CIRCL/vulnerability-scores huggingface dataset:
cisco-sa-ioxPE-KgGvCAf9 Cisco IOx for IOS XE Software Privilege Escalation Vulnerability
A vulnerability in the authorization controls for the Cisco IOx application hosting infrastructure in Cisco IOS XE Software could allow an unauthenticated, remote attacker to execute Cisco IOx API commands without proper authorization.

The vulnerability is due to incorrect handling of requests for authorization tokens. An attacker could exploit this vulnerability by using a crafted API call to request such a token. An exploit could allow the attacker to obtain an authorization token and execute any of the IOx API commands on an affected device.


Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ioxPE-KgGvCAf9 ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ioxPE-KgGvCAf9"]


This advisory is part of the June 3, 2020, release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication, which includes 23 Cisco Security Advisories that describe 25 vulnerabilities. For a complete list of the advisories and links to them, see Cisco Event Response: June 2020 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication [" https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-73388"].
CVSS v3.0 score: 9.8
CVE-2020-0520 
Path traversal in igdkmd64.sys for Intel(R) Graphics Drivers before versions 15.45.30.5103, 15.40.44.5107, 15.36.38.5117 and 15.33.49.5100 may allow an authenticated user to potentially enable escalation of privilege or denial of service via local access.
CVSS v3.1 score: 7.8
CVSS v2.0 score: 4.6
RHSA-2020:0798 Red Hat Security Advisory: OpenShift Container Platform 3.11 openshift-enterprise-mediawiki-apb security update
openshift/mediawiki-apb: /etc/passwd is given incorrect privileges
CVSS v3.1 score: 7
GHSA-p33j-c82p-w6vf 
BSS Continuity CMS 4.2.22640.0 has a Remote Denial Of Service vulnerability
CVE-2024-37087 
The vCenter Server contains a denial-of-service vulnerability. A malicious actor with network access to vCenter Server may create a denial-of-service condition.
CVSS v3.1 score: 5.3
GHSA-7cx2-ggh6-cfq5 
An access issue was addressed with additional sandbox restrictions. This issue is fixed in iOS 13.4 and iPadOS 13.4, macOS Catalina 10.15.4, tvOS 13.4, watchOS 6.2. A local user may be able to view sensitive user information.
RHSA-2020:1659 Red Hat Security Advisory: grafana security, bug fix, and enhancement update
grafana: incorrect access control in snapshot HTTP API leads to denial of service
CVSS v3.0 score: 4.3
CVE-2016-0611 
Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier and 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to Optimizer.
CVSS v2.0 score: 4
CVE-2025-54679 WordPress Neon Channel Product Customizer Free Plugin <= 2.0 - Arbitrary Content Deletion Vulnerability
Missing Authorization vulnerability in vertim Neon Channel Product Customizer Free neon-channel-product-customizer-free allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Neon Channel Product Customizer Free: from n/a through <= 2.0.
CVSS v3.1 score: 7.5
CVE-2021-22507 
Authentication bypass vulnerability in Micro Focus Operations Bridge Manager affects versions 2019.05, 2019.11, 2020.05 and 2020.10. The vulnerability could allow remote attackers to bypass user authentication and get unauthorized access.
CVSS v3.1 score: 9.8
CVSS v2.0 score: 7.5
CVE-2020-1655 Junos OS: MX Series: PFE crash on MPC7/8/9 upon receipt of large packets requiring fragmentation
When a device running Juniper Networks Junos OS with MPC7, MPC8, or MPC9 line cards installed and the system is configured for inline IP reassembly, used by L2TP, MAP-E, GRE, and IPIP, the packet forwarding engine (PFE) will become disabled upon receipt of large packets requiring fragmentation, generating the following error messages: [LOG: Err] MQSS(0): WO: Packet Error - Error Packets 1, Connection 29 [LOG: Err] eachip_hmcif_rx_intr_handler(7259): EA[0:0]: HMCIF Rx: Injected checksum error detected on WO response - Chunk Address 0x0 [LOG: Err] MQSS(0): DRD: RORD1: CMD reorder ID error - Command 11, Reorder ID 1838, QID 0 [LOG: Err] MQSS(0): DRD: UNROLL0: HMC chunk length error in stage 5 - Chunk Address: 0x4321f3 [LOG: Err] MQSS(0): DRD: UNROLL0: HMC chunk address error in stage 5 - Chunk Address: 0x0 [LOG: Notice] Error: /fpc/8/pfe/0/cm/0/MQSS(0)/0/MQSS_CMERROR_DRD_RORD_ENG_INT_REG_CMD_FSM_STATE_ERR (0x2203cc), scope: pfe, category: functional, severity: major, module: MQSS(0), type: DRD_RORD_ENG_INT: CMD FSM State Error [LOG: Notice] Performing action cmalarm for error /fpc/8/pfe/0/cm/0/MQSS(0)/0/MQSS_CMERROR_DRD_RORD_ENG_INT_REG_CMD_FSM_STATE_ERR (0x2203cc) in module: MQSS(0) with scope: pfe category: functional level: major [LOG: Notice] Performing action get-state for error /fpc/8/pfe/0/cm/0/MQSS(0)/0/MQSS_CMERROR_DRD_RORD_ENG_INT_REG_CMD_FSM_STATE_ERR (0x2203cc) in module: MQSS(0) with scope: pfe category: functional level: major [LOG: Notice] Performing action disable-pfe for error /fpc/8/pfe/0/cm/0/MQSS(0)/0/MQSS_CMERROR_DRD_RORD_ENG_INT_REG_CMD_FSM_STATE_ERR (0x2203cc) in module: MQSS(0) with scope: pfe category: functional level: major By continuously sending fragmented packets that cannot be reassembled, an attacker can repeatedly disable the PFE causing a sustained Denial of Service (DoS). This issue affects Juniper Networks Junos OS: 17.2 versions prior to 17.2R3-S4 on MX Series; 17.3 versions prior to 17.3R3-S8 on MX Series; 17.4 versions prior to 17.4R2-S10, 17.4R3-S2 on MX Series; 18.1 versions prior to 18.1R3-S10 on MX Series; 18.2 versions prior to 18.2R3-S3 on MX Series; 18.2X75 versions prior to 18.2X75-D41, 18.2X75-D430, 18.2X75-D65 on MX Series; 18.3 versions prior to 18.3R1-S7, 18.3R2-S4, 18.3R3-S1 on MX Series; 18.4 versions prior to 18.4R1-S7, 18.4R2-S4, 18.4R3 on MX Series; 19.1 versions prior to 19.1R1-S5, 19.1R2-S1, 19.1R3 on MX Series; 19.2 versions prior to 19.2R1-S4, 19.2R2 on MX Series; 19.3 versions prior to 19.3R2-S2, 19.3R3 on MX Series. This issue is specific to inline IP reassembly, introduced in Junos OS 17.2. Versions of Junos OS prior to 17.2 are unaffected by this vulnerability.
