CIRCL/vulnerability-scores huggingface dataset:
CVE-2019-10080 
The XMLFileLookupService in NiFi versions 1.3.0 to 1.9.2 allowed trusted users to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services (via XXE) and reveal information such as the versions of Java, Jersey, and Apache that the NiFI instance uses.
CVSS v3.1 score: 6.5
CVSS v2.0 score: 4
CVE-2021-1038 
In UserDetailsActivity of AndroidManifest.xml, there is a possible DoS due to a tapjacking/overlay attack. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-183411279
CVSS v3.1 score: 5.5
CVSS v2.0 score: 4.7
GHSA-8mrg-x6q5-3pc3 
Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS v3.1 score: 5.4
CVE-2023-46319 
WALLIX Bastion 9.x before 9.0.9 and 10.x before 10.0.5 allows unauthenticated access to sensitive information by bypassing access control on a network access administration web interface.
CVSS v3.1 score: 7.5
GHSA-7xv2-675g-4wq2 
An issue in Pure Data 0.54-0 and fixed in 0.54-1 allows a local attacker to escalate privileges via the set*id () function.
CVSS v3.1 score: 8.4
GHSA-w27c-274j-76rc 
Inappropriate implementation in Crypto in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVSS v3.1 score: 9.6
CVE-2026-19163 
Use after free in Media in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVSS v3.1 score: 8.3
GHSA-72jh-xr22-cgrg 
A stored XSS vulnerability was discovered in Hotaru CMS v1.7.2 via the admin_index.php?page=settings SITE NAME field (aka SITE_NAME), a related issue to CVE-2011-4709.1.
CVSS v3.1 score: 4.8
CVE-2026-1630 Reflected XSS in WEBCON BPS
WEBCON BPS is vulnerable to Reflected XSS via one of parameters used by "/openinmobileapp" endpoint. An attacker can send a specially crafted URL that, when opened by an authenticated user, results in arbitrary JavaScript execution in the victim's browser.

This issue was fixed in versions 2026.1.3.109 and 2025.2.1.293.
CVSS v4.0 score: 5.1
GHSA-g6wq-qcwm-j5g2 Regular Expression Denial of Service in websocket-extensions (RubyGem)
ImpactThe ReDoS flaw allows an attacker to exhaust the server's capacity to process incoming requests by sending a WebSocket handshake request containing a header of the following form:That is, a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. The parser takes exponential time to reject this header as invalid, and this will block the processing of any other work on the same thread. Thus if you are running a single-threaded server, such a request can render your service completely unavailable.PatchesUsers should upgrade to version 0.1.5.WorkaroundsThere are no known work-arounds other than disabling any public-facing WebSocket functionality you are operating.Referenceshttps://blog.jcoglan.com/2020/06/02/redos-vulnerability-in-websocket-extensions/
CVSS v3.1 score: 8.2
GHSA-hr8j-5xfh-rrg6 
The Simple Random Posts Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'container_right_width' attribute of the 'simple_random_posts' shortcode in all versions up to, and including, 0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1 score: 6.4
CVE-2022-48450 
In bluetooth service, there is a possible missing params check.  This could lead to local denial of service with System execution privileges needed.
CVSS v3.1 score: 4.4
CVE-2005-2502 
Buffer overflow in AppKit for Mac OS X 10.3.9 and 10.4.2, as used in applications such as TextEdit, allows external user-assisted attackers to execute arbitrary code via a crafted Microsoft Word file.
CVSS v2.0 score: 5.1
GHSA-285h-qjvj-x665 
SQL injection vulnerability in oku.asp in xWeblog 2.2 allows remote attackers to execute arbitrary SQL commands via the makale_id parameter.
CVE-2025-66939 
Cross Site Scripting vulnerability in 66biolinks by AltumCode v.61.0.1 allows an attacker to execute arbitrary code via a crafted favicon file
CVSS v3.1 score: 5.4
RHSA-2026:36878 Red Hat Security Advisory: tomcat security update
Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor Apache Tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass
CVSS v3.1 score: 7.5
GHSA-36gm-66fp-prv4 
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in spoonthemes Adifier System allows PHP Local File Inclusion.This issue affects Adifier System: from n/a before 3.1.4.
CVSS v3.1 score: 7.5
CVE-2024-2611 
A missing delay on when pointer lock was used could have allowed a malicious page to trick a user into granting permissions. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9.
CVSS v3.1 score: 5.5
CVE-2026-31637 rxrpc: reject undecryptable rxkad response tickets
In the Linux kernel, the following vulnerability has been resolved:

rxrpc: reject undecryptable rxkad response tickets

rxkad_decrypt_ticket() decrypts the RXKAD response ticket and then
parses the buffer as plaintext without checking whether
crypto_skcipher_decrypt() succeeded.

