CIRCL/vulnerability-scores huggingface dataset:
GHSA-qjrm-3323-m349 
The wp-ultimate-exporter plugin before 1.4.2 for WordPress has CSRF.
CVSS v3.0 score: 8.8
GHSA-47hw-v3j9-mmxv 
A vulnerability classified as problematic has been found in DedeCMS 5.7.116. Affected is an unknown function of the file /member/article_add.php. The manipulation of the argument body leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 3.5
GHSA-r2wf-q3x4-hrv9 Default development error handler in Ratpack is vulnerable to HTML content injection (XSS)
Versions of Ratpack from 0.9.10 through 1.7.5 are vulnerable to [CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')](https://cwe.mitre.org/data/definitions/79.html) (aka. XSS) in the development error handler. An attacker can utilize this to perform XSS when an exception message contains untrusted data.As a simplistic example:ImpactCross-Site ScriptingPatchesThis vulnerability has been patched in Ratpack version 1.7.6.WorkaroundsIf you are unable to update your version of Ratpack, we recommend the following workarounds and mitigations.Ensure that development mode is disabled in production.Don't use real customer data (ie. untrusted user input) in development.References[Ratpack development mode](https://ratpack.io/manual/current/api/ratpack/server/ServerConfigBuilder.html#development-boolean-)[Code Patch - a3cbb13](https://github.com/ratpack/ratpack/commit/a3cbb13be1527874528c3b99fc33517c0297b6d3)For more informationIf you have any questions or comments about this advisory:Open an issue in [ratpack/ratpack](https://github.com/ratpack/ratpack/issues?q=is%3Aissue+is%3Aopen+sort%3Aupdated-desc)Ask in our [Slack channel](https://slack-signup.ratpack.io/)
CVSS v3.1 score: 6.1
CVE-2021-27589 
When a user opens manipulated Scalable Vector Graphics (.SVG) format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9, the application crashes and becomes temporarily unavailable to the user until restart of the application.
CVSS v3.0 score: 4.3
GHSA-qqfm-63xg-g4x8 
Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
CVE-2026-62764 Apache Accumulo: A user can trigger a graceful shutdown of services without the relevant system permissions
Improper Handling of Insufficient Privileges vulnerability in Apache Accumulo.
An authenticated, but low-privileged user without system permissions may
issue a remote command to gracefully shutdown system components
(compaction-coordinator, compactor, gc, manager, monitor, tserver, or sserver),
leading to a denial of service.

This issue affects Apache Accumulo 2.1.4 and 2.1.5.

Users are recommended to upgrade to version 2.1.6, which fixes the issue.
CVSS v4.0 score: 5.7
CVE-2022-49731 ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo()
In the Linux kernel, the following vulnerability has been resolved:

ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo()

In an unlikely (and probably wrong?) case that the 'ppi' parameter of
ata_host_alloc_pinfo() points to an array starting with a NULL pointer,
there's going to be a kernel oops as the 'pi' local variable won't get
reassigned from the initial value of NULL. Initialize 'pi' instead to
'&ata_dummy_port_info' to fix the possible kernel oops for good...

Found by Linux Verification Center (linuxtesting.org) with the SVACE static
analysis tool.
CVSS v3.1 score: 5.5
CVE-2005-2889 
Check Point NGX R60 does not properly verify packets against the predefined service group "CIFS" rule, which allows remote attackers to bypass intended restrictions.
CVSS v2.0 score: 7.5
CVE-2026-24364 WordPress WP User Frontend plugin <= 4.2.5 - Broken Access Control vulnerability
Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through <= 4.2.5.
CVSS v3.1 score: 6.5
RHSA-2023:0565 Red Hat Security Advisory: OpenShift Container Platform 4.11.26 security update
goutils: RandomAlphaNumeric and CryptoRandomAlphaNumeric are not as random as they should be
CVSS v3.1 score: 7
CVE-2023-35193 
An OS command injection vulnerability exists in the api.cgi cmd.mvpn.x509.write functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HTTP request can lead to command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.This vulnerability is specifically for the `system` call in the file `/web/MANGA/cgi-bin/api.cgi` for firmware version 6.3.5 at offset 0x4bddb8.
CVSS v3.1 score: 7.2
CVE-2016-10395 
In FlexNet Publisher versions before Luton SP1 (11.14.1.1) running FlexNet Publisher Licensing Service on Windows platform, a boundary error related to a named pipe within the FlexNet Publisher Licensing Service can be exploited to cause an out-of-bounds memory read access and subsequently execute arbitrary code with SYSTEM privileges.
CVSS v3.0 score: 7.8
CVSS v2.0 score: 6.8
CVE-2006-5988 
Unspecified vulnerability in Windows 2000 Advanced Server SP4 running Active Directory allows remote attackers to cause a denial of service via unknown vectors, as demonstrated by a certain VulnDisco Pack module.  NOTE: the provenance of this information is unknown; the details are obtained from third party information. As of 20061116, this disclosure has no actionable information. However, since the VulnDisco Pack author is a reliable researcher, the disclosure is being assigned a CVE identifier for tracking purposes.
CVSS v2.0 score: 5
CVE-2011-4083 
The sosreport utility in the Red Hat sos package before 1.7-9 and 2.x before 2.2-17 includes (1) Certificate-based Red Hat Network private entitlement keys and the (2) private key for the entitlement in an archive of debugging information, which might allow remote attackers to obtain sensitive information by reading the archive.
