CIRCL/vulnerability-scores huggingface dataset:
CVE-2025-3044 MD5 Hash Collision in run-llama/llama_index
A vulnerability in the ArxivReader class of the run-llama/llama_index repository, versions up to v0.12.22.post1, allows for MD5 hash collisions when generating filenames for downloaded papers. This can lead to data loss as papers with identical titles but different contents may overwrite each other, preventing some papers from being processed for AI model training. The issue is resolved in version 0.12.28.
CVSS v3.0 score: 5.3
GHSA-rq68-v4m6-774h 
Unspecified vulnerability in the Oracle WebCenter Content component in Oracle Fusion Middleware 7.5.2, 10.1.3.5.1, 11.1.1.3, 11.1.1.4, and 11.1.1.5 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Search.
CVE-2011-2515 
PackageKit 0.6.17 allows installation of unsigned RPM packages as though they were signed which may allow installation of non-trusted packages and execution of arbitrary code.
CVSS v3.1 score: 5.3
CVSS v2.0 score: 4.6
CVE-2016-3051 
IBM Security Access Manager for Web 9.0.0 could allow an authenticated user to access some privileged functionality of the server. IBM X-Force ID: 114714.
CVSS v3.0 score: 4.3
CVSS v2.0 score: 4
GHSA-5p57-54cm-9527 
Poul-Henning Kamp md5crypt has insufficient algorithmic complexity and a consequently short runtime, which makes it easier for context-dependent attackers to discover cleartext passwords via a brute-force attack, as demonstrated by an attack using GPU hardware.
CVE-2016-6894 
Arista EOS 4.15 before 4.15.8M, 4.16 before 4.16.7M, and 4.17 before 4.17.0F on DCS-7050 series devices allow remote attackers to cause a denial of service (device reboot) by sending crafted packets to the control plane.
CVSS v3.0 score: 7.5
CVSS v2.0 score: 7.8
CVE-2019-8523 
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS v3.1 score: 8.8
CVSS v2.0 score: 9.3
CVE-2010-5177 
Race condition in Sophos Endpoint Security and Control 9.0.5 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection, via certain user-space memory changes during hook-handler execution, aka an argument-switch attack or a KHOBE attack.  NOTE: the vendor disputes this issue because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute
CVSS v2.0 score: 6.2
GHSA-mf52-j94g-746m 
A security flaw has been discovered in BerriAI litellm up to 1.82.2. This impacts the function authenticate_user of the file litellm/proxy/auth/login_utils.py of the component PROXY_ADMIN database API Key Generator. Performing a manipulation results in session expiration. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.
CVSS v4.0 score: 2.1
CVSS v3.1 score: 6.3
GHSA-fmrx-pcvh-q72x 
Adobe Dimension version 3.4.8 (and earlier) is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1 score: 5.5
RHSA-2022:6505 Red Hat Security Advisory: openvswitch2.15 security update
dpdk: error recovery in mlx5 driver not handled properly, allowing for denial of service
CVSS v3.1 score: 6.5
CVE-2024-27158 Hardcoded root password
All the Toshiba printers share the same hardcoded root password. As for the affected products/models/versions, see the reference URL.
CVSS v3.1 score: 7.4
CVE-2026-27707 Plex-configured Seerr instances vulnerable to unauthenticated account registration via Jellyfin authentication endpoint
Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Starting in version 2.0.0 and prior to version 3.1.0, an authentication guard logic flaw in `POST /api/v1/auth/jellyfin` allows an unauthenticated attacker to register a new Seerr account on any Plex-configured instance by authenticating with an attacker-controlled Jellyfin server. The attacker receives an authenticated session and can immediately use the application with default permissions, including the ability to submit media requests to Radarr/Sonarr. Any Seerr deployment where all three of the following are true may be vulnerable: `settings.main.mediaServerType` is set to `PLEX` (the most common deployment).; `settings.jellyfin.ip` is set to `""` (default, meaning Jellyfin was never configured); and `settings.main.newPlexLogin` is set to `true` (default). Jellyfin-configured and Emby-configured deployments are not affected. Version 3.1.0 of Seerr fixes this issue.
CVSS v3.1 score: 7.3
GHSA-x3mj-vjph-62qr 
In the Linux kernel, the following vulnerability has been resolved:bpf: Fix NMI/tracepoint re-entry deadlock on lru locksNMI and tracepoint BPF programs can re-enter the per-CPU or global
LRU lock that bpf_lru_pop_free()/push_free() already hold on the
same CPU, AA-deadlocking. Lockdep reports "inconsistent
{INITIAL USE} -> {IN-NMI}" on &l->lock (syzbot c69a0a2c816716f1e0d5)
and "possible recursive locking detected" on &loc_l->lock (syzbot
18b26edb69b2e19f3b33).Prior trylock and rqspinlock based fixes (see links) were nacked
because compromised on reliability.This patch converts every LRU lock site to rqspinlock_t and adds a
recovery path for some failure windows to avoid node leaks.Failure recovery:*_pop_free top-level: return NULL; prealloc_lru_pop() already
treats that as no-free-element (-ENOMEM).Cross-CPU steal: skip the victim's locked loc_l, try next CPU.Post-steal local lock fail: publish stolen node to lockless
per-CPU free_llist; next pop on this CPU picks it up.push_free fail: mark node pending_free=1. __local_list_flush(),
__local_list_pop_pending() reclaim the node from pending_list.
__bpf_lru_list_shrink_inactive() reclaims the node from inactive
list. Nodes from active list are reclaimed by __bpf_lru_list_shrink()
or after __bpf_lru_list_rotate_active() demotes it to the inactive.
