CIRCL/vulnerability-scores huggingface dataset:
GHSA-mx48-2qjx-49h9 
In the Linux kernel, the following vulnerability has been resolved:proc: protect ptrace_may_access() with exec_update_lock (part 1)Fix the easy cases where procfs currently calls ptrace_may_access() without
exec_update_lock protection, where the fix is to simply add the extra lock
or use mm_access():do_task_stat(): grab exec_update_lockproc_pid_wchan(): grab exec_update_lockproc_map_files_lookup(): use mm_access() instead of get_task_mm()proc_map_files_readdir(): use mm_access() instead of get_task_mm()proc_ns_get_link(): grab exec_update_lockproc_ns_readlink(): grab exec_update_lock
CVE-2022-30516 
In Hospital-Management-System v1.0, the editid parameter in the doctor.php page is vulnerable to SQL injection attacks.
CVSS v3.1 score: 9.8
CVSS v2.0 score: 7.5
CVE-2020-36501 
Multiple cross-site scripting (XSS) vulnerabilities in the Support module of SugarCRM v6.5.18 allows attackers to execute arbitrary web scripts or HTML via crafted payloads entered into the primary address state or alternate address state input fields.
CVSS v3.1 score: 5.4
CVSS v2.0 score: 3.5
CVE-2026-41041 Apache Gravitino: URL path injection via unencoded user-supplied identifiers in MCP REST client f-string URL construction, enabling path traversal to unintended API endpoints.
URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino.

This issue affects Apache Gravitino: from 1.0.0 before 1.2.1.

Users are recommended to upgrade to version 1.2.1, which fixes the issue.
CVSS v3.1 score: 9.1
GHSA-2f25-pfq3-c7h8 Phpseclib needs guardrails on large binaryfield integers
ImpactAnyone loading untrusted ASN1 files (eg. X509 certificates, RSA PKCS8 private or public keys, etc)Patcheshttps://github.com/phpseclib/phpseclib/commit/964d78101a70305df33f442f5490f0adb3b7e77fWorkaroundsNo.Referenceshttps://github.com/phpseclib/phpseclib/commit/964d78101a70305df33f442f5490f0adb3b7e77f
https://www.usenix.org/system/files/usenixsecurity25-shi-bing.pdf
CVSS v3.1 score: 7.5
CVE-2025-10623 SourceCodester Hotel Reservation System deleteuser.php sql injection
A vulnerability was identified in SourceCodester Hotel Reservation System 1.0. The impacted element is an unknown function of the file deleteuser.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 7.3
CVSS v3.0 score: 7.3
CVSS v2.0 score: 7.5
GHSA-xvh9-mfm3-cvfq 
wp-admin/upgrade.php in WordPress, probably 2.6.x, allows remote attackers to upgrade the application, and possibly cause a denial of service (application outage), via a direct request.
CVE-2019-5814 
Insufficient policy enforcement in Blink in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS v3.1 score: 6.5
CVSS v2.0 score: 4.3
GHSA-9j4m-c233-x6w5 
MyVideoConverter Pro 3.14 contains a local buffer overflow vulnerability that allows attackers to crash the application by supplying an excessively long string to the registration code input field. Attackers can paste a malicious payload containing 10000 bytes into the 'Copy and Paste Registration Code' field to trigger a denial of service condition.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 6.2
GHSA-hcq4-pg2q-469j 
An issue was discovered in SolarWinds N-Central 12.3.0.670. The AdvancedScripts HTTP endpoint allows CSRF.
RHSA-2026:19454 Red Hat Security Advisory: PackageKit security update
PackageKit: race condition vulnerability leads to arbitrary package installation as root
CVSS v3.1 score: 8.8
CVE-2005-2279 
Cisco ONS 15216 Optical Add/Drop Multiplexer (OADM) running firmware 2.2.2 and earlier allows remote attackers to cause a denial of service (management plane session loss) via crafted telnet data.
CVSS v2.0 score: 5
GHSA-g636-q5fc-4pr7 accounts: Hash account number using Salt
@alovak found that currently when we build hash of account number we do not "salt" it. Which makes it vulnerable to rainbow table attack.**What did you expect to see?**
I expected salt (some random number from configuration) to be used in [hash.AccountNumber](https://github.com/moov-io/customers/blob/master/pkg/secrets/hash/account_number.go#L13)I would generate salt per tenant at least (maybe per organization).
GHSA-j2gh-426h-92wp 
A code injection vulnerability can allow a low-privileged user to overwrite files on that VSPC server, which can lead to remote code execution on VSPC server.
CVSS v3.0 score: 8.5
CVE-2020-24591 
The Management Console in certain WSO2 products allows XXE attacks during EventReceiver updates. This affects API Manager through 3.0.0, API Manager Analytics 2.2.0 and 2.5.0, API Microgateway 2.2.0, Enterprise Integrator 6.2.0 and 6.3.0, and Identity Server Analytics through 5.6.0.
CVSS v3.1 score: 6.5
GHSA-fwcm-rqvw-j3p7 FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue
SummaryAn authorization bypass in the /api/getTagValue endpoint allows unauthenticated access to tag values when the referenced script does not exist.DetailsThe issue is caused by the combination of these code paths:`server/api/apikeys/verify-api-or-token.js:45` sends requests without `x-api-key` to `authJwt.verifyToken(req, res, next)`.`server/api/jwt-helper.js:46-64` creates a signed guest token when no `x-access-token` is provided:
`if (!token) { token = getGuestToken(); }`
and then populates `req.userId` / `req.userGroups` from that guest token.`server/api/command/index.js:76-105` exposes `/api/getTagValue`.`server/runtime/scripts/index.js:106-111` returns `true` when the referenced script does not exist:
`if (!script) { return true; }`As a result, an unauthenticated request reaches `/api/getTagValue` as `guest`, and the authorization check is bypassed because `isAuthorisedByScriptName()` returns `true` when `sourceScriptName` is omitted or does not match a real script. The endpoint then returns arbitrary tag values by ID.PoCRequests to /api/getTagValue without authentication could succeed when the authorization logic evaluated a non-existent sourceScriptName as authorized.
