CIRCL/vulnerability-scores huggingface dataset:
CVE-2026-37430 
An arbitrary file upload vulnerability in the ShopOrderImportController.java component of qihang-wms commit 75c15a allows attackers to execute arbitrary code via uploading a crafted file.
CVSS v3.1 score: 7.3
CVE-2023-42834 
A privacy issue was addressed with improved handling of files. This issue is fixed in watchOS 10.1, macOS Sonoma 14.1, macOS Monterey 12.7.2, macOS Ventura 13.6.3, iOS 17.1 and iPadOS 17.1. An app may be able to access sensitive user data.
CVSS v3.1 score: 6.2
GHSA-wq84-7pxg-4vqq 
The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_424CE0 function of the file /goform/setMacFilterCfg.
CVSS v3.1 score: 9.8
GHSA-8jx3-84v7-hf92 
NETGEAR D6220 devices before 1.0.0.76 are affected by command injection by an authenticated user.
CVE-2021-36916 WordPress Hide My WP premium plugin <= 6.2.3 - Unauthenticated SQL injection (SQLi) vulnerability
The SQL injection vulnerability in the Hide My WP WordPress plugin (versions <= 6.2.3) is possible because of how the IP address is retrieved and used inside a SQL query. The function "hmwp_get_user_ip" tries to retrieve the IP address from multiple headers, including IP address headers that the user can spoof, such as "X-Forwarded-For." As a result, the malicious payload supplied in one of these IP address headers will be directly inserted into the SQL query, making SQL injection possible.
CVSS v3.1 score: 8.6
CVE-2020-2935 
Vulnerability in the Oracle Financial Services Hedge Management and IFRS Valuations product of Oracle Financial Services Applications (component: User Interface). Supported versions that are affected are 8.0.6 - 8.0.8. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financial Services Hedge Management and IFRS Valuations. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Financial Services Hedge Management and IFRS Valuations accessible data as well as unauthorized read access to a subset of Oracle Financial Services Hedge Management and IFRS Valuations accessible data. CVSS 3.0 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).
CVSS v3.0 score: 7.1
CVE-2026-45915 fat: avoid parent link count underflow in rmdir
In the Linux kernel, the following vulnerability has been resolved:

fat: avoid parent link count underflow in rmdir

Corrupted FAT images can leave a directory inode with an incorrect
i_nlink (e.g. 2 even though subdirectories exist). rmdir then
unconditionally calls drop_nlink(dir) and can drive i_nlink to 0,
triggering the WARN_ON in drop_nlink().

Add a sanity check in vfat_rmdir() and msdos_rmdir(): only drop the
parent link count when it is at least 3, otherwise report a filesystem
error.
CVSS v3.1 score: 5.5
GHSA-mmr7-693v-25gc 
Tourism Management System Version: V 3.2 is affected by: Cross Site Request Forgery (CSRF).
CVSS v3.1 score: 4.3
CVE-2017-18662 
An issue was discovered on Samsung mobile devices with M(6.0) and N(7.x) software. Data outside of the rkp log buffer boundary is read, causing an information leak. The Samsung ID is SVE-2017-9109 (July 2017).
CVSS v3.1 score: 7.5
CVSS v2.0 score: 5
GHSA-5rj5-w87x-2r8m 
A vulnerability was found in Genexis Tilgin Fiber Home Gateway HG1522 CSx000-01_09_01_12. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /status/product_info/. The manipulation of the argument product_info leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269755. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v3.1 score: 4.3
CVE-2007-2884 
Multiple stack-based buffer overflows in Microsoft Visual Basic 6 allow user-assisted remote attackers to cause a denial of service (CPU consumption) or execute arbitrary code via a Visual Basic Project (vbp) file with a long (1) Description or (2) Company Name (VersionCompanyName) field.
CVSS v2.0 score: 9.3
GHSA-g2cm-47cx-7j94 
Unknown vulnerability in Cisco Firewall Services Module (FWSM) 2.3.1 and earlier, when using URL, FTP, or HTTPS filtering exceptions, allows certain TCP packets to bypass access control lists (ACLs).
GHSA-m6v8-99gm-ww24 
Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS v3.1 score: 5.4
CVE-2023-34598 
Gibbon v25.0.0 is vulnerable to a Local File Inclusion (LFI) where it's possible to include the content of several files present in the installation folder in the server's response.
CVSS v3.1 score: 9.8
CVE-2023-23692 

Dell EMC prior to version DDOS 7.9 contain(s) an OS command injection Vulnerability. An authenticated non admin attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS, with the privileges of the vulnerable application.


