CIRCL/vulnerability-scores huggingface dataset:
CVE-2023-1151 SourceCodester Electronic Medical Records System Cookie administrator.php sql injection
A vulnerability was found in SourceCodester Electronic Medical Records System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file administrator.php of the component Cookie Handler. The manipulation of the argument userid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-222163.
CVSS v3.1 score: 6.3
CVSS v3.0 score: 6.3
CVSS v2.0 score: 6.5
CVE-2023-36016 Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVSS v3.1 score: 6.2
CVE-2018-17311 
On the RICOH MP C6503 Plus printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi.
CVSS v3.0 score: 6.1
CVSS v2.0 score: 4.3
GHSA-mgvr-v627-68mp 
SQL injection vulnerability in index.php in sNews 1.3 allows remote attackers to execute arbitrary SQL commands via the (1) category and (2) id parameters.
CVE-2026-34700 InDesign Desktop | Out-of-bounds Write (CWE-787)
InDesign Desktop versions 21.3, 20.5.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1 score: 7.8
GHSA-j6hf-ffpw-242h 
In postNotification of ServiceRecord.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-153878498
CVE-2024-55992 WordPress WooCommerce Basic Ordernumbers plugin <= 1.4.4 - Broken Access Control vulnerability
Missing Authorization vulnerability in Open Tools WooCommerce Basic Ordernumbers woocommerce-basic-ordernumbers allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Basic Ordernumbers: from n/a through <= 1.4.4.
CVSS v3.1 score: 5.4
CVE-2021-3410 
A flaw was found in libcaca v0.99.beta19. A buffer overflow issue in caca_resize function in libcaca/caca/canvas.c may lead to local execution of arbitrary code in the user context.
CVSS v3.1 score: 7.8
CVSS v2.0 score: 4.6
GHSA-g4x4-6g36-hgrp 
A flaw was found in ImageMagick in MagickCore/statistic.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type unsigned long. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. This flaw affects ImageMagick versions prior to 7.0.9-0.
CVSS v3.1 score: 3.3
GHSA-wxww-rqxx-jpg4 
An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for mcabber 1.0.0 - 1.0.4.
CVSS v3.0 score: 5.9
GHSA-5wm3-c83x-cqpq 
A vulnerability has been identified in SIMATIC PCS 7 (All versions), SIMATIC S7-PM (All versions), SIMATIC STEP 7 V5 (All versions < V5.7). The affected product contains a database management system that could allow remote users with low privileges to use embedded functions of the database (local or in a network share) that have impact on the server.An attacker with network access to the server network could leverage these embedded functions to run code with elevated privileges in the database management system's server.
CVSS v3.1 score: 9.9
CVE-2017-15288 
The compilation daemon in Scala before 2.10.7, 2.11.x before 2.11.12, and 2.12.x before 2.12.4 uses weak permissions for private files in /tmp/scala-devel/${USER:shared}/scalac-compile-server-port, which allows local users to write to arbitrary class files and consequently gain privileges.
CVSS v3.1 score: 7.8
CVSS v2.0 score: 7.2
CVE-2016-3862 
media/ExifInterface.java in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-09-01 does not properly interact with the use of static variables in libjhead_jni, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 29270469.
CVSS v3.0 score: 7.8
CVSS v2.0 score: 9.3
GHSA-6r6c-7pv4-j6gr 
A malicious crafted TGA file when consumed through DesignReview.exe application could lead to memory corruption vulnerability. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
CVSS v3.1 score: 7.8
GHSA-x3vr-p44r-4h38 
u'Information disclosure issue occurs as in current logic as secure touch is released without clearing the display session which can result in user reading the secure input while touch is in non-secure domain as secure display is active' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8017, APQ8053, APQ8076, APQ8096AU, APQ8098, Kamorta, MDM9150, MDM9205, MDM9206, MDM9607, MDM9650, MSM8905, MSM8909, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996, MSM8996AU, MSM8998, Nicobar, QCM2150, QCS404, QCS405, QCS605, QCS610, QM215, Rennell, SA415M, SA515M, SA6155P, SC7180, SC8180X, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130
CVE-2019-25677 WinRAR 5.61 Denial of Service via Malformed Language File
WinRAR 5.61 contains a denial of service vulnerability that allows local attackers to crash the application by placing a malformed winrar.lng language file in the installation directory. Attackers can trigger the crash by opening an archive and pressing the test button, causing an access violation at memory address 004F1DB8 when the application attempts to read invalid data.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 6.2
CVE-2026-60744 
Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Cost Management.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Cost Management accessible data as well as  unauthorized access to critical data or complete access to all Oracle Cost Management accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N).
CVSS v3.1 score: 6.8
GHSA-3m69-935c-w2hj 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects embedded in PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-12438.
CVSS v3.1 score: 7.8
GHSA-cg6m-ghv2-fh4r 
Improper authorization checks of team members privileges allow a team member to escalate privileges to the team owner account.
CVSS v3.1 score: 7.1
CVE-2014-8995 
SQL injection vulnerability in Maarch LetterBox 2.8 allows remote attackers to execute arbitrary SQL commands via the UserId cookie.
CVSS v2.0 score: 5
CVE-2020-1710 
The issue appears to be that JBoss EAP 6.4.21 does not parse the field-name in accordance to RFC7230[1] as it returns a 200 instead of a 400.