CVSS v4.0 score: 7.7
GHSA-4v2g-fxcq-4j44 
In the Linux kernel, the following vulnerability has been resolved:iio: adc: ad7091r: Allow users to configure device eventsAD7091R-5 devices are supported by the ad7091r-5 driver together with
the ad7091r-base driver. Those drivers declared iio events for notifying
user space when ADC readings fall bellow the thresholds of low limit
registers or above the values set in high limit registers.
However, to configure iio events and their thresholds, a set of callback
functions must be implemented and those were not present until now.
The consequence of trying to configure ad7091r-5 events without the
proper callback functions was a null pointer dereference in the kernel
because the pointers to the callback functions were not set.Implement event configuration callbacks allowing users to read/write
event thresholds and enable/disable event generation.Since the event spec structs are generic to AD7091R devices, also move
those from the ad7091r-5 driver the base driver so they can be reused
when support for ad7091r-2/-4/-8 be added.
CVSS v3.1 score: 5.5
CVE-2026-15555 Jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: jboss deserialization rce via unfiltered river unmarshaller
A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node.
CVSS v3.1 score: 8.8
GHSA-3c29-qfhr-mp78 
An issue was discovered in Xen 4.9 through 4.14.x. On Arm, a guest is allowed to control whether memory accesses are bypassing the cache. This means that Xen needs to ensure that all writes (such as the ones during scrubbing) have reached the memory before handing over the page to a guest. Unfortunately, the operation to clean the cache is happening before checking if the page was scrubbed. Therefore there is no guarantee when all the writes will reach the memory.
CVSS v3.1 score: 5.5
CVE-2023-2283 
A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem is caused by the return value `rc,` which is initialized to SSH_ERROR and later rewritten to save the return value of the function call `pki_key_check_hash_compatible.` The value of the variable is not changed between this point and the cryptographic verification. Therefore any error between them calls `goto error` returning SSH_OK.
CVSS v3.1 score: 6.5
CVE-2020-6653 Sensitive date stored in logcat file
Eaton's Secure connect mobile app v1.7.3 & prior stores the user login credentials in logcat file when user create or register the account on the Mobile app. A malicious app or unauthorized user can harvest the information and later on can use the information to monitor and control the user's account and associated devices.
CVSS v3.1 score: 3.8
GHSA-mr8p-qxmj-qph5 
Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects WAC505 before 8.0.6.4 and WAC510 before 8.0.6.4.
CVE-2021-3863 Cross-site Scripting (XSS) - Generic in snipe/snipe-it
snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS v3.0 score: 5.5
GHSA-r22j-98fp-4fw9 
GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated attacker to leak sensitive information from confidential issues by injecting hidden prompts into merge request comments.
CVSS v3.1 score: 3.5
GHSA-4ppm-32h4-4764 
An issue was discovered in Open Source Social Network (OSSN) through 5.3. A user-controlled file path with a weak cryptographic rand() can be used to read any file with the permissions of the webserver. This can lead to further compromise. The attacker must conduct a brute-force attack against the SiteKey to insert into a crafted URL for components/OssnComments/ossn_com.php and/or libraries/ossn.lib.upgrade.php.
GHSA-wmrm-qmcx-9r68 
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ABCApp Creator allows PHP Local File Inclusion.This issue affects ABCApp Creator: from n/a through 1.1.2.
CVSS v3.1 score: 8.1
GHSA-p2fx-5559-g9cr 
Ubiquiti Networks UniFi 5.2.7 does not restrict access to the database, which allows remote attackers to modify the database by directly connecting to it.
CVSS v3.0 score: 8.8
CVE-2026-24521 WordPress Kama Thumbnail plugin <= 3.5.1 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Timur Kamaev Kama Thumbnail kama-thumbnail allows Cross Site Request Forgery.This issue affects Kama Thumbnail: from n/a through <= 3.5.1.
CVSS v3.1 score: 4.3
CVE-2017-9394 
A stored cross-site scripting vulnerability in CA Identity Governance 12.6 allows remote authenticated attackers to display HTML or execute script in the context of another user.
CVSS v3.0 score: 5.4
CVSS v2.0 score: 3.5
GHSA-h63v-hw6g-x8hp Bit flip attack vulnerability in cookie-encrypter
due to a weakness in the encryption method used in cookie-encrypter an attack can use the world visible IV to edit encrypted cookies without decrypting the cookie itself. This is known as an AES CBC bit flipping attack.
CVSS v3.1 score: 8.2
GHSA-x9rg-7xj6-v2x6 
KZTech JT3500V 4G LTE CPE 2.0.1 contains a session management vulnerability that allows attackers to reuse old session credentials without proper expiration. Attackers can exploit the weak session handling to maintain unauthorized access and potentially compromise device authentication mechanisms.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 7.5
CVE-2023-21989 
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).  Supported versions that are affected are Prior to 6.1.44 and  Prior to 7.0.8. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).
