CIRCL/vulnerability-scores huggingface dataset:
CVE-2025-23634 WordPress Youtube Video Grid plugin <= 1.9 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codehandling Youtube Video Grid youmax-channel-embeds-for-youtube-businesses allows Reflected XSS.This issue affects Youtube Video Grid: from n/a through <= 1.9.
CVSS v3.1 score: 7.1
GHSA-j346-h5wc-rw2m Incorrect Authorization in Apache Solr
In Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any given collection. However, if a node receives a request for a collection it does not host, it proxies the request to a relevant node and serves the request. Solr bypasses all authorization settings for such requests. This affects all Solr versions prior to 6.6.6 and 7.7 that use the default authorization mechanism of Solr (RuleBasedAuthorizationPlugin).
CVSS v3.1 score: 4.3
GHSA-fjfh-7vp5-mmx8 
Clara Genomics Analysis before 0.2.0 has an integer overflow for cudapoa memory management in allocate_block.cpp.
CVSS v3.0 score: 9.8
CVE-2024-41691 Insecure Storage of Sensitive Information Vulnerability
This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to storing of FTP credentials in plaintext within the SquashFS-root filesystem associated with the router's firmware. An attacker with physical access could exploit this by extracting the firmware and reverse engineer the binary data to access the plaintext FTP credentials from the vulnerable system.

Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to the FTP server associated with the targeted system.
CVSS v4.0 score: 7
GHSA-22hf-vx2v-gjff 
In Apache Airflow before 3.3.0, the REST API task-instance detail and list
endpoints returned a deferred task's trigger kwargs without masking. When a
deferred operator passed a secret (for example a provider API key) into its
trigger, any authenticated user with DAG-scoped task-instance read access for
that DAG could read that secret in clear text while the task was deferred.
Users should upgrade to apache-airflow 3.3.0 or later, which masks sensitive
values in trigger kwargs returned by the API.
CVSS v3.1 score: 6.5
CVE-2025-14017 broken TLS options for threaded LDAPS
When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl,
changing TLS options in one thread would inadvertently change them globally
and therefore possibly also affect other concurrently setup transfers.

Disabling certificate verification for a specific transfer could
unintentionally disable the feature for other threads as well.
CVSS v3.1 score: 6.3
RHSA-2022:1702 Red Hat Security Advisory: firefox security update
Mozilla: Bypassing permission prompt in nested browsing contexts Mozilla: iframe Sandbox bypass Mozilla: Reader mode bypassed SameSite cookies Mozilla: Fullscreen notification bypass using popups Mozilla: Leaking browser history with CSS variables Mozilla: Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9
CVSS v3.1 score: 9.8
CVSS v3.0 score: 7.5
CVE-2021-1802 
A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave. A local attacker may be able to elevate their privileges.
CVSS v3.1 score: 7.8
CVSS v2.0 score: 4.6
CVE-2019-12274 
In Rancher 1 and 2 through 2.2.3, unprivileged users (if allowed to deploy nodes) can gain admin access to the Rancher management plane because node driver options intentionally allow posting certain data to the cloud. The problem is that a user could choose to post a sensitive file such as /root/.kube/config or /var/lib/rancher/management-state/cred/kubeconfig-system.yaml.
CVSS v3.0 score: 8.8
CVSS v2.0 score: 4
CVE-2026-65756 Joomla Extension - regularlabs.com - XSS vector in Keyboard Shortcuts extension
Joomla Extension - regularlabs.com - XSS vector in Keyboard Shortcuts extension - Shortcut configuration accepted arbitrary inline JavaScript.
CVSS v3.1 score: 6.1
CVE-2024-1400 Mollie Forms <= 2.6.3 - Missing Authorization to Arbitrary Post Duplication
The Mollie Forms plugin for WordPress is vulnerable to unauthorized post or page duplication due to a missing capability check on the duplicateForm function in all versions up to, and including, 2.6.3. This makes it possible for authenticated attackers, with subscriber access or higher, to duplicate arbitrary posts and pages.
CVSS v3.1 score: 4.3
CVE-2007-4815 
Multiple PHP remote file inclusion vulnerabilities in WebED in Markus Iser ED Engine 0.8999 alpha allow remote attackers to execute arbitrary PHP code via a URL in the Codebase parameter to (1) channeledit.php, (2) post.php, (3) view.php, or (4) viewitem.php in source/mod/rss/.
CVSS v2.0 score: 6.8
CVE-2007-1220 
The Hypervisor in Microsoft Xbox 360 kernel 4532 and 4548 does not properly verify the parameters passed to the syscall dispatcher, which allows attackers with physical access to bypass code-signing requirements and execute arbitrary code.
CVSS v2.0 score: 6.2
CVE-2021-23157 WECON LeviStudioU
WECON LeviStudioU Versions 2019-09-21 and prior are vulnerable to a heap-based buffer overflow, which may allow an attacker to remotely execute code.
