CIRCL/vulnerability-scores huggingface dataset:
GHSA-vq87-vqwh-6mj9 
A vulnerability in the SSH server of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition for the SSH server of an affected device.This vulnerability is due to a logic error when an SSH session is established. An attacker could exploit this vulnerability by sending crafted SSH messages to an affected device. A successful exploit could allow the attacker to exhaust available SSH resources on the affected device so that new SSH connections to the device are denied, resulting in a DoS condition. Existing SSH connections to the device would continue to function normally. The device must be rebooted manually to recover. However, user traffic would not be impacted and could be managed using a remote application such as Cisco Adaptive Security Device Manager (ASDM).
CVSS v3.1 score: 5.3
CVE-2025-71098 ip6_gre: make ip6gre_header() robust
In the Linux kernel, the following vulnerability has been resolved:

ip6_gre: make ip6gre_header() robust

Over the years, syzbot found many ways to crash the kernel
in ip6gre_header() [1].

This involves team or bonding drivers ability to dynamically
change their dev->needed_headroom and/or dev->hard_header_len

In this particular crash mld_newpack() allocated an skb
with a too small reserve/headroom, and by the time mld_sendpack()
was called, syzbot managed to attach an ip6gre device.

[1]
skbuff: skb_under_panic: text:ffffffff8a1d69a8 len:136 put:40 head:ffff888059bc7000 data:ffff888059bc6fe8 tail:0x70 end:0x6c0 dev:team0
------------[ cut here ]------------
 kernel BUG at net/core/skbuff.c:213 !
 <TASK>
  skb_under_panic net/core/skbuff.c:223 [inline]
  skb_push+0xc3/0xe0 net/core/skbuff.c:2641
  ip6gre_header+0xc8/0x790 net/ipv6/ip6_gre.c:1371
  dev_hard_header include/linux/netdevice.h:3436 [inline]
  neigh_connected_output+0x286/0x460 net/core/neighbour.c:1618
  neigh_output include/net/neighbour.h:556 [inline]
  ip6_finish_output2+0xfb3/0x1480 net/ipv6/ip6_output.c:136
 __ip6_finish_output net/ipv6/ip6_output.c:-1 [inline]
  ip6_finish_output+0x234/0x7d0 net/ipv6/ip6_output.c:220
  NF_HOOK_COND include/linux/netfilter.h:307 [inline]
  ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247
  NF_HOOK+0x9e/0x380 include/linux/netfilter.h:318
  mld_sendpack+0x8d4/0xe60 net/ipv6/mcast.c:1855
  mld_send_cr net/ipv6/mcast.c:2154 [inline]
  mld_ifc_work+0x83e/0xd60 net/ipv6/mcast.c:2693
CVSS v3.1 score: 5.5
CVE-2023-42810 systeminformation SSID Command Injection Vulnerability
systeminformation is a System Information Library for Node.JS. Versions 5.0.0 through 5.21.6 have a SSID Command Injection Vulnerability. The problem was fixed with a parameter check in version 5.21.7. As a workaround, check or sanitize parameter strings that are passed to `wifiConnections()`, `wifiNetworks()` (string only).
CVSS v3.1 score: 9.8
GHSA-g2gv-p2wg-g748 
A vulnerability, which was classified as critical, has been found in SourceCodester Simple Company Website 1.0. This issue affects some unknown processing of the file /classes/Users.php?f=save. The manipulation of the argument img leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 2
CVSS v3.1 score: 4.7
RHSA-2004:047 Red Hat Security Advisory: pwlib security update
security flaw
CVE-2023-41165 
An issue was discovered in Stormshield Network Security (SNS) 3.7.0 through 3.7.38 before 3.7.39, 3.10.0 through 3.11.26 before 3.11.27, 4.0 through 4.3.21 before 4.3.22, and 4.4.0 through 4.6.8 before 4.6.9. An administrator with write access to the SNS firewall can configure a login disclaimer with malicious JavaScript elements that can result in data theft.
CVSS v3.1 score: 4.8
CVE-2023-41833 
A race condition in UEFI firmware for some Intel(R) processors may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS v4.0 score: 8.7
CVSS v3.1 score: 7.5
CVE-2023-40757 
User enumeration is found in PHPJabbers Food Delivery Script v3.1. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
CVSS v3.1 score: 9.8
CVE-2026-9058 Improper Certificate Verification in Szafir SDK
For untrusted certificates that contain the "Authority Information Access - caIssuers URI" extension, Szafir SDK will automatically download the parent CA certificate from the specified URL and will import it to its trust store as a "nonqualified" certificate. In such a case, Szafir SDK returns a success status code of 0 ("Positively verified") upon successful cryptographic verification and a certificate status of "nonqualified".

For other types of untrusted certificates, Szafir SDK returns a success status code of 0 ("Positively verified") upon successful cryptographic verification and a certificate status of "nondetermined".

This may lead integrating applications to incorrectly treat the digital signature as valid despite an untrusted certificate chain. This flaw enables authentication bypass and user impersonation:
(1) in use-cases other than qualified certificate authentication, or
(2) if the qualified certificate authentication use-case is not correctly implemented by the integrating application.

This issue was fixed in version 1.8.463.2.
CVSS v4.0 score: 9.3
CVE-2013-1546 
Unspecified vulnerability in the Oracle FLEXCUBE Direct Banking component in Oracle Financial Services Software 2.8.0 through 3.1.0 and 5.0.2 through 12.0.1 allows local users to affect confidentiality via vectors related to BASE.