A malformed RESPONSE can therefore use a non-block-aligned ticket
length, make the decrypt operation fail, and still drive the ticket
parser with attacker-controlled bytes.

Check the decrypt result and abort the connection with RXKADBADTICKET
when ticket decryption fails.
CVSS v3.1 score: 9.8
CVE-2023-36910 Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
CVSS v3.1 score: 9.8
CVE-2023-31248 Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability
Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; `nft_chain_lookup_byid()` failed to check whether a chain was active and CAP_NET_ADMIN is in any user or network namespace
CVSS v3.1 score: 7.8
RHSA-2022:6292 Red Hat Security Advisory: Red Hat AMQ Broker 7.8.7 release and security update
activemq-artemis: AMQ Broker web console HTML Injection
CVSS v3.1 score: 6.1
CVE-2022-1114 
A heap-use-after-free flaw was found in ImageMagick's RelinquishDCMInfo() function of dcm.c file. This vulnerability is triggered when an attacker passes a specially crafted DICOM image file to ImageMagick for conversion, potentially leading to information disclosure and a denial of service.
CVSS v3.1 score: 7.1
CVSS v2.0 score: 5.8
CVE-2002-0665 
Macromedia JRun Administration Server allows remote attackers to bypass authentication on the login form via an extra slash (/) in the URL.
CVSS v2.0 score: 10
CVE-2022-36386 WordPress Import any XML or CSV File to WordPress plugin <= 3.6.7 - Authenticated Arbitrary Code Execution vulnerability
Authenticated Arbitrary Code Execution vulnerability in Soflyy Import any XML or CSV File to WordPress plugin <= 3.6.7 at WordPress.
CVSS v3.1 score: 9.1
GHSA-89wh-w7hc-jhpc 
The ARM TrustZone Technology on which Trusty is based on contains a vulnerability in access permission settings where the portion of the DRAM reserved for TrustZone is identity-mapped by TLK with read, write, and execute permissions, which gives write access to kernel code and data that is otherwise mapped read only.
CVE-2017-11317 
Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload encryption, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.
CVSS v3.1 score: 9.8
CVSS v2.0 score: 7.5
GHSA-gvhx-gj42-m28v 
Cross-site scripting (XSS) vulnerability in Wiki content in RWiki 2.1.0pre1 through 2.1.0 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors.
GHSA-hj8w-fgm6-wx7w 
A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50). Affected devices do not properly validate the Language-parameter in requests to the web interface on port 443/tcp. This could allow an authenticated remote attacker to crash the device (followed by an automatic reboot) or to execute arbitrary code on the device.
CVSS v3.1 score: 8.8
GHSA-pfjj-m3jj-9jc9 Undefined behavior in `SparseTensorSliceDataset`
ImpactThe [implementation of `SparseTensorSliceDataset`](https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/kernels/data/sparse_tensor_slice_dataset_op.cc#L227-L292) has an undefined behavior: under certain condition it can be made to dereference a `nullptr` value:The 3 input arguments represent a sparse tensor. However, there are some preconditions that these arguments must satisfy but these are not validated in the implementation.PatchesWe have patched the issue in GitHub commit [965b97e4a9650495cda5a8c210ef6684b4b9eceb](https://github.com/tensorflow/tensorflow/commit/965b97e4a9650495cda5a8c210ef6684b4b9eceb).The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.For more informationPlease consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.AttributionThis vulnerability has been reported by Faysal Hossain Shezan from University of Virginia.
CVSS v4.0 score: 7.2
CVSS v3.1 score: 7.6
CVE-2026-26273 Known affected by Account Takeover via Password Reset Token Leakage
Known is a social publishing platform. Prior to 1.6.3, a Critical Broken Authentication vulnerability exists in Known 1.6.2 and earlier. The application leaks the password reset token within a hidden HTML input field on the password reset page. This allows any unauthenticated attacker to retrieve the reset token for any user by simply querying the user's email, leading to full Account Takeover (ATO) without requiring access to the victim's email inbox. This vulnerability is fixed in 1.6.3.
CVSS v3.0 score: 9.8
GHSA-fgwv-c9xg-jwvc 
LogoBee 0.2 allows updates.php?id= XSS.
CVSS v3.1 score: 6.1
RHSA-2022:7049 Red Hat Security Advisory: OpenJDK 8u352 Windows Security Update
OpenJDK: improper handling of long NTLM client hostnames (Security, 8286526) OpenJDK: insufficient randomization of JNDI DNS port numbers (JNDI, 8286910) OpenJDK: excessive memory allocation in X.509 certificate parsing (Security, 8286533) OpenJDK: HttpServer no connection count limit (Lightweight HTTP Server, 8286918)
CVSS v3.1 score: 5.3
CVE-2016-5474 
Unspecified vulnerability in the Oracle Retail Service Backbone component in Oracle Retail Applications 14.0, 14.1, and 15.0 allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to RSB Kernel.
