CIRCL/vulnerability-scores huggingface dataset:
RHSA-2024:10232 Red Hat Security Advisory: pam security update
pam: Improper Hostname Interpretation in pam_access Leads to Access Control Bypass
CVSS v3.1 score: 7.4
CVE-2014-4287 
Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier and 5.6.19 and earlier allows remote authenticated users to affect availability via vectors related to SERVER:CHARACTER SETS.
CVSS v2.0 score: 4
CVE-2026-65762 Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Guestbook 5.0.0-6.1.0
Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Guestbook 5.0.0-6.1.0 - Improper validation of user inputs lead to a reflective XSS vulnerability.
CVSS v4.0 score: 5.1
GHSA-cwqm-g264-pf82 
ktsuss versions 1.4 and prior spawns the GTK interface to run as root. This can allow a local attacker to escalate privileges to root and use the "GTK_MODULES" environment variable to possibly execute arbitrary code.
CVSS v3.1 score: 7.8
GHSA-fp94-h42g-rrg4 
SQL injection vulnerability in gallery.php in webSPELL 4.01.02 allows remote attackers to execute arbitrary SQL commands via the picID parameter, a different vector than CVE-2007-0492.
CVE-2025-27663 
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Weak Password Encryption / Encoding OVE-20230524-0007.
CVSS v3.1 score: 9.8
CVE-2004-0780 
Buffer overflow in uustat in Sun Solaris 8 and 9 allows local users to execute arbitrary code via a long -S command line argument.
CVSS v2.0 score: 7.2
RHSA-2024:0845 Red Hat Security Advisory: OpenShift Container Platform 4.13.34 security update
go-git: Maliciously crafted Git server replies can cause DoS on go-git clients go-git: Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients
CVSS v3.1 score: 8.1
CVE-2020-12702 
Weak encryption in the Quick Pairing mode in the eWeLink mobile application (Android application V4.9.2 and earlier, iOS application V4.9.1 and earlier) allows physically proximate attackers to eavesdrop on Wi-Fi credentials and other sensitive information by monitoring the Wi-Fi spectrum during the pairing process.
CVSS v3.1 score: 4.6
CVSS v2.0 score: 2.1
GHSA-ghf7-2pv3-c6f2 
Cross-site scripting (XSS) vulnerability in modules.php in NavBoard 16 (2.6.0) allows remote attackers to inject arbitrary web script or HTML via the module parameter.
CVE-2026-2799 Use-after-free in the DOM: Core & HTML component
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
CVSS v3.1 score: 7.5
GHSA-v93c-v766-hw94 
The WP Directory Kit plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on the 'admin_page_display' function. This makes it possible for unauthenticated attackers to delete or change plugin settings, import demo data, modify or delete Directory Kit related posts and terms via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Partial patches were made avilable in versions 1.2.0 and 1.2.1 but the issue was not fully patched until 1.2.2
CVSS v3.1 score: 5.4
RHSA-2026:4548 Red Hat Security Advisory: postgresql:15 security update
postgresql: PostgreSQL oidvector discloses a few bytes of memory postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code postgresql: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code
CVSS v3.1 score: 8.8
GHSA-2mfh-8q3p-3q36 
IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to arbitrary delete a directory caused by improper validation of user-supplied input. IBM X-Force ID: 175026.
CVE-2018-25168 Precurio Intranet Portal 2.0 Cross-Site Request Forgery Add Admin
Precurio Intranet Portal 2.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by submitting crafted POST requests. Attackers can forge requests to the /public/admin/user/submitnew endpoint with user creation parameters to add new admin accounts without requiring CSRF tokens or user interaction.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 4.3
CVE-2013-1088 
Cross-site request forgery (CSRF) vulnerability in Novell iManager 2.7 before SP6 Patch 1 allows remote attackers to hijack the authentication of arbitrary users by leveraging improper request validation by iManager code deployed within an Apache Tomcat container.
CVSS v2.0 score: 6.8
CVE-2023-30909 
A remote authentication bypass issue exists in some
OneView APIs.








