CIRCL/vulnerability-scores huggingface dataset:
CVE-2026-14650 connorskees grass UTF-8 Character raw_to_parse_error denial of service
A flaw has been found in connorskees grass up to 0.13.4. The affected element is the function grass_compiler::raw_to_parse_error of the component UTF-8 Character Handler. Executing a manipulation can lead to denial of service. The attack is restricted to local execution. The exploit has been published and may be used. In Issue #117 with similar structure the project maintainer explains: "DoS vulnerabilities are generally fine in Sass compilers -- they are trivially possible with recursive functions, infinite loops, nested mixins, etc. The description here is wrong. Compile time is not expected to be linear relative to the input, and the @extend algorithm is definitionally exponential."
CVSS v4.0 score: 4.8
CVSS v3.1 score: 3.3
CVSS v3.0 score: 3.3
CVSS v2.0 score: 1.7
GHSA-2x5r-jfhx-632p 
In the Linux kernel, the following vulnerability has been resolved:mmc: vub300: fix return value check of mmc_add_host()mmc_add_host() may return error, if we ignore its return value, the memory
that allocated in mmc_alloc_host() will be leaked and it will lead a kernel
crash because of deleting not added device in the remove path.So fix this by checking the return value and goto error path which will call
mmc_free_host(), besides, the timer added before mmc_add_host() needs be del.And this patch fixes another missing call mmc_free_host() if usb_control_msg()
fails.
CVSS v3.1 score: 5.5
CVE-2026-10738 jQuery Hover Footnotes <= 1.4 - Authenticated (Author+) Stored Cross-Site Scripting via Footnote Qualifier ('{{...}}' Syntax)
The jQuery Hover Footnotes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Footnote Qualifier ('{{...}}' Syntax) in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The attribute-breakout payload (e.g., a double-quote followed by an event handler) contains no angle brackets and therefore bypasses WordPress core's wp_kses_post() filtering, which only strips disallowed HTML tags rather than sanitizing attribute contexts.
CVSS v3.1 score: 6.4
CVE-2017-8668 
The Volume Manager Extension Driver in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2 allows an attacker to run a specially crafted application and obtain kernel information, aka "Volume Manager Extension Driver Information Disclosure Vulnerability".
CVSS v3.0 score: 5.5
CVSS v2.0 score: 2.1
GHSA-mw67-65x5-h28p 
A bug affects the Linux kernel’s ksmbd NTLMv2 authentication and is known to crash the OS immediately in Linux-based systems.
CVSS v3.1 score: 7.5
CVE-2026-2535 Comfast CF-N1 V2 mbox-config sub_44AB9C command injection
A vulnerability was found in Comfast CF-N1 V2 2.6.0.2. The impacted element is the function sub_44AB9C of the file /cgi-bin/mbox-config?method=SET&section=ptest_channel. The manipulation of the argument channel results in command injection. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 6.3
CVSS v3.0 score: 6.3
CVSS v2.0 score: 6.5
CVE-2025-14526 Tenda CH22 L7Im frmL7ImForm buffer overflow
A security flaw has been discovered in Tenda CH22 1.0.0.1. This affects the function frmL7ImForm of the file /goform/L7Im. Performing a manipulation of the argument page results in buffer overflow. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
CVSS v4.0 score: 8.7
CVSS v3.1 score: 8.8
CVSS v3.0 score: 8.8
CVSS v2.0 score: 9
GHSA-5r6q-2wr3-jrrc 
Unspecified vulnerability in Oracle Solaris 8, 9, 10, and 11 Express allows local users to affect availability, related to Driver/USB.
GHSA-mcg9-53rc-5qrh 
In freeIsolatedUidLocked of ProcessList.java, there is a possible UID reuse due to improper cleanup. This could lead to local escalation of privilege between constrained processes with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-146313311
GHSA-3g98-7fv9-8r7r 
Stack-based buffer overflow in BlazeVideo HDTV Player 2.1, and possibly earlier, allows remote attackers to execute arbitrary code via a long filename in a PLF playlist, a different product than CVE-2006-6199.  NOTE: it was later reported that 3.5 is also affected.
GHSA-5m42-m8mr-g3xp 
IBM Cloud Object System 3.15.8.97 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  213650.
CVSS v3.1 score: 6.4
CVE-2021-27172 
An issue was discovered on FiberHome HG6245D devices through RP2613. A hardcoded GEPON password for root is defined inside /etc/init.d/system-config.sh.
CVSS v3.1 score: 9.8
CVSS v2.0 score: 5
GHSA-24vv-fh33-8gqp 
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BestWebSoft Contact Form to DB by BestWebSoft.This issue affects Contact Form to DB by BestWebSoft: from n/a through 1.7.2.
CVSS v3.1 score: 8.5
CVE-2006-4748 
Multiple SQL injection vulnerabilities in F-ART BLOG:CMS 4.1 allow remote attackers to execute arbitrary SQL commands via the (1) xagent, (2) xpath, (3) xreferer, and (4) xdns parameters in (a) admin/plugins/NP_Log.php, and the (5) pitem parameter in (b) admin/plugins/NP_Poll.php; and allow remote authenticated users to execute arbitrary SQL commands via the (6) pageRef parameter in (c) admin/plugins/NP_Referrer.php.
CVSS v2.0 score: 7.5
GHSA-whc2-9r39-wqcm 
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVSS v3.1 score: 7.8
GHSA-f2j2-75p6-x665 
The Mega Addons plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the vc_saving_data function in versions up to, and including, 4.2.7. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to update the plugin's settings.
CVSS v3.1 score: 6.5
CVE-2018-1000221 
pkgconf version 1.5.0 to 1.5.2 contains a Buffer Overflow vulnerability in dequote() that can result in dequote() function returns 1-byte allocation if initial length is 0, leading to buffer overflow. This attack appear to be exploitable via specially crafted .pc file. This vulnerability appears to have been fixed in 1.5.3.
CVSS v3.0 score: 9.8
CVSS v2.0 score: 7.5
CVE-2022-41512 
An arbitrary file upload vulnerability in the component /php_action/editFile.php of Online Diagnostic Lab Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file.
CVSS v3.1 score: 7.2
CVE-2025-13510 Iskra iHUB and iHUB Lite has a Missing Authentication for Critical Function vulnerabilitiy