CVSS v3.0 score: 8.8
CVSS v2.0 score: 9
GHSA-xqrw-3c79-7qc7 
OS Command Injection vulnerability in the process_string action of Rapid7 InsightConnect AWK Plugin on Linux allows remote attackers to execute arbitrary OS commands via the text or expression parameters due to unsafe shell command construction in the processing pipeline.
CVSS v3.1 score: 7.7
CVE-2007-5489 
Directory traversal vulnerability in index.php in Artmedic CMS 3.4 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter.
CVSS v2.0 score: 7.5
GHSA-4v9f-r55g-g6hc Prefect CORS (Cross-Origin Resource Sharing) misconfiguration
A CORS (Cross-Origin Resource Sharing) misconfiguration in prefecthq/prefect prior to version 3.0.3 allows unauthorized domains to access sensitive data. This vulnerability can lead to unauthorized access to the database, resulting in potential data leaks, loss of confidentiality, service disruption, and data integrity risks.
CVSS v3.0 score: 7.6
CVE-2023-39322 Memory exhaustion in QUIC connection handling in crypto/tls
QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size.
CVSS v3.1 score: 7.5
GHSA-gq4f-rq24-q85j 
Multiple plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the cminds_free_guide shortcode in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS v3.1 score: 6.1
RHSA-2022:2237 Red Hat Security Advisory: subversion:1.10 security update
subversion: Subversion's mod_dav_svn is vulnerable to memory corruption
CVSS v3.1 score: 7.5
GHSA-5mmp-9c8m-j75x 
In the Linux kernel, the following vulnerability has been resolved:smack: fix bug: unprivileged task can create labelsIf an unprivileged task is allowed to relabel itself
(/smack/relabel-self is not empty),
it can freely create new labels by writing their
names into own /proc/PID/attr/smack/currentThis occurs because do_setattr() imports
the provided label in advance,
before checking "relabel-self" list.This change ensures that the "relabel-self" list
is checked before importing the label.
GHSA-5p82-chcw-3j9h 
Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
CVE-2025-55090 Potential out of bound read issue in _nx_ipv4_packet_receive()  in NetX Duo
In NetX Duo before 6.4.4, the networking support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _nx_ipv4_packet_receive() function when received an Ethernet frame with less than 4 bytes of IP packet.
CVSS v4.0 score: 6.9
CVE-2010-4278 
operation/agentes/networkmap.php in Pandora FMS before 3.1.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the layout parameter in an operation/agentes/networkmap action to index.php.
CVSS v2.0 score: 9
CVE-2017-18416 
cPanel before 67.9999.103 allows arbitrary file-overwrite operations during a Roundcube SQLite schema update (SEC-303).
CVSS v3.0 score: 5.5
CVSS v2.0 score: 3.6
CVE-2019-12928 
The QMP migrate command in QEMU version 4.0.0 and earlier is vulnerable to OS command injection, which allows the remote attacker to achieve code execution, denial of service, or information disclosure by sending a crafted QMP command to the listening server. Note: This has been disputed as a non-issue since QEMU's -qmp interface is meant to be used by trusted users. If one is able to access this interface via a tcp socket open to the internet, then it is an insecure configuration issue
CVSS v3.0 score: 9.8
CVSS v2.0 score: 10
RHSA-2023:5989 Red Hat Security Advisory: varnish security update
HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)
CVSS v3.1 score: 7.5
GHSA-fpr2-4824-6px3 
The administration module in OpenMRS 2.1 Standalone Edition allows remote authenticated users to obtain read access via a direct request to /admin.
cisco-sa-20200226-fpwr-cmdinj Cisco FXOS Software CLI Command Injection Vulnerability
A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying Linux operating system with a privilege level of root on an affected device.

The vulnerability is due to insufficient validation of arguments passed to a specific CLI command on the affected device. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux operating system with root privileges. An attacker would need valid administrator credentials to exploit this vulnerability.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.


CVSS v3.0 score: 6.7
CVE-2020-2560 
Vulnerability in the Siebel UI Framework product of Oracle Siebel CRM (component: SWSE Server). Supported versions that are affected are 19.10 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel UI Framework. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel UI Framework, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Siebel UI Framework accessible data. CVSS 3.0 Base Score 4.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N).
CVSS v3.0 score: 4.7
CVE-2008-5234 
Multiple heap-based buffer overflows in xine-lib 1.1.12, and other versions before 1.1.15, allow remote attackers to execute arbitrary code via vectors related to (1) a crafted metadata atom size processed by the parse_moov_atom function in demux_qt.c and (2) frame reading in the id3v23_interp_frame function in id3.c.  NOTE: as of 20081122, it is possible that vector 1 has not been fixed in 1.1.15.