CVSS v3.1 score: 9.8
CVE-2002-1690 
Unknown vulnerability in AIX before 4.0 with unknown attack vectors and unknown impact, aka "security issue," as fixed by APAR IY28225.
CVSS v2.0 score: 10
GHSA-q6xm-hqhq-6fw7 
In ImageMagick 7.0.6-1, a memory exhaustion vulnerability was found in the function ReadSUNImage in coders/sun.c, which allows attackers to cause a denial of service.
CVSS v3.0 score: 7.5
CVE-2013-1026 
Buffer overflow in ImageIO in Apple Mac OS X before 10.8.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted JPEG2000 data in a PDF document.
CVSS v2.0 score: 6.8
GHSA-p7rc-7m77-7q34 
Authentication Bypass by Spoofing vulnerability in wpdevart Coming soon and Maintenance mode allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Coming soon and Maintenance mode: from n/a through 3.7.3.
CVSS v3.1 score: 3.7
CVE-2021-34724 Cisco IOS XE SD-WAN Software Privilege Escalation Vulnerability
A vulnerability in the Cisco IOS XE SD-WAN Software CLI could allow an authenticated, local attacker to elevate privileges and execute arbitrary code on the underlying operating system as the root user. An attacker must be authenticated on an affected device as a PRIV15 user. This vulnerability is due to insufficient file system protection and the presence of a sensitive file in the bootflash directory on an affected device. An attacker could exploit this vulnerability by overwriting an installer file stored in the bootflash directory with arbitrary commands that can be executed with root-level privileges. A successful exploit could allow the attacker to read and write changes to the configuration database on the affected device.
CVSS v3.1 score: 6
CVE-2019-7068 
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
CVSS v3.0 score: 9.8
CVSS v2.0 score: 10
GHSA-53qv-629p-53cf 
Multiple directory traversal vulnerabilities in sitenfo.sh, sitezipchk.sh, and siteziplist.sh in Glftpd 1.26 to 2.00 allow remote authenticated users to (1) determine the existence of arbitrary files, (2) list files in restricted directories, or (3) read arbitrary files from within ZIP or gzip files, via .. (dot dot) sequences and globbing ("*") characters in a SITE NFO command.
GHSA-9jjg-8mxf-5rr7 
Untrusted pointer dereference in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally.
CVSS v3.1 score: 7.8
GHSA-6v68-gpqv-3rpv 
Telesquare TLR-2005KSH 1.1.4 is affected by an unauthorized stack overflow vulnerability when requesting the admin.cgi parameter with setSyncTimeHost.
CVSS v3.1 score: 9.8
CVE-2025-27827 
A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.2.0.3 could allow an unauthenticated attacker to conduct an information disclosure attack due to improper handling of session data. A successful exploit requires user interaction and could allow an attacker to access sensitive information, leading to unauthorized access to active chat rooms, reading chat data, and sending messages during an active chat session.
CVSS v3.1 score: 7.1
CVE-2021-47006 ARM: 9064/1: hw_breakpoint: Do not directly check the event's overflow_handler hook
In the Linux kernel, the following vulnerability has been resolved:

ARM: 9064/1: hw_breakpoint: Do not directly check the event's overflow_handler hook

The commit 1879445dfa7b ("perf/core: Set event's default
::overflow_handler()") set a default event->overflow_handler in
perf_event_alloc(), and replace the check event->overflow_handler with
is_default_overflow_handler(), but one is missing.

Currently, the bp->overflow_handler can not be NULL. As a result,
enable_single_step() is always not invoked.

Comments from Zhen Lei:

 https://patchwork.kernel.org/project/linux-arm-kernel/patch/20210207105934.2001-1-thunder.leizhen@huawei.com/
CVSS v3.1 score: 5.5
CVE-2022-30269 
Motorola ACE1000 RTUs through 2022-05-02 mishandle application integrity. They allow for custom application installation via either STS software, the C toolkit, or the ACE1000 Easy Configurator. In the case of the Easy Configurator, application images (as PLX/DAT/APP/CRC files) are uploaded via the Web UI. In case of the C toolkit, they are transferred and installed using SFTP/SSH. In each case, application images were found to have no authentication (in the form of firmware signing) and only relied on insecure checksums for regular integrity checks.
CVSS v3.1 score: 8.8
GHSA-g6g4-h466-8c58 
In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-pcp.c has a memory leak.
CVSS v3.0 score: 7.5
CVE-2018-13397 
There was an argument injection vulnerability in Sourcetree for Windows from version 0.5.1.0 before version 3.0.0 via Git subrepositories in Mercurial repositories. An attacker with permission to commit to a Mercurial repository linked in Sourcetree for Windows is able to exploit this issue to gain code execution on the system.
CVSS v3.0 score: 8.8
CVSS v2.0 score: 9
CVE-2026-52943 net: skbuff: fix missing zerocopy reference in pskb_carve helpers
In the Linux kernel, the following vulnerability has been resolved:

net: skbuff: fix missing zerocopy reference in pskb_carve helpers

pskb_carve_inside_header() and pskb_carve_inside_nonlinear() both copy
the old skb_shared_info header into a new buffer via memcpy(), which
includes the destructor_arg pointer (uarg) for MSG_ZEROCOPY skbs.
Neither function calls net_zcopy_get() for the new shinfo, creating an
unaccounted holder: every skb_shared_info with destructor_arg set will
call skb_zcopy_clear() once when freed, but the corresponding
net_zcopy_get() was never called for the new copy. Repeated calls
drive uarg->refcnt to zero prematurely, freeing ubuf_info_msgzc while
TX skbs still hold live destructor_arg pointers.

KASAN reports use-after-free on a freed ubuf_info_msgzc:

  BUG: KASAN: slab-use-after-free in skb_release_data+0x77b/0x810
  Read of size 8 at addr ffff88801574d3e8 by task poc/220

  Call Trace:
   skb_release_data+0x77b/0x810
   kfree_skb_list_reason+0x13e/0x610
   skb_release_data+0x4cd/0x810
   sk_skb_reason_drop+0xf3/0x340
   skb_queue_purge_reason+0x282/0x440
   rds_tcp_inc_free+0x1e/0x30
   rds_recvmsg+0x354/0x1780
   __sys_recvmsg+0xdf/0x180

  Allocated by task 219:
   msg_zerocopy_realloc+0x157/0x7b0
   tcp_sendmsg_locked+0x2892/0x3ba0

  Freed by task 219:
   ip_recv_error+0x74a/0xb10
   tcp_recvmsg+0x475/0x530

The skb consuming the late access still referenced the same uarg via
shinfo->destructor_arg copied by pskb_carve_inside_nonlinear() without
a refcount bump. This has been verified to be reliably exploitable: a
working proof-of-concept achieves full root privilege escalation from
an unprivileged local user on a default kernel configuration.

