CIRCL/vulnerability-scores huggingface dataset:
GHSA-pvx8-88xj-9px8 
Cross-site scripting (XSS) vulnerability in httpd on ASUS RT-N56U, RT-N66U, RT-AC66U, RT-N66R, RT-AC66R, RT-AC68U, RT-AC68R, RT-N66W, RT-AC66W, RT-AC87R, RT-AC87U, RT-AC51U, RT-AC68P, RT-N11P, RT-N12+, RT-N12E B1, RT-AC3200, RT-AC53U, RT-AC1750, RT-AC1900P, RT-N300, and RT-AC750 routers with firmware before 3.0.0.4.380.7378; RT-AC68W routers with firmware before 3.0.0.4.380.7266; and RT-N600, RT-N12+ B1, RT-N11P B1, RT-N12VP B1, RT-N12E C1, RT-N300 B1, and RT-N12+ Pro routers with firmware before 3.0.0.4.380.9488 allows remote attackers to inject arbitrary JavaScript by requesting filenames longer than 50 characters.
CVSS v3.0 score: 6.1
GHSA-2gj8-f8hj-pwwh 
Use after free in Input in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
CVSS v3.1 score: 8.3
GHSA-r8qv-p7w3-rj99 
Windows Graphics Component Remote Code Execution Vulnerability
CVSS v3.1 score: 7.8
PYSEC-2018-15 
An issue was discovered in Mayan EDMS before 3.0.3. The Tags app has XSS because tag label values are mishandled.
RHSA-2014:1039 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.0 security update
RESTEasy: XXE via parameter entities
CVE-2023-32700 
LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an untrusted source. This occurs because luatex-core.lua lets the original io.popen be accessed. This also affects TeX Live before 2023 r66984 and MiKTeX before 23.5.
CVSS v3.1 score: 8.8
RHSA-2021:2104 Red Hat Security Advisory: rh-ruby25-ruby security, bug fix, and enhancement update
ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication ruby: HTTP response splitting in WEBrick ruby: Code injection via command argument of Shell#test / Shell#[] rubygem-json: Unsafe object creation vulnerability in JSON ruby: BasicSocket#read_nonblock method leads to information disclosure ruby: Potential HTTP request smuggling in WEBrick ruby: XML round-trip vulnerability in REXML
CVSS v3.1 score: 7.5
CVSS v3.0 score: 7.5
CVE-2016-8361 
An issue was discovered in Lynxspring JENEsys BAS Bridge versions 1.1.8 and older. The application uses a hard-coded username with no password allowing an attacker into the system without authentication.
CVSS v3.0 score: 8.6
CVSS v2.0 score: 7.5
CVE-2018-9083 System Management Module Vulnerabilities
In System Management Module (SMM) versions prior to 1.06, the SMM contains weak default root credentials which could be used to log in to the device OS -- if the attacker manages to enable SSH or Telnet connections via some other vulnerability.
CVSS v3.0 score: 8.1
CVSS v2.0 score: 9.3
GHSA-qcrm-3jcv-ppvq 
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of multiple D-Link routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the lighttpd service, which listens on TCP port 80 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-13796.
CVSS v3.1 score: 8.8
GHSA-pxvg-5jqv-9c83 
The Publish approval plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on the publish_save_option function. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS v3.1 score: 5.3
GHSA-x2x3-cmvw-67w8 
In the Linux kernel, the following vulnerability has been resolved:gfs2: prevent NULL pointer dereference during unmountWhen flushing out outstanding glock work during an unmount, gfs2_log_flush()
can be called when sdp->sd_jdesc has already been deallocated and sdp->sd_jdesc
is NULL.  Commit 35264909e9d1 ("gfs2: Fix NULL pointer dereference in
gfs2_log_flush") added a check for that to gfs2_log_flush() itself, but it
missed the sdp->sd_jdesc dereference in gfs2_log_release().  Fix that.
CVSS v3.1 score: 5.5
GHSA-44mv-5x85-99g4 
SQL injection vulnerability in OpenScape Deployment Service (DLS) before 6.x and 7.x before R1.11.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS v3.0 score: 9.8
CVE-2024-24623 Softaculous Webuzo FTP Management Command Injection
Softaculous Webuzo contains a command injection vulnerability in the FTP management functionality. A remote, authenticated attacker can exploit this vulnerability to gain code execution on the system.
CVSS v3.1 score: 8.8
CVSS v2.0 score: 9
CVE-2024-53480 
Phpgurukul's Beauty Parlour Management System v1.1 is vulnerable to SQL Injection in `login.php` via the `emailcont` parameter.
CVSS v3.1 score: 9.8
CVE-2016-11057 
Certain NETGEAR devices are affected by mishandling of repeated URL calls. This affects JNR1010v2 before 2017-01-06, WNR614 before 2017-01-06, WNR618 before 2017-01-06, JWNR2000v5 before 2017-01-06, WNR2020 before 2017-01-06, JWNR2010v5 before 2017-01-06, WNR1000v4 before 2017-01-06, WNR2020v2 before 2017-01-06, R6220 before 2017-01-06, and WNDR3700v5 before 2017-01-06.
CVSS v3.1 score: 7.5
CVSS v2.0 score: 5
GHSA-6vfg-grh2-77vv 
HEVC Video Extensions Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31947, CVE-2021-33775, CVE-2021-33776, CVE-2021-33778.
CVSS v3.1 score: 7.8
CVE-2020-9817 
A permissions issue existed. This issue was addressed with improved permission validation. This issue is fixed in macOS Catalina 10.15.5. A malicious application may be able to gain root privileges.
CVSS v3.1 score: 7.8
CVSS v2.0 score: 9.3
CVE-2026-42168 
django-pyas2 through 1.2.3 is vulnerable to OS command injection via the cmd_receive and cmd_send fields on the Partner model. These fields are passed directly to os.system() in pyas2/utils.py without sanitization, allowing an authenticated admin user to execute arbitrary commands on the server when an AS2 message is received or sent.
CVSS v3.1 score: 9.1
CVE-2025-58215 WordPress Ziston Theme < 1.4.5 - Local File Inclusion Vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Ziston ziston allows PHP Local File Inclusion.This issue affects Ziston: from n/a through < 1.4.5.
CVSS v3.1 score: 8.1
ICSA-24-058-01 Mitsubishi Electric Multiple Factory Automation Products (Update A)
In Mitsubishi Electric multiple FA products there is a denial-of-service (DoS) vulnerability that exists in the Ethernet function. A remote attacker could cause a temporary denial-of-service (DoS) condition for a certain period of time in the product's Ethernet communication by performing a TCP SYN Flood attack.
CVSS v3.1 score: 5.3
GHSA-46q9-xg35-6h5q 
In multiple locations, there is a possible way for an application on a work profile to set the main user's default NFC payment setting due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1 score: 7.8
GHSA-cwwr-cv2h-5hmx 
Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an unauthorized attacker to disclose information over a network.
CVSS v3.1 score: 6.5
CVE-2022-49990 s390: fix double free of GS and RI CBs on fork() failure
In the Linux kernel, the following vulnerability has been resolved:

s390: fix double free of GS and RI CBs on fork() failure

The pointers for guarded storage and runtime instrumentation control
blocks are stored in the thread_struct of the associated task. These
pointers are initially copied on fork() via arch_dup_task_struct()
and then cleared via copy_thread() before fork() returns. If fork()
happens to fail after the initial task dup and before copy_thread(),
the newly allocated task and associated thread_struct memory are
freed via free_task() -> arch_release_task_struct(). This results in
a double free of the guarded storage and runtime info structs
because the fields in the failed task still refer to memory
associated with the source task.

This problem can manifest as a BUG_ON() in set_freepointer() (with
CONFIG_SLAB_FREELIST_HARDENED enabled) or KASAN splat (if enabled)
when running trinity syscall fuzz tests on s390x. To avoid this
problem, clear the associated pointer fields in
arch_dup_task_struct() immediately after the new task is copied.
Note that the RI flag is still cleared in copy_thread() because it
resides in thread stack memory and that is where stack info is
copied.
CVSS v3.1 score: 7.8
GHSA-2ggv-mm3c-gqxm 
72crm 9.0 has an Arbitrary file upload vulnerability.
CVSS v3.1 score: 9.8
CVE-2019-3871 
A vulnerability was found in PowerDNS Authoritative Server before 4.0.7 and before 4.1.7. An insufficient validation of data coming from the user when building a HTTP request from a DNS query in the HTTP Connector of the Remote backend, allowing a remote user to cause a denial of service by making the server connect to an invalid endpoint, or possibly information disclosure by making the server connect to an internal endpoint and somehow extracting meaningful information about the response
CVSS v3.0 score: 6.5
GHSA-xp97-6w7r-4cjc OpenStack Keystone token expiration issues
OpenStack Keystone before 2012.1.1, as used in OpenStack Folsom before Folsom-1 and OpenStack Essex, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by (1) creating new tokens through token chaining, (2) leveraging possession of a token for a disabled user account, or (3) leveraging possession of a token for an account with a changed password.
GHSA-66c7-2f58-rwhj 
Unused authorization codes issued to deleted users are not being properly invalidated or removed from the system. This allows for the persistence of these codes, enabling them to be potentially reused.If an attacker possesses both the authorization code and the associated client credentials (client ID and client secret), they can leverage these unused codes to obtain access tokens on behalf of users who have already been deleted. This may lead to unauthorized access to sensitive resources and services, contingent on the scopes originally authorized for the compromised authorization code.
CVSS v3.1 score: 4.9
GHSA-qfgh-5h7f-2r9r 
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formReflashClientTbl.
CVSS v3.1 score: 9.8
GHSA-73h7-c2xm-9mrv 
A flaw was found in chrony versions before 3.5.1 when creating the PID file under the /var/run/chrony folder. The file is created during chronyd startup while still running as the root user, and when it's opened for writing, chronyd does not check for an existing symbolic link with the same file name. This flaw allows an attacker with privileged access to create a symlink with the default PID file name pointing to any destination file in the system, resulting in data loss and a denial of service due to the path traversal.
CVSS v3.1 score: 6
CVE-2024-8309 SQL Injection in langchain-ai/langchain
A vulnerability in the GraphCypherQAChain class of langchain-ai/langchain version 0.2.5 allows for SQL injection through prompt injection. This vulnerability can lead to unauthorized data manipulation, data exfiltration, denial of service (DoS) by deleting all data, breaches in multi-tenant security environments, and data integrity issues. Attackers can create, update, or delete nodes and relationships without proper authorization, extract sensitive data, disrupt services, access data across different tenants, and compromise the integrity of the database.
CVSS v3.0 score: 4.9
GHSA-7prj-9ccr-hr3q Sylius has potential Cross Site Scripting vulnerability via the "Province" field in the Checkout and Address Book
ImpactThere is a possibility to save XSS code in province field in the Checkout and Address Book and then execute it on these pages. The problem occurs when you open the address step page in the checkout or edit the address in the address book. This only affects the base UI Shop provided by Sylius.PatchesThe issue is fixed in versions: 1.9.12, 1.10.16, 1.11.17, 1.12.16, 1.13.1 and above.WorkaroundsCreate new file `assets/shop/sylius-province-field.js`:Add new import in `assets/shop/entry.js`:If you're using Gulp, update your `gulpfile.babel.js`:Rebuild your assets:AcknowledgementsThis security issue has been reported by @r2tunes, thank you!ReferencesThe original advisory: https://github.com/advisories/GHSA-mw82-6m2g-qh6cFor more informationIf you have any questions or comments about this advisory:Open an issue in [Sylius issues](https://github.com/Sylius/Sylius/issues)Email us at security@sylius.com
CVE-2016-9409 
Cross-site scripting (XSS) vulnerability in the Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vectors involving pruning logs.
CVSS v3.0 score: 6.1
CVSS v2.0 score: 4.3
GHSA-gmvh-96pj-qpf9 
The BGP implementation in Cisco IOS 15.2, IOS XE 3.5.xS before 3.5.2S, and IOS XR 4.1.0 through 4.2.2 allows remote attackers to cause a denial of service (multiple connection resets) by leveraging a peer relationship and sending a malformed attribute, aka Bug IDs CSCtt35379, CSCty58300, CSCtz63248, and CSCtz62914.
CVE-2026-11158 
Insufficient validation of untrusted input in Downloads in Google Chrome on Mac prior to 149.0.7827.53 allowed a local attacker to potentially perform a sandbox escape via a crafted AppleScript command. (Chromium security severity: Medium)
CVSS v3.1 score: 8.6
CVE-2025-32887 