CVSS v2.0 score: 4.3
CVE-2026-14219 URL Redirection in Bilin Software's HUMANIST Digital Human Resources
URL redirection to untrusted site ('open redirect') vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Phishing.

This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1.
CVSS v3.1 score: 5.4
GHSA-fw28-fw4m-j39f 
Rejected reason: Not used
CVE-2022-41180 
Due to lack of proper memory management, when a victim opens a manipulated Portable Document Format (.pdf, PDFPublishing.dll) file received from untrusted sources in SAP 3D Visual Enterprise Author - version 9, it is possible that a Remote Code Execution can be triggered when payload forces a stack-based overflow or a re-use of dangling pointer which refers to overwritten space in memory.
CVSS v3.1 score: 7.8
GHSA-7ccw-mj8q-vff7 
Inappropriate implementation in Input in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
CVSS v3.1 score: 6.5
GHSA-mqvw-2h8p-cf8g 
An insufficient session expiration vulnerability exists in Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27, which allows a remote attacker to reuse, spoof, or steal other user and admin sessions.
GHSA-7rrh-5xjg-2jmp 
Windows Cryptographic Services Information Disclosure Vulnerability
CVSS v3.1 score: 5.5
GHSA-hjjv-g993-99j8 
In the Linux kernel, the following vulnerability has been resolved:nvme-core: fix dev_pm_qos memleakCall dev_pm_qos_hide_latency_tolerance() in the error unwind patch to
avoid following kmemleak:-blktests (master) # kmemleak-clear; ./check nvme/044;
blktests (master) # kmemleak-scan ; kmemleak-show
nvme/044 (Test bi-directional authentication)                [passed]
    runtime  2.111s  ...  2.124s
unreferenced object 0xffff888110c46240 (size 96):
  comm "nvme", pid 33461, jiffies 4345365353 (age 75.586s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<0000000069ac2cec>] kmalloc_trace+0x25/0x90
    [<000000006acc66d5>] dev_pm_qos_update_user_latency_tolerance+0x6f/0x100
    [<00000000cc376ea7>] nvme_init_ctrl+0x38e/0x410 [nvme_core]
    [<000000007df61b4b>] 0xffffffffc05e88b3
    [<00000000d152b985>] 0xffffffffc05744cb
    [<00000000f04a4041>] vfs_write+0xc5/0x3c0
    [<00000000f9491baf>] ksys_write+0x5f/0xe0
    [<000000001c46513d>] do_syscall_64+0x3b/0x90
    [<00000000ecf348fe>] entry_SYSCALL_64_after_hwframe+0x72/0xdc
CVSS v3.1 score: 5.5
CVE-2023-37316 D-Link DAP-2622 DDP Set IPv6 Address Default Gateway Stack-based Buffer Overflow Remote Code Execution Vulnerability
D-Link DAP-2622 DDP Set IPv6 Address Default Gateway Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.
. Was ZDI-CAN-20094.
CVSS v3.0 score: 8.8
CVE-2012-1676 
Unspecified vulnerability in the Oracle FLEXCUBE Direct Banking component in Oracle Financial Services Software 5.0.2, 5.3.0 through 5.3.4, 6.0.1, and 6.2.0 allows remote authenticated users to affect confidentiality via unknown vectors related to Virtual Banking.
CVSS v2.0 score: 3.5
RHSA-2017:2863 Red Hat Security Advisory: kernel security and bug fix update
kernel: Possible heap buffer overflow in brcmf_cfg80211_mgmt_tx()
CVSS v3.0 score: 6.8
CVE-2026-7832 IObit Advanced SystemCare Service ASC.exe symlink
A security flaw has been discovered in IObit Advanced SystemCare 19. This affects an unknown part of the file ASC.exe of the component Service. The manipulation results in symlink following. Attacking locally is a requirement. This attack is characterized by high complexity. It is indicated that the exploitability is difficult. The exploit has been released to the public and may be used for attacks.
CVSS v4.0 score: 7.3
CVSS v3.1 score: 7
CVSS v3.0 score: 7
CVSS v2.0 score: 6
CVE-2021-38360 wp-publications <= 0.0 Local File Include
The wp-publications WordPress plugin is vulnerable to restrictive local file inclusion via the Q_FILE parameter found in the ~/bibtexbrowser.php file which allows attackers to include local zip files and achieve remote code execution, in versions up to and including 0.0.
CVSS v3.1 score: 8.3
GHSA-pmp9-6wg3-93fg 
Reflected Cross-Site Scripting (XSS) vulnerability in Blockonomics WordPress Bitcoin Payments – Blockonomics plugin <= 3.5.7 versions.
CVSS v3.1 score: 6.1
CVE-2023-6652 code-projects Matrimonial Site register.php register sql injection
A vulnerability was found in code-projects Matrimonial Site 1.0. It has been declared as critical. Affected by this vulnerability is the function register of the file /register.php. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-247345 was assigned to this vulnerability.
