CIRCL/vulnerability-scores huggingface dataset:
ICSA-25-105-01 Siemens Mendix Runtime
Affected applications allow for entity enumeration due to distinguishable responses in certain client actions. This could allow an unauthenticated remote attacker to list all valid entities and attribute names of a Mendix Runtime-based application.
CVSS v3.1 score: 5.3
GHSA-366q-4w6v-fvw8 
A weakness has been identified in code-projects Online Event Judging System 1.0. This impacts an unknown function of the file /home.php. Executing manipulation of the argument main_event can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be exploited.
CVSS v4.0 score: 5.5
CVSS v3.1 score: 7.3
GHSA-2qj5-wjfc-3w96 
IBM Rhapsody DM 4.0, 5.0 and 6.0 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources. IBM Reference #: 1997798.
CVSS v3.0 score: 8.1
CVE-2020-37113 GUnet OpenEclass 1.7.3 E-learning platform - File Upload Extension Bypass
GUnet OpenEclass 1.7.3 allows authenticated users to bypass file extension restrictions when uploading files. By renaming a PHP file to .php3 or .PhP, an attacker can upload a web shell and execute arbitrary code on the server. This vulnerability enables remote code execution by bypassing the intended file type checks in the exercise submission feature.
CVSS v4.0 score: 8.7
CVSS v3.1 score: 8.8
GHSA-cmp2-w8c6-7f92 
In the Linux kernel, the following vulnerability has been resolved:bpf: return VMA snapshot from task_vma iteratorHolding the per-VMA lock across the BPF program body creates a lock
ordering problem when helpers acquire locks that depend on mmap_lock:vm_lock -> i_rwsem -> mmap_lock -> vm_lockSnapshot the VMA under the per-VMA lock in _next() via memcpy(), then
drop the lock before returning. The BPF program accesses only the
snapshot.The verifier only trusts vm_mm and vm_file pointers (see
BTF_TYPE_SAFE_TRUSTED_OR_NULL in verifier.c). vm_file is reference-
counted with get_file() under the lock and released via fput() on the
next iteration or in _destroy(). vm_mm is already correct because
lock_vma_under_rcu() verifies vma->vm_mm == mm. All other pointers
are left as-is by memcpy() since the verifier treats them as untrusted.
CVSS v3.1 score: 5.5
CVE-2004-1085 
Human Interface Toolbox (HIToolBox) for Apple Mac 0S X 10.3.6 allows local users to exit applications via the force-quit key combination, even when the system is running in kiosk mode.
CVSS v2.0 score: 2.1
CVE-2021-1182 Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly. The vulnerabilities are due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a denial of service (DoS) condition. To exploit these vulnerabilities, an attacker would need to have valid administrator credentials on the affected device. Cisco has not released software updates that address these vulnerabilities.
CVSS v3.1 score: 7.2
CVE-2026-47828 Missing TLS Certificate Verification in BOSH CLI Allows Root Code Execution via Man-in-the-Middle Credential Replay
During bosh create-env and bosh delete-env, the CLI uploads compiled CPI packages and rendered job templates to the new VM's DAV blobstore over HTTPS without verifying the server certificate, even though a CA certificate for that endpoint is available in the installation manifest. A network attacker can terminate the TLS connection, harvest the Basic-auth credentials, and read the rendered-templates archive containing every bootstrap secret for the new BOSH Director, then replay the credentials against the real VM's agent for root code execution.
Affected versions: bosh-cli versions prior to v7.10.4.
CVSS v4.0 score: 8.9
CVSS v3.0 score: 7.1
GHSA-6fmq-jp6x-cmjc 
Windows Feedback Hub Elevation of Privilege Vulnerability
CVSS v3.1 score: 5.5
CVE-2007-2836 
Directory traversal vulnerability in session.rb in Hiki 0.8.0 through 0.8.6 allows remote attackers to delete arbitrary files via directory traversal sequences in the session ID, which is matched against an insufficiently restrictive regular expression before it is used to construct a filename that is marked for deletion at logout.
CVSS v2.0 score: 6.4
CVE-2018-18202 
The QLogic 4Gb Fibre Channel 5.5.2.6.0 and 4/8Gb SAN 7.10.1.20.0 modules for IBM BladeCenter have an undocumented support account with a support password, an undocumented diags account with a diags password, and an undocumented prom account with a prom password.
CVSS v3.0 score: 9.8
CVSS v2.0 score: 5
GHSA-q5jv-h4mq-jqrg 
The Apache configuration file (httpd.conf) in Oracle 9i Application Server (9iAS) uses a Location alias for /perl directory instead of a ScriptAlias, which allows remote attackers to read the source code of arbitrary CGI files via a URL containing the /perl directory instead of /cgi-bin.
GHSA-grrh-mjp7-g52c 
The boot loader in Das U-Boot before 2021.04-rc2 mishandles use of unit addresses in a FIT.
CVSS v3.1 score: 7.8
GHSA-8464-8v52-xm79 
A vulnerability classified as critical has been found in zhenfeng13 My-Blog 1.0. Affected is the function uploadFileByEditomd of the file src/main/java/com/site/blog/my/core/controller/admin/BlogController.java. The manipulation of the argument editormd-image-file leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 6.3
GHSA-wgx4-mfw2-ccw7 
Triggering an error page of the import process in Yakamara Media Redaxo CMS version 5.12.1 allows an authenticated CMS user has to alternate the files of a vaild file backup. This leads of leaking the database credentials in the environment variables.
CVSS v3.1 score: 6.5
GHSA-ch38-rrf9-v6gp 
A vulnerability was determined in O2OA up to 10.0-410. Affected by this vulnerability is an unknown functionality of the file /x_processplatform_assemble_designer/jaxrs/form of the component Personal Profile Page. This manipulation of the argument name/alias/description causes cross site scripting. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor replied in the GitHub issue (translated from simplified Chinese): "This issue will be fixed in the new version."
CVSS v4.0 score: 2
CVSS v3.1 score: 3.5
CVE-2026-26031 Frappe LMS affected by unauthorised user was able to access the full list of batch enrolled students
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to 2.44.0, security issue was identified in Frappe Learning, where unauthorised users were able to access the full list of enrolled students (by email) in batches. This vulnerability is fixed in 2.44.0.
CVSS v4.0 score: 1.3
GHSA-h4ff-8jr3-p6jp 
Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.
CVSS v3.1 score: 7
CVE-2017-5202 
The ISO CLNS parser in tcpdump before 4.9.0 has a buffer overflow in print-isoclns.c:clnp_print().
CVSS v3.0 score: 9.8
CVSS v2.0 score: 7.5
GHSA-2886-x646-53fj 
A use after free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.2.1, iOS 15.3.1 and iPadOS 15.3.1, Safari 15.3 (v. 16612.4.9.1.8 and 15612.4.9.1.8). Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..
CVSS v3.1 score: 8.8
CVE-2024-22497 
Cross Site Scripting (XSS) vulnerability in /admin/login password parameter in JFinalcms 5.0.0 allows attackers to run arbitrary code via crafted URL.
CVSS v3.1 score: 6.1
CVE-2024-42285 RDMA/iwcm: Fix a use-after-free related to destroying CM IDs
In the Linux kernel, the following vulnerability has been resolved:

RDMA/iwcm: Fix a use-after-free related to destroying CM IDs

iw_conn_req_handler() associates a new struct rdma_id_private (conn_id) with
an existing struct iw_cm_id (cm_id) as follows:

        conn_id->cm_id.iw = cm_id;
        cm_id->context = conn_id;
        cm_id->cm_handler = cma_iw_handler;

rdma_destroy_id() frees both the cm_id and the struct rdma_id_private. Make
sure that cm_work_handler() does not trigger a use-after-free by only
freeing of the struct rdma_id_private after all pending work has finished.
CVSS v3.1 score: 9.8
CVE-2018-21155 
Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.34, DM200 before 1.0.0.52, R6100 before 1.0.1.22, R7500 before 1.0.0.122, R7500v2 before 1.0.3.26, R7800 before 1.0.2.42, R8900 before 1.0.4.2, R9000 before 1.0.3.16, WNDR4300 before 1.0.2.98, WNDR4300v2 before 1.0.0.54, WNDR4500v3 before 1.0.0.54, and WNR2000v5 before 1.0.0.64.
CVSS v3.0 score: 6.3
RHSA-2007:0981 Red Hat Security Advisory: thunderbird security update
security flaw security flaw security flaw about: blank windows security flaw security flaw security flaw security flaw security flaw
CVE-2022-21829 
Concrete CMS Versions 9.0.0 through 9.0.2 and 8.5.7 and below can download zip files over HTTP and execute code from those zip files which could lead to an RCE. Fixed by enforcing ‘concrete_secure’ instead of ‘concrete’. Concrete now only makes requests over https even a request comes in via http. Concrete CMS security team ranked this 8 with CVSS v3.1 vector: AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H Credit goes to Anna for reporting HackerOne 1482520.
CVSS v3.1 score: 9.8
CVSS v2.0 score: 7.5
GHSA-v3g7-mv58-c2hx 
In the Linux kernel, the following vulnerability has been resolved:i2c: tegra: check msg length in SMBUS block readFor SMBUS block read, do not continue to read if the message length
passed from the device is '0' or greater than the maximum allowed bytes.
CVSS v3.1 score: 7.8
CVE-2025-27213 
An Improper Access Control could allow a malicious actor authenticated in the API of certain UniFi Connect devices to enable Android Debug Bridge (ADB) and make unsupported changes to the system.