An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. A command channel includes the next hop. which can be intercepted and used to break frequency hopping.
CVSS v3.1 score: 7.1
GHSA-2f39-5mgp-fmmr 
Missing Authorization vulnerability in quomodosoft QS Dark Mode allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects QS Dark Mode: from n/a through 3.0.
CVSS v3.1 score: 5.4
GHSA-4wc3-5228-fw2c 
Rejected reason: Not used
CVE-2024-57549 
CMSimple 5.16 allows the user to read cms source code through manipulation of the file name in the file parameter of a GET request.
CVSS v3.1 score: 7.5
CVE-2025-57977 WordPress Flexible PDF Invoices for WooCommerce & WordPress Plugin <= 6.0.13 - Cross Site Request Forgery (CSRF) Vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in wpdesk Flexible PDF Invoices for WooCommerce & WordPress flexible-invoices allows Cross Site Request Forgery.This issue affects Flexible PDF Invoices for WooCommerce & WordPress: from n/a through <= 6.0.13.
CVSS v3.1 score: 7.1
CVE-2025-10186 WhyDonate – FREE Donate button – Crowdfunding – Fundraising <= 4.0.15 - Missing Authorization to Unauthenticated wp_wdplugin_style Rww Deletion
The WhyDonate – FREE Donate button – Crowdfunding – Fundraising plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the remove_row function in all versions up to, and including, 4.0.15. This makes it possible for unauthenticated attackers to delete rows from the wp_wdplugin_style table.
CVSS v3.1 score: 5.3
GHSA-c3qx-9jfj-8c4p 
In the Linux kernel, the following vulnerability has been resolved:tracing/user_events: Fix use-after-free in user_event_mm_dup()user_event_mm_dup() walks the parent mm's enabler list locklessly under
rcu_read_lock() during fork() (from copy_process()); it does not take
event_mutex:user_event_enabler_destroy() removes an enabler from that list with
list_del_rcu() and then, without waiting for a grace period, drops the
enabler's user_event reference with user_event_put() and frees the enabler
with kfree(). A reader that loaded the enabler before the list_del_rcu()
can still be walking it, which leads to two use-after-frees:kfree(enabler) frees the enabler while that reader dereferences
enabler->event.user_event_put() may drop the last reference to the user_event, which
is then freed (via delayed_destroy_user_event() on a work queue), while
the same reader does user_event_get(orig->event) on it.Both are reachable by an unprivileged task that can open user_events_data:
one multithreaded process that registers an enabler and then concurrently
unregisters it and calls fork() triggers the race. KASAN reports a
slab-use-after-free in user_event_mm_dup() during clone(), with a
"refcount_t: addition on 0" warning when the user_event is freed.The enabler use-after-free was found first; the user_event one was reported
by XIAO WU, and the earlier enabler-only fix did not address it.Defer both the user_event_put() and the kfree(enabler) to a work item
queued with queue_rcu_work(), so they run only after an RCU grace period,
once all readers walking the enabler list have finished. The put must run
in process context because user_event_put() takes event_mutex on the last
reference, so a work queue is used rather than call_rcu(). The now-unlocked
put lets the locked argument of user_event_enabler_destroy() be removed;
all callers are updated.
CVSS v3.1 score: 7.8
CVE-2021-36178 
A insufficiently protected credentials in Fortinet FortiSDNConnector version 1.1.7 and below allows attacker to disclose third-party devices credential information via configuration page lookup.
CVSS v3.1 score: 4.3
RHSA-2022:1010 Red Hat Security Advisory: rh-mariadb103-mariadb security and bug fix update
mysql: Server: DML unspecified vulnerability (CPU Apr 2021) mysql: Server: DML unspecified vulnerability (CPU Apr 2021) mysql: InnoDB unspecified vulnerability (CPU Jul 2021) mysql: InnoDB unspecified vulnerability (CPU Jul 2021) mysql: InnoDB unspecified vulnerability (CPU Oct 2021) mariadb: Crash in get_sort_by_table() in subquery with ORDER BY having outer ref mariadb: save_window_function_values triggers an abort during IN subquery mariadb: Crash in set_var.cc via certain UPDATE queries with nested subqueries mariadb: Crash caused by mishandling of a pushdown from a HAVING clause to a WHERE clause mariadb: Integer overflow in sql_lex.cc integer leading to crash mysql: InnoDB unspecified vulnerability (CPU Apr 2022) mariadb: crash in Used_tables_and_const_cache::used_tables_and_const_cache_join mariadb: improper locking due to unreleased lock in the ds_xbstream.cc mariadb: DoS due to improper locking due to unreleased lock in plugin/server_audit/server_audit.c
CVSS v3.1 score: 5.5
GHSA-gggq-j347-r3w6 
In the Linux kernel, the following vulnerability has been resolved:tee: optee: Fix supplicant wait loopOP-TEE supplicant is a user-space daemon and it's possible for it
be hung or crashed or killed in the middle of processing an OP-TEE
RPC call. It becomes more complicated when there is incorrect shutdown
ordering of the supplicant process vs the OP-TEE client application which
can eventually lead to system hang-up waiting for the closure of the
client application.Allow the client process waiting in kernel for supplicant response to
be killed rather than indefinitely waiting in an unkillable state. Also,
a normal uninterruptible wait should not have resulted in the hung-task
watchdog getting triggered, but the endless loop would.This fixes issues observed during system reboot/shutdown when supplicant
got hung for some reason or gets crashed/killed which lead to client
getting hung in an unkillable state. It in turn lead to system being in
hung up state requiring hard power off/on to recover.
CVSS v3.1 score: 5.5
PYSEC-2026-3574 
### Summary
`consult_gemini_with_files` in **inline mode** read any file path supplied in
the `files` argument without confining it to the working `directory`, then
forwarded the contents to the Gemini CLI. Because the caller also controls
`query`, the file contents are echoed back through the Gemini round-trip
(and sent to Google), making this an arbitrary local file read.

