CIRCL/vulnerability-scores huggingface dataset:
CVE-2003-0411 
Sun ONE Application Server 7.0 for Windows 2000/XP allows remote attackers to obtain JSP source code via a request that uses the uppercase ".JSP" extension instead of the lowercase .jsp extension.
CVSS v3.1 score: 7.5
CVSS v2.0 score: 5
GHSA-vrhf-cc97-jx2x 
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u343, 8u333, 11.0.15.1, 17.0.3.1, 18.0.1.1; Oracle GraalVM Enterprise Edition: 20.3.6, 21.3.2 and 22.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).
CVSS v3.1 score: 5.9
GHSA-pwwx-gm9f-wfwx 
A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The Tiff_Loader.dll library in affected applications lacks proper validation of user-supplied data when parsing TIFF files. This could result in an out of bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to leak information in the context of the current process. (ZDI-CAN-13198)
CVSS v3.1 score: 5.5
GHSA-8c2c-jxwj-jqgf Browsershot does not validate URL protocols passed to Browsershot URL method
Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the URL protocol passed to the Browsershot::url method.
CVSS v3.1 score: 8.2
GHSA-j94q-v897-c99w 
Buffer overflow in Apple Type Services (ATS) in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 allows remote attackers to execute arbitrary code via a long name of an embedded font in a document.
GHSA-xfjq-5m4w-cc6h Jenkins Beaker builder Plugin Missing Authorization vulnerability
Jenkins Beaker builder Plugin 1.10 and earlier does not perform a permission check in a method implementing form validation.This allows attackers with Overall/Read permission to connect to an attacker-specified URL.Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.As of publication of this advisory, there is no fix.
CVSS v3.1 score: 4.3
GHSA-w333-5f96-mjrr Drupal core Denial of Service
A visit to install.php can cause cached data to become corrupted. This could cause a site to be impaired until caches are rebuilt.
CVSS v3.1 score: 5.3
CVE-2011-0093 
ELEMENTS.DLL in Microsoft Visio 2002 SP2, 2003 SP3, and 2007 SP2 does not properly parse structures during the opening of a Visio file, which allows remote attackers to execute arbitrary code via a file containing a malformed structure, aka "Visio Data Type Memory Corruption Vulnerability."
CVSS v2.0 score: 9.3
GHSA-3w4r-prc4-q67c 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Agnel Waghela Shortcode Collection allows Stored XSS.This issue affects Shortcode Collection: from n/a through 1.4.
CVSS v3.1 score: 6.5
ICSA-25-350-03 Hitachi Energy AFS, AFR and AFF Series
The RADIUS protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid response (access-accept, access-reject, or access-challenge) to any other response using a chosen-prefix collision attack against the MD5 response authenticator signature.
CVSS v3.1 score: 9
GHSA-rgg5-4fcv-9382 
The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks.
CVSS v3.1 score: 5.9
GHSA-mfxc-mwgf-fr5h 
Use after free in WebRTC in Google Chrome prior to 77.0.3865.120 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
RHSA-2024:1278 Red Hat Security Advisory: kpatch-patch security update
kernel: UAF in nftables when nft_set_lookup_global triggered after handling named and anonymous sets in batch requests kernel: net/sched: sch_qfq component can be exploited if in qfq_change_agg function happens qfq_enqueue overhead kernel: net/sched: sch_hfsc UAF kernel: use-after-free in sch_qfq network scheduler kernel: use after free in nvmet_tcp_free_crypto in NVMe kernel: out-of-bounds write in qfq_change_class function kernel: nf_tables: stack-out-of-bounds-read in nft_byteorder_eval() kernel: IGB driver inadequate buffer size for frames larger than MTU kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination
CVSS v3.1 score: 7
GHSA-m96c-h623-g6w7 
Permissions vulnerability found in KiteCMS allows a remote attacker to execute arbitrary code via the upload file type.
CVSS v3.1 score: 9.8
GHSA-cpqc-m5vg-2rph 
Insecure Permission vulnerability found in Botkind/Siber Systems SyncApp v.19.0.3.0 allows a local attacker toe escalate privileges via the SyncService.exe file.
CVSS v3.1 score: 7.8
CVE-2024-54108 
Read/Write vulnerability in the image decoding module
Impact: Successful exploitation of this vulnerability will affect availability.
CVSS v3.1 score: 6.5
GHSA-82q8-fmjv-f526 
Stack-based buffer overflow in the code that sends images in Gadu-Gadu allows remote attackers to execute arbitrary code via a large image filename.
CVE-2021-40853 TCMAN GIM missing authorization vulnerability
TCMAN GIM does not perform an authorization check when trying to access determined resources. A remote attacker could exploit this vulnerability to access URL that require privileges without having them. The exploitation of this vulnerability might allow a remote attacker to obtain sensible information.
CVSS v3.1 score: 7.2
RHSA-2025:2754 Red Hat Security Advisory: Red Hat OpenShift Builds 1.3
openssl: RFC7250 handshakes with unauthenticated servers don't abort as expected emacs: Shell Injection Vulnerability in GNU Emacs via Custom "man" URI Scheme
CVSS v3.1 score: 8.8
PYSEC-2026-1226 
## Summary

In affected versions, ingestion paths construct file locations directly from untrusted `event_id` input without validation. A specially crafted `event_id` can result in paths outside the intended directory, potentially allowing file overwrite or creation in arbitrary locations.