CVSS v3.1 score: 5.3
GHSA-3448-vfvv-xp9g Apache Tika Denial of Service due to Infinite Loop in Tika's SQLite3Parser
A carefully crafted or corrupt sqlite file can cause an infinite loop in Apache Tika's SQLite3Parser in versions 1.8-1.19.1 of Apache Tika.
CVSS v3.0 score: 6.5
CVE-2022-37779 
Phicomm FIR151B A2, FIR302E A2, FIR300B A2, FIR303B A2 routers V3.0.1.17 were discovered to contain a remote command execution (RCE) vulnerability via the sendnum parameter of the ping function.
CVSS v3.1 score: 7.2
GHSA-c9fx-9g6g-3jxc 
F5 FirePass 5.4 through 5.5.1 does not properly enforce host access restrictions when a client uses a single integer (dword) representation of an IP address ("dotless IP address"), which allows remote authenticated users to connect to the FirePass administrator console and certain other network resources.
CVE-2010-3364 
The vips-7.22 script in VIPS 7.22.2 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
CVSS v2.0 score: 6.9
GHSA-q46p-9vq4-cfg2 
A vulnerability was found in Campcodes Employee Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /edit.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 5.5
CVSS v3.1 score: 7.3
CVE-1999-1469 
Buffer overflow in w3-auth CGI program in miniSQL package allows remote attackers to execute arbitrary commands via an HTTP request with (1) a long URL, or (2) a long User-Agent MIME header.
CVSS v2.0 score: 7.5
RHSA-2023:7616 Red Hat Security Advisory: postgresql security update
postgresql: Memory disclosure in aggregate function calls postgresql: Buffer overrun from integer overflow in array modification postgresql: Role pg_signal_backend can signal certain superuser processes. postgresql: extension script @substitutions@ within quoting allow SQL injection
CVSS v3.1 score: 7.5
GHSA-gf9x-6xqh-g38j 
A Denial of Service (infinite loop) exists in OpenSIPS before 1.10 in lookup.c.
RHSA-2019:1728 Red Hat Security Advisory: python-novajoin security and bug fix update
python-novajoin: novajoin API lacks access control
CVSS v3.0 score: 7.1
CVE-2025-11326 Tenda AC18 WifiMacFilterSet stack-based overflow
A weakness has been identified in Tenda AC18 15.03.05.19(6318). This affects an unknown part of the file /goform/WifiMacFilterSet. Executing a manipulation of the argument wifi_chkHz can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.
CVSS v4.0 score: 8.7
CVSS v3.1 score: 8.8
CVSS v3.0 score: 8.8
CVSS v2.0 score: 9
CVE-2020-19551 
Blacklist bypass issue exists in WUZHI CMS up to and including 4.1.0 in common.func.php, which when uploaded can cause remote code executiong.
CVSS v3.1 score: 8.8
CVSS v2.0 score: 6.5
CVE-2005-2403 
The login protocol in RealChat 3.5.1b does not use authentication, which allows remote attackers to log on as other users by sniffing the beginning of a chat session and replaying it via a modified username.
CVSS v2.0 score: 5
GHSA-fp63-499m-hq6m Files or Directories Accessible to External Parties in ether/logs
ImpactA vulnerability was found that allowed authenticated admin users to access any file on the server.PatchesThe vulnerability has been fixed in 3.0.4.WorkaroundsWe recommend disabling the plugin if untrustworthy sources have admin access.For more informationIf you have any questions or comments about this advisory:Open an issue in [ether/logs](https://github.com/ethercreative/logs/issues)
CVSS v3.1 score: 7.2
GHSA-xgj4-2hrf-j4xg Cross-site scripting in Survey Creator
Cross Site Scripting (XSS) vulnerability in SurveyJS Survey Creator v.1.9.132 and before, allows attackers to execute arbitrary code and obtain sensitive information via the title parameter in form.