CVSS v3.1 score: 7.8
GHSA-wgg4-4x3x-c77c 
A vulnerability was found in merikbest ecommerce-spring-reactjs up to 464e610bb11cc2619cf6ce8212ccc2d1fd4277fd. It has been rated as critical. Affected by this issue is some unknown functionality of the file /api/v1/admin/ of the component File Upload Endpoint. The manipulation of the argument filename leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 6.3
GHSA-348v-47hf-22wr 
In the Linux kernel, the following vulnerability has been resolved:drm/panthor: Fix UAF on kernel BO VA nodesIf the MMU is down, panthor_vm_unmap_range() might return an error.
We expect the page table to be updated still, and if the MMU is blocked,
the rest of the GPU should be blocked too, so no risk of accessing
physical memory returned to the system (which the current code doesn't
cover for anyway).Proceed with the rest of the cleanup instead of bailing out and leaving
the va_node inserted in the drm_mm, which leads to UAF when other
adjacent nodes are removed from the drm_mm tree.
CVSS v3.1 score: 7.8
GHSA-342x-54j8-cm6q 
Missing Authorization vulnerability in ValvePress Rankie allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Rankie: from n/a through 1.8.0.
CVSS v3.1 score: 4.3
CVE-2019-19066 
A memory leak in the bfad_im_get_stats() function in drivers/scsi/bfa/bfad_attr.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering bfa_port_get_stats() failures, aka CID-0e62395da2bd.
CVSS v3.1 score: 4.7
CVSS v2.0 score: 4.7
GHSA-ww45-hmjq-p5q2 
A vulnerability in the CLI of Cisco&nbsp;SD-WAN Software could allow an authenticated, local attacker to create or overwrite arbitrary files on an affected device, which could result in a denial of service (DoS) condition.
The vulnerability is due to insufficient input validation for specific commands. An attacker could exploit this vulnerability by including crafted arguments to those specific commands. A successful exploit could allow the attacker to create or overwrite arbitrary files on the affected device, which could result in a DoS condition.Cisco&nbsp;has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
CVSS v3.1 score: 8.4
GHSA-rjcp-8q3w-gjhq 
A flaw has been found in LeeSinLiang godot-mcp 0.1.0. Affected by this vulnerability is the function executeOperation of the file src/index.ts of the component create_scene/add_node. This manipulation of the argument projectPath causes command injection. The attack needs to be launched locally. The project was informed of the problem early through an issue report but has not responded yet.
CVSS v4.0 score: 1.9
CVSS v3.1 score: 5.3
GHSA-2fhw-2j7m-mr4m TYPO3 backend modules have Broken Access Control
Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules.
CVSS v4.0 score: 5.3
GHSA-8gpf-89wg-vgwp 
In Ceph before 12.2.3 and 13.x through 13.0.1, the rgw_civetweb.cc RGWCivetWeb::init_env function in radosgw doesn't handle malformed HTTP headers properly, allowing for denial of service.
CVSS v3.0 score: 7.5
CVE-2011-5320 
scanf and related functions in glibc before 2.15 allow local users to cause a denial of service (segmentation fault) via a large string of 0s.
CVSS v3.0 score: 6.2
CVSS v2.0 score: 2.1
CVE-2022-3828 Video Thumbnails <= 2.12.3 - Admin+ Stored XSS
The Video Thumbnails WordPress plugin through 2.12.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS v3.1 score: 4.8
CVE-2023-27999 
An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in FortiADC 7.2.0, 7.1.0 through 7.1.1 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands.
CVSS v3.1 score: 7.6
CVE-2024-13042 Tsinghua Unigroup Electronic Archives Management System download.html download information disclosure
A vulnerability was found in Tsinghua Unigroup Electronic Archives Management System 3.2.210802(62532). It has been classified as problematic. Affected is the function download of the file /Searchnew/Subject/download.html. The manipulation of the argument path leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 4.3
CVSS v3.0 score: 4.3
CVSS v2.0 score: 4
CVE-2023-24439 
Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier stores the private keys unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
CVSS v3.1 score: 5.5
GHSA-744v-4277-8vr5 
ltpmenu in ltp 20060918 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/runltp.mainmenu.##### temporary file.
GHSA-fcc8-j92h-q2f3 
In Joomla! before 3.9.14, a missing access check in framework files could lead to a path disclosure.
CVE-2024-12976 CodeZips Hospital Management System staff.php sql injection
A vulnerability, which was classified as critical, has been found in CodeZips Hospital Management System 1.0. Affected by this issue is some unknown functionality of the file /staff.php. The manipulation of the argument tel leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 7.3
CVSS v3.0 score: 7.3
CVSS v2.0 score: 7.5
CVE-2014-0770 Advantech WebAccess Stack-based Buffer Overflow
By providing an overly long string to the UserName parameter, an 
attacker may be able to overflow the static stack buffer. The attacker 
may then execute code on the target device remotely.
CVSS v2.0 score: 7.5
CVE-2014-7741 
The Healing Bookstore (aka com.wHealingBookstore) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0 score: 5.4
GHSA-8gjc-8wm2-3h6g 
Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Nicdark's Hotel Booking plugin <= 3.0 at WordPress.