CVSS v3.1 score: 8.8
GHSA-g5wm-487r-4228 
AIX passwd allows local users to gain root access.
CVE-2025-13748 Fluent Forms <= 6.1.7 - Unauthenticated Insecure Direct Object Reference to Payment Status Tampering via submission_id
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.1.7 via the 'submission_id' parameter due to missing validation on a user controlled key within the confirmScaPayment() function. This makes it possible for unauthenticated attackers to mark arbitrary submissions as failed via crafted requests to the endpoint granted they can guess or enumerate a valid submission identifier.
CVSS v3.1 score: 5.3
GHSA-x8cf-gv64-wx64 
Unspecified vulnerability in the Authentication Manager (aka utauthd) in Sun Ray Server Software 4.0 and 4.1 allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors.
CVE-2026-54842 WordPress Royal MCP plugin <= 1.4.25 - Broken Access Control vulnerability
Missing Authorization vulnerability in Royal Plugins Royal MCP allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects Royal MCP: from n/a through 1.4.25.
CVSS v3.1 score: 8.1
GHSA-wxjm-rv6g-5w39 
The SG Helper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in version 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS v3.1 score: 5.5
CVE-2019-2934 
Vulnerability in the Oracle Hospitality Reporting and Analytics component of Oracle Food and Beverage Applications. The supported version that is affected is 9.1.0. Easily exploitable vulnerability allows low privileged attacker having Admin - Configuration privilege with network access via HTTP to compromise Oracle Hospitality Reporting and Analytics. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hospitality Reporting and Analytics accessible data as well as unauthorized access to critical data or complete access to all Oracle Hospitality Reporting and Analytics accessible data. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
CVSS v3.1 score: 8.1
CVSS v2.0 score: 5.5
GHSA-4pc6-w92r-32xw 
Idira Privilege Cloud Connector versions prior 1.1.100504 under specific conditions and configuration scenarios, TLS certificate validation may not be fully enforced. CyberArk Security Bulletin: CA26-17
CVSS v4.0 score: 7.5
CVSS v3.1 score: 8.8
RHSA-2025:22899 Red Hat Security Advisory: golang security update
os/exec: Unexpected paths returned from LookPath in os/exec golang: archive/tar: Unbounded allocation when parsing GNU sparse map
CVSS v3.1 score: 7.5
GHSA-7268-qqjc-4287 
Cross-Site Request Forgery (CSRF) vulnerability in Kainex Wise Chat.This issue affects Wise Chat: from n/a through 3.1.3.
CVSS v3.1 score: 5.4
GHSA-8qv9-6423-m39w 
Incorrect access control in the "Let's Encrypt" certificate download endpoint of Nginx Proxy Manager v2.14.0 allows authenticated attackers to obtain the TLS private key material via a crafted GET request.
CVSS v3.1 score: 6.5
CVE-2025-58351 Outline's Local File Storage Feature can Cause CSP Bypass
Outline is a service that allows for collaborative documentation. In versions 0.72.0 through 0.83.0, Outline introduced a feature which facilitates local file system storage capabilities as an optional file storage strategy. This feature allowed a CSP bypass as well as a ContentType bypass that might facilitate further attacks. In the case of self-hosting and using Outline FILE_STORAGE=local on the same domain as the Outline application, a malicious payload can be uploaded as a file attachment and bypass those CSP restrictions, allowing script execution within the context of another user. This is fixed in version 0.84.0.
CVSS v3.1 score: 6.8
GHSA-9jcf-26mj-wqj2 
Cross-site scripting (XSS) vulnerability in ProfileView.aspx in mojoPortal 2.3.4.3 and 2.3.5.1 allows remote attackers to inject arbitrary web script or HTML via the User ID parameter.  NOTE: some of these details are obtained from third party information.
GHSA-4xwr-57p2-ghxq 
NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability in the Python backend, where an attacker could cause an out-of-bounds read by sending a request. A successful exploit of this vulnerability might lead to information disclosure.
CVSS v3.1 score: 5.9
GHSA-q6mr-262c-p36r 
BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier allow remote attackers to obtain sensitive information (intranet IP addresses) via unknown attack vectors involving "network address translation."
GHSA-rpjm-v5w4-ccc9 
Proxy command injection vulnerabilities in Trend Micro Mobile Security (Enterprise) versions before 9.7 Patch 3 allow remote attackers to execute arbitrary code on vulnerable installations.
CVSS v3.0 score: 8.8
GHSA-vjmh-x5rx-92fx 
Reflected Cross site scripting (xss) in machsol machpanel 8.0.32 allows attackers to execute arbitrary web scripts or HTML via a crafted PDF file.
CVSS v3.1 score: 6.1
CVE-2001-0845 
Vulnerability in DECwindows Motif Server on OpenVMS VAX or Alpha 6.2 through 7.3, and SEVMS VAX or Alpha 6.2, allows local users to gain access to unauthorized resources.
CVSS v2.0 score: 4.6
CVE-2022-42400 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18328.
CVSS v3.0 score: 7.8
CVE-2025-53208 WordPress Maya Business <= 1.2.0 - Insecure Direct Object References (IDOR) Vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in paymayapg Maya Business paymaya-checkout-for-woocommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Maya Business: from n/a through <= 1.2.0.
CVSS v3.1 score: 7.5
GHSA-9wmp-6fqg-fp67 
Under certain conditions, SAP Business One, 9.2, 9.3, for SAP HANA backup service allows an attacker to access information which would otherwise be restricted.
CVSS v3.0 score: 5.5
RHSA-2024:10483 Red Hat Security Advisory: webkit2gtk3 security update
webkitgtk: data isolation bypass vulnerability
CVSS v3.1 score: 6.1
CVE-2026-3464 WP Customer Area <= 8.3.4 - Authenticated (Subscriber+) Arbitrary File Read/Deletion via ajax_attach_file
The WP Customer Area plugin for WordPress is vulnerable to arbitrary file read and deletion due to insufficient file path validation in the 'ajax_attach_file' function in all versions up to, and including, 8.3.4. This makes it possible for authenticated attackers with a role that an administrator grants access to (e.g., Subscriber) to to read the contents of arbitrary files on the server, which can contain sensitive information, or delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
CVSS v3.1 score: 8.8
CVE-2016-4153 
Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.
CVSS v3.1 score: 8.8
CVSS v2.0 score: 9.3
CVE-2026-68278 drm/dp/mst: fix buffer overflows in sideband chunk accumulation
In the Linux kernel, the following vulnerability has been resolved:

drm/dp/mst: fix buffer overflows in sideband chunk accumulation

drm_dp_sideband_append_payload() has three related bugs when processing
device-provided sideband reply data:

1. Zero-length curchunk_len underflow: msg_len is a 6-bit field taken
   directly from the DP sideband header. If a device sends msg_len=0,
   curchunk_len is set to zero. The condition (curchunk_idx >= curchunk_len)
   is immediately true, and curchunk_len-1 wraps to 255 (u8 underflow).
   drm_dp_msg_data_crc4() reads 255 bytes from chunk[48], then memcpy()
   writes 255 bytes into msg[], both far out of bounds.

2. chunk[48] overflow: curchunk_len can reach 63 (6-bit field). chunk[] is
   only 48 bytes. Multi-iteration payload assembly appends 16-byte blocks
   until curchunk_idx reaches curchunk_len, writing up to 15 bytes past
   the end of chunk[] into msg[].

3. msg[256] overflow: each chunk contributes (curchunk_len-1) bytes to
   msg[]. No check ensures curlen + (curchunk_len-1) stays within msg[256],
   so the memcpy can spill into adjacent struct fields.

All three are reachable from any DP MST device that can forge sideband
reply messages on a physical connection.
CVE-2026-21537 Microsoft Defender for Endpoint Linux Extension Remote Code Execution Vulnerability
Improper control of generation of code ('code injection') in Microsoft Defender for Linux allows an unauthorized attacker to execute code over an adjacent network.
CVSS v3.1 score: 8.8
RHSA-2025:7624 Red Hat Security Advisory: Satellite 6 Client Bug Fix Update
golang-fips: Golang FIPS zeroed buffer golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect
CVSS v3.1 score: 5.9
GHSA-gc7r-mm9q-vgrj 
Integer overflow in the php_stream_zip_opener function in ext/zip/zip_stream.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a crafted zip:// URL.
CVSS v3.0 score: 8.8
GHSA-fj83-7fq4-4858 
An elevation of privilege vulnerability exists when Windows Defender antimalware platform improperly handles hard links, aka 'Windows Defender Antimalware Platform Hard Link Elevation of Privilege Vulnerability'.
CVE-2024-32476 Denial of Service via malicious jqPathExpressions in ignoreDifferences
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. There is a Denial of Service (DoS) vulnerability via OOM using jq in ignoreDifferences. This vulnerability has been patched in version(s) 2.10.7, 2.9.12 and 2.8.16.
CVSS v3.1 score: 6.5
GHSA-86r2-66fg-x55c 
Improper Knox ID validation logic in notification framework prior to SMR Jun-2023 Release 1 allows local attackers to read work profile notifications without proper access permission.
CVSS v3.1 score: 2.4
CVE-2025-58405 Lack of protection mechanisms against Clickjacking attacks
The CGM CLININET application does not implement any mechanisms that prevent clickjacking attacks, neither HTTP security headers nor HTML-based frame‑busting protections were detected. As a result, an attacker can embed the application inside a maliciously crafted IFRAME and trick users into performing unintended actions, including potentially bypassing CSRF/XSRF defenses.
CVSS v4.0 score: 5.3
GHSA-x5hg-hv2j-7wv6 
Cross-site scripting (XSS) vulnerability in Joomla! 1.5.x through 1.5.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to database output and the frontend administrative panel.
RHSA-2012:1277 Red Hat Security Advisory: Red Hat Enterprise MRG Messaging 2.2 update
qpid-cpp: not closing incomplete connections exhausts file descriptors, leading to DoS qpid-cpp-server-cluster: unauthorized broker access caused by the use of NullAuthenticator catch-up shadow connections
PYSEC-2026-596 
Crawl4AI before 0.8.7 contains a server-side request forgery vulnerability in the /crawl, /crawl/stream, /md, and /llm endpoints that fetch arbitrary user-supplied URLs without validation. Unauthenticated attackers can bypass the internal-address blocklist using IPv6-mapped IPv4 addresses to reach internal services and cloud metadata endpoints.
CVSS v3.1 score: 8.6
GHSA-r58p-qjp8-xqvv 
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris. CVSS 3.1 Base Score 5.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
CVSS v3.1 score: 5.5
GHSA-rcq7-gcq5-jx2v 
Cross-site scripting (XSS) vulnerability in MediaWiki before 1.18.5 and 1.19.x before 1.19.2 allows remote attackers to inject arbitrary web script or HTML via a File: link to a nonexistent image.
CVSS v3.0 score: 6.1
RHSA-2026:3753 Red Hat Security Advisory: osbuild-composer security update
golang: net/url: Memory exhaustion in query parameter parsing in net/url golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption
CVSS v3.1 score: 7.4
RHSA-2018:0522 Red Hat Security Advisory: .NET Core on Red Hat Enterprise Linux security update
Core: Hash Collision Denial of Service
CVSS v3.0 score: 3.7
CVE-2006-5328 
OpenBase SQL 10.0 and earlier, as used in Apple Xcode 2.2 2.2 and earlier and possibly other products, allows local users to create arbitrary files via a symlink attack on the simulation.sql file.
CVSS v2.0 score: 7.2
GHSA-vx36-4cp6-8qcp 
A vulnerability has been identified in SiPass integrated AC5102 (ACC-G2) (All versions < V6.4.9), SiPass integrated ACC-AP (All versions < V6.4.9). Affected devices improperly sanitize user input for specific commands on the telnet command line interface. This could allow an authenticated local administrator to escalate privileges by injecting arbitrary commands that are executed with root privileges.