CVSS v2.0 score: 9.3
GHSA-w855-c23r-66cr 
MailEnable versions prior to 10.54 contain a reflected cross-site scripting (XSS) vulnerability in the FieldTo parameter of /Mondo/lang/sys/Forms/AddressBook.aspx. The FieldTo value is not properly sanitized when processed via a GET request and is reflected inside a <script> block in the JavaScript variable var fieldTo. By supplying a crafted payload that terminates the existing Finish() function, inserts attacker-controlled script, and comments out remaining code, a remote attacker can execute arbitrary JavaScript in a victim’s browser when the victim attempts to send an email. Successful exploitation can redirect victims to malicious sites, steal non-HttpOnly cookies, inject arbitrary HTML or CSS, and perform actions as the authenticated user.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 6.1
GHSA-523x-p7vc-qqv3 
The issue was addressed with improved memory handling. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.
CVSS v3.1 score: 7.5
GHSA-9348-g23j-56pf 
Tor Browser before 7.0.9 on macOS and Linux allows remote attackers to bypass the intended anonymity feature and discover a client IP address via vectors involving a crafted web site that leverages file:// mishandling in Firefox, aka TorMoil. NOTE: Tails is unaffected.
CVSS v3.1 score: 6.5
CVE-2022-30221 Windows Graphics Component Remote Code Execution Vulnerability
Windows Graphics Component Remote Code Execution Vulnerability
CVSS v3.1 score: 8.8
CVE-2022-1498 
Inappropriate implementation in HTML Parser in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS v3.1 score: 4.3
CVE-2026-5814 PHPGurukul Online Course Registration check_availability.php sql injection
A security vulnerability has been detected in PHPGurukul Online Course Registration 3.1. This issue affects some unknown processing of the file /admin/check_availability.php. The manipulation of the argument regno leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 7.3
CVSS v3.0 score: 7.3
CVSS v2.0 score: 7.5
CVE-2024-2716 Campcodes Complete Online DJ Booking System contactus.php cross site scripting
A vulnerability was found in Campcodes Complete Online DJ Booking System 1.0. It has been classified as problematic. This affects an unknown part of the file /admin/contactus.php. The manipulation of the argument email leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257469 was assigned to this vulnerability.
CVSS v3.1 score: 3.5
CVSS v3.0 score: 3.5
CVSS v2.0 score: 4
CVE-2024-58284 PopojiCMS 2.0.1 Remote Command Execution via Authenticated Metadata Settings
PopojiCMS 2.0.1 contains an authenticated remote command execution vulnerability that allows administrative users to inject malicious PHP code through the metadata settings endpoint. Attackers can log in and modify the meta content to create a web shell that executes arbitrary system commands through a GET parameter.
CVSS v4.0 score: 8.6
CVE-2006-1911 
Cross-site scripting (XSS) vulnerability in MyBB (MyBulletinBoard) 1.1 allows remote attackers to inject arbitrary web script or HTML via the attachment content disposition in an HTML attachment.
CVSS v2.0 score: 4.3
CVE-2023-33797 
A stored cross-site scripting (XSS) vulnerability in the Create Sites (/dcim/sites/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
CVSS v3.1 score: 5.4
RHSA-2005:472 Red Hat Security Advisory: kernel security update
security flaw security flaw security flaw
GHSA-98v9-rg9c-r4gg 
OS Command Injection in export.php (vulnerable function called from include/functions-article.php) in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to achieve Code Execution by saving the code to be executed as the wkhtmltopdf path via admin/save-settings.php.
CVSS v3.1 score: 7.2
GHSA-q3gg-6xjx-jwjm 
setlicense for TOLIS Group Backup and Restore Utility (BRU) 17.0 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/brutest.$$ temporary file.
CVE-2025-13993 MailerLite – Signup forms (official) <= 1.7.16 - Authenticated (Administrator+) Stored Cross-Site Scripting
The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_description' and 'success_message' parameters in versions up to, and including, 1.7.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1 score: 5.5
GHSA-87h2-mwgq-f566 
An uncontrolled search path element vulnerabilities in Trend Micro Apex One and Apex One as a Service could allow a local attacker to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This vulnerability is similar but not identical to CVE-2021-42101.
CVE-2022-47489 
In soter service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
CVSS v3.1 score: 4.4
GHSA-h9pm-99hq-fxrv 
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects embedded in PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-12291.
