CIRCL/vulnerability-scores huggingface dataset:
GHSA-fmxg-mjgm-8q6c 
In the Linux kernel, the following vulnerability has been resolved:dmaengine: idxd: fix memory leak in error handling path of idxd_allocMemory allocated for idxd is not freed if an error occurs during
idxd_alloc(). To fix it, free the allocated memory in the reverse order
of allocation before exiting the function in case of an error.
CVSS v3.1 score: 5.5
RHSA-2010:0452 Red Hat Security Advisory: Red Hat Directory Server 7.1 - End of Life Notice 
This is the notification of the End of Life plans for Red Hat Directory
Server 7.1.
CVE-2021-27697 
RIOT-OS 2021.01 contains a buffer overflow vulnerability in sys/net/gnrc/routing/rpl/gnrc_rpl_validation.c through the gnrc_rpl_validation_options() function.
CVSS v3.1 score: 9.8
CVSS v2.0 score: 7.5
GHSA-5ch5-84x7-c2h3 
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in facturaone TicketBAI Facturas para WooCommerce allows Blind SQL Injection. This issue affects TicketBAI Facturas para WooCommerce: from n/a through 3.19.
CVSS v3.1 score: 9.3
RHSA-2015:0255 Red Hat Security Advisory: samba4 security update
samba: talloc free on uninitialized stack pointer in netlogon server could lead to remote-code execution
GHSA-pv42-jr5w-x5vg 
cgi-bin/webutil.pl in The Puppet Master WebUtil allows remote attackers to execute arbitrary commands via shell metacharacters in the dig command.
GHSA-m97f-x4mr-4x3q Moodle vulnerable to Cross-Site Request Forgery
Multiple cross-site request forgery (CSRF) vulnerabilities in Moodle 2.0.x before 2.0.2 allow remote attackers to hijack the authentication of arbitrary users for requests that mark the completion of (1) an activity or (2) a course.
CVSS v4.0 score: 6.6
GHSA-8xwh-69g8-mr3r 
An authenticated attacker can leverage an exposed resource.db() accessor method to smuggle Python method calls via a Jinja template, which can lead to code execution. This issue was resolved in the Managed and SaaS deployments on February 1, 2023, and in version 23.2.1 of the Self-Managed version of InsightCloudSec.
CVSS v3.1 score: 8.8
GHSA-hjjx-p4wx-hr4x 
Heap-based buffer overflow in Autodesk SketchBook Pro before 6.2.6 allows remote attackers to execute arbitrary code via crafted layer bitmap data in a PXD file.
GHSA-xw53-mwm6-gh7q 
Path traversal in Wallpaper service prior to SMR Jul-2026 Release 1 allows local privileged attackers to access files with system server privilege.
CVSS v4.0 score: 6.7
GHSA-fj59-4p8f-vjgf 
Rockwell Automation Arena Simulation Software versions 16.00.00 and earlier contain a USE AFTER FREE CWE-416. A maliciously crafted Arena file opened by an unsuspecting user may result in the application crashing or the execution of arbitrary code.
CVSS v3.0 score: 7.8
GHSA-7r9x-qrpr-3cxw mofh Vulnerable to Improper Restriction of XML External Entity Reference
The `xml.etree.ElementTree` module that mofh used up until version `1.0.1` implements a simple and efficient API for parsing and creating XML data. But it makes the application vulnerable to:[Billion Laughs attack](https://en.wikipedia.org/wiki/Billion_laughs_attack): It is a type of denial-of-service attack aimed at XML parsers. It uses multiple levels of nested entities. If one large entity is repeated with a couple of thousand chars repeatedly, the parser gets overwhelmed.[Quadratic blowup attack](https://www.acunetix.com/vulnerabilities/web/xml-quadratic-blowup-denial-of-service-attack/): It is similar to a Billion Laughs attack. It abuses entity expansion, too. Instead of nested entities, it repeats one large entity with a couple of thousand chars repeatedly.The Problem has been patched starting from version `1.0.1` by utilising the `defusedxml` package instead of `xml.etree.ElementTree`.WorkaroundsFor this vulnerability to be exploited the user must be using a custom API URL, which has to be manually given using the `api_url` argument, or MyOwnFreeHost's API must be hacked. So, if the user did not use a custom API URL they _should_ be fine, however, upgrading is still advised.Another workaround could be to call `defusedxml.defuse_stdlib()` before making any requests using the client.
CVE-2024-51522 
Vulnerability of improper device information processing in the device management module
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS v3.1 score: 6.2
CVE-2018-8869 
In Lantech IDS 2102 2.0 and prior, nearly all input fields allow for arbitrary input on the device. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS v3.0 score: 9.8
CVSS v2.0 score: 10
GHSA-mwgq-r782-4vx4 
MariaDB through 10.5.9 allows a sql_parse.cc application crash because of incorrect used_tables expectations.
CVSS v3.1 score: 5.5
CVE-2025-66084 WordPress FluentCommunity plugin <= 2.0.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in Shahjahan Jewel FluentCommunity fluent-community allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentCommunity: from n/a through <= 2.0.0.