CVSS v3.1 score: 6.1
RHSA-2013:0236 Red Hat Security Advisory: java-1.6.0-sun security update
JDK: unspecified vulnerability fixed in 6u39 and 7u13 (Deployment) JDK: unspecified vulnerability fixed in 6u39 and 7u13 (Scripting) JDK: unspecified vulnerability fixed in 6u39 and 7u13 (Deployment) JDK: unspecified vulnerability fixed in 6u39 and 7u13 (Deployment) JDK: unspecified vulnerability fixed in 6u39 and 7u13 (JMX) JDK: unspecified vulnerability fixed in 6u39 and 7u13 (Deployment) JDK: unspecified vulnerability fixed in 6u39 and 7u13 (Deployment) OpenJDK: RMI CGIHandler XSS issue (RMI, 6563318) OpenJDK: logging insufficient access control checks (Libraries, 6664509) OpenJDK: logging insufficient access control checks (Libraries, 6664528) OpenJDK: invalid threads subject to interrupts (Libraries, 6776941) OpenJDK: reflection API incorrect checks for proxy classes (Libraries, 7197546, SE-2012-01 Issue 29) OpenJDK: PresentationManager incorrectly shared (CORBA, 7141694) JDK: unspecified vulnerability fixed in 6u39 and 7u13 (Install) OpenJDK: insufficient clipboard access premission checks (AWT, 7186952) OpenJDK: InetSocketAddress serialization issue (Networking, 7201071) OpenJDK: loadPropertyFile missing restrictions (JAXP, 8001235) OpenJDK: com.sun.xml.internal.* not restricted packages (JAX-WS, 7201068) JDK: unspecified vulnerability fixed in 6u39 and 7u13 (Deployment) OpenJDK: CPU consumption DoS via repeated SSL ClientHello packets (JSSE, 7192393) OpenJDK: missing serialization restriction (CORBA, 7201066) OpenJDK: insufficient privilege checking issue (AWT, 7192977) OpenJDK: insufficient Diffie-Hellman public key checks (JSSE, 7192392) OpenJDK: insufficient privilege checking issue (AWT, 8001057) JDK: unspecified vulnerability fixed in 6u39 and 7u13 (Deployment) OpenJDK: RequiredModelMBean missing access control context checks (JMX, 8000537) JDK: unspecified vulnerability fixed in 6u39 and 7u13 (Deployment) OpenJDK: IIOP type reuse sandbox bypass (CORBA, 8000540, SE-2012-01 Issue 50) OpenJDK: missing ValueHandlerImpl class constructor access restriction (CORBA, 8000631) OpenJDK: image parser insufficient raster parameter checks (2D, 8001972) OpenJDK: image parser insufficient raster parameter checks (AWT, 8002325) JDK: unspecified vulnerability fixed in 6u39 (Sound)
PYSEC-2026-1642 
MLflow Weak Password Requirements Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of MLflow. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of passwords. The issue results from weak password requirements. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-26916.
CVSS v3.0 score: 8.1
CVE-2019-13106 
Das U-Boot versions 2016.09 through 2019.07-rc4 can memset() too much data while reading a crafted ext4 filesystem, which results in a stack buffer overflow and likely code execution.
CVSS v3.1 score: 7.8
CVSS v2.0 score: 8.3
GHSA-94r4-9j59-hcxh 
The dpcm_decode_frame function in libavcodec/dpcm.c in FFmpeg before 0.9.1 does not use the proper pointer after an audio API change, which allows remote attackers to cause a denial of service (application crash) via unspecified vectors, which triggers a heap-based buffer overflow.
GHSA-84pr-m4jr-85g5 flask-cors vulnerable to log injection when the log level is set to debug
corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted GET request containing a CRLF sequence in the request path. This vulnerability allows attackers to corrupt log files, potentially covering tracks of other attacks, confusing log post-processing tools, and forging log entries. The issue is due to improper output neutralization for logs.
CVSS v3.0 score: 5.3
CVE-2022-1016 
A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a use-after-free. This issue needs to handle 'return' with proper preconditions, as it can lead to a kernel information leak problem caused by a local, unprivileged attacker.
CVSS v3.1 score: 5.5
CVE-2025-6227 Invite token is used as part of the secure communication
Mattermost versions 10.5.x <= 10.5.7, 9.11.x <= 9.11.16 fail to negotiate a new token when accepting the invite which allows a user that intercepts both invite and password to send synchronization payloads to the server that originally created the invite via the REST API.
CVSS v3.1 score: 2.2
GHSA-8hj4-6vg4-8r5g 
In wlan driver, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00364732; Issue ID: MSV-1332.
CVSS v3.1 score: 6.6
CVE-2017-7514 
A cross-site scripting (XSS) flaw was found in how the failed action entry is processed in Red Hat Satellite before version 5.8.0. A user able to specify a failed action could exploit this flaw to perform XSS attacks against other Satellite users.
CVSS v3.0 score: 4.3
GHSA-hpqm-3mvx-vj45 
Tufin SecureTrack < R20-2 GA contains reflected + stored XSS (as in, the value is reflected back to the user, but is also stored within the DB and can be later triggered again by the same victim, or also later by different users). Both stored, and reflected payloads are triggerable by admin, so malicious non-authenticated user could get admin level access. Even malicious low-privileged user can inject XSS, which can be executed by admin, potentially elevating privileges and obtaining admin access. (issue 1 of 3)
CVE-2013-4544 
hw/net/vmxnet3.c in QEMU 2.0.0-rc0, 1.7.1, and earlier allows local guest users to cause a denial of service or possibly execute arbitrary code via vectors related to (1) RX or (2) TX queue numbers or (3) interrupt indices.  NOTE: some of these details are obtained from third party information.
CVSS v2.0 score: 4.9
CVE-2025-23491 WordPress VSTEMPLATE Creator plugin <= 2.0.2 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vikash Srivastava VSTEMPLATE Creator vstemplate-creator allows Reflected XSS.This issue affects VSTEMPLATE Creator: from n/a through <= 2.0.2.
CVSS v3.1 score: 7.1
CVE-2022-22701 
PartKeepr versions up to v1.4.0, loads attachments using a URL while creating a part and allows the use of the 'file://' URI scheme, allowing an authenticated user to read local files.
