CIRCL/vulnerability-scores huggingface dataset:
CVE-2026-45149 brace-expansion: Large numeric range defeats documented `max` DoS protection
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. From 5.0.0 to before 5.0.6, the max option was being applied too late. When expanding a single large numeric range like {1..10000000}, the sequence generation loop generates all 10 million intermediate elements before the max limit is applied With max=10, the output is correctly limited to 10 items, but the process still allocates ~505 MB and spends ~800ms building the full intermediate array. This vulnerability is fixed in 5.0.6.
CVSS v3.1 score: 6.5
GHSA-5xwj-pj7m-qfv5 
XnView Classic for Windows Version 2.43 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file, related to a "User Mode Write AV starting at CADImage+0x00000000000048e7."
CVSS v3.0 score: 7.8
CVE-2025-58806 WordPress WordPress Error Monitoring by Bugsnag Plugin <= 1.6.3 - Cross Site Request Forgery (CSRF) Vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Tom Longridge WordPress Error Monitoring by Bugsnag bugsnag allows Stored XSS.This issue affects WordPress Error Monitoring by Bugsnag: from n/a through <= 1.6.3.
CVSS v3.1 score: 7.1
RHSA-2026:24762 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
lodash: lodash: Arbitrary code execution via untrusted input in template imports path-to-regexp: path-to-regexp: Denial of Service via crafted regular expressions github.com/pallets/click: Pallets Click: Arbitrary command execution via command injection in click.edit() pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages node-forge: node-forge: Denial of Service via infinite loop in BigInteger.modInverse() Vite: Vite: Information disclosure via WebSocket connection bypasses access control cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API axios: Axios: Remote Code Execution via Prototype Pollution escalation Pillow: Pillow: Denial of Service via decompression bomb in FITS image processing
CVSS v3.1 score: 7.5
CVSS v3.0 score: 7.5
GHSA-3p8m-82f9-hcgw 
Cross-site scripting (XSS) vulnerability in IBM Forms Experience Builder 8.5.x and 8.6.x before 8.6.3 allows remote authenticated users to inject arbitrary web script or HTML via crafted input to an application that was built with this product.
CVSS v3.0 score: 2.7
RHSA-2025:4456 Red Hat Security Advisory: yelp security update
yelp: Arbitrary file read
CVSS v3.1 score: 7.4
CVE-2021-22030 
In versions of Greenplum database prior to 5.28.14 and 6.17.0, certain statements execution led to the storage of sensitive(credential) information in the logs of the database. A malicious user with access to logs can read sensitive(credentials) information about users
CVSS v3.1 score: 6.5
CVSS v2.0 score: 4
GHSA-4hxw-gc2q-f6f3 Filament has exported files stored in default (`public`) filesystem if not reconfigured
All Filament features that interact with storage use the `default_filesystem_disk` config option. This allows the user to easily swap their storage driver to something production-ready like `s3` when deploying their app, without having to touch multiple configuration options and potentially forgetting about some.The default disk is set to `public` when you first install Filament, since this allows users to quickly get started developing with a functional disk that allows features such as file upload previews locally without the need to set up an S3 disk with temporary URL support.However, some features of Filament such as exports also rely on storage, and the files that are stored contain data that should often not be public. This is not an issue for the many deployed applications, since many use a secure default disk such as S3 in production. However, [CWE-1188](https://cwe.mitre.org/data/definitions/1188.html) suggests that having the `public` disk as the default disk in Filament is a security vulnerability itself:Developers often choose default values that leave the product as open and easy to use as possible out-of-the-box, under the assumption that the administrator can (or should) change the default value. However, this ease-of-use comes at a cost when the default is insecure and the administrator does not change it.As such, we have implemented a measure to protect users whereby if the `public` disk is set as the default disk, the exports feature will automatically swap it out for the `local` disk, if that exists. Users who set the default disk to `local` or `s3` already are not affected. If a user wants to continue to use the `public` disk for exports, they can by [setting the export disk](https://filamentphp.com/docs/3.x/actions/prebuilt-actions/export#customizing-the-storage-disk) deliberately.
CVSS v4.0 score: 2.3
CVSS v3.1 score: 2.4
CVE-2008-1408 
SQL injection vulnerability in includes/functions/banners-external.php in phpBP 2 RC3 (2.204) FIX 4 allows remote attackers to execute arbitrary SQL commands via the id parameter in a banner_out action.
CVSS v2.0 score: 7.5
GHSA-8j8v-w647-795g 
Tenda AC15 v15.03.05.18 has a stack overflow vulnerability in the time parameter from the setSmartPowerManagement function.
CVSS v3.1 score: 4.3
CVE-2018-5992 
SQL Injection exists in the Staff Master through 1.0 RC 1 component for Joomla! via the name parameter in a view=staff request.
CVSS v3.0 score: 9.8
CVSS v2.0 score: 7.5
GHSA-pmm2-7944-2hf8 
NetApp OnCommand Insight version 7.3.0 and versions prior to 7.2.0 are susceptible to clickjacking attacks which could cause a user to perform an unintended action in the user interface.