The fix follows the pattern of pskb_expand_head() which has the same
memcpy/cloned structure. For pskb_carve_inside_header(), net_zcopy_get()
is placed after skb_orphan_frags() succeeds, so the orphan error path
needs no cleanup. For pskb_carve_inside_nonlinear(), net_zcopy_get() is
placed after all failure points and just before skb_release_data(), so
no error path needs cleanup at all -- matching pskb_expand_head() more
closely and avoiding the need for a balancing net_zcopy_put().
CVSS v3.1 score: 7.8
CVE-2004-2687 
distcc 2.x, as used in XCode 1.5 and others, when not configured to restrict access to the server port, allows remote attackers to execute arbitrary commands via compilation jobs, which are executed by the server without authorization checks.
CVSS v2.0 score: 9.3
GHSA-383h-f6wm-hpxc 
glusterfs is vulnerable to privilege escalation on gluster server nodes. An authenticated gluster client via TLS could use gluster cli with --remote-host command to add it self to trusted storage pool and perform privileged gluster operations like adding other machines to trusted storage pool, start, stop, and delete volumes.
CVSS v3.1 score: 8.8
CVE-2019-1008 
A security feature bypass vulnerability exists in Dynamics On Premise, aka 'Microsoft Dynamics On-Premise Security Feature Bypass'.
CVSS v3.0 score: 5.9
CVSS v2.0 score: 4.3
PYSEC-2026-2361 
In case of SQL errors, exception/stack trace of errors was exposed in API even if "api/expose_stack_traces" was set to false. That could lead to exposing additional information to potential attacker. Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue.
CVSS v3.1 score: 5.3
GHSA-fvv5-h29g-f6w5 User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository
ImpactA bug in permissions validation allows a user with the `ci:ReadAction` permission to skip read checks when copying an object.  If they additionally have read and write permission to path in the repository, they can copy an otherwise unreadable object and read it.In order to be affected and exploitable, the following conditions must ALL occur on the same user:`ci:ReadAction` enabled for the repository.  Predefined policies RepoManagementRead and RepoManagementFullAccess allow this action.`fs:ReadObject` and `fs:WriteObject` enabled for some path.`fs:ReadObject` _not_ available for some pathSuch a user can use (1) to copy the unreadable object (3) to a path that they can read and write (2).  At that point they can read the object copy.PatchesReleases >= 1.12.1 fix this issue in lakeFS.WorkaroundsAs a workaround, use RBAC to deny `ci:*` permissions to all users, or to all users who have limited read access.Many installations are unaffected:**Installations using ACLs are _not_ affected.** This includes all OSS installations that have not implemented an external authorization server.  We do not know of any OSS installations that have implemented such a server.  ACLs that allow ci:ReadAction also allow reading repositories, so no capabilities are granted.**Installations using RBAC that use only predefined policies with "all" ARNs ("*") are _not_ affected.**  This includes **all installations that have not defined any new groups in RBAC.**In order to be affected, **installations using RBAC** must define users and simultaneous allow `ci:ReadAction` and disallow `fs:ReadObject` for some path.  `ci:ReadAction` is available in policies RepoManagementReadAll and RepoManagementFullAccess.  By default these actions are configured for groups Developers and above, for all repositories and paths.References[lakeFS RBAC](https://docs.lakefs.io/reference/security/rbac.html)
CVSS v3.1 score: 5.3
GHSA-rwxx-mrjm-wc2m vLLM: ReDoS via structured_outputs.regex compiled without timeout in xgrammar and outlines backends
SummaryThe `structured_outputs.regex` API parameter passes a user-supplied regex string directly to grammar compiler backends with no compilation timeout. In the xgrammar backend, the string reaches `compile_regex()` with no guard. In the outlines backend, `validate_regex_is_buildable()` blocks structural issues (lookarounds, backreferences) but provides zero protection against exponential DFA state-space explosion. Patterns like `(a+)+b` pass all checks and hang the inference worker.Root Cause`backend_xgrammar.py:91` — no timeout:`backend_outlines.py:299–330` — structural checks only, no complexity analysis:`backend_outlines.py:64` — no timeout:ImpactDenial of service — one request with an adversarial regex pattern hangs an inference worker indefinitely.RemediationWrap `compile_regex()` and `oc.Index()` calls in a thread with a deadline (e.g., 5 seconds). Add complexity analysis to `validate_regex_is_buildable()` to detect nested quantifier patterns before compilation.
CVSS v4.0 score: 8.7
CVSS v3.1 score: 7.5
GHSA-9qvh-qx28-p5p7 
A vulnerability classified as critical has been found in Campcodes Complete Web-Based School Management System 1.0. Affected is an unknown function of the file /view/teacher_attendance_history1.php. The manipulation of the argument index leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-265104.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 6.3
CVE-2017-11407 
In Wireshark 2.2.0 to 2.2.7 and 2.0.0 to 2.0.13, the MQ dissector could crash. This was addressed in epan/dissectors/packet-mq.c by validating the fragment length before a reassembly attempt.
CVSS v3.0 score: 7.5
CVSS v2.0 score: 5
GHSA-f5r8-7h4f-jr9x Moodle incorrect access control
A vulnerability was found in Moodle where users with "Log in as" capability in a course context (typically, course managers) may gain access to some site administration capabilities by "logging in as" a System manager. This affects 3.9 to 3.9.1, 3.8 to 3.8.4, 3.7 to 3.7.7, 3.5 to 3.5.13 and earlier unsupported versions. This is fixed in 3.9.2, 3.8.5, 3.7.8 and 3.5.14.
CVSS v3.1 score: 8.8
GHSA-cxcm-vgv2-mq4g 
Transient DOS in WLAN Firmware while parsing a BTM request.
CVSS v3.1 score: 7.5
GHSA-wxg7-5pqj-jxrf 