CVSS v3.1 score: 5.3
CVSS v2.0 score: 5
CVE-2024-2945 Campcodes Online Examination System updateExaminee.php sql injection
A vulnerability was found in Campcodes Online Examination System 1.0. It has been classified as critical. Affected is an unknown function of the file /adminpanel/admin/facebox_modal/updateExaminee.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258036.
CVSS v3.1 score: 6.3
CVSS v3.0 score: 6.3
CVSS v2.0 score: 6.5
RHSA-2017:2787 Red Hat Security Advisory: rh-mysql56-mysql security and bug fix update
mysql: Incorrect input validation allowing code execution via mysqldump mysql: Server: Replication  unspecified vulnerability (CPU Jan 2017) mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2017) mysql: Server: DML unspecified vulnerability (CPU Jan 2017) mysql: Server: InnoDB unspecified vulnerability (CPU Jan 2017) mysql: Server: DDL unspecified vulnerability (CPU Jan 2017) mysql: unsafe chmod/chown use in init script (CPU Jan 2017) mysql: Server: DDL  unspecified vulnerability (CPU Jan 2017) mysql: unrestricted mysqld_safe's ledir (CPU Jan 2017) mysql: prepared statement handle use-after-free after disconnect mysql: incorrect enforcement of ssl-mode=REQUIRED in MySQL 5.5 and 5.6 mysql: Server: DML unspecified vulnerability (CPU Apr 2017) mysql: Server: Optimizer unspecified vulnerability (CPU Apr 2017) mysql: insecure error log file handling in mysqld_safe, incomplete CVE-2016-6664 fix (CPU Jan 2017) mysql: Server: MyISAM unspecified vulnerability (CPU Jan 2017) mysql: Logging unspecified vulnerability (CPU Jan 2017) mysql: Server: Error Handling unspecified vulnerability (CPU Jan 2017) mysql: Server: Memcached unspecified vulnerability (CPU Apr 2017) mysql: Server: Optimizer unspecified vulnerability (CPU Apr 2017) mysql: Server: Optimizer unspecified vulnerability (CPU Apr 2017) mysql: Server: DML unspecified vulnerability (CPU Apr 2017) mysql: Server: Security: Privileges unspecified vulnerability (CPU Apr 2017) mysql: Server: Security: Privileges unspecified vulnerability (CPU Apr 2017) mysql: Server: Security: Privileges unspecified vulnerability (CPU Apr 2017) mysql: Server: DDL unspecified vulnerability (CPU Apr 2017) mysql: integer underflow in get_56_lenc_string() leading to DoS (CPU Apr 2017) mysql: Incorrect input validation allowing code execution via mysqldump mysql: Server: Memcached unspecified vulnerability (CPU Jul 2017) mysql: Server: DML unspecified vulnerability (CPU Jul 2017) mysql: Client programs unspecified vulnerability (CPU Jul 2017) mysql: Server: DML unspecified vulnerability (CPU Jul 2017) mysql: Server: Replication unspecified vulnerability (CPU Jul 2017) mysql: Server: Charsets unspecified vulnerability (CPU Jul 2017) mysql: Server: Replication unspecified vulnerability (CPU Jul 2017) mysql: Client mysqldump unspecified vulnerability (CPU Jul 2017) mysql: Server: DDL unspecified vulnerability (CPU Jul 2017) mysql: Server: DDL unspecified vulnerability (CPU Jul 2017)
CVSS v3.0 score: 3.1
CVE-2007-5193 
The default configuration for twiki 4.1.2 on Debian GNU/Linux, and possibly other operating systems, specifies the work area directory (cfg{RCS}{WorkAreaDir}) under the web document root, which might allow remote attackers to obtain sensitive information when .htaccess restrictions are not applied.
CVSS v2.0 score: 5
GHSA-rv69-w27m-3wq2 
Themify Shortcodes WordPress plugin before 2.0.8 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
CVSS v3.1 score: 5.4
GHSA-999p-3hf6-2qgp 
A vulnerability in the Trend Micro InterScan Messaging Security Virtual Appliance 9.0 and 9.1 management portal could allow an unauthenticated user to access sensitive information in a particular log file that could be used to bypass authentication on vulnerable installations.
CVSS v3.0 score: 8.1
RHSA-2025:17377 Red Hat Security Advisory: kernel security update
kernel: security/keys: fix slab-out-of-bounds in key_task_permission kernel: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush kernel: wifi: ath12k: Decrement TID on RX peer frag setup error handling
CVSS v3.1 score: 7.1
CVE-2025-12061 Tax Service Electronic HDM < 1.2.1 - Unauthenticated Arbitrary SQL Execution
The TAX SERVICE Electronic HDM WordPress plugin before 1.2.1 does not authorization and CSRF checks in an AJAX action, allowing unauthenticated users to import and execute arbitrary SQL statements
CVSS v3.1 score: 8.6
CVE-2022-45701 
Arris TG2482A firmware through 9.1.103GEM9 allow Remote Code Execution (RCE) via the ping utility feature.
