CIRCL/vulnerability-scores huggingface dataset:
GHSA-695m-57fr-22vf 
Drupal Views Builk Operations (VBO) module 6.x-1.0 through 6.x-1.10 does not properly escape the vocabulary help when the vocabulary has had user tagging enabled and the "Modify node taxonomy terms" action is used. A remote attacker could provide a specially-crafted URL that could lead to cross-site scripting (XSS) attack.
CVSS v3.1 score: 6.1
CVE-2019-15620 
Improper access control in Nextcloud Talk 6.0.3 leaks the existance and the name of private conversations when linked them to another shared item via the projects feature.
CVSS v3.1 score: 2.7
CVSS v2.0 score: 4
GHSA-38gv-cwr5-whgg 
An issue was discovered in Exiv2 v0.26. The function Exiv2::DataValue::copy in value.cpp has a NULL pointer dereference.
CVSS v3.0 score: 6.5
GHSA-x7g9-w24q-hrjq 
Buffer overflow in BN-SDWBP3 firmware version 1.0.9 and earlier allows an attacker on the same network segment to execute arbitrary code via unspecified vectors.
CVSS v3.0 score: 6.8
CVE-2017-15412 
Use after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS v3.0 score: 8.8
CVSS v2.0 score: 6.8
GHSA-63pg-53ch-332g 
An issue was discovered in GNOME file-roller before 3.29.91. It allows a single ./../ path traversal via a filename contained in a TAR archive, possibly overwriting a file during extraction.
CVSS v3.1 score: 4.3
CVE-2016-3294 
Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Edge Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3330.
CVSS v3.0 score: 7.5
CVSS v2.0 score: 7.6
CVE-2017-15818 
In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while loading a user application in qseecom, an integer overflow could potentially occur if the application partition size is rounded up to page_size.
CVSS v3.0 score: 7.8
CVSS v2.0 score: 7.2
GHSA-m26p-m559-g5j5 Legion of the Bouncy Castle Java Cryptography API Bleichenbacher Oracle Vulnerability
The Legion of the Bouncy Castle Java Cryptography API before release 1.38, as used in Crypto Provider Package before 1.36, has unknown impact and remote attack vectors related to "a Bleichenbacher vulnerability in simple RSA CMS signatures without signed attributes."
GHSA-m453-2qqp-5rcc 
Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
GHSA-vw38-7gfm-96xc 
OpenDaylight defense4all 1.1.0 and earlier allows remote authenticated users to write report data to arbitrary files.
CVSS v3.0 score: 8.8
CVE-2020-15690 
In Nim before 1.2.6, the standard library asyncftpclient lacks a check for whether a message contains a newline character.
CVSS v3.1 score: 9.8
CVSS v2.0 score: 7.5
GHSA-c62c-m96c-cf8q 
Vulnerability in the Oracle Advanced Outbound Telephony component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Advanced Outbound Telephony. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Advanced Outbound Telephony, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Advanced Outbound Telephony accessible data as well as unauthorized update, insert or delete access to some of Oracle Advanced Outbound Telephony accessible data. CVSS v3.0 Base Score 8.2 (Confidentiality and Integrity impacts).
CVSS v3.0 score: 8.2
GHSA-m7rr-9vhr-9v38 
The ZENIC ONE R58 products by ZTE Corporation have a command injection vulnerability. An authenticated attacker can exploit this vulnerability to tamper with messages, inject malicious code, and subsequently launch attacks on related devices.
CVSS v3.1 score: 7.6
CVE-2021-23970 
Context-specific code was included in a shared jump table; resulting in assertions being triggered in multithreaded wasm code. This vulnerability affects Firefox < 86.
CVSS v3.1 score: 6.5
CVSS v2.0 score: 4.3
GHSA-v9x8-262p-f2g5 
Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote attacker to exhaust connection process memory over HTTP/1.1.The HTTP/1.1 handler in cowboy_http enforces the max_headers limit by counting the number of distinct header names in a map (maps:size(Headers)). When a request contains multiple header lines with the same name, the values are concatenated into a single ever-growing binary stored under that one map key (", " for regular headers, "; " for cookies), so the map size stays at one and the max_headers cap (default 100) is never reached. Because no accumulator bounds the total number of header lines or the total byte size of the header block (only per-line max_header_name_length and max_header_value_length apply), an unauthenticated client can send an arbitrary number of header lines with the same name and grow the connection process's binary memory to arbitrary size within the request window.The impact per connection is bounded by request_timeout (default 5 seconds, not reset by header data), and by max_heap_size when set (the offending connection process is killed once its heap grows past the limit). When max_heap_size is left at the default (unset), sustained abuse can drive the Erlang VM into out-of-memory conditions.This issue affects cowboy from 2.0.0-pre.4 before 2.18.0.
CVSS v4.0 score: 6.9
CVE-2002-0059 
The decompression algorithm in zlib 1.1.3 and earlier, as used in many different utilities and packages, causes inflateEnd to release certain memory more than once (a "double free"), which may allow local and remote attackers to execute arbitrary code via a block of malformed compression data.
CVSS v3.1 score: 9.8
CVSS v2.0 score: 7.5
GHSA-92pw-mff9-jqgm Salt improper handling of tmp files
`modules/serverdensity_device.py` in SaltStack before 2014.7.4 does not properly handle files in `/tmp`.
CVSS v3.0 score: 5.3
CVE-2018-25104 CoinGate Plugin Payment callback.php postProcess logic error
