine's error page lacks escaping, leading to potential Cross-site Scripting on import of malicious project
OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the built-in "Something went wrong!" error page includes the exception message and exception traceback without escaping HTML tags, enabling injection into the page if an attacker can reliably produce an error with an attacker-influenced message. It appears that the only way to reach this code in OpenRefine itself is for an attacker to somehow convince a victim to import a malicious file, which may be difficult.  However, out-of-tree extensions may add their own calls to `respondWithErrorPage`. Version 3.8.3 has a fix for this issue.
CVSS v3.1 score: 5.9
GHSA-3cwm-mjh6-3hwq 
icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code by using a device file for processing a crafted image file associated with large integer values for certain sizes, related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images.
GHSA-546f-m7rq-7rxw 
Out-of-bounds read vulnerability in bootloader prior to SMR June-2024 Release 1 allows physical attackers to arbitrary data access.
CVSS v3.1 score: 4.6
GHSA-rcmr-jmrm-mjrc 
Cross-Site Request Forgery (CSRF) vulnerability in Mozilla Web Push allows Stored XSS.This issue affects Web Push: from n/a through 1.4.0.
CVSS v3.1 score: 7.1
GHSA-2q4q-jqhc-8rg8 
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.2.0 via the exportEntries function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Fluent Forms manager-level access and above, to bypass form-level access restrictions to access submissions from forms they are not authorized to view, export data from arbitrary database tables, and enumerate database table names via error message disclosure.
CVSS v3.1 score: 8.2
GHSA-v8p7-4m38-955w 
Docmosis Tornado <= 2.9.4 is vulnerable to Directory Traversal leading to the disclosure of arbitrary content on the file system.
CVSS v3.1 score: 7.5
CVE-2012-0273 
Multiple stack-based buffer overflows in MinaliC 2.0.0 allow remote attackers to execute arbitrary code via a (1) session_id cookie in a request to the get_cookie_value function in response.c, (2) directory name in a request to the add_default_file function in response.c, or (3) file name in a request to the retrieve_physical_file_name_or_brows function in response.c.
CVSS v2.0 score: 7.5
CVE-2014-9584 
The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel before 3.18.2 does not validate a length value in the Extensions Reference (ER) System Use Field, which allows local users to obtain sensitive information from kernel memory via a crafted iso9660 image.
CVSS v2.0 score: 2.1
CVE-2022-43685 
CKAN through 2.9.6 account takeovers by unauthenticated users when an existing user id is sent via an HTTP POST request. This allows a user to take over an existing account including superuser accounts.
CVSS v3.1 score: 8.8
GHSA-4cvj-xf75-4wv6 
A vulnerability has been found in Tencent WeKnora up to 0.3.6. Affected by this issue is the function getKnowledgeBaseForInitialization of the file internal/handler/initialization.go of the component Config API Endpoint. The manipulation of the argument kbId leads to authorization bypass. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0 score: 2.1
CVSS v3.1 score: 6.3
CVE-2024-10418 code-projects Blood Bank Management System infoAdd.php sql injection
A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /file/infoAdd.php. The manipulation of the argument bg leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 6.3
CVSS v3.0 score: 6.3
CVSS v2.0 score: 6.5
GHSA-35cj-v3wc-rh8w 
In showNotification of NavigationModeController.java, there is a possible confused deputy due to an unsafe PendingIntent. This could lead to local escalation of privilege that allows actions performed as the System UI with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-173025705
RHSA-2026:3876 Red Hat Security Advisory: OpenShift Container Platform 4.18.35 bug fix and security update
expat: XML Entity Expansion
CVSS v3.1 score: 7.5
GHSA-gh6x-4whr-2qv4 Null pointer dereference and heap OOB read in operations restoring tensors
ImpactWhen restoring tensors via raw APIs, if the tensor name is not provided, TensorFlow can be tricked into dereferencing a null pointer:The same undefined behavior can be triggered by `tf.raw_ops.RestoreSlice`:Alternatively, attackers can read memory outside the bounds of heap allocated data by providing some tensor names but not enough for a successful restoration:The [implementation](https://github.com/tensorflow/tensorflow/blob/47a06f40411a69c99f381495f490536972152ac0/tensorflow/core/kernels/save_restore_tensor.cc#L158-L159) retrieves the tensor list corresponding to the `tensor_name` user controlled input and immediately retrieves the tensor at the restoration index (controlled via `preferred_shard` argument). This occurs without validating that the provided list has enough values.If the list is empty this results in dereferencing a null pointer (undefined behavior). If, however, the list has some elements, if the restoration index is outside the bounds this results in heap OOB read.PatchesWe have patched the issue in GitHub commit [9e82dce6e6bd1f36a57e08fa85af213e2b2f2622](https://github.com/tensorflow/tensorflow/commit/9e82dce6e6bd1f36a57e08fa85af213e2b2f2622).The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.For more informationPlease consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.AttributionThis vulnerability has been reported by members of the Aivul Team from Qihoo 360.