CVSS v3.1 score: 4.3
CVE-2017-8462 
The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an authenticated attacker to obtain information via a specially crafted application. aka "Windows Kernel Information Disclosure Vulnerability," a different vulnerability than CVE-2017-8491, CVE-2017-8490, CVE-2017-8489, CVE-2017-8488, CVE-2017-8485, CVE-2017-8483, CVE-2017-8482, CVE-2017-8481, CVE-2017-8480, CVE-2017-8478, CVE-2017-8479, CVE-2017-8476, CVE-2017-8474, CVE-2017-8469, CVE-2017-0300, CVE-2017-0299, and CVE-2017-0297.
CVSS v3.0 score: 5
CVSS v2.0 score: 1.9
CVE-2025-68153 Juju: Resource poisoning
Juju is an open source application orchestration engine that enables any application operation on any infrastructure at any scale through special operators called ‘charms’. From versions 2.9 to before 2.9.56 and 3.6 to before 3.6.19, any authenticated user, machine or controller under a Juju controller can modify the resources of an application within the entire controller. This issue has been patched in versions 2.9.56 and 3.6.19.
CVSS v4.0 score: 7.1
GHSA-3xp9-9rj3-pr8r 
The mintToken function of a smart contract implementation for Crystals, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS v3.0 score: 7.5
CVE-2025-13941 Foxit PDF Reader Update Service Incorrect Permission Assignment Local Privilege Escalation Vulnerability
A local privilege escalation vulnerability exists in the Foxit PDF Reader/Editor Update Service. During plugin installation, incorrect file system permissions are assigned to resources used by the update service. A local attacker with low privileges could modify or replace these resources, which are later executed by the service, resulting in execution of arbitrary code with SYSTEM privileges.
CVSS v3.1 score: 8.8
ICSA-21-077-01 Johnson Controls Exacq Technologies exacqVision
exacqVision Web Service can expose sensitive information to an actor who is not explicitly authorized to have access to that information.CVE-2021-27656 has been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
CVSS v3.0 score: 5.3
RHSA-2025:23113 Red Hat Security Advisory: OpenShift Container Platform 4.15.60 bug fix and security update
podman: Build Context Bind Mount sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems runc: container escape via 'masked path' abuse due to mount race conditions runc: container escape with malicious config due to /dev/console mount and related races runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects
CVSS v3.1 score: 8.2
GHSA-xgh6-7v4c-vr2f 
Microsoft SharePoint Server Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-37961, CVE-2022-38009.
CVSS v3.1 score: 8.8
CVE-2009-4318 
Cross-site scripting (XSS) vulnerability in index.php in Real Estate Manager 1.0.1 allows remote attackers to inject arbitrary web script or HTML via the lang parameter.  NOTE: some of these details are obtained from third party information.
CVSS v2.0 score: 4.3
GHSA-c477-fwvr-v9fx 
cgi.c in weborf .0.17, 0.18, 0.19, and 0.20 (before 1.0) lacks '\0' termination of the path for CGI scripts because strncpy is misused.
CVSS v3.1 score: 9.1
CVE-2023-22868 IBM Aspera Faspex cross-site scripting
IBM Aspera Faspex 4.4.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  244117.
CVSS v3.1 score: 5.4
CVE-2022-38238 
XPDF commit ffaf11c was discovered to contain a heap-buffer overflow via DCTStream::lookChar() at /xpdf/Stream.cc.
CVSS v3.1 score: 7.8
CVE-2020-36379 
An issue was discovered in the remove function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parameters.
CVSS v3.1 score: 9.8
CVSS v2.0 score: 7.5
GHSA-pq9h-wc5w-r94q 
An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests, aka "Microsoft Exchange Server Elevation of Privilege Vulnerability." This affects Microsoft Exchange Server.
CVSS v3.0 score: 5.4
CVE-2011-2101 
Adobe Reader and Acrobat 8.x before 8.3, 9.x before 9.4.5, and 10.x before 10.1 on Windows and Mac OS X do not properly restrict script, which allows attackers to execute arbitrary code via a crafted document, related to a "cross document script execution vulnerability."
CVSS v2.0 score: 9.3
CVE-2025-55698 DirectX Graphics Kernel Denial of Service Vulnerability
Null pointer dereference in Windows DirectX allows an authorized attacker to deny service over a network.
CVSS v3.1 score: 7.7
CVE-2023-50966 
erlang-jose (aka JOSE for Erlang and Elixir) through 1.11.6 allow attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value in a JOSE header.
CVSS v3.1 score: 5.3
CVE-2022-20678 Cisco IOS XE Software AppNav-XE Denial of Service Vulnerability
A vulnerability in the AppNav-XE feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. This vulnerability is due to the incorrect handling of certain TCP segments. An attacker could exploit this vulnerability by sending a stream of crafted TCP traffic at a high rate through an interface of an affected device. That interface would need to have AppNav interception enabled. A successful exploit could allow the attacker to cause the device to reload.
CVSS v3.1 score: 8.6
CVE-2022-4691 Cross-site Scripting (XSS) - Stored in usememos/memos
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.