SAP S/4HANA(On-Premise) contains SQL injection vulnerability in a remote-enabled function module component that could be exploited by an authenticated attacker to potentially execute unauthorized database queries.This flaw exposes sensitive information to which they should not otherwise have access to. The vulnerability has a high impact on the confidentiality of the data with no impact on the integrity and availability of the application.
CVSS v3.1 score: 6.5
CVE-2011-0715 
The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.16, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a request that contains a lock token.
CVSS v2.0 score: 4.3
GHSA-93pr-w682-79xh 
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 12.1.0 through 12.1.3 could allow an authenticated user to cause a denial of service due to improper neutralization of special elements in data query logic with federated objects.
CVSS v3.1 score: 6.5
GHSA-qm2h-r9mg-5xxj 
An issue was discovered in certain Apple products. macOS before 10.12.5 is affected. The issue involves the "Kernel" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVSS v3.0 score: 7.8
CVE-2020-9994 
A path handling issue was addressed with improved validation. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, watchOS 6.2.5. A malicious application may be able to overwrite arbitrary files.
CVSS v3.1 score: 7.1
CVSS v2.0 score: 5.8
GHSA-v454-jrmm-fr6q 
Adobe Acrobat and Reader versions 2019.010.20091 and earlier, 2019.010.20091 and earlier, 2017.011.30120 and earlier version, and 2015.006.30475 and earlier have a data leakage (sensitive) vulnerability. Successful exploitation could lead to information disclosure.
CVE-2026-55249 @rtk-ai/rtk-rewrite: OpenClaw Rewrite Plugin Command Injection via execSync Template String
@rtk-ai/rtk-rewrite transparently rewrites shell commands executed via OpenClaw's exec tool to their RTK equivalents. In 1.0.0, the @rtk-ai/rtk-rewrite OpenClaw plugin passes attacker-controlled input directly into a shell-backed execSync() template string without shell-safe escaping. JSON.stringify() wraps the value in double quotes and escapes inner double-quotes and backslashes, but leaves $() and backtick shell metacharacters untouched. Because execSync delegates execution to /bin/sh -c, the shell expands $(...) substitutions even inside double-quoted strings, causing the injected subcommand to execute before rtk is invoked. An attacker who can influence the exec tool's command parameter (e.g., via an LLM agent prompt or gateway/tool-call input) achieves arbitrary OS command execution with the privileges of the plugin/gateway process.
CVSS v3.1 score: 6.3
RHSA-2015:0813 Red Hat Security Advisory: flash-plugin security update
flash-plugin: multiple code execution issues fixed in APSB15-06 flash-plugin: multiple code execution issues fixed in APSB15-06 flash-plugin: multiple code execution issues fixed in APSB15-06 flash-plugin: multiple code execution issues fixed in APSB15-06 flash-plugin: multiple code execution issues fixed in APSB15-06 flash-plugin: multiple code execution issues fixed in APSB15-06 flash-plugin: multiple code execution issues fixed in APSB15-06 flash-plugin: multiple code execution issues fixed in APSB15-06 flash-plugin: multiple code execution issues fixed in APSB15-06 flash-plugin: multiple code execution issues fixed in APSB15-06 flash-plugin: multiple code execution issues fixed in APSB15-06 flash-plugin: information leaks leading to ASLR bypass (APSB15-06) flash-plugin: multiple code execution issues fixed in APSB15-06 flash-plugin: multiple code execution issues fixed in APSB15-06 flash-plugin: multiple code execution issues fixed in APSB15-06 flash-plugin: multiple code execution issues fixed in APSB15-06 flash-plugin: multiple code execution issues fixed in APSB15-06 flash-plugin: information leaks leading to ASLR bypass (APSB15-06) flash-plugin: multiple code execution issues fixed in APSB15-06 flash-plugin: multiple code execution issues fixed in APSB15-06 flash-plugin: multiple code execution issues fixed in APSB15-06 flash-plugin: security bypass leading to information disclosure (APSB15-06)
CVE-2025-70646 
Tenda AX1803 v1.0.0.1 was discovered to contain a stack overflow in the security parameter of the sub_72290 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
CVSS v3.1 score: 7.5
CVE-2023-20773 
In vow, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07611449; Issue ID: ALPS07441735.
CVSS v3.1 score: 7.8
GHSA-7cgw-vcwx-jrj7 
Cisco Linksys E4200 1.0.05 Build 7 devices contain a Clickjacking Vulnerability which allows remote attackers to obtain sensitive information.
CVE-2025-11763 Display Pages Shortcode <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Display Pages Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'column_count' parameter in the [display-pages] shortcode in all versions up to, and including, 1.1. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1 score: 6.4
CVE-2017-16212 
ltt is a static file server. ltt is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS v3.0 score: 7.5
CVSS v2.0 score: 5
CVE-2017-4905 
VMware ESXi 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch ESXi600-201703403-SG, 6.0 U1 without patch ESXi600-201703402-SG, 5.5 without patch ESXi550-201703401-SG; Workstation Pro / Player 12.x prior to 12.5.5; and Fusion Pro / Fusion 8.x prior to 8.5.6 have uninitialized memory usage. This issue may lead to an information leak.
CVSS v3.1 score: 5.5
CVSS v2.0 score: 2.1
CVE-2024-38508 
A privilege escalation vulnerability was discovered in the web interface or SSH captive command shell interface of XCC that could allow an authenticated XCC user with elevated privileges to perform command injection via a specially crafted request.
CVSS v3.1 score: 7.2
CVE-2011-4761 
Parallels Plesk Small Business Panel 10.2.0 omits the Content-Type header's charset parameter for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving domains/sitebuilder_edit.php and certain other files.  NOTE: it is possible that only clients, not the SmarterStats product, could be affected by this issue.
CVSS v2.0 score: 10