CVSS v2.0 score: 1.5
GHSA-2wxv-94xf-vqv2 
The implementation of Cross-Origin Resource Sharing (CORS) in WebKit, as used in Apple Safari before 4.0.4 and Google Chrome before 3.0.195.33, includes certain custom HTTP headers in the OPTIONS request during cross-origin operations with preflight, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via a crafted web page.
GHSA-xvp8-7h22-qmfg 
In JetBrains TeamCity before 2024.12 build credentials allowed unauthorized viewing of projects
CVSS v3.1 score: 4.3
GHSA-vwpw-rfx3-gqfw 
IBM Security Guardium Big Data Intelligence (SonarG) 4.0 stores sensitive information in cleartext within a resource that might be accessible to another control sphere. IBM X-Force ID: 1610141.
CVSS v3.1 score: 7.5
GHSA-vp48-vfcc-j7mg 
Windows Network File System Information Disclosure Vulnerability
CVSS v3.1 score: 5.5
GHSA-5ggr-qxh6-3vcm 
changepassword.cgi in ChangePassword 0.8, when installed setuid, allows local users to execute arbitrary code by modifying the PATH environment variable to point to a malicious "make" program.
GHSA-fxx6-rmp2-pm5r 
The Import any XML or CSV File to WordPress PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.9.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS v3.1 score: 5.5
GHSA-c4pv-cxp6-v96j 
IBM WebSphere Message Broker stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 123777.
CVSS v3.0 score: 5.5
CVE-2022-26077 
A cleartext transmission of sensitive information vulnerability exists in the OAS Engine configuration communications functionality of Open Automation Software OAS Platform V16.00.0112. A targeted network sniffing attack can lead to a disclosure of sensitive information. An attacker can sniff network traffic to trigger this vulnerability.
CVSS v3.1 score: 7.5
PYSEC-2014-80 
Docker before 1.3.1 and docker-py before 0.5.3 fall back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to conduct downgrade attacks and obtain authentication and image data by leveraging a network position between the client and the registry to block HTTPS traffic.
GHSA-2qj2-pgj3-p43w 
Missing Authorization vulnerability in themefusecom Brizy allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Brizy: from n/a through 2.7.12.
CVSS v3.1 score: 4.3
CVE-2025-3489 Nababur Simple-User-Management-System register.php cross site scripting
A vulnerability was found in Nababur Simple-User-Management-System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /register.php. The manipulation of the argument name/username leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 4.3
CVSS v3.0 score: 4.3
CVSS v2.0 score: 5
GHSA-2cpf-rv8p-fqqc 
** DISPUTED **  The encapsulation script mechanism in Webwasher CSM Appliance Suite 5.x uses case-sensitive detection of malicious tokens, which allows attackers to bypass script detection by using tokens that can be upper or lower case.  NOTE: the vendor has stated that this problem could not be reproduced, and has asked the researcher for more information, without a response as of 20060103.
GHSA-x43c-732c-cxf3 
The JobWP – Job Board, Job Listing, Career Page and Recruitment Plugin plugin for WordPress is vulnerable to SQL Injection via the 'jobwp_upload_resume' parameter in all versions up to, and including, 2.3.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS v3.1 score: 7.5
CVE-2026-57705 WordPress Event Tickets plugin <= 5.28.5 - Broken Access Control vulnerability
Missing Authorization vulnerability in Nexcess Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through <= 5.28.5.
CVSS v3.1 score: 7.5
CVE-2017-15907 
SQL injection vulnerability in phpCollab 2.5.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter to newsdesk/newsdesk.php.
CVSS v3.0 score: 9.8
CVSS v2.0 score: 7.5
CVE-2014-5781 
The Bouncy Bill Easter Tales (aka mominis.Generic_Android.Bouncy_Bill_Easter_Tales) application 1.0.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0 score: 5.4
GHSA-f4hq-453j-p95f Open redirect in Slashify
The package is an Express middleware that normalises routes by stripping any final slash, redirecting, for example, `bookings/latest/` to `bookings/latest`. However, it does not validate the path it redirects to in any way. In particular, if the path starts with two slashes (or two backslashes, or a slash and a backslash, etc.) it may redirect to a different domain.Consider the [example from the docs](https://www.npmjs.com/package/slashify#usage). Assume we have run it and started a server on `localhost:3000`, then visiting `localhost:3000///github.com/` redirects you to https://github.com.RecommendationThis vulnerability is currently un-patched in the `slashify` package so there is no known safe version of this package. Discontinuing use of `slashify` is recommended.
CVSS v3.1 score: 6.1
CVE-2025-27109 Lack of Escaping of HTML in JSX Fragments allows for Cross-site Scripting in solid-js
solid-js is a declarative, efficient, and flexible JavaScript library for building user interfaces. In affected versions Inserts/JSX expressions inside illegal inlined JSX fragments lacked escaping, allowing user input to be rendered as HTML when put directly inside JSX fragments. This issue has been addressed in version 1.9.4 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS v3.1 score: 7.3
GHSA-fccf-p8fx-vjj4 Moodle vulnerable to PHP object injection attacks
The Repositories component in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via serialized data associated with an add-on.
CVE-2018-10752 
The Tagregator plugin 0.6 for WordPress has stored XSS via the title field in an Add New action.