CVSS v4.0 score: 8.6
CVSS v3.1 score: 8.4
GHSA-5228-qfm2-w928 
Cisco Unified IP Phones 7900 devices (aka TNP phones) with software before 9.2.1 do not properly verify signatures for software images, which allows local users to gain privileges via a crafted image, aka Bug ID CSCtn65962.
CVE-2019-2998 
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.17 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS v3.1 score: 4.9
CVSS v2.0 score: 4
CVE-2018-1000622 
The Rust Programming Language rustdoc version Between 0.8 and 1.27.0 contains a CWE-427: Uncontrolled Search Path Element vulnerability in rustdoc plugins that can result in local code execution as a different user. This attack appear to be exploitable via using the --plugin flag without the --plugin-path flag. This vulnerability appears to have been fixed in 1.27.1.
CVSS v3.0 score: 7.8
CVSS v2.0 score: 6.8
CVE-2008-3521 
Race condition in the jas_stream_tmpfile function in libjasper/base/jas_stream.c in JasPer 1.900.1 allows local users to cause a denial of service (program exit) by creating the appropriate tmp.XXXXXXXXXX temporary file, which causes Jasper to exit.  NOTE: this was originally reported as a symlink issue, but this was incorrect.  NOTE: some vendors dispute the severity of this issue, but it satisfies CVE's requirements for inclusion.
CVSS v2.0 score: 7.2
GHSA-4j3q-rqjq-x3f3 
When GELI reads a key file from standard input, it does not reuse the key file to initialize multiple providers at once resulting in the second and subsequent devices silently using a NULL key as the user key file. If a user only uses a key file without a user passphrase, the master key is encrypted with an empty key file allowing trivial recovery of the master key.
CVSS v3.1 score: 6.5
CVE-2026-27767 SWITCH EV swtchenergy.com Missing Authentication for Critical Function
WebSocket endpoints lack proper authentication mechanisms, enabling 
attackers to perform unauthorized station impersonation and manipulate 
data sent to the backend. An unauthenticated attacker can connect to the
 OCPP WebSocket endpoint using a known or discovered charging station 
identifier, then issue or receive OCPP commands as a legitimate charger.
 Given that no authentication is required, this can lead to privilege 
escalation, unauthorized control of charging infrastructure, and 
corruption of charging network data reported to the backend.
CVSS v4.0 score: 9.3
CVSS v3.1 score: 9.4
GHSA-mh37-2gxv-wprp 
A vulnerability classified as critical was found in TOTOLINK T6 4.1.5cu.748. This vulnerability affects the function ckeckKeepAlive of the file wireless.so of the component MQTT Packet Handler. The manipulation leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 2.1
CVSS v3.1 score: 6.3
GHSA-x8rg-mpg5-78wg 
A navigationto expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).
GHSA-5hfr-5xvx-h6rq 
An issue was discovered in Bilboplanet 2.0. Stored XSS exists in the user_id parameter to signup.php.