CVSS v3.0 score: 6.5
CVE-2024-4135 WP Latest Posts <= 5.0.7  - Authenticated (Subscriber+) Arbitrary Shortcode Execution
The WP Latest Posts plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.7. This is due to the plugin allowing users to execute an action that does not properly validate a user-supplied value prior to using that value in a call to do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
CVSS v3.1 score: 5.4
CVE-2023-38702 Knowage Server vulnerable to path traversal via upload functionality
Knowage is an open source analytics and business intelligence suite. Starting in the 6.x.x branch and prior to version 8.1.8, the endpoint `/knowage/restful-services/dossier/importTemplateFile` allows authenticated users to upload `template file` on the server, but does not need any authorization to be reached. When the JSP file is uploaded, the attacker just needs to connect to `/knowageqbeengine/foo.jsp` to gain code execution on the server. By exploiting this vulnerability, an attacker with low privileges can upload a JSP file to the `knowageqbeengine` directory and gain code execution capability on the server. This issue has been patched in Knowage version 8.1.8.
CVSS v3.1 score: 10
GHSA-x634-3rj8-33g6 
IBM PureApplication System 1.0 before 1.0.0.4 cfix8 and 1.1 before 1.1.0.4 IF1 allows remote authenticated users to bypass intended access restrictions by establishing an SSH session from a deployed virtual machine.
GHSA-7c6m-w964-4jjh 
htsearch program in htDig 3.2 beta, 3.1.6, 3.1.5, and earlier allows remote attackers to determine the physical path of the server by requesting a non-existent configuration file using the config parameter, which generates an error message that includes the full path.
PYSEC-2021-633 
TensorFlow is an open source platform for machine learning. In affected versions the implementation of `SparseFillEmptyRows` can be made to trigger a heap OOB access. This occurs whenever the size of `indices` does not match the size of `values`. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
GHSA-jgf5-853p-m6fj 
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1689.
GHSA-cgh6-mrm3-hqpj 
In the Linux kernel, the following vulnerability has been resolved:platform/x86/amd/pmc: Detect when STB is not availableLoading the amd_pmc module as:...can result in the following messages in the kernel ring buffer:Further debugging reveals that this occurs when the requests for
S2D_PHYS_ADDR_LOW and S2D_PHYS_ADDR_HIGH return a value of 0,
indicating that the STB is inaccessible. To prevent the ioremap
warning and provide clarity to the user, handle the invalid address
and display an error message.
CVSS v3.1 score: 5.5
CVE-2007-5033 
Cross-site scripting (XSS) vulnerability in profile.php in phpBB XS 2 allows remote attackers to inject arbitrary web script or HTML via the selfdes parameter in a profile_info editprofile action.
CVSS v2.0 score: 4.3
GHSA-884c-w8q7-3ppv 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brecht Custom Related Posts allows Stored XSS. This issue affects Custom Related Posts: from n/a through 1.7.4.
CVSS v3.1 score: 6.5
GHSA-j9gg-mhrv-x578 
Quick Emulator (Qemu) built with the USB redirector usb-guest support is vulnerable to a memory leakage flaw. It could occur while destroying the USB redirector in 'usbredir_handle_destroy'. A guest user/process could use this issue to leak host memory, resulting in DoS for a host.
CVSS v3.1 score: 6.5
CVE-2021-41034 
The build of some language stacks of Eclipse Che version 6 includes pulling some binaries from an unsecured HTTP endpoint. As a consequence the builds of such stacks are vulnerable to MITM attacks that allow the replacement of the original binaries with arbitrary ones. The stacks involved are Java 8 (alpine and centos), Android and PHP. The vulnerability is not exploitable at runtime but only when building Che.
CVSS v3.1 score: 8.1
CVSS v2.0 score: 6.8
CVE-2025-22110 netfilter: nfnetlink_queue: Initialize ctx to avoid memory allocation error
In the Linux kernel, the following vulnerability has been resolved:

netfilter: nfnetlink_queue: Initialize ctx to avoid memory allocation error

It is possible that ctx in nfqnl_build_packet_message() could be used
before it is properly initialize, which is only initialized
by nfqnl_get_sk_secctx().

This patch corrects this problem by initializing the lsmctx to a safe
value when it is declared.

This is similar to the commit 35fcac7a7c25
("audit: Initialize lsmctx to avoid memory allocation error").
CVSS v3.1 score: 9.8
GHSA-9w4w-6v5v-wh95 
In the Linux kernel, the following vulnerability has been resolved:EDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_info's pvt_infoThe memory for llcc_driv_data is allocated by the LLCC driver. But when
it is passed as the private driver info to the EDAC core, it will get freed
during the qcom_edac driver release. So when the qcom_edac driver gets probed
again, it will try to use the freed data leading to the use-after-free bug.Hence, do not pass llcc_driv_data as pvt_info but rather reference it
using the platform_data pointer in the qcom_edac driver.
CVSS v3.1 score: 7.8
GHSA-mw8h-f5q9-mjrp 
External Control of File Name or Path vulnerability in PlexTrac allows Local Code Inclusion through use of an undocumented API endpoint.This issue affects PlexTrac: from 1.61.3 before 2.8.1.
CVSS v4.0 score: 8.6
CVSS v3.1 score: 9.8
CVE-2022-33259 Buffer copy without checking the size of input in Modem
Memory corruption due to buffer copy without checking the size of input in modem while decoding raw SMS received.