GHSA-85xp-wwwc-66g8 
Deserialization of Untrusted Data vulnerability in NooTheme Organici Library noo-organici-library allows Object Injection.This issue affects Organici Library: from n/a through <= 2.1.2.
CVSS v3.1 score: 8.8
GHSA-9pv5-7jc6-f3q2 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jonathan Brinley DOAJ Export allows Stored XSS. This issue affects DOAJ Export: from n/a through 1.0.4.
CVSS v3.1 score: 5.9
GHSA-jj4g-g9rr-33cr 
The EAP peer implementation in Espressif ESP-IDF 2.0.0 through 4.0.0 and ESP8266_NONOS_SDK 2.2.0 through 3.1.0 processes EAP Success messages before any EAP method completion or failure, which allows attackers in radio range to cause a denial of service (crash) via a crafted message.
GHSA-wpgw-f68m-pvhh 
lib/Zonemaster/GUI/Dancer/Export.pm in Zonemaster Web GUI before 1.0.11 has XSS.
CVSS v3.1 score: 6.1
RHSA-2025:4224 Red Hat Security Advisory: mod_auth_openidc security update
mod_auth_openidc: mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data
CVSS v3.1 score: 7.5
GHSA-9h5r-73cp-xv2w 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Internet Security 2018. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within cevakrnl.xmd. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code under the context of SYSTEM. Was ZDI-CAN-5101.
CVSS v3.0 score: 8.8
GHSA-xc3j-2w7m-w4h5 
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
GHSA-q78r-738h-p7hg 
In Golden Frog VyprVPN before 2.15.0.5828 for macOS, the vyprvpnservice launch daemon has an unprotected XPC service that allows attackers to update the underlying OpenVPN configuration and the arguments passed to the OpenVPN binary when executed. An attacker can abuse this vulnerability by forcing the VyprVPN application to load a malicious dynamic library every time a new connection is made.
CVSS v3.0 score: 7.8
GHSA-vjhv-mh94-cxp5 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (ConnectWise Technology Integration module) allows Stored XSS. This vulnerability is an additional unmitigated attack path for CVE-2025-13937.This issue affects Fireware OS 12.4 up to and including 12.12, 12.5 up to and including 12.5.18, and 2025.1 up to and including 2026.2.
CVSS v4.0 score: 4.8
CVSS v3.1 score: 4.8
GHSA-prp2-54v2-c9p2 
SQL injection vulnerability in Blue Eye CMS 1.0.0 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the BlueEyeCMS_login cookie parameter.
GHSA-459f-26mc-vgm2 
The NetBIOS Name Server (NBNS) protocol does not perform authentication, which allows remote attackers to cause a denial of service by sending a spoofed Name Conflict or Name Release datagram, aka the "NetBIOS Name Server Protocol Spoofing" vulnerability.
CVE-2015-3663 
QT Media Foundation in Apple QuickTime before 7.7.7, as used in OS X before 10.10.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file, a different vulnerability than CVE-2015-3661, CVE-2015-3662, CVE-2015-3666, CVE-2015-3667, and CVE-2015-3668.
CVSS v2.0 score: 6.8
GHSA-fx5p-f64h-93xc Opened exploitable ports in default docker-compose.yaml in go-ipfs
ImpactAllows admin API access to the IPFS node.Who ?This affects people running the  [docker-compose.yaml](https://github.com/ipfs/go-ipfs/blob/master/docker-compose.yaml) service in an environment where the docker host is directly attached to a public or untrusted IP.  In the vulnerable version, the private API endpoint is publicly forwarded by exposing it as `0.0.0.0:5001` on the host machine.If the host machine is hidden behind a firewall or NAT (and the LAN is trusted for NAT), this is not an immediate issue because of the protection from the firewall or NAT.  That said, we still recommend users update to follow security best practices of not putting unnecessary dependency on a working firewall.PatchesThis issue is in [docker-compose.yaml](https://github.com/ipfs/go-ipfs/blob/master/docker-compose.yaml).  Users need to replace their current `docker-compose.yaml` file with a version `0.12.1` or later.There is no need to update any of the binaries. Users running previous versions like `0.12.0` or earlier can download the `0.12.1` `docker-compose.yaml` file.  You can replace a vulnerable `docker-compose.yaml` file with a the new one with:How to test if you are vulnerableBinding check on the hostOn the host machine, while IPFS is running, run as root:The output will be a list of listeners bound to `:5001`.
You then need to check that those listeners are private and preferably even localhost IPs.
⚠️ If this listener is on `0.0.0.0` or a public IP you are very likely vulnerable.Remote hailingWhile IPFS is running, you can try to contact the API from a remote machine. (Replace `1.2.3.4` with your node public IP.  Or if you want to test in an untrusted NAT, then substitute the LAN IP instead.)⚠️ If you see any json outputted (e.g.,  `{"Commit": "<string>","Golang": "<string>","Repo": "<string>","System": "<string>","Version": "<string>"}`), then you are vulnerable.If it **fails**, then you are safe.For more informationIf you have any questions or comments about this advisory:Please first read https://docs.ipfs.io/reference/http/api/ about best practicesAsk in [IPFS Discord #ipfs-chatter](https://discord.gg/ipfs)Open an issue in [go-ipfs](https://github.com/ipfs/go-ipfs)
GHSA-pmgj-wpmq-6xx5 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fox-themes Whizz Plugins whizz-plugins allows Reflected XSS.This issue affects Whizz Plugins: from n/a through <= 1.9.
CVSS v3.1 score: 7.1
CVE-2013-1266 
Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges, and consequently read the contents of arbitrary kernel memory locations, via a crafted application, a different vulnerability than other CVEs listed in MS13-016.
CVSS v2.0 score: 4.9
CVE-2013-4158 
smokeping before 2.6.9 has XSS (incomplete fix for CVE-2012-0790)
CVSS v3.1 score: 6.1
CVSS v2.0 score: 4.3
CVE-2016-0715 