A vulnerability was found in CoinGate Plugin up to 1.2.7 on PrestaShop. It has been rated as problematic. Affected by this issue is the function postProcess of the file modules/coingate/controllers/front/callback.php of the component Payment Handler. The manipulation leads to business logic errors. The attack may be launched remotely. Upgrading to version 1.2.8 is able to address this issue. The patch is identified as 0a3097db0aec7c5d66686c142c6abaa1e126ca16. It is recommended to upgrade the affected component.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 4.3
CVSS v3.0 score: 4.3
CVSS v2.0 score: 4
GHSA-64jq-6pfg-748r 
The Gentoo net-misc/vde package before version 2.3.2-r4 may allow members of the "qemu" group to gain root privileges by creating a hard link in a directory on which "chown" is called recursively by the OpenRC service script.
CVSS v3.0 score: 9.8
GHSA-9396-6m54-w269 
An issue has been discovered in GitLab EE affecting all versions from 16.6 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1. Project Maintainers can exploit a vulnerability where they can assign custom roles to users with permissions exceeding their own, effectively granting themselves elevated privileges.
CVSS v3.1 score: 3.8
CVE-2002-1281 
Unknown vulnerability in the rlogin KIO subsystem (rlogin.protocol) of KDE 2.x 2.1 and later, and KDE 3.x 3.0.4 and earlier, allows local and remote attackers to execute arbitrary code via a certain URL.
CVSS v2.0 score: 7.5
RHSA-2015:0266 Red Hat Security Advisory: thunderbird security update
Mozilla: Reading of local files through manipulation of form autocomplete (MFSA 2015-24) Mozilla: Out-of-bounds read and write while rendering SVG content (MFSA 2015-19) Mozilla: Use-after-free in IndexedDB (MFSA 2015-16) Mozilla: Miscellaneous memory safety hazards (rv:31.5) (MFSA 2015-11)
CVE-2026-47472 
NVIDIA TensorRT-LLM contains a vulnerability in its inter-process communication layer where an attacker with local same-user access could cause deserialization. A successful exploit of this vulnerability might lead to code execution, information disclosure, data tampering, and denial of service.
CVSS v3.1 score: 7.8
GHSA-4xq5-6j3q-5rgw 
D-Link DIR-X3260 prog.cgi SetUsersSettings Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 routers. Authentication is required to exploit this vulnerability.The specific flaw exists within the prog.cgi binary, which handles HNAP requests made to the lighttpd webserver listening on TCP ports 80 and 443. The issue results from the lack of proper validation of a user-supplied string before copying it to a fixed-size stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21675.
CVSS v3.0 score: 6.8
CVE-2026-41248 Official Clerk JavaScript SDKs:  Middleware-based route protection bypass
Clerk JavaScript is the official JavaScript repository for Clerk authentication. createRouteMatcher in @clerk/nextjs, @clerk/nuxt, and @clerk/astro can be bypassed by certain crafted requests, allowing them to skip middleware gating and reach downstream handlers. This vulnerability is fixed in @clerk/astro 1.5.7, 2.17.10, and 3.0.15; @clerk/nextjs 5.7.6, 6.39.2, and 7.2.1; @clerk/nuxt 1.13.28 and 2.2.2; and @clerk/shared 2.22.1, 3.47.4, anc 4.8.1
CVSS v3.1 score: 9.1
CVE-2022-0645 Open redirect vulnerability via endpoint authorize_and_redirect/?redirect=  in posthog/posthog
Open redirect vulnerability via endpoint authorize_and_redirect/?redirect= in GitHub repository posthog/posthog prior to 1.34.1.
CVSS v3.0 score: 6.1
GHSA-qf35-c7c2-rj5w 
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1.2. An application may be able to gain elevated privileges.
CVE-2023-30693 
Out-of-bounds Write in DoOemFactorySendFactoryBypassCommand of libsec-ril prior to SMR Aug-2023 Release 1 allows local attacker to execute arbitrary code.
CVSS v3.1 score: 6.7
CVE-2005-1859 
Unknown vulnerability in arshell in the Array Service (arrayd) for SGI ProPack 3 with SP 5 and 6, and SGI ProPack 4, allows local users to execute arbitrary shells as root on other hosts in the cluster or array.
CVSS v2.0 score: 7.2
CVE-2025-58725 Windows COM+ Event System Service Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows COM allows an authorized attacker to elevate privileges locally.
CVSS v3.1 score: 7
CVE-2017-2742 
A potential security vulnerability has been identified with HP Web Jetadmin before 10.4 SR2. This vulnerability could potentially be exploited to create a denial of service.
CVSS v3.0 score: 7.5
CVSS v2.0 score: 7.8
GHSA-vxmf-93xr-m54g 
Windows TCP/IP Remote Code Execution Vulnerability
CVSS v3.1 score: 9.8
GHSA-w799-83vp-q48c 
Windows Kernel Elevation of Privilege Vulnerability
CVSS v3.1 score: 7.8
GHSA-629m-3vhg-jm6g 
Cross Site Scripting vulnerability found in :ouislam Uptime Kuma v.1.19.6 and before allows a remote attacker to execute arbitrary commands via the description, title, footer, and incident creation parameter of the status_page.js endpoint.
CVSS v3.1 score: 6.1
GHSA-qvhf-3567-pc4v Sandbox bypass vulnerability in Script Security Plugin
Sandbox protection in Script Security Plugin 1.70 and earlier can be circumvented through:Crafted constructor calls and bodies (due to an incomplete fix of [SECURITY-582](https://www.jenkins.io/security/advisory/2017-08-07/#super-constructor-calls))Crafted method calls on objects that implement `GroovyInterceptable`This allows attackers able to specify and run sandboxed scripts to execute arbitrary code in the context of the Jenkins controller JVM.Script Security Plugin 1.71 has additional restrictions and sanity checks to ensure that super constructors cannot be constructed without being intercepted by the sandbox. In addition, it also intercepts method calls on objects that implement `GroovyInterceptable` as calls to `GroovyObject#invokeMethod(String, Object)`, which is on the list of dangerous signatures and should not be approved for use in the sandbox.