CVSS v3.1 score: 9.8
GHSA-vg4p-f55f-wp4f 
D-Link DIR-880 A1_FW107WWb08 was discovered to contain a buffer overflow via the function fgets.
CVSS v3.1 score: 9.8
CVE-2026-43780 
An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted texture may lead to unexpected app termination.
CVSS v3.1 score: 7.8
CVE-2024-11154 PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes <= 3.5.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure
The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.15 via the 'actAjaxRevisionDiffs' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive data including revisions of posts and pages.
CVSS v3.1 score: 4.3
GHSA-q4mp-gpc2-ghww 
The Honeywell Experion PKSand OneWireless WDMcontains a Deployment of Wrong Handlervulnerabilityin the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading toInput Data Manipulation,which could result in incorrect handling of packets leading to remote code execution.Honeywell recommends updating to the most recent version of Honeywell Experion PKS:520.2 TCU9 HF1 and 530.1 TCU3 HF1 and OneWireless: 322.5 and 331.1.The affected Experion PKS products are C300 PCNT02, C300 PCNT05, FIM4, FIM8, UOC, CN100, HCA, C300PM, and C200E.  The Experion PKS versions affected are from 520.1 through 520.2 TCU9 and from 530 through 530 TCU3. The OneWireless WDM affected versions are 322.1 through 322.4 and 330.1 through 330.3.
CVSS v3.1 score: 8.2
CVE-2023-27245 
A cross-site scripting (XSS) vulnerability in File Management Project 1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field under the Edit User module.
CVSS v3.1 score: 6.1
GHSA-mwcp-7pff-55mh 
A logic issue was addressed with improved checks. This issue is fixed in iOS 26.1 and iPadOS 26.1. An attacker with physical access to a locked device may be able to view sensitive user information.
CVSS v3.1 score: 4.6
CVE-2009-3748 
Multiple cross-site scripting (XSS) vulnerabilities in the Web Administrator in Websense Personal Email Manager 7.1 before Hotfix 4 and Email Security 7.1 before Hotfix 4 allow remote attackers to inject arbitrary web script or HTML via the (1) FileName, (2) IsolatedMessageID, (3) ServerName, (4) Dictionary, (5) Scoring, and (6) MessagePart parameters to web/msgList/viewmsg/actions/msgAnalyse.asp; the (7) Queue, (8) FileName, (9) IsolatedMessageID, and (10) ServerName parameters to actions/msgForwardToRiskFilter.asp and viewHeaders.asp in web/msgList/viewmsg/; and (11) the subject in an e-mail message that is held in a Queue.
CVSS v2.0 score: 4.3
GHSA-22r4-f9q2-4m9g 
In TrustZone in all Android releases from CAF using the Linux kernel, an Information Exposure vulnerability could potentially exist.
CVSS v3.0 score: 5.5
CVE-2020-26033 
An issue was discovered in Zammad before 3.4.1. The Tag and Link REST API endpoints (for add and delete) lack a CSRF token check.
CVSS v3.1 score: 5.4
CVSS v2.0 score: 5.8
CVE-2025-47360 Stack-based Buffer Overflow in Automotive Software platform based on QNX
Memory corruption while processing client message during device management.
CVSS v3.1 score: 7.8
CVE-2014-6801 
The frank matano (aka com.frank.matano) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0 score: 5.4
GHSA-v5hj-j267-vhm7 
CyMiInstaller322 ActiveX which runs MIPLATFORM downloads files required to run applications. A vulnerability in downloading files by CyMiInstaller322 ActiveX caused by an attacker to download randomly generated DLL files and MIPLATFORM to load those DLLs due to insufficient verification.
CVE-2010-4857 
SQL injection vulnerability in click.php in CAG CMS 0.2 Beta allows remote attackers to execute arbitrary SQL commands via the itemid parameter.
CVSS v2.0 score: 7.5
GHSA-q33w-f2qg-4gq7 
Pivotick contains a DOM-based cross-site scripting vulnerability in its generic UI element resolution and icon-rendering utilities.The tryResolveHTMLElement function treated any resolved string as HTML markup by assigning it to a <template> element through innerHTML. Strings derived from untrusted graph properties or custom rendering callbacks could therefore introduce arbitrary HTML or SVG elements into the live document. The vulnerable function was used by multiple UI components, including headers, property panels, extra panels, and tooltips.Additionally, createIcon inserted caller-supplied svgIcon markup into a template without sanitization. An application integrating Pivotick and deriving icon markup from untrusted data could therefore expose a second script-execution path.An unauthenticated attacker able to provide a crafted graph, property value, rendering result, or SVG icon could execute JavaScript in another user's browser when the affected content is displayed or interacted with. Successful exploitation could allow the attacker to access information available to the victim, manipulate graph data or application state, and perform actions with the victim's privileges.The patch changes string rendering to use textContent, requiring callers to explicitly return an Element when HTML rendering is intended. It also sanitizes SVG icon markup before inserting it into the DOM.
CVSS v4.0 score: 9.2
GHSA-h582-98j8-c239 
Buffer overflow in Star Wars Battlefront 1.11 and earlier allows remote attackers to cause a denial of service (application crash) via a long nickname.