CVSS v3.1 score: 6.5
CVSS v2.0 score: 4
CVE-2017-6153 
Features in F5 BIG-IP 13.0.0-13.1.0.3, 12.1.0-12.1.3.1, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1 system that utilizes inflate functionality directly, via an iRule, or via the inflate code from PEM module are subjected to a service disruption via a "Zip Bomb" attack.
CVSS v3.0 score: 5.3
CVSS v2.0 score: 5
GHSA-wjjv-3mj2-39hf AgenticMail API/storage and outbound relay hardening fixes
The current upstream main branch at commit 7e0206d was reviewed, and the fix-first patch set was rebased on 2026-05-18. The patches cover: validated and bound inactive-agent hour filtering; storage SQL identifier validation; metadata-backed ownership checks for raw storage SQL; blocking direct storage metadata access through raw SQL; fail-closed outbound worker secret handling; SMTP envelope/header control-character validation before command construction; and TLS certificate verification as the default for MailSender with an explicit opt-out for local development. Validation completed locally with targeted API/Core security tests plus API/Core builds. The security patch branch was not published publicly because te repository's SECURITY.md asks reporters not to open public vulnerability issues.
CVE-2023-4078 
Inappropriate implementation in Extensions in Google Chrome prior to 115.0.5790.170 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. (Chromium security severity: Medium)
CVSS v3.1 score: 8.8
GHSA-vm5x-pcv8-r553 
The Netcom NTC 6200 and NWL 222 series expose a web interface to be configured and set up by operators. Multiple endpoints of the web interface are vulnerable to arbitrary command injection and use insecure hardcoded passwords. Remote authenticated attackers can gain arbitrary code execution with elevated privileges.
CVSS v4.0 score: 8.6
GHSA-5375-pq7m-f5r2 @grpc/grpc-js: A malformed request can cause a server crash
ImpactAn invalid incoming HTTP/2 stream initiation can cause a server process to crash. This affects all servers created using @grpc/grpc-js.PatchesThe following version have fixes for this vulnerability:1.9.161.10.121.11.41.12.71.13.51.14.4WorkaroundsThere is no workaround.
CVSS v3.1 score: 7.5
GHSA-4j3f-h527-cjcj 
Auto Spare Parts Management v1.0 was discovered to contain a SQL injection vulnerability via the user parameter.
CVSS v3.1 score: 9.8
GHSA-vrjc-hpch-xwfv 
In the Linux kernel, the following vulnerability has been resolved:coresight: prevent deactivate active config while enabling the configWhile enable active config via cscfg_csdev_enable_active_config(),
active config could be deactivated via configfs' sysfs interface.
This could make UAF issue in below scenario:CPU0                                          CPU1
(sysfs enable)                                load module
                                              cscfg_load_config_sets()
                                              activate config. // sysfs
                                              (sys_active_cnt == 1)
...
cscfg_csdev_enable_active_config()
lock(csdev->cscfg_csdev_lock)
// here load config activate by CPU1
unlock(csdev->cscfg_csdev_lock)// access to config_desc which freed
// while unloading module.
cscfg_csdev_enable_configTo address this, use cscfg_config_desc's active_cnt as a reference count
 which will be holded when
    - activate the config.
    - enable the activated config.
and put the module reference when config_active_cnt == 0.
CVSS v3.1 score: 7.8
GHSA-34gj-4vw3-fwwm 
Cross-site scripting (XSS) vulnerability in b2b/auction/container.jsp in the Internet Sales (crm.b2b) module in SAP NetWeaver 7.0 allows remote attackers to inject arbitrary web script or HTML via the _loadPage parameter.
GHSA-r3r2-fg89-jj2p 
Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS v3.1 score: 5.4
GHSA-fr57-5xm9-fpgw 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FlickDevs Elementor Button Plus allows Stored XSS.This issue affects Elementor Button Plus: from n/a through 1.3.3.
CVSS v3.1 score: 6.5
GHSA-pjp6-jx8r-j23r 
The Connect client in IBM Sametime 8.5.1, 8.5.1.1, 8.5.1.2, 8.5.2, and 8.5.2.1, as used in the Lotus Notes client and separately, might allow local users to obtain sensitive information by leveraging the persistence of cleartext password strings within process memory.
CVE-2010-3618 
PGP Desktop 10.0.x before 10.0.3 SP2 and 10.1.0 before 10.1.0 SP1 does not properly implement the "Decrypt/Verify File via Right-Click" functionality for multi-packet OpenPGP messages that represent multi-message input, which allows remote attackers to spoof signed data by concatenating an additional message to the end of a legitimately signed message, related to a "piggy-back" or "unsigned data injection" issue.
CVSS v2.0 score: 4.3
GHSA-h5mj-448h-fhr2 
A vulnerability in the IPv6 DHCP (DHCPv6) client module of Cisco Adaptive Security Appliance (ASA) Software, Cisco Firepower Threat Defense (FTD) Software, Cisco IOS Software, and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient validation of DHCPv6 messages. An attacker could exploit this vulnerability by sending crafted DHCPv6 messages to an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition. Note: To successfully exploit this vulnerability, the attacker would need to either control the DHCPv6 server or be in a man-in-the-middle position.
CVSS v3.1 score: 5.9
CVE-2025-7072 Hardcoded credentials in KAON CG3000T/CG3000CT routers
The firmware in KAON CG3000TC and CG3000T routers contains hard-coded credentials in clear text (shared across all routers of this model) that an unauthenticated remote attacker could use to execute commands with root privileges.
This vulnerability has been fixed in firmware version: 1.00.67 for CG3000TC and 1.00.27 for CG3000T.
CVSS v4.0 score: 9.3
CVE-2024-32436 WordPress Gift Cards plugin <= 4.4.0 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Codemenschen Gift Vouchers.This issue affects Gift Vouchers: from n/a through 4.4.0.