CVE-2023-1836 
A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 5.1 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. When viewing an XML file in a repository in "raw" mode, it can be made to render as HTML if viewed under specific circumstances
CVSS v3.1 score: 4.4
GHSA-97cm-2gxw-v54w 
IBM QRadar SIEM 7.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  285893.
CVSS v3.1 score: 5.4
CVE-2025-7508 code-projects Modern Bag product-update.php sql injection
A vulnerability, which was classified as critical, has been found in code-projects Modern Bag 1.0. Affected by this issue is some unknown functionality of the file /admin/product-update.php. The manipulation of the argument idProduct leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 7.3
CVSS v3.0 score: 7.3
CVSS v2.0 score: 7.5
CVE-2001-0695 
WFTPD 3.00 R5 allows a remote attacker to cause a denial of service by making repeated requests to cd to the floppy drive (A:\).
CVSS v2.0 score: 5
GHSA-wx34-7xqf-qpp4 
The dbus-daemon in D-Bus before 1.6.24 and 1.8.x before 1.8.8 does not properly close old connections, which allows local users to cause a denial of service (incomplete connection consumption and prevention of new connections) via a large number of incomplete connections.
CVE-2025-67342 
RuoYi versions 4.8.1 and earlier is affected by a stored XSS vulnerability in the /system/menu/edit endpoint. While the endpoint is protected by an XSS filter, the protection can be bypassed. Additionally, because the menu is shared across all users, any user with menu modification permissions can impact all users by exploiting this stored XSS vulnerability.
CVSS v3.1 score: 4.6
GHSA-2g6x-pxrf-x3gx 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in wowDevs Sky Addons for Elementor allows Stored XSS.This issue affects Sky Addons for Elementor: from n/a through 2.5.11.
CVSS v3.1 score: 6.5
cisco-sa-react-flight-TYw32Ddb Remote Code Execution Vulnerability in React and Next.js Frameworks: December 2025
On December 3, 2025, the React team released a security advisory regarding a vulnerability, CVE-2025-55182, in the React server that could allow an unauthenticated, remote attacker to perform remote code execution on an affected device or system.

For a description of this vulnerability, see the public React Security Advisory ["https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components"].

Cisco's standard practice is to update integrated third-party software components to later versions as they become available.
CVE-2026-18394 Incorrect authorization in Strands Agents Tools http_request proxy credential exfiltration
Incorrect authorization in the http_request tool in Strands Agents Tools before 0.8.2 might allow remote attackers to obtain credentials configured via HTTP_REQUEST_TOKEN_CONFIG by influencing the LLM to route requests through actor-controlled proxy infrastructure.



To remediate this issue, users should upgrade to version 0.8.2.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 7.4
CVE-2018-13021 
An issue was discovered in HongCMS 3.0.0. There is an Arbitrary Script File Upload issue that can result in PHP code execution via the admin/index.php/template/upload URI.
CVSS v3.0 score: 7.2
CVSS v2.0 score: 9
CVE-2023-52510 ieee802154: ca8210: Fix a potential UAF in ca8210_probe
In the Linux kernel, the following vulnerability has been resolved:

ieee802154: ca8210: Fix a potential UAF in ca8210_probe

If of_clk_add_provider() fails in ca8210_register_ext_clock(),
it calls clk_unregister() to release priv->clk and returns an
error. However, the caller ca8210_probe() then calls ca8210_remove(),
where priv->clk is freed again in ca8210_unregister_ext_clock(). In
this case, a use-after-free may happen in the second time we call
clk_unregister().

Fix this by removing the first clk_unregister(). Also, priv->clk could
be an error code on failure of clk_register_fixed_rate(). Use
IS_ERR_OR_NULL to catch this case in ca8210_unregister_ext_clock().
CVSS v3.1 score: 7.8
GHSA-583q-4hr8-hgjg 
Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.
CVE-2023-32645 
A leftover debug code vulnerability exists in the httpd debug credentials functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lead to authentication bypass. An attacker can send a network request to trigger this vulnerability.
CVSS v3.1 score: 9.8
RHSA-2014:0913 Red Hat Security Advisory: kernel-rt security update
kernel: net: insufficient permision checks of netlink messages kernel: aio: insufficient sanitization of head in aio_read_events_ring() Kernel: filter: prevent nla extensions to peek beyond the end of the message Kernel: filter: prevent nla extensions to peek beyond the end of the message kernel: futex: pi futexes requeue issue kernel: DoS with syscall auditing Kernel: missing check during hugepage migration Kernel: target/rd: imformation leakage kernel: sctp: sk_ack_backlog wrap-around problem kernel: x86_64: ptrace: sysret to non-canonical address
CVE-2023-51433 

Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause information leak.