Pivotal Cloud Foundry Elastic Runtime version 1.4.0 through 1.4.5, 1.5.0 through 1.5.11 and 1.6.0 through 1.6.11 is vulnerable to a remote information disclosure. It was found that original mitigation configuration instructions provided as part of CVE-2016-0708 were incomplete and could leave PHP Buildpack, Staticfile Buildpack and potentially other custom Buildpack applications vulnerable to remote information disclosure. Affected applications use automated buildpack detection, serve files directly from the root of the application and have a buildpack that matched after the Java Buildpack in the system buildpack priority when Java Buildpack versions 2.0 through 3.4 were present.
CVSS v3.0 score: 5.9
CVSS v2.0 score: 4.3
CVE-2020-1129 Microsoft Windows Codecs Library Remote Code Execution Vulnerability
<p>A remote code execution vulnerability exists in the way that Microsoft Windows Codecs Library handles objects in memory. An attacker who successfully exploited this vulnerability could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p>
<p>Exploitation of the vulnerability requires that a program process a specially crafted image file.</p>
<p>The update addresses the vulnerability by correcting how Microsoft Windows Codecs Library handles objects in memory.</p>
CVSS v3.1 score: 8.8
GHSA-8mg7-32mm-38xq 
Web Access in Lotus Domino 6.5.1 allows remote attackers to cause a denial of service (server crash) via a large e-mail message, as demonstrated using a large image attachment.
CVE-2023-20591 
Improper re-initialization of IOMMU during the DRTM event
may permit an untrusted platform configuration to persist, allowing an attacker
to read or modify hypervisor memory, potentially resulting in loss of
confidentiality, integrity, and availability.
CVSS v3.1 score: 6.5
GHSA-v4gr-cw6x-c3jw 
Dell EMC Data Protection Central versions 19.5 and prior contain a Server Side Request Forgery vulnerability in the DPC DNS client processing. A remote malicious user could potentially exploit this vulnerability, allowing port scanning of external hosts.
CVE-2023-43216 
SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_ip.php.
CVSS v3.1 score: 9.8
CVE-2026-7470 Tenda 4G300 SafeMacFilter sub_427C3C stack-based overflow
A flaw has been found in Tenda 4G300 US_4G300V1.0Mt_V1.01.42_CN_TDC01. Affected is the function sub_427C3C of the file /goform/SafeMacFilter. This manipulation of the argument page causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been published and may be used.
CVSS v4.0 score: 8.7
CVSS v3.1 score: 8.8
CVSS v3.0 score: 8.8
CVSS v2.0 score: 9
CVE-2026-57338 WordPress ARForms plugin <= 7.1.2 - Reflected Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in ARForms <= 7.1.2 versions.
CVSS v3.1 score: 7.1
CVE-2017-17614 
Food Order Script 1.0 has SQL Injection via the /list city parameter.
CVSS v3.0 score: 9.8
CVSS v2.0 score: 7.5
CVE-2026-19897 mangroup dtale Login Endpoint auth.py login excessive authentication
A vulnerability has been found in mangroup dtale up to 3.22.0. This issue affects the function Login of the file dtale/auth.py of the component Login Endpoint. Such manipulation leads to improper restriction of excessive authentication attempts. The attack can be executed remotely. This attack is characterized by high complexity. The exploitability is assessed as difficult. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS v4.0 score: 6.3
CVSS v3.1 score: 3.7
CVSS v3.0 score: 3.7
CVSS v2.0 score: 2.6
CVE-2023-41323 Users login enumeration by unauthenticated user in GLPI
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. An unauthenticated user can enumerate users logins. Users are advised to upgrade to version 10.0.10. There are no known workarounds for this vulnerability.
CVSS v3.1 score: 5.3
CVE-2025-12011 CompactLogix ®, ControlLogix ®, Compact GuardLogix ® and GuardLogix ® Buffer Overflow
A denial-of-service issue exists in  5370/5570 controllers. This vulnerability could potentially allow a remote user to load an invalid project, causing the device to enter a major non-recoverable fault (MNRF).
CVSS v4.0 score: 9.2
CVE-2020-15836 
An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices. The authentication function passes untrusted data to the operating system without proper sanitization. A crafted request can be sent to execute arbitrary commands as root.
CVSS v3.1 score: 9.8
CVSS v2.0 score: 10
GHSA-54hh-2wph-jw3p 
Improper buffer restriction in software for the Intel QAT Driver for Linux before version 1.7.l.4.12 may allow an authenticated user to potentially enable denial of service via local access.
CVSS v3.1 score: 3.3
PYSEC-2025-176 
A vulnerability classified as problematic has been found in Open Asset Import Library Assimp 5.4.3. This affects the function MDLImporter::InternReadFile_3DGS_MDL345 of the file assimp/code/AssetLib/MDL/MDLLoader.cpp. The manipulation leads to out-of-bounds read. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
CVSS v3.1 score: 5.5
GHSA-3hm3-f2vf-j6mp 
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-15051.
CVE-2023-23557 
An error in Hermes' algorithm for copying objects properties prior to commit a00d237346894c6067a594983be6634f4168c9ad could be used by a malicious attacker to execute arbitrary code via type confusion. Note that this is only exploitable in cases where Hermes is used to execute untrusted JavaScript. Hence, most React Native applications are not affected.
CVSS v3.1 score: 9.8
CVE-2011-5266 
Imperva SecureSphere Web Application Firewall (WAF) before 12-august-2010 allows SQL injection filter bypass.
CVSS v3.1 score: 9.8
CVSS v2.0 score: 7.5
CVE-2021-21218 
Uninitialized data in PDFium in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted PDF file.
CVSS v3.1 score: 5.5
CVSS v2.0 score: 4.3
GHSA-gw2x-q739-qhcr RustFS gRPC GetMetrics deserialization panic enables remote DoS
