CIRCL/vulnerability-scores huggingface dataset:
CVE-2024-47358 WordPress Popup Maker plugin <= 1.19.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in Daniel Iser Popup Maker popup-maker.This issue affects Popup Maker: from n/a through <= 1.19.2.
CVSS v3.1 score: 5.3
CVE-2013-5183 
Mail in Apple Mac OS X before 10.9, when Kerberos authentication is enabled and TLS is disabled, sends invalid cleartext data, which allows remote attackers to obtain sensitive information by sniffing the network.
CVSS v2.0 score: 2.6
GHSA-pv3h-4rg2-wc98 
OTFCC v0.10.4 was discovered to contain a heap-buffer overflow via /release-x64/otfccdump+0x6c08a6.
CVSS v3.1 score: 6.5
CVE-2025-7227 INVT VT-Designer PM3 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
INVT VT-Designer PM3 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of INVT VT-Designer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PM3 files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25550.
CVSS v3.0 score: 7.8
GHSA-g982-9r8g-6qxw Ciborg gem for Ruby allows local users to write files and gain privileges via Symlink
There is a /tmp file race condition in `chef/travis-cookbooks/ci_environment/perlbrew/recipes/default.rb` in the ciborg gem 3.0.0 when creating `/tmp/perlbrew-installer`. If a malicious local user creates the file first they can overwrite the contents with their own code executing it as the ciborg process owner.
CVSS v3.0 score: 5.5
GHSA-px78-549m-fc45 
The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read.
CVSS v3.1 score: 5.9
GHSA-vxmv-r24r-j66w 
Roothub v2.6 was discovered to contain a SQL injection vulnerability via the nodeTitle parameter in the parentNode() function..
CVSS v3.1 score: 9.8
GHSA-m529-gcjc-wm6j 
Cross-site scripting (XSS) vulnerability in the Max Foundry MaxButtons plugin before 1.26.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter in a button action on the maxbuttons-controller page to wp-admin/admin.php, related to the button creation page.
CVE-2020-1873 
NIP6800;Secospace USG6600;USG9500 products with versions of V500R001C30; V500R001C60SPC500; V500R005C00SPC100 have an out-of-bounds read vulnerability. An unauthenticated attacker crafts malformed message with specific parameter and sends the message to the affected products. Due to insufficient validation of message, which may be exploited to cause the device reboot.
CVSS v3.1 score: 7.5
CVSS v2.0 score: 7.8
RHSA-2014:0135 Red Hat Security Advisory: java-1.6.0-ibm security update
OpenJDK: jarsigner does not detect unsigned bytecode injected into signed jars OpenJDK: null xmlns handling issue (Security, 8025026) OpenJDK: insufficient security checks in CORBA stub factories (CORBA, 8026193) JDK: unspecified vulnerability fixed in 6u71 and 7u51 (Deployment) JDK: unspecified vulnerability fixed in 6u71 and 7u51 (Deployment) JDK: unspecified vulnerability fixed in 6u71 and 7u51 (Deployment) OpenJDK: com.sun.corba.se. should be restricted package (CORBA, 8025022) JDK: unspecified vulnerability fixed in 6u71 and 7u51 (Deployment) JDK: unspecified vulnerability fixed in 6u71 and 7u51 (Deployment) ICU: Layout Engine LookupProcessor insufficient input checks (JDK 2D, 8025034) OpenJDK: XML canonicalizer mutable strings passed to untrusted code (Security, 8026417) OpenJDK: insufficient Socket checkListen checks (Networking, 8011786) OpenJDK: SnmpStatusException handling issues (Serviceability, 7068126) JDK: unspecified vulnerability fixed in 6u71 and 7u51 (Deployment) OpenJDK: document builder missing security checks (JAXP, 8027201, 8025018) JDK: unspecified vulnerability fixed in 6u71 and 7u51 (Deployment) JDK: unspecified vulnerability fixed in 6u71 and 7u51 (Deployment) JDK: unspecified vulnerability fixed in 6u71 and 7u51 (Deployment) OpenJDK: TLS/SSL handshake timing issues (JSSE, 8023069) JDK: unspecified vulnerability fixed in 6u71 and 7u51 (Deployment) OpenJDK: insecure subject principals set handling (JAAS, 8024306) JDK: unspecified vulnerability fixed in 5.0u71, 6u71 and 7u51 (2D) OpenJDK: insufficient package access checks in the Naming component (JNDI, 8025758) OpenJDK: XXE issue in decoder (Beans, 8023245) JDK: unspecified vulnerability fixed in 6u71 and 7u51 (Deployment) OpenJDK: insufficient security checks in IIOP streams (CORBA, 8025767)
RHSA-2023:7253 Red Hat Security Advisory: dotnet8.0 security update
dotnet: Arbitrary File Write and Deletion Vulnerability: FormatFtpCommand dotnet: ASP.NET Security Feature Bypass Vulnerability in Blazor forms
CVSS v3.1 score: 5.5
GHSA-hwr4-fpqc-f4wf 
A command injection vulnerability exists in the Xiaomi Router AX3600. The vulnerability is caused by a lack of inspection for incoming data detection. Attackers can exploit this vulnerability to execute code.