CVSS v3.0 score: 8.3
CVE-2023-50822 WordPress Currency Converter Widget Plugin <= 3.0.2 is vulnerable to Cross Site Scripting (XSS)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Currency.Wiki Currency Converter Widget – Exchange Rates allows Stored XSS.This issue affects Currency Converter Widget – Exchange Rates: from n/a through 3.0.2.
CVSS v3.1 score: 6.5
RHSA-2020:3588 Red Hat Security Advisory: libvncserver security update
libvncserver: websocket decoding buffer overflow
CVSS v3.1 score: 9.8
GHSA-xj37-qjg2-xwv2 @whyour/qinglong: manipulation of the argument command leads to protection mechanism failure
A security vulnerability has been detected in whyour qinglong up to 2.20.1. Affected is an unknown function of the file back/loaders/express.ts of the component API Interface. The manipulation of the argument command leads to protection mechanism failure. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.20.2 is able to address this issue. The identifier of the patch is 6bec52dca158481258315ba0fc2f11206df7b719. It is advisable to upgrade the affected component. The code maintainer was informed beforehand about the issues. He reacted very fast and highly professional.
CVSS v4.0 score: 2.1
CVSS v3.1 score: 6.3
GHSA-rqcj-mh6f-fw77 
A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, watchOS 6.2, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for Windows 7.18. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS v3.1 score: 8.8
CVE-2026-1650 MDJM Event Management <= 1.7.8.1 - Missing Authorization to Unauthenticated Arbitrary Custom Event Field Deletion
The MDJM Event Management plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the 'custom_fields_controller' function in all versions up to, and including, 1.7.8.1. This makes it possible for unauthenticated attackers to delete arbitrary custom event fields via the 'delete_custom_field' and 'id' parameters.
CVSS v3.1 score: 5.3
GHSA-58r9-hhg2-63wm 
The metadata flow feature in Cisco IOS 15.1 through 15.3 and IOS XE 3.3.xXO before 3.3.1XO, 3.6.xS and 3.7.xS before 3.7.6S, and 3.8.xS, 3.9.xS, and 3.10.xS before 3.10.1S allows remote attackers to cause a denial of service (device reload) via malformed RSVP packets, aka Bug ID CSCue22753.
GHSA-hhg7-m4q3-pm9j 
In the Linux kernel, the following vulnerability has been resolved:igc: fix potential skb leak in igc_fpe_xmit_smd_frame()When igc_fpe_init_tx_descriptor() fails, no one takes care of an
allocated skb, leaking it. [1]
Use dev_kfree_skb_any() on failure.Tested on an I226 adapter with the following command, while injecting
faults in igc_fpe_init_tx_descriptor() to trigger the error path.ethtool --set-mm $DEV verify-enabled on tx-enabled on pmac-enabled on[1]
unreferenced object 0xffff888113c6cdc0 (size 224):
...
  backtrace (crc be3d3fda):
    kmem_cache_alloc_node_noprof+0x3b1/0x410
    __alloc_skb+0xde/0x830
    igc_fpe_xmit_smd_frame.isra.0+0xad/0x1b0
    igc_fpe_send_mpacket+0x37/0x90
    ethtool_mmsv_verify_timer+0x15e/0x300
CVSS v3.1 score: 5.5
CVE-2026-71201 
In OpenStack Ironic through 38.0.0, a project reader that makes a crafted request to Ironic can return Portgroups assigned to Nodes owned or leased by another project.
CVSS v3.1 score: 5
CVE-2024-35904 selinux: avoid dereference of garbage after mount failure
In the Linux kernel, the following vulnerability has been resolved:

selinux: avoid dereference of garbage after mount failure

In case kern_mount() fails and returns an error pointer return in the
error branch instead of continuing and dereferencing the error pointer.

While on it drop the never read static variable selinuxfs_mount.
CVSS v3.1 score: 5.5
CVE-2016-0751 
actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly restrict use of the MIME type cache, which allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP Accept header.
CVSS v3.0 score: 7.5
CVSS v2.0 score: 5
GHSA-23x2-f488-jm35 
Samsung Gallery on the Samsung Galaxy S6 allows local users to cause a denial of service (process crash).
CVSS v3.0 score: 5.5
GHSA-xjx4-77rq-qjf8 
A vulnerability in the checkpoint manager implementation of Cisco Redundancy Configuration Manager (RCM) for Cisco StarOS Software could allow an unauthenticated, remote attacker to cause the checkpoint manager process to restart upon receipt of malformed TCP data. This vulnerability is due to improper input validation of an ingress TCP packet. An attacker could exploit this vulnerability by sending crafted TCP data to the affected application. A successful exploit could allow the attacker to cause a denial of service (DoS) condition due to the checkpoint manager process restarting.
RHSA-2023:1279 Red Hat Security Advisory: Synopsis: Red Hat OpenStack Platform (openstack-cinder) security update
openstack: Arbitrary file access through custom VMDK flat descriptor
CVSS v3.1 score: 7.7
GHSA-5733-3xh5-v4mq 
An issue was discovered in /admin/?/user/add in Frog CMS 0.9.5. The application's add user functionality suffers from CSRF. A malicious user can craft an HTML page and use it to trick a victim into clicking on it; once executed, a malicious user will be created with admin privileges. This happens due to lack of an anti-CSRF token in state modification requests.