CVSS v3.1 score: 7.3
CVSS v3.0 score: 7.3
CVSS v2.0 score: 7.5
GHSA-w6m9-39cv-2fwp Note Mark: Username Enumeration via Login Endpoint Timing Side-Channel
SummaryA timing side-channel in the login endpoint allows unauthenticated attackers to determine whether a username exists by measuring response time differences. Requests for valid usernames take noticeably longer because the server performs bcrypt password verification, while requests for nonexistent usernames return much faster. This enables reliable remote username enumeration and increases the risk of targeted credential attacks.DetailsThe issue affects the login endpoint:`POST /api/auth/token`The root cause is that authentication processing takes different code paths depending on whether the supplied username exists. When the username is found, the server performs `bcrypt.CompareHashAndPassword`, which adds substantial latency. When the username does not exist, the server returns immediately without performing an equivalent bcrypt operation.Vulnerable flow:This creates a measurable timing discrepancy between:**existing username + wrong password** requests, which incur bcrypt cost**nonexistent username + any password** requests, which avoid bcrypt entirelyBecause no constant-time equalization is performed, the endpoint leaks account existence through timing behavior.The measurements provided show a large and consistent gap between the two cases across repeated trials, making the difference distinguishable without requiring especially high request volume. In the supplied test results:existing user requests averaged about `0.0616s`nonexistent user requests averaged about `0.0027s`That gap is large enough to support reliable username enumeration under typical testing conditions.PoCThe issue can be reproduced by sending repeated authentication attempts to the login endpoint using the same invalid password while alternating between a known valid username and a nonexistent username, then comparing average response times. Valid usernames consistently take longer because bcrypt verification is performed.Impact**Type:** Timing side-channel / username enumeration**Who is impacted:** Any deployment exposing the affected login endpoint**Security impact:** Unauthenticated attackers can confirm valid usernames one at a time, improving the effectiveness of credential stuffing, password spraying, phishing, and other targeted account attacks**Attack preconditions:** None beyond network access to the login endpoint**Confidentiality impact:** Low to moderate, depending on the sensitivity of account existence in the target environment
CVSS v3.1 score: 3.7
CVE-2025-48701 
openDCIM through 23.04 allows SQL injection in people_depts.php because prepared statements are not used.
CVSS v3.1 score: 5.4
GHSA-wr66-4wc3-frfh 
Logic vulnerabilities in the baseband.Successful exploitation of this vulnerability may affect service integrity.
CVSS v3.1 score: 7.5
CVE-2012-0389 
Cross-site scripting (XSS) vulnerability in ForgottenPassword.aspx in MailEnable Professional, Enterprise, and Premium 4.26 and earlier, 5.x before 5.53, and 6.x before 6.03 allows remote attackers to inject arbitrary web script or HTML via the Username parameter.
CVSS v2.0 score: 4.3
GHSA-mvh5-v533-3v55 
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Creative Solutions Contact Form Generator : Creative form builder for WordPress allows SQL Injection.This issue affects Contact Form Generator : Creative form builder for WordPress: from n/a through 2.6.0.
CVSS v3.1 score: 9.8
CVE-2023-29374 
In LangChain through 0.0.131, the LLMMathChain chain allows prompt injection attacks that can execute arbitrary code via the Python exec method.
CVSS v3.1 score: 9.8
GHSA-qcmf-37hx-74m3 
The User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the name parameter in all versions up to, and including, 1.0.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in feedback form responses that will execute whenever a high-privileged user tries to view them.
CVSS v3.1 score: 7.2
CVE-2009-2925 
Directory traversal vulnerability in DJcalendar.cgi in DJCalendar allows remote attackers to read arbitrary files via a .. (dot dot) in the TEMPLATE parameter.
CVSS v2.0 score: 7.8
CVE-2026-32008 OpenClaw < 2026.2.21 - Arbitrary Local File Read via Browser Navigation Guard
OpenClaw versions prior to 2026.2.21 contain an improper URL scheme validation vulnerability in the assertBrowserNavigationAllowed() function that allows authenticated users with browser-tool access to navigate to file:// URLs. Attackers can exploit this by accessing local files readable by the OpenClaw process user through browser snapshot and extraction actions to exfiltrate sensitive data.
CVSS v4.0 score: 7.1
CVSS v3.1 score: 6.5
CVE-2005-0855 
CoolForum 0.8.1 beta and earlier allows remote attackers to obtain sensitive path information via direct requests to (1) entete.php, (2) profile_accueil.php, (3) profile_mdp.php, (4) profile_notify.php, (5) profile_options.php, (6) profile_perso.php, (7) profile_pm.php, or (8) readannonce.php, which leaks the full pathname in a PHP error message.
CVSS v2.0 score: 10
GHSA-mmj2-2gvh-9pjf 
IBM Business Automation Workflow containers 25.0.0 through 25.0.0 Interim Fix 002, 24.0.1 through 24.0.1 Interim Fix 005, and 24.0.0 through 24.0.0 Interim Fix 006. IBM Cloud Pak for Business Automation could allow a local user with access to the container to execute OS system calls.
CVSS v3.1 score: 4.7
GHSA-54g8-pj2j-rgc7 
TOTOLINK CA300-POE V6.2c.884_B20180522 was found to contain a command injection vulnerability in the msg_process function via the Port parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVSS v3.1 score: 6.5
RHSA-2026:1922 Red Hat Security Advisory: python3.11 security update
cpython: python: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of service cpython: Excessive read buffering DoS in http.client
CVSS v3.1 score: 6.8
GHSA-85pr-x7hh-4jw2 
IBM Robotic Process Automation 21.0.0 through 21.0.7.1 and 23.0.0 through 23.0.1 server could allow an authenticated user to view sensitive information from installation logs.  IBM X-Force Id:  262293.
CVSS v3.1 score: 4.3
GHSA-g322-qw4j-fg2f 
An unauthenticated remote attacker can DoS the control agent due to a out-of-bounds read which may prevent or disrupt the charging functionality.
CVSS v3.1 score: 7.5
CVE-2017-8545 
A spoofing vulnerability exists in when Microsoft Outlook for Mac does not sanitize html properly, aka "Microsoft Outlook for Mac Spoofing Vulnerability".