GHSA-4c47-49qq-pq45 
ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to obtain sensitive information about all managed devices, including their IP addresses and device names.
CVSS v3.1 score: 7.5
CVE-2022-33291 Buffer over-read in Modem
Information disclosure in Modem due to buffer over-read while receiving a IP header with malformed length.
CVSS v3.1 score: 8.2
GHSA-vjqx-x8rw-qjr9 
Integer overflow in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 153.
CVSS v3.1 score: 9.8
GHSA-r836-hh6v-rg5g Django vulnerable to denial-of-service attack
An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize and urlizetrunc template filters, and the AdminURLFieldWidget widget, are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 5.3
GHSA-mpq7-8m6j-h6hc 
In the Linux kernel, the following vulnerability has been resolved:drm/i915: fix a possible refcount leak in intel_dp_add_mst_connector()If drm_connector_init fails, intel_connector_free will be called to take
care of proper free. So it is necessary to drop the refcount of port
before intel_connector_free.(cherry picked from commit cea9ed611e85d36a05db52b6457bf584b7d969e2)
CVSS v3.1 score: 5.5
cisco-sa-ios-ir800-img-verif-wHhLYHjK Cisco IOS Software for Cisco 800 Series Industrial Integrated Services Routers Image Verification Bypass Vulnerability
A vulnerability in the image verification feature of Cisco IOS Software for Cisco 809 and 829 Industrial Integrated Services Routers (Industrial ISRs) could allow an authenticated, local attacker to boot a malicious software image on  an affected device.

The vulnerability is due to insufficient access restrictions on the area of code that manages the image verification feature. An attacker could exploit this vulnerability by first authenticating to the targeted device and then logging in to the Virtual Device Server (VDS) of an affected device. The attacker could then, from the VDS shell, disable Cisco IOS Software integrity (image) verification.

A successful exploit could allow the attacker to boot a malicious Cisco IOS Software image on the targeted device. To exploit this vulnerability, the attacker must have valid user credentials at privilege level 15.


Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-ir800-img-verif-wHhLYHjK ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-ir800-img-verif-wHhLYHjK"]


This advisory is part of the June 3, 2020, release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication, which includes 23 Cisco Security Advisories that describe 25 vulnerabilities. For a complete list of the advisories and links to them, see Cisco Event Response: June 2020 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication [" https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-73388"].
CVSS v3.0 score: 6.7
CVE-2026-28392 OpenClaw < 2026.2.14 - Privilege Escalation in Slack Slash Command Handler via Direct Messages
OpenClaw versions prior to 2026.2.14 contain a privilege escalation vulnerability in the Slack slash-command handler that incorrectly authorizes any direct message sender when dmPolicy is set to open (must be configured). Attackers can execute privileged slash commands via direct message to bypass allowlist and access-group restrictions.
CVSS v4.0 score: 8.2
CVSS v3.1 score: 7.5
RHSA-2011:1369 Red Hat Security Advisory: httpd security update
httpd: multiple ranges DoS
CVE-2019-2005 
In onPermissionGrantResult of GrantPermissionsActivity.java, there is a possible incorrectly granted permission due to a missing permission check. This could lead to local escalation of privilege on a locked device with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9Android ID: A-68777217
CVSS v3.0 score: 8.8
CVSS v2.0 score: 6.8
GHSA-7j9p-67mm-5g87 LTI 1.3 Grade Pass Back Implementation has Missing Authorization Vulnerability
ProblemTL;DR: Any LTI tool that is integrated with on the Open edX platform can
post a grade back for any LTI XBlock so long as it knows or can guess the
block location for that XBlock.In LTI 1.3, LTI tools can "pass back" scores that learners earn while using
LTI tools to the edX platform. The edX platform then stores those LTI
scores in a separate table. If the right conditions are met, these scores
are then persisted to the LMS grades tables.LTI tools can create what are called "line items" on the edX platform. A
line item can be thought of as a column in a grade book; it stores results
for a specific activity (i.e. XBlock) for a specific set of users (i.e.
users in the course using the XBlock). A line item has an optional
resource_link_id field, which is basically the XBlock location. An LTI tool
can supply any value for this field.An LTI tool submits scores to the edX platform for line items. The code
that uploads that score to the LMS grade tables determines which XBlock to
upload the grades for by reading the resource_link_id field of the
associated line item. Because the LTI tool could have submitted any value
for the resource_link_id field, this introduces the potential for a
nefarious LTI tool to submit scores for any LTI XBlock on the platform.ImpactAny LTI tool that is integrated with on the Open edX platform can post a
grade back for any LTI XBlock so long as it knows the resource_link_id
(i.e. block location) for that XBlock.The impact is a loss of integrity for LTI XBlock grades.PatchesNo available patchWorkaroundsNo
CVSS v4.0 score: 2.1
CVSS v3.1 score: 3.7
CVE-2003-1005 
The PKI functionality in Mac OS X 10.2.8 and 10.3.2 allows remote attackers to cause a denial of service (service crash) via malformed ASN.1 sequences.
CVSS v2.0 score: 5
CVE-2025-20708 
In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01123853; Issue ID: MSV-4131.