CVSS v4.0 score: 9.3
CVSS v3.1 score: 8.2
CVE-2018-0119 
A vulnerability in certain authentication controls in the account services of Cisco Spark could allow an authenticated, remote attacker to interact with and view information on an affected device that would normally be prohibited. The vulnerability is due to the improper display of user-account tokens generated in the system. An attacker could exploit this vulnerability by logging in to the device with a token in use by another account. Successful exploitation could allow the attacker to cause a partial impact to the device's confidentiality, integrity, and availability. Cisco Bug IDs: CSCvg05206.
CVSS v3.0 score: 4.7
CVSS v2.0 score: 6.5
GHSA-79jr-8fhm-8wv3 OpenNMS Horizon and Meridian vulnerable to Cross-site Scripting
Unauthenticated, stored cross-site scripting in the display of alarm reduction keys in multiple versions of OpenNMS Horizon and Meridian could allow an attacker access to confidential session information.
CVSS v3.1 score: 6.1
CVE-2026-26741 
PX4 Autopilot versions 1.12.x through 1.15.x contain a logic flaw in the mode switching mechanism. When switching from Auto mode to Manual mode while the drone is in the "ARMED" state (after landing and before the automatic disarm triggered by the COM_DISARM_LAND parameter), the system lacks a throttle threshold safety check for the physical throttle stick. This flaw can directly cause the drone to lose control, experience rapid uncontrolled ascent (flyaway), and result in property damage
CVSS v3.1 score: 8.1
GHSA-fx4p-9qq6-m434 
Unauthenticated Local File Inclusion in AutoParts <= 1.5.8 versions.
CVSS v3.1 score: 8.1
GHSA-9j63-jqr8-fh2v 
In ConnMan through 1.44, parse_rr in dnsproxy.c has a memcpy length that depends on an RR RDLENGTH value, i.e., *rdlen=ntohs(rr->rdlen) and memcpy(response+offset,*end,*rdlen).
CVSS v3.1 score: 3.7
CVE-2026-46292 pmdomain: core: Fix detach procedure for virtual devices in genpd
In the Linux kernel, the following vulnerability has been resolved:

pmdomain: core: Fix detach procedure for virtual devices in genpd

If a device is attached to a PM domain through genpd_dev_pm_attach_by_id(),
genpd calls pm_runtime_enable() for the corresponding virtual device that
it registers. While this avoids boilerplate code in drivers, there is no
corresponding call to pm_runtime_disable() in genpd_dev_pm_detach().

This means these virtual devices are typically detached from its genpd,
while runtime PM remains enabled for them, which is not how things are
designed to work. In worst cases it may lead to critical errors, like a
NULL pointer dereference bug in genpd_runtime_suspend(), which was recently
reported. For another case, we may end up keeping an unnecessary vote for a
performance state for the device.

To fix these problems, let's add this missing call to pm_runtime_disable()
in genpd_dev_pm_detach().
CVSS v3.1 score: 5.5
GHSA-3gv9-wvwh-jv5c 
The Georgia Packing (aka com.tapatalk.georgiapackingorg) application 3.9.16 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2022-40373 
Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 allows remote attackers to run arbitrary code via upload of crafted XML file.
CVSS v3.1 score: 5.4
CVE-2026-60496 
Vulnerability in the JD Edwards EnterpriseOne Advanced Pricing - Procurement product of Oracle JD Edwards (component: Advanced Pricing).   The supported version that is affected is 9.2. Difficult to exploit vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Advanced Pricing - Procurement.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Advanced Pricing - Procurement. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS v3.1 score: 7.5
GHSA-32qq-4q5r-h4xr 
Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep access to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which can be triggered by the backend. CVE-2022-23042
CVSS v3.1 score: 7
CVE-2019-8379 
An issue was discovered in AdvanceCOMP through 2.1. A NULL pointer dereference exists in the function be_uint32_read() located in endianrw.h. It can be triggered by sending a crafted file to a binary. It allows an attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact when a victim opens a specially crafted file.
CVSS v3.1 score: 7.8
CVSS v2.0 score: 6.8
CVE-2021-46026 
mysiteforme, as of 19-12-2022, is vulnerable to Cross Site Scripting (XSS) via the add blog tag function in the blog tag in the background blog management.
CVSS v3.1 score: 5.4
CVSS v2.0 score: 3.5
GHSA-54gq-92ww-6vfg 
Aztek Forum 4.00 allows remote attackers to obtain sensitive information via a direct request to forum.php with the fid=XD query string, which reveals the path in an error message.
GHSA-8fhg-54m9-q37r 
MediaWiki before 1.15.3, and 1.6.x before 1.16.0beta2, does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to conduct phishing attacks by arranging for a victim to login to the attacker's account and then execute a crafted user script, related to a "login CSRF" issue.
CVE-2024-35247 fpga: region: add owner module and take its refcount
In the Linux kernel, the following vulnerability has been resolved:

fpga: region: add owner module and take its refcount

The current implementation of the fpga region assumes that the low-level
module registers a driver for the parent device and uses its owner pointer
to take the module's refcount. This approach is problematic since it can
lead to a null pointer dereference while attempting to get the region
during programming if the parent device does not have a driver.

To address this problem, add a module owner pointer to the fpga_region
struct and use it to take the module's refcount. Modify the functions for
registering a region to take an additional owner module parameter and
rename them to avoid conflicts. Use the old function names for helper
macros that automatically set the module that registers the region as the
owner. This ensures compatibility with existing low-level control modules
and reduces the chances of registering a region without setting the owner.

Also, update the documentation to keep it consistent with the new interface
for registering an fpga region.
CVSS v3.1 score: 5.5
CVE-2025-26629 Microsoft Office Remote Code Execution Vulnerability
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
CVSS v3.1 score: 7.8
CVE-2019-11709 
Mozilla developers and community members reported memory safety bugs present in Firefox 67 and Firefox ESR 60.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
CVSS v3.1 score: 9.8
CVSS v2.0 score: 7.5
GHSA-v623-g8m2-v48j 
Missing Authorization vulnerability in Approveme Signature Add-On for Gravity Forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Signature Add-On for Gravity Forms: from n/a through 1.8.6.
CVSS v3.1 score: 4.3
GHSA-m42j-v8jp-9cwc 
The Microsoft Windows Media Player 9.0 ActiveX control may allow remote attackers to execute arbitrary web script in the Local computer zone via the (1) artist or (2) song fields of a music file, if the file is processed using Internet Explorer.
GHSA-8w3q-f2m4-q9q2 
An issue in the sqlg_place_dpipes component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS v3.1 score: 7.5
GHSA-7vjx-48fp-ph3w 
SQL injection vulnerability in Alameda (com_alameda) component before 1.0.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the storeid parameter to index.php.
CVE-2005-0817 
Unknown vulnerability in the DNSd proxy, as used in Symantec Gateway Security 5400 2.x and 5300 1.x, Enterprise Firewall 7.0.x and 8.x, and VelociRaptor 1100/1200/1300 1.5, allows remote attackers to poison the DNS cache and redirect users to malicious sites.
CVSS v2.0 score: 5
GHSA-mx2j-7cmv-353c wasmvm: Malicious smart contract can slow down block production
CWA-2025-002**Severity**Medium (Moderate + Likely)[^1]**Affected versions:**wasmvm >= 2.2.0, < 2.2.2wasmvm >= 2.1.0, < 2.1.5wasmvm >= 2.0.0, < 2.0.6wasmvm < 1.5.8**Patched versions:**wasmvm 1.5.8, 2.0.6, 2.1.5, 2.2.2Description of the bugThe vulnerability can be used to slow down block production. The attack requires a malicious contract,
so permissioned chains are unlikely to be affected.(We'll add more detail once chains had a chance to upgrade.)Patch1.5: https://github.com/CosmWasm/cosmwasm/commit/2b7f2faa57a1efc8207455c37f87f1eee6035a272.0: https://github.com/CosmWasm/cosmwasm/commit/d6143b0aff16a39bbea4be37597d8e9d9b213d3b2.1: https://github.com/CosmWasm/cosmwasm/commit/f0c04c03cbe2557634c1bbcdc2ce203fe7caca582.2: https://github.com/CosmWasm/cosmwasm/commit/a5d62f65b5eb947ebe40e2085b1c48a9d0a244d0Applying the patchThe patch will be shipped in releases of wasmvm. You can update more or less as follows:Check the current wasmvm version: `go list -m github.com/CosmWasm/wasmvm`Bump the `github.com/CosmWasm/wasmvm` dependency in your go.mod to one of the patched version
depending on which minor version you are on; `go mod tidy`; commit.If you use the static libraries `libwasmvm_muslc.aarch64.a`/`libwasmvm_muslc.x86_64.a`, update them accordingly.Check the updated wasmvm version: `go list -m github.com/CosmWasm/wasmvm` and ensure you see 1.5.8, 2.0.6, 2.1.5 or 2.2.2.Follow your regular practices to deploy chain upgrades.The patch is consensus breaking and requires a coordinated upgrade.AcknowledgementThis issue was found by meadow101 who reported it to the Cosmos Bug Bounty Program on HackerOne.If you believe you have found a bug in the Interchain Stack or would like to contribute to the
program by reporting a bug, please see <https://hackerone.com/cosmos>.Timeline2024-11-24: Confio receives a report through the Cosmos bug bounty program maintained by Amulet.2024-12-20: Confio security contributors confirm the report.2024-01-27: Confio developed the patch internally.2025-02-04: Patch gets released.[^1]: following Amulet's Severity Classification Framework ACMv1.2: https://github.com/interchainio/security/blob/0295254e8645301ccb606d46108a45cede0a73e0/resources/CLASSIFICATION_MATRIX.md