CVSS v3.0 score: 4.8
CVSS v2.0 score: 3.5
CVE-2018-16163 
OpenDolphin 2.7.0 and earlier allows authenticated attackers to bypass authentication to create and/or delete other users accounts via unspecified vectors.
CVSS v3.0 score: 6.5
CVSS v2.0 score: 5.5
CVE-2019-11215 
In Combodo iTop 2.2.0 through 2.6.0, if the configuration file is writable, then execution of arbitrary code can be accomplished by calling ajax.dataloader with a maliciously crafted payload. Many conditions can place the configuration file into a writable state: during installation; during upgrade; in certain cases, an error during modification of the file from the web interface leaves the file writable (can be triggered with XSS); a race condition can be triggered by the hub-connector module (community version only from 2.4.1 to 2.6.0); or editing the file in a CLI.
CVSS v3.1 score: 8.1
CVSS v2.0 score: 6.8
CVE-2026-3286 itwanger paicoding Image Save Endpoint ImageRestController.java save server-side request forgery
A vulnerability was identified in itwanger paicoding 1.0.0/1.0.1/1.0.2/1.0.3. The impacted element is the function Save of the file paicoding-web/src/main/java/com/github/paicoding/forum/web/common/image/rest/ImageRestController.java of the component Image Save Endpoint. Such manipulation of the argument img leads to server-side request forgery. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 6.3
CVSS v3.0 score: 6.3
CVSS v2.0 score: 6.5
GHSA-g7c3-8m39-444q 
A BOLA vulnerability in POST /secretaries allows a low privileged user to create a low privileged user (secretary) in the system. This results in unauthorized data manipulation.
CVSS v3.1 score: 7.7
GHSA-9w5m-5829-xj6c 
Microsoft Excel 2000 SP3 through 2003 SP2, Viewer 2003, Compatibility Pack, and Office 2004 and 2008 for Mac allows user-assisted remote attackers to execute arbitrary code via malformed tags in rich text, aka "Excel Rich Text Validation Vulnerability."
CVE-2016-7454 
CSRF vulnerability on Technicolor TC dpc3941T (formerly Cisco dpc3941T) devices with firmware dpc3941-P20-18-v303r20421733-160413a-CMCST allows an attacker to change the Wi-Fi password, open the remote management interface, or reset the router.
CVSS v3.0 score: 8
CVSS v2.0 score: 7.9
GHSA-4wv7-983f-6869 
Deserialization of Untrusted Data vulnerability in yolo 3 allows attackers to execute arbitrary code via crafted yaml file.
CVSS v3.1 score: 7.8
GHSA-v333-7h2p-5fhv ZITADEL has improper HTML sanitization in emails and Console UI
ImpactZITADEL uses HTML for emails and renders certain information such as usernames dynamically. That information can be entered by users or administrators. Due to a missing output sanitization, these emails could include malicious code.
This may potentially lead to a threat where an attacker, without privileges, could send out altered notifications that are part of the registration processes. An attacker could create a malicious link, where the injected code would be rendered as part of the email.During investigation of this issue a related issue was found and mitigated, where on the user's detail page the username was not sanitized and would also render HTML, giving an attacker the same vulnerability.While it was possible to inject HTML including javascript, the execution of such scripts would be prevented by most email clients and the Content Security Policy in Console UI.Patches2.x versions are fixed on >= [2.58.1](https://github.com/zitadel/zitadel/releases/tag/v2.58.1)
2.57.x versions are fixed on >= [2.57.1](https://github.com/zitadel/zitadel/releases/tag/v2.57.1)
2.56.x versions are fixed on >= [2.56.2](https://github.com/zitadel/zitadel/releases/tag/v2.56.2)
2.55.x versions are fixed on >= [2.55.5](https://github.com/zitadel/zitadel/releases/tag/v2.55.5)
2.54.x versions are fixed on >= [2.54.8](https://github.com/zitadel/zitadel/releases/tag/v2.54.8)
2.53.x versions are fixed on >= [2.53.9](https://github.com/zitadel/zitadel/releases/tag/v2.53.9)
2.52.x versions are fixed on >= [2.52.9](https://github.com/zitadel/zitadel/releases/tag/v2.52.3)WorkaroundsThere is no workaround since a patch is already available.QuestionsIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)CreditsThanks to Sushmita Poudel and David Underwood for reporting this.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 4.3
CVE-2024-4245 Tenda i21 formQosManageDouble_user stack-based overflow
A vulnerability, which was classified as critical, has been found in Tenda i21 1.0.0.14(4656). Affected by this issue is the function formQosManageDouble_user. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. The attack may be launched remotely. The identifier of this vulnerability is VDB-262136. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v3.1 score: 8.8
CVSS v3.0 score: 8.8
CVSS v2.0 score: 9
CVE-2026-32924 OpenClaw < 2026.3.12 - Authorization Bypass via Misclassified Reaction Events in Feishu
OpenClaw before 2026.3.12 contains an authorization bypass vulnerability where Feishu reaction events with omitted chat_type are misclassified as p2p conversations instead of group chats. Attackers can exploit this misclassification to bypass groupAllowFrom and requireMention protections in group chat reaction-derived events.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 9.8
CVE-2021-28935 
CMS Made Simple (CMSMS) 2.2.15 allows authenticated XSS via the /admin/addbookmark.php script through the Site Admin > My Preferences > Title field.