CVSS v3.1 score: 7.8
CVE-2022-50176 drm/mcde: Fix refcount leak in mcde_dsi_bind
In the Linux kernel, the following vulnerability has been resolved:

drm/mcde: Fix refcount leak in mcde_dsi_bind

Every iteration of for_each_available_child_of_node() decrements
the reference counter of the previous node. There is no decrement
when break out from the loop and results in refcount leak.
Add missing of_node_put() to fix this.
CVSS v3.1 score: 5.5
CVE-2023-21307 
In Bluetooth, there is a possible way for a paired Bluetooth device to access a long term identifier for an Android device due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.
CVSS v3.1 score: 5
CVE-2023-30054 
TOTOLINK A7100RU V7.4cu.2313_B20191024 has a Command Injection vulnerability. An attacker can obtain a stable root shell through a specially constructed payload.
CVSS v3.1 score: 9.8
GHSA-3wvw-x258-gj48 
home 5G HR02 and Wi-Fi STATION SH-54C contain an OS command injection vulnerability in the configuration restore function. An arbitrary OS command may be executed with the root privilege by an administrative user.
CVSS v3.0 score: 7.2
CVE-2023-39338 
Enables an authenticated user (enrolled device) to access a service protected by Sentry even if they are not authorized according to the sentry policy to access that service. It does not enable the user to authenticate to or use the service, it just provides the tunnel access.
CVSS v3.0 score: 6.8
CVE-2014-0139 
cURL and libcurl 7.1 before 7.36.0, when using the OpenSSL, axtls, qsossl or gskit libraries for TLS, recognize a wildcard IP address in the subject's Common Name (CN) field of an X.509 certificate, which might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.
CVSS v2.0 score: 5.8
GHSA-74f7-fgmv-4c5m 
On Xerox WorkCentre 3550 25.003.03.000 devices, an authenticated attacker can view the SMB server settings and can obtain the stored cleartext credentials associated with those settings.
CVSS v3.1 score: 6.5
RHSA-2023:5725 Red Hat Security Advisory: OpenJDK 8u392 Security Update for Portable Linux Builds
OpenJDK: segmentation fault in ciMethodBlocks OpenJDK: IOR deserialization issue in CORBA (8303384) OpenJDK: certificate path validation issue during client authentication (8309966)
CVSS v3.1 score: 5.3
CVE-2024-39926 
An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3. A stored cross-site scripting (XSS) or, due to the default CSP, HTML injection vulnerability has been discovered in the admin dashboard. This potentially allows an authenticated attacker to inject malicious code into the dashboard, which is then executed or rendered in the context of an administrator's browser when viewing the injected content. However, it is important to note that the default Content Security Policy (CSP) of the application blocks most exploitation paths, significantly mitigating the potential impact.
CVSS v3.1 score: 5.4
CVE-2021-30579 
Use after free in UI framework in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS v3.1 score: 8.8
CVSS v2.0 score: 6.8
GHSA-cr39-25j5-rxg9 
Uncontrolled resource consumption for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an authenticated user to potentially enable denial of service via adjacent access.
CVSS v4.0 score: 5.1
CVSS v3.1 score: 3.5
GHSA-8h27-9qvf-3872 
An improper access control vulnerability [CWE-284] in FortiOS versions 6.2.0 through 6.2.11, 6.4.0 through 6.4.8 and 7.0.0 through 7.0.5 may allow an authenticated attacker with a restricted user profile to gather the checksum information about the other VDOMs via CLI commands.
CVSS v3.1 score: 4.3
GHSA-c9q2-5c67-xg9p 
A heap buffer overflow could occur in the DTLS 1.3 ACK serialization path before the connecting peer is authenticated. The buffer overflow was due to an integer truncation when computing the length of the ACK record-number list, causing an undersized buffer to be allocated and then overrun. This affects builds using DTLS 1.3 and wolfSSL version 5.9.0 and earlier. A fix was added to the 5.9.1 release.
CVSS v4.0 score: 8.8
CVSS v3.1 score: 7.5
GHSA-w682-79hv-gcr8 
The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not have CSRF check in place when resetting its settings, which could allow attackers to make a logged in admin reset them via a CSRF attack
CVSS v3.1 score: 5.5
GHSA-q2m8-r9h2-3g88 
Rejected reason: Not used
GHSA-vfxc-vmpj-497v 
Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database potentially leading to complete compromise of the ClearPass Policy Manager cluster in Aruba ClearPass Policy Manager version(s): 6.10.x: 6.10.6 and below; 6.9.x: 6.9.11 and below. Aruba has released upgrades for Aruba ClearPass Policy Manager that address these security vulnerabilities.
CVSS v3.1 score: 8.8
CVE-2025-51398 
A stored cross-site scripting (XSS) vulnerability in the Facebook registration page of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter.
CVSS v3.1 score: 5.4
CVE-2024-51669 WordPress Dynamic Widgets plugin <= 1.6.4 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Kalmang Dynamic Widgets dynamic-widgets.This issue affects Dynamic Widgets: from n/a through <= 1.6.4.