CVSS v3.1 score: 6
GHSA-w7j6-p4c4-j78m 
Insufficient permission checks in the REST API in Tribe29 Checkmk <= 2.1.0p27 and <= 2.2.0b4 (beta) allow unauthorized users to schedule downtimes for any host.
CVSS v3.1 score: 4.3
GHSA-5pcx-3rjp-rm45 
The Media Hygiene: Remove or Delete Unused Images and More! plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the bulk_action_delete and delete_single_image_call AJAX actions in all versions up to, and including, 3.0.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary attachments. A nonce check was added in version 3.0.1, however, it wasn't until version 3.0.2 that a capability check was added.
CVSS v3.1 score: 4.3
GHSA-g479-fg97-pf5w 
In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option (code 18) from the last upstream response is read and uses the option's length as the length of the agent domain. When a domain name check is performed on the agent domain, the returned lenght is not used and if the agent domain is followed by garbage, those bytes are moved onto the tail of the synthetic '_er.' report query name. That query name is later used in the iterator via a subquery to send out the DNS Error Report and when Unbound tries to walk that query name during 'find_closest_of_type()', it strips labels using the query name length rather than stopping at the embedded root, walks one byte past it, and feeds the first garbage byte to 'dname_query_hash()' as a label length writing over the stack variable 'labuf'. One ordinary upstream response from a delegated zone the attacker controls is sufficient to terminate the daemon.
CVSS v3.1 score: 7.5
GHSA-5vf9-4h4x-m5f6 
In the Linux kernel, the following vulnerability has been resolved:media: uvcvideo: Fix deadlock if uvc_status_stop is called from async_ctrl.workIf a UVC camera has an asynchronous control, uvc_status_stop may be
called from async_ctrl.work:uvc_ctrl_status_event_work()
    uvc_ctrl_status_event()
        uvc_ctrl_clear_handle()
	    uvc_pm_put()
	        uvc_status_put()
		    uvc_status_stop()
		        cancel_work_sync()This will cause a deadlock, since cancel_work_sync will wait for
uvc_ctrl_status_event_work to complete before returning.Fix this by returning early from uvc_status_stop if we are currently in
the work function. flush_status now remains false until uvc_status_start
is called again, ensuring that uvc_ctrl_status_event_work won't resubmit
the URB.
CVE-2021-22790 
A CWE-125: Out-of-bounds Read vulnerability that could cause a Denial of Service on the Modicon PLC controller / simulator when updating the controller application with a specially crafted project file exists in Modicon M580 CPU (part numbers BMEP* and BMEH*, all versions), Modicon M340 CPU (part numbers BMXP34*, all versions), Modicon MC80 (part numbers BMKC80*, all versions), Modicon Momentum Ethernet CPU (part numbers 171CBU*, all versions), PLC Simulator for EcoStruxureª Control Expert, including all Unity Pro versions (former name of EcoStruxureª Control Expert, all versions), PLC Simulator for EcoStruxureª Process Expert including all HDCS versions (former name of EcoStruxureª Process Expert, all versions), Modicon Quantum CPU (part numbers 140CPU*, all versions), Modicon Premium CPU (part numbers TSXP5*, all versions).
CVSS v3.1 score: 6.5
CVSS v2.0 score: 4
GHSA-9jf9-pq7g-q222 
The hdpvr_probe function in drivers/media/usb/hdpvr/hdpvr-core.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (improper error handling and system crash) or possibly have unspecified other impact via a crafted USB device.
CVSS v3.0 score: 6.6
GHSA-x97p-2r85-4gq4 
A remote adversary with the ability to send arbitrary CoAP packets to be parsed by Zephyr is able to cause a denial of service. This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions.
RHSA-2023:0337 Red Hat Security Advisory: expat security update
expat: use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate
CVSS v3.1 score: 7.5
GHSA-3475-j2vx-vqhg 
Cross-site scripting (XSS) vulnerability in VMware View (formerly Virtual Desktop Manager or VDM) 3.1.x before 3.1.3 build 252693 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2023-34868 
Jerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the parser_parse_for_statement_start at jerry-core/parser/js/js-parser-statm.c.
CVSS v3.1 score: 7.5
GHSA-cq83-c7ww-m93g 
A vulnerability was found in code-projects Hospital Bed Management System 1.0. This affects an unknown part of the component Login Form. Performing a manipulation of the argument Username results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
CVSS v4.0 score: 5.5
CVSS v3.1 score: 7.3
CVE-2025-30671 Zoom Workplace Apps for Windows - Null Pointer
Null pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access.
CVSS v3.1 score: 6.5
GHSA-h2ww-qm2g-98qf 
WebKit, as used in Apple iTunes before 11.0.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-05-16-1.
GHSA-36m2-fp76-fx6w 
An issue in PX4 Autopilot v.1.14.0 allows an attacker to manipulate the flight path allowing for crashes of the drone via the home point location of the mission_block.cpp component.
CVSS v3.1 score: 6.6
GHSA-m2xf-6xr9-22pv 
The (1) ZipArchive::addGlob and (2) ZipArchive::addPattern functions in ext/zip/php_zip.c in PHP 5.3.6 allow context-dependent attackers to cause a denial of service (application crash) via certain flags arguments, as demonstrated by (a) GLOB_ALTDIRFUNC and (b) GLOB_APPEND.
GHSA-gr86-25pq-rhr2 
In the Linux kernel, the following vulnerability has been resolved:btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent mapsWhen btrfs_drop_extent_map_range() splits an extent map, the new split
maps inherit the original map's flags through a local 'flags' variable.