CVSS v3.1 score: 5.4
CVSS v2.0 score: 3.5
CVE-2025-7289 IrfanView CADImage Plugin DXF File Parsing Memory Corruption Remote Code Execution Vulnerability
IrfanView CADImage Plugin DXF File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26225.
CVSS v3.0 score: 7.8
GHSA-fw8f-763x-7849 
site/index.php/admin/trees/add/ in BigTree 4.2.22 and earlier allows remote attackers to upload and execute arbitrary PHP code because the BigTreeStorage class in core/inc/bigtree/apis/storage.php does not prevent uploads of .htaccess files.
CVSS v3.0 score: 9.8
CVE-2023-4386 Essential Blocks <= 4.2.0 - Unauthenticated PHP Object Injection via queries
The Essential Blocks plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.2.0 via deserialization of untrusted input in the get_posts function. This allows unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
CVSS v3.1 score: 8.1
GHSA-j94j-6gp3-2xmh 
A vulnerability was identified in HBAI-Ltd Toonflow-app up to 1.1.1. This issue affects the function updateStoryboardUrl of the file replaceUrl.ts of the component Storyboard Export. Such manipulation of the argument url leads to path traversal. It is possible to launch the attack remotely. The exploit is publicly available and might be used. It is still unclear if this vulnerability genuinely exists. The vendor explains in a reply to the issue report, that "[t]he URL of this interface is designed to only be a local address or a trusted domain address configured in docker, and will not contain malicious links, unless the user modifies the code causing unexpected situations."
CVSS v4.0 score: 2.1
CVSS v3.1 score: 4.3
GHSA-jfph-3hpg-2f65 Incorrect Permission Assignment for Critical Resource in ShopXO
ShopXO v2.2.5 and below was discovered to contain a system re-install vulnerability via the Add function in app/install/controller/Index.php.
CVSS v3.1 score: 9.8
GHSA-8r24-mq27-r6cw 
In the Linux kernel, the following vulnerability has been resolved:btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file()If overlay is used on top of btrfs, dentry->d_sb translates to overlay's
super block and fsid assignment will lead to a crash.Use file_inode(file)->i_sb to always get btrfs_sb.
CVSS v3.1 score: 9.1
GHSA-p3x8-9rc9-vgpr 
Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Workflow executes to compromise Oracle Workflow.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Workflow accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Workflow. CVSS 3.1 Base Score 3.6 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L).
CVSS v3.1 score: 3.6
GHSA-mmmr-c45j-v926 
Untrusted search path in the installer for Zoom Rooms for Windows before version 7.0.0 may allow an authenticated user to enable an escalation of privilege via local access.
CVSS v3.1 score: 7.8
GHSA-9cxw-46fx-vr62 
Rejected reason: Not used
GHSA-fgmc-62v2-rcx5 
Uncontrolled search path element in the HotKey Services for some Intel(R) NUC P14E Laptop Element software for Windows 10 before version 1.1.44 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS v3.1 score: 6.7
CVE-2014-5676 
The Township (aka com.playrix.township) application 1.5.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0 score: 5.4
GHSA-w73f-r889-xrx8 
AFP Server in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon restart) via crafted reconnect authentication packets.
CVE-2026-40723 WordPress Bricks Builder theme <= 2.1.4 - Broken Access Control vulnerability
Subscriber Broken Access Control in Bricks Builder <= 2.1.4 versions.
CVSS v3.1 score: 4.3
CVE-2021-44838 
An issue was discovered in Delta RM 1.2. Using the /risque/risque/ajax-details endpoint, with a POST request indicating the risk to access with the id parameter, it is possible for users to access risks of other companies.
CVSS v3.1 score: 4.3
CVSS v2.0 score: 5
CVE-2007-2796 
Arris Cadant C3 CMTS allows remote attackers to cause a denial of service (service termination) via a malformed IP packet with an invalid IP option.
CVSS v2.0 score: 7.8
ICSA-24-256-11 Siemens Industrial Edge Management
Affected components do not properly validate the device tokens. This could allow an unauthenticated remote attacker to impersonate other devices onboarded to the system.
CVSS v3.1 score: 10
GHSA-44p4-8hp3-824h 
Cross-site scripting (XSS) vulnerability in the Comment Attachment plugin 1.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the "Attachment field title."
GHSA-58f3-gjmv-9j5x 
In startRanging of RttServiceImpl.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-194798757
CVE-2020-36221 
An integer underflow was discovered in OpenLDAP before 2.4.57 leading to slapd crashes in the Certificate Exact Assertion processing, resulting in denial of service (schema_init.c serialNumberAndIssuerCheck).
CVSS v3.1 score: 7.5
CVSS v2.0 score: 5
CVE-2025-5509 quequnlong shiyi-blog upload path traversal
A vulnerability classified as critical has been found in quequnlong shiyi-blog up to 1.2.1. This affects an unknown part of the file /api/file/upload. The manipulation of the argument file/source leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 6.3
CVSS v3.0 score: 6.3
CVSS v2.0 score: 6.5
GHSA-8crr-xf35-5f5p Jenkins Job Import Plugin CSRF vulnerability
A data modification vulnerability exists in Jenkins Job Import Plugin 3.0 and earlier in JobImportAction.java that allows attackers to copy jobs from a preconfigured other Jenkins instance, potentially installing additional plugins necessary to load the imported job's configuration.