CVSS v3.1 score: 8.8
GHSA-3m6q-jj5j-38c9 Oj: Stack Buffer Overflow in Oj::Doc#each_child via Deeply Nested Input
Summary`Oj::Doc#each_child`, when invoked recursively over a deeply nested JSON
document, overflows a fixed-size stack buffer and aborts the process. This is a
denial of service reachable from untrusted JSON.DetailsTwo-step chain in `ext/oj/fast.c`:**`doc_each_child` (~line 1501)** increments `doc->where` past the
`where_path[MAX_STACK = 100]` array with no bounds check, and never restores
it (`doc->where--` is missing). Calling `each_child` recursively from inside
the yield block therefore drives `doc->where` beyond the array.**On the next entry (~line 1478)** the function copies the path into a
stack-local buffer:When the previous recursive call left `doc->where` past `where_path[100]`,
`wlen` exceeds `MAX_STACK` and the `memcpy` overflows `save_path` on the C
stack.The `Oj::Doc` parser imposes no JSON nesting-depth limit (it relies on a
C-stack pressure check), so deeply nested attacker input reaches this path.Proof of ConceptRecursion depth <= 99 iterates normally; depth >= 101 aborts. lldb backtrace
on the affected build (`ruby 3.3.8 / arm64-darwin24`):ImpactReliable denial of service: any endpoint that calls
`Oj::Doc.open(untrusted) { |d| d.each_child ... }` recursively can be crashed
with a small deeply-nested payload. On builds with a stack protector (the
default, `-fstack-protector-strong`) the canary aborts the process before the
saved return address is used. The Step-1 heap OOB writes into `struct _doc`
fields do occur, but are masked in practice because the Step-2 stack overflow
crashes first; turning them into anything beyond a crash has not been
demonstrated.PatchesFixed in **3.17.3**: `doc_each_child` now bounds-checks before incrementing
`doc->where` (raising `Oj::DepthError`) and restores `doc->where` after the
loop, matching the existing `each_leaf` pattern. Verified on the fixed build:
depth >= 101 raises a clean `Oj::DepthError` instead of aborting.CreditReported by Zac Wang (@7a6163).
CVSS v3.1 score: 7.5
CVE-2025-37934 ASoC: simple-card-utils: Fix pointer check in graph_util_parse_link_direction
In the Linux kernel, the following vulnerability has been resolved:

ASoC: simple-card-utils: Fix pointer check in graph_util_parse_link_direction

Actually check if the passed pointers are valid, before writing to them.
This also fixes a USBAN warning:
UBSAN: invalid-load in ../sound/soc/fsl/imx-card.c:687:25
load of value 255 is not a valid value for type '_Bool'

This is because playback_only is uninitialized and is not written to, as
the playback-only property is absent.
CVSS v3.1 score: 7.8
CVE-2022-39264 nheko vulnerable to secret poisoning using MITM on secret requests by the homeserver
nheko is a desktop client for the Matrix communication application. All versions below 0.10.2 are vulnerable homeservers inserting malicious secrets, which could lead to man-in-the-middle attacks. Users can upgrade to version 0.10.2 to protect against this issue. As a workaround, one may apply the patch manually, avoid doing verifications of one's own devices, and/or avoid pressing the request button in the settings menu.
CVSS v3.1 score: 8.6
GHSA-qmjp-x75f-m6mw 
The StageShow plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 9.8.6. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS v3.1 score: 6.1
CVE-2007-4946 
LetterGrade allows remote attackers to obtain sensitive information (installation path or account existence) via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS v2.0 score: 5
GHSA-hxf7-8wmv-8rq2 
Unspecified vulnerability in the TouchPal Contacts (com.cootek.smartdialer) application 3.3.1 and 4.0.1 for Android has unknown impact and attack vectors.
CVE-2024-32842 
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
CVSS v3.0 score: 9.1
CVE-2019-10272 
An issue was discovered in Weaver e-cology 9.0. There is a CRLF Injection vulnerability via the /workflow/request/ViewRequestForwardSPA.jsp isintervenor parameter, as demonstrated by the %0aSet-cookie: substring.
CVSS v3.0 score: 6.1
CVSS v2.0 score: 4.3
GHSA-27fg-888w-q9q3 
Improper Control of Generation of Code ('Code Injection') vulnerability in Bearsthemes Alone allows Remote Code Inclusion. This issue affects Alone: from n/a through 7.8.2.
CVSS v3.1 score: 7.2
CVE-2026-57630 WordPress Blocksy Companion Pro plugin <= 2.1.46 - Insecure Direct Object References (IDOR) vulnerability
Unauthenticated Insecure Direct Object References (IDOR) in Blocksy Companion Pro <= 2.1.46 versions.
CVSS v3.1 score: 5.3
CVE-2017-12819 
Remote manipulations with language pack updater lead to NTLM-relay attack for system user in Gemalto's HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE version 7.55.
CVSS v3.0 score: 9.8
CVSS v2.0 score: 7.5
cisco-sa-20180418-iess Cisco Industrial Ethernet Switches Device Manager Cross-Site Request Forgery Vulnerability
A vulnerability in the device manager web interface of Cisco Industrial Ethernet Switches could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against a user of an affected system.

The vulnerability is due to insufficient CSRF protection by the device manager web interface. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link or visit an attacker-controlled website. A successful exploit could allow the attacker to submit arbitrary requests to an affected device via the device manager web interface with the privileges of the user.

