CIRCL/vulnerability-scores huggingface dataset:
GHSA-cw6h-ffmh-x6vh Anki: User scripts in iframes have access to the internal Anki API
SummaryAnki's webview-based pages communicate with the Rust backend using an internal localhost API. Anki implements measures to prevent user scripts run in the reviewer/editor from accessing this API (https://github.com/ankitects/anki/pull/3925) but it inadvertently allows access to scripts included via iframes in the editor. While overall only a limited set of API methods are exposed, some such as `getImageForOcclusion` can read arbitrary files.**CWE:** CWE-22 (Path Traversal)
**Reporter:** Bankde (Eakasit)Affected Products| Ecosystem | Package | Affected Versions |
| --------- | ------- | ----------------- |
| PyPI      | `aqt`   | `<= 25.09.3`      |ImpactAny desktop Anki user (Windows, macOS, Linux) who imports an untrusted `.apkg` and views card with an embedded iframe is vulnerable. No special configuration is required. The attacker can read any file accessible to the Anki process and exfiltrate its contents over the network.PatchesA patch is available in 25.09.4WorkaroundsDo not import `.apkg` files from untrusted sources.Inspect `.apkg` contents (it's a ZIP) for `.html`/`.svg` files with `<script>` tags before importing.Block unexpected outbound network requests from the Anki process at the firewall level.ReferencesVulnerability report: _Anki arbitrary file read vulnerability (with exfiltration)_ — Bankde (Eakasit)Affected source: [`qt/aqt/mediasrv.py::_handle_local_file_request`](https://github.com/ankitects/anki/blob/5a9b54e9380c66e26391f0827867d2a728107836/qt/aqt/mediasrv.py#L223)Related prior CVEs: [CVE-2024-29073](https://nvd.nist.gov/vuln/detail/CVE-2024-29073), [CVE-2024-32484](https://nvd.nist.gov/vuln/detail/CVE-2024-32484), [CVE-2025-62185](https://nvd.nist.gov/vuln/detail/CVE-2025-62185), [CVE-2025-62187](https://nvd.nist.gov/vuln/detail/CVE-2025-62187)
CVSS v3.1 score: 6.5
RHBA-2025:8688 Red Hat Bug Fix Advisory: Red Hat Quay v3.12.10 bug fix release
quay: Incorrect Privilege Assignment redis: Redis DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated client
CVSS v3.1 score: 7.5
CVE-2023-37388 WordPress Simple Light Weight Social Share (Tweet, Like, Share and Linkedin) Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Sudipto Pratap Mahato Simple Light Weight Social Share plugin <= 2.0 versions.
CVSS v3.1 score: 5.9
CVE-2023-2960 XSS in Oliva Expertise
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Oliva Expertise Oliva Expertise EKS allows Cross-Site Scripting (XSS).

This issue affects Oliva Expertise EKS: before 1.2.
CVSS v3.1 score: 6.1
RHSA-2025:15612 Red Hat Security Advisory: Red Hat Data Grid 8.5.5 security update
netty: netty-codec-http2: Netty MadeYouReset HTTP/2 DDoS Vulnerability
CVSS v3.1 score: 7.5
CVE-2022-22740 
Certain network request objects were freed too early when releasing a network request handle. This could have lead to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.
CVSS v3.1 score: 8.8
CVE-2024-36488 
Improper Access Control in some Intel(R) DSA before version 24.3.26.8 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS v4.0 score: 5.4
CVSS v3.1 score: 7.3
GHSA-854p-fxw9-mq4h 
IBM Tivoli Monitoring 6.3.0.7 through 6.3.0.7 Service Pack 20 is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. A remote attacker could overflow a buffer and execute arbitrary code on the system or cause the server to crash.
CVSS v3.1 score: 8.1
GHSA-h3p7-vxpm-g349 
An issue in the LB-LINK BL-W1210M v2.0 router allows attackers to bypass password complexity requirements and set single digit passwords for authentication. This vulnerability can allow attackers to access the router via a brute-force attack.
CVSS v3.1 score: 6.3
GHSA-c2v9-7ff7-q3p4 
Unauthenticated Broken Access Control in Civi Framework <= 2.2.0 versions.
CVSS v3.1 score: 5.3
GHSA-7hmv-r6w5-pr73 
A vulnerability was determined in cosmicstack-labs mercury-agent up to 1.1.12. Impacted is the function SubAgent.run of the file src/core/sub-agent.ts of the component delegate_task Tool. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
CVSS v4.0 score: 2.1
CVSS v3.1 score: 6.3
GHSA-8fxj-85rv-jj93 
WordPress before 5.2.3 allows reflected XSS in the dashboard.
CVSS v3.1 score: 6.1
GHSA-v4c8-f47v-cj2h 
JeeWMS 771e4f5d0c01ffdeae1671be4cf102b73a3fe644 (2025-05-19) contains incorrect authentication bypass vulnerability, which can lead to arbitrary file reading.
CVSS v3.1 score: 9.8
GHSA-mq9w-94xx-6xxh 
The Easy Form Builder plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple AJAX actions in all versions up to, and including, 3.9.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive form response data, including messages, admin replies, and user information due to a logic error in the authorization check that uses AND (&&) instead of OR (||).