 

Affected Products:

UniFi Connect EV Station Pro (Version 1.5.18 and earlier)
UniFi Connect Display (Version 1.9.324 and earlier)
UniFi Connect Display Cast (Version 1.9.301 and earlier)
UniFi Connect Display Cast Pro (Version 1.0.78 and earlier)
UniFi Connect Display Cast Lite (Version 1.0.3 and earlier)

Mitigation:

Update UniFi Connect EV Station Pro to Version 1.5.27 or later
Update UniFi Connect Display to Version 1.13.6 or later
Update UniFi Connect Display Cast to Version 1.10.3 or later
Update UniFi Connect Display Cast Pro to Version 1.0.83 or later
Update UniFi Connect Display Cast Lite to Version 1.1.3 or later
CVSS v3.1 score: 4.9
GHSA-48r6-v3wx-gxm5 
Exiv2 0.26 has a heap-based buffer over-read in WebPImage::decodeChunks in webpimage.cpp.
CVSS v3.0 score: 8.8
CVE-2011-4631 
Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the system extension recycler.
CVSS v3.1 score: 5.4
CVSS v2.0 score: 3.5
CVE-2020-36624 ahorner text-helpers translation.rb reverse tabnabbing
A vulnerability was found in ahorner text-helpers up to 1.0.x. It has been declared as critical. This vulnerability affects unknown code of the file lib/text_helpers/translation.rb. The manipulation of the argument link leads to use of web link to untrusted target with window.opener access. The attack can be initiated remotely. Upgrading to version 1.1.0 is able to address this issue. The name of the patch is 184b60ded0e43c985788582aca2d1e746f9405a3. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216520.
CVSS v3.1 score: 6.3
CVSS v3.0 score: 6.3
GHSA-xph7-pm58-q56v 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPCoder WP Coder allows Stored XSS.This issue affects WP Coder: from n/a through 3.5.
CVSS v3.1 score: 5.9
GHSA-76c9-566c-68x5 
I-O DATA DEVICE HDL-A and HDL2-A devices with firmware 1.07 and earlier do not properly manage sessions, which allows remote attackers to obtain sensitive information or modify data via unspecified vectors.
CVE-2025-24631 WordPress BP Email Assign Templates Plugin <= 1.5 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shanebp BP Email Assign Templates bp-email-assign-templates allows Reflected XSS.This issue affects BP Email Assign Templates: from n/a through <= 1.5.
CVSS v3.1 score: 7.1
GHSA-hv43-fjj6-p6qh 
The uListing plugin for WordPress is vulnerable to generic SQL Injection via the ‘listing_id’ parameter in versions up to, and including, 1.6.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS v3.1 score: 9.8
GHSA-xm32-723g-g4jh 
A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager software could allow an authenticated, remote attacker to download and view files within the application that should be restricted. This vulnerability is due to improper sanitization of user-supplied input in HTTP request parameters that describe filenames. An attacker could exploit this vulnerability by using directory traversal techniques to submit a path to a desired file location. A successful exploit could allow the attacker to view application files that may contain sensitive information.
CVSS v3.1 score: 6.5
CVE-2026-27998 WordPress Vixus theme <= 1.0.16 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Vixus vixus allows PHP Local File Inclusion.This issue affects Vixus: from n/a through <= 1.0.16.
CVSS v3.1 score: 8.1
GHSA-wh6p-cqjg-99rr 
A NULL pointer dereference in the gf_odf_vvc_cfg_write_bs function (odf/descriptors.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
CVSS v3.1 score: 7.5
CVE-2022-3099 Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 9.0.0360.
CVSS v3.0 score: 7.8
PYSEC-2026-3347 
### Impact
When [`mlir::tfg::ConvertGenericFunctionToFunctionDef`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/ir/importexport/functiondef_import.cc) is given empty function attributes, it crashes.
```cpp
// We pre-allocate the array of operands and populate it using the
// `output_name_to_position` and `control_output_to_position` populated
// previously.
SmallVector<Value> ret_vals(func.ret_size() + func.control_ret_size(),
                            Value());
for (const auto& ret_val : func.ret()) {
  auto position = output_name_to_position.find(ret_val.first);
  if (position == output_name_to_position.end())
    return InvalidArgument(
        "Can't import function, returned value references unknown output "
        "argument ",
        ret_val.first);
  ret_vals[position->second] =
      value_manager.GetValueOrCreatePlaceholder(ret_val.second);
}
for (const auto& ret_val : func.control_ret()) {
  auto position = control_output_to_position.find(ret_val.first);
  if (position == control_output_to_position.end())
    return InvalidArgument(
        "Can't import function, returned value references unknown output "
        "argument ",
        ret_val.first);
  Value result = value_manager.GetValueOrCreatePlaceholder(
      (Twine("^") + ret_val.second).str());
```
`ret_val.second` cannot be empty. Neither can `input`.
```cpp
// Process every node and create a matching MLIR operation
for (const NodeDef& node : nodes) {
  if (node.op().empty()) return InvalidArgument("empty op type");
  OperationState state(unknown_loc, absl::StrCat("tfg.", node.op()));
  // Fetch the inputs, creating placeholder if an input hasn't been visited.
  for (const std::string& input : node.input())
    state.operands.push_back(
        value_manager.GetValueOrCreatePlaceholder(input));
```


### Patches
We have patched the issue in GitHub commit [ad069af92392efee1418c48ff561fd3070a03d7b](https://github.com/tensorflow/tensorflow/commit/ad069af92392efee1418c48ff561fd3070a03d7b).