Commit f86f7a75e2fb ("btrfs: use the flags of an extent map to identify
the compression type") changed the EXTENT_FLAG_LOGGING clearing to
operate on em->flags instead of that local 'flags' copy, so a split of
an extent map that is currently being logged wrongly inherits
EXTENT_FLAG_LOGGING.The flag is then never cleared on the split, and when it is freed while
still on the inode's modified_extents list (for example by the extent
map shrinker) it trips the WARN_ON(!list_empty(&em->list)) in
btrfs_free_extent_map() and leads to a use-after-free.Clear EXTENT_FLAG_LOGGING from the local 'flags' copy used for the
splits and only clear EXTENT_FLAG_PINNED from em->flags, restoring the
behaviour prior to f86f7a75e2fb.
CVSS v3.1 score: 7.8
CVE-2017-1445 
IBM Emptoris Spend Analysis 9.5.0.0 through 10.1.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 128170.
CVSS v3.0 score: 5.4
CVSS v2.0 score: 3.5
CVE-2003-1048 
Double free vulnerability in mshtml.dll for certain versions of Internet Explorer 6.x allows remote attackers to cause a denial of service (application crash) via a malformed GIF image.
CVSS v3.1 score: 7.8
CVSS v2.0 score: 10
PYSEC-2026-976 
### Impact
If `QuantizeAndDequantizeV3` is given a nonscalar `num_bits` input tensor, it results in a `CHECK` fail that can be used to trigger a denial of service attack.
```python
import tensorflow as tf

signed_input = True
range_given = False
narrow_range = False
axis = -1
input = tf.constant(-3.5, shape=[1], dtype=tf.float32)
input_min = tf.constant(-3.5, shape=[1], dtype=tf.float32)
input_max = tf.constant(-3.5, shape=[1], dtype=tf.float32)
num_bits = tf.constant([], shape=[0], dtype=tf.int32)
tf.raw_ops.QuantizeAndDequantizeV3(input=input, input_min=input_min, input_max=input_max, num_bits=num_bits, signed_input=signed_input, range_given=range_given, narrow_range=narrow_range, axis=axis)
```

### Patches
We have patched the issue in GitHub commit [f3f9cb38ecfe5a8a703f2c4a8fead434ef291713](https://github.com/tensorflow/tensorflow/commit/f3f9cb38ecfe5a8a703f2c4a8fead434ef291713).

The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range.


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.


### Attribution
This vulnerability has been reported by Neophytos Christou, Secure Systems Labs, Brown University.
CVSS v3.1 score: 5.9
CVE-2026-22496 WordPress Hypnotherapy theme <= 1.2.10 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Hypnotherapy hypnotherapy allows PHP Local File Inclusion.This issue affects Hypnotherapy: from n/a through <= 1.2.10.
CVSS v3.1 score: 8.1
CVE-2009-2785 
Multiple cross-site scripting (XSS) vulnerabilities in PHP Open Classifieds Script allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter to buy.php and the id parameter to (2) contact.php and (3) tellafriend.php.
CVSS v2.0 score: 4.3
CVE-2020-12608 
An issue was discovered in SolarWinds MSP PME (Patch Management Engine) Cache Service before 1.1.15 in the Advanced Monitoring Agent. There are insecure file permissions for %PROGRAMDATA%\SolarWinds MSP\SolarWinds.MSP.CacheService\config\. This can lead to code execution by changing the CacheService.xml SISServerURL parameter.
CVSS v3.1 score: 7.8
CVSS v2.0 score: 9.3
GHSA-6qwm-5fm9-cvjx Apache Answer vulnerable to Cross-site Scripting
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache Answer.This issue affects Apache Answer: through 2.0.0.User-supplied content was included in notification emails without proper escaping, allowing authenticated users to inject arbitrary HTML into emails sent to other users.
Users are recommended to upgrade to version 2.0.1, which fixes the issue.
CVSS v3.1 score: 5.4
CVE-2020-2092 
Jenkins Robot Framework Plugin 2.0.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing users with Job/Configure to have Jenkins parse crafted XML documents.
CVSS v3.1 score: 8.8
CVSS v2.0 score: 6.5
CVE-2018-5333 
In the Linux kernel through 4.14.13, the rds_cmsg_atomic function in net/rds/rdma.c mishandles cases where page pinning fails or an invalid address is supplied, leading to an rds_atomic_free_op NULL pointer dereference.
CVSS v3.0 score: 5.5
CVSS v2.0 score: 4.9
CVE-2005-3018 
Apple Safari allows remote attackers to cause a denial of service (application crash) via a crafted data:// URL.
CVSS v2.0 score: 5
RHSA-2021:4702 Red Hat Security Advisory: Satellite 6.10 Release
python-ecdsa: Unexpected and  undocumented exceptions during signature decoding python-ecdsa: DER encoding is not being verified in signatures rubygem-activerecord-session_store: hijack sessions by using timing attacks targeting the session id rake: OS Command Injection via egrep in Rake::FileList guava: local information disclosure via temporary directory created with unsafe permissions PyYAML: incomplete fix for CVE-2020-1747 rubygem-nokogiri: XML external entity injection via Nokogiri::XML::Schema Satellite: Azure compute resource secret_key leak to authenticated users foreman: possible man-in-the-middle in smart_proxy realm_freeipa Satellite: BMC controller credential leak via API python-aiohttp: Open redirect in aiohttp.web_middlewares.normalize_path_middleware rubygem-actionpack: Possible Information Disclosure / Unintended Method Execution in Action Pack rails: Possible Denial of Service vulnerability in Action Dispatch rails: Possible DoS Vulnerability in Action Controller Token Authentication django: potential directory-traversal via uploaded files rubygem-puma: incomplete fix for CVE-2019-16770 allows Denial of Service (DoS) django: Potential directory-traversal via uploaded files rubygem-addressable: ReDoS in templates django: Potential directory traversal via ``admindocs`` python-urllib3: ReDoS in the parsing of authority part of URL django: Possible indeterminate SSRF, RFI, and LFI attacks since validators accepted leading zeros in IPv4 addresses
CVSS v3.1 score: 7.5
CVSS v3.0 score: 7.4
GHSA-p5jp-3f2p-w428 
Unauthenticated Cross Site Scripting (XSS) in WoodMart <= 8.5.3 versions.