CVSS v3.1 score: 5.3
GHSA-m246-pv28-4r6f Mingsoft MCMS CSRF vulnerability
An issue was discovered in MCMS 4.6.5. There is a CSRF vulnerability that can add an administrator account via ms/basic/manager/save.do.
CVSS v3.0 score: 8.8
CVE-2026-5910 
Integer overflow in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a crafted video file. (Chromium security severity: Low)
CVSS v3.1 score: 8.8
CVE-2013-1721 
Integer overflow in the drawLineLoop function in the libGLESv2 library in Almost Native Graphics Layer Engine (ANGLE), as used in Mozilla Firefox before 24.0 and SeaMonkey before 2.21, allows remote attackers to execute arbitrary code via a crafted web site.
CVSS v2.0 score: 9.3
GHSA-v4cf-5q68-v9xj 
The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'titleTag' attribute in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1 score: 6.4
CVE-2019-4093 
IBM Tivoli Storage Manager (IBM Spectrum Protect 8.1.7) could allow a user to restore files and directories using IBM Spectrum Prootect Client Web User Interface on Windows that they should not have access to due to incorrect file permissions. IBM X-Force ID: 157981.
CVSS v3.0 score: 5.1
CVE-2016-9039 
An exploitable denial of service exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system call with the command HYPRLOFS_ADD_ENTRIES. An attacker can cause a buffer to be allocated and never freed. When repeatedly exploited this will result in memory exhaustion, resulting in a full system denial of service.
CVSS v3.0 score: 6.2
CVE-2026-44586 SiYuan: Bazaar marketplace renders unescaped package author metadata, allowing XSS and Electron code execution
SiYuan is an open-source personal knowledge management system. From 2.1.12 to before 3.7.0. SiYuan's Bazaar marketplace renders package author metadata from the public bazaar stage feed into HTML without escaping. In the desktop app this becomes stored XSS, and because SiYuan's Electron windows are created with nodeIntegration: true and contextIsolation: false, a successful payload can call Node.js APIs and execute code on the host. This vulnerability is fixed in 3.7.0.
CVSS v3.1 score: 8.3
CVE-2023-31923 
Suprema BioStar 2 before 2022 Q4, v2.9.1 has Insecure Permissions. A vulnerability in the web application allows an authenticated attacker with "User Operator" privileges to create a highly privileged user account. The vulnerability is caused by missing server-side validation, which can be exploited to gain full administrator privileges on the system.
CVSS v3.1 score: 8.8
GHSA-v8vh-f89p-82w5 
A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Sequoia 15.5. An app may be able to break out of its sandbox.
CVSS v3.1 score: 8.8
GHSA-qjq7-2mhq-r456 
A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow arbitrary system file download due to lack of validation of SSL certificate.
CVSS v3.1 score: 7.5
CVE-2025-68981 WordPress HomeFix Elementor Portfolio plugin <= 1.0.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in designthemes HomeFix Elementor Portfolio homefix-ele-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HomeFix Elementor Portfolio: from n/a through <= 1.0.1.
CVSS v3.1 score: 5.3
CVE-2024-5556 SQL Injection
Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in reports module.
CVSS v3.1 score: 8.3
GHSA-78g7-jm5h-pv8q 
Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information over a network.
CVSS v3.1 score: 5.7
CVE-2025-10465 Unrestricted File Upload in Birtech Information Technologies' Sensaway
Unrestricted Upload of File with Dangerous Type vulnerability in Birtech Information Technologies Industry and Trade Ltd. Co. Sensaway allows Upload a Web Shell to a Web Server.

This issue affects Sensaway: through 09022026. NOTE: Because the product was developed using outdated technology, the manufacturer is unable to fix the relevant vulnerabilities. Users of the Sensaway application are advised to contact the manufacturer and review updated products developed with newer technology.
CVSS v3.1 score: 8.8
GHSA-m6q8-fqwc-9pp4 
Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through <= 1.0.16.
CVSS v3.1 score: 5.3
RHSA-2014:1784 Red Hat Security Advisory: python-keystoneclient security and bug fix update
python-keystoneclient: TLS certificate verification disabled
GHSA-f49q-5gxp-g34f 
The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a crafted network request.
CVSS v3.1 score: 8.1
GHSA-vg42-5gp5-qc65 
Unspecified vulnerability in the Upgrade component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.3 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.