CVSS v3.1 score: 4.3
GHSA-45hv-pr9g-v4j2 
In gpu driver, there is a possible out of bounds write due to a incorrect bounds check. This could lead to local denial of service with System execution privileges needed
CVSS v3.1 score: 4.4
RHSA-2025:21371 Red Hat Security Advisory: Red Hat build of Keycloak 26.4.4 Images Security Update
org.keycloak/keycloak-quarkus-server: Unable to restrict access to the admin console keycloak-server: Debug default bind address keycloak: org.keycloak:keycloak-services: User can refresh offline session even after client's offline_access scope was removed org.keycloak/keycloak-services: WebAuthn Attestation Statement Verification Bypass org.keycloak.protocol.oidc.endpoints.LogoutEndpoint: Offline Session takeover due to reused Authentication Session ID
CVSS v3.1 score: 6
GHSA-7r4x-ff5h-ghvg 
A vulnerability, which was classified as problematic, was found in iteaj iboot 物联网网关 1.1.3. This affects an unknown part of the file /core/admin/pwd of the component Admin Password Handler. The manipulation of the argument ID leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 4.3
GHSA-2g3f-73vr-7c76 
Dell Grab for Windows, versions 5.0.4 and below, contains an improper file permissions vulnerability. A locally authenticated attacker could potentially exploit this vulnerability, leading to the information disclosure of certain system information.
CVSS v3.1 score: 5.5
GHSA-6wfh-89q8-44jq TensorFlow has null dereference on ParallelConcat with XLA
ImpactWhen running with XLA, `tf.raw_ops.ParallelConcat` segfaults with a nullptr dereference when given a parameter `shape` with rank that is not greater than zero.PatchesWe have patched the issue in GitHub commit [da66bc6d5ff466aee084f9e7397980a24890cd15](https://github.com/tensorflow/tensorflow/commit/da66bc6d5ff466aee084f9e7397980a24890cd15).The fix will be included in TensorFlow 2.12. We will also cherrypick this commit on TensorFlow 2.11.1.For more informationPlease consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.AttributionThis vulnerability has been reported by r3pwnx of 360 AIVul Team
CVSS v3.1 score: 7.5
GHSA-3wmx-fc2q-p8g5 
A vulnerability in the Link Layer Discovery Protocol (LLDP) implementation for Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition when the device unexpectedly reloads. The vulnerability is due to improper input validation of certain type, length, value (TLV) fields of the LLDP frame header. An attacker could exploit this vulnerability by sending a crafted LLDP packet to an interface on the targeted device. A successful exploit could allow the attacker to cause the switch to reload unexpectedly.
CVSS v3.0 score: 5.3
GHSA-hq4g-8jp3-v42r 
In the Linux kernel, the following vulnerability has been resolved:media: pvrusb2: fix uaf in pvr2_context_set_notify[Syzbot reported]
BUG: KASAN: slab-use-after-free in pvr2_context_set_notify+0x2c4/0x310 drivers/media/usb/pvrusb2/pvrusb2-context.c:35
Read of size 4 at addr ffff888113aeb0d8 by task kworker/1:1/26CPU: 1 PID: 26 Comm: kworker/1:1 Not tainted 6.8.0-rc1-syzkaller-00046-gf1a27f081c1f #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
Workqueue: usb_hub_wq hub_event
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:377 [inline]
 print_report+0xc4/0x620 mm/kasan/report.c:488
 kasan_report+0xda/0x110 mm/kasan/report.c:601
 pvr2_context_set_notify+0x2c4/0x310 drivers/media/usb/pvrusb2/pvrusb2-context.c:35
 pvr2_context_notify drivers/media/usb/pvrusb2/pvrusb2-context.c:95 [inline]
 pvr2_context_disconnect+0x94/0xb0 drivers/media/usb/pvrusb2/pvrusb2-context.c:272Freed by task 906:
kasan_save_stack+0x33/0x50 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
kasan_save_free_info+0x3f/0x60 mm/kasan/generic.c:640
poison_slab_object mm/kasan/common.c:241 [inline]
__kasan_slab_free+0x106/0x1b0 mm/kasan/common.c:257
kasan_slab_free include/linux/kasan.h:184 [inline]
slab_free_hook mm/slub.c:2121 [inline]
slab_free mm/slub.c:4299 [inline]
kfree+0x105/0x340 mm/slub.c:4409
pvr2_context_check drivers/media/usb/pvrusb2/pvrusb2-context.c:137 [inline]
pvr2_context_thread_func+0x69d/0x960 drivers/media/usb/pvrusb2/pvrusb2-context.c:158[Analyze]
Task A set disconnect_flag = !0, which resulted in Task B's condition being met
and releasing mp, leading to this issue.[Fix]
Place the disconnect_flag assignment operation after all code in pvr2_context_disconnect()
to avoid this issue.
CVSS v3.1 score: 6.4
CVE-2025-11322 Mangati NovoSGA User Creation new weak password
A flaw has been found in Mangati NovoSGA up to 2.2.12. The impacted element is an unknown function of the file /novosga.users/new of the component User Creation Page. Executing manipulation of the argument Senha/Confirmação da senha can lead to weak password requirements. The attack can be launched remotely. Attacks of this nature are highly complex. The exploitability is regarded as difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0 score: 6.3
CVSS v3.1 score: 3.7
CVSS v3.0 score: 3.7
CVSS v2.0 score: 2.6
CVE-2022-3924 named configured to answer from stale cache may terminate unexpectedly at recursive-clients soft quota
This issue can affect BIND 9 resolvers with `stale-answer-enable yes;` that also make use of the option `stale-answer-client-timeout`, configured with a value greater than zero.