The Iskra iHUB and iHUB Lite smart metering gateway exposes its web management interface without requiring authentication, allowing unauthenticated users to access and modify critical device settings.
CVSS v4.0 score: 9.3
GHSA-76vf-mpmx-777j Graylog Allows Session Takeover via Insufficient HTML Sanitization
ImpactIt is possible to obtain user session cookies by submitting an HTML form as part of an Event Definition Remediation Step field. 
For this attack to succeed, the attacker needs a user account with permissions to create event definitions, while the user must have permissions to view alerts. Additionally, an active Input must be present on the Graylog server that is capable of receiving form data (e.g. a HTTP input, TCP raw or syslog etc).PatchesWorkaroundsNone, as long as the relatively rare prerequisites are met.Analysis provided by Fabian Yamaguchi - Whirly Labs (Pty) Ltd
CVSS v3.1 score: 8
CVE-2024-5971 Undertow: response write hangs in case of java 17 tlsv1.3 newsessionticket
A vulnerability was found in Undertow, where the chunked response hangs after the body was flushed. The response headers and body were sent but the client would continue waiting as Undertow does not send the expected 0\r\n termination of the chunked response. This results in uncontrolled resource consumption, leaving the server side to a denial of service attack. This happens only with Java 17 TLSv1.3 scenarios.
CVSS v3.1 score: 7.5
CVE-2008-1569 
policyd-weight 0.1.14 beta-16 and earlier allows local users to modify or delete arbitrary files via a symlink attack on temporary files that are used when creating a socket.
CVSS v2.0 score: 3.3
CVE-2022-24498 Windows iSCSI Target Service Information Disclosure Vulnerability
Windows iSCSI Target Service Information Disclosure Vulnerability
CVSS v3.1 score: 6.5
CVE-2019-1832 Cisco Firepower Threat Defense Software Detection Engine Policy Bypass Vulnerability
A vulnerability in the detection engine of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured access control policies. The vulnerability is due to improper validation of ICMP packets. An attacker could exploit this vulnerability by sending crafted ICMP packets to the affected device. A successful exploit could allow the attacker to bypass configured access control policies.
CVSS v3.0 score: 5.8
GHSA-wwcf-g45v-mxvf 
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Serhii Pasyuk Gmedia Photo Gallery allows PHP Local File Inclusion. This issue affects Gmedia Photo Gallery: from n/a through 1.23.0.
CVSS v3.1 score: 7.5
GHSA-qr33-xh36-3fgw 
The mintToken function of a smart contract implementation for hentaisolo (HAO), an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS v3.0 score: 7.5
GHSA-w37c-q653-qg95 actionpack Cross-site Scripting vulnerability
Cross-site scripting (XSS) vulnerability in the simple_format helper in `actionpack/lib/action_view/helpers/text_helper.rb` in Ruby on Rails 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML attribute.
ICSA-25-203-03 Schneider Electric EcoStruxure
Schneider Electric is aware of a vulnerability in its EcoStruxure™ Power Monitoring Expert (PME) and 
EcoStruxure™ Power Operation (EPO) products. 
EcoStruxure™ Power Monitoring Expert (PME) https://www.se.com/us/en/product-range/65404-ecostruxure-power-monitoring-expert/#overview is an on-premises software used to help power critical and 
energy-intensive facilities maximize uptime and operational efficiency. Note: There are some instances of PME 
being deployed in a Managed Service model.
EcoStruxure™ Power Operation (EPO) and EcoStruxure™ Power SCADA Operation (PSO) https://www.se.com/us/en/product-range/65405-ecostruxure-power-operation/?parent-subcategory-id=59326966&filter=business-4-low-voltage-products-and-systems#overview are on-premises 
software offers that provides a single platform to monitor and control medium and lower power systems.
Failure to apply the remediation provided below may risk unintended data exposure to other authenticated 
users on that system.
CVSS v3.1 score: 4.3
GHSA-65qj-84mc-xh49 
A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker with valid administrator credentials to execute arbitrary commands on the underlying operating system of an affected device. The vulnerability is due to insufficient validation of arguments passed to certain CLI commands. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with elevated privileges. An attacker would need valid administrator credentials to exploit this vulnerability.
GHSA-p5rj-hmpq-gmgh 
Crestron Electronics DM-TXRX-100-STR devices with firmware before 1.3039.00040 rely on the client to perform authentication, which allows remote attackers to obtain access by setting the value of objresp.authenabled to 1.
CVSS v3.0 score: 9.8
GHSA-399f-937r-fwr9 
Adobe Media Encoder versions 22.0, 15.4.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious 3GP ?file
CVSS v3.1 score: 7.8
GHSA-49q9-hj6w-v395 
Certain size values in firmware binary headers
could trigger out of bounds reads during signature validation, leading to
denial of service or potentially limited leakage of information about
out-of-bounds memory contents.
CVSS v3.1 score: 8.2
CVE-2009-4096 
RADIO istek scripti 2.5 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain user credentials via a direct request for estafresgaftesantusyan.inc.
CVSS v2.0 score: 7.5
GHSA-p9m2-974m-225h 
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). Affected devices do not properly validate the authentication when performing certain actions in the web interface allowing an unauthenticated attacker to access and edit device configuration information of devices for which they have no privileges.
CVSS v4.0 score: 7.2
CVSS v3.1 score: 7.6
GHSA-jggr-hhvm-4c9f 
In the Linux kernel, the following vulnerability has been resolved:cpufreq: loongson3: Use raw_smp_processor_id() in do_service_request()Use raw_smp_processor_id() instead of plain smp_processor_id() in
do_service_request(), otherwise we may get some errors with the driver
enabled:BUG: using smp_processor_id() in preemptible [00000000] code: (udev-worker)/208
 caller is loongson3_cpufreq_probe+0x5c/0x250 [loongson3_cpufreq]
CVSS v3.1 score: 5.5
CVE-2024-42508 