CVE-2024-27220 
In lpm_req_handler of , there is a possible out of bounds memory access due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1 score: 8.4
RHSA-2023:6621 Red Hat Security Advisory: protobuf-c security update
protobuf-c: unsigned integer overflow in parse_required_member
CVSS v3.1 score: 6.2
CVE-2023-4332 Broadcom RAID Controller web interface is vulnerable due to Improper permissions on the log file
Broadcom RAID Controller web interface is vulnerable due to Improper permissions on the log file
CVSS v3.1 score: 7.5
GHSA-23cf-8696-vmqx 
In BEESCMS 4.0, CSRF allows administrators to be added arbitrarily, a related issue to CVE-2018-10266.
CVSS v3.0 score: 8.8
GHSA-v3gg-5crq-w4vj 
Mutt before 1.14.3 proceeds with a connection even if, in response to a GnuTLS certificate prompt, the user rejects an expired intermediate certificate.
CVSS v3.1 score: 4.8
GHSA-c5mm-qw5v-hxgq 
Compiler removal of buffer clearing insli_se_driver_key_agreementin Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM.
CVSS v3.1 score: 5.3
GHSA-wfxh-w5c9-96vw 
Xircom REX 6000 allows local users to obtain the 10 digit PIN by starting a serial monitor, connecting to the personal digital assistant (PDA) via Rextools, and capturing the cleartext PIN.
GHSA-6r3v-jvh3-993p 
An issue in the qi_inst_state_free component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS v3.1 score: 7.5
GHSA-q85p-3xvp-jpw4 
eMedia Consulting simpleRedak up to v2.47.23.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /view/cb/format_642.php.
CVSS v3.1 score: 6.1
GHSA-xf28-vxch-f976 
In ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08240132; Issue ID: ALPS08240132.
CVSS v3.1 score: 6.7
CVE-2025-50594 
An issue was discovered in /Code/Websites/DanpheEMR/Controllers/Settings/SecuritySettingsController.cs in Danphe Health Hospital Management System EMR 3.2 allowing attackers to reset any account password.
CVSS v3.1 score: 9.8
GHSA-7gvw-7r69-cgx7 
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.
CVSS v4.0 score: 5.5
CVSS v3.1 score: 7.5
GHSA-vx5q-9x62-9qqg 
In the Linux kernel, the following vulnerability has been resolved:iommufd: Break the loop on failure in iommufd_fault_fops_read()On a copy_to_user() failure inside the inner list_for_each_entry, only the
inner loop breaks; the outer while re-fetches the just-restored fault group
and retries the failing copy_to_user() forever, spinning the reader at 100%
CPU with fault->mutex held.Check rc after the inner loop and break the outer while as well.
CVSS v3.1 score: 5.5
GHSA-qg5r-qr4p-h2x5 
There exists a heap-based buffer overflow in vc1_decode_p_mb_intfi in vc1_block.c in Libav 12.3, which allows attackers to cause a denial-of-service via a crafted aac file.
CVSS v3.0 score: 6.5
CVE-2025-43476 
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may be able to break out of its sandbox.
CVSS v3.1 score: 7.8
GHSA-q4v9-prc2-r77h 
CoreStorage in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context via a crafted app.
CVSS v3.0 score: 7.8
GHSA-8j4h-85hh-844w 
Missing Authorization vulnerability in The SEO Guys at SEOPress SEOPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SEOPress: from n/a through 8.1.1.
CVSS v3.1 score: 5.3
CVE-2019-12923 
In MailEnable Enterprise Premium 10.23, the potential cross-site request forgery (CSRF) protection mechanism was not implemented correctly and it was possible to bypass it by removing the anti-CSRF token parameter from the request. This could allow an attacker to manipulate a user into unwittingly performing actions within the application (such as sending email, adding contacts, or changing settings) on behalf of the attacker.
CVSS v3.0 score: 6.5
CVSS v2.0 score: 4.3
CVE-2012-2194 
Directory traversal vulnerability in the SQLJ.DB2_INSTALL_JAR stored procedure in IBM DB2 9.1 before FP12, 9.5 through FP9, 9.7 through FP6, 9.8 through FP5, and 10.1 allows remote attackers to replace JAR files via unspecified vectors.
CVSS v2.0 score: 5
CVE-2017-6281 
NVIDIA libnvomx contains a possible out of bounds write due to a improper input validation which could lead to local escalation of privilege. This issue is rated as high. Product: Android. Version: N/A. Android: A-66969318. Reference: N-CVE-2017-6281.
CVSS v3.0 score: 7.8
CVSS v2.0 score: 7.2
GHSA-3c28-w5w6-mh56 
In the Linux kernel, the following vulnerability has been resolved:ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflowCommit 299f962c0b02 ("ksmbd: use check_add_overflow() to prevent u16
DACL size overflow") added check_add_overflow() guards that break out
of the ACE-building loops in set_posix_acl_entries_dacl() when the
accumulated DACL size would wrap past 65535.However, each iteration allocates a struct smb_sid via kmalloc_obj()
at the top of the loop and relies on the kfree(sid) call at the end