If the resolver receives many queries that require recursion, there will be a corresponding increase in the number of clients that are waiting for recursion to complete. If there are sufficient clients already waiting when a new client query is received so that it is necessary to SERVFAIL the longest waiting client (see BIND 9 ARM `recursive-clients` limit and soft quota), then it is possible for a race to occur between providing a stale answer to this older client and sending an early timeout SERVFAIL, which may cause an assertion failure.
This issue affects BIND 9 versions 9.16.12 through 9.16.36, 9.18.0 through 9.18.10, 9.19.0 through 9.19.8, and 9.16.12-S1 through 9.16.36-S1.
CVSS v3.1 score: 7.5
GHSA-3pm6-mjgp-f4mr 
A vulnerability was found in PHPGurukul Nipah Virus Testing Management System 1.0 and classified as critical. This issue affects some unknown processing of the file login.php. The manipulation of the argument username leads to sql injection. The attack may be initiated remotely. The identifier VDB-243617 was assigned to this vulnerability.
CVSS v3.0 score: 7.3
GHSA-x9rv-39rr-f53c 
An issue was discovered in GNU Hurd before 0.9 20210404-9. libports accepts fake notification messages from any client on any port, which can lead to port use-after-free. This can be exploited for local privilege escalation to get full root access.
CVE-2022-29892 
Improper input validation vulnerability in Space of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to repeatedly display errors in certain functions and cause a denial-of-service (DoS).
CVSS v3.1 score: 6.5
CVSS v2.0 score: 4
GHSA-62pj-m994-qpwg 
The JavaScript engine in Mozilla Firefox 3.x before 3.0.9, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.16 allows remote attackers to cause a denial of service (application crash) and possibly trigger memory corruption via vectors involving (1) js_FindPropertyHelper, related to the definitions of Math and Date; and (2) js_CheckRedeclaration.
GHSA-24qp-4xx8-3jvj Cilium East-west traffic not subject to egress policy enforcement for requests via Gateway API load balancers
ImpactFor Cilium users who:Use Gateway API for Ingress for some services **AND**Use [LB-IPAM](https://docs.cilium.io/en/stable/network/lb-ipam/) or BGP for LB Service implementation **AND**Use network policies to block egress traffic from workloads in a namespace to workloads in other namespacesEgress traffic from workloads covered by such network policies to LoadBalancers configured by `Gateway` resources will incorrectly be allowed.LoadBalancer resources not deployed via a Gateway API configuration are not affected by this issue.PatchesThis issue was fixed by https://github.com/cilium/proxy/pull/1172.This issue affects:Cilium v1.15 between v1.15.0 and v1.15.14 inclusiveCilium v1.16 between v1.16.0 and v1.16.7 inclusiveCilium v1.17 between v1.17.0 and v1.17.1 inclusiveThis issue is fixed in:Cilium v1.15.15Cilium v1.16.8Cilium v1.17.2WorkaroundsA Clusterwide Cilium Network Policy can be used to work around this issue for users who are unable to upgrade. An outline of such a policy is provided below:The policy opens up connectivity from all locations outside the cluster into the Cilium Ingress Gateway.The policy establishes a default deny for all other traffic towards the Cilium Ingress Gateway, including all in-cluster sources.It is possible to tailor the policy to more narrowly allow inbound traffic while creating a default deny posture for traffic between namespaces. Users should edit the policy to bring it in line with the security requirements particular to their environments.AcknowledgementsThe Cilium community has worked together with members of the Isovalent team to prepare these mitigations. Special thanks to @jrajahalme for the fix.For more informationIf you think you have found a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at [security@cilium.io](mailto:security@cilium.io). This is a private mailing list for the Cilium security team, and your report will be treated as top priority.
CVSS v3.1 score: 3.2
CVE-2018-15386 Cisco Digital Network Architecture Center Unauthenticated Access Vulnerability
A vulnerability in Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated, remote attacker to bypass authentication and have direct unauthorized access to critical management functions. The vulnerability is due to an insecure default configuration of the affected system. An attacker could exploit this vulnerability by directly connecting to the exposed services. An exploit could allow the attacker to retrieve and modify critical system files.
CVSS v3.1 score: 9.8
CVSS v2.0 score: 7.5
GHSA-5j2v-qvwv-54xv 
Multiple cross-site request forgery (CSRF) vulnerabilities in the Newsletter Manager plugin 1.0.2 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change an email address or (2) conduct script insertion attacks.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
GHSA-j3gx-p9r2-3cwr 
Cross Site Request Forgery (CSRF) vulnerability exists in the 'pvmsg.php?action=add_message', pvmsg.php?action=confirm_delete , and ajax.server.php?page=user&action=flip_follow endpoints in Ampache <= 6.6.0.
CVSS v3.1 score: 8.8
GHSA-hh3x-m3cp-4mr9 
The Yell Local Search (aka com.yell.launcher2) application 4.2.1.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
GHSA-pwmv-qpch-986c 
Integer overflow in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS v3.1 score: 8.8
GHSA-772j-g7pw-69xq 
Cross-site scripting (XSS) vulnerability in (1) uploads.php and (2) "url links" in PmWiki 2.1.6 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
GHSA-67c2-9w2r-cg77 
Buffer overflow in unpack200 in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier, and 6 Update 12 and earlier, allows remote attackers to access files or execute arbitrary code via a JAR file with crafted Pack200 headers.
CVE-2025-26673 Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability
Uncontrolled resource consumption in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to deny service over a network.