There are no workarounds that address this vulnerability.

This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-iess ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-iess"]
CVSS v3.0 score: 8.8
GHSA-xhmv-gf55-q7fw 
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused
GHSA-wcc5-wx82-x4gx 
A Insufficient Verification of Data Authenticity (CWE-345) vulnerability exists in the Modicon M221, all versions, which could cause a change of IPv4 configuration (IP address, mask and gateway) when remotely connected to the device.
CVSS v3.1 score: 8.2
GHSA-g8vp-6g67-pf46 
The Product Feed PRO for WooCommerce WordPress plugin before 11.2.3 does not escape the rowCount parameter before outputting it back in an attribute via the woosea_categories_dropdown AJAX action (available to any authenticated user), leading to a Reflected Cross-Site Scripting
CVSS v3.1 score: 5.4
GHSA-rx9c-3qcp-h267 
Race condition in the GetStaticInstance function in the WebRTC implementation in Mozilla Firefox before 45.0 might allow remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via unspecified vectors.
CVSS v3.0 score: 8.8
GHSA-xgp6-75vr-8v4c 
Windows Bluetooth Driver Elevation of Privilege Vulnerability
CVSS v3.1 score: 8.8
PYSEC-2021-310 
TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can craft a TFLite model that would trigger a null pointer dereference, which would result in a crash and denial of service. The [implementation](https://github.com/tensorflow/tensorflow/blob/149562d49faa709ea80df1d99fc41d005b81082a/tensorflow/lite/kernels/internal/optimized/optimized_ops.h#L268-L285) unconditionally dereferences a pointer. We have patched the issue in GitHub commit 15691e456c7dc9bd6be203b09765b063bf4a380c. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
GHSA-whc5-w7f7-2gw5 
win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2008 R2 and Windows 7 does not properly validate user-mode input, which allows local users to gain privileges via a crafted application, aka "Win32k Memory Corruption Vulnerability."
GHSA-w7w7-6353-385q 
In the Linux kernel, the following vulnerability has been resolved:drm/amd/display: Implement bounds check for stream encoder creation in DCN401'stream_enc_regs' array is an array of dcn10_stream_enc_registers
structures. The array is initialized with four elements, corresponding
to the four calls to stream_enc_regs() in the array initializer. This
means that valid indices for this array are 0, 1, 2, and 3.The error message 'stream_enc_regs' 4 <= 5 below, is indicating that
there is an attempt to access this array with an index of 5, which is
out of bounds. This could lead to undefined behaviorHere, eng_id is used as an index to access the stream_enc_regs array. If
eng_id is 5, this would result in an out-of-bounds access on the
stream_enc_regs array.Thus fixing Buffer overflow error in dcn401_stream_encoder_createFound by smatch:
drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn401/dcn401_resource.c:1209 dcn401_stream_encoder_create() error: buffer overflow 'stream_enc_regs' 4 <= 5
CVSS v3.1 score: 5.5
GHSA-f6c5-28vq-94w2 
An incorrect buffer size calculation in the epoch key generator in OpenVPN ovpn-dco-win version 2.0.0 through 2.8.3 allows a remote authenticated peer to trigger a heap-based buffer overflow and kernel memory corruption via a crafted data packet, resulting in a system crash (denial of service).
CVSS v4.0 score: 5.6
CVSS v3.1 score: 6.5
GHSA-8c68-8q52-rmjm 
The ColorOS Internet Browser com.heytap.browser application 45.10.3.4.1 for Android allows a remote attacker to execute arbitrary JavaScript code via the com.android.browser.RealBrowserActivity component.
CVSS v3.1 score: 6.1
CVE-2025-53101 ImageMagick has Stack Buffer Overflow in image.c
ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick mogrify` command, specifying multiple consecutive `%d` format specifiers in a filename template causes internal pointer arithmetic to generate an address below the beginning of the stack buffer, resulting in a stack overflow through `vsnprintf()`. Versions 7.1.2-0 and 6.9.13-26 fix the issue.
CVSS v3.1 score: 7.4
CVE-2019-9145 
An issue was discovered in Hsycms V1.1. There is an XSS vulnerability via the name field to the /book page.
CVSS v3.0 score: 6.1
CVSS v2.0 score: 4.3
CVE-2026-47704 TypeBot vulnerable to cross-typebot webhook resume via unchecked `resultId` lineage allows unauthorized control of another bot's waiting session
TypeBot is a chatbot builder tool. Prior to version 3.17.0, an authenticated user who has read access to any typebot can resume a waiting webhook session that belongs to a different typebot by mixing an authorized `typebotId` and `blockId` and a foreign live `resultId`. The webhook resume handler authorizes the parent typebot first, but then resolves the descendant `result` only by `resultId`. As a result, an attacker can inject arbitrary webhook JSON into another typebot's suspended session and advance its execution without any access to the victim typebot. Version 3.17.0 patches the issue.
CVSS v4.0 score: 7.1
CVE-2021-3469 
Foreman versions before 2.3.4 and before 2.4.0 is affected by an improper authorization handling flaw. An authenticated attacker can impersonate the foreman-proxy if product enable the Puppet Certificate authority (CA) to sign certificate requests that have subject alternative names (SANs). Foreman do not enable SANs by default and `allow-authorization-extensions` is set to `false` unless user change `/etc/puppetlabs/puppetserver/conf.d/ca.conf` configuration explicitly.