CVSS v3.1 score: 5.4
GHSA-jg2j-f22p-jqh3 
The WISDOM (aka lvtu99.com.nescmxiaoniuniu) application 2.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
GHSA-9m3w-j6gp-86c9 
Cross-site scripting (XSS) vulnerability in public/index.php in BIGACE Web CMS 2.6 allows remote attackers to inject arbitrary web script or HTML via the id parameter.  NOTE: some of these details are obtained from third party information.
GHSA-322f-7555-6qf5 
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14.4. An app may be able to access a user's Photos Library.
CVSS v3.1 score: 7.5
CVE-2011-3128 
WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 treats unattached attachments as published, which might allow remote attackers to obtain sensitive data via vectors related to wp-includes/post.php.
CVSS v2.0 score: 5
CVE-2026-11625 Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes
Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes.

When an object is initialised before forking, or when the functional interface is used, then the internal state for the PRNG is shared across processes and identical random streams will be produced.

Secrets generated in multiprocess applications are predictable across processes.
CVSS v3.1 score: 7.5
GHSA-85mj-gq7p-m95w 
The embedded neutralization of Script-Related HTML Tag, was by-passed in the case of some extra conditions.
CVSS v3.1 score: 6.1
GHSA-95ch-mqcf-w529 
Insufficient control flow management in the Hyperscan Library maintained by Intel(R) before version 5.4.1 may allow an authenticated user to potentially enable denial of service via local access.
CVSS v3.1 score: 5.5
GHSA-xqqr-mq8x-22qx Jenkins JX Resources Plugin missing permission check
Jenkins jx-resources Plugin did not perform permission checks on a method implementing form validation. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified Kubernetes server and obtain information about an attacker-specified namespace. Doing so might also leak service account credentials used for the connection. Additionally, it allowed attackers to obtain the value of any attacker-specified environment variable for the Jenkins controller process.Additionally, this form validation method did not require POST requests, resulting in a cross-site request forgery vulnerability.This form validation method now requires POST requests and Overall/Administer permissions.
CVSS v3.0 score: 5.4
CVE-2023-31460 
A vulnerability in the Connect Mobility Router component of MiVoice Connect versions 9.6.2208.101 and earlier could allow an authenticated attacker with internal network access to conduct a command injection attack due to insufficient restriction on URL parameters.
CVSS v3.1 score: 7.2
GHSA-6w7q-qww7-p95w 
A vulnerability was found in GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate, GL-AX1800 Flint, GL-AXT1800 Slate AX, GL-B1300 Convexa-B, GL-B3000 Marble, GL-BE3600 Slate 7, GL-E750, GL-E750V2 Mudi, GL-MT300N-V2 Mango, GL-MT1300 Beryl, GL-MT2500 Brume 2, GL-MT3000 Beryl AX, GL-MT6000 Flint 2, GL-SFT1200 Opal, GL-X300B Collie, GL-X750 Spitz, GL-X3000 Spitz AX, GL-XE300 Puli and GL-XE3000 Puli AX 4.x. It has been declared as problematic. This vulnerability affects unknown code of the component API. The manipulation leads to inefficient regular expression complexity. It is recommended to upgrade the affected component.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 5.7
CVE-2024-43865 s390/fpu: Re-add exception handling in load_fpu_state()
In the Linux kernel, the following vulnerability has been resolved:

s390/fpu: Re-add exception handling in load_fpu_state()

With the recent rewrite of the fpu code exception handling for the
lfpc instruction within load_fpu_state() was erroneously removed.

Add it again to prevent that loading invalid floating point register
values cause an unhandled specification exception.
CVSS v3.1 score: 5.5
CVE-2024-47175 libppd's ppdCreatePPDFromIPP2 function does not sanitize IPP attributes when creating the PPD buffer
CUPS is a standards-based, open-source printing system, and `libppd` can be used for legacy PPD file support. The `libppd` function `ppdCreatePPDFromIPP2` does not sanitize IPP attributes when creating the PPD buffer. When used in combination with other functions such as `cfGetPrinterAttributes5`, can result in user controlled input and ultimately code execution via Foomatic. This vulnerability can be part of an exploit chain leading to remote code execution (RCE), as described in CVE-2024-47176.
CVSS v3.1 score: 8.6
CVE-2019-1153 Microsoft Graphics Component Information Disclosure Vulnerability
An information disclosure vulnerability exists when the Microsoft Windows Graphics Component improperly handles objects in memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system.
To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.
The update addresses the vulnerability by correcting the way in which the Windows Graphics Component handles objects in memory.
CVSS v3.1 score: 5.5
GHSA-pw6c-r98f-r37w 
Deserialization of Untrusted Data vulnerability in BoldThemes Travelicious travelicious allows Object Injection.This issue affects Travelicious: from n/a through < 1.6.7.
CVSS v3.1 score: 9.8
CVE-2016-3476 
Unspecified vulnerability in the Oracle Knowledge component in Oracle Siebel CRM 8.5.x allows remote attackers to affect confidentiality and integrity via vectors related to Information Manager Console.