The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range.


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

CVSS v3.1 score: 5.9
CVE-2025-28917 WordPress Custom Smilies plugin <= 2.9.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in crazyloong Custom Smilies custom-smilies-se allows Stored XSS.This issue affects Custom Smilies: from n/a through <= 2.9.2.
CVSS v3.1 score: 7.1
CVE-2018-15991 
Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS v3.0 score: 8.8
CVSS v2.0 score: 9.3
CVE-2023-25620 



A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that
could cause denial of service of the controller when a malicious project file is loaded onto the
controller by an authenticated user. 

 


CVSS v3.1 score: 6.5
CVE-2020-14152 
In IJG JPEG (aka libjpeg) before 9d, jpeg_mem_available() in jmemnobs.c in djpeg does not honor the max_memory_to_use setting, possibly causing excessive memory consumption.
CVSS v3.1 score: 7.1
CVSS v2.0 score: 5.8
CVE-2007-6532 
Double free vulnerability in the Widget Library (libxfcegui4) in Xfce before 4.4.2 might allow remote attackers to execute arbitrary code via unknown vectors related to the "cliend id, program name and working directory in session management."
CVSS v2.0 score: 10
GHSA-jjjh-9j5x-gr7x 
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling).  Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and  9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS v3.1 score: 4.9
GHSA-f9j6-qh7x-56fv 
SunGrow iSolarCloud Android app V2.1.6.20241104 and prior suffers from Missing SSL Certificate Validation. The app explicitly ignores certificate errors and is vulnerable to MiTM attacks. Attackers can impersonate the iSolarCloud server and communicate with the Android app.
CVSS v3.1 score: 7.4
GHSA-mw53-8qf5-qwp2 
An exploitable denial-of-service vulnerability exists in the Weave error reporting functionality of the Nest Cam IQ Indoor, version 4620002. A specially crafted weave packets can cause an arbitrary Weave Exchange Session to close, resulting in a denial of service. An attacker can send a specially crafted packet to trigger this vulnerability.
CVSS v3.0 score: 7.5
CVE-2016-10440 
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 425, SD 430, SD 450, SD 625, and SD 650/52, there is improper access control to a bus.
CVSS v3.0 score: 9.8
CVSS v2.0 score: 10
GHSA-r89h-7xqr-h8wg 
Adobe Framemaker versions 2020.8, 2022.6 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could lead to disclosure of sensitive memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1 score: 5.5
CVE-2018-1179 
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DataSubBlock structures in GIF images. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated data structure. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-5490.
CVSS v3.1 score: 6.5
CVSS v2.0 score: 4.3
GHSA-6mx3-3vqg-hpp2 Django allows unprivileged users to read the password hashes of arbitrary accounts
An issue was discovered in Django 2.1 before 2.1.2, in which unprivileged users can read the password hashes of arbitrary accounts. The read-only password widget used by the Django Admin to display an obfuscated password hash was bypassed if a user has only the "view" permission (new in Django 2.1), resulting in display of the entire password hash to those users. This may result in a vulnerability for sites with legacy user accounts using insecure hashes.
CVSS v4.0 score: 6.9
CVSS v3.0 score: 4.9
CVE-2025-6706 Running certain aggregation operations with the SBE engine may lead to unexpected behavior on MongoDB Server
An authenticated user may trigger a use after free that may result in MongoDB Server crash and other unexpected behavior, even if the user does not have authorization to shut down a server.
The crash is triggered on affected versions by issuing an aggregation framework operation using a specific combination of rarely-used aggregation pipeline expressions. This issue affects MongoDB Server v6.0 version prior to 6.0.21, MongoDB Server v7.0 version prior to 7.0.17 and MongoDB Server v8.0 version prior to 8.0.4 when the SBE engine is enabled.
CVSS v3.1 score: 5
GHSA-67qm-qh8r-8r76 