CVSS v3.1 score: 2.9
CVE-2023-3460 Ultimate Member < 2.6.7 - Unauthenticated Privilege Escalation
The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. This is actively being exploited in the wild.
CVSS v3.1 score: 9.8
GHSA-32wq-hfww-rqcm 
An issue in the sqlg_parallel_ts_seq component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS v3.1 score: 7.5
CVE-2018-12511 
In the mintToken function of a smart contract implementation for Substratum (SUB), an Ethereum ERC20 token, the administrator can control mintedAmount, leverage an integer overflow, and modify a user account's balance arbitrarily.
CVSS v3.0 score: 7.5
CVSS v2.0 score: 5
CVE-2025-48743 
SIGB PMB before 8.0.1.2 allows SQL injection.
CVSS v3.1 score: 5.3
GHSA-r4q3-7g4q-x89m Spring Framework server Web DoS Vulnerability
In Spring Framework versions 6.0.15 and 6.1.2, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.Specifically, an application is vulnerable when all of the following are true:the application uses Spring MVCSpring Security 6.1.6+ or 6.2.1+ is on the classpathTypically, Spring Boot applications need the org.springframework.boot:spring-boot-starter-web and org.springframework.boot:spring-boot-starter-security dependencies to meet all conditions.
CVSS v3.1 score: 7.5
CVE-2005-0315 
The FTP service in Magic Winmail Server 4.0 Build 1112 does not verify that the IP address in a PORT command is the same as the IP address of the user of the FTP session, which allows remote authenticated users to use the server as an intermediary for port scanning.
CVSS v2.0 score: 4.6
GHSA-wmm7-2925-jr64 
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence.  Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS v3.1 score: 9.8
GHSA-wxg7-w2v3-w38g ZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) in JWT IdP Provider
SummaryA token lifecycle validation vulnerability was discovered in ZITADEL's external JWT Identity Provider (IdP) implementation.
ZITADEL enforces a 1-hour maximum token age freshness window (`maxAge`) calculated from the token's issue time. However, this safety check is guarded by a presence condition. If an incoming token omits the `iat` claim, the freshness check is entirely bypassed, allowing arbitrarily old tokens to pass authentication successfully.Per the OIDC Core 1.0 specification, identity token validation pipelines must strictly handle and enforce session expiration. ZITADEL's silent acceptance of tokens missing these temporal constraints compromises session integrity.ImpactAn attacker in possession of a stale token lacking an `iat` claim can reuse it indefinitely without triggering the maximum age freshness invalidation.Affected VersionsSystems running one of the following versions are affected:**4.x**: `4.0.0` through `4.15.1` (including RC versions)**3.x**: `3.0.0` through `3.4.11` (including RC versions)PatchesThe vulnerability has been addressed in the latest releases. ZITADEL now explicitly rejects tokens that lack an `iat` claim.**4.x**: Upgrade to $\ge$ [4.15.2](https://github.com/zitadel/zitadel/releases/tag/v4.15.2)**3.x**: Upgrade to $\ge$ [3.4.12](https://github.com/zitadel/zitadel/releases/tag/v3.4.12)WorkaroundsThe recommended solution is to update ZITADEL to a patched version.If an immediate upgrade is not feasible, ensure at the upstream Identity Provider level that your external IdP explicitly includes the `iat` claim in all signed JWTs.Publication NoteThis advisory covers a subset of the security issues originally published on ZITADEL's registry under this tracking ID. To adhere strictly to CVE formatting standards regarding independently fixable flaws, the original "Token Lifecycle Validation" disclosure has been split into two granular entries. This entry specifically tracks the missing `iat` claim logic, while a separate companion entry tracks the missing `exp` claim logic: [GHSA-v77h-2w3m-94hx](https://github.com/zitadel/zitadel/security/advisories/GHSA-v77h-2w3m-94hx)QuestionsIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)CreditsThanks to [Android-Login-Analysis](https://github.com/Android-Login-Analysis), Jason Zhou and [Pedro Giglioti](https://github.com/Punisher100) for reporting this vulnerability.
CVSS v3.1 score: 4.2
CVE-2025-32159 WordPress Radius Blocks plugin <= 2.2.1 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme Radius Blocks radius-blocks allows PHP Local File Inclusion.This issue affects Radius Blocks: from n/a through <= 2.2.1.
CVSS v3.1 score: 7.5
GHSA-mpwr-28xv-5hw9 
Sante PACS Server Web Portal DCM File Parsing Directory Traversal Arbitrary File Write Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of Sante PACS Server. Authentication is required to exploit this vulnerability.The specific flaw exists within the parsing of DCM files. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to write files in the context of the current user. Was ZDI-CAN-25308.
CVSS v3.0 score: 4.3
CVE-2015-3192 
Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 do not properly process inline DTD declarations when DTD is not entirely disabled, which allows remote attackers to cause a denial of service (memory consumption and out-of-memory errors) via a crafted XML file.