Submitting such input requires access to a valid DSN. While that limits exposure, DSNs are sometimes discoverable—for example, when included in frontend code—and should not be treated as a strong security boundary.

## Impact

A valid DSN holder can craft an `event_id` that causes the ingestion process to write files outside its designated directory. This allows overwriting files accessible to the user running Bugsink.

If Bugsink runs in a container, the effect is confined to the container’s filesystem. In non-containerized setups, the overwrite may affect other parts of the system accessible to that user.

## Mitigation

Update to version `1.7.4`, `1.6.4`, `1.5.5` or `1.4.3` , which require `event_id` to be a valid UUID and normalizes it before use in file paths.
CVSS v4.0 score: 7.1
GHSA-p44r-3x7c-4h83 
Server-Side Request Forgery (SSRF) vulnerability in Podlove Podlove Podcast Publisher.This issue affects Podlove Podcast Publisher: from n/a through 4.0.11.
CVSS v3.1 score: 5.4
GHSA-25j8-p372-9f6w 
Stack-based buffer overflow in Xfig 3.2.4 and 3.2.5 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a FIG image with a crafted color definition.
GHSA-7jfg-qpxp-6grc 
Arobas Music Guitar Pro for iPad and iPhone before v1.10.2 allows attackers to perform directory traversal and download arbitrary files via a crafted web request.
CVSS v3.1 score: 7.5
GHSA-mr97-jqw9-fp77 
Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors related to 2D, a different vulnerability than CVE-2014-6591.
CVE-2021-28100 
Priam uses File.createTempFile, which gives the permissions on that file -rw-r--r--. An attacker with read access to the local filesystem can read anything written there by the Priam process.
CVSS v3.1 score: 5.5
CVSS v2.0 score: 2.1
RHBA-2022:1690 Red Hat Bug Fix Advisory: OpenShift Container Platform 4.10.13 bug fix update
openshift/router: route hijacking attack via crafted HAProxy configuration file
CVSS v3.1 score: 6.3
CVE-2018-4159 
An issue was discovered in certain Apple products. macOS before 10.13.5 is affected. The issue involves the "Graphics Drivers" component. It allows attackers to bypass intended memory-read restrictions via a crafted app.
CVSS v3.0 score: 5.5
CVSS v2.0 score: 4.3
CVE-2026-41455 WeKan < 8.35 SSRF via Webhook URL
WeKan before 8.35 contains a server-side request forgery vulnerability in webhook integration URL handling where the URL scheme field accepts any string without protocol restriction or destination validation. Attackers who can create or modify integrations can set webhook URLs to internal network addresses, causing the server to issue HTTP POST requests to attacker-controlled internal targets with full board event payloads, and can additionally exploit response handling to overwrite arbitrary comment text without authorization checks.
CVSS v4.0 score: 6.3
CVSS v3.1 score: 8.5
CVE-2026-48153 Budibase: SSRF via OAuth2 token endpoint URL reaches internal hosts and cloud metadata
Budibase is an open-source low-code platform. Prior to 3.39.0, fetchToken in the OAuth2 SDK makes a POST to a builder-supplied URL with plain node-fetch, skipping the blacklist.isBlacklisted check that every other outbound fetch path in the codebase uses. The Joi schema for the OAuth2 URL has no scheme or host restriction. This vulnerability is fixed in 3.39.0.
CVSS v3.1 score: 8.5
GHSA-wp3x-mhc9-hr54 
Bang Resto 1.0 was discovered to contain multiple SQL injection vulnerabilities via the btnMenuItemID, itemID, itemPrice, menuID, staffID, or itemqty parameter.
CVSS v3.1 score: 8.8
CVE-2024-37057 
Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.0.0rc0 or newer, enabling a maliciously uploaded Tensorflow model to run arbitrary code on an end user’s system when interacted with.
CVSS v3.1 score: 8.8
GHSA-j227-6vx8-v4r3 
Multiple SQL injection vulnerabilities in Open Bulletin Board (OpenBB) allow remote attackers to execute arbitrary SQL commands via the (1) FID parameter to board.php or (2) UID parameter to member.php.
RHSA-2013:1536 Red Hat Security Advisory: libguestfs security, bug fix, and enhancement update
libguestfs: insecure temporary directory handling for guestfish's network socket
GHSA-vwm5-j2mm-8pxx 
Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with task creation
CVSS v3.1 score: 4.6
CVE-2006-7097 
Multiple unspecified vulnerabilities in TaskFreak! before 0.1.4 have unknown impact and attack vectors.
CVSS v2.0 score: 10
CVE-2017-7730 
iSmartAlarm cube devices allow Denial of Service. Sending a SYN flood on port 12345 will freeze the "cube" and it will stop responding.
CVSS v3.1 score: 7.5
CVSS v2.0 score: 7.8
GHSA-rv3g-ccr2-88vh 
Missing Authorization vulnerability in wedos.com WEDOS Global allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects WEDOS Global: from n/a through 1.2.2.
CVSS v3.1 score: 5.3
CVE-2009-1962 
Xfig, possibly 3.2.5, allows local users to read and write arbitrary files via a symlink attack on the (1) xfig-eps[PID], (2) xfig-pic[PID].pix, (3) xfig-pic[PID].err, (4) xfig-pcx[PID].pix, (5) xfig-xfigrc[PID], (6) xfig[PID], (7) xfig-print[PID], (8) xfig-export[PID].err, (9) xfig-batch[PID], (10) xfig-exp[PID], or (11) xfig-spell.[PID] temporary files, where [PID] is a process ID.
CVSS v2.0 score: 4.4
CVE-2026-33212 Weblate: Improper access control for pending tasks in API
Weblate is a web based localization tool. In versions prior to 5.17, the tasks API didn't verify user access for pending tasks. This could expose logs of in-progress operations to users who don't have access to given scope. The attacker needs to brute-force the random UUID of the task, so exploiting this is unlikely with the default API rate limits. This issue has been fixed in version 5.17.
CVSS v3.1 score: 3.1
GHSA-3fqc-qp8w-rr4h 
A vulnerability in Zoom On-Premise Meeting Connector Controller version 4.8.102.20220310 and On-Premise Meeting Connector MMR version 4.8.102.20220310 exposes process memory fragments to connected clients, which could be observed by a passive attacker.
CVSS v3.1 score: 7.5
CVE-2021-36181 
A concurrent execution using shared resource with improper Synchronization vulnerability ('Race Condition') in the customer database interface of FortiPortal before 6.0.6 may allow an authenticated, low-privilege user to bring the underlying database data into an inconsistent state via specific coordination of web requests.