The AutoFill feature in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.1 on Mac OS X 10.4, allows remote attackers to obtain sensitive Address Book Card information via JavaScript code that forces keystroke events for input fields.
CVE-2021-41096 Use of a Broken or Risky Cryptographic Algorithm in com.mayank.rucky
Rucky is a USB HID Rubber Ducky Launch Pad for Android. Versions 2.2 and earlier for release builds and versions 425 and earlier for nightly builds suffer from use of a weak cryptographic algorithm (RSA/ECB/PKCS1Padding). The issue will be patched in v2.3 for release builds and 426 onwards for nightly builds. As a workaround, one may disable an advance security feature if not required.
CVSS v3.1 score: 7.5
CVE-2020-24565 
An out-of-bounds read information disclosure vulnerabilities in Trend Micro Apex One may allow a local attacker to disclose sensitive information to an unprivileged account on vulnerable installations of the product. An attacker must first obtain the ability to execute low-privileged code on the target in order to exploit these vulnerabilities. The subs affected in this vulnerability makes it unique compared to similar CVEs such as CVE-2020-24564 and CVE-2020-25770.
CVSS v3.1 score: 5.5
CVSS v2.0 score: 2.1
CVE-2017-9674 
In SimpleCE 2.3.0, an authenticated XSS vulnerability was found on index.php/content/text/1?return_url=[XSS] exploitable as a regular or admin user.
CVSS v3.0 score: 5.4
CVSS v2.0 score: 3.5
GHSA-hf63-h777-fqg6 
Cisco IOS 12.0 through 12.4, when IP-based tunnels and the Cisco Express Forwarding feature are enabled, allows remote attackers to cause a denial of service (device reload) via malformed packets, aka Bug ID CSCsx70889.
GHSA-xrcw-9q57-9frw 
An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed a suspended GitHub App to retain access to the repository via a scoped user access token. This was only exploitable in public repositories while private repositories were not impacted. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in versions 3.9.17, 3.10.14, 3.11.12, 3.12.6, 3.13.1. This vulnerability was reported via the GitHub Bug Bounty program.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 5.3
RHSA-2024:2937 Red Hat Security Advisory: nodejs security update
nodejs: CONTINUATION frames DoS nghttp2: CONTINUATION frames DoS
CVSS v3.1 score: 5.3
CVE-2013-3516 
NETGEAR WNR3500U and WNR3500L routers uses form tokens abased solely on router's current date and time, which allows attackers to guess the CSRF tokens.
CVSS v3.1 score: 6.5
CVSS v2.0 score: 4.3
GHSA-rv57-79g9-2rpq 
A vulnerability in the 802.11r Fast Transition feature set of Cisco IOS Access Points (APs) Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a corruption of certain timer mechanisms triggered by specific roaming events. This corruption will eventually cause a timer crash. An attacker could exploit this vulnerability by sending malicious reassociation events multiple times to the same AP in a short period of time, causing a DoS condition on the affected AP.
CVSS v3.0 score: 7.4
GHSA-rchm-vwvf-jh7x 
A vulnerability was detected in itsourcecode Online Hotel Management System 1.0. This impacts an unknown function of the file /admin/mod_amenities/controller.php?action=edit. Performing a manipulation of the argument amen_id results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.
CVSS v4.0 score: 5.5
CVSS v3.1 score: 7.3
CVE-2024-9439 Remote Code Execution in transformeroptimus/superagi
SuperAGI is vulnerable to remote code execution in the latest version. The `agent template update` API allows attackers to control certain parameters, which are then fed to the eval function without any sanitization or checks in place. This vulnerability can lead to full system compromise.
CVSS v3.0 score: 8.8
GHSA-9r35-r3pm-gc7c 
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.23 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
GHSA-x4pq-3h8q-r7jw 
A buffer overflow has been identified in the SetupUtility driver in some Lenovo Notebook products which may allow an attacker with local access and elevated privileges to execute arbitrary code.
CVSS v3.1 score: 6.7
CVE-2023-34336 
AMI BMC contains a vulnerability in the IPMI handler, where an
attacker with the required privileges can cause a buffer overflow, which may
lead to code execution, denial of service, or escalation of privileges.