CVSS v3.0 score: 5.5
CVSS v2.0 score: 4.3
GHSA-fc67-c4hg-q653 Amazon ECS Container Agent (Windows) is vulnerable to Information Disclosure
Summary[Amazon Elastic Container Service (Amazon ECS)](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/Welcome.html) is a fully managed container orchestration service that enables customers to deploy, manage, and scale containerized applications. An issue exists where, under certain circumstances, improper input validation in the FSx Windows File Server volume mounting process allows command injection through specially crafted credentials.ImpactImproper neutralization of inputs used in an OS command in the FSx Windows File Server volume mounting component in Amazon ECS Agent on Windows before 1.103.0 might allow a remote authenticated threat actor to execute shell commands with SYSTEM privileges on the underlying host via a specially crafted username field in an ECS task definition. This issue requires permissions to register ECS task definitions or write to the Secrets Manager or SSM Parameter Store credentials used by the FSx volume configuration.To remediate this issue, users should upgrade to version 1.103.0.**Impacted versions**: Version 1.47.0 through 1.102.2 of the ECS Agent for WindowsPatchesThis issue only impacts ECS Windows worker instances. ECS on Fargate is not affected. This issue has been addressed in ECS agent version 1.103.0.  Amazon ECS recommends [upgrading](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/launch_window-container_instance.html) to the [latest](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-windows-ami-versions.html) Amazon ECS-optimized Windows AMI with an updated ECS agent version.WorkaroundsCustomers who cannot update to the latest AMI can restrict ecs:RegisterTaskDefinition permissions to trusted IAM principals only and restrict write access to Secrets Manager secrets referenced in FSx volume configurations.ReferencesIf you have any questions or comments about this advisory, Amazon ECS asks that users contact [AWS/Amazon] Security via [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.AcknowledgementAmazon ECS would like to thank Sachin Patil for collaborating on this issue through the coordinated vulnerability disclosure process.
CVSS v3.1 score: 7.2
GHSA-5c7w-v73j-6cr4 
In the Linux kernel, the following vulnerability has been resolved:net: dsa: fix a crash if ->get_sset_count() failsIf ds->ops->get_sset_count() fails then it "count" is a negative error
code such as -EOPNOTSUPP.  Because "i" is an unsigned int, the negative
error code is type promoted to a very high value and the loop will
corrupt memory until the system crashes.Fix this by checking for error codes and changing the type of "i" to
just int.
CVSS v3.1 score: 5.5
GHSA-8h8c-f86r-pf3c 
A stack consumption issue in sqfs_size in Das U-Boot before 2025.01-rc1 occurs via a crafted squashfs filesystem with deep symlink nesting.
CVSS v3.1 score: 2
GHSA-3cgp-mpf6-c8vw 
An issue has been discovered in GitLab CE/EE affecting all versions starting before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2, which leads to developers being able to create pipeline schedules on protected branches even if they don't have access to merge
CVSS v3.1 score: 4.3
CVE-2007-3940 
Cross-site scripting (XSS) vulnerability in default.asp in QuickerSite 1.7.2 allows remote attackers to inject arbitrary web script or HTML via the svalue parameter in a search action.  NOTE: some of these details are obtained from third party information.
CVSS v2.0 score: 4.3
GHSA-jh5r-6pcq-w8hp 
In findParam of HevcUtils.cpp there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-230172711
CVSS v3.1 score: 3.3
CVE-2020-1536 Windows Backup Engine Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists when the Windows Backup Engine improperly handles memory.
To exploit this vulnerability, an attacker would first have to gain execution on the victim system. An attacker could then run a specially crafted application to elevate privileges.
The security update addresses the vulnerability by correcting how the Windows Backup Engine handles memory.
CVSS v3.1 score: 7.8
GHSA-6hv6-8cr9-hj55 
Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, may allow remote attackers to cause a denial of service or execute certain queries via a SQL injection attack on the sort order parameter to buglist.cgi.
CVE-2022-48444 
In telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
CVSS v3.1 score: 5.9
GHSA-q297-rgwf-h4xj 
Buffer overflow in the EnumPrintersA function in dapcnfsd.dll 0.6.4.0 in Shaffer Solutions (SSC) DiskAccess NFS Client allows remote attackers to execute arbitrary code via a long argument, an issue similar to CVE-2006-5854 and CVE-2007-0444.
GHSA-9g5p-c7vc-45f7 
In Atrocore 1.5.25, the Create Import Feed option with glyphicon-glyphicon-paperclip function is vulnerable to Unauthenticated File upload.
CVSS v3.1 score: 9.8
GHSA-wpv7-jq7x-9x2j 
A maliciously crafted GIF file, when parsed through Autodesk 3ds Max, can cause a Stack-Based Buffer Overflow vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
CVSS v3.1 score: 7.8
GHSA-p9mp-q42m-g65q 
The Social Rocket – Social Sharing Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tweet_settings_save() and tweet_settings_update() functions in all versions up to, and including, 1.3.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings.