CVSS v3.1 score: 3.1
CVE-2018-0200 
A vulnerability in the web-based interface of Cisco Prime Service Catalog could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based interface of an affected product. The vulnerability is due to insufficient validation of user-supplied input by the web-based interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvh65713.
CVSS v3.0 score: 6.1
CVSS v2.0 score: 4.3
GHSA-5wwj-v2p5-cmh2 
IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!ShowPlugInSaveOptions_W+0x000000000001bcab.
CVSS v3.1 score: 7.8
CVE-2024-45493 
An issue was discovered in MSA FieldServer Gateway 5.0.0 through 6.5.2 (Fixed in 7.0.0). The FieldServer Gateway has internal users, whose access is supposed to be restricted to login locally on the device. However, an attacker can bypass the check for this, which might allow them to authenticate with an internal user account from the network (if they know their password).
CVSS v3.1 score: 9.8
GHSA-crx8-mq4w-pqc9 
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows local users to affect confidentiality via unknown vectors related to printing on Solaris or Linux.
GHSA-v5qr-hv4h-xr6g 
Missing Authorization vulnerability in Jeroen Schmit Theater for WordPress theatre allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Theater for WordPress: from n/a through <= 0.19.
CVSS v3.1 score: 4.3
CVE-2019-19737 
MFScripts YetiShare 3.5.2 through 4.5.3 does not set the SameSite flag on session cookies, allowing the cookie to be sent in cross-site requests and potentially be used in cross-site request forgery attacks.
CVSS v3.1 score: 8.8
CVSS v2.0 score: 6.8
GHSA-43mr-gg87-qwf3 
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 under very specific conditions, could allow a local user to keep running a procedure that could cause the system to run out of memory.and cause a denial of service. IBM X-Force ID: 202267.
CVE-2018-1935 
IBM Connections 5.0, 5.5, and 6.0 could allow an authenticated user to obtain sensitive information from invalid request error messages. IBM X-Force ID: 153315.
CVSS v3.0 score: 4.3
CVE-2023-27783 
An issue found in TCPreplay tcprewrite v.4.4.3 allows a remote attacker to cause a denial of service via the tcpedit_dlt_cleanup function at plugins/dlt_plugins.c.
CVSS v3.1 score: 7.5
GHSA-92wp-6hhw-34wq 
In TP-LINK TL-WR741N / TL-WR741ND 150M Wireless Lite N Router with Firmware Version 3.11.7 Build 100603 Rel.56412n and Hardware Version: WR741N v1/v2 00000000, parameter SSID in the "Wireless Settings" is not properly validated. It's possible to inject malicious code: </script><H1>BUG/* </script><a href=XXX.com>. The second payload blocks the change of wireless settings. A factory reset is required.
CVSS v3.0 score: 6.5
GHSA-5p8c-xff7-r336 
stb stb_image.h 2.19, as used in catimg, Emscripten, and other products, has a heap-based buffer overflow in the stbi__out_gif_code function.
CVSS v3.1 score: 8.8
CVE-2016-10115 
NETGEAR Arlo base stations with firmware 1.7.5_6178 and earlier, Arlo Q devices with firmware 1.8.0_5551 and earlier, and Arlo Q Plus devices with firmware 1.8.1_6094 and earlier have a default password of 12345678, which makes it easier for remote attackers to obtain access after a factory reset or in a factory configuration.
CVSS v3.0 score: 9.8
CVSS v2.0 score: 10
CVE-2014-2361 OleumTech WIO Family Key Management Errors
OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules, when BreeZ is used, do not require authentication for reading the site security key, which allows physically proximate attackers to spoof communication by obtaining this key after use of direct hardware access or manual-setup mode.
CVSS v2.0 score: 7.2
GHSA-73gm-rwrw-qwv2 
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-0945, CVE-2018-0946, CVE-2018-0951, CVE-2018-0954, CVE-2018-0955, CVE-2018-1022, CVE-2018-8114, CVE-2018-8122, CVE-2018-8128, CVE-2018-8137, CVE-2018-8139.
CVSS v3.0 score: 7.5
GHSA-f5c3-fr66-f3j2 
A CWE-190: Integer Overflow or Wraparound vulnerability exists that could cause heap-based buffer overflow, leading to denial of service and potentially remote code execution when an attacker sends multiple specially crafted messages. Affected Product: Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior)
CVE-2025-0759 IBM EntireX race condition
IBM EntireX 11.1 could allow a local user to unintentionally modify data timestamp integrity due to improper shared resource synchronization.
CVSS v3.1 score: 3.3
GHSA-wg35-8jpf-2xv3 Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources.
Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources.More precisely, an application can be vulnerable when all the following are true:the application is using Spring MVC or Spring WebFluxthe application is configuring the  resource chain support https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title  with caching enabledthe application adds support for encoded resources resolutionthe resource cache must be empty when the attacker has access to the applicationWhen all the conditions above are met, the attacker can send malicious requests and poison the resource cache with resources using the wrong encoding. This can cause a denial of service by breaking the front-end application for clients.
CVSS v3.1 score: 3.1
GHSA-cfpj-3q4c-jhvr Division by zero in TFLite
ImpactThe implementation of fully connected layers in TFLite is [vulnerable to a division by zero error](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/lite/kernels/fully_connected.cc#L226):An attacker can craft a model such that `filter->dims->data[1]` is 0.PatchesWe have patched the issue in GitHub commit [718721986aa137691ee23f03638867151f74935f](https://github.com/tensorflow/tensorflow/commit/718721986aa137691ee23f03638867151f74935f).The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.For more informationPlease consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.AttributionThis vulnerability has been reported by members of the Aivul Team from Qihoo 360. Concurrently, it has also been reported by Yakun Zhang of Baidu Security.
CVSS v4.0 score: 6.8
CVSS v3.1 score: 5.5
CVE-2023-20910 
In add of WifiNetworkSuggestionsManager.java, there is a possible way to trigger permanent DoS due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.