RHSA-2018:3768 Red Hat Security Advisory: Red Hat Fuse 7.2 security update
xmlrpc: XML external entity vulnerability SSRF via a crafted DTD xmlrpc: Deserialization of untrusted Java object through <ex:serializable> tag undertow: Client can use bogus uri in Digest authentication spring-framework: ReDoS Attack with spring-messaging spring-data-commons: XXE with Spring Data’s XMLBeam integration kafka: Users can perform Broker actions via crafted fetch requests, interfering with data replication and causing data lass tomcat: A bug in the UTF-8 decoder can lead to DoS tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins ignite: Improper deserialization allows for code execution via GridClientJdkMarshaller endpoint apache-cxf: TLS hostname verification does not work correctly with com.sun.net.ssl.* camel-mail: path traversal vulnerability vertx: Improper neutralization of CRLF sequences allows remote attackers to inject arbitrary HTTP response headers
CVSS v3.0 score: 5.3
CVE-2022-32513 
A CWE-521: Weak Password Requirements vulnerability exists that could allow an attacker to gain control of the device when the attacker brute forces the password. Affected Products: C-Bus Network Automation Controller - LSS5500NAC (Versions prior to V1.10.0), Wiser for C-Bus Automation Controller - LSS5500SHAC (Versions prior to V1.10.0), Clipsal C-Bus Network Automation Controller - 5500NAC (Versions prior to V1.10.0), Clipsal Wiser for C-Bus Automation Controller - 5500SHAC (Versions prior to V1.10.0), SpaceLogic C-Bus Network Automation Controller - 5500NAC2 (Versions prior to V1.10.0), SpaceLogic C-Bus Application Controller - 5500AC2 (Versions prior to V1.10.0)
CVSS v3.1 score: 9.8
GHSA-m297-xg5f-f8hv 
Animate versions 24.0.8, 23.0.11 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1 score: 7.8
GHSA-8xg8-8x73-gmmx 
The drag-and-drop (DnD) function in VMware Workstation 12.x before version 12.5.4 and Fusion 8.x before version 8.5.5 has an out-of-bounds memory access vulnerability. This may allow a guest to execute code on the operating system that runs Workstation or Fusion.
CVSS v3.0 score: 9.9
GHSA-pjf8-cqc5-qhf8 
In \lib\admin\action\dataaction.class.php in Gxlcms v2.0, SQL Injection exists via the ids[] parameter.
CVSS v3.0 score: 9.8
CVE-2017-6973 
A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inject arbitrary code through a crafted 'action' parameter. This is fixed in 1.3.8, 2.1.2, and 2.2.2.
CVSS v3.0 score: 4.8
CVSS v2.0 score: 3.5
GHSA-pc5m-wcc8-vwh5 
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
CVSS v3.1 score: 7.8
GHSA-fvpx-c9g3-8m4p 
Multiple cross-site scripting (XSS) vulnerabilities in Interact before 2.4 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.  NOTE: this might overlap CVE-2007-3328.
CVE-2021-36875 WordPress uListing plugin <= 2.0.5 - Auth. Reflected Cross-Site Scripting (XSS) vulnerability
Cross-site Scripting (XSS) vulnerability in Stylemix Directory Listings WordPress plugin – uListing allows Reflected XSS.This issue affects Directory Listings WordPress plugin – uListing: from n/a through 2.0.5.
CVSS v3.1 score: 5.9
GHSA-244g-mc48-hxgx 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Start Booking Scheduling Plugin – Online Booking for WordPress allows Stored XSS.This issue affects Scheduling Plugin – Online Booking for WordPress: from n/a through 3.5.10.
CVSS v3.1 score: 6.5
GHSA-c49g-4rj2-vxxp 
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Contact Form plugin <= 8.0.3.1 versions.
CVSS v3.1 score: 5.4
GHSA-phf8-xfvh-mfwq 
A vulnerability in the Cisco IOx Application Framework of Cisco 809 Industrial Integrated Services Routers (Industrial ISRs), Cisco 829 Industrial ISRs, Cisco CGR 1000 Compute Module, and Cisco IC3000 Industrial Compute Gateway could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient error handling during packet processing. An attacker could exploit this vulnerability by sending a high and sustained rate of crafted TCP traffic to the IOx web server on an affected device. A successful exploit could allow the attacker to cause the IOx web server to stop processing requests, resulting in a DoS condition.
GHSA-7qmw-j6c4-f9rg 
Cross-site scripting (XSS) vulnerability in cat.php in PHP Pro Publish 2.0 allows remote attackers to inject arbitrary web script or HTML via the catname parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
GHSA-7x5p-w7r4-hq6m 
iproute2 before 5.1.0 has a use-after-free in get_netnsid_from_name in ip/ipnetns.c.
GHSA-72h4-mh2w-w3p4 
SQL injection vulnerability in index.php in the newsletter module 1.0 for KwsPHP, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the newsletter parameter.
GHSA-mcpv-3q7c-v7rr 
In affected Octopus Server versions when the server HTTP and HTTPS bindings are configured to localhost, Octopus Server will allow open redirects.
CVSS v3.1 score: 6.1
GHSA-qpv6-5r7r-m436 
Multiple unspecified vulnerabilities in the Bluetooth driver in Apple OS X before 10.10.2 allow attackers to execute arbitrary code in a privileged context via a crafted app.
GHSA-m4hg-46pw-6mmv Liferay Portal vulnerable to reflected cross-site scripting via the `redirect` parameter
Multiple reflected cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.74 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.6, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 74 through update 92 allow remote attackers to inject arbitrary web script or HTML via the `redirect` parameter to (1) Announcements, or (2) Alerts.
CVSS v4.0 score: 4.8
GHSA-hc9w-4p87-j549 Prototype Pollution in cached-path-relative
Version of `cached-path-relative` before 1.0.2 are vulnerable to prototype pollution.RecommendationUpdate to version 1.0.2 or later.
CVSS v3.1 score: 7.5
GHSA-rm22-8c83-9f9j 
Uncontrolled search path element in the Intel(R) Glorp software may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS v3.1 score: 7.8
CVE-2020-1825 
FusionAccess with versions earlier than 6.5.1.SPC002 have a Denial of Service (DoS) vulnerability. Due to insufficient verification on specific input, attackers can exploit this vulnerability by sending constructed messages to the affected device through another device on the same network. Successful exploit could cause affected devices to be abnormal.