RHSA-2026:42062 Red Hat Security Advisory: webkit2gtk3 security update
Mozilla: Arbitrary JavaScript execution in PDF.js webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash webkitgtk: webkitgtk: A malicious website may process restricted web content outside the sandbox webkitgtk: webkitgtk: Maliciously crafted web content may lead to memory corruption webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash webkitgtk: webkitgtk: Visiting a website may leak sensitive data webkitgtk: webkitgtk: Maliciously crafted web content may lead to memory corruption webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash webkitgtk: webkitgtk: A malicious website may silently hijack clipboard data webkitgtk: webkitgtk: A malicious website may process restricted web content outside the sandbox webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash webkitgtk: webkitgtk: Maliciously crafted web content may lead to memory corruption webkitgtk: webkitgtk: Maliciously crafted web content may disclose sensitive user information webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash webkitgtk: webkitgtk: Maliciously crafted web content may disclose process memory webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash
CVSS v3.1 score: 6.5
RHSA-2026:24333 Red Hat Security Advisory: .NET 9.0 security update
dotnet: .NET: infinite loop allows an attacker to cause a denial of service
CVSS v3.1 score: 7.5
RHSA-2026:0491 Red Hat Security Advisory: postgresql security update
postgresql: CREATE STATISTICS does not check for schema CREATE privilege postgresql: libpq: libpq undersizes allocations, via integer wraparound
CVSS v3.1 score: 7.5
CVE-2014-4748 
Cross-site scripting (XSS) vulnerability in the Classic Meeting Server in IBM Sametime 8.x through 8.5.2.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS v2.0 score: 4.3
CVE-2026-46805 
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).   The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Content accessible data as well as  unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N).
CVSS v3.1 score: 9.3
GHSA-w2p8-cxfv-fwhf 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Upeksha Wisidagama UW Freelancer allows Reflected XSS.This issue affects UW Freelancer: from n/a through 0.1.
CVSS v3.1 score: 7.1
GHSA-6397-25xv-gv4g 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aakif Kadiwala Event Espresso – Custom Email Template Shortcode allows Reflected XSS. This issue affects Event Espresso – Custom Email Template Shortcode: from n/a through 1.0.0.
CVSS v3.1 score: 7.1
RHSA-2025:22684 Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes 2.12.6 security update
prometheus/client_golang: Denial of service using InstrumentHandlerCounter golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON operator-sdk: privilege escalation due to incorrect permissions of /etc/passwd go-jose: Go JOSE's Parsing Vulnerable to Denial of Service database/sql: Postgres Scan Race Condition helm.sh/helm/v3: Helm Chart Code Execution axios: Axios DoS via lack of data size check
CVSS v3.1 score: 5.3
GHSA-hwfq-3hhr-352p 
The mksmbpasswd shell script (mksmbpasswd.sh) in Samba 3.0.0 and 3.0.1, when creating an account but marking it as disabled, may overwrite the user password with an uninitialized buffer, which could enable the account with a more easily guessable password.
CVE-2026-46705 russh server userauth state is not reset when authentication principal changes
Russh is a Rust SSH client & server library. From version 0.34.0-beta.1 to before version 0.61.0, the russh server authentication path keeps internal userauth state across SSH_MSG_USERAUTH_REQUEST messages without separating that state when the request principal changes. RFC 4252 allows the user name and service name fields to change between authentication requests. The issue is not that such changes are invalid. The issue is that russh-owned authentication state, such as remaining methods, partial-success state, and in-progress method state, can remain associated with the connection and then influence a later request for a different (user, service). This is an internal library state mismatch. This issue has been patched in version 0.61.0.
CVSS v3.1 score: 5.3
ICSA-17-299-01 Korenix JetNet
An attacker may gain access to hard-coded certificates and private keys allowing the attacker to perform man-in-the-middle attacks.CVE-2017-14021 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The software uses undocumented hard-coded credentials that may allow an attacker to gain remote access.CVE-2017-14027 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS v3.0 score: 9.8
GHSA-vq5p-mc3m-crgg 
The Simple Student Result plugin before 1.6.4 for WordPress has an Authentication Bypass vulnerability because the fn_ssr_add_st_submit() function and fn_ssr_del_st_submit() function in functions.php only require knowing the student id number.
CVSS v3.0 score: 7.5
GHSA-84c8-qpcc-7wf9 
Authorization Bypass Through User-Controlled Key vulnerability in Origin Software ATS Pro allows Authentication Abuse, Authentication Bypass.This issue affects ATS Pro: before 20230714.
CVSS v3.1 score: 8.8
CVE-2024-57078 
A prototype pollution in the lib.merge function of cli-util v1.1.27 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
CVSS v3.1 score: 7.5
GHSA-pxrf-vj27-hg76 
IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 could allow an authenticated user, under non default configurations, to cause a denial of service due to insufficient release of allocated memory after usage.
CVSS v3.1 score: 5.3
CVE-2021-21147 
Inappropriate implementation in Skia in Google Chrome prior to 88.0.4324.146 allowed a local attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
CVSS v3.1 score: 4.3
CVSS v2.0 score: 4.3
GHSA-f6fp-39qp-wq82 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mark Parnell Spark GF Failed Submissions allows Reflected XSS. This issue affects Spark GF Failed Submissions: from n/a through 1.3.5.