CVSS v3.0 score: 5.3
CVE-2026-67289 FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection
FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and, when the client connects through an HTTP proxy, is written directly into the proxy CONNECT request line and Host header by http_proxy_connect() without filtering. A malicious or compromised RDP server can send a crafted redirection PDU containing embedded control characters to inject arbitrary headers/requests into the HTTP proxy CONNECT request.
CVSS v4.0 score: 9.3
CVSS v3.1 score: 9.8
RHSA-2025:15699 Red Hat Security Advisory: mysql-selinux and mysql8.4 security update
mysql: Parser unspecified vulnerability (CPU Apr 2025) mysql: Parser unspecified vulnerability (CPU Apr 2025) mysql: InnoDB unspecified vulnerability (CPU Apr 2025) mysql: Options unspecified vulnerability (CPU Apr 2025) mysql: DML unspecified vulnerability (CPU Apr 2025) mysql: Optimizer unspecified vulnerability (CPU Apr 2025) mysql: DDL unspecified vulnerability (CPU Apr 2025) mysql: Optimizer unspecified vulnerability (CPU Apr 2025) mysql: DML unspecified vulnerability (CPU Apr 2025) mysql: Replication unspecified vulnerability (CPU Apr 2025) mysql: Optimizer unspecified vulnerability (CPU Apr 2025) mysql: Replication unspecified vulnerability (CPU Apr 2025) mysql: Replication unspecified vulnerability (CPU Apr 2025) mysql: Replication unspecified vulnerability (CPU Apr 2025) mysql: Optimizer unspecified vulnerability (CPU Apr 2025) mysql: Optimizer unspecified vulnerability (CPU Apr 2025) mysql: Optimizer unspecified vulnerability (CPU Apr 2025) mysql: mariadb: InnoDB unspecified vulnerability (CPU Apr 2025) mysql: InnoDB unspecified vulnerability (CPU Apr 2025) mysql: PS unspecified vulnerability (CPU Apr 2025) mysql: Stored Procedure unspecified vulnerability (CPU Apr 2025) mysql: InnoDB unspecified vulnerability (CPU Apr 2025) mysql: Components Services unspecified vulnerability (CPU Apr 2025) mysql: PS unspecified vulnerability (CPU Apr 2025) mysql: Components Services unspecified vulnerability (CPU Apr 2025) mysql: UDF unspecified vulnerability (CPU Apr 2025) mysql: mariadb: mysqldump unspecified vulnerability (CPU Apr 2025) mysql: InnoDB unspecified vulnerability (CPU Jul 2025) mysql: DML unspecified vulnerability (CPU Jul 2025) mysql: Optimizer unspecified vulnerability (CPU Jul 2025) mysql: Stored Procedure unspecified vulnerability (CPU Jul 2025) mysql: mysqldump unspecified vulnerability (CPU Jul 2025) mysql: Optimizer unspecified vulnerability (CPU Jul 2025) mysql: Optimizer unspecified vulnerability (CPU Jul 2025) mysql: Optimizer unspecified vulnerability (CPU Jul 2025) mysql: InnoDB unspecified vulnerability (CPU Jul 2025) mysql: Components Services unspecified vulnerability (CPU Jul 2025) mysql: Optimizer unspecified vulnerability (CPU Jul 2025) mysql: InnoDB unspecified vulnerability (CPU Jul 2025) mysql: Optimizer unspecified vulnerability (CPU Jul 2025) mysql: InnoDB unspecified vulnerability (CPU Jul 2025) mysql: DDL unspecified vulnerability (CPU Jul 2025) mysql: DDL unspecified vulnerability (CPU Jul 2025) mysql: InnoDB unspecified vulnerability (CPU Jul 2025) mysql: Encryption unspecified vulnerability (CPU Jul 2025) mysql: Optimizer  unspecified vulnerability (CPU Jul 2025) mysql: InnoDB unspecified vulnerability (CPU Jul 2025) mysql: Thread Pooling unspecified vulnerability (CPU Jul 2025) mysql: Optimizer unspecified vulnerability (CPU Jul 2025) mysql: Optimizer unspecified vulnerability (CPU Jul 2025) mysql: DDL unspecified vulnerability (CPU Jul 2025)
CVSS v3.1 score: 2.7
CVE-2012-1622 
Apache OFBiz 10.04.x before 10.04.02 allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS v3.0 score: 9.8
CVSS v2.0 score: 7.5
GHSA-m9cp-8h53-758g 
vmware-authd (aka the Authorization process) in VMware Workstation 10.x before 10.0.5, VMware Player 6.x before 6.0.5, and VMware ESXi 5.0 through 5.5 allows attackers to cause a host OS denial of service via unspecified vectors.
GHSA-4fgw-ccjj-q53m 
HPE has identified a remote access to sensitive information vulnerability in HPE Network Function Virtualization Director (NFVD) 4.2.1 prior to gui patch 3.
CVSS v3.0 score: 4.3
GHSA-22v9-p596-vfhg 
Midnight Commander (mc) 4.5.51 and earlier does not properly process malformed directory names when a user opens a directory, which allows other local users to gain privileges by creating directories that contain special characters followed by the commands to be executed.
CVE-2013-5971 
Session fixation vulnerability in the vSphere Web Client Server in VMware vCenter Server 5.0 before Update 3 allows remote attackers to hijack web sessions and gain privileges via unspecified vectors.