CVSS v3.0 score: 6.5
CVSS v2.0 score: 6.4
CVE-2023-53955 SOUND4 IMPACT/FIRST/PULSE/Eco v2.x Authorization Bypass via Insecure Object References
SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an insecure direct object reference vulnerability that allows attackers to bypass authorization and access hidden system resources. Attackers can exploit the vulnerability by manipulating user-supplied input to execute privileged functionalities without proper authentication.
CVSS v4.0 score: 9.3
CVSS v3.1 score: 9.8
CVE-2024-45560 Time-of-check Time-of-use (TOCTOU) Race Condition in Camera
Memory corruption while taking a snapshot with hardware encoder due to unvalidated userspace buffer.
CVSS v3.1 score: 7.8
GHSA-xh6j-pwvm-gcgm 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in winking Affiliate Links Manager allows Reflected XSS. This issue affects Affiliate Links Manager: from n/a through 1.0.
CVSS v3.1 score: 5.8
CVE-2023-6931 Out-of-bounds write in Linux kernel's Performance Events system component
A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be exploited to achieve local privilege escalation.



A perf_event's read_size can overflow, leading to an heap out-of-bounds increment or write in perf_read_group().



We recommend upgrading past commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b.
CVSS v3.1 score: 7.8
GHSA-fmmf-42mh-hr4x 
Improper certificate validation and a time-of-check time-of-use (TOCTOU) race condition in the PrivilegedHelperTool XPC service in Cato Client before v.5.13.1 on macOS allows a local authenticated attacker to escalate privileges to root via a self-signed certificate that bypasses the XPC caller verification and a symlink swap during package installation.
CVSS v4.0 score: 6.4
GHSA-xjc5-mpgm-fw42 
PHP remote file include vulnerability in usermods.php in Tolva PHP website system 0.1.0 allows remote attackers to execute arbitrary code via a URL in the ROOT parameter.
CVE-2026-8054 Unauthenticated SQL Injection in dotCMS Publish Audit API
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in the Publish Audit API endpoints (/api/auditPublishing/get and /api/auditPublishing/getAll) in dotCMS Core 25.11.04-1 through 26.04.28-02 allows remote unauthenticated attackers to read, modify, or destroy arbitrary database content. The endpoints did not enforce authentication and accepted unsanitized input used in dynamically constructed SQL. The fix in dotCMS Core 26.04.28-03 requires an authenticated backend user with the publishing-queue portlet permission. LTS releases are not affected as the vulnerable code path was never backported.
CVSS v4.0 score: 10
GHSA-r557-wffq-wvrc @astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect
ImpactWith `trailingSlash: 'always'` configured, the `@astrojs/node` standalone server's static file handler appends a trailing slash to request paths and issues a `301` redirect. Paths beginning with `/\` (slash-backslash) were not recognized as internal paths, so the handler would echo the raw path back in the `Location` header. Because browsers treat `\` as `/` per the WHATWG URL specification, the resulting redirect could resolve to an external host.**Preconditions:**`trailingSlash: 'always'` must be set (non-default; the default is `'ignore'`)The request path must not have a file extension in its final segmentAn attacker must deliver the crafted link to a userPatchesFixed by treating backslash-prefixed paths the same as `//`-prefixed paths in `isInternalPath()`, so they are no longer rewritten with a trailing slash.WorkaroundsUse the default `trailingSlash: 'ignore'` setting, which does not issue trailing-slash redirects in the static file handler.References[WHATWG URL spec: backslash normalization](https://url.spec.whatwg.org/#url-parsing)
CVSS v4.0 score: 2.1
GHSA-c7m5-9695-pwwr 
CMS Made Simple (aka CMSMS) 2.2.7 has CSRF in admin/siteprefs.php.
CVSS v3.0 score: 8.8
GHSA-3f3w-4rvj-j62g 
Memory Corruption due to improper validation of array index in Linux while updating adn record.
CVSS v3.1 score: 6.7
GHSA-vq65-25j7-7m98 
OwenPoll 1.0 allows remote attackers to bypass authentication and obtain administrative access via a modified account name in the username cookie.
CVE-2025-29922 kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace
kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.26.3, the identified vulnerability allows creating or deleting an object via the APIExport VirtualWorkspace in any arbitrary target workspace for pre-existing resources. By design, this should only be allowed when the workspace owner decides to give access to an API provider by creating an APIBinding. With this vulnerability, it is possible for an attacker to create and delete objects even if none of these requirements are satisfied, i.e. even if there is no APIBinding in that workspace at all or the workspace owner has created an APIBinding, but rejected a permission claim. A fix for this issue has been identified and has been published with kcp 0.26.3 and 0.27.0.