CVSS v3.0 score: 8.8
CVE-2026-64633 
A vulnerability allowing remote unauthenticated code execution on the agent host.
CVSS v4.0 score: 10
GHSA-2mwx-63m5-mpjg 
In cameraisp, there is a possible information disclosure due to improper input validation. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07670971; Issue ID: ALPS07670971.
CVSS v3.1 score: 4.4
GHSA-g5mf-wqq5-vwg6 ImageMagick: Policy Bypass in MNG coder could
Because of a missing check in the MNG coder it would be possible to read more images than the list limit policy would allow resulting in excessive resource use.
CVSS v3.1 score: 5.3
RHSA-2026:24977 Red Hat Security Advisory: RHOAI 2.25.7 - Red Hat OpenShift AI
bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly vllm: HTTP header size limit not enforced allows Denial of Service from Unauthenticated requests golang: net/url: Memory exhaustion in query parameter parsing in net/url axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization aiohttp: aiohttp: Denial of Service via specially crafted POST request aiohttp: aiohttp: Denial of Service via memory exhaustion from crafted POST request keras: Keras: Arbitrary Code Execution Vulnerability Bypassing Safe Mode lodash: lodash: Arbitrary code execution via untrusted input in template imports fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID pytorch: PyTorch: Arbitrary code execution via malicious checkpoint file loading xgrammar: xgrammar: Denial of Service via multi-level nested syntax vLLM: vLLM: Server-Side Request Forgery bypass via inconsistent URL parsing onnx: ONNX: Information Disclosure via Path Traversal Vulnerability vllm: vLLM: Remote code execution due to hardcoded trust_remote_code setting onnx: ONNX: Untrusted Model Repository Warnings Suppressed python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution svgo: SVGO: Denial of Service via XML entity expansion tornado-python: Tornado: Denial of Service via large multipart bodies crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation) ray: Ray Dashboard Path Traversal Leading to Local File Disclosure google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation nltk: NLTK: Denial of Service via unauthenticated remote shutdown github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load() cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API Pillow: Pillow: Denial of Service via decompression bomb in FITS image processing follow-redirects: follow-redirects: Information disclosure via cross-domain redirects DOMPurify: DOMPurify: Cross-Site Scripting (XSS) via inconsistent tag sanitization protobufjs: protobufjs: Arbitrary code execution via injected protobuf definition type fields axios: Axios: HTTP Transport Hijacking via Prototype Pollution axios: Axios: Arbitrary HTTP header injection via prototype pollution axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling axios: Axios: NO_PROXY bypass via crafted URL
CVSS v3.1 score: 7.2
GHSA-5q9f-4pxq-x2gv 
This issue was addressed with improved redaction of sensitive information. This issue is fixed in watchOS 9.5, macOS Ventura 13.4, tvOS 16.5, iOS 16.5 and iPadOS 16.5, macOS Big Sur 11.7.7, macOS Monterey 12.6.6. An app may be able to bypass Privacy preferences
CVSS v3.1 score: 5.5
GHSA-j2w6-g3jh-8g4x 
Relative Path Traversal in Marvell QConvergeConsole GUI 5.5.0.74 allows a remote, authenticated attacker to delete arbitrary files on disk as SYSTEM or root.
GHSA-hqxj-h2gh-2rq4 
Cross-site scripting (XSS) vulnerability in signupconfirm.php in phpBannerExchange 1.2 Arabic allows remote attackers to inject arbitrary web script or HTML via the bannerurl parameter.
CVE-2025-33131 Fixes to common vulnerabilities found in IBM Db2 High Performance Unload
IBM DB2 High Performance Unload 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, and 5.1 could allow an authenticated user to cause the program to crash due to a buffer being overwritten when it is allocated on the stack.
CVSS v3.1 score: 6.5
CVE-2025-43400 
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.1 and iPadOS 18.7.1, iOS 26.0.1 and iPadOS 26.0.1, macOS Sequoia 15.7.1, macOS Sonoma 14.8.1, macOS Tahoe 26.0.1, tvOS 26.1, visionOS 26.0.1, watchOS 26.1. Processing a maliciously crafted font may lead to unexpected app termination or corrupt process memory.
CVSS v3.1 score: 6.3
CVE-2026-35162 
Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Improper Access Control vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to denial of service.
CVSS v3.1 score: 4.3
GHSA-6gv5-7h2g-r3xh 
The AMD subsystem in Apple OS X before 10.11.5 allows attackers to obtain sensitive kernel memory-layout information via a crafted app.
CVSS v3.0 score: 3.3
CVE-2023-3694 SourceCodester/projectworlds House Rental and Property Listing index.php sql injection
A vulnerability, which was classified as critical, has been found in SourceCodester/projectworlds House Rental and Property Listing 1.0. This issue affects some unknown processing of the file /index.php. The manipulation of the argument keywords/location leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 6.3
CVSS v3.0 score: 6.3
CVSS v2.0 score: 6.5
CVE-2024-44992 smb/client: avoid possible NULL dereference in cifs_free_subrequest()
In the Linux kernel, the following vulnerability has been resolved:

smb/client: avoid possible NULL dereference in cifs_free_subrequest()

Clang static checker (scan-build) warning:
	cifsglob.h:line 890, column 3
	Access to field 'ops' results in a dereference of a null pointer.