CVSS v3.1 score: 5.3
CVE-2017-2242 
Untrusted search path vulnerability in Flets Setsuzoku Tool for Windows all versions allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS v3.0 score: 7.8
CVSS v2.0 score: 9.3
RHSA-2016:0056 Red Hat Security Advisory: java-1.7.0-oracle security update
TLS 1.2 Transcipt Collision attacks against MD5 in key exchange protocol (SLOTH) libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions OpenJDK: URL deserialization inconsistencies (Networking, 8059054) OpenJDK: logging of RMI connection secrets (JMX, 8130710) OpenJDK: insufficient enforcement of totalEntitySizeLimit (JAXP, 8133962) OpenJDK: incorrect boundary check in JPEG decoder (AWT, 8139017) ICU: integer signedness issue in IndicRearrangementProcessor (OpenJDK 2D, 8140543)
GHSA-4rgf-ww29-jxx4 
stoatchat before 0.15.0 fails to validate SVG viewBox dimensions in the proxy endpoint, allowing attackers to cause denial of service by memory exhaustion. Attackers can host malicious SVGs with extremely large width and height values and trigger concurrent requests to exhaust available memory across proxy replicas.
CVSS v4.0 score: 8.7
CVSS v3.1 score: 7.5
CVE-2026-25028 WordPress ElementInvader Addons for Elementor plugin <= 1.4.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ElementInvader Addons for Elementor: from n/a through <= 1.4.1.
CVSS v3.1 score: 5.4
GHSA-829c-jp2v-3j35 
Deserialization of Untrusted Data vulnerability in magepeopleteam WpTravelly allows Object Injection. This issue affects WpTravelly: from n/a through 1.8.7.
CVSS v3.1 score: 8.8
GHSA-v5wr-4j25-g277 
Cross-Site Request Forgery (CSRF) vulnerability in Leadster plugin <= 1.1.2 versions.
CVSS v3.1 score: 4.3
CVE-2022-25246 PTC Axeda agent and Axeda Desktop Server Use of Hard-Coded Credentials
Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) uses hard-coded credentials for its UltraVNC installation. Successful exploitation of this vulnerability could allow a remote authenticated attacker to take full remote control of the host operating system.
CVSS v3.1 score: 9.8
CVE-2000-0711 
Netscape Communicator does not properly prevent a ServerSocket object from being created by untrusted entities, which allows remote attackers to create a server on the victim's system via a malicious applet, as demonstrated by Brown Orifice.
CVSS v2.0 score: 7.5
CVE-2007-0729 
Apple File Protocol (AFP) Client in Apple Mac OS X 10.3.9 through 10.4.9 does not properly clean the environment before executing commands, which allows local users to gain privileges by setting unspecified environment variables.
CVSS v2.0 score: 7.2
GHSA-qq2g-5gj7-w9xg 
Incorrect Default Permissions vulnerability in Centreon Infra Monitoring (MBI modules) allows Embedding Scripts within Scripts by CentreonBI user account on the MBI server This issue affects Infra Monitoring: from 24.10.0 before 24.10.6, from 24.04.0 before 24.04.9, from 23.10.0 before 23.10.15.
CVSS v3.1 score: 8.4
CVE-2022-42953 
Certain ZKTeco products (ZEM500-510-560-760, ZEM600-800, ZEM720, ZMM) allow access to sensitive information via direct requests for the form/DataApp?style=1 and form/DataApp?style=0 URLs. The affected versions may be before 8.88 (ZEM500-510-560-760, ZEM600-800, ZEM720) and 15.00 (ZMM200-220-210). The fixed versions are firmware version 8.88 (ZEM500-510-560-760, ZEM600-800, ZEM720) and firmware version 15.00 (ZMM200-220-210).
CVSS v3.1 score: 7.5
GHSA-q9r4-343r-cphh 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.3.37598. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D files embedded in PDF documents. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13620.
GHSA-r2rm-869g-w2g5 
Improper access control in Windows Hyper-V allows an authorized attacker to bypass a security feature locally.
CVSS v3.1 score: 8.8
CVE-2001-0060 
Format string vulnerability in stunnel 3.8 and earlier allows attackers to execute arbitrary commands via a malformed ident username.
CVSS v2.0 score: 10
GHSA-667f-v95m-q2xp 
WorkDo HRM SaaS HR and Payroll Tool 8.1 is affected vulnerable to Insecure Permissions. An authenticated user can create leave or resignation records on behalf of other users.
CVSS v3.1 score: 6.5
GHSA-wqm8-hxqc-qwpc 
Manipulating individual parts of a URL object could have caused an out-of-bounds read, leaking process memory to malicious JavaScript. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0.
CVSS v3.1 score: 6.5
GHSA-p3pg-37qc-49qw 
Insufficient control flow managementin firmware in some Intel(R) Client SSDs and some Intel(R) Data Center SSDs may allow an unauthenticated user to potentially enable information disclosure via physical access.