CVSS v3.1 score: 6.5
CVSS v2.0 score: 4
GHSA-gqc2-r4w2-fgx4 
Trend Micro Security 2022 and 2021 (Consumer) is vulnerable to an Out-Of-Bounds Read Information Disclosure vulnerability that could allow an attacker to disclose sensitive information on an affected machine.
CVSS v3.1 score: 5.5
CVE-2025-67549 WordPress oik plugin <= 4.15.3 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bobbingwide oik oik allows DOM-Based XSS.This issue affects oik: from n/a through <= 4.15.3.
CVSS v3.1 score: 6.5
GHSA-q4p8-hc7g-6q5j 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Sourav All in One Slider allows Reflected XSS.This issue affects All in One Slider: from n/a through 1.1.
CVSS v3.1 score: 7.1
CVE-2026-3792 SourceCodester Sales and Inventory System GET Parameter purchase_invoice.php sql injection
A vulnerability was found in SourceCodester Sales and Inventory System 1.0. This affects an unknown part of the file purchase_invoice.php of the component GET Parameter Handler. The manipulation of the argument purchaseid results in sql injection. The attack may be performed from remote. The exploit has been made public and could be used.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 6.3
CVSS v3.0 score: 6.3
CVSS v2.0 score: 6.5
GHSA-f7wr-8w9m-h29x 
A vulnerability, which was classified as critical, has been found in CodeAstro House Rental Management System 1.0. Affected by this issue is some unknown functionality of the file signing.php. The manipulation of the argument uname/password leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-254612.
CVSS v3.1 score: 7.3
RHSA-2025:4229 Red Hat Security Advisory: thunderbird security update
thunderbird: Information Disclosure of /tmp directory listing thunderbird: Leak of hashed Window credentials via crafted attachment URL thunderbird: User Interface (UI) Misrepresentation of attachment URL
CVSS v3.1 score: 6.4
GHSA-pfg6-c632-pwgh 
The agp subsystem in the Linux kernel 2.6.38.5 and earlier does not properly restrict memory allocation by the (1) AGPIOC_RESERVE and (2) AGPIOC_ALLOCATE ioctls, which allows local users to cause a denial of service (memory consumption) by making many calls to these ioctls.
GHSA-6hpm-wr73-66xq 
in OpenHarmony v5.0.2 and prior versions allow a local attacker case DOS through missing release of memory.
CVSS v3.1 score: 3.3
GHSA-p67v-3w7g-wjg7 Nokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetime
Summary`Nokogiri::XML::XPathContext` did not keep its source document alive for garbage collection. If an `XPathContext` outlived its document and the document was collected, evaluating an XPath expression could read invalid memory and potentially segfault.This is only reachable when application code constructs an `XPathContext` directly and lets the document become unreachable while continuing to use the context. The normal `Document#xpath`, `#css`, and related search methods are not affected, and it is not triggerable by malicious document input.Nokogiri 1.19.4 makes `XPathContext` keep its source document alive for as long as the context exists.Only the CRuby implementation is affected. JRuby is not affected.SeverityThe Nokogiri maintainers have evaluated this as low severity. Reaching it requires an unusual API-usage pattern that does not arise during normal use. The application must construct an `XML::XPathContext` directly and continue using it after allowing its source document to be garbage-collected. Nokogiri 1.19.4 makes this pattern safe with no change to the public API. The context now keeps its source document alive for as long as it exists.MitigationUpgrade to Nokogiri 1.19.4 or later.As a workaround, ensure the source document remains referenced for as long as any `XPathContext` created from it is in use. The standard `Document#xpath`, `#css`, and related search methods already do this and are unaffected.CreditThis issue was responsibly reported by Zheng Yu from depthfirst.com.
CVSS v4.0 score: 1.7
CVE-2026-32860 Out-of-Bounds Write Vulnerability in NI LabVIEW when loading lvlib file
There is a memory corruption vulnerability due to an out-of-bounds write when loading a corrupted LVLIB file in NI LabVIEW.  This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted .lvlib file. This vulnerability affects NI LabVIEW 2026 Q1 (26.1.0) and prior versions.
CVSS v4.0 score: 8.5
CVSS v3.1 score: 7.8
GHSA-pw2r-vq6v-hr8c Exposure of Sensitive Information to an Unauthorized Actor in follow-redirects
Exposure of Sensitive Information to an Unauthorized Actor in NPM follow-redirects prior to 1.14.8.
CVSS v3.1 score: 5.9
GHSA-hr6c-43h9-9ghm 
GPAC MP4Box v2.4 was discovered to contain a NULL pointer dereference in the gf_isom_add_track_kind() function at isomedia/isom_write.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.
CVSS v3.1 score: 6.5
GHSA-gv7v-mf7r-p93f 
uClibc-ng through 1.0.40 and uClibc through 0.9.33.2 use predictable DNS transaction IDs that may lead to DNS cache poisoning. This is related to a reset of a value to 0x2.
CVSS v3.1 score: 6.5
GHSA-xg4r-c4j2-fcj4 
Punycode format text will be displayed for entire qualified international domain names in some instances when a sub-domain triggers the punycode display instead of the primary domain being displayed in native script and the sub-domain only displaying as punycode. This could be used for limited spoofing attacks due to user confusion. This vulnerability affects Firefox < 57.
