CIRCL/vulnerability-scores huggingface dataset:
CVE-2023-32967 QTS, QuTScloud
An incorrect authorization vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to bypass intended access restrictions via a network.
QTS 5.x, QuTS hero are not affected.

We have already fixed the vulnerability in the following versions:
QuTScloud c5.1.5.2651 and later
QTS 4.5.4.2627 build 20231225 and later

CVSS v3.1 score: 5
CVE-2006-1643 
SQL injection vulnerability in login.php in Interact 2.1.1 allows remote attackers to execute arbitrary SQL commands via the user_name parameter.  NOTE: the provenance of this information is unknown; the details are obtained from third party.
CVSS v2.0 score: 7.5
RHSA-2016:1588 Red Hat Security Advisory: java-1.7.1-ibm security update
JDK: unspecified vulnerability fixed in 7u111 and 8u101 (Deployment) OpenJDK: incorrect handling of MethodHandles.dropArguments() argument (Libraries, 8155985)
CVSS v3.0 score: 8.8
GHSA-jgqf-hwc5-hh37 Root Path Disclosure in send
Versions of `send` prior to 0.11.2 are affected by an information leakage vulnerability which may allow an attacker to enumerate paths on the server filesystem.RecommendationUpdate to version 0.11.1 or later.
CVSS v3.0 score: 5.3
GHSA-gvpc-fhpp-hm84 
UDM provides support for running commands after a download is completed, this is currently made use of for click package installation. This functionality was not restricted to unconfined applications. Before UDM version 1.2+16.04.20160408-0ubuntu1 any confined application could make use of the UDM C++ API to run arbitrary commands in an unconfined environment as the phablet user.
CVSS v3.0 score: 9.8
CVE-2020-3889 
A logic issue was addressed with improved state management. This issue is fixed in macOS Catalina 10.15.4. A local user may be able to read arbitrary files.
CVSS v3.1 score: 5.5
CVSS v2.0 score: 2.1
GHSA-42c5-x389-m7vp 
Eval injection vulnerability in the Digest module before 1.17 for Perl allows context-dependent attackers to execute arbitrary commands via the new constructor.
GHSA-vgm6-6v2c-qf82 
Cross-site scripting vulnerability in index.php in M-Phorum 0.2 allows remote attackers to inject arbitrary web script or HTML via the go parameter.
GHSA-8h58-w33p-wq3g rPGP affected by crash in message handling for deeply nested messages
SummaryPrevious rPGP versions could be caused to crash with a "stack overflow" when parsing messages that contain deeply nested message layers, such as messages with many signatures.rPGP 0.19.0 resolves this issue with a more robust message handling implementation (via https://github.com/rpgp/rpgp/pull/625).ImpactAn attacker could cause applications to crash in rPGP's message parsing subsystem, when applications attempt to ingest messages.AttributionDiscovered internally during rPGP development, using a fuzz test suite previously contributed by Christian Reitter.
CVSS v4.0 score: 8.7
CVE-2022-35714 
IBM Maximo Asset Management 7.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 231116.
CVSS v3.0 score: 5.4
GHSA-f9gm-wm64-8rg3 
Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations to gain access to already freed memory.This issue affects Bifrost GPU Kernel Driver: from r43p0 through r49p0; Valhall GPU Kernel Driver: from r43p0 through r49p0; Arm 5th Gen GPU Architecture Kernel Driver: from r43p0 through r49p0.
CVSS v3.1 score: 7.8
GHSA-v3v9-4r58-fj96 
Missing Authorization vulnerability in FantasticPlugins WooCommerce Recover Abandoned Cart rac allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Recover Abandoned Cart: from n/a through <= 24.6.0.
CVSS v3.1 score: 7.5
CVE-2015-8240 
The Traffic Management Microkernel (TMM) in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, GTM, Link Controller, and BIG-IP PEM before 11.4.1 HF10, 11.5.x before 11.5.4, and 11.6.x before 11.6.0 HF6 and BIG-IP PSM before 11.4.1 HF10 does not properly handle TCP options, which allows remote attackers to cause a denial of service via unspecified vectors, related to the tm.minpathmtu database variable.
CVSS v3.0 score: 7.5
CVSS v2.0 score: 5
RHSA-2026:4143 Red Hat Security Advisory: python-pyasn1 security update
pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID
CVSS v3.1 score: 7.5
GHSA-8c47-56c4-8w57 
A vulnerability has been found in Tenda F1202 1.2.0.20(408). Affected is the function fromPPTPUserSetting of the file /goform/PPTPUserSetting. Such manipulation of the argument delno leads to stack-based buffer overflow. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 7.4
CVSS v3.1 score: 8.8
GHSA-rhh2-f22c-xh7f 
This vulnerability exists in TP-Link IoT Smart Hub due to storage of Wi-Fi credentials in plain text within the device firmware. An attacker with physical access could exploit this by extracting the firmware and analyzing the binary data to obtain the Wi-Fi credentials stored on the vulnerable device.