CVSS v3.0 score: 6.5
CVSS v2.0 score: 4.3
GHSA-f9j7-c6rx-hpc7 
XSS and/or a Client Side URL Redirect exists in OpenText Documentum Webtop 5.3 SP2. The parameter startat in "/webtop/help/en/default.htm" is vulnerable.
CVSS v3.0 score: 6.1
GHSA-7v7w-f7c6-f829 YetiForceCRM is vulnerable to Business Logic Errors because product amount can be a negative number
YetiForceCRM is vulnerable to Business Logic Errors because product amount can be a negative number.
CVSS v3.0 score: 7.3
CVE-2014-4226 
Unspecified vulnerability in the PeopleSoft Enterprise FIN Install component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
CVSS v2.0 score: 5.1
GHSA-pj5x-m9rp-22m5 
Multiple argument injection vulnerabilities in PPLive.exe in PPLive 1.9.21 and earlier allow remote attackers to execute arbitrary code via a UNC share pathname in the LoadModule argument to the (1) synacast, (2) Play, (3) pplsv, or (4) ppvod URI handler.  NOTE: some of these details are obtained from third party information.
GHSA-x28m-8977-r45c 
An issue was discovered in xmppserver jar in the XMPP Server component of the JIve platform, as used in Pascom Cloud Phone System before 7.20.x (and in other products). An endpoint in the backend Tomcat server of the Pascom allows SSRF, a related issue to CVE-2019-18394.
CVSS v3.1 score: 7.5
CVE-2018-16955 
The login function of Oracle WebCenter Interaction Portal 10.3.3 is vulnerable to reflected cross-site scripting (XSS). The content of the in_hi_redirect parameter, when prefixed with the https:// scheme, is unsafely reflected in a HTML META tag in the HTTP response. NOTE: this CVE is assigned by MITRE and isn't validated by Oracle because Oracle WebCenter Interaction Portal is out of support.
CVSS v3.0 score: 6.1
CVSS v2.0 score: 4.3
GHSA-w3qq-h832-55jf 
IBM Informix Dynamic Server 12.10 and 14.10 archecker is vulnerable to a heap buffer overflow, caused by improper bounds checking which could allow a local user to cause a segmentation fault.  IBM X-Force ID:  251204.
CVSS v3.1 score: 6.2
CVE-2025-5958 
Use after free in Media in Google Chrome prior to 137.0.7151.103 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS v3.1 score: 8.8
CVE-2025-62575 Mirion Medical EC2 Software NMIS BioDose Incorrect Permission Assignment for Critical Resource
NMIS/BioDose V22.02 and previous versions rely on a Microsoft SQL Server database. The SQL user account 'nmdbuser' and other created accounts by default have the sysadmin role. This can lead to remote code execution through the use of certain built-in stored procedures.
CVSS v4.0 score: 8.7
CVSS v3.1 score: 8.3
CVE-2025-9690 SourceCodester Advanced School Management System vendordetails sql injection
A flaw has been found in SourceCodester Advanced School Management System 1.0. This affects an unknown function of the file /index.php/stock/vendordetails. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 6.3
CVSS v3.0 score: 6.3
CVSS v2.0 score: 6.5
CVE-2022-22578 
A logic issue was addressed with improved validation. This issue is fixed in tvOS 15.3, iOS 15.3 and iPadOS 15.3, watchOS 8.4, macOS Monterey 12.2. A malicious application may be able to gain root privileges.
CVSS v3.1 score: 7.8
CVSS v2.0 score: 9.3
CVE-2016-6272 
XPath injection vulnerability in Epic MyChart allows remote attackers to access contents of an XML document containing static display strings, such as field labels, via the topic parameter to help.asp. NOTE: this was originally reported as a SQL injection vulnerability, but this may be inaccurate.
CVSS v3.0 score: 7.5
CVSS v2.0 score: 5
GHSA-fc6j-rjwv-62c9 
A security flaw has been discovered in Tenda CX12L 16.03.53.12. This vulnerability affects the function fromRouteStatic of the file /goform/RouteStatic. The manipulation of the argument page results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
CVSS v4.0 score: 7.4
CVSS v3.1 score: 8.8
CVE-2026-3457 Stored XSS vulnerability in Sentinel ACC
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Thales Sentinel LDK Runtime on Windows allows Stored XSS.This issue affects Sentinel LDK Runtime: before 10.22.
CVSS v4.0 score: 7
GHSA-v95x-xhq5-4929 kumactl connects to control plane without verifying TLS certificate when no CA is configured
When an operator adds an HTTPS control plane profile to `kumactl` without providing a CA certificate, `kumactl` disables TLS verification and sends API tokens over the unverified connectionImpactAn attacker on the network path between the operator and the control plane can intercept user or admin API tokens and then act against the control plane as that userAffected configurations`kumactl` profiles manually added against an HTTPS control plane endpoint without `--ca-cert-file`Not affectedThe default local profile, which uses plain HTTPWorkaroundsWhen adding an HTTPS control plane profile to `kumactl`, always pass `--ca-cert-file` pointing at the control plane's serving CA. Alternatively, terminate the control plane behind a publicly trusted certificate; the patched releases will verify successfully against the operating system trust store with no further configurationResourcesFix: https://github.com/kumahq/kuma/pull/16777
CVSS v4.0 score: 5.5
GHSA-2m36-m26c-9mc8 
An elevation of privilege vulnerability in the Huawei bootloader. Product: Android. Versions: Android kernel. Android ID: A-34622855.