CVSS v3.0 score: 5.3
GHSA-jhx3-3wc6-88r6 
An unspecified vulnerability in IBM Jazz Team Server may disclose some deployment information to an authenticated user.
CVSS v3.0 score: 4.3
CVE-2023-26536 WordPress Sp*tify Play Button for WordPress Plugin <= 2.05 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Jonk @ Follow me Darling Sp*tify Play Button for WordPress plugin <= 2.05 versions.
CVSS v3.1 score: 6.5
CVE-2021-41079 Apache Tomcat DoS with unexpected TLS packet
Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service.
CVSS v3.1 score: 7.5
CVSS v2.0 score: 4.3
CVE-2024-34654 
Improper Export of android application component in My Files prior to SMR Sep-2024 Release 1 allows local attackers to access files with My Files' privilege.
CVSS v3.1 score: 6.2
GHSA-w279-mj9j-w893 
In the Linux kernel, the following vulnerability has been resolved:fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_infoHold state of deferred I/O in struct fb_deferred_io_state. Allocate an
instance as part of initializing deferred I/O and remove it only after
the final mapping has been closed. If the fb_info and the contained
deferred I/O meanwhile goes away, clear struct fb_deferred_io_state.info
to invalidate the mapping. Any access will then result in a SIGBUS
signal.Fixes a long-standing problem, where a device hot-unplug happens while
user space still has an active mapping of the graphics memory. The hot-
unplug frees the instance of struct fb_info. Accessing the memory will
operate on undefined state.
CVSS v3.1 score: 7.8
ICSA-25-317-16 Siemens Altair Grid Engine
Affected products do not properly handle error messages and discloses sensitive password hash information when processing user authentication requests.
This could allow a local attacker to extract password hashes for privileged accounts, which can then be subjected to offline brute-force attacks. Affected products do not properly validate environment variables when loading shared libraries, allowing path hijacking through malicious library substitution.
This could allow a local attacker to execute arbitrary code with superuser privileges by manipulating the environment variable and placing a malicious library in the controlled path.
CVSS v3.1 score: 7.8
CVE-2026-50629 Apache CXF: OAuth2: Log Injection via Unsanitized Client Identifier
The 'clientId' parameter from incoming HTTP requests is directly concatenated into OAuth2 server log warning messages without sanitizing control characters. This allows an attacker to inject arbitrary content, including fake log entries, into the server's log files. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
CVSS v3.1 score: 5.3
CVE-2014-9186 
A file inclusion vulnerability exists in the confd.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6, and R43x before R430.2, which could lead to accepting an arbitrary file into the function, and potential information disclosure or remote code execution. Honeywell strongly encourages and recommends all customers running unsupported versions of EKPS prior to R400 to upgrade to a supported version.
CVSS v3.0 score: 9.8
CVSS v2.0 score: 7.5
CVE-2026-59861 Kiota: Code Generation Literal Injection in Kiota Ruby Generator
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.0, Kiota's Ruby generator embedded OpenAPI default fields, property names, and other schema-derived strings through CodeMethodWriter.cs and SanitizeForQuotedLiteral() in Writers/StringExtensions.cs into Ruby double-quoted literals without escaping #, allowing attacker-controlled #{expr}, #$var, or #@var interpolation markers to inject arbitrary Ruby code into generated model classes. This issue is fixed in version 1.29.1 and 1.32.0.
CVSS v3.1 score: 7.5
GHSA-4m4m-6fm5-244f 
Inappropriate implementation in Permissions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
CVSS v3.1 score: 5.4
CVE-2024-41773 IBM Global Configuration Management incorrect ownership assignment
IBM Global Configuration Management 7.0.2 and 7.0.3 could allow an authenticated user to archive a global baseline due to improper access controls.
CVSS v3.1 score: 6.5
CVE-2021-45929 
Wasm3 0.5.0 has an out-of-bounds write in CompileBlock (called from CompileElseBlock and Compile_If).
CVSS v3.1 score: 5.5
CVSS v2.0 score: 4.3
CVE-2023-48482 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS v3.1 score: 5.4
GHSA-q8cw-c873-9xh2 
Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS v3.1 score: 5.4
CVE-2017-17897 
SQL injection vulnerability in comm/multiprix.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS v3.0 score: 9.8
CVSS v2.0 score: 7.5
CVE-2014-0311 
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-0299 and CVE-2014-0305.
CVSS v2.0 score: 9.3
GHSA-cgvh-3r4w-r8v7 
An improper input validation vulnerability in loading graph file in DSP driver prior to SMR Sep-2021 Release 1 allows attackers to perform permanent denial of service on the device.
CVE-2026-0489 DOM-based Cross-Site Scripting (XSS) Vulnerability in SAP Business One (Job Service)
Due to insufficient validation of user-controlled input in the URLs query parameter. SAP Business One Job Service could allow an unauthenticated attacker to inject specially crafted input which upon user interaction could result in a DOM-based Cross-Site Scripting (XSS) vulnerability. This issue had a low impact on the confidentiality and integrity of the application with no impact on availability.