CVSS v3.1 score: 4.3
CVE-2020-27553 
In BASETech GE-131 BT-1837836 firmware 20180921, the web-server on the system is configured with the option “DocumentRoot /etc“. This allows an attacker with network access to the web-server to download any files from the “/etc” folder without authentication. No path traversal sequences are needed to exploit this vulnerability.
CVSS v3.1 score: 7.5
CVSS v2.0 score: 5
CVE-2022-44946 
Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add Page function at /index.php?module=help_pages/pages&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field.
CVSS v3.1 score: 5.4
GHSA-vcvx-j5vc-8jhr 
GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute arbitrary client-side code on behalf of a targeted user due to improper input sanitization in the Analytics Dashboard.
CVSS v3.1 score: 8.7
GHSA-8x75-79hf-2g6r 
RT (aka Request Tracker) 3.8.8 through 4.x before 4.0.23 and 4.2.x before 4.2.10 allows remote attackers to obtain sensitive RSS feed URLs and ticket data via unspecified vectors.
RHSA-2010:0586 Red Hat Security Advisory: java-1.4.2-ibm-sap security update
OpenJDK Policy/PolicyFile leak dynamic ProtectionDomains. (6633872) OpenJDK File TOCTOU deserialization vulnerability (6736390) JDK unspecified vulnerability in JWS/Plugin component OpenJDK Inflater/Deflater clone issues (6745393) JDK unspecified vulnerability in JavaWS/Plugin component OpenJDK Unsigned applet can retrieve the dragged information before drop action occurs(6887703) OpenJDK Subclasses of InetAddress may incorrectly interpret network addresses (6893954) JDK multiple unspecified vulnerabilities OpenJDK Applet Trusted Methods Chaining Privilege Escalation Vulnerability (6904691) OpenJDK JPEGImageReader stepX Integer Overflow Vulnerability (6909597) JDK multiple unspecified vulnerabilities JDK multiple unspecified vulnerabilities JDK multiple unspecified vulnerabilities JDK unspecified vulnerability in ImageIO component OpenJDK ImagingLib arbitrary code execution vulnerability (6914866) OpenJDK AWT Library Invalid Index Vulnerability (6914823) JDK unspecified vulnerability in Java2D component
GHSA-mvx9-f55c-65h5 
Dell EMC AppSync versions 3.9 to 4.3 contain an Improper Restriction of Excessive Authentication Attempts Vulnerability that can be exploited from UI and CLI. An adjacent unauthenticated attacker could potentially exploit this vulnerability, leading to password brute-forcing. Account takeover is possible if weak passwords are used by users.
CVE-2007-5090 
Unspecified vulnerability in IBM Rational ClearQuest (CQ), when a Microsoft SQL Server or an IBM DB2 database is used, allows attackers to corrupt data via unspecified vectors.
CVSS v2.0 score: 7.5
CVE-2022-33049 
Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /orrs/admin/?page=user/manage_user.
CVSS v3.1 score: 7.2
CVSS v2.0 score: 6.5
GHSA-5526-463r-44x5 
In JetBrains TeamCity before 2026.1.2 stored XSS on the cloud profile page was possible via agent-reported data
CVSS v3.1 score: 7.3
GHSA-72gc-mhp7-rjpf 
Navigate CMS 2.8 has Stored XSS via a navigate_upload.php (aka File Upload) request with a multipart/form-data JavaScript payload.
CVSS v3.0 score: 5.4
CVE-2025-7769 Improper Neutralization of Special Elements used in a Command ('Command Injection') in Tigo Energy Cloud Connect Advanced
Tigo Energy's CCA is vulnerable to a command injection vulnerability in the /cgi-bin/mobile_api endpoint when the DEVICE_PING command is called, allowing remote code execution due to improper handling of user input. When used with default credentials, this enables attackers to execute arbitrary commands on the device that could cause potential unauthorized access, service disruption, and data exposure.
CVSS v4.0 score: 8.7
CVE-2026-35012 Open ISES Tickets < 3.44.2 Reflected XSS via add_facnote.php ticket_id Parameter
Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in add_facnote.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the ticket_id GET parameter directly into a hidden input field VALUE attribute. Attackers can craft a malicious URL containing a JavaScript payload in the ticket_id parameter that executes in the victim's browser when the URL is visited.
CVSS v4.0 score: 5.1
CVSS v3.1 score: 4.6
GHSA-3r7r-mrpq-cx9g 
The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has two user accounts with default passwords, including a hardcoded service account with the username true and password true. These accounts can be used to login to the web interface, exploit authenticated command injections and change router settings for malicious purposes.
CVSS v3.0 score: 8.8
GHSA-7ghp-cxp3-645v 
iSmartViewPro 1.3.34 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the camera ID input field. Attackers can paste a 257-character buffer into the camera DID and password fields to trigger an application crash on iOS devices.
CVSS v4.0 score: 4.6
CVSS v3.1 score: 7.5
CVE-2018-10615 
Directory traversal may lead to files being exfiltrated or deleted on the GE MDS PulseNET and MDS PulseNET Enterprise version 3.2.1 and prior host platform.
CVSS v3.0 score: 8.1
CVSS v2.0 score: 6.5
CVE-2019-13421 
Search Guard versions before 23.1 had an issue that an administrative user is able to retrieve bcrypt password hashes of other users configured in the internal user database.
CVSS v3.0 score: 4.9
CVSS v2.0 score: 4
GHSA-f639-3h6h-vr46 
An untrusted pointer dereference in mrb_vm_exec() of mruby v3.0.0 can lead to a segmentation fault or application crash.
GHSA-78jj-qvg7-6h49 
H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a stack overflow via the function UpdateWanLinkspyMulti.