CVSS v3.0 score: 9.8
CVE-2017-3732 BN_mod_exp may produce incorrect results on x86_64
There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL 1.0.2 before 1.0.2k and 1.1.0 before 1.1.0d. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be very significant and likely only accessible to a limited number of attackers. An attacker would additionally need online access to an unpatched system using the target private key in a scenario with persistent DH parameters and a private key that is shared between multiple clients. For example this can occur by default in OpenSSL DHE based SSL/TLS ciphersuites. Note: This issue is very similar to CVE-2015-3193 but must be treated as a separate problem.
CVSS v3.1 score: 5.9
CVSS v2.0 score: 4.3
RHBA-2022:3945 Red Hat Bug Fix Advisory: new packages: vim
vim: Use after free in src/ex_cmds.c
CVSS v3.1 score: 7.3
CVE-2017-0410 
An elevation of privilege vulnerability in the Framework APIs could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-31929765.
CVSS v3.0 score: 7.8
CVSS v2.0 score: 9.3
GHSA-59h3-wp7j-68gw 
SQL Injection vulnerability in Boelter Blue System Management v.1.3 allows a remote attacker to execute arbitrary code and obtain sensitive information via the id parameter to news_details.php and location_details.php; and the section parameter to services.php.
CVSS v3.1 score: 9.1
GHSA-g99p-47x7-mq88 go-f3 module vulnerable to integer overflow leading to panic
ImpactFilecoin nodes consuming F3 messages are vulnerable.  go-f3 panics when it validates a "poison" messages.  A "poison" message can can cause integer overflow in the signer index validation.  In Lotus' case, the whole node will crash.There is no barrier to entry.  An attacker doesn't need any power to pull off this attack.These malicious messages aren't self-propagating since the bug is in the validator.  An attacker needs to directly send the message to all targets.PatchesThe fix was merged and released with go-f3 0.8.7.  All node software (Lotus, Forest, Venus) are using a patched version of go-f3 with their updates for the nv27 network upgrade.go-f3 now does proper overflow checking using `math.MaxInt64` comparison and returns error `"justificationPower overflow"` when overflow would occur.WorkaroundsThe are no immediate workarounds available.  Nodes should upgrade to the patched version, which they will have done if participating in nv27 on Filecoin mainnet.CreditsThe initial finding(unrelated path) was reported by [0xNirix](https://github.com/0xNirix) via bug bounty program which wasn't high issue. The further digging by developers led to this finding. Thank you for the contributions.
CVSS v3.1 score: 7.5
GHSA-vwqw-r29w-hrg7 
QTS, QuTS hero, QuTScloud are not affected.We have already fixed the vulnerability in the following version:
CVSS v4.0 score: 5.1
GHSA-4v37-24gm-h554 Cross-Site Request Forgery (CSRF) Protection Bypass Vulnerability in CodeIgniter4
ImpactThis vulnerability might allow remote attackers to bypass the CodeIgniter4 CSRF protection mechanism.PatchesUpgrade to v4.1.9 or later.WorkaroundsThese are workarounds for this vulnerability, but **you will still need to code as these after upgrading to v4.1.9**.
Otherwise, the CSRF protection may be bypassed.When Auto-Routing is EnabledCheck the request method in the controller method before processing.E.g.:When Auto-Routing is DisabledDo one of the following:Do not use `$routes->add()`, and [use HTTP verbs in routes](https://codeigniter4.github.io/userguide/incoming/routing.html#using-http-verbs-in-routes).Check the request method in the controller method before processing.E.g.:References[CodeIgniter4 CSRF protection](https://codeigniter4.github.io/userguide/libraries/security.html#cross-site-request-forgery-csrf)For more informationIf you have any questions or comments about this advisory:Open an issue in [codeigniter4/CodeIgniter4](https://github.com/codeigniter4/CodeIgniter4/issues)Email us at [SECURITY.md](https://github.com/codeigniter4/CodeIgniter4/blob/develop/SECURITY.md)
CVSS v3.1 score: 6.3
GHSA-fcmh-7492-g4q9 z-song laravel-admin XSS via the Slug or Name on the Roles screen
z-song laravel-admin 1.7.3 has XSS via the Slug or Name on the Roles screen, because of mishandling on the "Operation log" screen.
CVSS v3.1 score: 4.8
CVE-2013-3317 
Netgear WNR1000v3 with firmware before 1.0.2.60 contains an Authentication Bypass via the NtgrBak key.
CVSS v3.1 score: 9.8
CVSS v2.0 score: 10
CVE-2005-1911 
The fetchnews NNTP client in leafnode 1.11.2 and earlier can hang while waiting for input that never arrives, which allows remote NNTP servers to cause a denial of service (news loss).
CVSS v2.0 score: 5
CVE-2024-30571 
An information leak in the BRS_top.html component of Netgear R6850 v1.1.0.88 allows attackers to obtain sensitive information without any authentication required.
CVSS v3.1 score: 7.5
GHSA-5pm8-492c-92p5 Prototype Pollution in chartkick
Affected versions of `@polymer/polymer` are vulnerable to prototype pollution. The package fails to prevent modification of object prototypes through chart options containing a payload such as `{"__proto__": {"polluted": true}}`. It is possible to achieve the same results if a chart loads data from a malicious server.RecommendationUpgrade to version 3.2.0 or later.