CVSS v3.1 score: 8.8
GHSA-w263-x24h-qvff 
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to ImageIO.  NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "JPEGImageWriter state corruption" when using native code, which triggers memory corruption.
GHSA-95ww-475f-pr4f RAGAS has SSRF via Multi-Modal Faithfulness Collections Module
A security flaw has been discovered in vibrantlabsai RAGAS up to 0.4.3. The affected element is the function _try_process_local_file/_try_process_url of the file src/ragas/metrics/collections/multi_modal_faithfulness/util.py of the component Collections Module. Performing a manipulation of the argument retrieved_contexts results in server-side request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The security patch for CVE-2025-45691 was applied to a different module only. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0 score: 2.1
CVSS v3.1 score: 6.3
GHSA-cgx6-hpwq-fhv5 Integer Overflow or Wraparound in libxml2 affects Nokogiri
SummaryNokogiri v1.13.5 upgrades the packaged version of its dependency libxml2 from v2.9.13 to [v2.9.14](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.9.14).libxml2 v2.9.14 addresses [CVE-2022-29824](https://nvd.nist.gov/vuln/detail/CVE-2022-29824). This version also includes several security-related bug fixes for which CVEs were not created, including a potential double-free, potential memory leaks, and integer-overflow.Please note that this advisory only applies to the CRuby implementation of Nokogiri `< 1.13.5`, and only if the _packaged_ libraries are being used. If you've overridden defaults at installation time to use _system_ libraries instead of packaged libraries, you should instead pay attention to your distro's `libxml2` and `libxslt` release announcements.MitigationUpgrade to Nokogiri `>= 1.13.5`.Users who are unable to upgrade Nokogiri may also choose a more complicated mitigation: compile and link Nokogiri against external libraries libxml2 `>= 2.9.14` which will also address these same issues.Impactlibxml2 [CVE-2022-29824](https://nvd.nist.gov/vuln/detail/CVE-2022-29824)**CVSS3 score**:Unspecified upstreamNokogiri maintainers evaluate at 8.6 (High) ([CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H)). Note that this is different from the CVSS assessed by NVD.**Type**: Denial of service, information disclosure**Description**: In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for example libxslt through 1.1.35, is affected as well.**Fixed**: https://gitlab.gnome.org/GNOME/libxml2/-/commit/2554a24All versions of libml2 prior to v2.9.14 are affected.Applications parsing or serializing multi-gigabyte documents (in excess of INT_MAX bytes) may be vulnerable to an integer overflow bug in buffer handling that could lead to exposure of confidential data, modification of unrelated data, or a segmentation fault resulting in a denial-of-service.References[libxml2 v2.9.14 release notes](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.9.14)[CVE-2022-29824](https://nvd.nist.gov/vuln/detail/CVE-2022-29824)[CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer](https://cwe.mitre.org/data/definitions/119.html)
CVSS v3.1 score: 8.6
CVE-2025-33082 IBM Concert Software cross-site scripting
IBM Concert Software 1.0.0 through 1.1.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS v3.1 score: 5.4
CVE-2014-3429 
IPython Notebook 0.12 through 1.x before 1.2 does not validate the origin of websocket requests, which allows remote attackers to execute arbitrary code by leveraging knowledge of the kernel id and a crafted page.
CVSS v2.0 score: 6.8
CVE-2019-16556 
Jenkins Rundeck Plugin 3.6.5 and earlier stores credentials unencrypted in its global configuration file and in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
CVSS v3.1 score: 6.5
CVSS v2.0 score: 4
GHSA-rgv9-q543-rqg4 Uncontrolled Resource Consumption in FasterXML jackson-databind
In FasterXML jackson-databind before 2.12.7.1 and in 2.13.x before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. This issue can only happen when the `UNWRAP_SINGLE_VALUE_ARRAYS` feature is explicitly enabled.
CVSS v4.0 score: 8.2
CVSS v3.1 score: 7.5
ICSA-23-320-09 Siemens COMOS
MPXJ through 8.1.3 allows XXE attacks. This affects the GanttProjectReader and PhoenixReader components. common/InputStreamHelper.java in Packwood MPXJ before 8.3.5 allows directory traversal in the zip stream handler flow, leading to the writing of files to arbitrary locations. Open Design Alliance Drawings SDK before 2022.12.1 mishandles the loading of JPG files. Unchecked input data from a crafted JPG file leads to memory corruption. An attacker can leverage this vulnerability to execute code in the context of the current process. Open Design Alliance Drawings SDK (all versions prior to 2023.2) is vulnerable
to an out-of-bounds read when rendering DWG files after they are opened in the recovery mode. This could allow an attacker to execute code in the context of the current process. Open Design Alliance Drawings SDK (all versions prior to 2023.3) is vulnerable to an out-of-bounds read when reading DWG files in a recovery mode. This could allow an attacker to execute code in the context of the current process. Open Design Alliance Drawings SDK (all  versions prior to 2023.3) is vulnerable to an out-of-bounds read when reading a DWG file with invalid vertex number in a recovery mode. This could allow an attacker to execute code in the context of the current process. Integer overflow in PDFium library used in COMOS allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. Use after free in PDFium library used in COMOS allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Use after free in PDFium library used in COMOS allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. Use after free in PDFium library used in COMOS allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. Open Design Alliance Drawings SDK used in affected application is vulnerable to heap-based buffer overflow while parsing specially crafted DWG files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-19104) Open Design Alliance Drawings SDK used in affected application is vulnerable to heap-based buffer overflow while parsing specially crafted DXF files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-19382) Caching system in the affected application leaks sensitive information such as user and project information in cleartext via UDP. Ptmcast executable used for testing cache validation service in affected application is vulnerable to Structured Exception Handler (SEH) based buffer overflow. This could allow an attacker to execute arbitrary code on the target system or cause denial of service condition. The affected application lacks proper access controls in SMB shares. This could allow an attacker to access files that the user should not have access to. The affected application lacks proper access controls in making the SQLServer connection. This could allow an attacker to query the database directly to access information that the user should not have access to.