CVSS v4.0 score: 4.4
CVSS v3.1 score: 4.6
CVE-2022-39368 Californium Failing DTLS handshakes causes Data Loss due to throttling blocking processing of records
Eclipse Californium is a Java implementation of RFC7252 - Constrained Application Protocol for IoT Cloud services. In versions prior to 3.7.0, and 2.7.4, Californium is vulnerable to a Denial of Service. Failing handshakes don't cleanup counters for throttling, causing the threshold to be reached without being released again. This results in permanently dropping records. The issue was reported for certificate based handshakes, but may also affect PSK based handshakes. It generally affects client and server as well. This issue is patched in version 3.7.0 and 2.7.4. There are no known workarounds. main: commit 726bac57659410da463dcf404b3e79a7312ac0b9 2.7.x: commit 5648a0c27c2c2667c98419254557a14bac2b1f3f
CVSS v3.1 score: 8.2
GHSA-mx3x-ghqm-r43h Prototype pollution vulnerability in 'predefine'
Prototype pollution vulnerability in 'predefine' versions 0.0.0 through 0.1.2 allows an attacker to cause a denial of service and may lead to remote code execution.
CVSS v3.1 score: 9.8
GHSA-4qf2-cmvc-cch6 
HCL Unica MaxAI Workbench is vulnerable to improper input validation.  This allows attackers to exploit vulnerabilities such as SQL Injection, XSS, or command injection, leading to unauthorized access or data breaches, etc.
CVSS v3.1 score: 3.5
GHSA-j4fp-pv59-4m67 
Unspecified vulnerability in Kernel/Modules/AdminPackageManager.pm in OTRS-Core in Open Ticket Request System (OTRS) 2.x before 2.4.11 and 3.x before 3.0.10 allows remote authenticated administrators to read arbitrary files via unknown vectors.
GHSA-7x64-hm7m-2xjq 
Carbon Forum 5.9.0 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScript code through the Forum Name field in dashboard settings. Attackers with admin privileges can store JavaScript payloads in the Forum Name field that execute in the browsers of all users visiting the forum, enabling session hijacking and data theft.
CVSS v4.0 score: 5.1
CVSS v3.1 score: 6.4
PYSEC-2026-2327 
### Summary

adx-mcp-server (<= latest, commit 48b2933) contains KQL (Kusto Query Language) injection vulnerabilities in three MCP tool handlers: `get_table_schema`, `sample_table_data`, and `get_table_details`. The `table_name` parameter is interpolated directly into KQL queries via f-strings without any validation or sanitization, allowing an attacker (or a prompt-injected AI agent) to execute arbitrary KQL queries against the Azure Data Explorer cluster.

### Details

The MCP tools construct KQL queries by directly embedding the `table_name` parameter into query strings:

**Vulnerable code** ([permalink](https://github.com/pab1it0/adx-mcp-server/blob/48b2933/src/adx_mcp_server/server.py#L228)):

```python
@mcp.tool(...)
async def get_table_schema(table_name: str) -> List[Dict[str, Any]]:
    client = get_kusto_client()
    query = f"{table_name} | getschema"          # <-- KQL injection
    result_set = client.execute(config.database, query)
```

```python
@mcp.tool(...)
async def sample_table_data(table_name: str, sample_size: int = 10) -> List[Dict[str, Any]]:
    client = get_kusto_client()
    query = f"{table_name} | sample {sample_size}"  # <-- KQL injection
    result_set = client.execute(config.database, query)
```

```python
@mcp.tool(...)
async def get_table_details(table_name: str) -> List[Dict[str, Any]]:
    client = get_kusto_client()
    query = f".show table {table_name} details"     # <-- KQL injection
    result_set = client.execute(config.database, query)
```

KQL allows chaining query operators with `|` and executing management commands prefixed with `.`. An attacker can inject:
- `sensitive_table | project Secret, Password | take 100 //` to read arbitrary tables
- Newline-separated management commands like `.drop table important_data` via `get_table_details`
- Arbitrary KQL analytics queries via any of the three tools

**Note:** While the server also has an `execute_query` tool that accepts raw KQL by design, the three vulnerable tools are presented as safe metadata-inspection tools. MCP clients may grant automatic access to "safe" tools while requiring confirmation for `execute_query`. The injection bypasses this trust boundary.

### PoC

```python
# PoC: KQL Injection via get_table_schema tool
# The table_name parameter is injected into: f"{table_name} | getschema"

import json

# MCP tool call that exfiltrates data from a sensitive table
tool_call = {
    "name": "get_table_schema",
    "arguments": {
        "table_name": "sensitive_data | project Secret, Password | take 100 //"
    }
}
print(json.dumps(tool_call, indent=2))

# Resulting KQL: "sensitive_data | project Secret, Password | take 100 // | getschema"
# The // comments out "| getschema", executing an arbitrary data query instead

# Destructive example via get_table_details:
tool_call_destructive = {
    "name": "get_table_details",
    "arguments": {
        "table_name": "users details\n.drop table critical_data"
    }
}
# Resulting KQL:
#   .show table users details
#   .drop table critical_data details
```
CVSS v3.1 score: 8.3
GHSA-q2qw-486m-j3c6 
In the Linux kernel, the following vulnerability has been resolved:riscv: Fix module loading free orderReverse order of kfree calls to resolve use-after-free error.