CVSS v3.1 score: 8.8
RHSA-2021:4614 Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP10 security update
httpd: mod_proxy_wstunnel tunneling of non Upgraded connection pcre: Buffer over-read in JIT when UTF is disabled and \X or \R has fixed quantifier greater than 1 httpd: mod_proxy NULL pointer dereference pcre: Integer overflow when parsing callout numeric arguments httpd: Single zero byte stack overflow in mod_auth_digest JBCS: URL normalization issue with dot-dot-semicolon(s) leads to information disclosure openssl: Read buffer overruns processing ASN.1 strings openssl: integer overflow in CipherUpdate openssl: NULL pointer dereference in X509_issuer_and_serial_hash() httpd: mod_session: NULL pointer dereference when parsing Cookie header httpd: mod_session: Heap overflow via a crafted SessionHeader value httpd: Unexpected URL matching with 'MergeSlashes OFF' httpd: NULL pointer dereference via malformed requests
CVSS v3.1 score: 7.5
CVE-2015-3035 
Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmware before 150304, and C8 (1.0) with firmware before 150316, Archer C9 (1.0), TL-WDR3500 (1.0), TL-WDR3600 (1.0), and TL-WDR4300 (1.0) with firmware before 150302, TL-WR740N (5.0) and TL-WR741ND (5.0) with firmware before 150312, and TL-WR841N (9.0), TL-WR841N (10.0), TL-WR841ND (9.0), and TL-WR841ND (10.0) with firmware before 150310 allows remote attackers to read arbitrary files via a .. (dot dot) in the PATH_INFO to login/.
CVSS v3.1 score: 7.5
CVSS v2.0 score: 7.8
GHSA-j72h-72jr-j8pr 
Dell PowerProtect Data Domain, versions prior to 7.13.0.0, LTS 7.7.5.40, LTS 7.10.1.30 contain an weak cryptographic algorithm vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to man-in-the-middle attack that exposes sensitive session information.
CVSS v3.1 score: 5.9
CVE-2026-2657 wren-lang wren Error Message wren_compiler.c printError stack-based overflow
A vulnerability has been found in wren-lang wren up to 0.4.0. This impacts the function printError of the file src/vm/wren_compiler.c of the component Error Message Handler. Such manipulation leads to stack-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS v4.0 score: 4.8
CVSS v3.1 score: 3.3
CVSS v3.0 score: 3.3
CVSS v2.0 score: 1.7
GHSA-fj42-7xm3-95v2 
A vulnerability in the CLI of Cisco APIC could allow an authenticated, local attacker to execute arbitrary commands as root&nbsp;on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials.This vulnerability is due to insufficient validation of arguments that are passed to specific CLI commands. An attacker could exploit this vulnerability by including crafted input as the argument of an affected CLI command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privileges of root.
CVSS v3.1 score: 5.1
GHSA-r22v-g8vq-gjwc 
In the Linux kernel, the following vulnerability has been resolved:drm/amd/display: Check index for aux_rd_interval before usingaux_rd_interval has size of 7 and should be checked.This fixes 3 OVERRUN and 1 INTEGER_OVERFLOW issues reported by Coverity.
CVSS v3.1 score: 5.5
RHSA-2005:412 Red Hat Security Advisory: openmotif security update
libxpm buffer overflow
RHSA-2024:1386 Red Hat Security Advisory: ovn22.12 security update
ovn: insufficient validation of BFD packets may lead to denial of service
CVSS v3.1 score: 6.5
RHSA-2025:18645 Red Hat Security Advisory: aardvark-dns security update from RHEL
An update for aardvark-dns is now available for Red Hat In-Vehicle-OS version 1.0.0.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
GHSA-8j9h-fmv7-4h7w 
Cross-Site Request Forgery (CSRF) vulnerability in Pixelgrade Comments Ratings plugin <= 1.1.7 versions.
CVSS v3.1 score: 4.3
GHSA-x2fp-hj8c-mmxh Concrete CMS is vulnerable to authorization bypass in the Calendar Event Frontend Dialog
Concrete CMS 9.5.0 and below is vulnerable to authorization Bypass in the Calendar Event Frontend Dialog which can allow cross-calendar data disclosure. A public calendar block can be used as a pivot point to access private calendar data.
CVSS v4.0 score: 6.3
CVSS v3.1 score: 5.3
CVE-2025-47357 Missing Authentication for Critical Function in SMSS
Information Disclosure when a user-level driver performs QFPROM read or write operations on Fuse regions.
CVSS v3.1 score: 8
CVE-2026-21885 Miniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resources
Miniflux 2 is an open source feed reader. Prior to version 2.2.16, Miniflux's media proxy endpoint (`GET /proxy/{encodedDigest}/{encodedURL}`) can be abused to perform Server-Side Request Forgery (SSRF). An authenticated user can cause Miniflux to generate a signed proxy URL for attacker-chosen media URLs embedded in feed entry content, including internal addresses (e.g., localhost, private RFC1918 ranges, or link-local metadata endpoints). Requesting the resulting `/proxy/...` URL makes Miniflux fetch and return the internal response. Version 2.2.16 fixes the issue.
CVSS v3.1 score: 6.5
GHSA-c8q7-8787-544x 
Cross Site Request Forgery (CSRF) vulnerability exits in Catfish <=6.1.* when you upload an html file containing CSRF on the website that uses a google editor; you can specify the menu url address as your malicious url address in the Add Menu column.
GHSA-mpf8-3pvr-29fx 
Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
GHSA-ph3p-q84c-pqrw 
In the Linux kernel, the following vulnerability has been resolved:drm/amd/pm: Prevent division by zeroThe user can set any speed value.
If speed is greater than UINT_MAX/8, division by zero is possible.Found by Linux Verification Center (linuxtesting.org) with SVACE.
CVSS v3.1 score: 5.5
CVE-2026-42844 Grav: Low-privileged API users can create super-admin accounts via blueprint-upload
Grav is a file-based Web platform. In Grav 2.0.0-beta.2, a low-privileged authenticated API user with api.media.write can abuse /api/v1/blueprint-upload to write an arbitrary YAML file into user/accounts/, then log in as the newly created account with api.super privileges. This results in full administrative compromise of the Grav API. This vulnerability is fixed in API 1.0.0-beta.17.
CVSS v4.0 score: 8.7
CVE-2015-5789 
WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
CVSS v2.0 score: 6.8
GHSA-82hr-pf96-mj72 
SQL Injection is present on the hfInventoryDistFormID parameter in the /PSP/appNET/Store/CartV12.aspx/GetUnitPrice endpoint in edu Business Solutions Print Shop Pro WebDesk version 18.34. Unsanitized user input is incorporated directly into SQL queries without proper parameterization or escaping. This vulnerability allows remote attackers to execute arbitrary SQL commands
CVSS v3.1 score: 9.8
GHSA-5mc7-jwxc-9m39 
An improper certificate validation vulnerability was reported in the Lenovo Filez application that could allow a user capable of intercepting network traffic to obtain sensitive user data from the application.
CVSS v4.0 score: 6
CVSS v3.1 score: 5.3
CVE-2023-30577 
AMANDA (Advanced Maryland Automatic Network Disk Archiver) before tag-community-3.5.4 mishandles argument checking for runtar.c, a different vulnerability than CVE-2022-37705.
CVSS v3.1 score: 7.8
GHSA-59pp-9g7r-57q6 
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
GHSA-5pqp-2mmm-qc3c 
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Everestthemes Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin.This issue affects Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin: from n/a through 2.1.9.
CVSS v3.1 score: 5.3
CVE-2026-60747 
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.2 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
CVSS v3.1 score: 6.2
GHSA-3jqv-j83m-6qhf 
When a specific BGP flowspec configuration is enabled and upon receipt of a specific matching BGP packet meeting a specific term in the flowspec configuration, a reachable assertion failure occurs, causing the routing protocol daemon (rpd) process to crash with a core file being generated. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D77 on SRX Series; 12.3 versions prior to 12.3R12-S10; 12.3X48 versions prior to 12.3X48-D70 on SRX Series; 14.1X53 versions prior to 14.1X53-D47 on EX2200/VC, EX3200, EX3300/VC, EX4200, EX4300, EX4550/VC, EX4600, EX6200, EX8200/VC (XRE), QFX3500, QFX3600, QFX5100; 15.1 versions prior to 15.1R3; 15.1F versions prior to 15.1F3; 15.1X49 versions prior to 15.1X49-D140 on SRX Series; 15.1X53 versions prior to 15.1X53-D59 on EX2300/EX3400.
CVSS v3.1 score: 5.9
CVE-2026-32425 WordPress Payment Gateway Pix For GiveWP plugin <= 2.2.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in linknacional Payment Gateway Pix For GiveWP payment-gateway-pix-for-givewp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payment Gateway Pix For GiveWP: from n/a through <= 2.2.3.
CVSS v3.1 score: 5.3
GHSA-mhcc-g592-267j 
SiYuan versions up to and including v3.7.2 (fixed in v3.7.4) contain an information disclosure vulnerability in the /api/asset/getFileAnnotation endpoint, which returns .sya PDF-annotation file content without a publish-access check. Because the endpoint is gated only by CheckAuth (unlike the /assets/* route, which enforces publish access and password), an anonymous reader (when publish authentication is disabled) or any publish RoleReader who knows an asset path can read the private PDF annotations (highlights and notes) of publish-forbidden, password-protected, or unpublished documents. The issue is limited to non-encrypted notebooks; encrypted-box annotations are not exposed.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 5.8
GHSA-qchg-5f29-5gxw 
A vulnerability was found in Xunrui CMS 4.61 and classified as problematic. Affected by this issue is some unknown functionality of the file /dayrui/Fcms/View/system_log.html. The manipulation leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224240.
CVSS v3.1 score: 7.5
CVE-2019-1947 Cisco Email Security Appliance Denial of Service Vulnerability
A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to cause the CPU utilization to increase to 100 percent, causing a denial of service (DoS) condition on an affected device. The vulnerability is due to improper handling of email messages that contain large attachments. An attacker could exploit this vulnerability by sending a malicious email message through the targeted device. A successful exploit could allow the attacker to cause a permanent DoS condition due to high CPU utilization. This vulnerability may require manual intervention to recover the ESA.
CVSS v3.0 score: 8.6
CVE-2026-25032 WordPress Ricky theme < 2.31 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in park_of_ideas Ricky ricky allows Object Injection.This issue affects Ricky: from n/a through < 2.31.
CVSS v3.1 score: 9.8
CVE-2021-47388 mac80211: fix use-after-free in CCMP/GCMP RX
In the Linux kernel, the following vulnerability has been resolved:

mac80211: fix use-after-free in CCMP/GCMP RX

When PN checking is done in mac80211, for fragmentation we need
to copy the PN to the RX struct so we can later use it to do a
comparison, since commit bf30ca922a0c ("mac80211: check defrag
PN against current frame").

Unfortunately, in that commit I used the 'hdr' variable without
it being necessarily valid, so use-after-free could occur if it
was necessary to reallocate (parts of) the frame.

Fix this by reloading the variable after the code that results
in the reallocations, if any.

This fixes https://bugzilla.kernel.org/show_bug.cgi?id=214401.
CVSS v3.1 score: 8.8
CVE-2016-2980 
The Sametime WebPlayer 8.5.2 and 9.0 is vulnerable to a script injection where a malicious site can inject their own script by exploiting a vulnerability in the way that the WebPlayer works. IBM X-Force ID: 113993.
CVSS v3.0 score: 6.3
CVSS v2.0 score: 6.8
CVE-2020-7858 AquaNPlayer directory traversing vulnerability
There is a directory traversing vulnerability in the download page url of AquaNPlayer 2.0.0.92. The IP of the download page url is localhost and an attacker can traverse directories using "dot dot" sequences(../../) to view host file on the system. This vulnerability can cause information leakage.
CVSS v3.1 score: 6.8
GHSA-cr88-6mqm-4g57 Gogs has a Denial of Service issue
SummaryAn authenticated user can cause a DOS attack. If one of the repo files is deleted before synchronization, it will cause the application to crash.DetailsIf GetMirrorByRepoID fails, the error log dereferencing null pointer. This happens if the repository no longer exits.
https://github.com/gogs/gogs/blob/4cc83c498b6ae59356a04912d68a932165bad5e6/internal/database/mirror.go#L333-L337
if `err != nil` `m` is alwasa `nil`
https://github.com/gogs/gogs/blob/4cc83c498b6ae59356a04912d68a932165bad5e6/internal/database/mirror.go#L269-L278PoCSpam mirror-sync on repo and delete this repo
code python spam mirror-syncImpactDenial of Service server crash.
CVSS v3.1 score: 6.5
CVE-2024-26209 Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability
Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability
CVSS v3.1 score: 5.5
GHSA-g35q-w93f-4c48 
Cross-site request forgery (CSRF) vulnerability in the web-based administration console in Citrix Access Gateway before firmware 4.5.5 allows remote attackers to perform certain configuration changes as administrators.
GHSA-8qmr-c2vp-p9wp 
The (1) PANA and (2) KISMET dissectors in Wireshark (formerly Ethereal) 0.99.3 through 1.0.0 allow remote attackers to cause a denial of service (application stop) via unknown vectors.
CVE-2018-8004 
There are multiple HTTP smuggling and cache poisoning issues when clients making malicious requests interact with Apache Traffic Server (ATS). This affects versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions.
CVSS v3.0 score: 6.5
CVSS v2.0 score: 4
CVE-2026-8157 Vitepos < 3.4.2 - Outlet Manager+ Privilege Escalation
The Vitepos  WordPress plugin before 3.4.2 does not properly restrict the roles that can be assigned when creating new users via one of its REST API endpoints, allowing authenticated users with a custom Vitepos  WordPress plugin before 3.4.2 role to escalate privileges to administrator.
CVSS v3.1 score: 8.8
GHSA-8p2c-fghc-9hj4 Improper input validation in pyftpdlib
The ftp_QUIT function in ftpserver.py in pyftpdlib before 0.5.0 allows remote authenticated users to cause a denial of service (file descriptor exhaustion and daemon outage) by sending a QUIT command during a disallowed data-transfer attempt.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 4.3
RHSA-2019:1260 Red Hat Security Advisory: python27-python and python27-python-jinja2 security and bug fix update
python-jinja2: Sandbox escape due to information disclosure via str.format python: DOS via regular expression catastrophic backtracking in apop() method in pop3lib python: DOS via regular expression backtracking in difflib.IS_LINE_JUNK method in difflib python: Missing salt initialization in _elementtree.c module python: CRLF injection via the query part of the url passed to urlopen() python: CRLF injection via the path part of the url passed to urlopen()
CVSS v3.0 score: 6.5
CVE-2017-7994 
The function TextExtractor::ExtractText in TextExtractor.cpp:77 in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document.
CVSS v3.0 score: 6.5
CVSS v2.0 score: 4.3
CVE-2021-32244 
Cross Site Scripting (XSS) in Moodle 3.10.3 allows remote attackers to execute arbitrary web script or HTML via the "Description" field.
CVSS v3.1 score: 5.4
CVSS v2.0 score: 3.5
CVE-2022-3078 
An issue was discovered in the Linux kernel through 5.16-rc6. There is a lack of check after calling vzalloc() and lack of free after allocation in drivers/media/test-drivers/vidtv/vidtv_s302m.c.
CVSS v3.1 score: 5.5
CVE-2020-18173 
A DLL injection vulnerability in 1password.dll of 1Password 7.3.712 allows attackers to execute arbitrary code.
CVSS v3.1 score: 7.8
CVSS v2.0 score: 4.4
GHSA-jqjc-23q2-72qc 
Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4275, CVE-2016-4276, CVE-2016-4280, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, CVE-2016-6922, and CVE-2016-6924.
CVSS v3.0 score: 9.8
CVE-2015-6092 
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Office Compatibility Pack SP3, and Word Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
CVSS v2.0 score: 9.3
CVE-2020-10648 
Das U-Boot through 2020.01 allows attackers to bypass verified boot restrictions and subsequently boot arbitrary images by providing a crafted FIT image to a system configured to boot the default configuration.
CVSS v3.1 score: 7.8
CVSS v2.0 score: 6.8
CVE-2021-44387 
A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. SetPtzPreset param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS v3.0 score: 8.6
GHSA-w7x5-37px-9r33 
IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 198231.
GHSA-8r2v-q8wh-86gh 
Substance3D - Modeler versions 1.22.4 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1 score: 5.5
CVE-2013-6829 
admin/confnetworking.html in PineApp Mail-SeCure allows remote attackers to execute arbitrary commands via shell metacharacters in the pinghost parameter during a ping operation.
CVSS v2.0 score: 7.5
CVE-2025-11253 SQLi in Aksis Technologies' Netty ERP
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aksis Technology Inc. Netty ERP allows SQL Injection.