### Impact
An MCP client — or an LLM that has been prompt-injected into calling the tool —
can read **any file the server process can access** (SSH keys, cloud
credentials, `.env`, source) and have it disclosed via the tool response.
No code execution by itself.

### Affected component
- Tool: `consult_gemini_with_files(query, directory, files, …)`, `mode="inline"`
- Sink: `_read_file_for_inline` via `_prepare_inline_payload` in `src/mcp_server.py`
- The `at_command` mode already confined paths; inline mode did not.

### Root cause
`_resolve_path` returned an out-of-root path while only nullifying the *display*
name, and `_prepare_inline_payload` read the file regardless. Absolute paths,
`..` traversal, and symlink escapes were all accepted.

### Patch
Fixed in **1.3.1**. `_resolve_path` now resolves symlinks and confines via
`Path.relative_to(root)`; inline mode skips any entry that resolves outside the
working directory (the same guard `at_command` already enforced).

### Workarounds
Upgrade to 1.3.1. Before upgrading, avoid `mode="inline"` with untrusted
`files` input, or run the server with a restricted-permission user.

### Credit
Reported privately by Zhihao Zhang (WPI).
CVSS v3.1 score: 6.2
CVE-2022-3076 CM Download Manager < 2.8.6 - Admin+ Arbitrary File Upload
The CM Download Manager WordPress plugin before 2.8.6 allows high privilege users such as admin to upload arbitrary files by setting the any extension via the plugin's setting, which could be used by admins of multisite blog to upload PHP files for example.
CVSS v3.1 score: 7.2
CVE-2026-33056 tar-rs: unpack_in can chmod arbitrary directories by following symlinks
tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses fs::metadata() to check whether a path that already exists is a directory. Because fs::metadata() follows symbolic links, a crafted tarball containing a symlink entry followed by a directory entry with the same name causes the crate to treat the symlink target as a valid existing directory — and subsequently apply chmod to it. This allows an attacker to modify the permissions of arbitrary directories outside the extraction root. This issue has been fixed in version 0.4.45.
CVSS v4.0 score: 5.1
GHSA-jf4f-59hf-2932 
In miniadb, there is a possible way to get read/write access to recovery system properties due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-201308542
CVSS v3.1 score: 7.8
GHSA-v7jc-crf6-wh7w 
In parseMPEGCCData of NuPlayer2CCDecoder.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution in an unprivileged process with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-111874331
CVSS v3.0 score: 8.8
CVE-2026-46084 RDMA/mana_ib: Disable RX steering on RSS QP destroy
In the Linux kernel, the following vulnerability has been resolved:

RDMA/mana_ib: Disable RX steering on RSS QP destroy

When an RSS QP is destroyed (e.g. DPDK exit), mana_ib_destroy_qp_rss()
destroys the RX WQ objects but does not disable vPort RX steering in
firmware. This leaves stale steering configuration that still points to
the destroyed RX objects.