CVSS v3.1 score: 7.8
CVE-2009-1262 
Format string vulnerability in Fortinet FortiClient 3.0.614, and possibly earlier, allows local users to execute arbitrary code via format string specifiers in the VPN connection name.
CVSS v2.0 score: 7.2
CVE-2019-5589 
An Unsafe Search Path vulnerability in FortiClient Online Installer (Windows version before 6.0.6) may allow an unauthenticated, remote attacker with control over the directory in which FortiClientOnlineInstaller.exe resides to execute arbitrary code on the system via uploading malicious .dll files in that directory.
CVSS v3.0 score: 7.8
CVSS v2.0 score: 9.3
CVE-2026-17016 Restore PayPal Standard for WooCommerce <= 3.1.0 - Payment Bypass via PDT Underpayment
The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not validate the amount actually paid against the order total in its PayPal Data Transfer return handler, allowing a customer to pay less than the order total and still have the order marked as fully paid when the PayPal Data Transfer feature is enabled.
CVSS v3.1 score: 3.7
CVE-2021-37110 
There is a Timing design defects in Smartphone.Successful exploitation of this vulnerability may affect service confidentiality.
CVSS v3.1 score: 7.5
CVSS v2.0 score: 5
CVE-2025-6216 Allegra calculateTokenExpDate Password Recovery Authentication Bypass Vulnerability
Allegra calculateTokenExpDate Password Recovery Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Allegra. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the password recovery mechanism. The issue results from reliance upon a predictable value when generating a password reset token. An attacker can leverage this vulnerability to bypass authentication on the application. Was ZDI-CAN-27104.
CVSS v3.0 score: 9.8
CVE-2026-70377 imagecli - Uncontrolled Memory Allocation via Unbounded scale Ratio Causes Denial of Service
imagecli's pipeline operation (Scale::apply in src/image_ops.rs) computes output width/height as (dimension as f32 * ratio) as u32 with no upper-bound validation on the CLI-supplied ratio, which is parsed via nom::number::complete::float with no range check. Any application embedding imagecli as a library and accepting user-controlled pipeline strings is remotely crashable with a single request.
CVSS v3.1 score: 7.5
GHSA-864v-5q2g-fr64 Stored XSS vulnerability in Jenkins 'keep forever' badge icon
Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the job name in the 'Keep this build forever' badge tooltip. This results in a stored cross-site scripting (XSS) vulnerability exploitable by users able to configure job names.As job names do not generally support the character set needed for XSS, this is believed to be difficult to exploit in common configurations.Jenkins 2.245, LTS 2.235.2 escapes the job name in the 'Keep this build forever' badge tooltip.
CVSS v3.1 score: 8
CVE-2021-35414 
Chamilo LMS v1.11.x was discovered to contain a SQL injection via the doc parameter in main/plagiarism/compilatio/upload.php.
CVSS v3.1 score: 9.8
CVSS v2.0 score: 7.5
GHSA-fhqq-8f65-5xfc Improper Input Validation in Buildah and Podman
A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.
CVSS v4.0 score: 5.9
CVSS v3.1 score: 4.7
GHSA-fvp3-crpw-3vgj 
A weakness has been identified in mettle sendportal up to 3.0.1. Affected is the function destroy of the file app/Http/Controllers/Workspaces/WorkspaceInvitationsController.php of the component Invitation Handler. This manipulation of the argument invitation causes authorization bypass. The attack may be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 5.4
RHSA-2024:10262 Red Hat Security Advisory: kernel security update
kernel: improper input validation may lead to privilege escalation kernel: hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs kernel: userfaultfd: fix a race between writeprotect and exit_mmap() kernel: Linux ebpf logic vulnerability leads to critical memory read and write gaining root privileges kernel: local privileges escalation in kernel/bpf/verifier.c kernel: nvme-tcp: fix UAF when detecting digest errors kernel: xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create kernel: bpf: Fix crash due to out of bounds access into reg2btf_ids. kernel: x86/mm: Randomize per-cpu entry area kernel: mm/sparsemem: fix race in accessing memory_section->usage kernel: blk-mq: fix IO hang from sbitmap wakeup race kernel: mac802154: fix llsec key resources release in mac802154_llsec_key_del kernel: genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline kernel: vt: fix unicode buffer corruption when deleting characters kernel: mptcp: ensure snd_nxt is properly initialized on connect kernel: scsi: mpi3mr: Avoid memcpy field-spanning write WARNING kernel: bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE kernel: drm/radeon: fix UBSAN warning in kv_dpm.c kernel: bpf: Fix overrunning reservations in ringbuf kernel: xfs: add bounds checking to xlog_recover_process_data kernel: sched/deadline: Fix task_struct reference leak kernel: mptcp: pm: Fix uaf in __timer_delete_sync
CVSS v3.1 score: 7
GHSA-mf42-3c8q-x7x8 
SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability in the KILL statement that allows authenticated database users to terminate other users' LIVE SELECT subscriptions. Attackers can issue KILL statements with target live query UUIDs to disrupt real-time data subscriptions of other users without ownership verification.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 5.4
CVE-2013-2458 
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries.  NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via "an error related to method handles."