CVSS v3.1 score: 7.1
CVE-2009-4143 
PHP before 5.2.12 does not properly handle session data, which has unspecified impact and attack vectors related to (1) interrupt corruption of the SESSION superglobal array and (2) the session.save_path directive.
CVSS v2.0 score: 10
CVE-2015-9186 
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, in a PlayReady API function, a buffer over-read can occur.
CVSS v3.0 score: 9.8
CVSS v2.0 score: 10
CVE-2021-29242 
CODESYS Control Runtime system before 3.5.17.0 has improper input validation. Attackers can send crafted communication packets to change the router's addressing scheme and may re-route, add, remove or change low level communication packages.
CVSS v3.1 score: 7.3
CVSS v2.0 score: 7.5
GHSA-52q4-558x-f9rv 
Multiple cross-site scripting (XSS) vulnerabilities in MyBB (aka MyBulletinBoard) before 1.4.1 allow remote attackers to inject arbitrary web script or HTML via (1) a certain referrer field in usercp2.php, (2) a certain location field in inc/functions_online.php, and certain (3) tsubject and (4) psubject fields in moderation.php.
CVE-2019-14521 
The api/admin/logoupload Logo File upload feature in EMCA Energy Logserver 6.1.2 allows attackers to send any kind of file to any location on the server via path traversal in the filename parameter.
CVSS v3.0 score: 7.5
CVSS v2.0 score: 5
CVE-2016-9799 
In BlueZ 5.42, a buffer overflow was observed in "pklg_read_hci" function in "btsnoop.c" source file. This issue can be triggered by processing a corrupted dump file and will result in btmon crash.
CVSS v3.0 score: 5.3
CVSS v2.0 score: 5
CVE-2019-0279 
ABAP BASIS function modules INST_CREATE_R3_RFC_DEST, INST_CREATE_TCPIP_RFCDEST, and INST_CREATE_TCPIP_RFC_DEST in SAP BASIS (fixed in versions 7.0 to 7.02, 7.10 to 7.30, 7.31, 7.40, 7.50 to 7.53) do not perform necessary authorization checks in all circumstances for an authenticated user, resulting in escalation of privileges.
CVSS v3.0 score: 8.8
CVSS v2.0 score: 6.5
GHSA-r39h-4c2p-3jxp OpenClaw vulnerable to arbitrary code execution via attacker-controlled setup-api.js loaded from cwd during env-key resolution
SummaryOpenClaw's bundled plugin setup resolver could fall back to `process.cwd()` while resolving provider setup metadata. If a user ran an OpenClaw command from an attacker-controlled repository containing `extensions/<plugin>/setup-api.js`, OpenClaw could load and execute that JavaScript during ordinary provider/model status resolution.ImpactThis is arbitrary JavaScript execution in the OpenClaw process under the current user account. A malicious repository could run code when the user executed commands such as provider/model inspection from that directory. The issue does not require gateway network exposure, but it does require user interaction: the user must run OpenClaw from a directory containing the attacker-controlled setup file.Affected Packages / VersionsPackage: `openclaw` on npmAffected: versions before `2026.4.23`Fixed: `2026.4.23`Latest stable verified fixed: `openclaw@2026.4.23`, tag `v2026.4.23`FixOpenClaw now resolves bundled setup fallbacks only from the canonical package/repository root and no longer includes `process.cwd()` as a trusted setup-api search root. A regression test verifies that a workspace-local `extensions/<plugin>/setup-api.js` is not loaded through provider setup resolution.Fix Commit(s)`993781e6e6eaf50f033cfc3e3bf4f47059740707` (`fix(plugins): ignore cwd setup-api fallback`)SeveritySeverity remains `high` because successful exploitation allows arbitrary code execution under the user running OpenClaw. The CVSS vector is local/user-interaction scoped rather than network-only because the victim must run OpenClaw from an attacker-controlled directory.
CVSS v3.1 score: 7.8
GHSA-rf57-p454-qrmj 
APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Restriction of Operations within the Bounds of a Memory Buffer by local. Successful exploitation of this vulnerability may lead to privilege escalation and potentially arbitrary code execution, and impact Integrity.
CVSS v4.0 score: 4.4
CVSS v3.1 score: 4.8
CVE-2025-31140 
In JetBrains TeamCity before 2025.03 stored XSS was possible on Cloud Profiles page
CVSS v3.1 score: 4.6
GHSA-cwmw-4frh-c4rr 
An information disclosure vulnerability exists when Windows Media Player improperly discloses file information, aka "Windows Media Player Information Disclosure Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8481.