CVSS v2.0 score: 6.8
CVE-2021-21608 
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape button labels in the Jenkins UI, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with the ability to control button labels.
CVSS v3.1 score: 5.4
CVSS v2.0 score: 3.5
GHSA-gq3q-5vrm-rgm7 
In the Linux kernel, the following vulnerability has been resolved:ASoC: sti: use managed regmap_field allocationsThe regmap_field objects allocated at player init are never freed and
may leak resources if the driver is removed.Switch to devm_regmap_field_alloc() to automatically limit the lifetime
of the allocations the lifetime of the device.
CVSS v3.1 score: 5.5
GHSA-6q8j-5hgw-vrf9 
A flaw has been found in Tenda F456 1.0.0.5. Affected by this vulnerability is the function formWrlExtraSet of the file /goform/WrlExtraSet of the component httpd. Executing a manipulation of the argument Go can lead to buffer overflow. The attack can be executed remotely. The exploit has been published and may be used.
CVSS v4.0 score: 7.4
CVSS v3.1 score: 8.8
CVE-2025-12893 Improper Certificate Validation May Allow Successful TLS Handshaking Despite Invalid Extended Key Usage Fields in MongoDB Server
Clients may successfully perform a TLS handshake with a MongoDB server despite presenting a client certificate not aligning with the documented Extended Key Usage (EKU) requirements. A certificate that specifies extendedKeyUsage but is missing extendedKeyUsage = clientAuth may still be successfully authenticated via the TLS handshake as a client. This issue is specific to MongoDB servers running on Windows or Apple as the expected validation behavior functions correctly on Linux systems.

Additionally, MongoDB servers may successfully establish egress TLS connections with servers that present server certificates not aligning with the documented Extended Key Usage (EKU) requirements. A certificate that specifies extendedKeyUsage but is missing extendedKeyUsage = serverAuth may still be successfully authenticated via the TLS handshake as a server. This issue is specific to MongoDB servers running on Apple as the expected validation behavior functions correctly on both Linux and Windows systems. 

This vulnerability affects MongoDB Server v7.0 versions prior to 7.0.26, MongoDB Server v8.0 versions prior to 8.0.16 and MongoDB Server v8.2 versions prior to 8.2.2
CVSS v4.0 score: 2.3
CVSS v3.1 score: 4.2
GHSA-5828-r584-frv5 
Rejected reason: Not used
GHSA-63cm-3458-95cr 
In the Linux kernel, the following vulnerability has been resolved:tipc: wait and exit until all work queues are doneOn some host, a crash could be triggered simply by repeating these
commands several times:modprobe tipctipc bearer enable media udp name UDP1 localip 127.0.0.1rmmod tipc[] BUG: unable to handle kernel paging request at ffffffffc096bb00
  [] Workqueue: events 0xffffffffc096bb00
  [] Call Trace:
  []  ? process_one_work+0x1a7/0x360
  []  ? worker_thread+0x30/0x390
  []  ? create_worker+0x1a0/0x1a0
  []  ? kthread+0x116/0x130
  []  ? kthread_flush_work_fn+0x10/0x10
  []  ? ret_from_fork+0x35/0x40When removing the TIPC module, the UDP tunnel sock will be delayed to
release in a work queue as sock_release() can't be done in rtnl_lock().
If the work queue is schedule to run after the TIPC module is removed,
kernel will crash as the work queue function cleanup_beareri() code no
longer exists when trying to invoke it.To fix it, this patch introduce a member wq_count in tipc_net to track
the numbers of work queues in schedule, and  wait and exit until all
work queues are done in tipc_exit_net().
CVSS v3.1 score: 5.5
GHSA-h6hv-v4xc-8xxh 
The easy-fancybox plugin before 1.8.18 for WordPress (aka Easy FancyBox) is susceptible to Stored XSS in the Settings Menu inc/class-easyfancybox.php due to improper encoding of arbitrarily submitted settings parameters. This occurs because there is no inline styles output filter.
CVSS v3.1 score: 4.8
CVE-2005-4614 
Multiple SQL injection vulnerabilities in digiSHOP 3.1.17 and earlier allow remote attackers to execute arbitrary SQL commands or obtain the full installation path via (1) the c parameter in cart.php and (2) unspecified search module parameters.
CVSS v2.0 score: 7.5
GHSA-m776-2hwc-9x9m 
A vulnerability in the connection-handling mechanism of Cisco Crosswork Network Controller (CNC) and Cisco Network Services Orchestrator (NSO) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected system.This vulnerability is due to an inadequate implementation of rate-limiting on incoming network connections. An attacker could exploit this vulnerability by sending a large number of connection requests to an affected system. A successful exploit could allow the attacker to exhaust available connection resources, causing Cisco CNC and Cisco NSO to become unresponsive and resulting in a DoS condition for legitimate users and dependent services. A manual reboot of the system is required to recover from this condition.
CVSS v3.1 score: 7.5
CVE-2024-38314 IBM Maximo Application Suite - Monitor Component information disclosure
IBM Maximo Application Suite - Monitor Component 8.10, 8.11, and 9.0 could disclose information in the form of the hard-coded cryptographic key to an attacker that has compromised environment.
CVSS v3.1 score: 5.9
GHSA-qhqr-659q-mhg7 
In the Linux kernel, the following vulnerability has been resolved:mount: handle NULL values in mnt_ns_release()When calling in listmount() mnt_ns_release() may be passed a NULL
pointer. Handle that case gracefully.