CVSS v2.0 score: 5.8
ICSA-23-199-03 Iagona ScrutisWeb
Iagona ScrutisWeb versions 2.1.37 and prior are vulnerable to a directory traversal vulnerability that could allow an unauthenticated user to directly access any file outside the webroot. Iagona ScrutisWeb versions 2.1.37 and prior are vulnerable to an insecure direct object reference vulnerability that could allow an unauthenticated user to view profile information, including user login names and encrypted passwords. Iagona ScrutisWeb versions 2.1.37 and prior are vulnerable to a cryptographic vulnerability that could allow an unauthenticated user to decrypt encrypted passwords into plaintext. Iagona ScrutisWeb versions 2.1.37 and prior are vulnerable to a remote code execution vulnerability that could allow an unauthenticated user to upload a malicious payload and execute it.
CVSS v3.0 score: 10
GHSA-796q-qr2v-jqrc 
NeDi 1.9C allows inc/rt-popup.php d XSS.
GHSA-7325-gcx9-7xh4 
An incorrect permissions vulnerability was reported in the Lenovo App Store app that could allow an attacker to use system resources, resulting in a denial of service.
CVSS v3.1 score: 5.5
GHSA-927c-c24q-w7gx 
IBM Security Access Manager for Enterprise Single Sign-On 8.2.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 164555.
CVSS v3.1 score: 8.2
CVE-2024-0475 code-projects Dormitory Management System modifyuser.php sql injection
A vulnerability, which was classified as critical, has been found in code-projects Dormitory Management System 1.0. Affected by this issue is some unknown functionality of the file modifyuser.php. The manipulation of the argument user_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250580.
CVSS v3.1 score: 6.3
CVSS v3.0 score: 6.3
CVSS v2.0 score: 6.5
RHSA-2026:18705 Red Hat Security Advisory: mingw-glib2 security update
glib: Integer overflow in in g_escape_uri_string()
CVSS v3.1 score: 7.7
GHSA-gv98-9r75-xrjg 
VMware Workstation 6.0.x before 6.0.3 and 5.5.x before 5.5.6, VMware Player 2.0.x before 2.0.3 and 1.0.x before 1.0.6, VMware ACE 2.0.x before 2.0.1 and 1.0.x before 1.0.5, and VMware Server 1.0.x before 1.0.5 on Windows allow local users to gain privileges via an unspecified manipulation that causes the authd process to connect to an arbitrary named pipe, a different vulnerability than CVE-2008-1362.
GHSA-qgm6-q97v-329x 
Buffer overflow in RaidenHTTPD 1.1.32, and possibly other versions before 1.1.34, allows remote attackers to execute arbitrary code via a long URL.
GHSA-x7h5-vhw2-pmff 
Memory corruption while processing IOCTL command when device is in power-save state.
CVSS v3.1 score: 5.5
CVE-2022-34785 
Jenkins build-metrics Plugin 1.3 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read permission to obtain information about jobs otherwise inaccessible to them.
CVSS v3.1 score: 4.3
CVSS v2.0 score: 4
ICSA-11-243-03A GE Intelligent Platforms Proficy Historian Data Archiver Buffer Overflow Vulnerability
Stack-based buffer overflow in the Data Archiver service in GE Intelligent Platforms Proficy Historian before 3.5 SIM 17 and 4.x before 4.0 SIM 12 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via crafted TCP message traffic.
CVE-2020-28361 
Kamailio before 5.4.0, as used in Sip Express Router (SER) in Sippy Softswitch 4.5 through 5.2 and other products, allows a bypass of a header-removal protection mechanism via whitespace characters. This occurs in the remove_hf function in the Kamailio textops module. Particular use of remove_hf in Sippy Softswitch may allow skilled attacker having a valid credential in the system to disrupt internal call start/duration accounting mechanisms leading potentially to a loss of revenue.
CVSS v3.1 score: 5.4
CVSS v2.0 score: 5.5
CVE-2012-1673 
SQL injection vulnerability in loginscript.php in e-ticketing allows remote attackers to execute arbitrary SQL commands via the password parameter.
CVSS v2.0 score: 7.5
GHSA-r6hq-w4gp-j558 
The Most Popular Ringtones (aka com.bbs.mostpopularringtones) application 32 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2025-14636 Tenda AX9 httpd image_check weak hash
A security flaw has been discovered in Tenda AX9 22.03.01.46. This affects the function image_check of the component httpd. The manipulation results in use of weak hash. It is possible to launch the attack remotely. A high complexity level is associated with this attack. It is indicated that the exploitability is difficult. The exploit has been released to the public and may be used for attacks.
CVSS v4.0 score: 6.3
CVSS v3.1 score: 3.7
CVSS v3.0 score: 3.7
CVSS v2.0 score: 2.6
GHSA-vrvf-6v98-rp7r 
Zoho ManageEngine ADManager Plus 6.6 Build 6657 allows local users to gain privileges (after a reboot) by placing a Trojan horse file into the permissive bin directory.