CVSS v3.1 score: 7.5
GHSA-4v4p-87m3-5423 Known v1.3.1 contains Insecure Direct Object Reference
Known v1.3.1 was discovered to contain an Insecure Direct Object Reference (IDOR).The researcher report indicates that versions 1.3.1 and prior are vulnerable. Version 1.2.2 is the last version tagged on GitHub and in Packagist, and development related to the 1.3.x branch is currently on the `dev` branch of the idno/known repository.
CVSS v3.1 score: 4.3
GHSA-xv6q-7929-hxjr 
In savePhotoFromUriToUri of ContactPhotoUtils.java in Android-7.0, Android-7.1.1, Android-7.1.2, Android-8.0, Android-8.1 and Android-9, there is possible unauthorized access to files within the contact app due to a confused deputy scenario. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Android ID: A-113597344.
CVSS v3.0 score: 7.3
GHSA-vp8v-gjj6-f34x 
In the Linux kernel, the following vulnerability has been resolved:ipv4: icmp: fix null-ptr-deref in icmp_build_probe()ipv6_stub->ipv6_dev_find() may return ERR_PTR(-EAFNOSUPPORT) when the
IPv6 stack is not active (CONFIG_IPV6=m and not loaded), and passing
this error pointer to dev_hold() will cause a kernel crash with
null-ptr-deref.Instead, silently discard the request. RFC 8335 does not appear to
define a specific response for the case where an IPv6 interface
identifier is syntactically valid but the implementation cannot perform
the lookup at runtime, and silently dropping the request may safer than
misreporting "No Such Interface".
CVSS v3.1 score: 7.5
GHSA-3q47-272x-vrfj 
The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15. An application may be able to read restricted memory.
CVSS v3.1 score: 7.5
GHSA-c2j7-66m3-r4ff JSPUI's "Internal System Error" page prints exceptions and stack traces without sanitization
ImpactWhen an "Internal System Error" occurs in the JSPUI, then entire exception (including stack trace) is available. Information in this stacktrace may be useful to an attacker in launching a more sophisticated attack.  This vulnerability only impacts the JSPUI._This vulnerability does NOT impact the XMLUI or 7.x._Patches_DSpace 6.x:_Fixed in 6.4 via commit: https://github.com/DSpace/DSpace/commit/afcc6c3389729b85d5c7b0230cbf9aaf7452f31a6.x patch file: https://github.com/DSpace/DSpace/commit/afcc6c3389729b85d5c7b0230cbf9aaf7452f31a.patch (may be applied manually if an immediate upgrade to 6.4 or above is not possible)_DSpace 5.x:_The 6.x patch file can also be applied to an older 5.x installation.Alternatively, you can simply apply the workaround documented below.  The detailed error information embedded in `internal.jsp` is not necessary for the JSPUI to function.Apply the patch to your DSpaceIf at all possible, we recommend upgrading your DSpace site based on the upgrade instructions. However, if you are unable to do so, you can manually apply the above patches as follows:Download the appropriate patch file to the machine where DSpace is runningFrom the `[dspace-src]` folder, apply the patch, e.g. `git apply [name-of-file].patch`Now, update your DSpace site (based loosely on the Upgrade instructions). This generally involves three steps:Rebuild DSpace, e.g. `mvn -U clean package`  (This will recompile all DSpace code)Redeploy DSpace, e.g. `ant update`  (This will copy all updated WARs / configs to your installation directory). Depending on your setup you also may need to copy the updated WARs over to your Tomcat webapps folder.Restart TomcatWorkaroundsThe detailed error information embedded in `internal.jsp` is not necessary for the JSPUI to function.  Because this error information is also available in the `dspace.log` files, it does not need to be displayed in `internal.jsp`.Modify your `internal.jsp`, and disable the display of the error message. This is most easily done by setting the returned exception to "null" at all times.  For example, add a new line between line number 43 and 44ReferencesDiscovered & reported by Ozkan Erdogan (Brunel University London)For more informationIf you have any questions or comments about this advisory:Email us at security@dspace.org
CVSS v3.1 score: 5.3
GHSA-8crg-fp2w-xqgv 
Honeywell S35 Series Cameras contains an authorization bypass Vulnerability through User controller key. An attacker could potentially exploit this vulnerability, leading to Privilege Escalation to admin privileged functionalities . Honeywell also recommends updating to the most recent version of this product, service or offering (S35 Pinhole/Kit Camera to version 2025.08.28, S35 AI Fisheye & Dual Sensor/Micro Dome/Full Color Eyeball & Bullet Camera to version 2025.08.22, S35 Thermal Camera to version 2025.08.26).
CVSS v3.1 score: 6.8
GHSA-m8r2-hpvv-53w3 
The Newsletter Subscriptions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'token_type' parameter in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS v3.1 score: 6.1
GHSA-q833-5r3h-2vq9 
A potential security vulnerability has been identified in the system BIOS for certain HP Workstation PCs, which might allow escalation of privilege, arbitrary code execution, or denial of service. HP is releasing mitigation for the potential vulnerability.
CVSS v3.1 score: 7.9
CVE-2010-2762 
The XPCSafeJSObjectWrapper class in the SafeJSObjectWrapper (aka SJOW) implementation in Mozilla Firefox 3.6.x before 3.6.9 and Thunderbird 3.1.x before 3.1.3 does not properly restrict objects at the end of scope chains, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via vectors related to a chrome privileged object and a chain ending in an outer object.