CVSS v3.1 score: 7.3
CVE-2026-12456 
Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.155 allowed an attacker who convinced a user to install a malicious extension to bypass same origin policy via a crafted Chrome Extension. (Chromium security severity: High)
CVSS v3.1 score: 4.2
GHSA-6929-8p9f-26jx SimpleSAMLphp HTTP-Artifact TLS validator confusion allows cross-IdP authentication bypass
SummarySimpleSAMLphp's HTTP-Artifact receive path can treat an unsigned embedded SAML `Response` as cryptographically valid for the wrong IdP.In the `HTTPArtifact::receive()` flow, the SOAP `ArtifactResponse` receives a TLS-based validator from `SOAPClient::addSSLValidator()`. The embedded SAML `Response` then receives a validator that delegates signature validation to that outer `ArtifactResponse`. Later, the SP validates the embedded `Response` against metadata selected from the embedded response issuer, not necessarily the artifact issuer.The critical issue is that `SOAPClient::validateSSL()` returns normally when the TLS public key does not match the key currently being validated. `SAML2\Message::validate()` treats any validator call that does not throw an exception as successful. As a result, an `ArtifactResponse` obtained from one IdP can validate an unsigned embedded SAML `Response` that claims to be issued by a different IdP.In a multi-IdP/federation deployment where a malicious or lower-trust IdP can issue an HTTP-Artifact response to an SP, this can allow the attacker to authenticate to the SP as arbitrary users from a higher-trust victim IdP.ImpactA malicious or lower-trust IdP in the same SP/federation trust set can authenticate to the SP as users from another IdP when HTTP-Artifact is used. The attacker can choose assertion attributes, `NameID`, and session data in the forged unsigned assertion.This is an authentication bypass and identity-provider impersonation issue. In realistic federations, the security boundary between IdPs matters: a compromised or low-assurance IdP should not be able to mint identities for a high-assurance IdP.
CVSS v3.1 score: 8.7
CVE-2020-19825 
Cross Site Scripting (XSS) vulnerability in kevinpapst kimai2 1.30.0 in /src/Twig/Runtime/MarkdownExtension.php, allows attackers to gain escalated privileges.
CVSS v3.1 score: 9.6
CVE-2025-3608 Race condition in nsHttpTransaction could lead to memory corruption
A race condition existed in nsHttpTransaction that could have been exploited to cause memory corruption, potentially leading to an exploitable condition. This vulnerability was fixed in Firefox 137.0.2.
CVSS v3.1 score: 6.5
CVE-2024-7244 Panda Security Dome VPN DLL Hijacking Local Privilege Escalation Vulnerability
Panda Security Dome VPN DLL Hijacking Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Panda Security Dome. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the VPN process. The process does not restrict DLL search to trusted paths, which can result in the loading of a malicious DLL. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-23428.
CVSS v3.0 score: 7.8
CVE-2017-18008 
In ImageMagick 7.0.7-17 Q16, there is a Memory Leak in ReadPWPImage in coders/pwp.c.
CVSS v3.0 score: 6.5
CVSS v2.0 score: 4.3
GHSA-jv49-4gm9-79jh 
Integer overflow in the calloc function in libc/stdlib/malloc.c in jemalloc in libc for FreeBSD 6.4 and NetBSD makes it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value, which triggers a memory allocation of one byte.
CVE-2022-1278 
A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain.
CVSS v3.1 score: 7.5
ICSA-26-225-01 AVEVA Enterprise SCADA
The vulnerability, if exploited, could allow an authenticated miscreant with "DNA Authority - Operator" privilege to tamper with serialized data, potentially resulting in code execution during deserialization under the privilege of Enterprise SCADA security group "DNA Apps".
CVSS v3.1 score: 7.1
CVE-2018-1164 
This vulnerability allows remote attackers to cause a denial-of-service condition on vulnerable installations of ZyXEL P-870H-51 DSL Router 1.00(AWG.3)D5. Authentication is not required to exploit this vulnerability. The specific flaw exists within numerous exposed CGI endpoints. The vulnerability is caused by improper access controls that allow access to critical functions without authentication. An attacker can use this vulnerability to reboot affected devices, along with other actions. Was ZDI-CAN-4540.
CVSS v3.0 score: 9.8
CVSS v2.0 score: 10
CVE-2017-14487 
The OhMiBod Remote app for Android and iOS allows remote attackers to impersonate users by sniffing network traffic for search responses from the OhMiBod API server and then editing the username, user_id, and token fields in data/data/com.ohmibod.remote2/shared_prefs/OMB.xml.
CVSS v3.0 score: 9.1
CVSS v2.0 score: 6.4
RHSA-2024:0959 Red Hat Security Advisory: thunderbird security update
Mozilla: Out-of-bounds memory read in networking channels Mozilla: Alert dialog could have been spoofed on another site Mozilla: Fullscreen Notification could have been hidden by select element Mozilla: Custom cursor could obscure the permission dialog Mozilla: Mouse cursor re-positioned unexpectedly could have led to unintended permission grants Mozilla: Multipart HTTP Responses would accept the Set-Cookie header in response parts Mozilla: Incorrect code generation on 32-bit ARM devices Mozilla: Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8
CVSS v3.1 score: 7.5
CVE-2011-2076 
MediaCAST 8 and earlier stores passwords in cleartext, which makes it easier for context-dependent attackers to obtain sensitive information by reading an unspecified password data store, a different vulnerability than CVE-2010-0216.
CVSS v2.0 score: 5
CVE-2025-67014 
Incorrect access control in DEV Systemtechnik GmbH DEV 7113 RF over Fiber Distribution System 32-0078 H.01 allows unauthenticated attackers to access an administrative endpoint.