CVSS v3.0 score: 7
CVE-2025-9826 
Stored cross-site scripting vulnerability in M-Files Hubshare before version 25.8 allows authenticated attackers to cause script execution for other users.
CVSS v4.0 score: 7
CVE-2020-25206 
The web console for Mimosa B5, B5c, and C5x firmware through 2.8.0.2 allows authenticated command injection in the Throughput, WANStats, PhyStats, and QosStats API classes. An attacker with access to a web console account may execute operating system commands on affected devices by sending crafted POST requests to the affected endpoints (/core/api/calls/Throughput.php, /core/api/calls/WANStats.php, /core/api/calls/PhyStats.php, /core/api/calls/QosStats.php). This results in the complete takeover of the vulnerable device. This vulnerability does not occur in the older 1.5.x firmware versions.
CVSS v3.1 score: 7.2
CVSS v2.0 score: 9
GHSA-qr28-7prp-37fx 
An out of bounds read within the AMD Platform Management Framework (PMF) could allow an attacker to trigger a read of an arbitrary memory location potentially resulting in loss of availability or confidentiality.
CVSS v4.0 score: 5.8
GHSA-x646-ph8g-wp5m 
Out of bounds write in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file. (Chromium security severity: Medium)
CVSS v3.1 score: 9.6
CVE-2000-0708 
Buffer overflow in Pragma Systems TelnetServer 2000 version 4.0 allows remote attackers to cause a denial of service via a long series of null characters to the rexec port.
CVSS v2.0 score: 5
GHSA-gch6-cfhh-c44p 
The Gutenberg Blocks with AI by Kadence WP plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.6.1. This is due to a missing capability check in the `process_image_data_ajax_callback()` function which handles the `kadence_import_process_image_data` AJAX action. The function's authorization check via `verify_ajax_call()` only validates `edit_posts` capability but fails to check for the `upload_files` capability. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary images from remote URLs to the WordPress Media Library, bypassing the standard WordPress capability restriction that prevents Contributors from uploading files.
CVSS v3.1 score: 4.3
GHSA-p6xh-r33c-c9h2 
The Drag and Drop Multiple File Upload PRO - Contact Form 7 Standard WordPress plugin before 2.11.1 and Drag and Drop Multiple File Upload PRO - Contact Form 7 with Remote Storage Integrations WordPress plugin before 5.0.6.4 do not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high-privilege users such as admins.
CVSS v3.1 score: 6.1
CVE-2006-0602 
Multiple SQL injection vulnerabilities in Hinton Design phphg Guestbook 1.2 allow remote attackers to execute arbitrary SQL commands via the (1) username parameter to check.php or the id parameter to (2) admin/edit_smilie.php, (3) admin/add_theme.php, (4) admin/ban_ip.php, (5) admin/add_lang.php, or (6) admin/edit_filter.php.
CVSS v2.0 score: 7.5
CVE-2006-4172 
Integer overflow vulnerability in the i386_set_ldt call in FreeBSD 5.5, and possibly earlier versions down to 5.2, allows local users to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2006-4178.
CVSS v2.0 score: 7.2
CVE-2013-10058 Linksys Routers apply.cgi Remote Command Injection
An authenticated OS command injection vulnerability exists in various Linksys router models (tested on WRT160Nv2) running firmware version v2.0.03 via the apply.cgi endpoint. The web interface fails to properly sanitize user-supplied input passed to the ping_size parameter during diagnostic operations. An attacker with valid credentials can inject arbitrary shell commands, enabling remote code execution.
CVSS v4.0 score: 8.6
GHSA-mhfq-mh5j-8qxc 
cgi-bin/cgi_system in NUUO NVRmini 2 1.7.5 through 2.x, NUUO NVRsolo 1.7.5 through 2.x, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to reset the administrator password via a cmd=loaddefconfig action.
CVSS v3.0 score: 7.5
GHSA-jv6q-m92f-5fmr 
A vulnerability was found in itsourcecode Online Bookstore 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file bookPerPub.php. The manipulation of the argument pubid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-268459.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 6.3
GHSA-f6px-cpfg-vx5v 
A vulnerability, which was classified as critical, was found in pbrong hrms up to 1.0.1. This affects the function HrmsDB of the file \resource\resource.go. The manipulation of the argument user_cookie leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 7.3
GHSA-7hrq-m3jx-vxhp 
A vulnerability was found in PHPGurukul Medical Card Generation System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/changeimage.php of the component Managecard Edit Image Page. The manipulation of the argument editid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 5.1
CVSS v3.1 score: 4.7
CVE-2018-19070 
An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. They allow remote attackers to execute arbitrary OS commands via shell metacharacters in the usrName parameter of a CGIProxy.fcgi addAccount action.
CVSS v3.0 score: 7.2
CVSS v2.0 score: 9
CVE-2021-44713 Adobe Acrobat Reader DC Use After Free could lead to Application denial-of-service
Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a use-after-free vulnerability in the processing of Format event actions that could result in application denial of service. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1 score: 5.5
ICSA-22-223-05 Siemens SICAM A8000 Web Server Module
The component allows to activate a web server module which provides unauthenticated access to its web pages. This could allow an attacker to retrieve debug-level information from the component such as internal network topology or connected systems.