CVSS v2.0 score: 6.8
CVE-2010-0307 
The load_elf_binary function in fs/binfmt_elf.c in the Linux kernel before 2.6.32.8 on the x86_64 platform does not ensure that the ELF interpreter is available before a call to the SET_PERSONALITY macro, which allows local users to cause a denial of service (system crash) via a 32-bit application that attempts to execute a 64-bit application and then triggers a segmentation fault, as demonstrated by amd64_killer, related to the flush_old_exec function.
CVSS v2.0 score: 4.7
CVE-2025-61481 
An issue in MikroTik RouterOS v.7.14.2 and SwOS v.2.18 exposes the WebFig management interface over cleartext HTTP by default, allowing an on-path attacker to execute injected JavaScript in the administrator’s browser and intercept credentials.
CVSS v3.1 score: 10
CVE-2021-34972 Foxit PDF Reader AcroForm Use-After-Free Information Disclosure Vulnerability
Foxit PDF Reader AcroForm Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the processing of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-14975.
CVSS v3.0 score: 3.3
CVE-2007-1041 
Multiple stack-based buffer overflows in S&H Computer Systems News Rover 12.1 Rev 1 allow remote attackers to execute arbitrary code via a .nzb file with a long (1) group or (2) subject string.
CVSS v2.0 score: 9.3
GHSA-f8h9-v582-wc52 
A buffer overflow vulnerability in Formats!ReadRAS_W+0x1001 of Irfanview 4.57 allows attackers to execute arbitrary code via a crafted RLE file.
GHSA-8862-mgcq-cgrw 
In the Linux kernel, the following vulnerability has been resolved:can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAFCommit f1b4e32aca08 ("can: bcm: use call_rcu() instead of costly
synchronize_rcu()") replaced synchronize_rcu() in bcm_delete_rx_op()
with call_rcu() and introduced the RX_NO_AUTOTIMER flag.However, this flag check was omitted for thrtimer in the packet rx
fast-path. During BCM RX operation teardown, a concurrent RCU reader
(bcm_rx_handler) can race and re-arm thrtimer via
bcm_rx_update_and_send() after call_rcu() has been scheduled.  Once
the RCU grace period elapses, bcm_op is freed.  The subsequently
firing thrtimer then dereferences the deallocated op, causing a UAF.Adding flag checks to the rx fast-path (bcm_rx_update_and_send) does not
fully close the TOCTOU race and introduces latency for every CAN frame.
Conversely, calling hrtimer_cancel() directly inside the RCU callback
(softirq context) is fatal as hrtimer_cancel() can sleep, triggering
a "scheduling while atomic" panic.Resolve this by deferring the timer cancellation and memory free to a
dedicated unbound workqueue (bcm_wq).  The RCU callback now queues a
work item to bcm_wq, which safely cancels both timers and deallocates
memory in sleepable process context.  A dedicated workqueue is used to
prevent system-wide WQ saturation and is cleanly flushed/destroyed
on module unload to avoid rmmod page faults.Since the deferred work can now outlive the calling context by an
unbounded amount, also take a reference on op->sk when it is assigned
and drop it only once the deferred work has cancelled both timers, so a
socket can no longer be freed out from under a still-armed timer whose
callback (bcm_send_to_user()) dereferences op->sk.
CVSS v3.1 score: 7.8
GHSA-vrqh-v8jm-4v2m 
The OSM – OpenStreetMap plugin for WordPress is vulnerable to SQL Injection via the 'tagged_filter' attribute of the 'osm_map_v3' shortcode in all versions up to, and including, 6.0.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS v3.1 score: 9.9
CVE-2024-20910 
Vulnerability in Oracle Audit Vault and Database Firewall (component: Firewall).  Supported versions that are affected are 20.1-20.9. Difficult to exploit vulnerability allows high privileged attacker with network access via Oracle Net to compromise Oracle Audit Vault and Database Firewall.  While the vulnerability is in Oracle Audit Vault and Database Firewall, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Audit Vault and Database Firewall accessible data. CVSS 3.1 Base Score 3.0 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N).
CVSS v3.1 score: 3
GHSA-3g87-jvpr-fg65 
PrestaShop 1.7.2.4 allows user enumeration via the Reset Password feature, by noticing which reset attempts do not produce a "This account does not exist" error message.
CVSS v3.0 score: 5.3
CVE-2024-10629 GPX Viewer <= 2.2.9 - Authenticated (Subscriber+) Arbitrary File Creation
The GPX Viewer plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check and file type validation in the gpxv_file_upload() function in all versions up to, and including, 2.2.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to create arbitrary files on the affected site's server which may make remote code execution possible.
CVSS v3.1 score: 8.8
GHSA-qqg4-gm3f-2r2x 
Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability. This CVE ID is unique from CVE-2023-21677, CVE-2023-21683.
CVSS v3.1 score: 7.5
GHSA-xg7m-r4cx-cq66 
Stack-based buffer overflow in Microsoft Windows Media Player 9 and 10 allows remote attackers to execute arbitrary code via a PNG image with a large chunk size.
GHSA-c32r-w7r9-9w44 
spacewalk-backend in Red Hat Network Satellite 5.4 on Red Hat Enterprise Linux 6 does not properly authorize or authenticate uploads to the NULL organization when mod_wsgi is used, which allows remote attackers to cause a denial of service (/var partition disk consumption and failed updates) via a large number of package uploads.