CVSS v3.1 score: 5.5
GHSA-v2hf-gpg2-hm9f 
Unspecified vulnerability in Gyach Enhanced (Gyach-E) before 1.0.4 allows remote attackers to cause a denial of service (crash) via conference packets with error messages.
CVE-2019-11157 
Improper conditions check in voltage settings for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege and/or information disclosure via local access.
CVSS v3.1 score: 6.7
CVSS v2.0 score: 4.6
CVE-2026-5485 OS command injection in Amazon Athena ODBC driver on Linux
OS command injection in the browser-based authentication component in Amazon Athena ODBC driver before 2.0.5.1 on Linux might allow a threat actor to execute arbitrary code by using specially crafted connection parameters that are loaded by the driver during a local user-initiated connection.

To remediate this issue, users should upgrade to version 2.0.5.1 or later.
CVSS v4.0 score: 7.3
CVSS v3.1 score: 7.8
CVE-2010-5076 
QSslSocket in Qt before 4.7.0-rc1 recognizes a wildcard IP address in the subject's Common Name field of an X.509 certificate, which might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.
CVSS v2.0 score: 4.3
GHSA-j947-jfqc-5v3q 
In tmu_get_tr_thresholds, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1 score: 6.7
CVE-2009-2290 
SQL injection vulnerability in the Boy Scout Advancement (com_bsadv) component 0.3 and earlier for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a (1) account or (2) event task to index.php.
CVSS v2.0 score: 7.5
GHSA-mf5j-wgq9-9jj2 
An issue was discovered in Int15MicrocodeSmm in Insyde InsydeH2O before 2021-10-14 on Intel client chipsets. A caller may be able to escalate privileges.
CVSS v3.1 score: 9.8
GHSA-3j3h-76gf-gffm 
OutSystems Platform 10 through 11 allows ImageResourceDetail.aspx CSRF for content modifications and file uploads. NOTE: the product is self-hosted by the customer, even though it has a *.outsystemsenterprise.com domain name.)
CVSS v3.1 score: 6.5
GHSA-mhwx-cv4j-f56v 
Stack-based buffer overflow in javaws.exe in Sun Java Web Start in JRE 5.0 Update 11 and earlier, and 6.0 Update 1 and earlier, allows remote attackers to execute arbitrary code via a long codebase attribute in a JNLP file.
GHSA-px94-7h5c-q5wh 
A Cross Site Scripting vulnerability in CloudClassroom-PHP Project v1.0 allows a remote attacker to execute arbitrary code via the exid parameter of the assessment function.
CVSS v3.1 score: 6.1
GHSA-9pm8-xcj6-2m33 Missing Authorization in TYPO3 extension
The direct_mail extension through 5.2.3 for TYPO3 has Broken Access Control for newsletter subscriber tables.
CVSS v3.1 score: 4.3
CVE-2017-7028 
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. macOS before 10.12.6 is affected. tvOS before 10.2.2 is affected. watchOS before 3.2.3 is affected. The issue involves the "Kernel" component. It allows attackers to bypass intended memory-read restrictions via a crafted app.
CVSS v3.0 score: 5.5
CVSS v2.0 score: 4.3
CVE-2020-3251 Multiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big Data
Multiple vulnerabilities in the REST API of Cisco UCS Director and Cisco UCS Director Express for Big Data may allow a remote attacker to bypass authentication or conduct directory traversal attacks on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS v3.0 score: 9.8
GHSA-q86r-gwqc-jx85 Liferay Portal JSON Web Services Direct Class Invocation Enables Service Access Policy Execution
JSON Web Services in Liferay Portal 7.4.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.9, 7.4 GA through update 92 published to OSGi are registered and invoked directly as classes which allows Service Access Policies to get executed.
CVSS v4.0 score: 1
CVE-2020-14105 
The application in the mobile phone can read the SNO information of the device, Xiaomi 10 MIUI < 2020.01.15.
CVSS v3.1 score: 5.5
CVSS v2.0 score: 2.1
CVE-2005-4269 
mshtml.dll in Microsoft Windows XP, Server 2003, and Internet Explorer 6.0 SP1 allows attackers to cause a denial of service (access violation) by causing mshtml.dll to process button-focus events at the same time that a document is reloading, as seen in Microsoft Office InfoPath 2003 by repeatedly clicking the "Delete" button in a repeating section in a form.  NOTE: the normal operation of InfoPath appears to involve a local user without any privilege boundaries, so this might not be a vulnerability in InfoPath.  If no realistic scenarios exist for this problem in other products, then perhaps it should be excluded from CVE.
CVSS v2.0 score: 7.8
GHSA-4gfx-85vx-rrgg 
Weak Password Recovery Mechanism for Forgotten Password vulnerability in Hossein Material Dashboard. This issue affects Material Dashboard: from n/a through 1.4.6.
CVSS v3.1 score: 9.8
CVE-2024-4427 Comparison Slider <= 1.0.5 - Missing Authorization
The Comparison Slider plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX actions in all versions up to, and including, 1.0.5. This makes it possible for authenticated attackers, with subscriber access or above, to change plugin settings and perform other actions such deleting sliders.
CVSS v3.1 score: 4.3
CVE-2026-45468 Microsoft SharePoint Server Spoofing Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVSS v3.1 score: 4.6
RHSA-2018:2684 Red Hat Security Advisory: .NET Core Runtime 2.1.4 and SDK 2.1.402 for Red Hat Enterprise Linux
Updates for rh-dotnet21 and rh-dotnet21-dotnet are now available for .NET Core on Red Hat Enterprise Linux.