of the loop body (the 'pass_same_sid' label in the first loop, and
the explicit kfree at the tail of the second loop) to release it.
The newly introduced 'break' statements bypass those kfree() calls,
leaking the sid buffer every time an overflow is detected.A malicious or malformed file with enough POSIX ACL entries to trip
the overflow check will leak one or more struct smb_sid allocations
on every request that touches the file's DACL, providing a trivial
kernel memory exhaustion vector.Free sid before breaking out of the loops to plug the leak.
RHSA-2020:4820 Red Hat Security Advisory: file-roller security update
file-roller: path traversal vulnerability via a specially crafted filename contained in malicious archive file-roller: directory traversal via directory symlink pointing outside of the target directory
CVSS v3.1 score: 3.9
CVSS v3.0 score: 4.3
CVE-2020-14339 
A flaw was found in libvirt, where it leaked a file descriptor for `/dev/mapper/control` into the QEMU process. This file descriptor allows for privileged operations to happen against the device-mapper on the host. This flaw allows a malicious guest user or process to perform operations outside of their standard permissions, potentially causing serious damage to the host operating system. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
CVSS v3.1 score: 8.8
CVSS v2.0 score: 7.2
CVE-2006-7191 
Untrusted search path vulnerability in lamdaemon.pl in LDAP Account Manager (LAM) before 1.0.0 allows local users to gain privileges via a modified PATH that points to a malicious rm program.
CVSS v2.0 score: 7.2
GHSA-jj2v-2j63-rcwf 
In the Linux kernel, the following vulnerability has been resolved:netfilter: nf_tables: set dormant flag on hook register failureWe need to set the dormant flag again if we fail to register
the hooks.During memory pressure hook registration can fail and we end up
with a table marked as active but no registered hooks.On table/base chain deletion, nf_tables will attempt to unregister
the hook again which yields a warn splat from the nftables core.
CVSS v3.1 score: 5.5
GHSA-fffj-9qwg-qmh5 Improper Input Validation in OpenCV
OpenCV 3.0.0 allows remote attackers to cause a denial of service (segfault) via vectors involving corrupt chunks. This issue was fixed in OpenCV version 3.3.1 (corresponding to OpenCV 3.3.1.11).
CVSS v3.0 score: 5.5
CVE-2007-2497 
RealNetworks RealPlayer 10 Gold allows remote attackers to cause a denial of service (memory consumption) via a certain .ra file.  NOTE: this issue was referred to as a "memory leak," but it is not clear if this is correct.
CVSS v2.0 score: 7.8
GHSA-2qf4-qh24-m72c 
In the Linux kernel, the following vulnerability has been resolved:drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewportIf a plane reaches calculate_mcache_setting with a zero-area viewport,
calculate_mcache_setting exits early with num_mcaches == 0 and
mvmpg_width/height == 0. This will cause a divide-by-zero panic and can
also cause an underflow on num_mcaches.Fix this by changing calculate_mcache_setting to bool and adding guards
after each calculate_mcache_row_bytes call. If num_mcaches or
mvmpg_width/height is zero, return a false. Callers will propagate the
failure as a rejected mode, which prevents the panic.(cherry picked from commit 29c0f7c655f47bcbd575ff75e58480df6ec3c9da)
CVSS v3.1 score: 7.8
CVE-2024-22290 WordPress Custom Dashboard Widgets Plugin <= 1.3.1 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in AboZain,O7abeeb,UnitOne Custom Dashboard Widgets allows Cross-Site Scripting (XSS).This issue affects Custom Dashboard Widgets: from n/a through 1.3.1.
CVSS v3.1 score: 7.1
CVE-2007-0248 
The aclMatchExternal function in Squid before 2.6.STABLE7 allows remote attackers to cause a denial of service (crash) by causing an external_acl queue overload, which triggers an infinite loop.
CVSS v2.0 score: 5
GHSA-c9hm-78qq-78cf 
An authenticated attacker could create an audit file that bypasses PowerShell cmdlet checks and executes commands with administrator privileges.
CVSS v3.1 score: 8.8
CVE-2016-9606 
JBoss RESTEasy before version 3.1.2 could be forced into parsing a request with YamlProvider, resulting in unmarshalling of potentially untrusted data which could allow an attacker to execute arbitrary code with RESTEasy application permissions.
CVSS v3.0 score: 8.1
CVSS v2.0 score: 6.8
RHSA-2023:3662 Red Hat Security Advisory: c-ares security update
c-ares: 0-byte UDP payload Denial of Service
CVSS v3.1 score: 7.5
GHSA-j7jv-w7wp-p2c3 
A security vulnerability has been identified in HPE Data Management Framework (DMF) Suite (CXFS). Depending on configuration, this vulnerability may lead to local/cluster unauthorized access.
CVSS v3.1 score: 5.5
RHSA-2009:1560 Red Hat Security Advisory: java-1.6.0-sun security update