SummaryA malformed gRPC `GetMetrics` request causes `get_metrics` to `unwrap()` failed deserialization of `metric_type`/`opts`, panicking the handler thread and enabling remote denial of service of the metrics endpoint.DetailsVulnerable code: `rustfs/src/storage/tonic_service.rs:1775-1782`:`MetricType` and `CollectMetricsOpts` are deserialized with `Deserialize::deserialize(...).unwrap()` from client-supplied bytes.Malformed `metric_type`/`opts` (e.g., empty or truncated rmp-serde payloads) trigger `InvalidMarkerRead` and panic.Reachability: same TCP listener as S3 (default `:9000`); only a static interceptor token `authorization: rustfs rpc` is checked in `server/http.rs:677`.Impact scope: panic terminates the worker handling the request, causing metrics service interruption and potential process instability.PoC[rustfs-grpc-metrics-invalid-metric-type-panic-poc.tar.gz](https://github.com/user-attachments/files/24038341/rustfs-grpc-metrics-invalid-metric-type-panic-poc.tar.gz)Start RustFS (example local dev):From `rustfs-grpc-metrics-invalid-metric-type-panic-poc/`, run:Observe panic in server logs at `tonic_service.rs:get_metrics` with `InvalidMarkerRead` and worker crash; client output saved to `poc-response.txt`/`poc-grpcurl.log`.ImpactVulnerability type: remote unauthenticated (static token) denial of service via panic in gRPC handler.Who is impacted: any deployment exposing the gRPC endpoint where an attacker can reach port 9000 and supply the known `authorization: rustfs rpc` header; metrics service is disrupted and may affect overall stability depending on runtime crash handling.
CVSS v4.0 score: 5.5
GHSA-777h-5433-29fx 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DGN files. Crafted data in a DGN file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15507.
RHSA-2014:0150 Red Hat Security Advisory: gc security update
gc: malloc() and calloc() overflows
CVE-2022-3634 Contact Form 7 Database Addon < 1.2.6.5 - CSV Injection
The Contact Form 7 Database Addon WordPress plugin before 1.2.6.5 does not validate data when output it back in a CSV file, which could lead to CSV injection
CVSS v3.1 score: 9.8
CVE-2017-2541 
An issue was discovered in certain Apple products. macOS before 10.12.5 is affected. The issue involves the "WindowServer" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVSS v3.0 score: 7.8
CVSS v2.0 score: 9.3
GHSA-fp55-jw48-c537 astral-tokio-tar is Vulnerable to PAX Header Desynchronization
ImpactVersions of astral-tokio-tar prior to 0.6.1 contain a PAX header interpretation bug that allows manipulated entries to be made selectively visible or invisible during extraction with astral-tokio-tar versus other tar implementations. An attacker could use this differential to smuggle unexpected files onto a victim's filesystem.See GHSA-j5gw-2vrg-8fgx for a similar desynchronization bug in astral-tokio-tar.PatchesVersions 0.6.1 and newer of astral-tokio-tar address this differential.WorkaroundsUsers are advised to upgrade to version 0.6.1 or newer to address this advisory.There is no workaround other than upgrading. Users should experience no breaking changes as a result of the upgrade.ResourcesGHSA-j5gw-2vrg-8fgx is a similar PAX desynchronization bugAttributionReporter: Adam Harvey (@lawngnome)
CVSS v4.0 score: 6.6
CVE-2026-18903 yeqifu warehouse FileController.java path traversal
A vulnerability was determined in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This issue affects some unknown processing of the file src/main/java/com/yeqifu/sys/controller/FileController.java. This manipulation of the argument path causes path traversal. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 4.3
CVSS v3.0 score: 4.3
CVSS v2.0 score: 4
CVE-2012-0988 
Multiple cross-site scripting (XSS) vulnerabilities in config/dmsDefaults.php in KnowledgeTree 3.7.0.2 and possibly earlier allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) login.php, (2) admin.php, or (3) preferences.php.
CVSS v2.0 score: 4.3
CVE-2022-32837 
This issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.5, tvOS 15.6, iOS 15.6 and iPadOS 15.6. An app may be able to cause unexpected system termination or write kernel memory.
CVSS v3.1 score: 7.8
GHSA-v88g-8xgm-9r57 
Arm Mali GPU Kernel Driver allows improper GPU operations in Valhall r29p0 through r36p0 before r37p0 to reach a use-after-free situation.
CVSS v3.1 score: 9.8
GHSA-5vff-mfgm-ggcg 
In the Linux kernel, the following vulnerability has been resolved:ARM: cns3xxx: Fix refcount leak in cns3xxx_initof_find_compatible_node() returns a node pointer with refcount
incremented, we should use of_node_put() on it when done.
Add missing of_node_put() to avoid refcount leak.
CVSS v3.1 score: 5.5
CVE-2024-23717 
In access_secure_service_from_temp_bond of btm_sec.cc, there is a possible way to achieve keystroke injection due to improper input validation. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1 score: 9.1
CVE-2014-4563 
Cross-site scripting (XSS) vulnerability in go.php in the URL Cloak & Encrypt (url-cloak-encrypt) plugin 2.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the url parameter.
CVSS v2.0 score: 4.3
RHSA-2013:0627 Red Hat Security Advisory: thunderbird security update
Mozilla: Use-after-free in HTML Editor (MFSA 2013-29)
GHSA-vvp3-76jq-q4c4 
In the Linux kernel, the following vulnerability has been resolved:atm: clip: Fix potential null-ptr-deref in to_atmarpd().atmarpd is protected by RTNL since commit f3a0592b37b8 ("[ATM]: clip
causes unregister hang").However, it is not enough because to_atmarpd() is called without RTNL,
especially clip_neigh_solicit() / neigh_ops->solicit() is unsleepable.Also, there is no RTNL dependency around atmarpd.Let's use a private mutex and RCU to protect access to atmarpd in
to_atmarpd().
CVSS v3.1 score: 5.5
CVE-2009-1387 
The dtls1_retrieve_buffered_fragment function in ssl/d1_both.c in OpenSSL before 1.0.0 Beta 2 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence DTLS handshake message, related to a "fragment bug."
CVSS v2.0 score: 5
CVE-2025-54465 Hard-coded Credentials Vulnerability in ZKTeco WL20
This vulnerability exists in ZKTeco WL20 due to hard-coded MQTT credentials and endpoints stored in plaintext within the device firmware. An attacker with physical access could exploit this vulnerability by extracting the firmware and analyzing the binary data to retrieve the hard-coded MQTT credentials and endpoints from the targeted device.

Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to the MQTT broker and manipulate the communications of the targeted device.
CVSS v4.0 score: 6.8
CVE-2026-53789 rsync < 3.5.0 Arbitrary File Deletion via Malicious File List
rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended destination subtree by sending a crafted file list that causes rsync to reclassify implied parent directory entries or treat synthetic paths as the transfer root. Attackers can exploit multiple variants including implied parent reclassification, synthetic root path construction, legacy protocol behavior below version 30, and non-directory root handling to cause the receiver to delete files outside the authorized destination directory.
CVSS v4.0 score: 7.1
CVSS v3.1 score: 6.5
RHSA-2011:0871 Red Hat Security Advisory: tigervnc security update
tigervnc: vncviewer can send password to server without proper validation of the X.509 certificate
CVE-2016-7461 
The drag-and-drop (aka DnD) function in VMware Workstation Pro 12.x before 12.5.2 and VMware Workstation Player 12.x before 12.5.2 and VMware Fusion and Fusion Pro 8.x before 8.5.2 allows guest OS users to execute arbitrary code on the host OS or cause a denial of service (out-of-bounds memory access on the host OS) via unspecified vectors.
CVSS v3.0 score: 8.8
CVSS v2.0 score: 7.2
RHSA-2015:1417 Red Hat Security Advisory: mailman security and bug fix update
mailman: Local users able to read private mailing list archives mailman: directory traversal in MTA transports that deliver programmatically
CVE-2006-3385 
Cross-site scripting (XSS) vulnerability in divers.php in Vincent Leclercq News 5.2 allows remote attackers to inject arbitrary web script or HTML via the (1) id and (2) disabled parameters.
CVSS v2.0 score: 5.8
CVE-2021-30740 
A logic issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.4, tvOS 14.6, watchOS 7.5, iOS 14.6 and iPadOS 14.6. A malicious application may be able to execute arbitrary code with kernel privileges.
CVSS v3.1 score: 7.8
CVSS v2.0 score: 9.3