If traffic continues to arrive (e.g. peer VM is still transmitting) and
the VF interface is subsequently brought up (mana_open), the firmware
may deliver completions using stale CQ IDs from the old RX objects.
These CQ IDs can be reused by the ethernet driver for new TX CQs,
causing RX completions to land on TX CQs:

  WARNING: mana_poll_tx_cq+0x1b8/0x220 [mana]  (is_sq == false)
  WARNING: mana_gd_process_eq_events+0x209/0x290 (cq_table lookup fails)

Fix this by disabling vPort RX steering before destroying RX WQ objects.
Note that mana_fence_rqs() cannot be used here because the fence
completion is delivered on the CQ, which is polled by user-mode (e.g.
DPDK) and not visible to the kernel driver.

Refactor the disable logic into a shared mana_disable_vport_rx() in
mana_en, exported for use by mana_ib, replacing the duplicate code.
The ethernet driver's mana_dealloc_queues() is also updated to call
this common function.
CVSS v3.1 score: 7.8
GHSA-74pw-6jvg-9rqc 
A vulnerability, which was classified as critical, was found in code-projects/anirbandutta9 Content Management System and News-Buzz 1.0. This affects an unknown part of the file /index.php. The manipulation of the argument user_name leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product is distributed under two entirely different names.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 7.3
CVE-2007-5152 
Sun Java System Access Manager 7.1, when installed in a Sun Java System Application Server 9.1 container, does not demand authentication after a container restart, which allows remote attackers to perform administrative tasks.
CVSS v2.0 score: 7.5
GHSA-vhm9-7pj9-7x4x 
Citrix XenServer 5.0 Update 2 and earlier, and 5.5 Update 1 and earlier, when using a pvops kernel, allows guest users to cause a denial of service in the host via unspecified vectors that trigger "incorrectly set flags."
RHSA-2023:4571 Red Hat Security Advisory: iperf3 security update
iperf3: memory allocation hazard and crash
CVSS v3.1 score: 7.5
CVE-2017-18280 
In Snapdragon (Automobile, Mobile, Wear) in version MDM9607, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 617, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SDM429, SDM439, SDM632, Snapdragon_High_Med_2016, when a Trusted Application has opened the SPI/I2C interface to a particular device, it is possible for another Trusted Application to read the data on this open interface by calling the SPI/I2C read function.
CVSS v3.0 score: 7.8
CVSS v2.0 score: 7.2
GHSA-5mv9-9mfh-fm86 
It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent (DSA) has Remote Code Execution vulnerabilities in multiple instances of the API requests. The affected endpoints do not have any input validation of the user's input that allowed a malicious payload to be injected.
CVSS v3.1 score: 9.8
CVE-2006-0379 
FreeBSD kernel 5.4-STABLE and 6.0 does not completely initialize a buffer before making it available to userland, which could allow local users to read portions of kernel memory.
CVSS v2.0 score: 2.1
GHSA-5ghw-w62x-rm6x 
A weakness has been identified in Campcodes Grocery Sales and Inventory System 1.0. This issue affects some unknown processing of the file /ajax.php?action=save_receiving. Executing manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be exploited.
CVSS v4.0 score: 5.5
CVSS v3.1 score: 7.3
GHSA-w5h9-gvgr-jhpg 
In the Linux kernel, the following vulnerability has been resolved:x86/ioremap: Map EFI-reserved memory as encrypted for SEVSome drivers require memory that is marked as EFI boot services
data. In order for this memory to not be re-used by the kernel
after ExitBootServices(), efi_mem_reserve() is used to preserve it
by inserting a new EFI memory descriptor and marking it with the
EFI_MEMORY_RUNTIME attribute.Under SEV, memory marked with the EFI_MEMORY_RUNTIME attribute needs to
be mapped encrypted by Linux, otherwise the kernel might crash at boot
like below:EFI Variables Facility v0.08 2004-May-17
  general protection fault, probably for non-canonical address 0x3597688770a868b2: 0000 [#1] SMP NOPTI
  CPU: 13 PID: 1 Comm: swapper/0 Not tainted 5.12.4-2-default #1 openSUSE Tumbleweed
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
  RIP: 0010:efi_mokvar_entry_next
  [...]
  Call Trace:
   efi_mokvar_sysfs_init
   ? efi_mokvar_table_init
   do_one_initcall
   ? __kmalloc
   kernel_init_freeable
   ? rest_init
   kernel_init
   ret_from_forkExpand the __ioremap_check_other() function to additionally check for
this other type of boot data reserved at runtime and indicate that it
should be mapped encrypted for an SEV guest.[ bp: Massage commit message. ]
CVSS v3.1 score: 6.2
GHSA-m58q-qq5h-mgqq Islandora 2.0 before 2.4.1 could allow any user to upload content into a repository
ImpactThis vulnerability would allow any user, regardless of permissions, to upload content into a repository. This affects installations of Islandora core 2.0 or greater.PatchesUpgrade immediately to the [latest release](https://github.com/Islandora/islandora/releases/tag/2.4.1) of Islandora.WorkaroundsIn lieu of an upgrade the [following module](https://github.com/Islandora/islandora_ghsa_route_fix) can be leveraged that will resolve the issue until such a time an upgrade can take place.For more informationIf you have any questions or comments about this advisory:Open an issue in [Islandora](https://github.com/Islandora/islandora)Contact community@islandora.ca.
CVSS v3.1 score: 10
GHSA-9q3v-fmw3-9539 
Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
CVE-2016-2125 
It was found that Samba before versions 4.5.3, 4.4.8, 4.3.13 always requested forwardable tickets when using Kerberos authentication. A service to which Samba authenticated using Kerberos could subsequently use the ticket to impersonate Samba to other services or domain users.
CVSS v3.0 score: 6.4
CVE-2025-14819 OpenSSL partial chain store policy bypass
When doing TLS related transfers with reused easy or multi handles and
altering the  `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally
reuse a CA store cached in memory for which the partial chain option was
reversed. Contrary to the user's wishes and expectations. This could make
libcurl find and accept a trust chain that it otherwise would not.
CVSS v3.1 score: 5.3
GHSA-23f2-7h54-3w8p 
The Artofdefence Hyperguard Web Application Firewall (WAF) module before 2.5.5-11635, 3.0 before 3.0.3-11636, and 3.1 before 3.1.1-11637, a module for the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via an HTTP request with a large Content-Length value but no POST data.
CVE-2004-1936 
ZoneAlarm Pro 4.5.538.001 and possibly other versions allows remote attackers to bypass e-mail protection via attachments whose names contain certain non-English characters.
CVSS v2.0 score: 7.5
GHSA-3c4g-j683-8mx6 
The Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the seedprod_lite_new_lpage function in all versions up to, and including, 6.15.21. This makes it possible for unauthenticated attackers to change the contents of coming-soon, maintenance pages, login and 404 pages set up with the plugin. Version 6.15.22 addresses this issue but introduces a bug affecting admin pages. We suggest upgrading to 6.15.23.
CVSS v3.1 score: 8.2
CVE-2017-7697 
In libsamplerate before 0.1.9, a buffer over-read occurs in the calc_output_single function in src_sinc.c via a crafted audio file.
CVSS v3.1 score: 5.5
CVSS v2.0 score: 4.3
CVE-2021-40106 
An issue was discovered in Concrete CMS through 8.5.5. There is unauthenticated stored XSS in blog comments via the website field.
CVSS v3.1 score: 6.1
CVSS v2.0 score: 4.3
cisco-sa-20180606-multiplatform-sip Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware Session Initiation Protocol Denial of Service Vulnerability
A vulnerability in the Session Initiation Protocol (SIP) call-handling functionality of Cisco IP Phone 6800, 7800, and 8800 Series Phones with Multiplatform Firmware could allow an unauthenticated, remote attacker to cause an affected phone to reload unexpectedly, resulting in a temporary denial of service (DoS) condition.