Red Hat Product Security has rated this update as having a security impact of Low.
ICSA-16-348-01 Visonic PowerLink2 Vulnerabilities
An issue was discovered in Visonic PowerLink2, all versions prior to October 2016 firmware release. User controlled input is not neutralized prior to being placed in web page output (CROSS-SITE SCRIPTING). An issue was discovered in Visonic PowerLink2, all versions prior to October 2016 firmware release. When a specific URL to an image is accessed, the downloaded image carries with it source code used in the web server (INFORMATION EXPOSURE).
CVSS v3.0 score: 5.3
GHSA-fqqp-7v7w-5xhp 
A vulnerability was identified in Bjskzy Zhiyou ERP up to 11.0. Affected by this vulnerability is the function openForm of the component com.artery.richclient.RichClientService. Such manipulation of the argument contentString leads to xml external entity reference. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0 score: 5.5
CVSS v3.1 score: 7.3
CVE-2010-2320 
bozotic HTTP server (aka bozohttpd) before 20100621 allows remote attackers to list the contents of home directories, and determine the existence of user accounts, via multiple requests for URIs beginning with /~ sequences.
CVSS v2.0 score: 5
GHSA-vh27-7qvw-fwfm 
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Paytm Paytm Payment Gateway paytm-payments allows SQL Injection.This issue affects Paytm Payment Gateway: from n/a through 2.7.3.
CVSS v3.1 score: 9.8
PYSEC-2026-1716 
### Impact

OctoPrint versions up to and including 1.11.5 are affected by a (theoretical) timing attack vulnerability that allows API key extraction over the network.

Due to using character based comparison that short-circuits on the first mismatched character during API key validation, rather than a cryptographical method with static runtime regardless of the point of mismatch, an attacker with network based access to an affected OctoPrint could extract API keys valid on the instance by measuring the response times of the denied access responses and guess an API key character by character.

### Patches

The vulnerability will be patched in version 1.11.6.

### Workaround

The likelihood of this attack actually working is highly dependent on the network's latency, noise and similar parameters. An actual proof of concept was not achieved so far. Still, as always administrators are advised to not expose their OctoPrint instance on hostile networks, especially not on the public Internet!