Commit 519be989717c ("cifs: Add a tracepoint to track credits involved in
R/W requests") adds a check for 'rdata->server', and let clang throw this
warning about NULL dereference.

When 'rdata->credits.value != 0 && rdata->server == NULL' happens,
add_credits_and_wake_if() will call rdata->server->ops->add_credits().
This will cause NULL dereference problem. Add a check for 'rdata->server'
to avoid NULL dereference.
CVSS v3.1 score: 7.5
GHSA-3867-jc5c-66qf Broken Access Control order API in Shopware
ImpactIn the Shopware CMS, the state handler for orders fails to sufficiently verify user authorizations for actions that modify the payment, delivery, and/or order status. Due to this inadequate implementation, users lacking 'write' permissions for orders are still able to change the order state.PatchesUpdate to Shopware 6.5.7.4WorkaroundsFor older versions of 6.1, 6.2, 6.3 and 6.4 corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
CVSS v3.1 score: 4.9
CVE-2025-13155 
An improper permissions vulnerability was reported in Lenovo Baiying Client that could allow a local authenticated user to execute code with elevated privileges.
CVSS v4.0 score: 8.5
CVSS v3.1 score: 7.8
GHSA-ggjq-8c4c-68r5 Apache JSPWiki XSS due to incomplete patch for CVE-2021-40369
A carefully crafted request on AJAXPreview.jsp could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. This vulnerability leverages CVE-2021-40369, where the Denounce plugin dangerously renders user-supplied URLs. Upon re-testing CVE-2021-40369, it appears that the patch was incomplete as it was still possible to insert malicious input via the Denounce plugin. Apache JSPWiki users should upgrade to 2.11.3 or later.
CVSS v3.1 score: 6.1
GHSA-7657-r953-54qx 
IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products versions 7.5 through 8.2 could allow an authenticated user to download arbitrary files from the operating system. IBM X-Force ID: 148757.
CVSS v3.0 score: 6.5
CVE-2026-11112 
Insufficient validation of untrusted input in Chromoting in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted Chrome Extension. (Chromium security severity: Medium)
CVSS v3.1 score: 9.6
CVE-2006-6838 
Rediff Bol Downloader ActiveX (OCX) control allows remote attackers to execute arbitrary files, and obtain sensitive information (usernames and pathnames), via a URL in the url vbscript parameter.
CVSS v2.0 score: 7.5
CVE-2025-48744 
In SIGB PMB before 8.0.1.2, attackers can achieve Local File Inclusion and remote code execution.
CVSS v3.1 score: 6.4
CVE-2026-31827 Alienbin: TTL Index Race Condition allows unauthorized deletion of other users data
Alienbin is an anonymous code and text sharing web service. In 1.0.0 and earlier, the /save endpoint in server.js drops and recreates the MongoDB TTL index on the entire post collection for every new paste submission. When User B submits a paste with a short TTL (e.g., 30 seconds), the TTL index is recreated with expireAfterSeconds: 30 for all documents in the collection. This causes User A's paste (originally set to 7 days) to be deleted after 30 seconds. An attacker can intentionally delete all existing pastes by repeatedly submitting pastes with ttlOption=30s.
CVSS v4.0 score: 7.1
GHSA-j4ph-wp3c-c37w 
Jenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Extended Read permission or access to the Jenkins controller file system.
CVSS v3.1 score: 4.3
GHSA-qvgr-wc77-vj3m 
IBM Sterling B2B Integrator 6.0.0.0 through 6.0.3.8 and 6.1.0.0 through 6.1.2.3 could allow an authenticated user to cause a denial of service due to uncontrolled resource consumption.  IBM X-Force ID:  255827.
CVSS v3.1 score: 6.5
GHSA-x9g6-2xx2-2gfx 
PDF-XChange Editor OXPS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of OXPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a write  past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20035.
CVSS v3.0 score: 7.8
RHSA-2009:1562 Red Hat Security Advisory: tomcat security update
Improve cookie parsing for tomcat5 tomcat request dispatcher information disclosure vulnerability tomcat6 Denial-Of-Service with AJP connection tomcat6 Information disclosure in authentication classes tomcat: XSS in Apache Tomcat calendar application tomcat XML parser information disclosure
GHSA-c5w3-r59j-638h 
A file upload vulnerability in exists in Trend Micro Apex One server build 11110. Using a malformed Content-Length header in an HTTP PUT message sent to URL /officescan/console/html/cgi/fcgiOfcDDA.exe, an unauthenticated remote attacker can upload arbitrary files to the SampleSubmission directory (i.e., \PCCSRV\TEMP\SampleSubmission) on the server. The attacker can upload a large number of large files to fill up the file system on which the Apex One server is installed.
CVSS v3.1 score: 9.1
GHSA-5xpm-7rr7-rcx4 
IBM Engineering Systems Design Rhapsody 9.0.2, 10.0, and 10.0.1 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local user could overflow the buffer and execute arbitrary code on the system.