CVSS v3.1 score: 5.4
CVSS v2.0 score: 3.5
CVE-2023-23636 
In Jellyfin 10.8.x through 10.8.3, the name of a playlist is vulnerable to stored XSS. This allows an attacker to steal access tokens from the localStorage of the victim.
CVSS v3.1 score: 5.4
GHSA-h985-5f4g-mf95 
Microsoft Windows Infrared Data Association (IrDA) Information Disclosure Vulnerability
CVSS v3.1 score: 5.5
CVE-2022-36416 
Protection mechanism failure in the Intel(R) Ethernet 500 Series Controller drivers for VMware before version 1.10.0.13 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS v3.1 score: 4.4
CVE-2026-67551 Apache Qpid Proton Dotnet: Type size/count handling can lead to excessive allocation pre-authentication
pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.

This issue affects Apache Qpid Proton-Dotnet: through 1.0.0.

Users are recommended to upgrade to version 1.1.0, which fixes the issue.
CVSS v3.1 score: 7.5
ICSA-24-226-09 Rockwell Automation ControlLogix, GuardLogix 5580, CompactLogix, Compact GuardLogix 5380
A denial-of-service vulnerability exists in the affected products.  This vulnerability occurs when a malformed PCCC message is received, causing a fault in the controller.
CVSS v3.1 score: 7.5
GHSA-2ffw-h4mh-jjh5 
Windu CMS is vulnerable to User Enumeration. This issue occurs during logon, where a difference in messages could allow an attacker to determine if the login is valid or not, enabling a brute force attack with valid logins.The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 4.1 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 5.3
GHSA-jqvm-5g74-g525 
A vulnerability was detected in Totolink A7100RU 7.4cu.2313_b20191024. The affected element is the function setNtpCfg of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument tz results in os command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.
CVSS v4.0 score: 5.5
CVSS v3.1 score: 7.3
GHSA-8jvc-mcx6-r4cg Vikunja has TOTP Two-Factor Authentication Bypass via OIDC Login Path
SummaryThe OIDC callback handler issues a full JWT token without checking whether the matched user has TOTP two-factor authentication enabled. When a local user with TOTP enrolled is matched via the OIDC email fallback mechanism, the second factor is completely skipped.DetailsThe OIDC callback at `pkg/modules/auth/openid/openid.go:185` issues a JWT directly after user lookup:There are zero references to TOTP in the entire `pkg/modules/auth/openid/` directory. By contrast, the local login handler at `pkg/routes/api/v1/login.go:79-102` correctly implements TOTP verification:When OIDC `EmailFallback` maps to a local user who has TOTP enabled, the TOTP enrollment is ignored and a full JWT is issued without any second-factor challenge.Proof of ConceptTested on Vikunja v2.2.2 with Dex as the OIDC provider.Setup:Vikunja configured with `emailfallback: true` for DexLocal user `alice` (id=1) has TOTP enabledOutput:Local login correctly requires TOTP (412), but the OIDC path issued a JWT for alice without any TOTP challenge.ImpactWhen an administrator enables OIDC with `EmailFallback`, any user who has enrolled TOTP two-factor authentication on their local account can have that protection completely bypassed. An attacker who can authenticate to the OIDC provider with a matching email address gains full access without any second-factor challenge. This undermines the security guarantee of TOTP enrollment.This vulnerability is a prerequisite chain with the OIDC email fallback account takeover (missing `email_verified` check). Together, they allow an attacker to bypass both the password and the TOTP second factor.Recommended FixAdd a TOTP check in the OIDC callback before issuing the JWT:*Found and reported by [aisafe.io](https://aisafe.io)*
CVSS v3.1 score: 7.4
GHSA-7655-hvf9-c7q3 
libjasper/jpc/jpc_dec.c in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via vectors involving left shift of a negative value.
CVSS v3.0 score: 5.5
GHSA-7j2x-68p3-rh6g 
Insecure permissions configured in the user_id parameter at SysUserController.java of OFCMS v1.1.4 allows attackers to access and arbitrarily modify users' personal information.
CVSS v3.1 score: 5.4
CVE-2025-22405 
In multiple locations, there is a possible way to execute arbitrary code due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1 score: 8.4
CVE-2017-7921 
An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS-2CD2xx2FWD Series V5.3.1 build 150410 to V5.4.4 Build 161125, DS-2CD4x2xFWD Series V5.2.0 build 140721 to V5.4.0 Build 160414, DS-2CD4xx5 Series V5.2.0 build 140721 to V5.4.0 Build 160421, DS-2DFx Series V5.2.0 build 140805 to V5.4.5 Build 160928, and DS-2CD63xx Series V5.0.9 build 140305 to V5.3.5 Build 160106 devices. The improper authentication vulnerability occurs when an application does not adequately or correctly authenticate users. This may allow a malicious user to escalate his or her privileges on the system and gain access to sensitive information.
CVSS v3.1 score: 9.8
CVSS v2.0 score: 7.5
RHSA-2017:2451 Red Hat Security Advisory: openstack-neutron security update
openstack-neutron: iptables not active after update
CVSS v3.0 score: 5.3
GHSA-6357-xr2f-cw6x 
Philips Vue PACS does not properly assign, modify, track, or check actor privileges, creating an unintended sphere of control for that actor.