CVSS v3.0 score: 6.1
RHSA-2025:9336 Red Hat Security Advisory: glibc security update
glibc: static setuid binary dlopen may incorrectly search LD_LIBRARY_PATH
CVSS v3.1 score: 7
GHSA-j6p9-hm3q-hwmj CSRF vulnerability in MongoDB Plugin
Jenkins MongoDB Plugin 1.3 and earlier does not perform permission checks in methods implementing form validation.This allows attackers with Overall/Read permission to gain access to some metadata of any arbitrary files on the Jenkins controller.Additionally, these form validation methods do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.As of publication of this advisory, there is no fix.
CVSS v3.1 score: 5.3
RHSA-2022:5263 Red Hat Security Advisory: qemu-kvm security and bug fix update
QEMU: virtio-net: map leaking on error during receive QEMU: vhost-vsock: missing virtqueue detach on error can lead to memory leak
CVSS v3.1 score: 2.5
CVE-2022-29774 
iSpy v7.2.2.0 is vulnerable to remote command execution via path traversal.
CVSS v3.1 score: 9.8
CVSS v2.0 score: 7.5
GHSA-3367-vgjc-9cv9 
Cross-site scripting (XSS) vulnerability in contrib/example.php in the SyntaxHighlight GeSHi extension for MediaWiki, possibly as downloaded before September 2013, allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
GHSA-29rf-p7cr-3mg7 
Multiple SQL injection vulnerabilities in the com_content component in MiaCMS 4.6.5 allow remote attackers to execute arbitrary SQL commands via the id parameter in a (1) view, (2) category, or (3) blogsection action to index.php.
GHSA-wjpj-j5w8-2m2p 
BlackICE PC Protection and Server Protection installs (1) firewall.ini, (2) blackice.ini, (3) sigs.ini and (4) protect.ini with Everyone Full Control permissions, which allows local users to cause a denial of service (crash) or modify configuration, as demonstrated by modifying firewall.ini to contain a large firewall rule.
CVSS v3.1 score: 7.1
CVE-2020-11964 
In IQrouter through 3.3.1, the Lua function diag_set_password in the web-panel allows remote attackers to change the root password arbitrarily. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configuration (which has a required step for setting a secure password on the system), makes this CVE invalid. This vulnerability is “true for any unconfigured release of OpenWRT, and true of many other new Linux distros prior to being configured for the first time”
CVSS v3.1 score: 7.5
CVSS v2.0 score: 5
CVE-2013-7252 
kwalletd in KWallet before KDE Applications 14.12.0 uses Blowfish with ECB mode instead of CBC mode when encrypting the password store, which makes it easier for attackers to guess passwords via a codebook attack.
CVSS v2.0 score: 5
GHSA-34xg-89cf-qr7j 
In camera driver, there is a possible memory corruption due to improper locking. This could lead to local denial of service in kernel.
CVSS v3.1 score: 5.5
CVE-2024-11793 Fuji Electric Monitouch V-SFT V9C File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Fuji Electric Monitouch V-SFT V9C File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Monitouch V-SFT. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of V9C files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24503.
CVSS v3.0 score: 7.8
GHSA-6f4f-mvfg-v7fq 
Cross-site scripting (XSS) vulnerability in vpnum/userslist.php in Endian Firewall 2.1.2 allows remote attackers to inject arbitrary web script or HTML via the psearch parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVE-2021-29863 
IBM QRadar SIEM 7.3 and 7.4 is vulnerable to server side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. This vulnerability is due to an incomplete fix for CVE-2020-4786. IBM X-Force ID: 206087.
CVSS v3.0 score: 5.4
CVE-2023-42048 PDF-XChange Editor J2K File Parsing Uninitialized Variable Information Disclosure Vulnerability
PDF-XChange Editor J2K File Parsing Uninitialized Variable Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of J2K files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-20909.
CVSS v3.0 score: 3.3
GHSA-76hm-w32x-m7rx 
libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the ReadImage function in input-bmp.c:355:25.
CVSS v3.0 score: 9.8
CVE-2022-1036 Able to create an account with long password leads to memory corruption / Integer Overflow in microweber/microweber
Able to create an account with long password leads to memory corruption / Integer Overflow in GitHub repository microweber/microweber prior to 1.2.12.