CVSS v3.1 score: 9.6
CVE-2025-31627 WordPress Media Library Assistant plugin <= 3.24 - Stored Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Stored XSS.This issue affects Media LIbrary Assistant: from n/a through <= 3.24.
CVSS v3.1 score: 5.9
GHSA-85g9-m9j2-hcx2 
Disclosure of sensitive information in HikVision camera driver's log file in XProtect Device Pack allows an attacker to read camera credentials stored in the Recording Server under specific conditions.
CVSS v4.0 score: 5.2
CVSS v3.1 score: 7.5
GHSA-xgjj-x9g2-jxw7 
Unrestricted Upload of File with Dangerous Type vulnerability in Genetech Pie Register Premium.This issue affects Pie Register Premium: from n/a before 3.8.3.3.
CVSS v3.1 score: 10
GHSA-h4wv-r484-2rg5 
In the Linux kernel, the following vulnerability has been resolved:smb: client: fix overflow in passthrough ioctl bounds checksmb2_ioctl_query_info() validates the PASSTHRU_FSCTL response payload
before copying it to userspace.The payload offset and length both come from 32-bit fields. The bounds
check currently adds OutputOffset and qi.input_buffer_length directly, so
the addition can wrap in 32-bit arithmetic before the result is compared
against the response buffer length.A malicious server can use a large OutputOffset and a small OutputCount
to make the wrapped sum pass the bounds check. The later copy_to_user()
then reads from io_rsp + OutputOffset, outside the response buffer.Use size_add() for the offset plus length check so overflow is treated as
out of bounds.
CVSS v3.1 score: 8.1
GHSA-j2rp-vprg-5m9q 
WordPress before 4.5 does not consider octal and hexadecimal IP address formats when determining an intranet address, which allows remote attackers to bypass an intended SSRF protection mechanism via a crafted address.
CVSS v3.0 score: 8.6
GHSA-g6fc-cmqh-mh4p 
Unspecified vulnerability in the Security component in IBM Systems Director 6.3.0 through 6.3.5 allows local users to obtain sensitive information via unknown vectors.
GHSA-prqw-x27x-86h2 
HCL DRYiCE Lucy (now AEX) is affected by a Cross Origin Resource Sharing (CORS) vulnerability. The mobile app is vulnerable to a CORS misconfiguration which could potentially allow unauthorized access to the application resources from any web domain and enable cache poisoning attacks.
CVSS v3.1 score: 6.5
GHSA-h625-v4g8-94r9 
** DISPUTED **  PHP remote file inclusion vulnerability in template.php in phpBB 2 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.  NOTE: followup posts have disputed this issue, stating that template.php does not appear in phpBB and does not use a $page variable.  It is possible that this is a site-specific vulnerability, or an issue in a mod.
PYSEC-2026-3189 
### Impact
NPE in RandomShuffle with XLA enable 
```python
import tensorflow as tf

func = tf.raw_ops.RandomShuffle
para = {'value': 1e+20, 'seed': -4294967297, 'seed2': -2147483649}

@tf.function(jit_compile=True)
def test():
   y = func(**para)
   return y

test()
```

### Patches
We have patched the issue in GitHub commit [728113a3be690facad6ce436660a0bc1858017fa](https://github.com/tensorflow/tensorflow/commit/728113a3be690facad6ce436660a0bc1858017fa).

The fix will be included in TensorFlow 2.12.0. We will also cherrypick this commit on TensorFlow 2.11.1


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.


### Attribution
This vulnerability has been reported by r3pwnx

CVSS v3.1 score: 7.5
CVE-2026-41047 Information leak via “diff” methods in qSnapper
Lack of authentication when using the "snapshot diff" functions in qSnapper before version 1.3.3 allowed a local attacker to see otherwise read protected information.
CVSS v4.0 score: 6.9
CVE-2024-39594 [CVE-2024-39594] Multiple Cross-Site Scripting (XSS) vulnerabilities in SAP Business Warehouse - Business Planning and Simulation
SAP Business Warehouse - Business Planning and
Simulation application does not sufficiently encode user controlled inputs,
resulting in Reflected Cross-Site Scripting (XSS) vulnerability. After
successful exploitation, an attacker can cause low impact on the confidentiality
and integrity of the application.