CVSS v3.1 score: 6.1
CVE-2015-3638 
phpMyBackupPro before 2.5 does not validate integer input, which allows remote authenticated users to execute arbitrary PHP code by injecting scripts via the path, filename, and period parameters to scheduled.php, and making requests to injected scripts, or by injecting PHP into a PHP configuration variable via a PHP variable variable.
CVSS v3.0 score: 8.8
CVSS v2.0 score: 6.5
GHSA-cp9w-hr4q-pmr4 
In imsservice, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed
CVSS v3.1 score: 5.5
GHSA-hhp7-p9cg-9wm2 
A stored cross site scripting (XSS) vulnerability in the "Import emails" module in phplist 3.5.4 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload.
GHSA-w4jr-ppq4-7m9m 
The mm_decode_inter function in mmvideo.c in libavcodec in FFmpeg before 1.2.1 does not validate the relationship between a horizontal coordinate and a width value, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) via crafted American Laser Games (ALG) MM Video data.
RHSA-2024:11192 Red Hat Security Advisory: libsndfile security update
libsndfile: Segmentation fault error in ogg_vorbis.c:417 vorbis_analysis_wrote()
CVSS v3.1 score: 5.5
GHSA-f8vm-5j5r-ppjw 
A vulnerability was identified in TransformerOptimus SuperAGI up to 0.0.14. Impacted is the function get_budget/update_budget of the file superagi/controllers/budget.py of the component Budget Endpoint. Such manipulation leads to authorization bypass. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0 score: 2.1
CVSS v3.1 score: 6.3
GHSA-j8g5-fv8j-f45c 
Adobe Flash Player 9.0.124.0 and earlier does not properly interpret policy files, which allows remote attackers to bypass a non-root domain policy.
CVE-2026-49172 Windows FTP Service Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows FTP Service allows an unauthorized attacker to execute code over a network.
CVSS v3.1 score: 9.8
GHSA-2r42-2m3r-837x 
PHP remote file inclusion vulnerability in addpost_newpoll.php in UBB.threads 6.4 through 6.5.2 and 6.5.1.1 (trial) allows remote attackers to execute arbitrary PHP code via a URL in the thispath parameter.
GHSA-whgg-c8ff-264h 
A vulnerability exists on all versions of Ivanti Policy Secure below 22.6R1 where an authenticated administrator can perform an arbitrary file read via a maliciously crafted web request.
CVSS v3.0 score: 4.9
GHSA-fh58-p632-fqpq 
IOGraphics in Apple OS X before 10.11 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5871, CVE-2015-5872, and CVE-2015-5890.
CVE-2021-21436 Agent is able to link customer's Config Items without permission
Agents are able to see and link Config Items without permissions, which are defined in General Catalog. This issue affects: OTRS AG OTRSCIsInCustomerFrontend 7.0.x version 7.0.14 and prior versions.
CVSS v3.1 score: 3.5
CVE-2012-2990 
The MASetupCaller ActiveX control before 1.4.2012.508 in MASetupCaller.dll in MarkAny ContentSAFER, as distributed in Samsung KIES before 2.3.2.12074_13_13, does not properly implement unspecified methods, which allows remote attackers to download an arbitrary program onto a client machine, and execute this program, via a crafted HTML document.
CVSS v2.0 score: 9.3
CVE-2025-30877 WordPress Quiz Cat plugin <= 3.0.8 - Broken Access Control vulnerability
Missing Authorization vulnerability in fatcatapps Quiz Cat quiz-cat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz Cat: from n/a through <= 3.0.8.
CVSS v3.1 score: 2.7
CVE-2025-6111 Tenda FH1205 VirtualSer fromVirtualSer stack-based overflow
A vulnerability classified as critical was found in Tenda FH1205 2.0.0.7(775). This vulnerability affects the function fromVirtualSer of the file /goform/VirtualSer. The manipulation of the argument page leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 8.7
CVSS v3.1 score: 8.8
CVSS v3.0 score: 8.8
CVSS v2.0 score: 9
CVE-2024-11672 
Incorrect authorization in the add permission component in Devolutions Remote Desktop Manager 2024.2.21 and earlier on Windows allows an authenticated malicious user to bypass the "Add" permission via the import in vault feature.
CVSS v3.1 score: 4.3
GHSA-phxq-8cx9-m597 
An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B FRN 21.2 and before. A specially crafted packet can cause a read or write operation resulting in disclosure of sensitive information, modification of settings, or modification of ladder logic. An attacker can send unauthenticated packets to trigger this vulnerability. Required Keyswitch State: REMOTE or PROG Associated Fault Code: 0012 Fault Type: Non-User Description: A fault state can be triggered by overwriting the ladder logic data file (type 0x22 number 0x02) with null values.
CVSS v3.0 score: 9.8
GHSA-7v83-4fxv-vr48 
A shell command injection vulnerability in Mobvoi Tichome Mini smart speaker 012-18853 and 027-58389 allows remote attackers to send a specially crafted UDP datagram and execute arbitrary shell code as the root account.
CVSS v3.1 score: 9.8
CVE-2004-2063 
Cross-site scripting (XSS) vulnerability in antiboard.php in AntiBoard 0.7.2 and earlier allows remote attackers to inject arbitrary HTML or web script via the feedback parameter.
CVSS v2.0 score: 4.3
CVE-2023-44261 WordPress Block Plugin Update Plugin <= 3.3 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in Dinesh Karki Block Plugin Update plugin <= 3.3 versions.