CVSS v3.1 score: 9.6
RHSA-2020:4299 Red Hat Security Advisory: rh-python38 security, bug fix, and enhancement update
python-psutil: Double free because of refcount mishandling python: infinite loop in the tarfile module via crafted TAR archive python: DoS via inefficiency in IPv{4,6}Interface classes python: CRLF injection via HTTP request method in httplib/http.client python-urllib3: CRLF injection via HTTP request method
CVSS v3.1 score: 6.5
CVSS v3.0 score: 7
GHSA-g7wp-ccc5-wp8p 
A vulnerability, which was classified as critical, was found in PHPGurukul Dairy Farm Shop Management System 1.3. Affected is an unknown function of the file /profile.php. The manipulation of the argument mobilenumber leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 7.3
CVE-2024-3765 Xiongmai AHB7804R-MH-V2 Sofia Service access control
A vulnerability classified as critical was found in Xiongmai AHB7804R-MH-V2, AHB8004T-GL, AHB8008T-GL, AHB7004T-GS-V3, AHB7004T-MHV2, AHB8032F-LME and XM530_R80X30-PQ_8M. Affected by this vulnerability is an unknown functionality of the component Sofia Service. The manipulation with the input ff00000000000000000000000000f103250000007b202252657422203a203130302c202253657373696f6e494422203a202230783022207d0a leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260605 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v3.1 score: 9.8
CVSS v3.0 score: 9.8
CVSS v2.0 score: 10
CVE-2002-0667 
Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 has a default null administrator password, which could allow remote attackers to gain access to the phone.
CVSS v2.0 score: 10
GHSA-54wr-xmjg-j9mj 
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in BoxyStudio Booked - Appointment Booking for WordPress | Calendars.This issue affects Booked - Appointment Booking for WordPress | Calendars: from n/a before 2.4.4.
CVSS v3.1 score: 5.3
GHSA-gjc9-grw9-5m5q 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Qode Qi Blocks qi-blocks allows Stored XSS.This issue affects Qi Blocks: from n/a through <= 1.4.3.
CVSS v3.1 score: 6.5
CVE-2021-2464 
Vulnerability in Oracle Linux (component: OSwatcher). Supported versions that are affected are 7 and 8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Linux executes to compromise Oracle Linux. Successful attacks of this vulnerability can result in takeover of Oracle Linux. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS v3.1 score: 7.8
CVE-2012-1710 
Unspecified vulnerability in the Oracle WebCenter Forms Recognition component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Designer, a different vulnerability than CVE-2012-1709.
CVSS v3.1 score: 9.8
CVSS v2.0 score: 7.5
GHSA-76g9-vvww-9vvf 
A SQL injection vulnerability in SupplierDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via parameter searchTxt.
CVSS v3.1 score: 9.8
GHSA-48g9-h8v9-c2qm 
Untrusted search path vulnerability in XnView before 1.98.1 allows local users to gain privileges via a Trojan horse .exe file in a folder selected by the "Open containing folder" menu item.
GHSA-wh87-3959-vfrq Malicious Package in buffer-hor
Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.RecommendationRemove the package from your environment. Ensure no Ethereum funds were compromised.
CVSS v3.1 score: 9.8
GHSA-cc6j-mm94-2h5g 
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Ashish Ajani WordPress Simple HTML Sitemap plugin <= 2.1 versions.
CVSS v3.1 score: 6.5
CVE-2006-4436 
isakmpd in OpenBSD 3.8, 3.9, and possibly earlier versions, creates Security Associations (SA) with a replay window of size 0 when isakmpd acts as a responder during SA negotiation, which allows remote attackers to replay IPSec packets and bypass the replay protection.
CVSS v2.0 score: 5
GHSA-h73w-qq75-8f39 
Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 35739.
CVSS v3.0 score: 5.5
GHSA-xvw9-3mhm-xjqq Apache Airflow information disclosure vulnerability
Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an unauthorized actor to gain access to sensitive information in Connection edit view. This vulnerability is considered low since it requires someone with access to Connection resources specifically updating the connection to exploit it. Users should upgrade to version 2.6.3 or later which has removed the vulnerability.
CVSS v4.0 score: 7.1
CVSS v3.1 score: 6.5
CVE-2013-5962 
Unrestricted file upload vulnerability in frames/upload-images.php in the Complete Gallery Manager plugin before 3.3.4 rev40279 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/[year]/[month]/.
CVSS v2.0 score: 5.1
PYSEC-2022-10 
PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method.
CVE-2026-19005 nanocoai NanoClaw Child-Agent Creation create-agent.ts handleCreateAgent privileges management
A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. Affected is the function handleCreateAgent of the file src/modules/agent-to-agent/create-agent.ts of the component Child-Agent Creation. Performing a manipulation results in improper privilege management. Remote exploitation of the attack is possible. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 6.3
CVSS v3.0 score: 6.3
CVSS v2.0 score: 6.5
RHEA-2021:1906 Red Hat Enhancement Advisory: libyang bug fix and enhancement update
libyang: invalid memory access in resolve_feature_value() when a if-feature is used inside a bit libyang: invalid memory access when if-feature statement is used inside a list key node libyang: double-free in function yyparse() when empty description is used libyang: double-free in yyparse() when a type statement is used in a notification statement libyang: stack-overflow when parsing yang files with self-referential union types libyang: heap-based buffer over-read in function lys_type_free() due to malformed pattern libyang: double-free in yyparse() when organization field is not terminated libyang: NULL pointer dereference in function lys_extension_instances_free()
CVSS v3.1 score: 5.5
CVE-2024-4686 Campcodes Complete Web-Based School Management System emarks_range_grade_update_form.php cross site scripting
A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /view/emarks_range_grade_update_form.php. The manipulation of the argument grade leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263627.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 3.5
CVSS v3.0 score: 3.5
CVSS v2.0 score: 4
CVE-2026-20447 
In geniezone, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10724073; Issue ID: MSV-6296.