CVSS v3.1 score: 7.1
GHSA-pc79-p8f4-vrv5 
Esri ArcGIS Server versions 10.9.1 and prior have a path traversal vulnerability that may result in a denial of service by allowing a remote, authenticated attacker to overwrite internal ArcGIS Server directory.
CVSS v3.1 score: 8.1
GHSA-hg6h-cj3j-wp77 
An issue was discovered in the Linux kernel brcm_nvram_parse in drivers/nvmem/brcm_nvram.c. Lacks for the check of the return value of kzalloc() can cause the NULL Pointer Dereference.
CVSS v3.1 score: 5.5
GHSA-j8mf-78fw-w88x 
The Cove (aka org.covechurch.app) application 1.0.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
RHSA-2017:1871 Red Hat Security Advisory: tcpdump security, bug fix, and enhancement update
tcpdump: IPv6 mobility printer mobility_opt_print() typecastimg/signedness error tcpdump: tcp printer rpki_rtr_pdu_print() missing length check tcpdump: ethernet printer osi_print_cksum() missing sanity checks out-of-bounds read tcpdump: force printer vulnerability tcpdump: multiple overflow issues in protocol decoding tcpdump: multiple overflow issues in protocol decoding tcpdump: multiple overflow issues in protocol decoding tcpdump: multiple overflow issues in protocol decoding tcpdump: multiple overflow issues in protocol decoding tcpdump: multiple overflow issues in protocol decoding tcpdump: multiple overflow issues in protocol decoding tcpdump: multiple overflow issues in protocol decoding tcpdump: multiple overflow issues in protocol decoding tcpdump: multiple overflow issues in protocol decoding tcpdump: multiple overflow issues in protocol decoding tcpdump: multiple overflow issues in protocol decoding tcpdump: multiple overflow issues in protocol decoding tcpdump: multiple overflow issues in protocol decoding tcpdump: multiple overflow issues in protocol decoding tcpdump: multiple overflow issues in protocol decoding tcpdump: multiple overflow issues in protocol decoding tcpdump: multiple overflow issues in protocol decoding tcpdump: multiple overflow issues in protocol decoding tcpdump: multiple overflow issues in protocol decoding tcpdump: multiple overflow issues in protocol decoding tcpdump: multiple overflow issues in protocol decoding tcpdump: multiple overflow issues in protocol decoding tcpdump: multiple overflow issues in protocol decoding tcpdump: multiple overflow issues in protocol decoding tcpdump: multiple overflow issues in protocol decoding tcpdump: multiple overflow issues in protocol decoding tcpdump: multiple overflow issues in protocol decoding tcpdump: multiple overflow issues in protocol decoding tcpdump: multiple overflow issues in protocol decoding tcpdump: multiple overflow issues in protocol decoding tcpdump: multiple overflow issues in protocol decoding tcpdump: multiple overflow issues in protocol decoding tcpdump: multiple overflow issues in protocol decoding tcpdump: multiple overflow issues in protocol decoding tcpdump: multiple overflow issues in protocol decoding tcpdump: multiple overflow issues in protocol decoding tcpdump: multiple overflow issues in protocol decoding tcpdump: multiple overflow issues in protocol decoding tcpdump: multiple overflow issues in protocol decoding tcpdump: multiple overflow issues in protocol decoding
CVSS v3.0 score: 6.5
GHSA-wwwq-962j-m7x8 
Memory corruption while using alignments for memory allocation.
CVSS v3.1 score: 7.8
GHSA-pcr7-6q32-4xxw 
The Red Hat Linux su program does not log failed password guesses if the su process is killed before it times out, which allows local attackers to conduct brute force password guessing.
GHSA-w528-j4p6-w8vf 
Missing Authorization vulnerability in Pagelayer Team PageLayer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PageLayer: from n/a through 1.7.7.
CVSS v3.1 score: 4.3
GHSA-jgxc-qhw9-rf7c 
An improper certificate validation vulnerability in the Prisma Access Agent® for Android and Chrome OS enables an attacker to perform a man-in-the-middle (MitM) attack to intercept VPN traffic. By presenting a certificate for any domain issued by a trusted Certificate Authority, the attacker can capture sensitive device information.The Prisma Access Agent on macOS, Windows, Linux and iOS are not affected.
CVSS v4.0 score: 6.2
CVSS v3.1 score: 5.9
CVE-2018-16759 
The removeXSS function in App/Common/common.php (called from App/Modules/Index/Action/SearchAction.class.php) in EasyCMS v1.4 allows XSS via an onhashchange event.
CVSS v3.0 score: 6.1
CVSS v2.0 score: 4.3
GHSA-98c3-8pq6-g67m 
Unspecified vulnerability in the PeopleSoft Enterprise FSCM component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote authenticated users to affect confidentiality and integrity via vectors related to eProcurement.