CVSS v3.0 score: 3.1
RHSA-2026:5877 Red Hat Security Advisory: OpenShift Container Platform 4.19.27 bug fix and security update
nfs-utils: rpc.mountd in the nfs-utils privilege escalation
CVSS v3.1 score: 6.5
CVE-2017-18505 
The twitter-plugin plugin before 2.55 for WordPress has XSS.
CVSS v3.0 score: 6.1
CVSS v2.0 score: 4.3
GHSA-x7p5-c683-6jrp 
An Improper Handling of Exceptional Conditions vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a Denial of Service (DoS), which causes the l2cpd process to crash by sending a specific TLV.The l2cpd process is responsible for layer 2 control protocols, such as STP, RSTP, MSTP, VSTP, ERP, and LLDP.  The impact of the l2cpd crash is reinitialization of STP protocols (RSTP, MSTP or VSTP), and MVRP and ERP, leading to a Denial of Service.  Continued receipt and processing of this specific TLV will create a sustained Denial of Service (DoS) condition.
This issue affects:Junos OS: 
all versions before 20.4R3-S9, 
from 21.2 before 21.2R3-S7, 
from 21.3 before 21.3R3-S5, 
from 21.4 before 21.4R3-S4, 
from 22.1 before 22.1R3-S4, 
from 22.2 before 22.2R3-S2, 
from 22.3 before 22.3R2-S2, 22.3R3-S1, 
from 22.4 before 22.4R2-S2, 22.4R3, 
from 23.2 before 23.2R1-S1, 23.2R2;Junos OS Evolved: 
all versions before 21.2R3-S7,from 21.3 before 21.3R3-S5-EVO, 
from 21.4 before 21.4R3-S5-EVO, 
from 22.1 before 22.1R3-S4-EVO, 
from 22.2 before 22.2R3-S2-EVO, 
from 22.3 before 22.3R2-S2-EVO, 22.3R3-S1-EVO, 
from 22.4 before 22.4R2-S2-EVO, 22.4R3-EVO, 
from 23.2 before 23.2R1-S1-EVO, 23.2R2-EVO.
CVSS v4.0 score: 7.1
CVSS v3.1 score: 6.5
CVE-2007-2694 
Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0 GA, and 9.1 GA allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS v2.0 score: 4.3
GHSA-85fc-rr25-p568 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Web Security (Transaction Viewer) allows Stored XSS.The
 Forcepoint Web Security portal allows administrators to generate 
detailed reports on user requests made through the Web proxy. It has 
been determined that the "user agent" field in the Transaction Viewer is
 vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability, 
which can be exploited by any user who can route traffic through the 
Forcepoint Web proxy.This 
vulnerability enables unauthorized attackers to execute JavaScript 
within the browser context of a Forcepoint administrator, thereby 
allowing them to perform actions on the administrator's behalf. Such a 
breach could lead to unauthorized access or modifications, posing a 
significant security risk.This issue affects Web Security: before 8.5.6.
CVSS v3.1 score: 9.6
GHSA-9qrj-ww3w-jxgp 
Tenable Appliance versions 4.6.1 and earlier have been found to contain a single XSS vulnerability. Utilizing a specially crafted request, an authenticated attacker could potentially execute arbitrary JavaScript code by manipulating certain URL parameters related to offline plugins.
CVSS v3.0 score: 5.4
CVE-2026-5715 Voyage Plus <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post-content' Shortcode
The Voyage Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' attribute of the 'post-content' shortcode in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1 score: 6.4
CVE-2026-43766 
An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An attacker with physical access to a locked device may be able to view sensitive user information.
CVSS v3.1 score: 4.6
GHSA-w4g8-c7r7-rx85 
Directory traversal vulnerability in IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8 allows remote authenticated users to read arbitrary files via a .. (dot dot) in a URL.
CVSS v3.0 score: 6.5
CVE-2024-52404 WordPress CF7 Reply Manager plugin <= 1.2.3 - Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in bigfiveagency CF7 Reply Manager cf7-reply-manager.This issue affects CF7 Reply Manager: from n/a through <= 1.2.3.
CVSS v3.1 score: 9.9
CVE-2024-34128 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS v3.1 score: 5.4
GHSA-fc7g-9852-m869 
Juniper Junos OS before 12.1X46-D45, 12.1X47 before 12.1X47-D30, 12.1X48 before 12.3X48-D20, and 15.1X49 before 15.1X49-D30 on SRX series devices, when the Real Time Streaming Protocol Application Layer Gateway (RTSP ALG) is enabled, allow remote attackers to cause a denial of service (flowd crash) via a crafted RTSP packet.
CVSS v3.0 score: 5.9
CVE-2014-1748 
The ScrollView::paint function in platform/scroll/ScrollView.cpp in Blink, as used in Google Chrome before 35.0.1916.114, allows remote attackers to spoof the UI by extending scrollbar painting into the parent frame.