CVSS v3.1 score: 6.7
CVE-2017-12732 
A Stack-based Buffer Overflow issue was discovered in GE CIMPLICITY Versions 9.0 and prior. A function reads a packet to indicate the next packet length. The next packet length is not verified, allowing a buffer overwrite that could lead to an arbitrary remote code execution.
CVSS v3.0 score: 6.8
CVSS v2.0 score: 4.9
RHSA-2015:1852 Red Hat Security Advisory: thunderbird security update
Mozilla: Miscellaneous memory safety hazards (MFSA 2015-96) Mozilla: Use-after-free while manipulating HTML media content (MFSA 2015-106) Mozilla: Vulnerabilities found through code inspection (MFSA 2015-112) Mozilla: Dragging and dropping images exposes final URL after redirects (MFSA 2015-110) Mozilla: Errors in the handling of CORS preflight request headers (MFSA 2015-111) Mozilla: Vulnerabilities found through code inspection (MFSA 2015-112) Mozilla: Vulnerabilities found through code inspection (MFSA 2015-112) Mozilla: Vulnerabilities found through code inspection (MFSA 2015-112) Mozilla: Vulnerabilities found through code inspection (MFSA 2015-112) Mozilla: Vulnerabilities found through code inspection (MFSA 2015-112) Mozilla: Vulnerabilities found through code inspection (MFSA 2015-112) Mozilla: Vulnerabilities found through code inspection (MFSA 2015-112)
GHSA-cxvj-jx5h-9xf2 
An Unchecked Return Value to NULL Pointer Dereference vulnerability in Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). On SRX Series if Unified Threat Management (UTM) Enhanced Content Filtering (CF) and AntiVirus (AV) are enabled together and the system processes specific valid transit traffic the Packet Forwarding Engine (PFE) will crash and restart. This issue affects Juniper Networks Junos OS 21.4 versions prior to 21.4R1-S2, 21.4R2 on SRX Series. This issue does not affect Juniper Networks Junos OS versions prior to 21.4R1.
CVSS v3.1 score: 7.5
GHSA-xfjv-gcf8-3jqc 
Access control settings for forum post custom fields are not applied to the JSON output type, leading to an ACL violation vector an information disclosure
CVSS v4.0 score: 9.2
CVSS v3.1 score: 7.5
GHSA-9947-x7wp-628p 
Use after free in TabStrip in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.
CVE-2024-45290 Path traversal and Server-Side Request Forgery when opening XLSX files in PHPSpreadsheet
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. It's possible for an attacker to construct an XLSX file which links media from external URLs. When opening the XLSX file, PhpSpreadsheet retrieves the image size and type by reading the file contents, if the provided path is a URL. By using specially crafted `php://filter` URLs an attacker can leak the contents of any file or URL. Note that this vulnerability is different from GHSA-w9xv-qf98-ccq4, and resides in a different component. An attacker can access any file on the server, or leak information form arbitrary URLs, potentially exposing sensitive information such as AWS IAM credentials. This issue has been addressed in release versions 1.29.2, 2.1.1, and 2.3.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS v3.1 score: 7.7
CVE-2021-45599 
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects CBR40 before 2.5.0.24, CBR750 before 4.6.3.6, RBK852 before 3.2.17.12, RBR850 before 3.2.17.12, and RBS850 before 3.2.17.12.
CVSS v3.1 score: 8.4
GHSA-3q6g-vf58-7m4g Regular Expression Denial of Service in flask-restx
Flask RESTX contains a regular expression that is vulnerable to [ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS) (Regular Expression Denial of Service) in `email_regex`.
CVSS v4.0 score: 8.7
CVSS v3.1 score: 7.5
CVE-2026-42595 Gotenberg: Server-Side Request Forgery via Chromium URL Endpoint with Redirect-Based Deny-List Bypass
Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, Gotenberg's Chromium URL-to-PDF endpoint (/forms/chromium/convert/url) has no default protection against HTTP/HTTPS-based SSRF. The default deny-list regex only blocks file:// URIs. An unauthenticated attacker can point Chromium at any internal IP — including loopback, RFC 1918 ranges, and cloud metadata endpoints — and receive the response rendered as a PDF. Additionally, even when operators configure a custom deny-list, the protection is bypassed via HTTP redirects. Gotenberg's Chromium instance follows 302 redirects from an attacker-controlled external URL to internal targets without re-validating the redirect destination against the deny-list. This vulnerability is fixed in 8.32.0.
CVSS v3.1 score: 8.6
CVE-2023-40814 
OpenCRX version 5.2.0 is vulnerable to HTML injection via the Accounts Name Field.
CVSS v3.1 score: 6.1
CVE-2023-2491 
A flaw was found in the Emacs text editor. Processing a specially crafted org-mode code with the "org-babel-execute:latex" function in ob-latex.el can result in arbitrary command execution. This CVE exists because of a CVE-2023-28617 security regression for the emacs package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.