 








CVSS v3.1 score: 8.1
CVE-2022-3502 Human Resource Management System Leave cross site scripting
A vulnerability was found in Human Resource Management System 1.0. It has been classified as problematic. This affects an unknown part of the component Leave Handler. The manipulation of the argument Reason leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-210831.
CVSS v3.1 score: 3.5
GHSA-fjww-f977-qh4x 
A vulnerability in the HTTP traffic filtering component of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, and Cisco Firepower Management Center Software could allow an unauthenticated, remote attacker to bypass filtering protections. The vulnerability is due to improper handling of HTTP requests, including those communicated over a secure HTTPS connection, that contain maliciously crafted headers. An attacker could exploit this vulnerability by sending malicious requests to an affected device. An exploit could allow the attacker to bypass filtering and deliver malicious requests to protected systems, allowing attackers to deliver malicious content that would otherwise be blocked.
CVSS v3.1 score: 5.3
GHSA-9rj4-m4p5-2v9x 
Possible out of bound access while processing assoc response from host due to improper length check before copying into buffer in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8096AU, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8905, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996AU, Nicobar, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCM2150, QCN7605, QCS405, QCS605, QM215, SA6155P, Saipan, SC8180X, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM845, SDX20, SDX55, SM6150, SM7150, SM8150, SM8250, SXR2130
GHSA-x34r-63hx-w57f Langroid has WAF Bypass Leading to RCE in TableChatAgent
Affected Scopelangroid <= 0.59.31Vulnerability DescriptionCVE-2025-46724 fix bypass:TableChatAgent can call pandas_eval tool to evaluate the expression. There is a WAF in `langroid/utils/pandas_utils.py` introduced to block code injection CVE-2025-46724. However it can be bypassed due to `_literal_ok()` returning `False` instead of raising `UnsafeCommandError` on invalid input, combined with unrestricted access to dangerous dunder attributes (`__init__`, `__globals__`, `__builtins__`). This allows chaining whitelisted DataFrame methods to leak the `eval` builtin and execute arbitrary code.Reproduction & PoCThis payload is used to bypass the waf, when executed, the column name `__import__('os').system('ls')#...` will be passed to evalhere is the PoCafter running this poc, command `ls` will be executed on the server
<img width="2501" height="1256" alt="image" src="https://github.com/user-attachments/assets/98b83585-68e0-4be4-a7a6-21909fed662e" />Gadgetpandas_eval (langroid\agent\special\table_chat_agent.py:239)
handle_tool_message (langroid\agent\base.py:2092)
handle_message (langroid\agent\base.py:1744)
agent_response (langroid\agent\base.py:760)
response (langroid\agent\task.py:1584)
step (langroid\agent\task.py:1261)
run (langroid\agent\task.py:827)Security ImpactRemote Code Execution (RCE) via `pandas_eval` tool. Attackers can execute arbitrary shell commands through controlled user input.
CVSS v4.0 score: 9.4
CVE-2025-9411 lostvip-com ruoyi-go LoginInforService.go SelectPageList sql injection
A security vulnerability has been detected in lostvip-com ruoyi-go up to 2.1. The impacted element is the function SelectPageList of the file modules/system/service/LoginInforService.go. The manipulation of the argument isAsc leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 6.3
CVSS v3.0 score: 6.3
CVSS v2.0 score: 6.5
GHSA-hm95-jj3v-8fvx 
An issue was discovered in EyesOfNetwork 5.3. An authenticated web user with sufficient privileges could abuse the AutoDiscovery module to run arbitrary OS commands via the /module/module_frame/index.php autodiscovery.php target field.
GHSA-58m2-c5rp-jr5w 
The Similar Posts WordPress plugin through 3.1.5 allow high privilege users to execute arbitrary PHP code in an hardened environment (ie with DISALLOW_FILE_EDIT, DISALLOW_FILE_MODS and DISALLOW_UNFILTERED_HTML set to true) via the 'widget_rrm_similar_posts_condition' widget setting of the plugin.
CVSS v3.1 score: 7.2
GHSA-g2fv-w76j-v7p7 
Sensitive information uncleared after debug/power state transition in the Controller 6000 could be abused by an attacker with knowledge of the Controller's default diagnostic password and physical access to the Controller to view its configuration through the diagnostic web pages.This issue affects: Gallagher Controller 6000 8.70 prior to vCR8.70.231204a (distributed in 8.70.2375 (MR5)), v8.60 or earlier.
CVSS v3.1 score: 2.4
GHSA-w7qf-x8rx-fxrq 
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 39378.
CVSS v3.0 score: 6.3
RHSA-2024:2303 Red Hat Security Advisory: gstreamer1-plugins-good security update
gstreamer-plugins-good: integer overflow leading to heap overwrite in FLAC image tag handling
CVSS v3.1 score: 5.5
RHSA-2019:0218 Red Hat Security Advisory: firefox security update
Mozilla: Use-after-free parsing HTML5 stream Mozilla: Memory safety bugs fixed in Firefox 65 and Firefox ESR 60.5 Mozilla: Privilege escalation through IPC channel messages
CVSS v3.0 score: 10
GHSA-4g62-mfwx-4q48 slixmpp Incorrect Access Control