CVSS v4.0 score: 4.8
CVSS v3.1 score: 4.4
CVE-2025-1467 
Versions of the package tarteaucitronjs before 1.17.0 are vulnerable to Cross-site Scripting (XSS) via the getElemWidth() and getElemHeight(). This is related to [SNYK-JS-TARTEAUCITRONJS-8366541](https://security.snyk.io/vuln/SNYK-JS-TARTEAUCITRONJS-8366541)
CVSS v4.0 score: 5.1
CVSS v3.1 score: 6.1
GHSA-8qjr-j6r8-5cw7 
The Ninja Forms Contact Form WordPress plugin before 3.6.4 does not escape keys of the fields POST parameter, which could allow high privilege users to perform SQL injections attacks
GHSA-7q4r-xvh7-hj22 
Improper authorization in GitLab 12.8+ allows a guest user in a private project to view tag data that should be inaccessible on the releases page
CVSS v3.1 score: 4.3
GHSA-2p2q-m5g6-rghx 
Cross-Site Request Forgery (CSRF) vulnerability in Jeff Sherk Update Theme and Plugins from Zip File plugin <= 2.0.0 versions.
CVSS v3.1 score: 4.3
CVE-2025-48359 WordPress ATT YouTube Widget plugin <= 1.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in thaihavnn07 ATT YouTube Widget att-youtube allows Stored XSS.This issue affects ATT YouTube Widget: from n/a through <= 1.0.
CVSS v3.1 score: 7.1
GHSA-fc99-9g2v-hx8x 
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.
CVSS v3.1 score: 7.8
GHSA-mhwr-j844-q9pq 
An issue was discovered in the Shared Account Synchronization component of PaperCut MF (version 25.0.4). The application allows administrative users to configure a source path for account data synchronization.Due to a lack of proper path validation and sanitization, an authenticated user with administrative privileges can specify arbitrary file paths on the local file system. This allows for the enumeration of directory structures and the unauthorized reading of sensitive text-based configuration or system files.When the synchronization process is triggered, the application attempts to parse the contents of the specified file, subsequently exposing the data within the application's account management interface. This vulnerability could lead to the disclosure of sensitive system information or configuration details, depending on the permissions of the service account under which the application is running.
CVSS v4.0 score: 4.6
CVSS v3.1 score: 4.9
GHSA-wwr2-fv28-4q32 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15373.
CVE-2025-65966 OneUptime Unauthorized User Creation via API
OneUptime is a solution for monitoring and managing online services. In version 9.0.5598, a low-permission user can create new accounts through a direct API request instead of being restricted to the intended interface. This issue has been patched in version 9.1.0.
CVSS v4.0 score: 8.8
CVE-2023-26055 XWiki Commons may allow privilege escalation to programming rights via user's first name
XWiki Commons are technical libraries common to several other top level XWiki projects. Starting in version 3.1-milestone-1, any user can edit their own profile and inject code, which is going to be executed with programming right. The same vulnerability can also be exploited in all other places where short text properties are displayed, e.g., in apps created using Apps Within Minutes that use a short text field. The problem has been patched on versions 13.10.9, 14.4.4, 14.7RC1.

CVSS v3.1 score: 10
GHSA-h67w-cq63-4c2j 
Cross-site scripting (XSS) vulnerability in tiki-view_forum_thread.php in TikiWiki 1.9.0 through 1.9.2 allows remote attackers to inject arbitrary web script or HTML via the topics_offset parameter.
CVE-2025-10041 Flex QR Code Generator <= 1.2.5 - Unauthenticated Arbitrary File Upload
The Flex QR Code Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in thesave_qr_code_to_db() function in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS v3.1 score: 9.8
GHSA-rrgm-366h-c73x 
The STARTTLS implementation in MailMarshal before 7.2 allows plaintext command injection.
CVSS v3.1 score: 9.8
CVE-2020-6398 
Use of uninitialized data in PDFium in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
CVSS v3.1 score: 8.8
CVSS v2.0 score: 6.8
CVE-2024-6895 Insecure Account Profile Management
Insufficient authentication in user account management in Yugabyte Platform allows local network attackers with a compromised user session to change critical security information without re-authentication. An attacker with user session and access to application can modify settings such as password and email without being prompted for the current password, enabling account takeover.
CVSS v4.0 score: 6.1
GHSA-8pg6-484v-xp8v 
Missing Authorization vulnerability in Detheme DethemeKit For Elementor allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects DethemeKit For Elementor: from n/a through 2.1.10.
CVSS v3.1 score: 4.3
CVE-2026-41419 4ga Boards: Import Path Traversal Leads to Arbitrary File Read
4ga Boards is a boards system for realtime project management. Prior to 3.3.5, a path traversal vulnerability allows an authenticated user with board import privileges to make the server ingest arbitrary host files as board attachments during BOARDS archive import. Once imported, the file can be downloaded through the normal application interface, resulting in unauthorized local file disclosure. This vulnerability is fixed in 3.3.5.
CVSS v3.1 score: 7.6
GHSA-6r5p-9p8v-rc3q 
Logic error in package installation via debugger command prior to SMR Oct-2023 Release 1 allows physical attacker to install an application that has different build type.