### Credits

This vulnerability was discovered and responsibly disclosed to OctoPrint by [Knox Liu](https://github.com/yueyueL).
CVSS v4.0 score: 6
CVSS v3.1 score: 5.9
GHSA-f8vc-wfc8-hxqh Improper Privilege Management in Apache Hadoop
In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and 2.0.0-alpha to 2.10.0, WebHDFS client might send SPNEGO authorization header to remote URL without proper verification.
CVSS v3.1 score: 8.8
CVE-2025-61617 
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed
CVSS v3.1 score: 7.5
GHSA-f3cv-gjqx-mcfh 
The init_nss_hash function in exec/totemcrypto.c in Corosync 2.0 before 2.3 does not properly initialize the HMAC key, which allows remote attackers to cause a denial of service (crash) via a crafted packet.
CVE-2025-23960 WordPress Save & Import Image from URL Plugin <= 0.7 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in basteln3rk Save & Import Image from URL save-import-image-from-url allows Reflected XSS.This issue affects Save & Import Image from URL: from n/a through <= 0.7.
CVSS v3.1 score: 7.1
CVE-2026-29061 Gokapi: Privilege escalation via incomplete API-key permission revocation on user rank demotion
Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, a privilege escalation vulnerability in the user rank demotion logic allows a demoted user's existing API keys to retain ApiPermManageFileRequests and ApiPermManageLogs permissions, enabling continued access to upload-request management and log viewing endpoints after the user has been stripped of all privileges. This issue has been patched in version 2.2.3.
CVSS v3.1 score: 5.4
CVE-2025-26594 X.org: xwayland: use-after-free of the root cursor
A use-after-free flaw was found in X.Org and Xwayland. The root cursor is referenced in the X server as a global variable. If a client frees the root cursor, the internal reference points to freed memory and causes a use-after-free.
CVSS v3.1 score: 7.8
GHSA-878w-7gxp-mc63 SQL Injection in Spring Cloud Task
In applications using Spring Cloud Task 2.2.4.RELEASE and below, may be vulnerable to SQL injection when exercising certain lookup queries in the TaskExplorer.
CVSS v3.1 score: 6
GHSA-j8mg-pqc5-x9gj MLFlow unsafe deserialization
Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.0.0rc0 or newer, enabling a maliciously uploaded Tensorflow model to run arbitrary code on an end user’s system when interacted with.
CVSS v3.1 score: 8.8
CVE-2014-5382 
Multiple cross-site scripting (XSS) vulnerabilities in the web interface in Schrack Technik microControl with firmware 1.7.0 (937) allow remote attackers to inject arbitrary web script or HTML via the position textbox in the configuration menu or other unspecified vectors.
CVSS v2.0 score: 4.3
CVE-2023-34418 
A valid, authenticated LXCA user may be able to gain unauthorized access to events and other data stored in LXCA due to a SQL injection vulnerability in a specific web API.
CVSS v3.1 score: 8.1
CVE-2025-3724 PCMan FTP Server DIR Command buffer overflow
A vulnerability was found in PCMan FTP Server 2.0.7. It has been classified as critical. Affected is an unknown function of the component DIR Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 7.3
CVSS v3.0 score: 7.3
CVSS v2.0 score: 7.5
CVE-2017-14608 
In LibRaw through 0.18.4, an out of bounds read flaw related to kodak_65000_load_raw has been reported in dcraw/dcraw.c and internal/dcraw_common.cpp. An attacker could possibly exploit this flaw to disclose potentially sensitive memory or cause an application crash.
CVSS v3.0 score: 9.1
CVSS v2.0 score: 6.4
CVE-2010-2268 
Cross-site request forgery (CSRF) vulnerability in authcfg.cgi in Accoria Web Server (aka Rock Web Server) 1.4.7 allows remote attackers to hijack the authentication of administrators for requests that create user accounts.
CVSS v2.0 score: 6.8
GHSA-63j3-rvrp-pj79 
FTP Shell Server 6.83 contains a buffer overflow vulnerability in the 'Account name to ban' field that allows local attackers to execute arbitrary code by supplying a crafted string. Attackers can inject shellcode through the account name parameter in the Manage FTP Accounts dialog to overwrite the return address and execute calc.exe or other commands.
CVSS v4.0 score: 8.6
CVSS v3.1 score: 8.4
GHSA-683j-m88c-27m5 
Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-6348.
GHSA-mwf5-g33g-h3m5 
An issue was discovered in Mattermost Server before 5.8.0, when Town Square is set to Read-Only. Users can pin or unpin a post.
CVE-2025-57874 BUG-000161627 - Reflected XSS vulnerability in Portal for ArcGIS.  (11.3, 11.1, 10.9.1)
There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string which would execute arbitrary JavaScript code in the  browser.
CVSS v3.1 score: 4.8
GHSA-gv3x-jp82-23cx 
SQL injection vulnerability in the Address visualization with Google Maps (st_address_map) extension before 0.3.6 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
GHSA-8f7q-x4r8-9427 
A maliciously crafted PDF file in Autodesk Navisworks 2019, 2020, 2021, 2022 can be forced to read beyond allocated boundaries when parsing the PDF file. This vulnerability can be exploited to execute arbitrary code.
CVE-2020-23374 
Cross-site scripting (XSS) vulnerability in admin/article/add.html in noneCMS v1.3.0 allows remote authenticated attackers to inject arbitrary web script or HTML via the name parameter.
CVSS v3.1 score: 5.4
CVSS v2.0 score: 3.5
RHSA-2015:1485 Red Hat Security Advisory: java-1.7.1-ibm security update
JDK: plain text data stored in memory dumps OpenJDK: deserialization issue in ObjectInputStream.readSerialData() (Libraries, 8076401) OpenJDK: non-constant time comparisons in crypto code (JCE, 8074865) JCE: missing EC parameter validation in ECDH_Derive() (OpenJDK JCE, 8075833) JDK: unspecified vulnerability fixed in 7u85 and 8u51 (2D) OpenJDK: incorrect code permission checks in RMIConnectionImpl (JMX, 8075853) OpenJDK: name for reverse DNS lookup used in certificate identity check (JSSE, 8067694) ICU: integer overflow in LETableReference verifyLength() (OpenJDK 2D, 8077520) JDK: unspecified vulnerability fixed in 6u101, 7u85 and 8u51 (2D) JDK: unspecified vulnerability fixed in 6u101, 7u85 and 8u51 (2D) JDK: unspecified vulnerability fixed in 6u101, 7u85 and 8u51 (Deployment) LOGJAM: TLS connections which support export grade DHE key-exchange are vulnerable to MITM attacks JDK: unspecified vulnerability fixed in 7u85 and 8u51 (Deployment) OpenJDK: improper permission checks in MBeanServerInvocationHandler (JMX, 8076397) OpenJDK: insufficient context checks during object deserialization (Libraries, 8076405) OpenJDK: RemoteObjectInvocationHandler allows calling finalize() (RMI, 8076409) JDK: unspecified vulnerability fixed in 7u85 and 8u51 (Deployment) OpenJDK: incorrect OCSP nextUpdate checking (Libraries, 8075374) OpenJDK: DnsClient fails to release request information after error (JNDI, 8075378) ICU: missing boundary checks in layout engine (OpenJDK 2D, 8071715)
CVSS v3.0 score: 3.7
CVE-2024-7060 Exposure of Sensitive Information to an Unauthorized Actor in GitLab
An information disclosure vulnerability in GitLab CE/EE in project/group exports affecting all versions from 15.4 prior to 17.0.5, 17.1 prior to 17.1.3, and 17.2 prior to 17.2.1 allows unauthorized users to view the resultant export.
CVSS v3.1 score: 2.6
PYSEC-2026-3038 
### Summary