CVSS v3.1 score: 9.8
GHSA-4993-v2g9-96m4 
JimuReport thru version 2.1.3 is vulnerable to remote code execution when processing user-controlled H2 JDBC URLs. The application passes the attacker-supplied JDBC URL directly to the H2 driver, allowing the use of certain directives to execute arbitrary Java code. A different vulnerability than CVE-2025-10770.
CVSS v3.1 score: 9.8
GHSA-wjgq-p4jx-fg3f 
Cross-site request forgery (CSRF) vulnerability in /admin.php?c=member&m=edit&uid=1 in dayrui FineCms 5.4 allows remote attackers to change the administrator's password.
CVSS v3.0 score: 8.8
GHSA-6j7v-2g8q-wx49 
A vulnerability in the web-based management interface of Cisco Unified CCX could allow an authenticated, local attacker to execute arbitrary code on an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials.This vulnerability is due to improper limitation of a pathname to a restricted directory (path traversal). An attacker could exploit this vulnerability by sending a crafted web request to an affected device, followed by a specific command through an SSH session. A successful exploit could allow the attacker to execute arbitrary code on the underlying operating system of an affected device as a low-privilege user. A successful exploit could also allow the attacker to undertake further actions to elevate their privileges to root.
CVSS v3.1 score: 3.4
GHSA-823j-2wj6-7jwh 
A Server-Side Request Forgery (SSRF) vulnerability was identified in langgenius/dify version 0.10.2. The vulnerability occurs in the 'Create Knowledge' section when uploading DOCX files. If an external relationship exists in the DOCX file, the reltype value is requested as a URL using the 'requests' module instead of the 'ssrf_proxy', leading to an SSRF vulnerability. This issue was fixed in version 0.11.0.
CVSS v3.0 score: 6.5
CVE-2024-25407 
SteVe v3.6.0 was discovered to use predictable transaction ID's when receiving a StartTransaction request. This vulnerability can allow attackers to cause a Denial of Service (DoS) by using the predicted transaction ID's to terminate other transactions.
CVSS v3.1 score: 7.5
CVE-2010-5101 
Directory traversal vulnerability in the TypoScript setup in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allows remote authenticated administrators to read arbitrary files via unspecified vectors related to the "file inclusion functionality."
CVSS v2.0 score: 4
CVE-2024-47348 WordPress Visual CSS Style Editor plugin <= 7.6.4 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YellowPencil YellowPencil Visual CSS Style Editor yellow-pencil-visual-theme-customizer allows Reflected XSS.This issue affects YellowPencil Visual CSS Style Editor: from n/a through <= 7.6.4.
CVSS v3.1 score: 7.1
CVE-2020-24636 
A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.5.x: 6.5.4.17 and below; Aruba Instant 8.3.x: 8.3.0.13 and below; Aruba Instant 8.5.x: 8.5.0.10 and below; Aruba Instant 8.6.x: 8.6.0.5 and below; Aruba Instant 8.7.x: 8.7.0.0 and below. Aruba has released patches for Aruba Instant that address this security vulnerability.
CVSS v3.1 score: 9.8
CVSS v2.0 score: 10
GHSA-mcmm-333p-x7jv 
A weakness has been identified in O2OA up to 10.0-410. This vulnerability affects unknown code of the file /x_processplatform_assemble_designer/jaxrs/script of the component Personal Profile Page. Executing manipulation of the argument name/alias/description/applicationName can lead to cross site scripting. The attack can be executed remotely. The exploit has been made available to the public and could be exploited.
CVSS v4.0 score: 2
CVSS v3.1 score: 3.5
GHSA-4c2x-qgm5-5mrh 
The AnnotationX.AnnList.1 ActiveX control in Agilent Technologies Feature Extraction allows remote attackers to execute arbitrary code via a crafted object parameter in the Insert function, related to "Index Out-Of-Bounds."
GHSA-6r7v-ww2r-2qpr 
The RentMy Real-Time Rental Management Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.4.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to read, create, update, and delete event records stored in the rentmy_events WordPress option, as well as overwrite the rentmy_locationId option.
CVSS v3.1 score: 5.3
CVE-2020-15240 Regression in JWT Signature Validation
omniauth-auth0 (rubygems) versions >= 2.3.0 and < 2.4.1 improperly validate the JWT token signature when using the `jwt_validator.verify` method. Improper validation of the JWT token signature can allow an attacker to bypass authentication and authorization. You are affected by this vulnerability if all of the following conditions apply: 1. You are using `omniauth-auth0`. 2. You are using `JWTValidator.verify` method directly OR you are not authenticating using the SDK’s default Authorization Code Flow. The issue is patched in version 2.4.1.
CVSS v3.1 score: 7.4
GHSA-fpxh-9966-h5g3 
A vulnerability in the MISP dashboard widgets allowed an authenticated user to manipulate the fields option and influence which fields were returned by the New Users and New Organisations widgets. In some cases, requesting a field set that became empty after validation or redaction could cause the underlying query to fall back to returning unintended model fields.For the New Users widget, this could allow a non-site-admin user to obtain user e-mail addresses even when user e-mail disclosure was disabled by configuration. For the New Organisations widget, crafted field selection could similarly result in unintended organisation fields being included in the dashboard response.The issue was caused by applying field filtering and redaction in a way that could leave the selected field list empty. The patch ensures that the allowed field list is built safely, that restricted fields such as user e-mail addresses are removed before user-supplied field selection is processed, and that an empty field selection falls back only to the permitted default fields.Impact:
An authenticated low-privileged user with access to the affected dashboard widgets may be able to disclose restricted user or organisation metadata, including user e-mail addresses depending on configuration.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 4.3
GHSA-9hw2-mcj5-xfgx 
Cross-site Scripting (XSS) - Generic in GitHub repository flatpressblog/flatpress prior to 1.3.