This issue affects Netty ERP: before V.1.1000.
CVSS v3.1 score: 9.8
GHSA-93v2-7c6x-23m2 
A buffer overflow vulnerability exists in Symantec Server Management Suite version 7.9 and before. A remote, anonymous attacker can exploit this vulnerability to achieve remote code execution as SYSTEM.
CVSS v3.1 score: 10
CVE-2010-0663 
The ParamTraits<SkBitmap>::Read function in common/common_param_traits.cc in Google Chrome before 4.0.249.78 does not initialize the memory locations that will hold bitmap data, which might allow remote attackers to obtain potentially sensitive information from process memory by providing insufficient data, related to use of a (1) thumbnail database or (2) HTML canvas.
CVSS v2.0 score: 5
CVE-2021-24944 Custom Dashboard & Login Page < 7.0 - Admin+ Stored Cross-Site Scripting
The Custom Dashboard & Login Page WordPress plugin before 7.0 does not sanitise some of its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVSS v3.1 score: 4.8
CVSS v2.0 score: 3.5
GHSA-h552-pj49-gv49 
Multiple vulnerabilities in the Server Message Block (SMB) Protocol preprocessor detection engine for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, adjacent or remote attacker to cause a denial of service (DoS) condition. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS v3.0 score: 7.5
GHSA-r9cc-j7wr-p329 
Improper Input Validation vulnerability in Apache Camel Cometd Component.The camel-cometd component maps inbound Bayeux (CometD) message headers into the Camel Exchange without applying a HeaderFilterStrategy. CometdBinding.populateExchangeFromMessage copies the entire ext.CamelHeaders map supplied by the CometD client directly onto the Camel message (message.setHeaders), so any header name - including Camel-internal control headers such as CamelHttpUri, CamelFileName or CamelJmsDestinationName - is accepted unmodified. Because a CometdComponent installs no Bayeux SecurityPolicy by default, any client that can complete the Bayeux handshake against the CometD endpoint can publish such a message without authentication. An attacker can therefore inject arbitrary Camel control headers that influence the behaviour of downstream producers in the route (for example redirecting an HTTP producer, changing a file name, or overriding a JMS destination); the injected headers also persist across internal direct, seda and vm hops. The concrete downstream impact depends on which producers the route uses.
This issue affects Apache Camel: from 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0.Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. The fix implements a HeaderFilterStrategy in the camel-cometd binding (a long-standing TODO in the code) that filters the Camel header namespace case-insensitively on inbound mapping, so client-supplied Camel* / camel* headers are no longer copied into the Exchange. For deployments that cannot upgrade immediately, strip the Camel control headers from inbound CometD messages before they reach any downstream producer (for example removeHeaders('Camel*') and removeHeaders('camel*') at the start of the route), and install an explicit Bayeux SecurityPolicy on the CometdComponent so that only authenticated clients can publish.
CVSS v3.1 score: 9.8
GHSA-g2pw-hx42-qrf8 
An exploitable information disclosure vulnerability exists in the init_node_manager functionality of F2fs-Tools F2fs.Fsck 1.12 and 1.13. A specially crafted filesystem can be used to disclose information. An attacker can provide a malicious file to trigger this vulnerability.
CVSS v3.1 score: 5.5
GHSA-ffjw-6mf8-2rj5 
Multiple cross-site scripting (XSS) vulnerabilities in Horde Internet Mail Program (IMP) before 6.1.8, as used in Horde Groupware Webmail Edition before 5.1.5, allow remote attackers to inject arbitrary web script or HTML via (1) unspecified flags or (2) a mailbox name in the dynamic mailbox view.
RHSA-2024:1345 Red Hat Security Advisory: Red Hat OpenShift GitOps security update
argo-cd: XSS vulnerability in application summary component
CVSS v3.1 score: 8.9
CVE-2002-1347 
Multiple buffer overflows in Cyrus SASL library 2.1.9 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via (1) long inputs during user name canonicalization, (2) characters that need to be escaped during LDAP authentication using saslauthd, or (3) an off-by-one error in the log writer, which does not allocate space for the null character that terminates a string.
CVSS v3.1 score: 9.8
CVSS v2.0 score: 7.5
GHSA-3r6v-3hcr-76x3 
Use After Free in op_is_set_bp in GitHub repository radareorg/radare2 prior to 5.6.6.
CVSS v3.1 score: 7.8
CVE-2026-22564 
An Improper Access Control vulnerability could allow a malicious actor with access to the UniFi Play network to enable SSH to make unauthorized changes to the system.  