CVSS v3.1 score: 8.8
CVE-2025-31493 Path traversal of collection names during file system lookup
Kirby is an open-source content management system. A vulnerability in versions prior to 3.9.8.3, 3.10.1.2, and 4.7.1 affects all Kirby sites that use the `collection()` helper or `$kirby->collection()` method with a dynamic collection name (such as a collection name that depends on request or user data). Sites that only use fixed calls to the `collection()` helper/`$kirby->collection()` method (i.e. calls with a simple string for the collection name) are *not* affected. A missing path traversal check allowed attackers to navigate and access all files on the server that were accessible to the PHP process, including files outside of the collections root or even outside of the Kirby installation. PHP code within such files was executed. Such attacks first require an attack vector in the site code that is caused by dynamic collection names, such as `collection('tags-' . get('tags'))`. It generally also requires knowledge of the site structure and the server's file system by the attacker, although it can be possible to find vulnerable setups through automated methods such as fuzzing. In a vulnerable setup, this could cause damage to the confidentiality and integrity of the server. The problem has been patched in Kirby 3.9.8.3, Kirby 3.10.1.2, and Kirby 4.7.1. In all of the mentioned releases, the maintainers of Kirby have added a check for the collection path that ensures that the resulting path is contained within the configured collections root. Collection paths that point outside of the collections root will not be loaded.
CVSS v4.0 score: 6.3
CVE-2021-36287 
Dell VNX2 for file version 8.1.21.266 and earlier, contain an unauthenticated remote code execution vulnerability which may lead unauthenticated users to execute commands on the system.
CVSS v3.1 score: 7.3
CVE-2021-33965 
China Mobile An Lianbao WF-1 V1.0.1 router provides a web interface /api/ZRMesh/set_ZRMesh which receives parameters by POST request, and the parameter mesh_enable and mesh_device have a command injection vulnerability. An attacker can use the vulnerability to execute remote commands.
CVSS v3.1 score: 8.8
CVSS v2.0 score: 6.5
GHSA-qq6p-768q-h7g2 
A flaw was discovered in htmodoc 1.9.12 in function parse_paragraph in ps-pdf.cxx ,this flaw possibly allows possible code execution and a denial of service via a crafted file.
CVSS v3.1 score: 7.8
CVE-2026-12990 Multiple vulnerabilities in Ghost Robotics' Vision 60
An access control vulnerability in the mobile app (APK v5.5.0) for Ghost Robotics' Vision 60 robot allows multiple simultaneous sessions to run without proper client validation or session integrity checks. An attacker with a modified version of the app can connect to the robot during an active, legitimate session. This allows the attacker to bypass control restrictions, intercept sensitive information (such as real-time video), and partially interact with the system unnoticed and without disconnecting the legitimate user, compromising confidentiality and operational security.
CVSS v4.0 score: 7.7
GHSA-f282-xv35-jqp9 
Stack buffer overflow in Crash reporting in Google Chrome on Windows prior to 111.0.5563.64 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
CVSS v3.1 score: 6.5
CVE-2016-6209 
Cross-site scripting (XSS) vulnerability in Nagios.
CVSS v3.0 score: 6.1
CVSS v2.0 score: 4.3
CVE-2021-25961 SuiteCRM - Account Takeover in Password Reset Functionality
In “SuiteCRM” application, v7.1.7 through v7.10.31 and v7.11-beta through v7.11.20 fail to properly invalidate password reset links that is associated with a deleted user id, which makes it possible for account takeover of any newly created user with the same user id.
CVSS v3.1 score: 8
RHSA-2022:7822 Red Hat Security Advisory: container-tools:rhel8 security, bug fix, and enhancement update
podman: possible information disclosure and modification buildah: possible information disclosure and modification
CVSS v3.1 score: 7.1
RHSA-2016:0068 Red Hat Security Advisory: kernel-rt security update
kernel: crypto api unprivileged arbitrary module load via request_module() kernel: memcg: OOM handling DoS kernel: crypto api unprivileged arbitrary module load via request_module() Kernel: vfs: Do not allow escaping from bind mounts kernel: Possible use-after-free vulnerability in keyring facility
CVE-2006-4424 
PHP remote file inclusion vulnerability in coin_includes/constants.php in phpCOIN 1.2.3 allows remote attackers to execute arbitrary PHP code via the _CCFG[_PKG_PATH_INCL] parameter.
CVSS v2.0 score: 5.1
GHSA-q8f7-j4v4-234r 
IBM Quality Manager (RQM) 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 120663.
CVSS v3.0 score: 5.4
GHSA-637m-w3h7-gjfv 
Advisto PEEL Shopping 9.2.1 has CSRF via administrer/utilisateurs.php to delete a user.
CVE-2020-10269 RVD#2566: Hardcoded Credentials on MiRX00 wireless Access Point
One of the wireless interfaces within MiR100, MiR200 and possibly (according to the vendor) other MiR fleet vehicles comes pre-configured in WiFi Master (Access Point) mode. Credentials to such wireless Access Point default to well known and widely spread SSID (MiR_RXXXX) and passwords (omitted). This information is also available in past User Guides and manuals which the vendor distributed. We have confirmed this flaw in MiR100 and MiR200 but it might also apply to MiR250, MiR500 and MiR1000.