CVSS v3.1 score: 6.1
RHSA-2014:0910 Red Hat Security Advisory: Red Hat JBoss Operations Network 3.2.2 update
JSF: XSS due to insufficient escaping of user-supplied content in outputText tags and EL expressions EAP6: Plain text password logging during security audit netty: DoS via memory exhaustion during data aggregation PicketLink: XXE via insecure DocumentBuilderFactory usage
CVE-2018-19347 
The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information via a U3D sample because of a "Data from Faulting Address controls Branch Selection starting at U3DBrowser!PlugInMain+0x00000000000d11bb" issue.
CVSS v3.0 score: 7.1
CVSS v2.0 score: 5.8
CVE-2024-34784 
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
CVSS v3.0 score: 7.2
GHSA-cqhp-pw9h-ff47 
A malformed SMI (System Management Interface) command may allow an attacker to establish a corrupted SMI Trigger Info data structure, potentially leading to out-of-bounds memory reads and writes when triggering an SMI resulting in a potential loss of resources.
CVSS v3.1 score: 7.8
RHSA-2024:0244 Red Hat Security Advisory: java-17-openjdk security and bug fix update
OpenJDK: array out-of-bounds access due to missing range check in C1 compiler (8314468) OpenJDK: JVM class file verifier flaw allows unverified bytecode execution (8314295) OpenJDK: range check loop optimization issue (8314307) OpenJDK: incorrect handling of ZIP files with duplicate entries (8276123) OpenJDK: logging of digital signature private keys (8316976) OpenJDK: RSA padding issue and timing side-channel attack against TLS (8317547)
CVSS v3.1 score: 7.4
CVE-2023-30194 
Prestashop posstaticfooter <= 1.0.0 is vulnerable to SQL Injection via posstaticfooter::getPosCurrentHook().
CVSS v3.1 score: 9.8
GHSA-gjfg-4cm8-4m2j 
After performing a sequence of Power FW950, FW1010 maintenance operations a SRIOV network adapter can be improperly configured leading to desired VEPA configuration being disabled. IBM X-Force ID: 229695.
CVSS v3.1 score: 9.8
CVE-2026-48160 react-tracked was vulnerable to malicious code execution via compromised commits
react-tracked provides state usage tracking with Proxies. Between 2026-05-18 19:26:36 and 2026-05-19 15:22:45, the default branch contained malicious commits 6978272a7d6ca02225cb747ea69f427512e33699 through 949f1a3d6bb1ff7d1a0dec892afd773e742627e8 that executed remote attacker-controlled code on developer machines during `npm install`. The commits were removed by force-push, but local clones, forks, and direct-SHA URLs may still contain them, and `npm install` against an affected checkout will still execute the code today. The package was not published to npm. `src/install.js` was added and wired into the `postinstall` script. It fetched a JavaScript payload from an attacker-controlled HTTPS endpoint (configurable via an environment variable), disabled TLS verification, and evaluated the response as code with `require` available. Execution was deliberately skipped on CI and cloud/serverless environments, targeting developer workstations. The second-stage payload was attacker-hosted and cannot be reconstructed. Assume full compromise of anything reachable from a Node process with the user's permissions. Those who ran `npm install` against an affected checkout on a developer machine on or after 2026-05-18 19:26:36 should treat the machine as compromised, rotate every credential the machine could reach, audit account activity** since 2026-05-18 19:26:36, and clean local clones.
CVSS v4.0 score: 9.3
GHSA-35v8-x66v-gw3q 
The RuntimeHelpers.InitializeArray method in metadata/icall.c in Mono, when Moonlight 2.x before 2.4.1 or 3.x before 3.99.3 is used, does not properly restrict data types, which allows remote attackers to modify internal read-only data structures, and cause a denial of service (plugin crash) or corrupt the internal state of the security manager, via a crafted media file, as demonstrated by modifying a C# struct.
CVE-2019-9893 
libseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the arithmetic operators (LT, GT, LE, GE), which might able to lead to bypassing seccomp filters and potential privilege escalations.
CVSS v3.0 score: 9.8
CVSS v2.0 score: 7.5
CVE-2013-7444 
The Special:Contributions page in MediaWiki before 1.22.0 allows remote attackers to determine if an IP is autoblocked via the "Change block" text.
CVSS v2.0 score: 5
CVE-2026-55792 Craft CMS: Sensitive File Disclosure / Server-Side File Read
Craft CMS is a content management system (CMS). In versions starting from 4.0.0-RC1 and prior to 4.18.0, and 5.0.0-RC1 and above, prior to 5.10.0, the dataUrl() Twig function is included in Craft’s Twig sandbox allowlist, allowing any control panel user granted the utility:system-messages permission to embed a file-reading payload into system email templates. When those emails are sent, the server reads the target file and returns its contents as a base64-encoded data URL embedded in the email body. The .env file, which typically contains the database password, CRAFT_SECURITY_KEY, and third-party API keys, passes all of Craft’s existing dataUrl() protection checks and is fully exfiltrated. Obtaining CRAFT_SECURITY_KEY enables an attacker to forge session tokens and escalate to full admin account takeover. This issue has been fixed in versions 4.18.0 and 5.10.0.