CVSS v3.1 score: 7.5
GHSA-7q9p-cx8r-rh2q 
When doing SSH-based transfers using either SCP or SFTP, and setting the
known_hosts file, libcurl could still mistakenly accept connecting to hosts
*not present* in the specified file if they were added as recognized in the
libssh *global* known_hosts file.
CVSS v3.1 score: 5.3
CVE-2023-2671 SourceCodester Lost and Found Information System Contact Form cross site scripting
A vulnerability was found in SourceCodester Lost and Found Information System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file classes/Master.php?f=save_inquiry of the component Contact Form. The manipulation of the argument fullname/contact/message leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-228887.
CVSS v3.1 score: 3.5
CVSS v3.0 score: 3.5
CVSS v2.0 score: 4
GHSA-x7v9-qqww-p3gc 
The analytics-tracker plugin before 1.1.1 for WordPress has XSS via a search event.
GHSA-g8jg-wcrf-374h 
Respondus 1.1.2 for WebCT uses weak encryption to remember usernames and passwords, which allows local users who can read the WEBCT.SVR file to decrypt the passwords and gain additional privileges.
CVE-2025-71368 picklescan - Arbitrary Code Execution via Undetected doctest.debug_script
picklescan before 0.0.30 fails to detect the doctest.debug_script function when analyzing pickle files, allowing attackers to execute arbitrary code. Remote attackers can craft malicious pickle files embedding doctest.debug_script calls that bypass picklescan detection and execute arbitrary commands upon pickle.load invocation.
CVSS v4.0 score: 7.6
CVSS v3.1 score: 8.1
GHSA-vqjc-v52h-6f2g 
The WP MultiTasking  WordPress plugin through 0.1.12 does not have CSRF check when updating exit popups, which could allow attackers to make logged admins perform such action via a CSRF attack
CVSS v3.1 score: 6.5
GHSA-mxhr-3xg4-5hx7 
Snoopy 1.0 in Nagios XI 5.5.6 allows remote unauthenticated attackers to execute arbitrary commands via a crafted HTTP request.
CVSS v3.0 score: 9.8
RHSA-2015:1905 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.4 update
AS/WildFly: missing X-Frame-Options header leading to clickjacking EAP: CSRF vulnerability in EAP & WildFly Web Console OOME from EAP 6 http management console
GHSA-w4wp-6c4p-vfjm 
In the Linux kernel, the following vulnerability has been resolved:mtd: rawnand: gpmi: don't leak PM reference in error pathIf gpmi_nfc_apply_timings() fails, the PM runtime usage counter must be
dropped.
CVSS v3.1 score: 7.8
CVE-2026-54479 EVoke Systems EVoke CSMS Insufficient Session Expiration
The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 7.3
CVE-2011-1522 
Multiple SQL injection vulnerabilities in the Doctrine\DBAL\Platforms\AbstractPlatform::modifyLimitQuery function in Doctrine 1.x before 1.2.4 and 2.x before 2.0.3 allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset field.
CVSS v2.0 score: 7.5
GHSA-c2h5-7f6m-jqmp 
Spoofing replies to Recursor might mark an IP of an authoritative server as not supporting EDNS, causing valdiation of DNSSEC records served by that server to fail.
CVSS v3.1 score: 5.9
GHSA-qvp6-cqcj-98gv 
Multiple SQL injection vulnerabilities in DropAFew before 0.2.1 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in the delete action in (a) search.php or (b) search-pda.php, or the (2) calories parameter in a save action in editlogcal.php.
CVE-2017-11893 
ChakraCore and Microsoft Edge in Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11886, CVE-2017-11889, CVE-2017-11890, CVE-2017-11894, CVE-2017-11895, CVE-2017-11901, CVE-2017-11903, CVE-2017-11905, CVE-2017-11907, CVE-2017-11908, CVE-2017-11909, CVE-2017-11910, CVE-2017-11911, CVE-2017-11912, CVE-2017-11913, CVE-2017-11914, CVE-2017-11916, CVE-2017-11918, and CVE-2017-11930.
CVSS v3.0 score: 7.5
CVSS v2.0 score: 7.6
GHSA-4p6f-vmpg-88hm 
Heap buffer overflow in Internals in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS v3.1 score: 8.8
PYSEC-2023-168 
Vyper is a Pythonic Smart Contract Language. In affected versions the order of evaluation of the arguments of the builtin functions `uint256_addmod`, `uint256_mulmod`, `ecadd` and `ecmul` does not follow source order. This behaviour is problematic when the evaluation of one of the arguments produces side effects that other arguments depend on. A patch is currently being developed on pull request #3583. When using builtins from the list above, users should make sure that the arguments of the expression do not produce side effects or, if one does, that no other argument is dependent on those side effects.
CVSS v3.1 score: 5.3
GHSA-8whm-5rcq-6487 
Cross-Site Request Forgery (CSRF) vulnerability in WPClever WPC Product Bundles for WooCommerce.This issue affects WPC Product Bundles for WooCommerce: from n/a through 7.3.1.
CVSS v3.1 score: 4.3
CVE-2008-7248 
Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery (CSRF) protection for requests to applications that rely on this protection, as demonstrated using text/plain.
CVSS v2.0 score: 6.8
CVE-2025-23146 mfd: ene-kb3930: Fix a potential NULL pointer dereference
In the Linux kernel, the following vulnerability has been resolved:

mfd: ene-kb3930: Fix a potential NULL pointer dereference

The off_gpios could be NULL. Add missing check in the kb3930_probe().
This is similar to the issue fixed in commit b1ba8bcb2d1f
("backlight: hx8357: Fix potential NULL pointer dereference").