This vulnerability could be exploited, leading to unauthorized disclosure of information to authenticated users.
CVSS v3.1 score: 5.5
CVE-2006-6555 
Multiple SQL injection vulnerabilities in EasyFill before 0.5.1 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS v2.0 score: 7.5
CVE-2022-2306 Insufficient Session Expiration in heroiclabs/nakama
Old session tokens can be used to authenticate to the application and send authenticated requests.
CVSS v3.0 score: 8.2
CVE-2013-0479 
IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 do not properly restrict file types and extensions, which allows remote authenticated users to bypass intended access restrictions via a crafted filename.
CVSS v2.0 score: 4
GHSA-m7cq-vpfp-92jw 
A buffer overflow vulnerability was discovered in Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.8.4, Zoom Client for Meetings for Blackberry (for Android and iOS) before version 5.8.1, Zoom Client for Meetings for intune (for Android and iOS) before version 5.8.4, Zoom Client for Meetings for Chrome OS before version 5.0.1, Zoom Rooms for Conference Room (for Android, AndroidBali, macOS, and Windows) before version 5.8.3, Controllers for Zoom Rooms (for Android, iOS, and Windows) before version 5.8.3, Zoom VDI before version 5.8.4, Zoom Meeting SDK for Android before version 5.7.6.1922, Zoom Meeting SDK for iOS before version 5.7.6.1082, Zoom Meeting SDK for macOS before version 5.7.6.1340, Zoom Meeting SDK for Windows before version 5.7.6.1081, Zoom Video SDK (for Android, iOS, macOS, and Windows) before version 1.1.2, Zoom On-Premise Meeting Connector Controller before version 4.8.12.20211115, Zoom On-Premise Meeting Connector MMR before version 4.8.12.20211115, Zoom On-Premise Recording Connector before version 5.1.0.65.20211116, Zoom On-Premise Virtual Room Connector before version 4.4.7266.20211117, Zoom On-Premise Virtual Room Connector Load Balancer before version 2.5.5692.20211117, Zoom Hybrid Zproxy before version 1.0.1058.20211116, and Zoom Hybrid MMR before version 4.6.20211116.131_x86-64. This can potentially allow a malicious actor to crash the service or application, or leverage this vulnerability to execute arbitrary code.
CVSS v3.1 score: 9.8
RHSA-2024:1998 Red Hat Security Advisory: libreswan security update
libreswan: Missing PreSharedKey for connection can cause crash
CVSS v3.1 score: 5
GHSA-mx32-rp5g-c3fj 
Cross-site scripting (XSS) vulnerability in IBM Content Navigator 2.0.0 and 2.0.1 before 2.0.1.2 FP002 IF003 and 2.0.3 before 2.0.3.2 FP002 allows remote attackers to inject arbitrary web script or HTML via the Accept-Language HTTP header.
CVE-2021-21161 
Heap buffer overflow in TabStrip in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS v3.1 score: 8.8
CVSS v2.0 score: 6.8
GHSA-v77x-x335-v6m9 
Multiple SQL injection vulnerabilities in KLF-DESIGN (aka Kim L. Fraser) KLF-REALTY allow remote attackers to execute arbitrary SQL commands via the (1) category and (2) agent parameters in (a) search_listing.asp, and the (3) property_id parameter in (b) detail.asp.
CVE-2024-38101 Windows Layer-2 Bridge Network Driver Denial of Service Vulnerability
Windows Layer-2 Bridge Network Driver Denial of Service Vulnerability
CVSS v3.1 score: 6.5
RHSA-2020:4348 Red Hat Security Advisory: java-1.8.0-openjdk security update
OpenJDK: High memory usage during deserialization of Proxy class with many interfaces (Serialization, 8236862) OpenJDK: Credentials sent over unencrypted LDAP connection (JNDI, 8237990) OpenJDK: Certificate blacklist bypass via alternate certificate encodings (Libraries, 8237995) OpenJDK: Integer overflow leading to out-of-bounds access (Hotspot, 8241114) OpenJDK: Missing permission check in path to URI conversion (Libraries, 8242680) OpenJDK: Incomplete check for invalid characters in URI to path conversion (Libraries, 8242685) OpenJDK: Race condition in NIO Buffer boundary checks (Libraries, 8244136)
CVSS v3.1 score: 5.3
CVE-2025-10795 code-projects Online Bidding System bidupdate.php sql injection
A vulnerability has been found in code-projects Online Bidding System 1.0. This affects an unknown part of the file /administrator/bidupdate.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 7.3
CVSS v3.0 score: 7.3
CVSS v2.0 score: 7.5
GHSA-g43p-fpv4-prfq 
Buffer overflow for the Intel(R) Data Center Graphics Driver for VMware ESXi software before version 2.0.2 within Ring 1: Device Drivers may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable local code execution. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (high) impacts.
CVSS v4.0 score: 9.3
CVE-2023-28113 russh may use insecure Diffie-Hellman keys
russh is a Rust SSH client and server library. Starting in version 0.34.0 and prior to versions 0.36.2 and 0.37.1, Diffie-Hellman key validation is insufficient, which can lead to insecure shared secrets and therefore breaks confidentiality. Connections between a russh client and server or those of a russh peer with some other misbehaving peer are most likely to be problematic. These may vulnerable to eavesdropping. Most other implementations reject such keys, so this is mainly an interoperability issue in such a case. This issue is fixed in versions 0.36.2 and 0.37.1
CVSS v3.1 score: 5.9
CVE-2009-3420 
Multiple cross-site scripting (XSS) vulnerabilities in index.php in the Publisher module 2.0 for Miniweb allow remote attackers to inject arbitrary web script or HTML via the (1) begin parameter and the (2) PATH_INFO.
CVSS v2.0 score: 4.3
CVE-2024-2961 
The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable.
CVSS v3.1 score: 7.3
CVE-2019-15720 
CloudBerry Backup v6.1.2.34 allows local privilege escalation via a Pre or Post backup action. With only user-level access, a user can modify the backup plan and add a Pre backup action script that executes on behalf of NT AUTHORITY\SYSTEM.
CVSS v3.0 score: 7.8
CVSS v2.0 score: 7.2
GHSA-64mf-xhgv-qwph 
Out of bounds memory access in WebHID in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a malicious HID device. (Chromium security severity: High)
CVSS v3.1 score: 9.8
CVE-2026-53119 platform/wmi: use generic driver_override infrastructure
In the Linux kernel, the following vulnerability has been resolved:

platform/wmi: use generic driver_override infrastructure

When a driver is probed through __driver_attach(), the bus' match()
callback is called without the device lock held, thus accessing the
driver_override field without a lock, which can cause a UAF.

Fix this by using the driver-core driver_override infrastructure taking
care of proper locking internally.

Note that calling match() from __driver_attach() without the device lock
held is intentional. [1]
CVSS v3.1 score: 7.8
GHSA-rc6c-3j97-8gfm 
SimplePHPscripts News Script PHP Pro 2.3 does not properly set the HttpOnly Flag from Session Cookies.
GHSA-55c3-q2mc-rv5w 
The lack of cryptographic mechanisms to ensure the integrity and authenticity of communications in Ghost Robotics' Vision 60 robot (APK v5.5.0) exposes the system to man-in-the-middle attacks. An attacker located on the local network can use ARP spoofing and selective traffic blocking techniques to intercept and manipulate packets between the legitimate operator and the robot. This allows the attacker to disconnect the original controller, establish unauthorized communications, and prevent the operator from regaining control of the device, seriously compromising the confidentiality, integrity, and availability (CIA) of operations.
CVSS v4.0 score: 8.7
CVE-2024-10989 code-projects E-Health Care System detail.php sql injection
A vulnerability classified as critical has been found in code-projects E-Health Care System 1.0. This affects an unknown part of the file /Admin/detail.php. The manipulation of the argument s_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory confuses the vulnerability class of this issue.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 6.3
CVSS v3.0 score: 6.3
CVSS v2.0 score: 6.5
CVE-2024-11807 NPS computy <= 2.8.0 - Reflected Cross-Site Scripting
The NPS computy plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'data1' and 'data2' parameters in all versions up to, and including, 2.8.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS v3.1 score: 6.1
CVE-2024-25088 
Improper privilege management in Jungo WinDriver before 12.5.1 allows local attackers to escalate privileges and execute arbitrary code.
CVSS v3.1 score: 7.8
GHSA-4wmm-6qxj-fpj4 AVideo has a Path Traversal in listFiles.json.php Enables Server Filesystem Enumeration
SummaryThe `listFiles.json.php` endpoint accepts a `path` POST parameter and passes it directly to `glob()` without restricting the path to an allowed base directory. An authenticated uploader can traverse the entire server filesystem by supplying arbitrary absolute paths, enumerating `.mp4` filenames and their full absolute filesystem paths wherever they exist on the server — including locations outside the web root, such as private or premium media directories.DetailsThe vulnerable code is at `objects/listFiles.json.php:8-45`:The `$_POST['path']` value is used directly in `glob()` with no call to `realpath()` for normalization and no prefix check against a permitted base directory (e.g., `$global['systemRootPath'] . 'videos/'`). The response includes `obj->path` containing the full absolute filesystem path of each matched file.The extension filter (`{*.mp4,*.mp4,*.MP4}`) limits results to `.mp4` files, which prevents reading credentials or source code but does not prevent enumeration of video files stored in access-controlled locations such as:Premium/paid content directoriesPrivate or unlisted media storesBackup directories containing `.mp4` filesPaths revealing sensitive server directory structure`canUpload` is a standard low-privilege role granted to any registered uploader; it does not imply administrative trust.PoC**Expected behavior:** Only files within the designated upload directory should be listable.
**Actual behavior:** Files from any path readable by the web server process are returned with full absolute paths.Impact**Unauthorized media enumeration:** An uploader can discover private, premium, or access-controlled `.mp4` files stored outside their permitted directory.**Filesystem structure disclosure:** Full absolute paths reveal server directory layout, aiding further attacks.**Content bypass:** In AVideo deployments where premium video files are stored in filesystem directories not protected by application access control, this exposes the filenames and paths needed to directly access them if other path traversal or direct-file-access weaknesses are present.**Blast radius:** Requires `canUpload` permission (low privilege), but this is the standard permission for all video uploaders on a multi-user AVideo instance.Recommended FixRestrict the supplied path to an allowed base directory using `realpath()`:`realpath()` resolves `../` sequences before the prefix check, preventing traversal bypasses.
CVSS v3.1 score: 4.3
CVE-2025-71412 In CPDLC, False Emergency or Status Messages Will be Accepted as Legitimate
Injection of false emergency or status messages over CPDLC may lead to misallocation of resources, operational confusion, and improper response actions by flight crews, traffic controllers, and ground operations.  This type of attack can be carried out remotely over radio frequency.
CVSS v4.0 score: 7.1
CVSS v3.1 score: 7.1
GHSA-rvhx-c29r-93j7 
In the Linux kernel, the following vulnerability has been resolved:net: Fix icmp host relookup triggering ip_rt_bugarp link failure may trigger ip_rt_bug while xfrm enabled, call trace is:WARNING: CPU: 0 PID: 0 at net/ipv4/route.c:1241 ip_rt_bug+0x14/0x20
Modules linked in:
CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.0-rc6-00077-g2e1b3cc9d7f7
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
RIP: 0010:ip_rt_bug+0x14/0x20
Call Trace:
 <IRQ>
 ip_send_skb+0x14/0x40
 __icmp_send+0x42d/0x6a0
 ipv4_link_failure+0xe2/0x1d0
 arp_error_report+0x3c/0x50
 neigh_invalidate+0x8d/0x100
 neigh_timer_handler+0x2e1/0x330
 call_timer_fn+0x21/0x120
 __run_timer_base.part.0+0x1c9/0x270
 run_timer_softirq+0x4c/0x80
 handle_softirqs+0xac/0x280
 irq_exit_rcu+0x62/0x80
 sysvec_apic_timer_interrupt+0x77/0x90The script below reproduces this scenario:
ip xfrm policy add src 0.0.0.0/0 dst 0.0.0.0/0 \
	dir out priority 0 ptype main flag localok icmp
ip l a veth1 type veth
ip a a 192.168.141.111/24 dev veth0
ip l s veth0 up