CVSS v3.1 score: 5.7
RHSA-2023:1102 Red Hat Security Advisory: rh-mysql80-mysql security update
mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) mysql: Server: Stored Procedure unspecified vulnerability (CPU Oct 2022) mysql: InnoDB unspecified vulnerability (CPU Oct 2022) mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) mysql: InnoDB unspecified vulnerability (CPU Oct 2022) mysql: Server: Connection Handling unspecified vulnerability (CPU Oct 2022) mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) mysql: Server: Security: Privileges unspecified vulnerability (CPU Oct 2022) mysql: Server: Replication unspecified vulnerability (CPU Oct 2022) mysql: InnoDB unspecified vulnerability (CPU Oct 2022) mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) mysql: Server: DML unspecified vulnerability (CPU Jan 2023) mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) mysql: InnoDB unspecified vulnerability (CPU Jan 2023) mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) mysql: InnoDB unspecified vulnerability (CPU Jan 2023) mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) mysql: Server: Thread Pooling unspecified vulnerability (CPU Jan 2023) mysql: Server: Security: Encryption unspecified vulnerability (CPU Jan 2023) mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) mysql: InnoDB unspecified vulnerability (CPU Jan 2023) mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) mysql: InnoDB unspecified vulnerability (CPU Jan 2023) mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) mysql: Server: GIS unspecified vulnerability (CPU Jan 2023) mysql: Server: Security: Privileges unspecified vulnerability (CPU Apr 2023) mysql: Server: Optimizer unspecified vulnerability (CPU Apr 2023) mysql: Server: Optimizer unspecified vulnerability (CPU Apr 2023) mysql: Server: Connection Handling unspecified vulnerability (CPU Apr 2023) mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2023) mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2023) mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2023)
CVSS v3.1 score: 4.9
GHSA-8j5c-vh5f-278q 
Cross-site scripting (XSS) vulnerability in the HTML help system on Cisco Wireless LAN Controller (WLC) devices before 8.0 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCun95178.
GHSA-mhfc-h92x-3f8m 
Wyse Management Suite 3.3.1 and below versions contain a deserialization vulnerability that could allow an unauthenticated attacker to execute code on the affected system.
GHSA-542j-7g79-83m4 
Multiple cross-site scripting (XSS) vulnerabilities in editflagtypes.cgi in Bugzilla 2.x, 3.x, and 4.0.x before 4.0.11; 4.1.x and 4.2.x before 4.2.7; and 4.3.x and 4.4.x before 4.4.1 allow remote attackers to inject arbitrary web script or HTML via the (1) id or (2) sortkey parameter.
GHSA-cxcw-75qj-r943 
In the Linux kernel, the following vulnerability has been resolved:jfs: add check read-only before txBeginAnon() callAdded a read-only check before calling `txBeginAnon` in `extAlloc`
and `extRecord`. This prevents modification attempts on a read-only
mounted filesystem, avoiding potential errors or crashes.Call trace:
 txBeginAnon+0xac/0x154
 extAlloc+0xe8/0xdec fs/jfs/jfs_extent.c:78
 jfs_get_block+0x340/0xb98 fs/jfs/inode.c:248
 __block_write_begin_int+0x580/0x166c fs/buffer.c:2128
 __block_write_begin fs/buffer.c:2177 [inline]
 block_write_begin+0x98/0x11c fs/buffer.c:2236
 jfs_write_begin+0x44/0x88 fs/jfs/inode.c:299
CVSS v3.1 score: 5.5
CVE-2023-53016 Bluetooth: Fix possible deadlock in rfcomm_sk_state_change
In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: Fix possible deadlock in rfcomm_sk_state_change

syzbot reports a possible deadlock in rfcomm_sk_state_change [1].
While rfcomm_sock_connect acquires the sk lock and waits for
the rfcomm lock, rfcomm_sock_release could have the rfcomm
lock and hit a deadlock for acquiring the sk lock.
Here's a simplified flow:

rfcomm_sock_connect:
  lock_sock(sk)
  rfcomm_dlc_open:
    rfcomm_lock()

rfcomm_sock_release:
  rfcomm_sock_shutdown:
    rfcomm_lock()
    __rfcomm_dlc_close:
        rfcomm_k_state_change:
	  lock_sock(sk)

This patch drops the sk lock before calling rfcomm_dlc_open to
avoid the possible deadlock and holds sk's reference count to
prevent use-after-free after rfcomm_dlc_open completes.
CVSS v3.1 score: 5.5
RHSA-2017:2800 Red Hat Security Advisory: kernel security update
kernel: load_elf_ binary() does not take account of the need to allocate sufficient space for the entire binary
CVSS v3.0 score: 7.8
CVE-2026-19176 
Use after free in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS v3.1 score: 7.5
GHSA-fgj4-2vhm-6cjx 
In btu_hcif_connection_comp_evt of btu_hcif.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-141619686
GHSA-mh52-5xcm-mhfr 
A stored cross-site scripting (XSS) vulnerability exists in the Shopware 6 installation interface at /recovery/install/database-configuration/. The c_database_schema field fails to properly sanitize user-supplied input before rendering it in the browser, allowing an attacker to inject malicious JavaScript. This vulnerability can be exploited via a Cross-Site Request Forgery (CSRF) attack due to the absence of CSRF protections on the POST request. An unauthenticated remote attacker can craft a malicious web page that, when visited by a victim, stores the payload persistently in the installation configuration. As a result, the payload executes whenever any user subsequently accesses the vulnerable installation page, leading to persistent client-side code execution.