A denial of service vulnerability exists when parsing crafted `multipart/form-data` requests with large preamble or epilogue sections.

### Details

Two inefficient multipart parsing paths could be abused with attacker-controlled input.

Before the first multipart boundary, the parser handled leading CR and LF bytes inefficiently while searching for the start of the first part. After the closing boundary, the parser continued processing trailing epilogue data instead of discarding it immediately. As a result, parsing time could grow with the size of crafted data placed before the first boundary or after the closing boundary.

### Impact

An attacker can send oversized malformed multipart bodies that consume excessive CPU time during request parsing, reducing request-handling capacity and delaying legitimate requests. This issue degrades availability but does not typically result in a complete denial of service for the entire application.

### Mitigation

Upgrade to version `0.0.26` or later, which skips ahead to the next boundary candidate when processing leading CR/LF data and immediately discards epilogue data after the closing boundary.
CVSS v3.1 score: 5.3
GHSA-qgg8-99p6-v8v8 
LG SuperSign CMS allows remote attackers to execute arbitrary code via the sourceUri parameter to qsr_server/device/getThumbnail.
CVSS v3.0 score: 9.8
CVE-2026-47324 Stored XSS in Multiple Points in ProjectsAndPrograms school-management-system
ProjectsAndPrograms school-management-system is vulnerable to Stored Cross‑Site Scripting (XSS) in multiple attributes of students and teachers objects. An authorized attacker (e.g., a teacher or administrator) can inject malicious JavaScript that is subsequently executed in other users’ browsers.
Critically, when chained with CVE‑2025‑11661, which allows unauthenticated access to backend endpoints, this vulnerability can be exploited by a remote attacker without privileges to inject and execute arbitrary JavaScript.