GHSA-x7p4-m95h-xjv4 
An Improper Certificate Validation could allow a malicious actor with access to an adjacent network to take control of the system.Affected Products:UniFi Connect Application (Version 3.7.9 and earlier)UniFi Connect EV Station (Version 1.1.18 and earlier)UniFi Connect EV Station Pro (Version 1.1.18 and earlier)UniFi Connect Display (Version 1.9.324 and earlier)UniFi Connect Display Cast (Version 1.6.225 and earlier)Mitigation:Update UniFi Connect Application to Version 3.10.7 or later.Update UniFi Connect EV Station to Version 1.2.15 or later.Update UniFi Connect EV Station Pro to Version 1.2.15 or later.Update UniFi Connect Display to Version 1.11.348 or later.Update UniFi Connect Display Cast to Version 1.8.255 or later.
CVSS v3.0 score: 7.5
CVE-2020-14873 
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Logging). Supported versions that are affected are 8.0.21 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS v3.1 score: 4.4
GHSA-6rmp-2hgm-cprx 
Sonatype Nexus Repository Manager OSS/Pro before 3.26.0 has Incorrect Access Control.
CVSS v3.1 score: 7.5
GHSA-fpc5-7ggr-6536 
An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
CVSS v3.0 score: 8.8
GHSA-9gjh-5rhx-x686 
Cross-Site Request Forgery (CSRF) vulnerability in AboZain Albanna Customize Login Page allows Cross Site Request Forgery. This issue affects Customize Login Page: from n/a through 1.1.
CVSS v3.1 score: 4.3
GHSA-hxxg-433j-m5fg 
Unknown vulnerability in IBM Websphere Application Server 5.0, 5.1, and 6.0 when running on Windows, allows remote attackers to obtain the source code for Java Server Pages (.jsp) via a crafted URL that causes the page to be processed by the file serving servlet instead of the JSP engine.
GHSA-qp5v-h8qw-wpmh 
Improper Access Control vulnerability in Themeisle PPOM for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PPOM for WooCommerce: from n/a through 33.0.18.
CVSS v3.1 score: 6.5
CVE-2025-21490 
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and  9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS v3.1 score: 4.9
CVE-2008-0799 
SQL injection vulnerability in index.php in the Quiz (com_quiz) 0.81 and earlier component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the tid parameter in a user_tst_shw action.
CVSS v2.0 score: 7.5
RHSA-2010:0861 Red Hat Security Advisory: firefox security update
Mozilla miscellaneous memory safety hazards Mozilla miscellaneous memory safety hazards Mozilla XSS in gopher parser when parsing hrefs Mozilla cross-site information disclosure via modal calls Mozilla buffer overflow and memory corruption using document.write Mozilla use-after-free error in nsBarProp Mozilla unsafe library loading flaw Mozilla dangling pointer vulnerability in LookupGetterOrSetter Firefox race condition flaw (MFSA 2010-73)
GHSA-5x5x-c9q8-x83f 
The multiplayer engine in Wesnoth 1.2.x before 1.2.7 and 1.3.x before 1.3.9 allows remote servers to cause a denial of service (crash) via a long message with multibyte characters that can produce an invalid UTF-8 string after it is truncated, which triggers an uncaught exception, involving the truncate_message function in server/server.cpp.  NOTE: this issue affects both clients and servers.
GHSA-jmmv-6pvw-x59r 
Memory Corruption in Audio while playing amrwbplus clips with modified content.
CVSS v3.1 score: 8.4
GHSA-fgj7-39v4-xhp5 
Inappropriate implementation in Blink in Google Chrome on Android prior to 144.0.7559.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: High)
CVSS v3.1 score: 5.4
RHSA-2025:16099 Red Hat Security Advisory: postgresql security update
postgresql: PostgreSQL code execution in restore operation
CVSS v3.1 score: 8.8
CVE-2007-2325 
PHP remote file inclusion vulnerability in include.php in MyNewsGroups :) allows remote attackers to execute arbitrary PHP code via a URL in the myng_root parameter.
CVSS v2.0 score: 10
CVE-2023-25797 WordPress vSlider Multi Image Slider for WordPress Plugin <= 4.1.2 is vulnerable to Cross Site Scripting (XSS)
Auth. Stored Cross-Site Scripting (XSS) vulnerability in Mr.Vibe vSlider Multi Image Slider for WordPress plugin <= 4.1.2 versions.
CVSS v3.1 score: 5.9
CVE-2022-31551 
The pleomax00/flask-mongo-skel repository through 2012-11-01 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVSS v3.1 score: 9.3
CVSS v2.0 score: 6.4
CVE-2026-9791 Keycloak-rhel9: organization data leak after feature disabled in keycloak
A flaw was found in Keycloak. An authenticated user with existing organization membership can exploit this flaw by accessing user-facing APIs, such as the account API or by requesting an OpenID Connect (OIDC) token with the 'organization' scope. This allows organization metadata to be disclosed in tokens, even after an administrator has explicitly disabled the Organizations feature, potentially leading to incorrect authorization decisions by resource servers.