CVSS v3.0 score: 9.8
CVE-2023-2838 Out-of-bounds Read in gpac/gpac
Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.2.2.
CVSS v3.0 score: 6.1
GHSA-mchf-g5xr-2975 
Stack-based buffer overflow in the Initialize function in an ActiveX control in IBM SPSS Statistics 19 and 20 before 20.0.0.2-IF0008, 21 before 21.0.0.2-IF0010, 22 before 22.0.0.2-IF0011, 23 before 23.0.0.3-IF0001, and 24 before 24.0.0.0-IF0003 allows remote authenticated users to execute arbitrary code via a long argument.
CVSS v3.0 score: 6.5
GHSA-3vrv-754q-mq3j 
Incorrect boundary conditions in the Graphics: Text component. This vulnerability was fixed in Firefox 151.0.3.
CVSS v3.1 score: 7.5
CVE-2020-15647 
A Content Provider in Firefox for Android allowed local files accessible by the browser to be read by a remote webpage, leading to sensitive data disclosure, including cookies for other origins. This vulnerability affects Firefox for < Android.
CVSS v3.1 score: 7.4
CVSS v2.0 score: 5
GHSA-h9hr-82mr-qh26 
Adobe Bridge versions 10.0.1 and earlier version have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
GHSA-4gg5-pmq6-mj4h 
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.44, prior to 6.0.24 and prior to 6.1.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N).
CVE-2020-26194 
Dell EMC PowerScale OneFS versions 8.1.2 and 8.2.2 contain an Incorrect Permission Assignment for a Critical Resource vulnerability. This may allow a non-admin user with either ISI_PRIV_LOGIN_CONSOLE or ISI_PRIV_LOGIN_SSH privileges to exploit the vulnerability, leading to compromised cryptographic operations. Note: no non-admin users or roles have these privileges by default.
CVSS v3.1 score: 7
CVE-2026-1474 Out-of-band SQL injection in Quatuor Performance Evaluation
An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Programación. Exploiting this vulnerability in the parameter 'Id_usuario' and 'Id_evaluacion' en ‘/evaluacion_inicio.aspx’, could allow an attacker to extract sensitive information from the database through external channels, without the affected application returning the data directly, compromising the confidentiality of the stored information.
CVSS v4.0 score: 9.3
GHSA-926j-923w-jrrq 
Command injection vulnerability in EZ-Internet in Synology DiskStation Manager (DSM) before 6.2-23739 allows remote authenticated users to execute arbitrary command via the username parameter.
CVSS v3.0 score: 7.2
GHSA-jqv7-vv43-9rx5 
Vulnerability in the Oracle Application Express Data Reporter component of Oracle Database Server. The supported version that is affected is Prior to 21.1.0.00.04. Easily exploitable vulnerability allows low privileged attacker having Valid User Account privilege with network access via HTTP to compromise Oracle Application Express Data Reporter. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Application Express Data Reporter, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Application Express Data Reporter accessible data as well as unauthorized read access to a subset of Oracle Application Express Data Reporter accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
GHSA-w3cr-3qxm-287x 
The ChkCookie subroutine in an ActiveX control in broadweb/include/gChkCook.asp in Advantech WebAccess before 7.2 allows remote attackers to read arbitrary files via a crafted call.
GHSA-738m-f33v-qc2r SMTP Injection in PHPMailer
ImpactAttackers could inject arbitrary SMTP commands via by exploiting the fact that valid email addresses may contain line breaks, which are not handled correctly in some contexts.PatchesFixed in 5.2.14 in [this commit](https://github.com/PHPMailer/PHPMailer/commit/6687a96a18b8f12148881e4ddde795ae477284b0).WorkaroundsManually strip line breaks from email addresses before passing them to PHPMailer.Referenceshttps://nvd.nist.gov/vuln/detail/CVE-2015-8476For more informationIf you have any questions or comments about this advisory:Open a private issue in [the PHPMailer project](https://github.com/PHPMailer/PHPMailer)
GHSA-76q6-r982-4fxq 
NVIDIA vGPU software for Windows and Linux contains a vulnerability where unprivileged users could execute privileged operations on the host. A successful exploit of this vulnerability might lead to data tampering, escalation of privileges, and denial of service.
CVSS v3.1 score: 6.3
CVE-2017-7217 
The Management Web Interface in Palo Alto Networks PAN-OS before 7.0.14 and 7.1.x before 7.1.9 allows remote attackers to write to export files via unspecified parameters.
CVSS v3.0 score: 4.3
CVSS v2.0 score: 4
GHSA-vpm6-vh97-9hqc 
Unspecified vulnerability in IBM OS/400 R530 and R535 has unknown impact and remote attack vectors, related to an "Integrity Problem" involving LIC-TCPIP and TCP reset.  NOTE: it is possible that this issue is related to CVE-2004-0230, but this is not certain.
CVE-2023-50883 
ONLYOFFICE Docs before 8.0.1 allows XSS because a macro is an immediately-invoked function expression (IIFE), and therefore a sandbox escape is possible by directly calling the constructor of the Function object. NOTE: this issue exists because of an incorrect fix for CVE-2021-43446.