CVSS v3.0 score: 5.4
GHSA-r534-43c2-gm8w 
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0590, CVE-2019-0591, CVE-2019-0593, CVE-2019-0607, CVE-2019-0610, CVE-2019-0640, CVE-2019-0642, CVE-2019-0644, CVE-2019-0651, CVE-2019-0652, CVE-2019-0655.
CVSS v3.0 score: 7.5
CVE-2024-32524 WordPress Custom Order Statuses for WooCommerce plugin <= 1.5.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in Nuggethon Custom Order Statuses for WooCommerce.This issue affects Custom Order Statuses for WooCommerce: from n/a through 1.5.2.
CVSS v3.1 score: 4.3
GHSA-2v6f-x5hx-p44q 
The fst_get_iface function in drivers/net/wan/farsync.c in the Linux kernel before 3.11.7 does not properly initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability for an SIOCWANDEV ioctl call.
CVE-2021-40576 
The binary MP4Box in Gpac 1.0.1 has a null pointer dereference vulnerability in the gf_isom_get_payt_count function in hint_track.c, which allows attackers to cause a denial of service.
CVSS v3.1 score: 5.5
CVSS v2.0 score: 4.3
GHSA-gqww-mmf9-7x23 
VMware Fusion(13.x prior to 13.5) contains a local privilege escalation vulnerability that occurs during 
installation for the first time (the user needs to drag or copy the 
application to a folder from the '.dmg' volume) or when installing an 
upgrade. A malicious actor with local non-administrative user privileges may 
exploit this vulnerability to escalate privileges to root on the system 
where Fusion is installed or being installed for the first time.
CVSS v3.1 score: 6.6
GHSA-f62g-jrwm-hq59 
Quick Emulator (aka QEMU), when built with the Cirrus CLGD 54xx VGA Emulator support, allows local guest OS privileged users to cause a denial of service (out-of-bounds access and QEMU process crash) by leveraging incorrect region calculation when updating VGA display.
CVSS v3.1 score: 5.5
GHSA-76rv-vcjw-7q23 
Out of bounds write in ChromeOS Audio Server in Google Chrome on ChromeOS prior to 113.0.5672.114 allowed a remote attacker to potentially exploit heap corruption via crafted audio file. (Chromium security severity: High)
CVSS v3.1 score: 8.8
CVE-2026-43442 io_uring: fix physical SQE bounds check for SQE_MIXED 128-byte ops
In the Linux kernel, the following vulnerability has been resolved:

io_uring: fix physical SQE bounds check for SQE_MIXED 128-byte ops

When IORING_SETUP_SQE_MIXED is used without IORING_SETUP_NO_SQARRAY,
the boundary check for 128-byte SQE operations in io_init_req()
validated the logical SQ head position rather than the physical SQE
index.

The existing check:

  !(ctx->cached_sq_head & (ctx->sq_entries - 1))

ensures the logical position isn't at the end of the ring, which is
correct for NO_SQARRAY rings where physical == logical. However, when
sq_array is present, an unprivileged user can remap any logical
position to an arbitrary physical index via sq_array. Setting
sq_array[N] = sq_entries - 1 places a 128-byte operation at the last
physical SQE slot, causing the 128-byte memcpy in
io_uring_cmd_sqe_copy() to read 64 bytes past the end of the SQE
array.

Replace the cached_sq_head alignment check with a direct validation
of the physical SQE index, which correctly handles both sq_array and
NO_SQARRAY cases.
CVSS v3.1 score: 7.1
GHSA-c22h-m2p9-c6w3 
An improper neutralization of script-related html tags in a web page (basic xss) in Fortinet FortiPortal 6.0.0 through 6.0.14 allows attacker to execute unauthorized code or commands via html injection.
CVSS v3.1 score: 3.5
GHSA-2vmp-q8v6-7qc9 
In the Linux kernel, the following vulnerability has been resolved:net: fix stack overflow when LRO is disabled for virtual interfacesWhen the virtual interface's feature is updated, it synchronizes the
updated feature for its own lower interface.
This propagation logic should be worked as the iteration, not recursively.
But it works recursively due to the netdev notification unexpectedly.
This problem occurs when it disables LRO only for the team and bonding
interface type.+------+------+-----+-----+
  |      |      |     |     |
team1  team2  team3  ...  team200If team0's LRO feature is updated, it generates the NETDEV_FEAT_CHANGE
event to its own lower interfaces(team1 ~ team200).
It is worked by netdev_sync_lower_features().
So, the NETDEV_FEAT_CHANGE notification logic of each lower interface
work iteratively.
But generated NETDEV_FEAT_CHANGE event is also sent to the upper
interface too.
upper interface(team0) generates the NETDEV_FEAT_CHANGE event for its own
lower interfaces again.
lower and upper interfaces receive this event and generate this
event again and again.
So, the stack overflow occurs.But it is not the infinite loop issue.
Because the netdev_sync_lower_features() updates features before
generating the NETDEV_FEAT_CHANGE event.
Already synchronized lower interfaces skip notification logic.
So, it is just the problem that iteration logic is changed to the
recursive unexpectedly due to the notification mechanism.Reproducer:ip link add team0 type team
ethtool -K team0 lro on
for i in {1..200}
do
        ip link add team$i master team0 type team
        ethtool -K team$i lro on
doneethtool -K team0 lro offIn order to fix it, the notifier_ctx member of bonding/team is introduced.
CVSS v3.1 score: 7.8
GHSA-928j-whg4-747q 
The Xiaomi Redmi 6 Pro Android device with a build fingerprint of xiaomi/sakura_india/sakura_india:8.1.0/OPM1.171019.019/V10.2.6.0.ODMMIXM:user/release-keys contains a pre-installed app with a package name of com.huaqin.factory app (versionCode=1, versionName=QL1715_201812191721) that allows unauthorized wireless settings modification via a confused deputy attack. This capability can be accessed by any app co-located on the device.