CVSS v3.1 score: 4.3
CVE-2012-4772 
SQL injection vulnerability in register/ in Subrion CMS before 2.2.3 allows remote attackers to execute arbitrary SQL commands via the plan_id parameter.
CVSS v2.0 score: 7.5
GHSA-465r-3gh8-mpg4 
Cross-Site Request Forgery (CSRF) vulnerability in jordan.hatch Infusionsoft Analytics allows Cross Site Request Forgery. This issue affects Infusionsoft Analytics: from n/a through 2.0.
CVSS v3.1 score: 5.4
RHSA-2019:4117 Red Hat Security Advisory: Open Liberty 19.0.0.12 Runtime security update
A security update is now available for Open Liberty 19.0.0.12 from the Customer Portal.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the originating Security Bulletin link(s) in the References section.
GHSA-mr78-86rh-644v 
A heap use after free in PDFium in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android allows a remote attacker to potentially exploit heap corruption via crafted PDF files.
CVSS v3.0 score: 8.8
CVE-2017-0842 
An elevation of privilege vulnerability in the Android system (bluetooth). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-37502513.
CVSS v3.0 score: 7.8
CVSS v2.0 score: 7.2
GHSA-9x98-jv6r-7jg8 
A vulnerability was found in D-Link DIR-605L 2.13B01. It has been rated as critical. This issue affects the function sub_454F2C. The manipulation of the argument sysCmd leads to command injection. The attack may be initiated remotely. The vendor was contacted early about this disclosure. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 6.3
CVE-2025-47516 WordPress Time Clock plugin <= 1.2.3 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scott Paterson Time Clock time-clock allows Stored XSS.This issue affects Time Clock: from n/a through <= 1.2.3.
CVSS v3.1 score: 5.9
CVE-2024-47048 
Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and earlier allows stored XSS in the description and release notes of the marketplace and private apps.
CVSS v3.1 score: 5.4
GHSA-4cv6-9jjm-xp2g 
phpMyFAQ before 4.1.6 fails to validate path traversal sequences in the existing_image field during category updates, allowing authenticated attackers to delete arbitrary files by exploiting insufficient sanitization in Image::delete(). Attackers can delete the database.php configuration file to disable the installation gate and access the public setup wizard to create new superadmin accounts.
CVSS v4.0 score: 8.6
GHSA-w3mh-jmwv-56f3 
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVSS v3.1 score: 8.8
CVE-2026-14672 PostgreSQL observable response discrepancy with non-default scram_iterations provides user existence oracle
Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user to test the existence of a user via observing the SCRAM iteration count.  This requires the probed user to have a non-default scram_iterations count, because the authentication challenge for a nonexistent user reports the default scram_iterations.  Within major versions 16-18, minor versions before PostgreSQL 18.5, 17.11, and 16.15 are affected.  Versions before PostgreSQL 16 are unaffected.
CVSS v3.1 score: 5.3
GHSA-36vm-5pc5-gh56 
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused
GHSA-f6gc-6hjg-r4qc 
A vulnerability, which was classified as critical, has been found in code-projects Exam Form Submission 1.0. Affected by this issue is some unknown functionality of the file /register.php. The manipulation of the argument USN leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS v4.0 score: 5.5
CVSS v3.1 score: 7.3
CVE-2023-0987 SourceCodester Online Pizza Ordering System cross site scripting
A vulnerability classified as problematic was found in SourceCodester Online Pizza Ordering System 1.0. This vulnerability affects unknown code of the file index.php?page=checkout. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-221680.
CVSS v3.1 score: 3.5
CVSS v3.0 score: 3.5
CVSS v2.0 score: 4
GHSA-xvmc-5cj3-c86j 
Cross-site scripting (XSS) vulnerability in index.php in MP3 Search/Archive 1.2 allows remote attackers to inject arbitrary web script or HTML via the (1) keywords parameter, as used by the "search box", and (2) res parameter.
CVE-2024-42477 llama.cpp global-buffer-overflow in ggml_type_size
llama.cpp provides LLM inference in C/C++. The unsafe `type` member in the `rpc_tensor` structure can cause `global-buffer-overflow`. This vulnerability may lead to memory data leakage. The vulnerability is fixed in b3561.
CVSS v3.1 score: 5.3
CVE-2022-28247 Adobe Acrobat Uninstaller Hard Link Leads To Remote Code Execution
Acrobat Reader DC version 22.001.2011x (and earlier), 20.005.3033x (and earlier) and 17.012.3022x (and earlier) are affected by an uncontrolled search path vulnerability that could lead to local privilege escalation. Exploitation of this issue requires user interaction in that a victim must run the uninstaller with Admin privileges.
CVSS v3.1 score: 6.7
RHSA-2025:23486 Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.15 security update.
org.eclipse.jgit: XXE vulnerability in Eclipse JGit org.jenkins-ci.main/jenkins-core: Jenkins HTTP connection mis-handling
CVSS v3.1 score: 5.3
GHSA-fghw-vx75-2hcj 
Improper JPAKE implementation allows offline PIN brute-forcing due to the initialization of random values to a known value, which leads to unauthorized authentication to amzn.lightning services.This issue affects:Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5.