CVSS v3.1 score: 4.3
GHSA-pqcf-jf74-qjf4 
A vulnerability in the CLI of Cisco AsyncOS for Cisco Email Security Appliance (ESA) and Cisco AsyncOS for Cisco Content Security Management Appliance (SMA) could allow an authenticated, remote attacker to access sensitive information on an affected device. The vulnerability is due to excessive verbosity in certain log subscriptions. An attacker could exploit this vulnerability by accessing specific log files on an affected device. A successful exploit could allow the attacker to obtain sensitive log data, which may include user credentials. To exploit this vulnerability, the attacker would need to have valid credentials at the operator level or higher on the affected device.
GHSA-x3g5-46v3-h3q6 
The config method in Henrik Storner Hobbit monitor before 4.1.2p2 permits access to files outside of the intended configuration directory, which allows remote attackers to obtain sensitive information via requests to the hobbitd daemon on port 1984/tcp.
ICSA-17-192-03 ABB VSN300 WiFi Logger Card
By accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to access internal information about status and connected devices without authenticating.CVE-2017-7920 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The web application does not properly restrict privileges of the Guest account. A malicious user may be able to gain access to configuration information that should be restricted.CVE-2017-7916 has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
CVSS v3.0 score: 6.5
GHSA-5c63-m98j-vx6v 
An XSS issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. The widthheight, widthheightpage, and nbytes properties of messages are not escaped when used in galleries or Special:RevisionDelete.
CVSS v3.1 score: 6.1
GHSA-jq82-jqvw-64w3 
telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer dereference via 0xff 0xf7 or 0xff 0xf8. In a typical installation, the telnetd application would crash but the telnet service would remain available through inetd. However, if the telnetd application has many crashes within a short time interval, the telnet service would become unavailable after inetd logs a "telnet/tcp server failing (looping), service terminated" error. NOTE: MIT krb5-appl is not supported upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT Kerberos 5 (aka krb5) product many years ago, at version 1.8.
CVSS v3.1 score: 7.5
GHSA-5f9x-4h79-7fqp 
A vulnerability in the command line interface of Access Points running AOS-10 and AOS-8 Instant could allow an authenticated remote attacker to execute system commands in a restricted shell environment. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
CVSS v3.1 score: 7.2
GHSA-2m9x-v8g8-3x2j 
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in OceanWP Ocean Extra plugin <= 2.1.2 versions.
CVSS v3.1 score: 5.4
CVE-2018-19415 
Multiple SQL injection vulnerabilities in Plikli CMS 4.0.0 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to join_group.php or (2) comment_id parameter to story.php.
CVSS v3.0 score: 9.8
CVSS v2.0 score: 7.5
CVE-2026-33693 Lemmy's Activitypub-Federation has SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4_is_invalid()
Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.7.0-beta.9, the `v4_is_invalid()` function in `activitypub-federation-rust` (`src/utils.rs`) does not check for `Ipv4Addr::UNSPECIFIED` (0.0.0.0). An unauthenticated attacker controlling a remote domain can point it to 0.0.0.0, bypass the SSRF protection introduced by the fix for CVE-2025-25194 (GHSA-7723-35v7-qcxw), and reach localhost services on the target server. Version 0.7.0-beta.9 patches the issue.
CVSS v3.1 score: 6.5
CVE-2016-4406 
A remote cross site scripting vulnerability was identified in HPE iLO 3 all version prior to v1.88 and HPE iLO 4 all versions prior to v2.44.
CVSS v3.0 score: 6.1
CVSS v2.0 score: 4.3
GHSA-2wr8-7p4f-4m6x 
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUJobDefinitions Get method requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Was ZDI-CAN-4316.
CVSS v3.0 score: 9.8
CVE-2020-19961 
A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the component subzs.php.
CVSS v3.1 score: 7.5
CVSS v2.0 score: 5
GHSA-xfw4-xc98-9hr6 
Unspecified vulnerability in the Oracle Explorer (Sun Explorer) component in Oracle Sun Products Suite 6.4 allows local users to affect confidentiality and integrity via unknown vectors.
RHSA-2024:2410 Red Hat Security Advisory: harfbuzz security update
harfbuzz: allows attackers to trigger O(n^2) growth via consecutive marks
CVSS v3.1 score: 7.5
CVE-2025-2277 
Exposure of password in web-based SSH authentication component in Devolutions Server 2024.3.13 and earlier allows a user to unadvertently leak his SSH password due to missing password masking.
CVSS v3.1 score: 7.5
GHSA-vv3m-f5v5-qh9p 
A vulnerability was found in Hindu Matrimonial Script. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/usermanagement.php. The manipulation leads to improper privilege management. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v3.1 score: 8.8
RHSA-2024:0960 Red Hat Security Advisory: thunderbird security update
Mozilla: Out-of-bounds memory read in networking channels Mozilla: Alert dialog could have been spoofed on another site Mozilla: Fullscreen Notification could have been hidden by select element Mozilla: Custom cursor could obscure the permission dialog Mozilla: Mouse cursor re-positioned unexpectedly could have led to unintended permission grants Mozilla: Multipart HTTP Responses would accept the Set-Cookie header in response parts Mozilla: Incorrect code generation on 32-bit ARM devices Mozilla: Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8
CVSS v3.1 score: 7.5
GHSA-qvqj-pfj9-vcvw 
Session fixation vulnerability in Drupal 5.x before 5.9 and 6.x before 6.3, when contributed modules "terminate the current request during a login event," allows remote attackers to hijack web sessions via unknown vectors.