The vulnerability exists because the firmware of an affected phone incorrectly handles errors that could occur when an incoming phone call is not answered. An attacker could exploit this vulnerability by sending a set of maliciously crafted SIP packets to an affected phone. A successful exploit could allow the attacker to cause the affected phone to reload unexpectedly, resulting in a temporary DoS condition.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-multiplatform-sip ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-multiplatform-sip"]
CVSS v3.0 score: 7.5
CVE-2021-32681 Improper escaping of HTML ('Cross-site Scripting') in Wagtail StreamField blocks
Wagtail is an open source content management system built on Django. A cross-site scripting vulnerability exists in versions 2.13-2.13.1, versions 2.12-2.12.4, and versions prior to 2.11.8. When the `{% include_block %}` template tag is used to output the value of a plain-text StreamField block (`CharBlock`, `TextBlock` or a similar user-defined block derived from `FieldBlock`), and that block does not specify a template for rendering, the tag output is not properly escaped as HTML. This could allow users to insert arbitrary HTML or scripting. This vulnerability is only exploitable by users with the ability to author StreamField content (i.e. users with 'editor' access to the Wagtail admin). Patched versions have been released as Wagtail 2.11.8 (for the LTS 2.11 branch), Wagtail 2.12.5, and Wagtail 2.13.2 (for the current 2.13 branch). As a workaround, site implementors who are unable to upgrade to a current supported version should audit their use of `{% include_block %}` to ensure it is not used to output `CharBlock` / `TextBlock` values with no associated template. Note that this only applies where `{% include_block %}` is used directly on that block (uses of `include_block` on a block _containing_ a CharBlock / TextBlock, such as a StructBlock, are unaffected). In these cases, the tag can be replaced with Django's `{{ ... }}` syntax - e.g. `{% include_block my_title_block %}` becomes `{{ my_title_block }}`.
CVSS v3.1 score: 5.4
CVE-2026-57575 Misskey: SSRF bypass in URL Preview
Misskey is an open source, federated social media platform. Prior to 2026.6.0, Misskey contains a Server-Side Request Forgery (SSRF) vulnerability in URL preview functionality in UrlPreviewService. Due to missing network restrictions before establishing outbound connections, a remote attacker can cause the Misskey server to initiate HTTP requests to loopback, private, or link-local services. Because IP address validation takes place after the request has been sent and the process is subsequently rejected, no sensitive internal data is believed to be transmitted back or exposed to the attacker. This issue is fixed in version 2026.6.0.
CVSS v4.0 score: 6.9
GHSA-whcc-jgf3-q7pm 
The OptinMonster WordPress plugin is vulnerable to sensitive information disclosure and unauthorized setting updates due to insufficient authorization validation via the logged_in_or_has_api_key function in the ~/OMAPI/RestApi.php file that can used to exploit inject malicious web scripts on sites with the plugin installed. This affects versions up to, and including, 2.6.4.
CVSS v3.1 score: 8.2
CVE-2023-36835 Junos OS: QFX10000 Series: All traffic will be dropped after a specific valid IP packet has been received which needs to be routed over a VXLAN tunnel
An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on QFX10000 Series allows a network based attacker to cause a Denial of Service (DoS).