deprecate MD2 in SSL cert validation (Kaminsky) OpenJDK ICC_Profile file existence detection information leak (6631533) JRE TrueType font parsing crash (6815780) java-1.6.0-sun: ACE in JRE Deployment Toolkit (6869752) java-1.6.0-sun: Privilege escalation in the Java Web Start Installer  (6872824) java-1.6.0-sun: Stack-based buffer overflow via a long file: URL argument (6854303) java-1.6.0-sun: Privilege escalation via crafted image file due improper color profiles parsing (6862970) OpenJDK JRE AWT setDifflCM stack overflow (6872357) OpenJDK JRE AWT setBytePixels heap overflow (6872358) JRE JPEG JFIF Decoder issue (6862969) OpenJDK JPEG Image Writer quantization problem (6862968) OpenJDK ImageI/O JPEG heap overflow  (6874643) OpenJDK MessageDigest.isEqual introduces timing attack vulnerabilities  (6863503) OpenJDK ASN.1/DER input stream parser denial of service (6864911) CVE-2009-3877 OpenJDK ASN.1/DER input stream parser denial of service (6864911) CVE-2009-3877 OpenJDK GraphicsConfiguration information leak(6822057) OpenJDK UI logging information leakage(6664512) OpenJDK resurrected classloaders can still have children (6636650) OpenJDK information leaks in mutable variables (6657026,6657138) OpenJDK information leaks in mutable variables (6657026,6657138) OpenJDK zoneinfo file existence information leak (6824265) REGRESSION: have problem to run JNLP app and applets with signed Jar files (6870531)
CVE-2024-11180 ElementsKit Elementor addons <= 3.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown Timer Widget ekit_countdown_timer_title parameter in all versions up to, and including, 3.4.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1 score: 6.4
GHSA-6p9v-hq35-2xcf 
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the pptphellointerval variable in the pptp_client.lua file.
CVSS v3.0 score: 7.2
CVE-2019-9224 
An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Control (issue 4 of 5).
CVSS v3.0 score: 5.3
CVSS v2.0 score: 5
CVE-2025-25783 
An arbitrary file upload vulnerability in the component admin\plugin.php of Emlog Pro v2.5.3 allows attackers to execute arbitrary code via uploading a crafted Zip file.
CVSS v3.1 score: 9.8
CVE-2022-50896 Testa 3.5.1 Online Test Management System - Reflected Cross-Site Scripting (XSS)
Testa 3.5.1 contains a reflected cross-site scripting vulnerability in the login.php redirect parameter that allows attackers to inject malicious scripts. Attackers can craft a specially encoded payload in the redirect parameter to execute arbitrary JavaScript in victim's browser context.
CVSS v4.0 score: 5.1
CVSS v3.1 score: 6.1
GHSA-g527-324c-34j6 
The LDAP component in CommuniGate Pro Core Server 5.0.7 allows remote attackers to cause a denial of service (application crash) via LDAP messages that contain Distinguished Names (DN) fields with a large number of elements.
CVE-2021-30227 
Cross Site Scripting (XSS) vulnerability in the article comments feature in emlog 6.0.
CVSS v3.1 score: 6.1
CVSS v2.0 score: 4.3
CVE-2024-5940 GiveWP – Donation Plugin and Fundraising Platform <= 3.13.0 - Missing Authorization to Unauthenticated Event Settings Update
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'handle_request' function in all versions up to, and including, 3.13.0. This makes it possible for unauthenticated attackers to edit event ticket settings if the Events beta feature is enabled.
CVSS v3.1 score: 6.5
GHSA-hcmc-r7j6-4q4h 
Infinite loop while decoding compressed data can lead to overrun condition in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, MDM9150, MDM9205, MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9650, MDM9655, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8939, MSM8940, MSM8953, MSM8976, MSM8996AU, MSM8998, Nicobar, QCM2150, QCS605, QM215, SC8180X, SDA660, SDA845, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, Snapdragon_High_Med_2016, SXR1130, SXR2130
CVE-2015-4665 
Cross-site scripting (XSS) vulnerability in ajax_cmd.php in Xceedium Xsuite 2.4.4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the fileName parameter.
CVSS v2.0 score: 4.3
GHSA-xxp5-7q7f-j96c 
Multiple cross-site scripting (XSS) vulnerabilities in add_url.php in CloudNine Interactive Links Manager 2006-06-12 allow remote attackers to inject arbitrary web script or HTML via the (1) title, (2) description, or (3) keywords parameters.
CVE-2025-8902 Widget Options - Extended <= 5.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Widget Options - Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'do_sidebar' shortcode in all versions up to, and including, 5.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1 score: 6.4
CVE-2025-43722 
Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an improper privilege management vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to elevation of privileges.
CVSS v3.1 score: 6.7