CVSS v3.1 score: 7.8
GHSA-r8gp-c62w-m7jr 
A vulnerability, which was classified as problematic, was found in TOTOLINK X2000R 1.0.0-B20230726.1108. This affects an unknown part of the file /boafrm/formFilter of the component URL Filtering Page. The manipulation of the argument URL Address leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0 score: 4.8
CVSS v3.1 score: 2.4
GHSA-fq8x-mrpc-mqxw 
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
CVSS v3.1 score: 7.8
RHSA-2019:4225 Red Hat Security Advisory: OpenShift Container Platform 4.1 openshift-external-storage security update
kubernetes-csi: CSI volume snapshot, cloning and resizing features can result in unauthorized volume data access or mutation
CVSS v3.0 score: 4.8
GHSA-f3wv-7jx9-8mxj 
Unknown vulnerability in pam_ldap before 180 does not properly handle a new password policy control, which could allow attackers to gain privileges.  NOTE: CVE-2005-2497 had also been assigned to this issue, but CVE-2005-2641 is the correct candidate.
GHSA-hcmr-mv5h-wj39 
The Apache 1.3.x HTTP server for Windows platforms allows remote attackers to list directory contents by requesting a URL containing a large number of / characters.
GHSA-m55h-2h99-7g5h 
In Moxa ioLogik 2500 series firmware, Version 3.0 or lower, and IOxpress configuration utility, Version 2.3.0 or lower, frequent and multiple requests for short-term use may cause the web server to fail.
GHSA-7f2f-ggqm-m223 
SQL injection vulnerability in the NinjaMonials (com_ninjacentral) component 1.1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the testimID parameter in a display action to index.php.
CVE-2024-8610 SourceCodester Best House Rental Management System New Tenant Page index.php cross site scripting
A vulnerability classified as problematic has been found in SourceCodester Best House Rental Management System 1.0. Affected is an unknown function of the file /index.php?page=tenants of the component New Tenant Page. The manipulation of the argument Last Name/First Name/Middle Name leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 3.5
CVSS v3.0 score: 3.5
CVSS v2.0 score: 4
GHSA-jwpw-ppj5-7h4w OpenStack Keystone Logs Passwords
OpenStack Identity (Keystone) before 2014.1.5 and 2014.2.x before 2014.2.4 logs the backend_argument configuration option content, which allows remote authenticated users to obtain passwords and other sensitive backend information by reading the Keystone logs.
GHSA-vq59-jw46-8pm8 
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x uses weak credential mechanism that could allow an attacker to easily calculate MQTT credentials.
CVSS v4.0 score: 8.7
CVSS v3.1 score: 7.5
GHSA-gpv3-f535-563w 
A Remote Code Execution vulnerability in HPE intelligent Management Center (iMC) PLAT version IMC Plat 7.3 E0504P2 and earlier was found.
CVSS v3.0 score: 9.8
GHSA-qp79-9v76-98gj 
SQL injection vulnerability in bluegate_seo.inc.php in the Direct URL module for xt:Commerce, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the coID parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVE-2022-4859 Joget User Profile Menu UserProfileMenu.java submitForm cross site scripting
A vulnerability, which was classified as problematic, has been found in Joget up to 7.0.33. This issue affects the function submitForm of the file wflow-core/src/main/java/org/joget/plugin/enterprise/UserProfileMenu.java of the component User Profile Menu. The manipulation of the argument firstName/lastName leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 7.0.34 is able to address this issue. The patch is named 9a77f508a2bf8cf661d588f37a4cc29ecaea4fc8. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217055.
CVSS v3.1 score: 3.5
CVSS v3.0 score: 3.5
CVSS v2.0 score: 4
CVE-2024-48694 
File Upload vulnerability in Xi'an Daxi Information technology OfficeWeb365 v.8.6.1.0 and v7.18.23.0 allows a remote attacker to execute arbitrary code via the pw/savedraw component.
CVSS v3.1 score: 9.8
CVE-2026-56046 WordPress ListingPro theme <= 2.9.11 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting (XSS) in ListingPro <= 2.9.11 versions.
CVSS v3.1 score: 6.5
CVE-2024-41926 Malicious remote can claim that a user was synced from another remote
Mattermost versions 9.9.x <= 9.9.0 and 9.5.x <= 9.5.6 fail to validate the source of sync messages and only allow the correct remote IDs, which allows a malicious remote to set arbitrary RemoteId values for synced users and therefore claim that a user was synced from another remote.
CVSS v3.1 score: 2.7
GHSA-xq3w-mm28-x95x 
Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have a Use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVSS v3.0 score: 9.8
CVE-2017-8368 
Sublime Text 3 Build 3126 allows user-assisted attackers to cause a denial of service or possibly have unspecified other impact via a crafted .mkv file. One threat model is a victim who obtains an untrusted crafted file from a remote location and issues several user-defined commands, as demonstrated by Ctrl-A, Delete, and Ctrl-Z.