CVSS v3.0 score: 5.3
GHSA-f5hr-qj5q-hc8f 
In the Linux kernel, the following vulnerability has been resolved:bpf: Enforce expected_attach_type for tailcall compatibilityYinhao et al. recently reported:Our fuzzer tool discovered an uninitialized pointer issue in the
  bpf_prog_test_run_xdp() function within the Linux kernel's BPF subsystem.
  This leads to a NULL pointer dereference when a BPF program attempts to
  deference the txq member of struct xdp_buff object.The test initializes two programs of BPF_PROG_TYPE_XDP: progA acts as the
entry point for bpf_prog_test_run_xdp() and its expected_attach_type can
neither be of be BPF_XDP_DEVMAP nor BPF_XDP_CPUMAP. progA calls into a slot
of a tailcall map it owns. progB's expected_attach_type must be BPF_XDP_DEVMAP
to pass xdp_is_valid_access() validation. The program returns struct xdp_md's
egress_ifindex, and the latter is only allowed to be accessed under mentioned
expected_attach_type. progB is then inserted into the tailcall which progA
calls.The underlying issue goes beyond XDP though. Another example are programs
of type BPF_PROG_TYPE_CGROUP_SOCK_ADDR. sock_addr_is_valid_access() as well
as sock_addr_func_proto() have different logic depending on the programs'
expected_attach_type. Similarly, a program attached to BPF_CGROUP_INET4_GETPEERNAME
should not be allowed doing a tailcall into a program which calls bpf_bind()
out of BPF which is only enabled for BPF_CGROUP_INET4_CONNECT.In short, specifying expected_attach_type allows to open up additional
functionality or restrictions beyond what the basic bpf_prog_type enables.
The use of tailcalls must not violate these constraints. Fix it by enforcing
expected_attach_type in __bpf_prog_map_compatible().Note that we only enforce this for tailcall maps, but not for BPF devmaps or
cpumaps: There, the programs are invoked through dev_map_bpf_prog_run*() and
cpu_map_bpf_prog_run*() which set up a new environment / context and therefore
these situations are not prone to this issue.
CVSS v3.1 score: 7.8
CVE-2020-1605 Junos OS and Junos OS Evolved: A vulnerability in JDHCPD allows an attacker to send crafted IPv4 packets and arbitrarily execute commands on the target device.
When a device using Juniper Network's Dynamic Host Configuration Protocol Daemon (JDHCPD) process on Junos OS or Junos OS Evolved which is configured in relay mode it vulnerable to an attacker sending crafted IPv4 packets who may then arbitrarily execute commands as root on the target device. This issue affects IPv4 JDHCPD services. This issue affects: Juniper Networks Junos OS: 15.1 versions prior to 15.1R7-S6; 15.1X49 versions prior to 15.1X49-D200; 15.1X53 versions prior to 15.1X53-D592; 16.1 versions prior to 16.1R7-S6; 16.2 versions prior to 16.2R2-S11; 17.1 versions prior to 17.1R2-S11, 17.1R3-S1; 17.2 versions prior to 17.2R2-S8, 17.2R3-S3; 17.3 versions prior to 17.3R3-S6; 17.4 versions prior to 17.4R2-S7, 17.4R3; 18.1 versions prior to 18.1R3-S8; 18.2 versions prior to 18.2R3-S2; 18.2X75 versions prior to 18.2X75-D60; 18.3 versions prior to 18.3R1-S6, 18.3R2-S2, 18.3R3; 18.4 versions prior to 18.4R1-S5, 18.4R2-S3, 18.4R3; 19.1 versions prior to 19.1R1-S3, 19.1R2; 19.2 versions prior to 19.2R1-S3, 19.2R2*. and All versions prior to 19.3R1 on Junos OS Evolved. This issue do not affect versions of Junos OS prior to 15.1, or JDHCPD operating as a local server in non-relay mode.
CVSS v3.1 score: 8.8
CVE-2016-7468 
An unauthenticated remote attacker may be able to disrupt services on F5 BIG-IP 11.4.1 - 11.5.4 devices with maliciously crafted network traffic. This vulnerability affects virtual servers associated with TCP profiles when the BIG-IP system's tm.tcpprogressive db variable value is set to non-default setting "enabled". The default value for the tm.tcpprogressive db variable is "negotiate". An attacker may be able to disrupt traffic or cause the BIG-IP system to fail over to another device in the device group.