GHSA-373w-8gf3-3hvx 
Microsoft Windows Media Runtime, as used in DirectShow WMA Voice Codec, Windows Media Audio Voice Decoder, and Audio Compression Manager (ACM), does not properly process Advanced Systems Format (ASF) files, which allows remote attackers to execute arbitrary code via a crafted audio file that uses the Windows Media Speech codec, aka "Windows Media Runtime Voice Sample Rate Vulnerability."
CVE-2023-22661 
Buffer overflow in some Intel(R) Server Board BMC firmware before version 2.90 may allow a privileged user to enable escalation of privilege via local access.
CVSS v3.1 score: 8.2
CVE-2025-68019 WordPress SEO Booster plugin <= 6.1.8 - Broken Access Control vulnerability
Missing Authorization vulnerability in cleverplugins SEO Booster seo-booster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SEO Booster: from n/a through <= 6.1.8.
CVSS v3.1 score: 6.5
CVE-2019-4530 
IBM Maximo Asset Management 7.6, 7.6.1, and 7.6.1.1 could allow an authenticated user to delete a record that they should not normally be able to. IBM X-Force ID: 165586.
CVSS v3.0 score: 4.3
GHSA-996f-83x4-9fpc 
The SillMap::readFace function in FeatureMap.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, mishandles a return value, which allows remote attackers to cause a denial of service (missing initialization, NULL pointer dereference, and application crash) via a crafted Graphite smart font.
CVSS v3.0 score: 6.5
CVE-2014-4861 
The Remote Desktop Launcher in Thycotic Secret Server before 8.6.000010 does not properly cleanup a temporary file that contains an encrypted password once a session has ended.
CVSS v3.0 score: 9.8
CVSS v2.0 score: 7.5
CVE-2005-1946 
Multiple SQL injection vulnerabilities in Invision Blog before 1.1.2 Final allow remote attackers to execute arbitrary SQL commands via the (1) eid parameter to an editentry, replyentry, or editcomment action, or (2) the mid parameter to an aboutme action.
CVSS v2.0 score: 7.5
RHSA-2018:3591 Red Hat Security Advisory: kernel security and bug fix update
kernel: out-of-bounds access in the show_timer function in kernel/time/posix-timers.c kernel: Integer overflow in Linux's create_elf_tables function
CVSS v3.0 score: 7.8
GHSA-4mfv-jcx7-pg36 
Cross-site scripting (XSS) vulnerability in Title Tootip in Synology Office before 3.0.3-2143 allows remote authenticated users to inject arbitrary web script or HTML via the malicious file name.
CVSS v3.0 score: 5.4
GHSA-5579-33mm-x832 
A CWE-787: Out-of-bounds write vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in loss of data or remote code execution due to missing size checks, when a malicious WSP (Workspace) file is being parsed by IGSS Definition.
GHSA-g536-q3gw-6p2p 
Siri in Apple iOS before 9.3.2 does not block data detectors within results in the lock-screen state, which allows physically proximate attackers to obtain sensitive contact and photo information via unspecified vectors.
CVSS v3.0 score: 2.4
RHSA-2016:0296 Red Hat Security Advisory: rh-ror41 security update
rubygem-actionpack: Timing attack vulnerability in basic authentication in Action Controller rubygem-activerecord: Nested attributes rejection proc bypass in Active Record rubygem-actionpack: Object leak vulnerability for wildcard controller routes in Action Pack rubygem-actionpack: possible object leak and denial of service attack in Action Pack rubygem-actionpack: directory traversal flaw in Action View rubygem-activerecord: possible input validation circumvention in Active Model
RHSA-2025:19566 Red Hat Security Advisory: osbuild-composer security update
go-jose: Go JOSE's Parsing Vulnerable to Denial of Service
CVSS v3.1 score: 7.5
GHSA-p5vf-5754-x7p3 `polymarket-client-sdks` was removed from crates.io for malicious code
It appeared to be typosquatting existing crate [`polymarket-client-sdk`](https://crates.io/crates/polymarket-client-sdk) (`sdks` vs `sdk`) and attempting to steal credentials from local files.The malicious crate had 1 version published on 2026-02-09 and had been downloaded only 33 times. There were no crates depending on this crate on crates.io.Thanks to Roland Peelen for finding and reporting this to the crates.io team!
CVE-2024-29879 Cross-Site Scripting (XSS) vulnerability in Sentrifugo
Cross-Site Scripting (XSS) vulnerability in Sentrifugo 3.2, through   /sentrifugo/index.php/index/getdepartments/format/html,  'business_id' parameter. The exploitation of this vulnerability could allow  a remote user to send a specially crafted URL to the victim and steal their session data.

CVSS v3.1 score: 7.1
RHSA-2021:0381 Red Hat Security Advisory: RHV-M(ovirt-engine) 4.4.z security, bug fix, enhancement update [ovirt-4.4.4]
jackson-databind: FasterXML DOMDeserializer insecure entity expansion is vulnerable to XML external entity (XXE)
CVSS v3.1 score: 7.5
GHSA-f6f7-q4mq-xm89 
An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack. Fixed in version 6.4.1.
CVSS v3.0 score: 6.3
CVE-2019-20709 
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D3600 before 1.0.0.76, D6000 before 1.0.0.76, and XR500 before 2.3.2.32.