CVSS v3.1 score: 4.3
GHSA-9jq2-jvwc-p52f Contao core SQL Injection Vulnerability
Contao core prior to 2.11.4 has a SQL injection vulnerability in `contao-2.11.3\system\modules\backend\Ajax.php`
CVSS v3.1 score: 8.8
RHSA-2023:2532 Red Hat Security Advisory: libarchive security update
libarchive: NULL pointer dereference in archive_write.c
CVSS v3.1 score: 5.9
CVE-2026-3099 Libsoup: libsoup: authentication bypass via digest authentication replay attack
A flaw was found in Libsoup. The server-side digest authentication implementation in the SoupAuthDomainDigest class does not properly track issued nonces or enforce the required incrementing nonce-count (nc) attribute. This vulnerability allows a remote attacker to capture a single valid authentication header and replay it repeatedly. Consequently, the attacker can bypass authentication and gain unauthorized access to protected resources, impersonating the legitimate user.
CVSS v3.1 score: 5.8
RHSA-2025:15700 Red Hat Security Advisory: cups security update
cups: Authentication Bypass in CUPS Authorization Handling cups: Null Pointer Dereference in CUPS ipp_read_io() Leading to Remote DoS
CVSS v3.1 score: 6.5
GHSA-3wfw-pwxc-r3x9 
Ghidra versions prior to 12.0.3 improperly process annotation directives embedded in automatically extracted binary data, resulting in arbitrary command execution when an analyst interacts with the UI. Specifically, the @execute annotation (which is intended for trusted, user-authored comments) is also parsed in comments generated during auto-analysis (such as CFStrings in Mach-O binaries). This allows a crafted binary to present seemingly benign clickable text which, when clicked, executes attacker-controlled commands on the analyst’s machine.
CVSS v3.1 score: 8.8
GHSA-wq97-r6xw-c5c9 
Execution with unnecessary privileges in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.
CVSS v3.1 score: 9.1
GHSA-cx26-p6xx-w7v5 
A crafted HTTP packet with a -1 content-length header can create a denial-of-service condition in Softing Secure Integration Server V1.22.
CVSS v3.1 score: 7.5
GHSA-3jgg-vqj7-2c3r 
Puppet Module Tool (PMT), as used in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, installs modules with weak permissions if those permissions were used when the modules were originally built, which might allow local users to read or modify those modules depending on the original permissions.
CVE-2023-49157 WordPress Multiple Post Passwords Plugin <= 1.1.1 is vulnerable to Cross Site Scripting (XSS)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Andreas Münch Multiple Post Passwords allows Stored XSS.This issue affects Multiple Post Passwords: from n/a through 1.1.1.
CVSS v3.1 score: 5.9
CVE-2023-1295 Privilege escalation with IO_RING_OP_CLOSE in the Linux Kernel
A time-of-check to time-of-use issue exists in io_uring subsystem's IORING_OP_CLOSE operation in the Linux kernel's versions 5.6 - 5.11 (inclusive), which allows a local user to elevate their privileges to root. Introduced in b5dba59e0cf7e2cc4d3b3b1ac5fe81ddf21959eb, patched in 9eac1904d3364254d622bf2c771c4f85cd435fc2, backported to stable in 788d0824269bef539fe31a785b1517882eafed93.
CVSS v3.1 score: 7.8
CVE-2019-20677 
Certain NETGEAR devices are affected by stored XSS. This affects RBR50 before 2.3.5.30, RBS50 before 2.3.5.30, and RBK50 before 2.3.5.30.
CVSS v3.0 score: 6
GHSA-7765-586w-22wh 
Cross-Site Request Forgery (CSRF) vulnerability in Helmut Wandl Advanced Settings allows Cross Site Request Forgery. This issue affects Advanced Settings: from n/a through 3.1.1.
CVSS v3.1 score: 4.3
GHSA-7x79-jxc8-j9v6 
Microsoft Internet Explorer 6 SP2 (6.0.2900.2180) crashes when the user attempts to add a URI to the restricted zone, in which the full domain name of the URI begins with numeric sequences similar to an IP address.  NOTE: if there is not an exploit scenario in which an attacker can trigger this behavior, then perhaps this issue should not be included in CVE.
GHSA-xmv7-64fr-2r3x 
CWE-20: Improper Input Validation vulnerability exists that could cause Denial of Service when an
authenticated malicious user sends special malformed HTTPS request containing improper formatted body
data to the controller.
CVSS v4.0 score: 7.1
CVSS v3.1 score: 6.5
CVE-2001-0965 
glFTPD 1.23 allows remote attackers to cause a denial of service (CPU consumption) via a LIST command with an argument that contains a large number of * (asterisk) characters.
CVSS v2.0 score: 5
CVE-2026-32680 
The installer of RATOC RAID Monitoring Manager for Windows allows to customize the installation folder. If the installation folder is customized to some non-default one, the folder may be left with un-secure ACLs and non-administrative users can alter contents of that folder. It may allow a non-administrative user to execute an arbitrary code with SYSTEM privilege.
CVSS v4.0 score: 8.5
CVSS v3.0 score: 7.8
CVE-2006-2966 
Cross-site scripting (XSS) vulnerability in Particle Soft Particle Wiki 1.0.2 allows remote attackers to inject arbitrary web script or HTML via a BR element with an extraneous IMG tag and a STYLE attribute that contains "/**/" comment sequences, which bypasses the XSS protection scheme.
CVSS v2.0 score: 4.3
CVE-2022-36506 
H3C Magic NX18 Plus NX18PV100R003 was discovered to contain a stack overflow via the function SetMacAccessMode.
CVSS v3.1 score: 7.8