CVSS v4.0 score: 6
RHSA-2025:9304 Red Hat Security Advisory: xorg-x11-server-Xwayland security update
xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Out-of-Bounds Read in X Rendering Extension Animated Cursors xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in Big Requests Extension xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Data Leak in XFIXES Extension's XFixesSetClientDisconnectMode xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Unprocessed Client Request Due to Bytes to Ignore xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer overflow in X Record extension xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in X Resize, Rotate and Reflect (RandR) Extension
CVSS v3.1 score: 7.8
GHSA-558h-hw8g-9x57 
In Cloudera Hue, there is privilege escalation by a read-only user when CDH 5.x brefore 5.4.9 is used.
CVSS v3.1 score: 8.8
GHSA-74rv-fq96-j6vr 
CSV Injection vulnerability in '/members/moremember.pl' and '/admin/aqbudgets.pl' endpoints in Koha Library Management System version 23.05.05 and earlier allows attackers to to inject DDE commands into csv exports via the 'Budget' and 'Patrons Member' components.
CVSS v3.1 score: 8.8
CVE-2018-2410 
SAP Business One, 9.2, 9.3, browser access does not sufficiently encode user controlled inputs, which results in a Cross-Site Scripting (XSS) vulnerability.
CVSS v3.0 score: 5.4
CVE-2023-49093 HtmlUnit vulnerable to Remote Code Execution (RCE) via XSTL
HtmlUnit is a GUI-less browser for Java programs. HtmlUnit is vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage. This vulnerability has been patched in version 3.9.0
CVSS v3.1 score: 9.8
GHSA-jw44-2hm2-63x7 
The tspc.conf configuration file in freenet6 before 0.9.6 and before 1.0 on Debian Linux has world readable permissions, which could allow local users to gain sensitive information, such as a username and password.
CVE-2018-25048 Codesys Runtime  Improper Limitation of a Pathname
The CODESYS runtime system in multiple versions allows an remote low privileged attacker to use a path traversal vulnerability to access and modify all system files as well as DoS the device.
CVSS v3.1 score: 8.8
CVE-2013-3476 
Cross-site request forgery (CSRF) vulnerability in the WordPress Related Posts plugin before 2.6.2 for WordPress allows remote attackers to hijack the authentication of users for requests that change settings via unspecified vectors.
CVSS v2.0 score: 6.8
CVE-2020-7866 Tobesoft XPLATFORM Arbitrary Command Execution Vulnerability
When using XPLATFORM 9.2.2.270 or earlier versions ActiveX component, arbitrary commands can be executed due to improper input validation
CVSS v3.1 score: 8.8
GHSA-9pq5-6mmc-rqh3 
The PNG deflate algorithm in RealOne Player 6.0.11.x and earlier, RealPlayer 8/RealPlayer Plus 8 6.0.9.584, and other versions allows remote attackers to corrupt the heap and overwrite arbitrary memory via a PNG graphic file format containing compressed data using fixed trees that contain the length values 286-287, which are treated as a very large length.
RHSA-2026:42875 Red Hat Security Advisory: RHEL AI 3.5 RPM runtime CVE fix - aom
libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode libaom: libaom: arbitrary address write via SVC layer context OOB and cyclic refresh map pointer hijack libaom: libaom: heap-buffer-overflow read via missing bounds check in ctrl_set_layer_id libaom: libaom: remote code execution via SVC layer context handling with attacker-controlled frames
CVSS v3.1 score: 7.1
GHSA-mgmw-3rhj-73v9 
Cryptographic issue while processing crypto API calls, missing checks may lead to corrupted key usage or IV reuses.
CVSS v3.1 score: 7.1
GHSA-8x56-53cq-3vgm 
The RPC daemon in EMC Isilon OneFS 6.5.x and 7.0.x before 7.0.2.13, 7.1.0 before 7.1.0.6, 7.1.1 before 7.1.1.2, and 7.2.0 before 7.2.0.1 allows local users to gain privileges by leveraging an ability to modify system files.
CVE-2021-22398 
There is a logic error vulnerability in several smartphones. The software does not properly restrict certain operation when the Digital Balance function is on. Successful exploit could allow the attacker to bypass the Digital Balance limit after a series of operations. Affected product versions include: Hulk-AL00C 9.1.1.201(C00E201R8P1);Jennifer-AN00C 10.1.1.171(C00E170R6P3);Jenny-AL10B 10.1.0.228(C00E220R5P1) and OxfordPL-AN10B 10.1.0.116(C00E110R2P1).
CVSS v3.1 score: 4.6
CVSS v2.0 score: 2.1
GHSA-wv5c-7rvw-phjw 
HCL iNotes is susceptible to a Broken Password Strength Checks vulnerability. Custom password policies are not enforced on certain iNotes forms which could allow users to set weak passwords, leading to easier cracking.
CVSS v3.1 score: 7.5
GHSA-c6gm-3g25-mfgv 
In onbind of ShannonRcsService.java, there is a possible access to protect data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-206987222References: N/A
CVSS v3.1 score: 5.5
CVE-2025-66459 Lookyloo vulnerable to XSS due to unescaped error message passed to innerHTML
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.35.3, a XSS vulnerability can be triggered when a user submits a list of URLs to capture, one of them contains a HTML element, and the capture fails. Then, the error field is populated with an error message that contains the bad URL they tried to capture, triggering the XSS. This vulnerability is fixed in 1.35.3.
CVSS v4.0 score: 5.3