ping 192.168.141.155 -c 1icmp_route_lookup() create input routes for locally generated packets
while xfrm relookup ICMP traffic.Then it will set input route
(dst->out = ip_rt_bug) to skb for DESTUNREACH.For ICMP err triggered by locally generated packets, dst->dev of output
route is loopback. Generally, xfrm relookup verification is not required
on loopback interfaces (net.ipv4.conf.lo.disable_xfrm = 1).Skip icmp relookup for locally generated packets to fix it.
CVSS v3.1 score: 5.5
GHSA-xmx6-fp5q-5xrh 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Omnify, Inc. Omnify allows Reflected XSS. This issue affects Omnify: from n/a through 2.0.3.
CVSS v3.1 score: 7.1
CVE-2020-25055 
An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. The persona service allows attackers (who control an unprivileged SecureFolder process) to bypass admin restrictions in KnoxContainer. The Samsung ID is SVE-2020-18133 (August 2020).
CVSS v3.1 score: 9.8
CVSS v2.0 score: 7.5
CVE-2006-0181 
Cisco Security Monitoring, Analysis and Response System (CS-MARS) before 4.1.3 has an undocumented administrative account with a default password, which allows local users to gain privileges via the expert command.
CVSS v2.0 score: 7.2
CVE-2011-1803 
An issue exists in third_party/WebKit/Source/WebCore/svg/animation/SVGSMILElement.h in WebKit in Google Chrome before Blink M11 and M12 when trying to access a removed smil element.
CVSS v3.1 score: 6.5
CVSS v2.0 score: 4.3
CVE-2022-3570 
Multiple heap buffer overflows in tiffcrop.c utility in libtiff library Version 4.4.0 allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could result into application crash, potential information disclosure or any other context-dependent impact
CVSS v3.1 score: 7.7
CVE-2020-37127 dnsmasq-utils 2.79-1 - 'dhcp_release' Denial of Service
Dnsmasq-utils 2.79-1 contains a buffer overflow vulnerability in the dhcp_release utility that allows attackers to cause a denial of service by supplying excessive input. Attackers can trigger a core dump and terminate the dhcp_release process by sending a crafted input string longer than 16 characters.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 5.5
RHSA-2025:9314 Red Hat Security Advisory: gimp security update
gimp: GIMP ICO File Parsing Integer Overflow gimp: Multiple heap buffer overflows in TGA parser gimp: Multiple use after free in XCF parser
CVSS v3.1 score: 7.3
CVE-2022-3357 Smart Slider 3 < 3.5.1.11 - PHP Object Injection
The Smart Slider 3 WordPress plugin before 3.5.1.11 unserialises the content of an imported file, which could lead to PHP object injection issues when a user import (intentionally or not) a malicious file, and a suitable gadget chain is present on the site.
CVSS v3.1 score: 8.8
CVE-2021-42529 XMP-Toolkit SDK Stack-based Buffer Overflow Could Lead To Arbitrary Code Execution
XMP Toolkit SDK version 2021.07 (and earlier) is affected by a stack-based buffer overflow vulnerability potentially resulting in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted file.
CVSS v3.1 score: 7.8
RHSA-2015:1214 Red Hat Security Advisory: flash-plugin security update
flash-plugin: information disclosure issues fixed in APSB15-16 flash-plugin: information disclosure issues fixed in APSB15-16 flash-plugin: information disclosure issues fixed in APSB15-16 flash-plugin: information disclosure issues fixed in APSB15-16 flash-plugin: multiple code execution issues fixed in APSB15-16 flash-plugin: multiple code execution issues fixed in APSB15-16 flash-plugin: multiple code execution issues fixed in APSB15-16 flash-plugin: multiple code execution issues fixed in APSB15-16 flash-plugin: multiple code execution issues fixed in APSB15-16 flash-plugin: multiple code execution issues fixed in APSB15-16 flash-plugin: multiple code execution issues fixed in APSB15-16 flash-plugin: multiple code execution issues fixed in APSB15-16 flash-plugin: information disclosure issues fixed in APSB15-16 flash-plugin: multiple code execution issues fixed in APSB15-16 flash-plugin: multiple code execution issues fixed in APSB15-16 flash-plugin: multiple code execution issues fixed in APSB15-16 flash-plugin: multiple code execution issues fixed in APSB15-16 flash-plugin: multiple code execution issues fixed in APSB15-16 flash-plugin: multiple code execution issues fixed in APSB15-16 flash-plugin: multiple code execution issues fixed in APSB15-16 flash-plugin: multiple code execution issues fixed in APSB15-16 flash-plugin: multiple code execution issues fixed in APSB15-16 flash-plugin: multiple code execution issues fixed in APSB15-16 flash-plugin: multiple code execution issues fixed in APSB15-16 flash-plugin: multiple code execution issues fixed in APSB15-16 flash-plugin: multiple code execution issues fixed in APSB15-16 flash-plugin: multiple code execution issues fixed in APSB15-16 flash-plugin: multiple code execution issues fixed in APSB15-16 flash-plugin: multiple code execution issues fixed in APSB15-16 flash-plugin: multiple code execution issues fixed in APSB15-16 flash-plugin: multiple code execution issues fixed in APSB15-16 flash-plugin: information disclosure issues fixed in APSB15-16 flash-plugin: multiple code execution issues fixed in APSB15-16 flash-plugin: multiple code execution issues fixed in APSB15-16 flash-plugin: code execution issue in APSA15-03 / APSB15-16 flash-plugin: multiple code execution issues fixed in APSB15-16
GHSA-pf3p-v9xp-mrvf py-lmdb Invalid write operation
An issue was discovered in py-lmdb 0.97. For certain values of `mn_flags`, `mdb_cursor_set` triggers a memcpy with an invalid write operation within `mdb_xcursor_init1`. NOTE: this outcome occurs when accessing a `data.mdb` file supplied by an attacker.
CVSS v4.0 score: 9.3
CVSS v3.1 score: 9.8
CVE-2025-9299 Tenda M3 getMasterPassengerAnalyseData formGetMasterPassengerAnalyseData stack-based overflow
A vulnerability has been found in Tenda M3 1.0.0.12. Affected by this vulnerability is the function formGetMasterPassengerAnalyseData of the file /goform/getMasterPassengerAnalyseData. The manipulation of the argument Time leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 8.7
CVSS v3.1 score: 8.8
CVSS v3.0 score: 8.8
CVSS v2.0 score: 9
GHSA-9w7p-8933-f5gq 