If a specific valid IP packet is received and that packet needs to be routed over a VXLAN tunnel, this will result in a PFE wedge condition due to which traffic gets impacted. As this is not a crash and restart scenario, this condition will persist until the system is rebooted to recover.

This issue affects Juniper Networks Junos OS on QFX10000:
20.3 version 20.3R1 and later versions;
20.4 versions prior to 20.4R3-S5;
21.1 versions prior to 21.1R3-S5;
21.2 versions prior to 21.2R3-S5;
21.3 versions prior to 21.3R3-S4;
21.4 versions prior to 21.4R3-S1;
22.1 versions prior to 22.1R3;
22.2 versions prior to 22.2R2;
22.3 versions prior to 22.3R1-S2, 22.3R2.

CVSS v3.1 score: 7.5
GHSA-4338-qx49-jmf8 
Vulnerability in the Siebel Core - Common Components component of Oracle Siebel CRM (subcomponent: Email). Supported versions that are affected are 19.0 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Siebel Core - Common Components. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel Core - Common Components accessible data. CVSS 3.0 Base Score 4.2 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N).
CVE-2014-9926 
In GNSS in all Android releases from CAF using the Linux kernel, a Use After Free vulnerability could potentially exist.
CVSS v3.0 score: 7.8
CVSS v2.0 score: 9.3
CVE-2001-0257 
Buffer overflow in Easycom/Safecom Print Server Web service, version 404.590 and earlier, allows remote attackers to execute arbitrary commands via (1) a long URL or (2) a long HTTP header field such as "Host:".
CVSS v2.0 score: 7.5
CVE-2010-1018 
SQL injection vulnerability in the Book Reviews (sk_bookreview) extension 0.0.12 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS v2.0 score: 7.5
GHSA-c77h-w7c8-63x2 
Advantech EKI-122x-BE devices with firmware before 1.65, EKI-132x devices with firmware before 1.98, and EKI-136x devices with firmware before 1.27 have hardcoded SSH keys, which makes it easier for remote attackers to obtain access via an SSH session.
GHSA-5369-cwvv-7r63 
A non-administrative user can upload malicious files. When an administrator or the product accesses that file, an arbitrary script may be executed on the administrator's browser. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well.
CVSS v4.0 score: 5.1
CVSS v3.0 score: 6.5
GHSA-f72f-6w6j-jj9v 
Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavfilter/f_reverse.c:269:26 in areverse_request_frame.
CVSS v3.1 score: 3.6
CVE-2017-5502 
libjasper/jp2/jp2_dec.c in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via vectors involving left shift of a negative value.
CVSS v3.0 score: 5.5
CVSS v2.0 score: 4.3
GHSA-5qx5-jpr4-rw99 
In the Linux kernel, the following vulnerability has been resolved:Revert "drm/gem-framebuffer: Use dma_buf from GEM object instance"This reverts commit cce16fcd7446dcff7480cd9d2b6417075ed81065.The dma_buf field in struct drm_gem_object is not stable over the
object instance's lifetime. The field becomes NULL when user space
releases the final GEM handle on the buffer object. This resulted
in a NULL-pointer deref.Workarounds in commit 5307dce878d4 ("drm/gem: Acquire references on
GEM handles for framebuffers") and commit f6bfc9afc751 ("drm/framebuffer:
Acquire internal references on GEM handles") only solved the problem
partially. They especially don't work for buffer objects without a DRM
framebuffer associated.Hence, this revert to going back to using .import_attach->dmabuf.v3:cc stable
CVSS v3.1 score: 5.5
GHSA-vwrw-h95r-ch46 
picklescan before 0.0.30 fails to detect malicious pickle files that invoke torch.utils.bottleneck.__main__.run_autograd_prof function. Attackers can embed undetected code in pickle files that executes during deserialization, enabling remote code execution.
CVSS v4.0 score: 7.6
CVSS v3.1 score: 8.1
GHSA-286q-c3p5-x28w 
A vulnerability was found in ZhiHuiYun up to 4.4.13 and classified as critical. This issue affects the function download_network_image of the file /app/Http/Controllers/ImageController.php of the component Search. The manipulation of the argument url leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-251375.
CVSS v3.1 score: 6.3
GHSA-7j83-c8jv-q846 
Citrix XenDesktop 7.0, when upgraded from XenDesktop 5.x, does not properly enforce policy rule permissions, which allows remote attackers to bypass intended restrictions.
CVE-2007-5652 
IBM DB2 UDB 9.1 before Fixpak 4 does not properly manage storage of a list containing authentication information, which might allow attackers to cause a denial of service (instance crash) or trigger memory corruption.  NOTE: the vendor description of this issue is too vague to be certain that it is security-related.
CVSS v2.0 score: 7.8
GHSA-v4jv-gfgq-2wrh 
TOTOLINK N350RT V9.3.5u.6139_B20201216 was discovered to contain a stack overflow via the sPort parameter in the function setIpPortFilterRules.
CVSS v3.1 score: 7.8
GHSA-j3fw-wc48-29g3 Open WebUI Arbitrary File Write, Delete via Path Traversal
** CONFIDENTIAL **Vulnerability Disclosure Analysis DocumentationVulnerability DetailsDiscoverer: Taylor Pennington of KoreLogic, Inc.Date Submitted: June 11, 2024Title: Open WebUI Arbitrary File Write, Delete via Path TraversalHigh-level Summary:
  Attacker controlled files can be uploaded to arbitrary locations on the web