CVSS v3.1 score: 5.4
CVE-2009-0591 
The CMS_verify function in OpenSSL 0.9.8h through 0.9.8j, when CMS is enabled, does not properly handle errors associated with malformed signed attributes, which allows remote attackers to repudiate a signature that originally appeared to be valid but was actually invalid.
CVSS v2.0 score: 2.6
CVE-2021-35393 
Realtek Jungle SDK version v2.x up to v3.4.14B provides a 'WiFi Simple Config' server that implements both UPnP and SSDP protocols. The binary is usually named wscd or mini_upnpd and is the successor to miniigd. The server is vulnerable to a stack buffer overflow vulnerability that is present due to unsafe parsing of the UPnP SUBSCRIBE/UNSUBSCRIBE Callback header. Successful exploitation of this vulnerability allows remote unauthenticated attackers to gain arbitrary code execution on the affected device.
CVSS v3.1 score: 9.8
CVSS v2.0 score: 10
CVE-2021-31538 
LANCOM R&S Unified Firewall (UF) devices running LCOS FX 10.5 allow Relative Path Traversal.
CVSS v3.1 score: 7.5
CVSS v2.0 score: 5
GHSA-885g-r558-qx2m 
By specially crafting HTTP/2 requests, workers would be allocated 60 seconds longer than necessary, leading to worker exhaustion and a denial of service. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.18-2.4.30,2.4.33).
CVSS v3.0 score: 7.5
CVE-2026-39998 Apache APISIX: Identity Injection via forward-auth Plugin Missing Header Cleanup
Improper Input Validation vulnerability in Apache APISIX.

The attacker can take advantage of certain configuration in forward-auth plugin to spoof identity headers.
This issue affects Apache APISIX: from 2.12.0 through 3.16.0.

Users are recommended to upgrade to version 3.17.0, which fixes the issue.
CVSS v4.0 score: 5.8
CVE-2026-45378 Decidim: Verification documents can be downloaded through reusable links
Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verification admin UI embeds verification_attachment blobs through reusable signed Active Storage disk URLs, allowing anyone who obtains a URL to download the scanned document without an authenticated Decidim session until the signature expires. Verification-document images are rendered with variant_url(...), which produces signed /rails/active_storage/disk/... links instead of routing the file through an authorization-checking controller. Because Decidim configures Active Storage service URLs to remain valid for seven days, the URL itself becomes the credential for that period. The affected files are verification_attachment blobs on Decidim::Authorization, and the admin review pages embed those signed URLs directly into the HTML for pending and confirmation views. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.
CVSS v3.1 score: 7.5
GHSA-vw4p-3wx5-4j4r 
Memory corruption in QESL while processing payload from external ESL device to firmware.
CVSS v3.1 score: 9.8
GHSA-p84p-32wc-24f9 
A vulnerability was found in Luxul XWR-600 up to 4.0.1. The affected element is an unknown function of the component Web Administration Interface. The manipulation of the argument Guest Network/Wireless Profile SSID results in cross site scripting. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond with a technical statement.
CVSS v4.0 score: 1.9
CVSS v3.1 score: 2.4
CVE-2026-11380 JetWidgets For Elementor <= 1.0.21 - Authenticated (Author+) Stored Cross-Site Scripting via Animated Box 'animation_effect' Setting
The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.0.21. This is due to insufficient output escaping and missing server-side validation of the Animated Box widget's animation_effect setting before it is rendered inside an HTML class attribute. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1 score: 6.4
GHSA-4frx-xq3x-xrp7 
Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and Solaris and before 10.3.186.3 on Android, and Adobe AIR before 2.7.1 on Windows and Mac OS X and before 2.7.1.1961 on Android, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted SWF file, as demonstrated by "about 400 unique crash signatures."
CVE-2017-1000455 
GuixSD prior to Git commit 5e66574a128937e7f2fcf146d146225703ccfd5d used POSIX hard links incorrectly, leading the creation of setuid executables in "the store", violating a fundamental security assumption of GNU Guix.
CVSS v3.0 score: 5.5
CVSS v2.0 score: 2.1
CVE-2024-24100 
Code-projects Computer Book Store 1.0 is vulnerable to SQL Injection via PublisherID.
CVSS v3.1 score: 8.3
GHSA-grmg-5q49-mqmf Jenkins Crowd 2 Integration Plugin server-side request forgery vulnerability
An improper authorization vulnerability exists in Jenkins Crowd 2 Integration Plugin 2.0.0 and earlier in CrowdSecurityRealm.java that allows attackers to have Jenkins perform a connection test, connecting to an attacker-specified server with attacker-specified credentials and connection settings.
CVSS v3.0 score: 6.5
CVE-2022-35258 
An unauthenticated attacker can cause a denial-of-service to the following products: Ivanti Connect Secure (ICS) in versions prior to 9.1R14.3, 9.1R15.2, 9.1R16.2, and 22.2R4, Ivanti Policy Secure (IPS) in versions prior to 9.1R17 and 22.3R1, and Ivanti Neurons for Zero-Trust Access in versions prior to 22.3R1.
CVSS v3.1 score: 7.5
GHSA-rg32-q372-32r7 
ReOS 2.0.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by padmin/blocks/vergal.php and certain other files.
GHSA-fq8r-wqrc-7xwq 
An issue was discovered in the read-and-understood plugin 2.1 for WordPress. CSRF exists via wp-admin/options-general.php.