The maintainers were notified early about this vulnerability but did not provide details regarding affected versions. The version corresponding to commit 6b6fae5 was tested and confirmed vulnerable; other versions were not tested and may also be affected.
CVSS v4.0 score: 5.1
CVE-2024-9793 Tenda AC1206 ate ate_ifconfig_set command injection
A vulnerability classified as critical was found in Tenda AC1206 up to 15.03.06.23. This vulnerability affects the function ate_iwpriv_set/ate_ifconfig_set of the file /goform/ate. The manipulation leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 6.3
CVSS v3.0 score: 6.3
CVSS v2.0 score: 6.5
GHSA-474x-3vv5-5q3g 
A Reflected Cross Site Scripting (XSS) vulnerability was found in /smsa/student_login.php in Kashipara Responsive School Management System v3.2.0, which allows remote attackers to execute arbitrary code via "error" parameter.
CVSS v3.1 score: 5.5
CVE-2025-54390 
A Cross-Site Request Forgery (CSRF) vulnerability exists in the ResetPasswordRequest operation of Zimbra Collaboration (ZCS) when the zimbraFeatureResetPasswordStatus attribute is enabled. An attacker can exploit this by tricking an authenticated user into visiting a malicious webpage that silently sends a crafted SOAP request to reset the user's password. The vulnerability stems from a lack of CSRF token validation on the endpoint, allowing password resets without the user's consent.
CVSS v3.1 score: 6.3
CVE-2021-4461 Seeyon Zhiyuan OA Web Application System < 7.0 SP1 Authentication Bypass
Seeyon Zhiyuan OA Web Application System versions up to and including 7.0 SP1 improperly decode and parse the `enc` parameter in thirdpartyController.do. The decoded map values can influence session attributes without sufficient authentication/authorization checks, enabling attackers to assign a session to arbitrary user IDs. VulnCheck has observed this vulnerability being exploited in the wild as of 2025-10-30 at 00:30:40.855917 UTC.
CVSS v4.0 score: 9.3
GHSA-47gj-cqh4-pq8c 
In the Linux kernel, the following vulnerability has been resolved:iommufd: Make sure to zero vfio_iommu_type1_info before copying to userMissed a zero initialization here. Most of the struct is filled with
a copy_from_user(), however minsz for that copy is smaller than the
actual struct by 8 bytes, thus we don't fill the padding.
CVE-2010-3795 
QuickTime in Apple Mac OS X 10.6.x before 10.6.5 accesses uninitialized memory locations during processing of GIF image data, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted GIF file.
CVSS v2.0 score: 6.8
GHSA-6v7x-r5hj-8xc6 
A vulnerability was found in xlnt-community xlnt up to 1.6.1. This issue affects the function xlnt::detail::compound_document_istreambuf::xsgetn of the file source/detail/cryptography/compound_document.cpp of the component XLSX File Parser. Performing a manipulation results in out-of-bounds read. The attack is only possible with local access. The exploit has been made public and could be used. The patch is named 147. It is recommended to apply a patch to fix this issue.
CVSS v4.0 score: 1.9
CVSS v3.1 score: 3.3
GHSA-8jhf-f6ww-f9rj 
qdPM 9.1 suffers from Cross-site Scripting (XSS) in the search[keywords] parameter.
CVSS v3.0 score: 6.1
GHSA-v2c8-m646-2q5c 
A stack overflow flaw was found in the Linux kernel's SYSCTL subsystem in how a user changes certain kernel parameters and variables. This flaw allows a local user to crash or potentially escalate their privileges on the system.
CVSS v3.1 score: 7.8
GHSA-q3f9-5g39-v5vh 
A SQL injection vulnerability in /smsa/admin_login.php in Kashipara Responsive School Management System v3.2.0 allows an attacker to execute arbitrary SQL commands via the "username" parameter of the Admin Login Page
CVSS v3.1 score: 5.4
RHSA-2026:12423 Red Hat Security Advisory: libcap security update
libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file()
CVSS v3.1 score: 6.7
CVE-2021-34546 
An unauthenticated attacker with physical access to a computer with NetSetMan Pro before 5.0 installed, that has the pre-logon profile switch button within the Windows logon screen enabled, is able to drop to an administrative shell and execute arbitrary commands as SYSTEM via the "save log to file" feature. To accomplish this, the attacker can navigate to cmd.exe.
CVSS v3.1 score: 6.8
CVSS v2.0 score: 7.2
CVE-2021-2072 
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions that are affected are 8.0.22 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS v3.1 score: 4.9
CVE-2024-7117 MD-MAFUJUL-HASAN Online-Payroll-Management-System shift_viewmore.php sql injection
A vulnerability classified as critical has been found in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to 20230911. Affected is an unknown function of the file /shift_viewmore.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The identifier of this vulnerability is VDB-272448. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 6.3
CVSS v3.0 score: 6.3
CVSS v2.0 score: 6.5
CVE-2023-5374 SourceCodester Online Computer and Laptop Store products.php sql injection
A vulnerability classified as critical was found in SourceCodester Online Computer and Laptop Store 1.0. Affected by this vulnerability is an unknown functionality of the file products.php. The manipulation of the argument c leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-241255.
CVSS v3.1 score: 6.3
CVSS v3.0 score: 6.3
CVSS v2.0 score: 6.5
GHSA-h6c2-23rv-4mwc 
In the Linux kernel, the following vulnerability has been resolved:wifi: iwlwifi: don't warn when if there is a FW erroriwl_trans_reclaim is warning if it is called when the FW is not alive.
But if it is called when there is a pending restart, i.e. after a FW
error, there is no need to warn, instead - return silently.
CVSS v3.1 score: 5.5
RHSA-2023:1486 Red Hat Security Advisory: Red Hat Gluster Storage web-admin-build security update
puma-5.6.4: http request smuggling vulnerabilities rubygem-rack: crafted multipart POST request may cause a DoS rubygem-rack: crafted requests can cause shell escape sequences moment: inefficient parsing algorithm resulting in DoS rubygem-tzinfo: arbitrary code execution
CVSS v3.1 score: 7.5
GHSA-j8vv-cjg2-mmg2 
iChat Server in Apple Mac OS X Server before 10.6.3, when group chat is used, does not perform logging for all types of messages, which might allow remote attackers to avoid message auditing via an unspecified selection of message type.
GHSA-cqc5-vhj7-6mrq 
Using custom code, an attacker can write into name or description fields larger than the appropriate buffer size causing a stack-based buffer overflow on Host Engineering H0-ECOM100 Communications Module Firmware versions v5.0.155 and prior. This may allow an attacker to crash the affected device or cause it to become unresponsive.
CVSS v3.1 score: 6.5
CVE-2017-3740 
In Lenovo Active Protection System before 1.82.0.14, an attacker with local privileges could send commands to the system's embedded controller, which could cause a denial of service attack on the system or the ability to alter hardware functionality.
CVSS v3.0 score: 5.5
CVSS v2.0 score: 4.9
GHSA-4jvg-7p7h-vmpq 
XPDF v4.0.4 was discovered to contain a segmentation violation via the component /xpdf/AcroForm.cc:538.
CVSS v3.1 score: 5.5