CVE-2025-21088 WebApp crash via improper validation of proto style in attachments
Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly validate the style of proto supplied to an action's style in post.props.attachments, which allows an attacker to crash the frontend via crafted malicious input.
CVSS v3.1 score: 6.5
GHSA-3fq9-fm98-2gqp 
NVIDIA Tegra kernel driver contains a vulnerability in NVMAP where an attacker has the ability to write an arbitrary value to an arbitrary location which may lead to an escalation of privileges. This issue is rated as high.
CVSS v3.0 score: 7.8
CVE-2022-20255 
In SettingsProvider, there is a possible way to read or change the default ringtone due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-222687217
CVSS v3.1 score: 4.4
CVE-2018-20584 
JasPer 2.0.14 allows remote attackers to cause a denial of service (application hang) via an attempted conversion to the jp2 format.
CVSS v3.1 score: 6.5
CVSS v2.0 score: 4.3
RHSA-2018:3522 Red Hat Security Advisory: spice-server security update
spice: Possible buffer overflow via invalid monitor configurations
CVSS v3.0 score: 9.1
CVE-2019-0331 
Under certain conditions, SAP BusinessObjects Business Intelligence Platform (BI Workspace), versions 4.1, 4.2, 4.3, allows an attacker to access sensitive data such as directory structure, leading to Information Disclosure.
CVSS v3.0 score: 5.3
CVSS v2.0 score: 5
CVE-2025-20222 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software  Buffer Vulnerability
A vulnerability in the RADIUS proxy feature for the IPsec VPN feature of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition.

This vulnerability is due to improper processing of IPv6 packets. An attacker could exploit this vulnerability by sending IPv6 packets over an IPsec VPN connection to&nbsp;an affected device. A successful exploit could allow the attacker to trigger a reload of the device, resulting in a DoS condition.
CVSS v3.1 score: 8.6
CVE-2023-5000 Horizontal scrolling announcements <= 2.4 -  Authenticated (Contributor+) SQL Injection via Shortcode
The Horizontal scrolling announcements plugin for WordPress is vulnerable to SQL Injection via the plugin's 'hsas-shortcode' shortcode in versions up to, and including, 2.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with contributor-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS v3.1 score: 8.8
CVE-2017-12537 
A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version PLAT 7.3 (E0504) was found. The problem was resolved in HPE Intelligent Management Center PLAT v7.3 (E0506) or any subsequent version.
CVSS v3.0 score: 8.8
CVSS v2.0 score: 9
RHSA-2025:8514 Red Hat Security Advisory: nodejs:20 security update
nodejs: Memory Leak in Node.js ReadFileUtf8 Binding Leading to DoS nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js nodejs: Improper HTTP Header Termination in Node.js 20 Enables Request Smuggling
CVSS v3.0 score: 6.5
GHSA-646c-wq37-8qcr 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects in PDF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-10192.
CVE-2021-21357 Broken Access Control in Form Framework
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 8.7.40, 9.5.25, 10.4.14, 11.1.1 due to improper input validation, attackers can by-pass restrictions of predefined options and submit arbitrary data in the Form Designer backend module of the Form Framework. In the default configuration of the Form Framework this allows attackers to explicitly allow arbitrary mime-types for file uploads - however, default _fileDenyPattern_ successfully blocked files like _.htaccess_ or _malicious.php_. Besides that, attackers can persist those files in any writable directory of the corresponding TYPO3 installation. A valid backend user account with access to the form module is needed to exploit this vulnerability. This is fixed in versions 8.7.40, 9.5.25, 10.4.14, 11.1.1.
CVSS v3.1 score: 8.3
CVE-2023-40137 
In multiple functions of DialogFillUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1 score: 3.3
CVE-2021-20536 
IBM Spectrum Protect Plus File Systems Agent 10.1.6 and 10.1.7 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 198836.
CVSS v3.0 score: 6.2
CVE-2008-1620 
Directory traversal vulnerability in 2X TFTP service (TFTPd.exe) 3.2.0.0 and earlier in 2X ThinClientServer 5.0_sp1-r3497 and earlier allows remote attackers to read or overwrite arbitrary files via a ... (dot dot dot) in the filename.
CVSS v2.0 score: 7.5
GHSA-h9xm-j4qg-fvpg OpenClaw: Experimental apply_patch may bypass workspace-only checks in opt-in sandbox mounts (off by default)
SummaryIn some opt-in sandbox configurations, the **experimental** `apply_patch` tool did not consistently apply workspace-only checks to mounted paths (for example `/agent/...`).ImpactThis does **not** affect default installs.Default posture:`agents.defaults.sandbox.mode=off` (sandbox disabled by default)`tools.exec.applyPatch.enabled=false` (experimental tool disabled by default)This behavior applies only when all of the following are enabled/configured:sandbox mode,experimental `apply_patch`,workspace-only expectations (`tools.fs.workspaceOnly=true` and/or `tools.exec.applyPatch.workspaceOnly=true`),and writable mounts outside workspace.Under that opt-in setup, `apply_patch` operations could target mounted paths outside the workspace root.Affected Packages / VersionsPackage: `openclaw` (npm)Affected published versions: `<= 2026.2.22-2`Fixed in code on `main`: commit `6634030be31e1a1842967df046c2f2e47490e6bf`Patched release: `2026.2.23`Technical DetailsIn the sandbox path flow, `apply_patch` used `sandbox.bridge.resolvePath(...)` without applying the same workspace-root assertion used by other filesystem tools. The fix makes `apply_patch` follow the same workspace-only enforcement for sandbox-resolved paths (unless explicitly disabled with `tools.exec.applyPatch.workspaceOnly=false`).Fix Commit(s)`6634030be31e1a1842967df046c2f2e47490e6bf`Release Process Note`patched_versions` is pre-set to the released version (`2026.2.23`). Patched in `2026.2.23` and published.OpenClaw thanks @tdjackey for reporting.