GHSA-h9xh-g5pc-79x3 
The The Shortcode Ajax plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
CVSS v3.1 score: 5.4
GHSA-wq8j-qvfr-hj44 
A vulnerability, which was classified as critical, has been found in SeaCMS up to 13.3. This issue affects some unknown processing of the file /admin_link.php?action=delall. The manipulation of the argument e_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 5.1
CVSS v3.1 score: 4.7
CVE-2022-50935 FLAME II MODEM USB - Unquoted Service Path
Flame II HSPA USB Modem contains an unquoted service path vulnerability in its Windows service configuration. Attackers can exploit the unquoted path in 'C:\Program Files (x86)\Internet Telcel\ApplicationController.exe' to execute arbitrary code with elevated system privileges.
CVSS v4.0 score: 8.5
CVSS v3.1 score: 9.8
GHSA-c2p4-8mvv-rwmv Apache Karaf vulnerable to potential code injection
This vulnerability is about a potential code injection when an attacker has control of the target LDAP server using in the JDBC JNDI URL. The function `jaas.modules.src.main.java.porg.apache.karaf.jass.modules.jdbc.JDBCUtils#doCreateDatasource` uses `InitialContext.lookup(jndiName)` without filtering. A user can modify `options.put(JDBCUtils.DATASOURCE, "osgi:" + DataSource.class.getName());` to `options.put(JDBCUtils.DATASOURCE,"jndi:rmi://x.x.x.x:xxxx/Command");` in `JdbcLoginModuleTest#setup`. This is vulnerable to a remote code execution (RCE) attack when a configuration uses a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue affects all versions of Apache Karaf up to 4.4.1 and 4.3.7. Maintainers encourage the users to upgrade to at least Apache Karaf versions 4.4.2 or 4.3.8.
CVSS v3.1 score: 9.8
CVE-2016-10365 
Kibana versions before 4.6.3 and 5.0.1 have an open redirect vulnerability that would enable an attacker to craft a link in the Kibana domain that redirects to an arbitrary website.
CVSS v3.0 score: 6.1
CVSS v2.0 score: 5.8
GHSA-9mf6-h5qw-3r5p 
In the Linux kernel, the following vulnerability has been resolved:drm/msm/gpu: Fix crash when throttling GPU immediately during bootThere is a small chance that the GPU is already hot during boot. In that
case, the call to of_devfreq_cooling_register() will immediately try to
apply devfreq cooling, as seen in the following crash:Unable to handle kernel paging request at virtual address 0000000000014110
  pc : a6xx_gpu_busy+0x1c/0x58 [msm]
  lr : msm_devfreq_get_dev_status+0xbc/0x140 [msm]
  Call trace:
   a6xx_gpu_busy+0x1c/0x58 [msm] (P)
   devfreq_simple_ondemand_func+0x3c/0x150
   devfreq_update_target+0x44/0xd8
   qos_max_notifier_call+0x30/0x84
   blocking_notifier_call_chain+0x6c/0xa0
   pm_qos_update_target+0xd0/0x110
   freq_qos_apply+0x3c/0x74
   apply_constraint+0x88/0x148
   __dev_pm_qos_update_request+0x7c/0xcc
   dev_pm_qos_update_request+0x38/0x5c
   devfreq_cooling_set_cur_state+0x98/0xf0
   __thermal_cdev_update+0x64/0xb4
   thermal_cdev_update+0x4c/0x58
   step_wise_manage+0x1f0/0x318
   __thermal_zone_device_update+0x278/0x424
   __thermal_cooling_device_register+0x2bc/0x308
   thermal_of_cooling_device_register+0x10/0x1c
   of_devfreq_cooling_register_power+0x240/0x2bc
   of_devfreq_cooling_register+0x14/0x20
   msm_devfreq_init+0xc4/0x1a0 [msm]
   msm_gpu_init+0x304/0x574 [msm]
   adreno_gpu_init+0x1c4/0x2e0 [msm]
   a6xx_gpu_init+0x5c8/0x9c8 [msm]
   adreno_bind+0x2a8/0x33c [msm]
   ...At this point we haven't initialized the GMU at all yet, so we cannot read
the GMU registers inside a6xx_gpu_busy(). A similar issue was fixed before
in commit 6694482a70e9 ("drm/msm: Avoid unclocked GMU register access in
6xx gpu_busy"): msm_devfreq_init() does call devfreq_suspend_device(), but
unlike msm_devfreq_suspend(), it doesn't set the df->suspended flag
accordingly. This means the df->suspended flag does not match the actual
devfreq state after initialization and msm_devfreq_get_dev_status() will
end up accessing GMU registers, causing the crash.Fix this by setting df->suspended correctly during initialization.Patchwork: https://patchwork.freedesktop.org/patch/650772/
CVSS v3.1 score: 5.5
GHSA-8hgf-mr3f-26cc 
In onCreate of DevicePickerFragment.java, there is a possible way to trick the user to select an unwanted bluetooth device due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-182584940