CVSS v3.0 score: 8.8
CVE-2017-6766 
A vulnerability in the Secure Sockets Layer (SSL) Decryption and Inspection feature of Cisco Firepower System Software 5.4.0, 5.4.1, 6.0.0, 6.1.0, 6.2.0, 6.2.1, and 6.2.2 could allow an unauthenticated, remote attacker to bypass the SSL policy for decrypting and inspecting traffic on an affected system. The vulnerability is due to unexpected interaction with Known Key and Decrypt and Resign configuration settings of SSL policies when the affected software receives unexpected SSL packet headers. An attacker could exploit this vulnerability by sending a crafted SSL packet through an affected device in a valid SSL session. A successful exploit could allow the attacker to bypass the SSL decryption and inspection policy for the affected system, which could allow traffic to flow through the system without being inspected. Cisco Bug IDs: CSCve12652.
CVSS v3.0 score: 7.5
CVSS v2.0 score: 5
GHSA-fcmm-7862-g7xv 
A Security Bypass vulnerability exists in TP-LINK IP Cameras TL-SC 3130, TL-SC 3130G, 3171G, 4171G, and 3130 1.6.18P12 due to default hard-coded credentials for the administrative Web interface, which could let a malicious user obtain unauthorized access to CGI files.
RHSA-2026:6912 Red Hat Security Advisory: Red Hat Quay 3.10.20
jsrsasign: jsrsasign: Private key recovery via incomplete comparison checks biasing DSA nonces jsrsasign: jsrsasign: Cryptographic signature forgery via malicious DSA domain parameters jsrsasign: jsrsasign: Private Key Recovery via Missing Cryptographic Step in DSA Signing jsrsasign: jsrsasign: Signature verification bypass via negative exponent handling authlib: Authlib: Authentication bypass via forged OpenID Connect ID Tokens pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)
CVSS v3.1 score: 7.5
CVSS v3.0 score: 7.5
RHSA-2013:0266 Red Hat Security Advisory: tomcat6 security update
tomcat: HTTP NIO connector OOM DoS via a request with large headers Tomcat/JBoss Web - Bypass of CSRF prevention filter Tomcat - Denial Of Service when using NIO+SSL+sendfile tomcat: three DIGEST authentication implementation issues tomcat: three DIGEST authentication implementation issues tomcat: three DIGEST authentication implementation issues
GHSA-cxgx-7f2w-qv3v 
The Slide Anything WordPress plugin before 2.3.44 does not sanitize and escape sliders' description, which could allow high privilege users such as editor and above to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
CVSS v3.1 score: 4.8
GHSA-2wjq-7fcc-4p8f 
Juiker app hard-coded its AES key in the source code. A physical attacker, after getting the Android root privilege, can use the AES key to decrypt users’ ciphertext and tamper with it.
CVSS v3.1 score: 5.5
GHSA-h6jf-w64w-qpgf 
netstation.navio-com.rte 1.1.0.1 configuration script for Navio NC on IBM AIX exports /tmp over NFS as world-readable and world-writable.
CVE-2026-61948 WordPress WPDM – Premium Packages plugin <= 6.2.0 - SQL Injection vulnerability
Unauthenticated SQL Injection in WPDM – Premium Packages <= 6.2.0 versions.
CVSS v3.1 score: 9.3
CVE-2023-42970 
A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14, watchOS 10, tvOS 17, Safari 17. Processing web content may lead to arbitrary code execution.
CVSS v3.1 score: 8.8
ICSA-23-073-01 Omron CJ1M PLC
Omron CJ1M unit v4.0 and prior has improper access controls on the memory region where the UM password is stored. If an adversary issues a PROGRAM AREA WRITE command to a specific memory region, they could overwrite the password. This may lead to disabling UM protections or setting a non-ASCII password (non-keyboard characters) and preventing an engineer from viewing or modifying the user program. CVE-2023-0811 has been assigned to this vulnerability. A CVSS v3 base score of 9.1 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).
CVSS v3.0 score: 9.1
GHSA-c625-ghm3-xfc2 
Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail before 1.1.5 allows remote attackers to hijack the authentication of users for requests that download attachments and cause a denial of service (disk consumption) via unspecified vectors.
CVSS v3.0 score: 8.8
GHSA-gpcm-hmx8-j7h9 
Stack-based buffer overflow in the parser function in GhostScript 8.70 and 8.64 allows context-dependent attackers to execute arbitrary code via a crafted PostScript file.
GHSA-2cf4-4hv6-ccxc 
IBM Storage Scale 5.2.2.0 and 5.2.2.1, under certain configurations, could allow an authenticated user to execute privileged commands due to improper input neutralization.
CVSS v3.1 score: 7.5
RHSA-2026:28210 Red Hat Security Advisory: vim security update
vim: Vim: Command injection allows arbitrary code execution via malicious tag files
CVSS v3.1 score: 7.3
CVE-1999-1385 
Buffer overflow in ppp program in FreeBSD 2.1 and earlier allows local users to gain privileges via a long HOME environment variable.
CVSS v2.0 score: 7.2
GHSA-wpxj-m9rg-gvw6 
Cross-site request forgery (CSRF) vulnerability in bmc/admin.php in Kailash Nadh boastMachine (formerly bMachine) 3.1 and earlier allows remote attackers to perform unauthorized actions as an administrator and delete arbitrary user accounts via a delete_user action.
GHSA-3x98-fhcg-5wv3 
Server receiving a malformed message based on a using the specified key values can cause a stack overflow vulnerability which could lead to an attacker performing remote code execution or causing a failure. See Honeywell Security Notification for recommendations on upgrading and versioning.
CVSS v3.1 score: 8.1
GHSA-8j9m-7jr9-v6q2 
Directory traversal vulnerability in forum/kietu/libs/calendrier.php in Dragoon 0.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the cal[lng] parameter.
GHSA-cxg8-6xcc-g5fw 
Opening a specially crafted file could cause the affected product to fail to release its memory reference potentially resulting in arbitrary code execution.
CVSS v3.1 score: 7.8