Insignia TV with FireOS 7.6.3.3.
CVSS v3.1 score: 7.1
GHSA-rg78-c857-fg6x 
The in_mp4 plugin in Winamp before 5.6 allows remote attackers to cause a denial of service (application crash) via crafted (1) metadata or (2) albumart in an invalid MP4 file.
GHSA-x7qh-ghv7-7g8x 
The Frontend Checklist WordPress plugin through 2.3.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS v3.1 score: 4.3
GHSA-9h42-3pgf-qjc8 
An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility whichmay allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands.Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS v3.1 score: 8.8
GHSA-9fcw-h273-v9r3 
Microsoft Windows Media Runtime, as used in DirectShow WMA Voice Codec, Windows Media Audio Voice Decoder, and Audio Compression Manager (ACM), does not properly initialize unspecified functions within compressed audio files, which allows remote attackers to execute arbitrary code via (1) a crafted media file or (2) crafted streaming content, aka "Windows Media Runtime Heap Corruption Vulnerability."
RHSA-2026:1416 Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.8.2 release
crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate
CVSS v3.1 score: 7.5
CVE-2018-2375 
In SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor authorization in a specific space could retrieve application environments within that space.
CVSS v3.0 score: 8.1
CVSS v2.0 score: 5.5
CVE-2026-72285 KVM: TDX: Reject concurrent change to CPUID entry count
In the Linux kernel, the following vulnerability has been resolved:

KVM: TDX: Reject concurrent change to CPUID entry count

Reject KVM_TDX_INIT_VM if userspace changes cpuid.nent between the
initial read and the subsequent copy of the initialization data.

tdx_td_init() first reads user_data->cpuid.nent to size the flexible
kvm_tdx_init_vm copy.  The copied structure also contains cpuid.nent,
and that field can differ from the value used to size the allocation if
userspace modifies the input concurrently.  setup_tdparams_cpuids() later
passes init_vm->cpuid.nent to kvm_find_cpuid_entry2(), which uses it as
the array bound for the copied entries.

Require the copied count to match the value used to size the allocation
so that CPUID parsing cannot access beyond the entries actually copied.
CVSS v3.1 score: 7.8
CVE-2009-3428 
Stack-based buffer overflow in Easy Music Player 1.0.0.2 allows remote attackers to execute arbitrary code via a crafted .wav file.
CVSS v2.0 score: 9.3
GHSA-3q94-vm9h-5h6v 
Blesta 3.x through 5.x before 5.13.3 mishandles input validation, aka CORE-5665.
CVSS v3.1 score: 4.7
CVE-2001-0663 
Terminal Server in Windows NT and Windows 2000 allows remote attackers to cause a denial of service via a sequence of invalid Remote Desktop Protocol (RDP) packets.
CVSS v2.0 score: 5
GHSA-95wf-5gcv-fj6f 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Loopus WP Visitors Tracker allows Reflected XSS.This issue affects WP Visitors Tracker: from n/a through 2.3.
CVSS v3.1 score: 7.1
CVE-2022-45587 
Stack overflow vulnerability in function gmalloc in goo/gmem.cc in xpdf 4.04, allows local attackers to cause a denial of service.
CVSS v3.1 score: 5.5
CVE-2007-2382 
The Moo.fx framework exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka "JavaScript Hijacking."
CVSS v2.0 score: 5
GHSA-53qw-j8c7-3g2x 
A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via alerts.php and the "from_time" parameter.
PYSEC-2026-1089 
In version 3.25.0 of aimhubio/aim, the tracking server is vulnerable to a denial of service attack. The server overrides the maximum size for websocket messages, allowing very large images to be tracked. This causes the server to become unresponsive to other requests while processing the large image, leading to a denial of service condition.
CVSS v3.0 score: 7.5
CVE-2020-16103 
Type confusion in Gallagher Command Centre Server allows a remote attacker to crash the server or possibly cause remote code execution. This issue affects: Gallagher Command Centre 8.30 versions prior to 8.30.1236(MR1); 8.20 versions prior to 8.20.1166(MR3); 8.10 versions prior to 8.10.1211(MR5); version 8.00 and prior versions.
CVSS v3.1 score: 8.8
CVE-2024-35643 WordPress WP Back Button plugin <= 1.1.3 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting (XSS) vulnerability in Xabier Miranda WP Back Button allows Stored XSS.This issue affects WP Back Button: from n/a through 1.1.3.
CVSS v3.1 score: 5.9
CVE-2017-3235 
Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are affected are 11.3.0, 11.4.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0 and 12.2.0. Easily exploitable vulnerability allows physical access to compromise Oracle FLEXCUBE Universal Banking. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Universal Banking accessible data as well as unauthorized read access to a subset of Oracle FLEXCUBE Universal Banking accessible data. CVSS v3.0 Base Score 3.5 (Confidentiality and Integrity impacts).