slixmpp version before commit 7cd73b594e8122dddf847953fcfc85ab4d316416 contains an incorrect Access Control vulnerability in XEP-0223 plugin (Persistent Storage of Private Data via PubSub) options profile, used for the configuration of default access model that can result in all of the contacts of the victim can see private data having been published to a PEP node. This attack appears to be exploitable if the user of this library publishes any private data on PEP, the node isn't configured to be private. This vulnerability appears to have been fixed in commit 7cd73b594e8122dddf847953fcfc85ab4d316416 which is included in slixmpp 1.4.2.
CVSS v3.0 score: 7.5
CVE-2026-49793 Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally.
CVSS v3.1 score: 7.8
CVE-2006-4774 
The VLAN Trunking Protocol (VTP) feature in Cisco IOS 12.1(19) allows remote attackers to cause a denial of service by sending a VTP version 1 summary frame with a VTP version field value of 2.
CVSS v2.0 score: 7.8
GHSA-g5xp-5m3c-87v8 
An out-of-bounds read issue was addressed with improved bounds checking. This issue is fixed in Security Update 2022-005 Catalina, macOS Monterey 12.5. A user in a privileged network position may be able to leak sensitive information.
CVSS v3.1 score: 6.5
GHSA-hqhc-52p7-qm56 
IBM WebSphere Application Server 7.x before 7.0.0.31, when simpleFileServlet static file caching is enabled, allows remote authenticated users to obtain sensitive information via unspecified vectors.
GHSA-2j53-wh2m-93x6 
IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS v3.0 score: 5.4
RHSA-2025:0880 Red Hat Security Advisory: tuned security update
tuned: `script_pre` and `script_post` options allow to pass arbitrary scripts executed by root tuned: improper sanitization of `instance_name` parameter of the `instance_create()` method
CVSS v3.1 score: 5.5
CVE-2026-45792 RTK improperly trusts project-local filter configuration, allowing silent tampering of command output shown to LLM
rtk filters and compresses command outputs before they reach your LLM context. Prior to 0.32.0, RTK (Rust Token Killer) improperly trusts project-local configuration files. RTK automatically loads .rtk/filters.toml from the working directory with highest priority and without user notification. An attacker can place a malicious filter file in a repository to apply regex-based modifications (e.g., strip_lines_matching) to shell command output before it is shown to the LLM, without any indication that the output has been modified. This allows attackers to selectively suppress or alter command output (including file contents, diffs, and security scan results) without detection, potentially concealing malicious code during AI-assisted development or review. This vulnerability is fixed in 0.32.0.
CVSS v4.0 score: 6.9
CVE-2020-27155 
An issue was discovered in Octopus Deploy through 2020.4.4. If enabled, the websocket endpoint may allow an untrusted tentacle host to present itself as a trusted one.
CVSS v3.1 score: 7.5
CVSS v2.0 score: 4.3
GHSA-c852-rjqq-x3x3 
The upgrade of IRIX on Origin 3000 to 6.5.13 through 6.5.16 changes the MAC address of the system, which could modify intended access restrictions that are based on a MAC address.
GHSA-92vr-85r4-9j46 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chris Taylor Child Themes child-themes allows Reflected XSS.This issue affects Child Themes: from n/a through <= 1.0.1.
CVSS v3.1 score: 7.1
RHSA-2009:1426 Red Hat Security Advisory: openoffice.org security update
OpenOffice.org Word document Integer Underflow OpenOffice.org Word document buffer overflow
GHSA-3v2q-pqp4-rfp4 
Windows Digital Media Elevation of Privilege Vulnerability
CVSS v3.1 score: 6.6
GHSA-9277-mg3f-fmc2 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo allows Stored XSS.This issue affects WooPayments – Fully Integrated Solution Built and Supported by Woo: from n/a through 6.4.2.
CVSS v3.1 score: 6.5
CVE-2017-1268 
IBM Security Guardium 10 and 10.5 uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the software does not also use a salt as part of the input. IBM X-Force ID: 124743.
CVSS v3.0 score: 5.9
GHSA-qw9g-4493-84v2 
A vulnerability was found in PHPGurukul Pre-School Enrollment System 1.0. It has been classified as critical. This affects an unknown part of the file /enrollment.php. The manipulation of the argument fathername leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS v4.0 score: 5.5
CVSS v3.1 score: 7.3
RHSA-2022:1082 Red Hat Security Advisory: openssl security update
openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
CVSS v3.1 score: 7.5
RHSA-2022:6147 Red Hat Security Advisory: OpenShift Container Platform 4.9.47 bug fix and security update
go-getter: command injection vulnerability go-getter: unsafe download (issue 1 of 3) go-getter: unsafe download (issue 2 of 3) go-getter: unsafe download (issue 3 of 3)
CVSS v3.1 score: 8.6
CVE-2024-8362 
Use after free in WebAudio in Google Chrome prior to 128.0.6613.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS v3.1 score: 8.8
GHSA-rc6v-g84g-9p25 
IBM InfoSphere Master Data Management 11.6, 12.0, and 14.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS v3.1 score: 5.4
GHSA-vc27-49rw-f322 
A vulnerability was found in needyamin Library Card System 1.0 and classified as critical. This issue affects some unknown processing of the file admin.php of the component Login. The manipulation of the argument email/password leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 7.3
GHSA-g89v-hj63-36q6 
IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 213866.
CVSS v3.1 score: 5.4
CVE-2025-38180 net: atm: fix /proc/net/atm/lec handling
In the Linux kernel, the following vulnerability has been resolved:

net: atm: fix /proc/net/atm/lec handling

/proc/net/atm/lec must ensure safety against dev_lec[] changes.

It appears it had dev_put() calls without prior dev_hold(),
leading to imbalance and UAF.
CVSS v3.1 score: 7.8
GHSA-66r3-h3v8-4pjm 
Cross-site scripting (XSS) vulnerability in the docshell implementation in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allows remote attackers to inject arbitrary web script or HTML via vectors related to short-circuited page loads, aka "Universal XSS (UXSS)."
GHSA-x25c-38mh-jjj3 
libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 does not validate OMX buffer sizes for the GSM and G711 codecs, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27793163.
CVSS v3.0 score: 7.8
CVE-2025-6699 LabRedesCefetRJ WeGIA Cadastro de Funcionário cadastro_funcionario.php cross site scripting
A vulnerability classified as problematic has been found in LabRedesCefetRJ WeGIA 3.4.0. This affects an unknown part of the file /html/funcionario/cadastro_funcionario.php of the component Cadastro de Funcionário. The manipulation of the argument Nome/Sobrenome leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This is a different issue than CVE-2025-23030. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0 score: 5.1
CVSS v3.1 score: 3.5
CVSS v3.0 score: 3.5
CVSS v2.0 score: 4
GHSA-9c7m-33cr-jgj5 
In contacts service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed.
CVSS v3.1 score: 5.5
GHSA-vcfr-4r54-mh5g 
A vulnerability, which was classified as critical, has been found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. Affected by this issue is some unknown functionality of the file /add-phlebotomist.php. The manipulation of the argument empid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 7.3
CVE-2026-63233 SQL injection and unsafe deserialisation vulnerability
A SQL injection and unsafe deserialisation
vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment
overall answer endpoint, control data passed to unserialize(), write a webshell
to a publicly accessible location, and execute arbitrary code on the server.
CVSS v3.1 score: 9.9
CVE-2023-33182 Nextcloud Contacts photos only sanitized if mime type is all lower case
Contacts app for Nextcloud easily syncs contacts from various devices with your Nextcloud and allows editing. The unsanitized SVG is converted to a JavaScript blob (in memory data) that the Avatar can't render. Due to this constellation the missing sanitization does not seem to be exploitable. It is recommended that the Contacts app is upgraded to 5.0.3 or 4.2.4


CVSS v3.1 score: 0
CVE-2023-41084 Socomec MOD3GP-SY-120K Reliance on Cookies without Validation and Integrity Checking











Session management within the web application is incorrect and allows attackers to steal session cookies to perform a multitude of actions that the web app allows on the device.












CVSS v3.1 score: 10
GHSA-h66g-2x3f-vgpp 
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eliz Software Panel allows Command Line Execution through SQL Injection.This issue affects Panel: before v2.3.24.
CVSS v4.0 score: 9.4
CVSS v3.1 score: 8.8
CVE-2014-0484 
The Debian acpi-support package before 0.140-5+deb7u3 allows local users to gain privileges via vectors related to the "user's environment."
CVSS v2.0 score: 7.2
GHSA-q2x7-gx3x-j7wv 
The mintToken function of a smart contract implementation for CryptoABS (ABS), an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS v3.0 score: 7.5
GHSA-v6ph-xcq9-qxxj mcp-from-openapi is Vulnerable to SSRF via $ref Dereferencing in Untrusted OpenAPI Specifications
SummaryThe `mcp-from-openapi` library uses `@apidevtools/json-schema-ref-parser` to dereference `$ref` pointers in OpenAPI specifications without configuring any URL restrictions or custom resolvers. A malicious OpenAPI specification containing `$ref` values pointing to internal network addresses, cloud metadata endpoints, or local files will cause the library to fetch those resources during the `initialize()` call. This enables Server-Side Request Forgery (SSRF) and local file read attacks when processing untrusted OpenAPI specifications.Affected Versions`<= 2.1.2` (latest)CWECWE-918: Server-Side Request Forgery (SSRF)Vulnerability Details**File:** `index.js` lines 870-875When `OpenAPIToolGenerator.initialize()` is called, it dereferences the OpenAPI document using `json-schema-ref-parser`:No options are passed to `.dereference()` — no URL allowlist, no custom resolvers, no protocol restrictions. The ref parser fetches any URL it encounters in `$ref` values, including:`http://` and `https://` URLs (internal services, cloud metadata)`file://` URLs (local filesystem)This is the default behavior of `json-schema-ref-parser` — it resolves all `$ref` pointers by fetching the referenced resource.ExploitationAttack 1: SSRF to internal services / cloud metadataA malicious OpenAPI spec containing:When processed by `OpenAPIToolGenerator`, the library fetches `http://169.254.169.254/latest/meta-data/iam/security-credentials/` from the server, potentially leaking AWS IAM credentials.Attack 2: Local file readThe ref parser reads local files and includes their contents in the dereferenced output.Proof of Concept**Tested and confirmed** on mcp-from-openapi v2.1.2. The attacker server receives the GET request during `initialize()`.Impact**Cloud credential theft** — `$ref` pointing to `http://169.254.169.254/` steals AWS/GCP/Azure metadata**Internal network scanning** — `$ref` values can probe internal services and ports**Local file read** — `file://` protocol reads arbitrary files from the server filesystem**No privileges required** — attacker only needs to provide a crafted OpenAPI spec to any application using this librarySuggested FixPass resolver options to `dereference()` that restrict which protocols and hosts are allowed:Or disable all external resolution and require all schemas to be inline:
CVSS v3.1 score: 7.5
CVE-2014-0565 
Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0566.
CVSS v2.0 score: 10
GHSA-cxgq-2hjc-xvvj 
In the 5.4.0 version of the Fork CMS software, HTML Injection and Stored XSS vulnerabilities were discovered via the /backend/ajax URI.
CVSS v3.0 score: 6.1
GHSA-qvcj-459w-56gw 
The Identity Server in Novell Access Manager before 3.1 SP1 allows attackers with disabled Active Directory accounts to authenticate using X.509 authentication, which bypasses intended access restrictions.