This was detected by our static analysis tool.
CVSS v3.1 score: 5.5
CVE-2026-65470 WordPress Fluent Support plugin <= 2.3.0 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in Fluent Support <= 2.3.0 versions.
CVSS v3.1 score: 6.5
GHSA-3p5c-4j36-fmjf 
A post-authentication arbitrary file read vulnerability within the server plugins section in plugin edition feature. This issue affects Pandora FMS: from 700 through <777.3.
CVSS v4.0 score: 8.3
CVSS v3.1 score: 8.8
GHSA-cpjc-p7fc-j9xh Mail Improper Input Validation vulnerability
The deliver function in the sendmail delivery agent (`lib/mail/network/delivery_methods/sendmail.rb`) in Ruby Mail gem 2.2.14 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an e-mail address.
GHSA-qw58-58rf-9phv 
Lexiglot through 2014-11-20 allows local users to obtain sensitive information by listing a process because the username and password are on the command line.
CVE-2019-11759 
An attacker could have caused 4 bytes of HMAC output to be written past the end of a buffer stored on the stack. This could be used by an attacker to execute arbitrary code or more likely lead to a crash. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2.
CVSS v3.1 score: 8.8
CVSS v2.0 score: 6.8
GHSA-8j53-28jm-72jx 
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0609, CVE-2019-0639, CVE-2019-0680, CVE-2019-0769, CVE-2019-0770, CVE-2019-0771, CVE-2019-0773.
CVSS v3.0 score: 7.5
CVE-2011-5289 
The SaveDecrypted method in the ChilkatCrypt2.ChilkatOmaDrm.1 ActiveX control in ChilkatCrypt2.dll in aTube Catcher 2.3.570 allows remote attackers to write to arbitrary files via a pathname in the argument.
CVSS v2.0 score: 6.4
GHSA-m47c-jf7w-67w3 
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects RBK752 before 3.2.16.6, RBR750 before 3.2.16.6, RBS750 before 3.2.16.6, RBK852 before 3.2.16.6, RBR850 before 3.2.16.6, and RBS850 before 3.2.16.6.
CVE-2005-2413 
PHP remote file inclusion vulnerability in apa_phpinclude.inc.php in Atomic Photo Album (APA) allows remote attackers to execute arbitrary PHP code via the apa_module_basedir parameter.
CVSS v2.0 score: 5
CVE-2020-13843 
An issue was discovered on LG mobile devices with Android OS software before 2020-06-01. Local users can cause a denial of service because checking of the userdata partition is mishandled. The LG ID is LVE-SMP-200014 (June 2020).
CVSS v3.1 score: 5.5
CVSS v2.0 score: 4.9
GHSA-q984-c5g7-6mwg 
Multiple vulnerabilities in specific Cisco Identity Services Engine (ISE) CLI commands could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit these vulnerabilities, an attacker must have valid Administrator privileges on the affected device.
 These vulnerabilities are due to insufficient validation of user-supplied input. An attacker could exploit these vulnerabilities by submitting a crafted CLI command. A successful exploit could allow the attacker to elevate privileges to root.
CVSS v3.1 score: 6.7
CVE-2020-3667 
u'Buffer Overflow in mic calculation for WPA due to copying data into buffer without validating the length of buffer' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8098, IPQ5018, IPQ6018, IPQ8074, Kamorta, MSM8998, Nicobar, QCA6390, QCA8081, QCS404, QCS405, QCS605, Rennell, SA415M, Saipan, SC7180, SC8180X, SDA845, SDM630, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SM6150, SM7150, SM8150, SM8250, SXR1130
CVSS v3.1 score: 9.8
CVSS v2.0 score: 10
CVE-2021-43408 Duplicate Post WordPress Plugin SQL Injection Vulnerability
The "Duplicate Post" WordPress plugin up to and including version 1.1.9 is vulnerable to SQL Injection. SQL injection vulnerabilities occur when client supplied data is included within an SQL Query insecurely. SQL Injection can typically be exploited to read, modify and delete SQL table data. In many cases it also possible to exploit features of SQL server to execute system commands and/or access the local file system. This particular vulnerability can be exploited by any authenticated user who has been granted access to use the Duplicate Post plugin. By default, this is limited to Administrators, however the plugin presents the option to permit access to the Editor, Author, Contributor and Subscriber roles.
CVSS v3.1 score: 6.5
CVE-2017-14753 
Cross-site scripting (XSS) vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated users to inject arbitrary web script or HTML via the filter parameter to module/module_filters/index.php.
CVSS v3.0 score: 5.4
CVSS v2.0 score: 3.5
GHSA-qx7g-fx8q-545g Para Inserts Sensitive Information into Log File for Facebook authentication
CWE ID: CWE-532 (Insertion of Sensitive Information into Log File)
CVSS: 6.2 (Medium)
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N**Affected Component:** Facebook Authentication Logging
**Version:** Para v1.50.6
**File Path:** para-1.50.6/para-server/src/main/java/com/erudika/para/server/security/filters/FacebookAuthFilter.java
**Vulnerable Line(s):** Line 184 (logger.warn(...) with raw access token)Technical Details:The vulnerability is located in FacebookAuthFilter.java, where a failed request to Facebook’s user profile endpoint triggers the following log statement:Here, `PROFILE_URL` is a constant:This results in the full request URL being logged, including the user's access token in plain text. Since WARN-level logs are often retained in production and accessible to operators or log aggregation systems, this poses a risk of token exposure.
CVSS v3.1 score: 6.2