CVSS v3.1 score: 6.1
GHSA-jjc9-c73g-2px6 
SQL injection vulnerability in SignIn.asp in India Software Solution shopping cart allows remote attackers to execute arbitrary SQL commands via the password.
GHSA-pjw5-hf2q-wg7j 
An issue was discovered in Wind River VxWorks through 6.8. There is a possible stack overflow in dhcp server.
CVE-2026-34531 Flask-HTTPAuth invokes token verification callback when missing or empty token was given by client
Flask-HTTPAuth provides Basic, Digest and Token HTTP authentication for Flask routes. Prior to version 4.8.1, in a situation where the client makes a request to a token protected resource without passing a token, or passing an empty token, Flask-HTTPAuth would invoke the application's token verification callback function with the token argument set to an empty string. If the application had any users in its database with an empty string set as their token, then it could potentially authenticate the client request against any of those users. This issue has been patched in version 4.8.1.
CVSS v3.1 score: 6.5
CVE-2025-8378 Campcodes Online Hotel Reservation System Login index.php sql injection
A vulnerability was found in Campcodes Online Hotel Reservation System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/index.php of the component Login. The manipulation of the argument username/password leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 7.3
CVSS v3.0 score: 7.3
CVSS v2.0 score: 7.5
GHSA-qj5g-vv2m-g5p9 
The Watu Pro plugin before 4.9.0.8 for WordPress has CSRF that allows an attacker to delete quizzes.
CVSS v3.1 score: 4.3
CVE-2021-28794 
The unofficial ShellCheck extension before 0.13.4 for Visual Studio Code mishandles shellcheck.executablePath.
CVSS v3.1 score: 9.8
CVSS v2.0 score: 7.5
CVE-2015-7677 
The MOVEitISAPI service in Ipswitch MOVEit DMZ before 8.2 provides different error messages depending on whether a FileID exists, which allows remote authenticated users to enumerate FileIDs via the X-siLock-FileID parameter in a download action to MOVEitISAPI/MOVEitISAPI.dll.
CVSS v3.0 score: 4.3
CVSS v2.0 score: 4
CVE-2021-36134 Out of bounds write in Netop Vision Pro
Out of bounds write vulnerability in the JPEG parsing code of Netop Vision Pro up to and including 9.7.2 allows an adjacent unauthenticated attacker to write to arbitrary memory potentially leading to a Denial of Service (DoS).
CVSS v3.1 score: 7.4
GHSA-x8xr-rm9r-7mvf OpenStack Compute (Nova) has Insufficient Verification of Data Authenticity
OpenStack Compute (Nova) before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket requests, which allows remote attackers to hijack the authentication of users for access to consoles via a crafted webpage.
CVE-2021-33087 
Improper authentication in the installer for the Intel(R) NUC M15 Laptop Kit Management Engine driver pack before version 15.0.10.1508 may allow an authenticated user to potentially enable denial of service via local access.
CVSS v3.1 score: 5.5
CVSS v2.0 score: 4.9
CVE-2024-13889 WordPress Importer <= 0.8.3 - Authenticated (Administrator+) PHP Object Injection
The WordPress Importer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 0.8.3 via deserialization of untrusted input in the 'maybe_unserialize' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
CVSS v3.1 score: 7.2
GHSA-w92x-9vr5-rfvc 
Fujian Kelixun <=7.6.6.4391 is vulnerable to SQL Injection in send_event.php.
CVSS v3.1 score: 9.8
CVE-2025-9032 Avira antivirus engine heap buffer OOB read when scanning a malformed PE file
Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed Windows PE file may allow Local Execution of Code or Denial-of-Service of the antivirus engine process.

This issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.70.98.
CVSS v3.1 score: 7.8
GHSA-ggx5-4f4f-6x9j 
SQL injection vulnerability in linking.page.php in Automated Link Exchange Portal allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.  NOTE: linking.page.php is commonly renamed to link.php, links.php, etc.
GHSA-3fj3-8v7h-68xh 
Improper access control vulnerability in ThemeManager prior to SMR May-2023 Release 1 allows local attackers to write arbitrary files with system privilege.
CVSS v3.1 score: 8.5
GHSA-6hgj-w9hw-g9j3 
In mdp driver, there is a possible memory corruption due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05836478; Issue ID: ALPS05836478.
CVE-2016-6693 
sound/soc/msm/qdsp6v2/msm-ds2-dap-config.c in a Qualcomm QDSP6v2 driver in Android before 2016-10-05 allows attackers to cause a denial of service or possibly have unspecified other impact via an invalid data length, aka Qualcomm internal bug CR 1027585.
CVSS v3.0 score: 9.8
CVSS v2.0 score: 7.5
GHSA-xqvv-5qpx-cjj8 
VMware ESXi (7.0 before ESXi70U1b-17168206, 6.7 before ESXi670-202011101-SG, 6.5 before ESXi650-202011301-SG), Workstation (15.x before 15.5.7), Fusion (11.x before 11.5.7) contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.
CVSS v3.1 score: 8.2