CVSS v4.0 score: 7.6
CVSS v3.1 score: 6.8
GHSA-xx3h-9xgv-2q4v 
Directory traversal vulnerability in the modURL function in instance.c in Weborf before 0.12.3 allows remote attackers to read arbitrary files via ..%2f sequences in a URI.
GHSA-r47w-m25r-5m77 
SQL injection vulnerability in the art_print function in print.inc.php in unknown versions of jPortal before 2.3.1 allows remote attackers to inject arbitrary SQL commands via the id parameter.
CVE-2006-4788 
PHP remote file inclusion vulnerability in includes/log.inc.php in Telekorn SignKorn Guestbook (SL) 1.3 and earlier, when register_globals is enabled and _SESSION[permission] parameter is set to "yes", allows remote attackers to execute arbitrary PHP code via a URL in the dir_path parameter.
CVSS v2.0 score: 5.1
GHSA-qcqx-gfxj-4j65 
An issue was discovered in Kiamo before 8.4 allowing authenticated administrative attackers to execute arbitrary PHP code on the server.
CVSS v3.1 score: 8.8
GHSA-prcq-gffq-r32v 
Authentication Bypass vulnerability in TPM autoboot in McAfee Drive Encryption (MDE) 7.1.0 and above allows physically proximate attackers to bypass local security protection via specific set of circumstances.
CVSS v3.0 score: 6.6
CVE-2022-21145 
A stored cross-site scripting vulnerability exists in the WebUserActions.aspx functionality of Lansweeper lansweeper 9.1.20.2. A specially-crafted HTTP request can lead to arbitrary Javascript code injection. An attacker can send an HTTP request to trigger this vulnerability.
CVSS v3.0 score: 9.1
CVE-2023-7012 
Insufficient data validation in Permission Prompts in Google Chrome prior to 117.0.5938.62 allowed an attacker who convinced a user to install a malicious app to potentially perform a sandbox escape via a malicious file. (Chromium security severity: Medium)
CVSS v3.1 score: 7.5
CVE-2014-6340 
Microsoft Internet Explorer 6 through 11 allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web site, aka "Internet Explorer Cross-domain Information Disclosure Vulnerability."
CVSS v2.0 score: 4.3
GHSA-gh4m-j6cx-fcjx 
A vulnerability was found in code-projects Bus Reservation System 1.0 and classified as critical. Affected by this issue is the function Login of the component Login Form. The manipulation of the argument Str1 leads to buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 4.8
CVSS v3.1 score: 5.3
CVE-2018-8849 Medtronic N'Vision Clinician Programmer Missing Encryption of Sensitive Data
Medtronic N'Vision Clinician Programmer 8840 N'Vision Clinician Programme and 8870 N'Vision removable Application Card do not encrypt PII and PHI while at rest.
CVSS v3.1 score: 4.6
GHSA-2qcj-x6g8-5f33 
The WP-CRM WordPress plugin through 1.2.1 does not validate and sanitise fields when exporting people to a CSV file, leading to a CSV injection vulnerability.
CVSS v3.1 score: 7.8
CVE-2021-31844 Local Privilege Escalation in McAfee DLP Endpoint for Windows
A buffer overflow vulnerability in McAfee Data Loss Prevention (DLP) Endpoint for Windows prior to 11.6.200 allows a local attacker to execute arbitrary code with elevated privileges through placing carefully constructed Ami Pro (.sam) files onto the local system and triggering a DLP Endpoint scan through accessing a file. This is caused by the destination buffer being of fixed size and incorrect checks being made on the source size.
CVSS v3.1 score: 8.2
CVE-2024-41770 IBM Engineering Requirements Management DOORS Next information disclosure
IBM Engineering Requirements Management DOORS Next 7.0.2, 7.0.3, and 7.1 could allow a remote attacker to download temporary files which could expose application logic or other sensitive information.
CVSS v3.1 score: 7.5
GHSA-5m2r-v35x-jhhx 
Authorization Bypass Through User-Controlled Key vulnerability in mediavine Create by Mediavine mediavine-create allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Create by Mediavine: from n/a through <= 1.9.14.
CVSS v3.1 score: 8.1
GHSA-mx2f-ggfx-v955 
NASM nasm-2.13.03 nasm- 2.14rc15 version 2.14rc15 and earlier contains a memory corruption (crashed) of nasm when handling a crafted file due to function assemble_file(inname, depend_ptr) at asm/nasm.c:482. vulnerability in function assemble_file(inname, depend_ptr) at asm/nasm.c:482. that can result in aborting/crash nasm program. This attack appear to be exploitable via a specially crafted asm file..
CVSS v3.0 score: 5.5
GHSA-4w6m-9wfj-675v 
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS v3.1 score: 4.9