RHSA-2024:1311 Red Hat Security Advisory: .NET 8.0 security update
dotnet: DoS in .NET Core / YARP HTTP / 2 WebSocket support
CVSS v3.1 score: 7.5
CVE-2019-2178 
In rw_t4t_sm_read_ndef of rw_t4t in Android 7.1.1, 7.1.2, 8.0, 8.1 and 9, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege in the NFC service with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.0 score: 7.8
CVSS v2.0 score: 7.2
GHSA-g9vh-q2pj-86vr 
SQL injection vulnerability in the eluna Page Comments (eluna_pagecomments) extension 1.1.2 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
RHSA-2025:3376 Red Hat Security Advisory: Red Hat build of Quarkus 3.15.4 release and security update
smallrye-fault-tolerance: SmallRye Fault Tolerance
CVSS v3.1 score: 7.5
CVE-2025-69044 WordPress Vango theme <= 1.3.3 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in goalthemes Vango vango allows PHP Local File Inclusion.This issue affects Vango: from n/a through <= 1.3.3.
CVSS v3.1 score: 8.1
GHSA-5qhr-7423-r78m 
Untrusted search path vulnerability in self-extracting archive files created by File Compact Ver.5 version 5.10 and earlier, Ver.6 version 6.02 and earlier, Ver.7 version 7.02 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS v3.0 score: 7.8
CVE-2024-38709 WordPress GD Rating System plugin <= 3.6 - Local File Inclusion vulnerability
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Milan Petrovic GD Rating System allows PHP Local File Inclusion.This issue affects GD Rating System: from n/a through 3.6.
CVSS v3.1 score: 5.3
CVE-2018-10746 
An issue was discovered on D-Link DSL-3782 EU 1.01 devices. An authenticated user can pass a long buffer as a 'get' parameter to the '/userfs/bin/tcapi' binary (in the Diagnostics component) using the 'get <node_name attr>' function and cause memory corruption. Furthermore, it is possible to redirect the flow of the program and execute arbitrary code.
CVSS v3.0 score: 8.8
CVSS v2.0 score: 9
CVE-2008-1689 
Stack consumption vulnerability in WebContainer.exe 1.0.0.336 and earlier in SLMail Pro 6.3.1.0 and earlier allows remote attackers to cause a denial of service (daemon crash) via a long request header in an HTTP request to TCP port 801.  NOTE: some of these details are obtained from third party information.
CVSS v2.0 score: 5
CVE-2025-24238 
A logic issue was addressed with improved checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, watchOS 11.4. An app may be able to gain elevated privileges.
CVSS v3.1 score: 9.8
CVE-2018-1267 
Cloud Foundry Silk CNI plugin, versions prior to 0.2.0, contains an improper access control vulnerability. If the platform is configured with an application security group (ASG) that overlaps with the Silk overlay network, any applications can reach any other application on the network regardless of the configured routing policies.
CVSS v3.1 score: 8.1
CVSS v2.0 score: 6.8
CVE-2018-9539 
In the ClearKey CAS descrambler, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-8.0 Android-8.1 Android-9. Android ID: A-113027383
CVSS v3.0 score: 7
CVSS v2.0 score: 6.9
CVE-2013-3837 
Unspecified vulnerability in Oracle Solaris 10 and 11.1 allows remote attackers to affect availability via unknown vectors related to Cacao.
CVSS v2.0 score: 4.3
GHSA-cgj5-5fg6-p5p3 
NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where a pointer passed from an user to the driver is used without validation which may lead to denial of service or potential escalation of privileges.
CVSS v3.0 score: 7.8
GHSA-mhqw-4hwc-5m2q 
Multiple directory traversal vulnerabilities in NOCC Webmail 1.0 allow remote attackers to include arbitrary files via .. (dot dot) sequences and a trailing NULL (%00) byte in (1) the _SESSION['nocc_theme'] parameter in (a) html/footer.php; and (2) the lang and (3) theme parameters and the (4) Accept-Language HTTP header field, when force_default_lang is disabled, in (b) index.php, as demonstrated by injecting PHP code into a profile and accessing it using the lang parameter in index.php.
CVE-2021-45551 
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D6200 before 1.1.00.40, D7000 before 1.0.1.78, R6020 before 1.0.0.42, R6080 before 1.0.0.42, R6050 before 1.0.1.26, JR6150 before 1.0.1.26, R6120 before 1.0.0.66, R6220 before 1.1.0.110, R6230 before 1.1.0.110, R6260 before 1.1.0.64, R6800 before 1.2.0.62, R6700v2 before 1.2.0.62, R6900v2 before 1.2.0.62, R7450 before 1.2.0.62, AC2100 before 1.2.0.62, AC2400 before 1.2.0.62, AC2600 before 1.2.0.62, and WNR2020 before 1.1.0.62.
CVSS v3.1 score: 7.6
CVE-2020-12288 
Protection mechanism failure in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via local access.