CVSS v3.1 score: 6.1
GHSA-jppm-rmh2-mpxw 
Improper initialization in some Intel(R) NUC 13 Extreme Compute Element, Intel(R) NUC 13 Extreme Kit, Intel(R) NUC 11 Performance Kit, Intel(R) NUC 11 Performance Mini PC, Intel(R) NUC Compute Element, Intel(R) NUC Laptop Kit, Intel(R) NUC Pro Kit, Intel(R) NUC Pro Board and Intel(R) NUC Pro Mini PC BIOS firmware may allow a privileged user to potentially enable information disclosure via local access.
CVSS v3.1 score: 6
CVE-2020-24916 
CGI implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to OS command injection.
CVSS v3.1 score: 9.8
CVSS v2.0 score: 10
GHSA-g792-jhj8-228v 
In the Linux kernel, the following vulnerability has been resolved:netfilter: nf_tables: clone set on flush onlySyzbot with fault injection triggered a failing memory allocation with
GFP_KERNEL which results in a WARN splat:iter.err
WARNING: net/netfilter/nf_tables_api.c:845 at nft_map_deactivate+0x34e/0x3c0 net/netfilter/nf_tables_api.c:845, CPU#0: syz.0.17/5992
Modules linked in:
CPU: 0 UID: 0 PID: 5992 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
RIP: 0010:nft_map_deactivate+0x34e/0x3c0 net/netfilter/nf_tables_api.c:845
Code: 8b 05 86 5a 4e 09 48 3b 84 24 a0 00 00 00 75 62 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 63 6d fa f7 90 <0f> 0b 90 43
+80 7c 35 00 00 0f 85 23 fe ff ff e9 26 fe ff ff 89 d9
RSP: 0018:ffffc900045af780 EFLAGS: 00010293
RAX: ffffffff89ca45bd RBX: 00000000fffffff4 RCX: ffff888028111e40
RDX: 0000000000000000 RSI: 00000000fffffff4 RDI: 0000000000000000
RBP: ffffc900045af870 R08: 0000000000400dc0 R09: 00000000ffffffff
R10: dffffc0000000000 R11: fffffbfff1d141db R12: ffffc900045af7e0
R13: 1ffff920008b5f24 R14: dffffc0000000000 R15: ffffc900045af920
FS:  000055557a6a5500(0000) GS:ffff888125496000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fb5ea271fc0 CR3: 000000003269e000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 __nft_release_table+0xceb/0x11f0 net/netfilter/nf_tables_api.c:12115
 nft_rcv_nl_event+0xc25/0xdb0 net/netfilter/nf_tables_api.c:12187
 notifier_call_chain+0x19d/0x3a0 kernel/notifier.c:85
 blocking_notifier_call_chain+0x6a/0x90 kernel/notifier.c:380
 netlink_release+0x123b/0x1ad0 net/netlink/af_netlink.c:761
 __sock_release net/socket.c:662 [inline]
 sock_close+0xc3/0x240 net/socket.c:1455Restrict set clone to the flush set command in the preparation phase.
Add NFT_ITER_UPDATE_CLONE and use it for this purpose, update the rbtree
and pipapo backends to only clone the set when this iteration type is
used.As for the existing NFT_ITER_UPDATE type, update the pipapo backend to
use the existing set clone if available, otherwise use the existing set
representation. After this update, there is no need to clone a set that
is being deleted, this includes bound anonymous set.An alternative approach to NFT_ITER_UPDATE_CLONE is to add a .clone
interface and call it from the flush set path.
CVSS v3.1 score: 5.5
GHSA-pq9q-4fcv-7rvj 
Citrix ADC and Citrix/NetScaler Gateway before 13.0-82.41, 12.1-62.23, 11.1-65.20 and Citrix ADC 12.1-FIPS before 12.1-55.238 suffer from improper access control allowing SAML authentication hijack through a phishing attack to steal a valid user session. Note that Citrix ADC or Citrix Gateway must be configured as a SAML SP or a SAML IdP for this to be possible.
CVSS v3.1 score: 6.5
GHSA-gpvf-6hpf-4f9h 
The Electron desktop application of Rocket.Chat through 6.3.4 allows stored XSS via links in an uploaded file, related to failure to use a separate browser upon encountering third-party external actions from PDF documents.
CVSS v3.1 score: 5.4
GHSA-495r-5j65-5hp3 
A vulnerability of plugin openid-connect in Apache APISIX.This vulnerability will only have an impact if all of the following conditions are met:Use the openid-connect plugin with introspection modeThe auth service connected to openid-connect provides services to multiple issuersMultiple issuers share the same private key and relies only on the issuer being differentIf affected by this vulnerability, it would allow an attacker with a valid account on one of the issuers to log into the other issuer.This issue affects Apache APISIX: until 3.12.0.Users are recommended to upgrade to version 3.12.0 or higher.
CVSS v3.1 score: 5.3