The Embed PDF WordPress plugin through 1.0.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS v3.1 score: 5.4
GHSA-79wf-qgrg-2p6c 
An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser.
CVSS v3.1 score: 5.9
GHSA-3678-gxh4-fv44 
A flaw has been found in cdevroe unmark up to 1.9.3. This vulnerability affects unknown code of the file application/views/layouts/topbar/searchform.php. This manipulation of the argument q causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0 score: 2.1
CVSS v3.1 score: 4.3
GHSA-3q67-g228-h5qx 
An access issue was addressed with additional sandbox restrictions. This issue is fixed in iOS 13.4 and iPadOS 13.4, watchOS 6.2. Setting an alternate app icon may disclose a photo without needing permission to access photos.
CVE-2026-39354 Scoold has an Authenticated Arbitrary Question Overwrite via Client-Controlled postId in POST /questions/ask
Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.66.2, an authenticated authorization flaw in Scoold allows any logged-in, low-privilege user to overwrite another user's existing question by supplying that question's public ID as the postId parameter to POST /questions/ask. Because question IDs are exposed in normal question URLs, a low-privilege attacker can take a victim question ID from a public page and cause attacker-controlled content to be stored under that existing question object. This causes direct integrity loss of user-generated content and corrupts the integrity of the existing discussion thread. This vulnerability is fixed in 1.66.2.
CVSS v3.1 score: 6.5
CVE-2000-1199 
PostgreSQL stores usernames and passwords in plaintext in (1) pg_shadow and (2) pg_pwd, which allows attackers with sufficient privileges to gain access to databases.
CVSS v2.0 score: 4.6
GHSA-fx5q-fpjj-9r8j 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RTO GmbH Dynamic Conditions allows Stored XSS. This issue affects Dynamic Conditions: from n/a through 1.7.4.
CVSS v3.1 score: 6.5
CVE-2018-8123 
An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerability." This affects Microsoft Edge. This CVE ID is unique from CVE-2018-1021.
CVSS v3.0 score: 4.3
CVSS v2.0 score: 4.3
CVE-2024-29901 @workos-inc/authkit-nextjs session replay vulnerability
The AuthKit library for Next.js provides helpers for authentication and session management using WorkOS & AuthKit with Next.js.
A user can reuse an expired session by controlling the `x-workos-session` header. The vulnerability is patched in v0.4.2.
CVSS v3.1 score: 4.8
GHSA-5pjv-qvv6-rwqw 
Stack-based buffer overflow in goform/formExportDataLogs in HP Power Manager before 4.2.10 allows remote attackers to execute arbitrary code via a long fileName parameter.
CVE-2023-4002 Insertion of Sensitive Information Into Sent Data in GitLab
An issue has been discovered in GitLab EE affecting all versions starting from 14.1 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for EE-licensed users to link any security policy project by its ID to projects or groups the user has access to, potentially revealing the security projects's configured security policies.
CVSS v3.1 score: 5.3
CVE-2024-41460 
Tenda FH1201 v1.2.0.14 was discovered to contain a stack-based buffer overflow vulnerability via the entrys parameter at ip/goform/RouteStatic.
CVSS v3.1 score: 6.5
CVE-2025-5472 Denial of Service via Uncontrolled Recursive JSON Parsing in JSONReader in run-llama/llama_index
The JSONReader in run-llama/llama_index versions 0.12.28 is vulnerable to a stack overflow due to uncontrolled recursive JSON parsing. This vulnerability allows attackers to trigger a Denial of Service (DoS) by submitting deeply nested JSON structures, leading to a RecursionError and crashing applications. The root cause is the unsafe recursive traversal design and lack of depth validation, which makes the JSONReader susceptible to stack overflow when processing deeply nested JSON. This impacts the availability of services, making them unreliable and disrupting workflows. The issue is resolved in version 0.12.38.
CVSS v3.0 score: 6.5
GHSA-8xff-473h-f863 Uncaught Exception Handling Parsing Errors on Line Terminators
The span rendering would panic when handling failed parsing of queries where the error occurred on a line terminator character.ImpactA client that is authorized to run queries in a SurrealDB server is able to execute a malformed query which will fail to parse on a line terminator character and cause a panic in the span rendering code. This will crash the server, leading to denial of service.PatchesVersion 1.2.1 and later are not affected by this issue.WorkaroundsConcerned users unable to update may want to limit the ability of untrusted users to run arbitrary SurrealQL queries in the affected versions of SurrealDB. To limit the impact of the denial of service, SurrealDB administrators may also want to ensure that the SurrealDB process is running so that it can be automatically re-started after a crash.References#3527https://github.com/StarlaneStudios/Surrealist/issues/177
CVSS v3.1 score: 6.5
GHSA-r9q7-6mw7-hmpc 
The VMware vCenter Server contains a use-after-free vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may exploit this issue to execute arbitrary code on the underlying operating system that hosts vCenter Server.
CVSS v3.1 score: 8.1
CVE-2024-13700 Embed Swagger UI <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Embed Swagger UI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpsgui' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1 score: 6.4
CVE-2010-1952 
Directory traversal vulnerability in the BeeHeard (com_beeheard) and BeeHeard Lite (com_beeheardlite) component 1.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
CVSS v2.0 score: 7.5
CVE-2006-2774 
Cross-site scripting (XSS) vulnerability in search.php in QontentOne CMS allows remote attackers to inject arbitrary web script or HTML via the search_phrase parameter.
CVSS v2.0 score: 6.8
GHSA-p8h8-xw72-9c2w 
IBM DB2 UDB before 8.2 Fixpak 16 does not properly check authorization for the ALTER TABLE statement, which has unknown impact and attack vectors.
CVE-2025-21997 xsk: fix an integer overflow in xp_create_and_assign_umem()
In the Linux kernel, the following vulnerability has been resolved:

xsk: fix an integer overflow in xp_create_and_assign_umem()

Since the i and pool->chunk_size variables are of type 'u32',
their product can wrap around and then be cast to 'u64'.
This can lead to two different XDP buffers pointing to the same
memory area.

Found by InfoTeCS on behalf of Linux Verification Center
(linuxtesting.org) with SVACE.
CVSS v3.1 score: 5.5
GHSA-2hp3-cccc-h69r 
A security flaw has been discovered in Tenda HG9 300001138. Affected is an unknown function of the file /boaform/formSamba of the component Samba Configuration Endpoint. The manipulation of the argument sambaCap results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
CVSS v4.0 score: 7.4
CVSS v3.1 score: 8.8
CVE-2024-5665 Login/Signup Popup ( Inline Form + Woocommerce ) 2.7.1 - 2.7.2 - Missing Authorization to Arbitrary Options Exposure
The Login/Signup Popup ( Inline Form + Woocommerce ) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ‘export_settings’ function in versions 2.7.1 to 2.7.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read arbitrary options on affected sites.
CVSS v3.1 score: 4.3
GHSA-24jq-7r79-4823 
Mbed TLS 3.5.x through 3.6.x before 3.6.2 has a buffer underrun in pkwrite when writing an opaque key pair
CVSS v3.1 score: 9.8
GHSA-xm38-q6p9-jrgg 
A vulnerability was identified in Ichigo3766 image-gen-mcp 0.1.0. The impacted element is an unknown function of the file src/index.ts of the component upscale_images. Such manipulation of the argument output_path leads to path traversal. The attack must be carried out locally. The project was informed of the problem early through an issue report but has not responded yet.
CVSS v4.0 score: 1.9
CVSS v3.1 score: 5.3
CVE-2022-49270 dm: fix use-after-free in dm_cleanup_zoned_dev()
In the Linux kernel, the following vulnerability has been resolved:

dm: fix use-after-free in dm_cleanup_zoned_dev()

dm_cleanup_zoned_dev() uses queue, so it must be called
before blk_cleanup_disk() starts its killing:

blk_cleanup_disk->blk_cleanup_queue()->kobject_put()->blk_release_queue()->
->...RCU...->blk_free_queue_rcu()->kmem_cache_free()

Otherwise, RCU callback may be executed first and
dm_cleanup_zoned_dev() will touch free'd memory:

 BUG: KASAN: use-after-free in dm_cleanup_zoned_dev+0x33/0xd0
 Read of size 8 at addr ffff88805ac6e430 by task dmsetup/681

 CPU: 4 PID: 681 Comm: dmsetup Not tainted 5.17.0-rc2+ #6
 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014
 Call Trace:
  <TASK>
  dump_stack_lvl+0x57/0x7d
  print_address_description.constprop.0+0x1f/0x150
  ? dm_cleanup_zoned_dev+0x33/0xd0
  kasan_report.cold+0x7f/0x11b
  ? dm_cleanup_zoned_dev+0x33/0xd0
  dm_cleanup_zoned_dev+0x33/0xd0
  __dm_destroy+0x26a/0x400
  ? dm_blk_ioctl+0x230/0x230
  ? up_write+0xd8/0x270
  dev_remove+0x156/0x1d0
  ctl_ioctl+0x269/0x530
  ? table_clear+0x140/0x140
  ? lock_release+0xb2/0x750
  ? remove_all+0x40/0x40
  ? rcu_read_lock_sched_held+0x12/0x70
  ? lock_downgrade+0x3c0/0x3c0
  ? rcu_read_lock_sched_held+0x12/0x70
  dm_ctl_ioctl+0xa/0x10
  __x64_sys_ioctl+0xb9/0xf0
  do_syscall_64+0x3b/0x90
  entry_SYSCALL_64_after_hwframe+0x44/0xae
 RIP: 0033:0x7fb6dfa95c27
CVSS v3.1 score: 7.8
PYSEC-2026-1085 
In version 3.25.0 of aimhubio/aim, a denial of service vulnerability exists. By tracking a large number of `Text` objects and then querying them simultaneously through the web API, the Aim web server becomes unresponsive to other requests for an extended period while processing and returning these objects. This vulnerability can be exploited repeatedly, leading to a complete denial of service.
CVSS v3.0 score: 7.5
GHSA-vw8h-m6gw-gg25 
A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka 'Microsoft Edge Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0634, CVE-2019-0645.
CVSS v3.0 score: 7.5
GHSA-9q28-3qg6-wq2f 
In the Linux kernel, the following vulnerability has been resolved:drm/msm: always recover the gpuPreviously, in case there was no more work to do, recover worker
wouldn't trigger recovery and would instead rely on the gpu going to
sleep and then resuming when more work is submitted.Recover_worker will first increment the fence of the hung ring so, if
there's only one job submitted to a ring and that causes an hang, it
will early out.There's no guarantee that the gpu will suspend and resume before more
work is submitted and if the gpu is in a hung state it will stay in that
state and probably trigger a timeout again.Just stop checking and always recover the gpu.Patchwork: https://patchwork.freedesktop.org/patch/704066/
CVSS v3.1 score: 5.5
CVE-2023-32099 Key duplication in GSDK

Compiler removal of buffer clearing in 







sli_se_sign_hash in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM.


CVSS v3.1 score: 5.3
GHSA-c2mq-q2fv-ffhw 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound One Backend Language allows Reflected XSS. This issue affects One Backend Language: from n/a through 1.0.
CVSS v3.1 score: 7.1
CVE-2016-9221 
A Denial of Service Vulnerability in 802.11 ingress connection authentication handling for the Cisco Mobility Express 2800 and 3800 Access Points (APs) could allow an unauthenticated, adjacent attacker to cause authentication to fail. Affected Products: This vulnerability affects Cisco Mobility Express 2800 Series and 3800 Series Access Points when configured in local mode in 40 MHz. More Information: CSCvb33575. Known Affected Releases: 8.2(121.12) 8.4(1.82). Known Fixed Releases: 8.2(131.2) 8.2(131.3) 8.2(131.4) 8.2(141.0) 8.3(104.53) 8.3(104.54) 8.4(1.80) 8.4(1.85).
CVSS v3.0 score: 4.3
CVSS v2.0 score: 3.3
CVE-2025-24012 Umbraco Backoffice Components Have XSS/HTML Injection Vulnerability
Umbraco is a free and open source .NET content management system. Starting in version 14.0.0 and prior to versions 14.3.2 and 15.1.2, authenticated users are able to exploit a cross-site scripting vulnerability when viewing certain localized backoffice components. Versions 14.3.2 and 15.1.2 contain a patch.
CVSS v3.1 score: 4.6
CVE-2025-5281 
Inappropriate implementation in BFCache in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially obtain user information via a crafted HTML page. (Chromium security severity: Medium)
CVSS v3.1 score: 5.4