CVSS v3.0 score: 3.5
CVSS v2.0 score: 3.6
GHSA-j4x8-5rjr-hgpc 
CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
CVSS v3.1 score: 4.8
CVE-2021-34317 
A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The BMP_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing PCX files. This could result in an out of bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13402)
CVSS v3.1 score: 7.8
CVSS v2.0 score: 6.8
GHSA-9m3h-4942-cwfh 
Vulnerability in the Oracle Managed File Transfer product of Oracle Fusion Middleware (component: MFT Runtime Server).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Managed File Transfer.  Successful attacks of this vulnerability can result in takeover of Oracle Managed File Transfer. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS v3.1 score: 8.8
CVE-2025-21061 
Cleartext storage of sensitive information in Smart Switch prior to version 3.7.67.2 allows local attackers to access sensitive data. User interaction is required for triggering this vulnerability.
CVSS v3.1 score: 7.1
GHSA-4987-rr6v-x4q5 
The identity zones feature in Pivotal Cloud Foundry 208 through 229; UAA 2.0.0 through 2.7.3 and 3.0.0; UAA-Release 2 through 4, when configured with multiple identity zones; and Elastic Runtime 1.6.0 through 1.6.13 allows remote authenticated users with privileges in one zone to gain privileges and perform operations on a different zone via unspecified vectors.
CVSS v3.1 score: 8.8
CVE-2025-45843 
TOTOLINK NR1800X V9.1.0u.6681_B20230703 was discovered to contain an authenticated stack overflow via the ssid parameter in the setWiFiGuestCfg function.
CVSS v3.1 score: 8.8
CVE-2026-47949 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
CVSS v3.1 score: 5.4
GHSA-9g3m-jq99-wvqp 
In the Linux kernel, the following vulnerability has been resolved:ipmi:ssif: Clean up kthread on errorsIf an error occurs after the ssif kthread is created, but before the
main IPMI code starts the ssif interface, the ssif kthread will not
be stopped.So make sure the kthread is stopped on an error condition if it is
running.
CVSS v3.1 score: 5.5
GHSA-98gq-6hxg-52r6 XSS vulnerability in Jenkins notification bar
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape notification bar response contents (typically shown after form submissions via Apply button).This results in a cross-site scripting (XSS) vulnerability exploitable by attackers able to influence notification bar contents.Jenkins 2.275, LTS 2.263.2 escapes the content shown in notification bars.
CVSS v3.1 score: 5.4
CVE-2019-2188 
In the Easel driver, there is possible memory corruption due to race conditions. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-112309571
CVSS v3.1 score: 6.4
CVSS v2.0 score: 6.9
RHSA-2026:35447 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via Symbol Arguments
CVSS v3.1 score: 7.1
CVE-2025-8059 B Blocks <= 2.0.6 - Missing Authorization to Unauthenticated Privilege Escalation via rgfr_registration Function
The B Blocks plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization and improper input validation within the rgfr_registration() function in all versions up to, and including, 2.0.6. This makes it possible for unauthenticated attackers to create a new account and assign it the administrator role.
CVSS v3.1 score: 9.8
GHSA-r25f-mfgv-vq97 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip TimeProvider 4100 (banner config modules) allows Cross-Site Scripting (XSS).This issue affects TimeProvider 4100: from 1.0 before 2.4.7.
CVSS v4.0 score: 0
CVSS v3.1 score: 6.1
GHSA-3frm-wcmv-8jx7 
An unauthorized user can modify configuration through API
calls that affects the OpenText Access
Manager. This issue affects Access Manager before 5.1.3.
CVSS v4.0 score: 6.3
CVSS v3.1 score: 7.5
GHSA-w648-9w29-r2jg 
minPlayCommand.php in Centreon Web before 2.8.27 allows authenticated attackers to execute arbitrary code via the command_hostaddress parameter. NOTE: some sources have listed CVE-2019-17017 for this, but that is incorrect.
CVSS v3.1 score: 8.8
GHSA-w36f-7jv5-74qh 
In types.cpp in Exiv2 0.26, a large size value may lead to a SIGABRT during an attempt at memory allocation for an Exiv2::Internal::PngChunk::zlibUncompress call.
CVSS v3.0 score: 6.5
RHSA-2020:3421 Red Hat Security Advisory: .NET Core 3.1 security and bugfix update for Red Hat Enterprise Linux
dotnet: ASP.NET Core Resource Consumption Denial of Service
CVSS v3.1 score: 7.5
GHSA-wx8p-85p4-gfr8 
In the Linux kernel, the following vulnerability has been resolved:firmware: arm_scmi: Fix list protocols enumeration in the base protocolWhile enumerating protocols implemented by the SCMI platform using
BASE_DISCOVER_LIST_PROTOCOLS, the number of returned protocols is
currently validated in an improper way since the check employs a sum
between unsigned integers that could overflow and cause the check itself
to be silently bypassed if the returned value 'loop_num_ret' is big
enough.Fix the validation avoiding the addition.
CVSS v3.1 score: 5.5
CVE-2021-29501 Remote code execution in ticketer
Ticketer is a command based ticket system cog (plugin) for the red discord bot. A vulnerability allowing discord users to expose sensitive information has been found in the Ticketer cog. Please upgrade to version 1.0.1 as soon as possible. As a workaround users may unload the ticketer cog to disable the exploitable code.
CVSS v3.1 score: 8.1