Affected Products:
UniFi Play PowerAmp (Version 1.0.35 and earlier) 
UniFi Play Audio Port  (Version 1.0.24 and earlier)  

Mitigation:
Update UniFi Play PowerAmp to Version 1.0.38 or later 
Update UniFi Play Audio Port  to Version 1.1.9 or later
CVSS v3.1 score: 9.8
CVE-2026-7068 D-Link DIR-825 nmbd sserver.c NMBD_process buffer overflow
A vulnerability was identified in D-Link DIR-825 3.00b32. This affects the function NMBD_process of the file sserver.c of the component nmbd. Such manipulation leads to buffer overflow. The attack can only be initiated within the local network. The exploit is publicly available and might be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS v4.0 score: 8.7
CVSS v3.1 score: 8.8
CVSS v3.0 score: 8.8
CVSS v2.0 score: 8.3
PYSEC-2026-3465 
### Impact

The FiftyOne App/API server (`fiftyone/server/app.py`) and the `/media` route (`fiftyone/server/routes/media.py`) unconditionally set a permissive CORS header (`Access-Control-Allow-Origin: *`) on their responses. Because the embedded App server runs locally and is unauthenticated, this allows **any website a user visits to make cross-origin requests to that user's running FiftyOne server and read the responses**.

Combined with the unauthenticated `/media` endpoint — which serves files from the local filesystem by path — the wildcard CORS policy turns a local-only file read into a **remotely exploitable, drive-by data exfiltration** vulnerability. A malicious web page can silently issue requests such as `http://localhost:5151/media?filepath=/etc/passwd` and read arbitrary files accessible to the server process (SSH keys, cloud credentials, `.env` files, dataset media, etc.), then exfiltrate them to an attacker-controlled endpoint.

The victim only needs to have a FiftyOne server running locally and visit a malicious page — no clicks or other interaction are required. Browsers that have shipped Private Network Access / local-network-access protections (e.g. Chromium 142+) mitigate this for some users, but Safari and Firefox do not yet, so the attack remains viable in common configurations.

**Who is impacted:** any user running FiftyOne (the open-source, embedded App server) locally while also browsing the web.

**Not affected:** media stored in cloud buckets, which is served via signed URLs on a separate origin.

### Patches

Fixed in **FiftyOne 1.17.0**. The hard-coded `Access-Control-Allow-Origin: *` has been removed and the server now responds **same-origin only by default**, which covers local desktop usage and the supported notebook integrations (each served through a same-origin proxy or iframe).

Cross-origin access is now opt-in via a new `allowed_origins` config option (environment variable `FIFTYONE_ALLOWED_ORIGINS`), an explicit comma-separated list of trusted origins, e.g.:

```shell
export FIFTYONE_ALLOWED_ORIGINS='https://app.example.com,http://localhost:3000'
```

The literal value `*` restores the legacy wildcard behavior for users who explicitly require it and emits a warning.

**Users should upgrade to FiftyOne 1.17.0 or later.**

### Workarounds

In affected versions there is no configuration flag to disable the wildcard CORS header without upgrading. Until you can upgrade:

- Do not run the FiftyOne App server while browsing untrusted websites.
- Keep the App server bound to `localhost` (the default) and avoid exposing it on a network interface.
- Use a browser that enforces Private Network Access protections.