CVSS v3.1 score: 5.5
CVSS v2.0 score: 2.1
GHSA-gx5w-rrhp-f436 XSS in mdBook
This is a cross-post of [the official security advisory][ml]. The official post contains a signed version with our PGP key, as well.The Rust Security Response Working Group was recently notified of a security issue affecting the search feature of mdBook, which could allow an attacker to execute arbitrary JavaScript code on the page.The CVE for this vulnerability is [CVE-2020-26297](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26297).OverviewThe search feature of mdBook (introduced in version 0.1.4) was affected by a cross site scripting vulnerability that allowed an attacker to execute arbitrary JavaScript code on an user's browser by tricking the user into typing a malicious search query, or tricking the user into clicking a link to the search page with the malicious search query prefilled.mdBook 0.4.5 fixes the vulnerability by properly escaping the search query.MitigationsOwners of websites built with mdBook have to upgrade to mdBook 0.4.5 or greater and rebuild their website contents with it. It's possible to install mdBook 0.4.5 on the local system with:AcknowledgementsThanks to Kamil Vavra for responsibly disclosing the vulnerability to us according to [our security policy](https://www.rust-lang.org/policies/security).Timeline of eventsAll times are listed in UTC.2020-12-30 20:14 - The issue is reported to the Rust Security Response WG2020-12-30 20:32 - The issue is acknowledged and the investigation began2020-12-30 21:21 - Found the cause of the vulnerability and prepared the patch2021-01-04 15:00 - Patched version released and vulnerability disclosed
CVSS v3.1 score: 8.2
CVE-2025-31177 Gnuplot: gnuplot heap-buffer overflow on utf8_copy_one
gnuplot is affected by a heap buffer overflow at function utf8_copy_one.
CVSS v3.1 score: 5.5
GHSA-8gh2-336j-g8v7 
The STARTTLS feature in Exim through 4.94.2 allows response injection (buffering) during MTA SMTP sending.
CVSS v3.1 score: 7.5
CVE-2024-47515 Pagure: generate_archive() follows symbolic links in temporary clones
A vulnerability was found in Pagure. Support of symbolic links during repository archiving of repositories allows the disclosure of local files. This flaw allows a malicious user to take advantage of the Pagure instance.
CVSS v3.1 score: 8.1
CVE-2026-43982 Algernon: Path traversal file write via savein()
Algernon is a small self-contained pure-Go web server. Prior to 1.17.6, uploadedFileSaveIn() in lua/upload/upload.go uses filepath.Join() with the caller-supplied directory but performs no boundary check after joining. A directory of ../../../tmp resolves cleanly to /tmp, outside the web root. This vulnerability is fixed in 1.17.6.
CVSS v4.0 score: 8.7
GHSA-m8wf-2872-hp5w 
Use after free in Universal Print Management Service allows an authorized attacker to elevate privileges locally.
CVSS v3.1 score: 8.8
CVE-2024-4621 ArForms < 6.6 - Admin+ Stored XSS
The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS v3.1 score: 4.8
GHSA-x689-jpx4-3rqc 
Out of bounds write in Swiftshader in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
GHSA-p729-59m3-2m8r 
Use of a hard-coded cryptographic key in MIK.starlight 7.9.5.24363 allows local users to decrypt credentials via unspecified vectors.
CVE-2025-46732 OpenCTI's GraphQL IDOR enables authenticated users to modify or delete notifications of other users
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.6.6, an IDOR vulnerability in the GrapQL `NotificationLineNotificationMarkReadMutation` and `NotificationLineNotificationDeleteMutation` mutations of OpenCTI allows an authenticated user to change the read status of a notification or delete a notification of another user in case he has knowledge of the UUID of the notification. When changing the read status of a notification, the user also receives the content of the notification they changed the read status of. Authenticated Users in OpenCTI can read, modify and delete notification of other users if they know the UUID of the notification. Version 6.6.6 fixes the issue.
CVSS v3.1 score: 5.4
GHSA-fj9v-g8fw-vxmf Improper Privilege Management in craftercms
A logged-in and authenticated user with a Reviewer Role may lock a content item.
CVSS v3.1 score: 4.3
CVE-2021-40998 
A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x prior to 6.10.2 - - ClearPass Policy Manager 6.9.x prior to 6.9.7-HF1 - - ClearPass Policy Manager 6.8.x prior to 6.8.9-HF1. Aruba has released patches for ClearPass Policy Manager that address this security vulnerability.
CVSS v3.1 score: 7.2
CVSS v2.0 score: 9
GHSA-f924-8j9q-7fpq 
A vulnerability has been identified in SiPass integrated (All versions < V3.0). Affected server applications contains a broken access control vulnerability. The authorization mechanism lacks sufficient server-side checks, allowing an attacker to execute a specific API request.Successful exploitation allows an attacker to potentially manipulate data belonging to other users.
CVSS v4.0 score: 5.1
CVSS v3.1 score: 3.5
CVE-2016-5282 
Mozilla Firefox before 49.0 does not properly restrict the scheme in favicon requests, which might allow remote attackers to obtain sensitive information via unspecified vectors, as demonstrated by a jar: URL for a favicon resource.
CVSS v3.0 score: 6.5
CVSS v2.0 score: 4.3
CVE-2019-16157 
An information exposure vulnerability in Fortinet FortiWeb 6.2.0 CLI and earlier may allow an authenticated user to view sensitive information being logged via diagnose debug commands.