  server's filesystem by abusing a path traversal vulnerability. After the
  file is written, it is deleted.Affected Vendor: Open WebUIAffected Product(s): Open WebUI (Formerly Ollama WebUI)Affected Version(s): 0.1.105Platform/OS: Debian GNU/Linux 12 (bookworm)Vector: HTTP web interfaceCWE: 22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Technical Analysis:When attaching files to a prompt by clicking the plus sign (+) on the left of
   the message input box when using the Open WebUI HTTP interface, the file is
   uploaded to a static upload directory. If the file is an audio file
   it will be sent to a second API that will attempt to transcribe it.The name of the file is derived from the original HTTP upload request and is
   not validated or sanitized. This allows for users to upload files with names
   containing dot-segments in the file path and traverse out of the intended
   uploads directory. Effectively, users can upload files anywhere on the
   filesystem the user running the web server has permission.This can be visualized by examining the python code for the
   "/ollama/models/upload" API route (https://github.com/open-webui/open-webui/blob/0399a69b73de9789c4221acedea70d528e1346c4/backend/apps/ollama/main.py#L1063-L1127):filename = os.path.basename(file.filename)
file_path = f"{UPLOAD_DIR}/{filename}"
CVSS v3.1 score: 8.1
CVE-2025-65033 Rallly Broken Authorization: Any User Can Pause or Resume Any Poll via Poll ID Manipulation
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an authorization flaw in the poll management feature allows any authenticated user to pause or resume any poll, regardless of ownership. The system only uses the public pollId to identify polls, and it does not verify whether the user performing the action is the poll owner. As a result, any user can disrupt polls created by others, leading to a loss of integrity and availability across the application. This issue has been patched in version 4.5.4.
CVSS v3.1 score: 8.1
GHSA-9p53-xrmx-vm2x 
Incorrect default permissions in the software installer for the Intel(R) VTune(TM) Profiler before version 2021.3.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2025-67562 WordPress Image Caption Hover Pro plugin < 20.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in WebCodingPlace Image Caption Hover Pro image-caption-hover-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Caption Hover Pro: from n/a through < 20.0.
CVSS v3.1 score: 5.4
GHSA-62cc-g9f4-2r2g 
Use after free in PDFium in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS v3.1 score: 8.8
CVE-2018-4145 
Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 11.3, tvOS 11.3, watchOS 4.3, Safari 11.1, iTunes 12.7.4 for Windows, iCloud for Windows 7.4.
CVSS v3.0 score: 8.8
CVSS v2.0 score: 6.8
RHSA-2019:1189 Red Hat Security Advisory: qemu-kvm security update
hardware: Microarchitectural Store Buffer Data Sampling (MSBDS) hardware: Micro-architectural Load Port Data Sampling - Information Leak (MLPDS) hardware: Microarchitectural Fill Buffer Data Sampling (MFBDS) hardware: Microarchitectural Data Sampling Uncacheable Memory (MDSUM)
CVSS v3.0 score: 3.8
GHSA-5jpm-p694-hhf9 
In the Linux kernel, the following vulnerability has been resolved:tipc: require net admin for TIPCv2 netlink mutatorsTIPCv2 registers mutating generic-netlink operations without admin
permission flags. Generic netlink only checks CAP_NET_ADMIN when an
operation sets GENL_ADMIN_PERM or GENL_UNS_ADMIN_PERM, so a local
unprivileged process can currently change TIPC state through commands
such as TIPC_NL_NET_SET, TIPC_NL_KEY_SET, TIPC_NL_KEY_FLUSH, and
bearer enable/disable.The legacy TIPC netlink API already checks netlink_net_capable(...,
CAP_NET_ADMIN) for administrative commands. Give the TIPCv2 mutators
the equivalent generic-netlink gate. Use GENL_UNS_ADMIN_PERM, which
maps to the same namespace-aware CAP_NET_ADMIN check that
netlink_net_capable() performs, so the behaviour matches the legacy
path and keeps working for CAP_NET_ADMIN holders in a non-initial user
namespace (containers).A QEMU/KASAN repro run as uid/gid 65534 with zero effective
capabilities previously succeeded in changing the network id and node
identity, setting and flushing key material, and enabling/disabling a
UDP bearer. With this patch applied the same operations fail with
-EPERM.
CVSS v3.1 score: 7.8
GHSA-h595-8pw6-5q6v Inadequate Encryption Strength in DotNetNuke
DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.
CVSS v3.0 score: 7.5
GHSA-4mw4-qwhg-37xg 
Time-of-check time-of-use race condition in the WheaERST SMM module for some Intel(R) reference platforms may allow an escalation of privilege. System software adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
CVSS v4.0 score: 7.1
CVE-2007-2323 
Multiple buffer overflows in the WinDVDX ActiveX control in InterVideo Home Theater 2.1.13.0 and 2.5.13.58 allow remote attackers to execute arbitrary code via a long string argument to the (1) GetDiscType or (2) AddFileList method.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS v2.0 score: 10
GHSA-4vfj-wgm2-99m2 
In the Linux kernel, the following vulnerability has been resolved:PCI/DOE: Fix memory leak with CONFIG_DEBUG_OBJECTS=yAfter a pci_doe_task completes, its work_struct needs to be destroyed
to avoid a memory leak with CONFIG_DEBUG_OBJECTS=y.