### Resources

- OWASP A01:2025 – Broken Access Control: https://owasp.org/Top10/2025/A01_2025-Broken_Access_Control/
CVSS v3.1 score: 6.3
RHSA-2025:22924 Red Hat Security Advisory: Red Hat JBoss Web Server 5.8.6 release and security update
tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE
CVSS v3.1 score: 7.5
GHSA-xwxj-5cm4-pc27 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Filtr8 Easy Magazine allows DOM-Based XSS. This issue affects Easy Magazine: from n/a through 2.1.13.
CVSS v3.1 score: 6.5
CVE-2025-59021 TYPO3 CMS Allows Broken Access Control in Redirects Module
Backend users with access to the redirects module and write permission on the sys_redirect table were able to read, create, and modify any redirect record without restriction to the user’s own file-mounts or web-mounts. This allowed attackers to insert or alter redirects pointing to arbitrary URLs – facilitating phishing or other malicious redirect attacks. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.
CVSS v4.0 score: 5.3
GHSA-xp9c-82jq-4pp7 
Information leak in doeditvotes.cgi in Bugzilla before 2.14.1 may allow remote attackers to more easily conduct attacks on the login.
CVE-2019-1853 Cisco AnyConnect Secure Mobility Client for Linux Out-of-Bounds Memory Read Vulnerability
A vulnerability in the HostScan component of Cisco AnyConnect Secure Mobility Client for Linux could allow an unauthenticated, remote attacker to read sensitive information on an affected system. The vulnerability exists because the affected software performs improper bounds checks. An attacker could exploit this vulnerability by crafting HTTP traffic for the affected component to download and process. A successful exploit could allow the attacker to read sensitive information on the affected system.
CVSS v3.0 score: 4.8
GHSA-fxw9-fjj4-4r79 
Unspecified vulnerability in Opera Mail before 2016-02-16 on Windows allows user-assisted remote attackers to execute arbitrary code via a crafted e-mail message.
CVSS v3.0 score: 8.8
GHSA-cfgm-r5hj-fcvm 
Multiple interpretation error in Panda Titanium 2005 4.02.01 allows remote attackers to bypass virus scanning via a file such as BAT, HTML, and EML with an "MZ" magic byte sequence which is normally associated with EXE, which causes the file to be treated as a safe type that could still be executed as a dangerous file type by applications on the end system, as demonstrated by a "triple headed" program that contains EXE, EML, and HTML content, aka the "magic byte bug."
CVE-2018-18989 
In CX-One Versions 4.42 and prior (CX-Programmer Versions 9.66 and prior and CX-Server Versions 5.0.23 and prior), when processing project files, the application fails to check if it is referencing freed memory. An attacker could use a specially crafted project file to exploit and execute code under the privileges of the application.
CVSS v3.0 score: 7.8
CVSS v2.0 score: 6.8
CVE-2022-34634 
CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a executes crafted or incorrectly formatted det instructions rather create an exception.
CVSS v3.1 score: 5.5
GHSA-cgx9-2qv8-82p7 
Heap-based buffer overflow in ImageMagick allows remote attackers to have unspecified impact via a crafted psd file, a different vulnerability than CVE-2014-9824.
CVSS v3.0 score: 7.8
GHSA-44c7-hc99-224f 
libmariadb/mariadb_lib.c in MariaDB Connector/C before 3.1.8 does not properly validate the content of an OK packet received from a client. NOTE: although mariadb_lib.c was originally based on code shipped for MySQL, this issue does not affect any MySQL components supported by Oracle.
CVSS v3.1 score: 8.8
CVE-2014-8157 
Off-by-one error in the jpc_dec_process_sot function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 image, which triggers a heap-based buffer overflow.
CVSS v2.0 score: 7.5
CVE-2016-10291 
An elevation of privilege vulnerability in the Qualcomm Slimbus driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10. Android ID: A-34030871. References: QC-CR#986837.
CVSS v3.0 score: 7
CVSS v2.0 score: 7.6
CVE-2025-31045 WordPress elfsight Contact Form widget plugin <= 2.3.1 - Sensitive Data Exposure Vulnerability
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in elfsight elfsight Contact Form widget elfsight-contact-form allows Retrieve Embedded Sensitive Data.This issue affects elfsight Contact Form widget: from n/a through <= 2.3.1.
CVSS v3.1 score: 7.5
CVE-2024-5259 MultiVendorX Marketplace – WooCommerce MultiVendor Marketplace Solution <= 4.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via hover_animation Parameter
The MultiVendorX Marketplace – WooCommerce MultiVendor Marketplace Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘hover_animation’ parameter in all versions up to, and including, 4.1.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1 score: 6.4
CVE-2025-10599 itsourcecode Web-Based Internet Laboratory Management System login.php AuthenticateUser sql injection
A security flaw has been discovered in itsourcecode Web-Based Internet Laboratory Management System 1.0. Impacted is the function User::AuthenticateUser of the file login.php. Performing manipulation of the argument user_email results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 7.3
CVSS v3.0 score: 7.3
CVSS v2.0 score: 7.5
GHSA-63jw-46hv-gwp2 
The SMS Alert  WordPress plugin before 3.9.8 does not bind its "mobile verified" session flag to the phone number that was actually verified: after an attacker verifies an OTP sent to their own phone, the signup/login handler reads a fresh, attacker-supplied phone number to select the account and logs them in. An unauthenticated attacker can therefore log in as any user, including an administrator, who has a billing phone on file.
CVSS v3.1 score: 7.5