CVSS v3.0 score: 7.1
RHSA-2025:3743 Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.5.1 release
golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws go-jose: Go JOSE's Parsing Vulnerable to Denial of Service github.com/expr-lang/expr: Memory Exhaustion in Expr Parser with Unrestricted Input golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing
CVSS v3.1 score: 7.5
GHSA-3mwp-7c29-vp5v 
JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153 and Firefox ESR 140.13.
CVSS v3.1 score: 9.8
GHSA-9r4q-cm6h-cc5p 
A memory corruption issue was addressed with improved state management. This issue affected versions prior to iOS 12, macOS Mojave 10.14, tvOS 12, watchOS 5.
CVSS v3.0 score: 7.8
GHSA-7cm4-rxww-3v3q 
IRC connection tracking helper module in the netfilter subsystem for Linux 2.4.18-pre9 and earlier does not properly set the mask for conntrack expectations for incoming DCC connections, which could allow remote attackers to bypass intended firewall restrictions.
GHSA-655q-9gvg-q4cm Remote code execution in ASP.NET Core
A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka 'ASP.NET Core Remote Code Execution Vulnerability'.
GHSA-2pvj-p485-cp3m matrix-android-sdk2 vulnerable to impersonation via forwarded Megolm sessions
ImpactAn attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shield on some platforms, but this may be missing in others.This attack is possible due to the matrix-android-sdk2 implementing a too permissive [key forwarding](https://spec.matrix.org/v1.3/client-server-api/#key-requests) strategy on the receiving end.Key forwarding is a mechanism allowing clients to recover from “unable to decrypt” messages when they missed the initial key distribution, at the time the message was originally sent. Examples include accessing message history before they joined the room but also when some network/federation errors have occurred.PatchesThe default policy for accepting key forwards has been made more strict in the matrix-android-sdk2. The matrix-android-sdk2 will now only accept forwarded keys in response to previously issued requests and only from own, verified devices.A unique exception to this rule is with the experimental [MSC3061](https://github.com/matrix-org/matrix-spec-proposals/pull/3061), that is forwarding room keys for past messages when invited in a room configured with the proper history visibility setting. Such key forwards are parked upon receipt and are only accepted if the SDK receives an invitation for that room from the inviter in a limited time window.The SDK now sets a `trusted` flag on the decrypted message upon decryption, based on whether the key used to decrypt the message was received from a trusted source. Clients need to ensure that messages decrypted with a key with `trusted = false` are decorated appropriately (for example, by showing a warning for such messages).WorkaroundsCurrent users of the SDK can disable key forwarding in their forks using `CryptoService#enableKeyGossiping(enable: Boolean)`.ReferencesBlog post: https://matrix.org/blog/2022/09/28/upgrade-now-to-address-encryption-vulns-in-matrix-sdks-and-clientsFor more informationIf you have any questions or comments about this advisory, e-mail us at [security@matrix.org](mailto:security@matrix.org).
CVSS v3.1 score: 7.5
GHSA-mg87-gpmw-w9r3 
While sending a probe request indication in lim_send_sme_probe_req_ind() in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel, a buffer overflow can occur.
CVSS v3.0 score: 7.8
CVE-2009-0739 
SQL injection vulnerability in login.php in MyNews 0.10 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) passwd parameters.
CVSS v2.0 score: 7.5
CVE-2026-33211 Tekton Pipelines git resolver has path traversal that allows reading arbitrary files from the resolver pod
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.1, 1.3.3, 1.6.1, 1.9.2, and 1.10.2, the Tekton Pipelines git resolver is vulnerable to path traversal via the `pathInRepo` parameter. A tenant with permission to create `ResolutionRequests` (e.g. by creating `TaskRuns` or `PipelineRuns` that use the git resolver) can read arbitrary files from the resolver pod's filesystem, including ServiceAccount tokens. The file contents are returned base64-encoded in `resolutionrequest.status.data`. Versions 1.0.1, 1.3.3, 1.6.1, 1.9.2, and 1.10.2 contain a patch.
CVSS v3.1 score: 9.6
CVE-2025-43880 
Inefficient regular expression complexity issue exists in GROWI prior to v7.1.6. If exploited, a logged-in user may cause a denial of service (DoS) condition.
CVSS v4.0 score: 5.3
CVSS v3.0 score: 4.3
CVE-2013-3500 
The Foundation webapp admin interface in GroundWork Monitor Enterprise 6.7.0 uses the nagios account as the owner of writable files under /usr/local/groundwork, which allows context-dependent attackers to bypass intended filesystem restrictions by leveraging access to a GroundWork script.
CVSS v2.0 score: 7.5
CVE-2023-21771 Windows Local Session Manager (LSM) Elevation of Privilege Vulnerability
Windows Local Session Manager (LSM) Elevation of Privilege Vulnerability
CVSS v3.1 score: 7
CVE-2022-42984 
WoWonder Social Network Platform 4.1.4 was discovered to contain a SQL injection vulnerability via the offset parameter at requests.php?f=search&s=recipients.
CVSS v3.1 score: 9.8
CVE-2026-4484 Masteriyo LMS <= 2.1.6 - Missing Authorization to Authenticated (Student+) Privilege Escalation to Administrator
The Masteriyo LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.1.6. This is due to the plugin allowing a user to update the user role through the 'InstructorsController::prepare_object_for_database' function. This makes it possible for authenticated attackers, with Student-level access and above, to elevate their privileges to that of an administrator.
CVSS v3.1 score: 8.8
GHSA-qrxh-qrgr-2433 
ImageMagick 7.0.7-22 Q16 has memory leaks in the ReadDCMImage function in coders/dcm.c.
CVSS v3.0 score: 6.5