CVSS v3.0 score: 5.9
CVSS v2.0 score: 4.3
GHSA-jj42-75hx-q362 
The vulnerability, if exploited, could allow an authenticated miscreant 
(with privilege of "aaConfigTools") to tamper with App Objects' help 
files and persist a cross-site scripting (XSS) injection that when 
executed by a victim user, can result in horizontal or vertical 
escalation of privileges. The vulnerability can only be exploited during
 config-time operations within the IDE component of Application Server. 
Run-time components and operations are not affected.
CVSS v4.0 score: 7.2
CVSS v3.1 score: 6.9
CVE-2021-22791 
A CWE-787: Out-of-bounds Write vulnerability that could cause a Denial of Service on the Modicon PLC controller / simulator when updating the controller application with a specially crafted project file exists in Modicon M580 CPU (part numbers BMEP* and BMEH*, all versions), Modicon M340 CPU (part numbers BMXP34*, all versions), Modicon MC80 (part numbers BMKC80*, all versions), Modicon Momentum Ethernet CPU (part numbers 171CBU*, all versions), PLC Simulator for EcoStruxureª Control Expert, including all Unity Pro versions (former name of EcoStruxureª Control Expert, all versions), PLC Simulator for EcoStruxureª Process Expert including all HDCS versions (former name of EcoStruxureª Process Expert, all versions), Modicon Quantum CPU (part numbers 140CPU*, all versions), Modicon Premium CPU (part numbers TSXP5*, all versions).
CVSS v3.1 score: 6.5
CVSS v2.0 score: 4
CVE-2007-2530 
Multiple PHP remote file inclusion vulnerabilities in Tropicalm Crowell Resource 4.5.2 allow remote attackers to execute arbitrary PHP code via a URL in the RESPATH parameter to (1) dosearch.php or (2) printfriendly.php.
CVSS v2.0 score: 7.5
CVE-2023-38864 
An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to execute arbitrary code via the protal_delete_picname parameter in the sub_41171C function at bin/webmgnt.
CVSS v3.1 score: 9.8
GHSA-w7jr-5292-3wmh 
Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 11.5.10 CU2 and 12.0.6 allows remote authenticated users to affect confidentiality via unknown vectors.  NOTE: the previous information was obtained from the January 2009 CPU.  Oracle has not commented on reliable researcher claims that this issue is related to unrestricted guest access to the "About Us Page" in the Oracle Applications Framework (OAF), which allows attackers to obtain sensitive system and application environment information.
GHSA-rj36-vf3r-744c 
In the Linux kernel, the following vulnerability has been resolved:dma-buf/dma-resv: check if the new fence is really laterPreviously when we added a fence to a dma_resv object we always
assumed the the newer than all the existing fences.With Jason's work to add an UAPI to explicit export/import that's not
necessary the case any more. So without this check we would allow
userspace to force the kernel into an use after free error.Since the change is very small and defensive it's probably a good
idea to backport this to stable kernels as well just in case others
are using the dma_resv object in the same way.
CVSS v3.1 score: 7.8
GHSA-m629-g935-wmqw 
Windows Digital Media Receiver Elevation of Privilege Vulnerability.
CVSS v3.1 score: 7.8
GHSA-rh28-76xv-jcqc 
A use-after-free read flaw was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (and connect()) in the Linux kernel. In this flaw, an attacker with a user privileges may crash the system or leak internal kernel information.
CVSS v3.1 score: 6.8
GHSA-pvpf-28ww-xp98 
Absolute path traversal vulnerability in filemanager.php in AuraCMS 3.0 allows remote attackers to list a directory via a full pathname in the viewdir parameter.
GHSA-78wx-v5xq-93gg 
A remote command execution vulnerability in Veritas NetBackup Appliance before 3.1.2 allows authenticated administrators to execute arbitrary commands as root. This issue was caused by insufficient filtering of user provided input.
CVSS v3.0 score: 7.2