CVSS v2.0 score: 5
GHSA-hp9w-gf9p-prw9 
Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE-2024-49227 WordPress Free Stock Photos Foter plugin <= 1.5.4 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in foter Free Stock Photos Foter free-stock-photos-foter allows Object Injection.This issue affects Free Stock Photos Foter: from n/a through <= 1.5.4.
CVSS v3.1 score: 8.8
CVE-2005-0281 
Cross-site scripting (XSS) vulnerability in the web interface in Soldner Secret Wars 30830 allows remote attackers to inject arbitrary web script or HTML via a user message, which is not filtered or quoted when the administrator views the server logs.
CVSS v2.0 score: 4.3
CVE-2026-75047 
In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpoint
CVSS v3.1 score: 6.5
CVE-2024-27375 
An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_nan_followup_get_nl_params(), there is no input validation check on hal_req->sdea_service_specific_info_len coming from userspace, which can lead to a heap overwrite.
CVSS v3.1 score: 6.7
CVE-2021-38016 
Insufficient policy enforcement in background fetch in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to bypass same origin policy via a crafted HTML page.
CVSS v3.1 score: 8.8
CVSS v2.0 score: 6.8
CVE-2008-3957 
The Microsoft Windows Image Acquisition Logger ActiveX control allows remote attackers to force the download of arbitrary files onto a client system via a URL in the first argument to the Open method, in conjunction with a full destination pathname in the first argument to the Save method.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS v2.0 score: 9.3
CVE-2005-2412 
PHP remote file inclusion vulnerability in block.php in PHP FirstPost allows remote attackers to execute arbitrary PHP code via the Include parameter.
CVSS v2.0 score: 5
CVE-2018-16096 System Management Module Vulnerabilities
In System Management Module (SMM) versions prior to 1.06, the SMM web interface for changing Enclosure VPD fails to sufficiently sanitize all input for HTML tags, possibly opening a path for cross-site scripting.
CVSS v3.0 score: 6.1
CVSS v2.0 score: 4.3
GHSA-5m32-x2f7-rpgh 
In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01661189; Issue ID: MSV-4298.
CVSS v3.1 score: 5.3
GHSA-7cx3-2qx2-3g6w phpMyFAQ's Missing Authorization on Tag Deletion Allows Any Authenticated User to Delete Tags
SummaryThe `TagController::delete()` endpoint at `DELETE /admin/api/content/tags/{tagId}` only verifies that the user is logged in (`userIsAuthenticated()`), but does not check any permission. Any authenticated user — including regular non-admin frontend users — can delete any tag by ID. This contrasts with `TagController::update()` and `TagController::search()`, which both enforce the `FAQ_EDIT` permission.DetailsIn `phpmyfaq/src/phpMyFAQ/Controller/Administration/Api/TagController.php`, the `delete()` method (line 121-133) uses only `$this->userIsAuthenticated()`:Compare with `update()` (line 48-71) which properly enforces authorization:The `userIsAuthenticated()` method in `AbstractController` (line 258-263) only checks `$this->currentUser->isLoggedIn()`:There is no admin-level middleware in the `Kernel` — it registers only RouterListener, LanguageListener, ControllerContainerListener, and exception listeners. The admin API entry point (`admin/api/index.php`) shares the same bootstrap and session as the frontend, meaning a frontend user's session cookie is valid for admin API requests.Additionally, this endpoint lacks CSRF token verification (unlike `update()`), though the primary issue is the missing authorization since the attack vector is a logged-in user acting directly.PoCImpactAny authenticated user (including regular frontend users who registered through the public registration form) can delete all tags in the phpMyFAQ instance. This results in:**Data integrity loss:** Tags are permanently deleted from the database. All FAQ-to-tag associations are destroyed.**Disruption of FAQ organization:** Tag-based navigation, filtering, and tag clouds become empty or broken.**No recoverability without backup:** Deleted tags and their associations cannot be restored without a database backup.The impact is limited to tags (not FAQ content itself), but in large installations with extensive tag taxonomies, this could significantly degrade usability.Recommended FixAdd the `FAQ_EDIT` permission check and CSRF token verification to `TagController::delete()`, consistent with `TagController::update()`:At minimum, add `$this->userHasPermission(PermissionType::FAQ_EDIT)` to enforce the same authorization as the update and search endpoints. Consider also adding a dedicated `TAG_DELETE` permission type for more granular access control.
CVSS v3.1 score: 5.4
CVE-2004-0961 
Memory leak in FreeRADIUS before 1.0.1 allows remote attackers to cause a denial of service (memory exhaustion) via a series of Access-Request packets with (1) Ascend-Send-Secret, (2) Ascend-Recv-Secret, or (3) Tunnel-Password attributes.
CVSS v2.0 score: 5