CVSS v3.0 score: 7.8
CVSS v2.0 score: 6.8
GHSA-h4cr-6c88-hv52 
The BATBToken smart contract (address 0xfbf1388408670c02f0dbbb74251d8ded1d63b7a2, Compiler Version v0.8.26+commit.8a97fa7a) contains incorrect access control implementation in whitelist management functions. The setColdWhiteList() and setSpecialAddress() functions in the base ERC20 contract are declared as public without proper access control modifiers, allowing any user to bypass transfer restrictions and manipulate special address settings. This enables unauthorized users to circumvent cold time transfer restrictions and potentially disrupt dividend distribution mechanisms, leading to privilege escalation and violation of the contract's intended tokenomics.
CVSS v3.1 score: 9.1
GHSA-55f2-f95r-q833 
A vulnerability in Okta Verify for iOS versions 9.25.1 (beta) and 9.27.0 (including beta) allows push notification responses through the iOS ContextExtension feature allowing the authentication to proceed regardless of the user’s selection. When a user long-presses the notification banner and selects an option, both options allow the authentication to succeed. 
The ContextExtension feature is one of several push mechanisms available when using Okta Verify Push on iOS devices. The vulnerable flows include:When a user is presented with a notification on a locked screen, the user presses on the notification directly and selects their reply without unlocking the device;When a user is presented with a notification on the home screen and drags the notification down and selects their reply;When an Apple Watch is used to reply directly to a notification.A pre-condition for this vulnerability is that the user must have enrolled in Okta Verify while the Okta customer was using Okta Classic. This applies irrespective of whether the organization has since upgraded to Okta Identity Engine.
CVSS v3.1 score: 8.1
ICSA-26-043-07 Siemens Siveillance Video Management Servers
Missing Authorization vulnerability in Milestone Systems XProtect VMS allows users with read-only access to Management Server to have full read/write access to MIP Webhooks API.
CVSS v3.1 score: 6.3
CVE-2017-13185 
An information disclosure vulnerability in the Android media framework (libhevc). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-65123471.
CVSS v3.0 score: 9.1
CVSS v2.0 score: 8.5
GHSA-4hj7-qg65-92fp 
** DISPUTED ** The libfsntfs_attribute_read_from_mft function in libfsntfs_attribute.c in libfsntfs through 2018-04-20 allows remote attackers to cause an information disclosure (heap-based buffer over-read) via a crafted ntfs file. NOTE: the vendor has disputed this as described in libyal/libfsntfs issue 8 on GitHub.
CVSS v3.0 score: 5.5
CVE-2019-15693 
TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which occurs in TightDecoder::FilterGradient. Exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity.
CVSS v3.1 score: 7.2
CVSS v2.0 score: 6.5
CVE-2026-10941 
Out of bounds memory access in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS v3.1 score: 8.8
GHSA-p57h-3cmc-xpjq Python package "zhmcclient" stores passwords in clear text in its HMC and API logs
ImpactThe Python package "zhmcclient" writes password-like properties in clear text into its HMC and API logs in the following cases:The 'boot-ftp-password' and 'ssc-master-pw' properties when creating or updating a partition in DPM mode, in the zhmcclient API and HMC logsThe 'ssc-master-pw' and 'zaware-master-pw' properties when updating an LPAR in classic mode, in the zhmcclient API and HMC logsThe 'ssc-master-pw' and 'zaware-master-pw' properties when creating or updating an image activation profile in classic mode, in the zhmcclient API and HMC logsThe 'password' property when creating or updating an HMC user, in the zhmcclient API logThe 'bind-password' property when creating or updating an LDAP server definition, in the zhmcclient API and HMC logsThis issue affects only users of the zhmcclient package that have enabled the Python loggers named "zhmcclient.api" (for the API log) or "zhmcclient.hmc" (for the HMC log) and that use the functions listed above.PatchesHas been fixed in zhmcclient version 1.18.1WorkaroundsNot applicable, since fix is available.ReferencesNone
CVSS v4.0 score: 6.2
CVSS v3.1 score: 8.2
CVE-2017-3907 McAfee Threat Intelligence Exchange (TIE) Server - Code Injection vulnerability
Code Injection vulnerability in the ePolicy Orchestrator (ePO) extension in McAfee Threat Intelligence Exchange (TIE) Server 2.1.0 and earlier allows remote attackers to execute arbitrary HTML code to be reflected in the response web page via unspecified vector.
CVSS v3.0 score: 5.4
GHSA-8478-53pv-jxvm Joplin Vulnerable to Code Injection
Joplin prior to version 2.7.1 allows remote attackers to execute system commands through malicious code in user search results.
CVSS v3.1 score: 9.8
GHSA-mg2w-x76x-59h8 
openDCIM version 23.04, through commit 4467e9c4, contains a missing authorization vulnerability in install.php and container-install.php. The installer and upgrade handler expose LDAP configuration functionality without enforcing application role checks. Any authenticated user can access this functionality regardless of assigned privileges. In deployments where REMOTE_USER is set without authentication enforcement, the endpoint may be accessible without credentials. This allows unauthorized modification of application configuration.
CVSS v4.0 score: 9.3
CVSS v3.1 score: 8.8