CVSS v3.1 score: 6.5
CVSS v2.0 score: 4
GHSA-f94f-phr4-45gf 
TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in the function setDiagnosisCfg of the file lib/cste_modules/system.so to control the ipDoamin.
CVSS v3.1 score: 9.8
GHSA-fxqv-865x-5g7j 
IBM Kenexa LCMS Premier on Cloud 9.0, and 10.0.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM Reference #: 1992067.
CVSS v3.0 score: 7.1
CVE-2016-6054 
IBM Jazz Foundation is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS v3.0 score: 5.4
CVSS v2.0 score: 3.5
CVE-2007-1503 
Multiple format string vulnerabilities in comm.c in Rhapsody IRC 0.28b allow remote attackers to execute arbitrary code via format string specifiers to the create_ctcp_message function using the message argument to the (1) me or (2) ctcp commands, and possibly related vectors involving the (3) whois, (4) mode, and (5) topic commands.
CVSS v2.0 score: 7.5
GHSA-fpvf-frm6-625q ImageMagick has Heap Use-After-Free in ImageMagick MSL decoder
A heap use-after-free vulnerability in ImageMagick's MSL decoder allows an attacker to trigger access to freed memory by crafting an MSL file.
CVSS v3.1 score: 5.3
GHSA-3rj8-qrpc-rrvr 
HCL DFXServer is affected by a Missing Access Control vulnerability. This vulnerability states that certain endpoints are accessible without any form of authentication in another browser. This allows any network user to invoke these APIs and interact with the application without verification of their identity or authorization level.
CVSS v3.1 score: 6.3
GHSA-xrwp-4qvv-59wr 
A flaw was found in the virtio-net device of QEMU. This flaw was inadvertently introduced with the fix for CVE-2021-3748, which forgot to unmap the cached virtqueue elements on error, leading to memory leakage and other unexpected results. Affected QEMU version: 6.2.0.
CVSS v3.1 score: 7.5
CVE-2021-21848 
An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. The library will actually reuse the parser for atoms with the “stsz” FOURCC code when parsing atoms that use the “stz2” FOURCC code and can cause an integer overflow due to unchecked arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.
CVSS v3.0 score: 8.8
CVE-2025-31412 WordPress JetProductGallery plugin <= 2.1.22 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetProductGallery jet-woo-product-gallery allows DOM-Based XSS.This issue affects JetProductGallery: from n/a through <= 2.1.22.
CVSS v3.1 score: 6.5
CVE-2023-37486 Information Disclosure vulnerability in SAP Commerce (OCC API)
Under certain conditions SAP Commerce (OCC API) - versions HY_COM 2105, HY_COM 2205, COM_CLOUD 2211, endpoints allow an attacker to access information which would otherwise be restricted. On successful exploitation there could be a high impact on confidentiality with no impact on integrity and availability of the application.
CVSS v3.1 score: 5.9
GHSA-7f3w-h53p-5qwq 
Windows Resource Manager PSM Service Extension Elevation of Privilege Vulnerability
CVSS v3.1 score: 7.8
CVE-2021-26425 Windows Event Tracing Elevation of Privilege Vulnerability
Windows Event Tracing Elevation of Privilege Vulnerability
CVSS v3.1 score: 7.8
CVE-2017-10349 
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JAXP). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
CVSS v3.1 score: 5.3
CVSS v2.0 score: 5
RHSA-2017:0831 Red Hat Security Advisory: JBoss Enterprise Application Platform 7.0.5 on RHEL 6
jboss: jbossas: unsafe chown of server.log in jboss init script allows privilege escalation wildfly: ParseState headerValuesCache can be exploited to fill heap with garbage
CVSS v3.0 score: 7.5
GHSA-m95q-f3q8-2rj9 
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and  15.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence.  While the vulnerability is in Oracle Coherence, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Coherence accessible data as well as  unauthorized read access to a subset of Oracle Coherence accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N).
CVSS v3.1 score: 5.4
CVE-2023-37144 
Tenda AC10 v15.03.06.26 was discovered to contain a command injection vulnerability via the mac parameter in the function formWriteFacMac.
CVSS v3.1 score: 9.8
CVE-2006-6416 
Multiple PHP remote file inclusion vulnerabilities in PhpLeague - Univert PhpLeague 0.81 allow remote attackers to execute arbitrary PHP code via a URL in the cheminmini parameter to (1) consult/miniseul.php or (2) config.php.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS v2.0 score: 7.5
GHSA-g56g-9mxr-9pgw 
Hitron CODA-4582 2AHKM-CODA4589 7.2.4.5.1b8 devices allow a remote attacker within Wi-Fi proximity to conduct stored XSS attacks via the 'Network Name (SSID)' input fields to the /index.html#wireless_basic page.
CVSS v3.1 score: 5.2
CVE-2020-7335 Privilege Escalation vulnerability in McAfee Total Protection (MTP)
Privilege Escalation vulnerability in Microsoft Windows client McAfee Total Protection (MTP) prior to 16.0.29 allows local users to gain elevated privileges via careful manipulation of a folder by creating a junction link. This exploits a lack of protection through a timing issue and is only exploitable in a small time window.
CVSS v3.1 score: 7.5