CIRCL/vulnerability-scores huggingface dataset:
GHSA-8pw3-9m7f-q734 TinaCMS CLI Dev Server Vulnerable to Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS
SummaryThe TinaCMS CLI dev server combines a permissive CORS configuration (Access-Control-Allow-Origin: *) with the path traversal vulnerability (previously reported) to enable a browser-based drive-by attack. A remote attacker can enumerate the filesystem, write arbitrary files, and delete arbitrary files on developer's machines by simply tricking them into visiting a malicious website while tinacms dev is running.DetailsThe TinaCMS dev server sets permissive CORS headers that allow **any origin** to make cross-origin requests:packages/@tinacms/cli/src/server/server.ts:packages/@tinacms/cli/src/next/vite/plugins.ts:When combined with the path traversal vulnerability, this creates a complete attack chain.Attack ScenarioPrerequisitesDeveloper runs `tinacms dev` (default port 4001)Developer visits attacker's website while TinaCMS is running**No other conditions required** - the dev server doesn't need to be:Exposed to the internetBound to 0.0.0.0Accessible outside localhostAttack FlowDeveloper starts TinaCMS: `tinacms dev`Developer browses the web (checking email, social media, etc.)Developer unknowingly visits attacker-controlled page (malicious ad, compromised site, etc.)Attacker's JavaScript exploits CORS + path traversal to read sensitive filesFiles are exfiltrated to attacker's serverPoCAttacker's Malicious Website (evil.html):Demonstration**Step 1:** Start TinaCMS dev server**Step 2:** Host evil.html on attacker server**Step 3:** Developer visits `http://attacker-server:8000/evil.html`**Result:** The browser makes cross-origin requests to localhost:4001.
Because cors() returns Access-Control-Allow-Origin: *, the browser
allows the JavaScript to read the responses. Directory listings from
outside the media directory are sent to the attacker's server.
<img width="1900" height="366" alt="image" src="https://github.com/user-attachments/assets/72fdd31d-dd93-4728-9a4b-4d7d66d33617" />ImpactWho is affectedEvery developer running `tinacms dev` is vulnerable while the dev server is active. No special configuration is required the default setup is exploitable.What an attacker achievesBy hosting a malicious webpage (or injecting script via a compromised ad network, XSS on a forum, etc.), the attacker can silently:**Enumerate the developer's filesystem** directory listings via `/media/list/` with path traversal reveal file and folder names
across the entire filesystem**Discover sensitive files** locate `.env`, `.git/config`,  SSH keys, cloud credentials, database configs**Write arbitrary files** via `/media/upload/` with path traversal, the attacker can overwrite project source files, inject backdoors, or modify build scripts**Delete arbitrary files** via `/media/` DELETE with path traversal
CVSS v3.1 score: 9.6
CVE-2022-43442 
Plaintext storage of a password vulnerability exists in +F FS040U software versions v2.3.4 and earlier, which may allow an attacker to obtain the login password of +F FS040U and log in to the management console.
CVSS v3.1 score: 4.6
GHSA-fch2-qg6h-c37w 
The file picker dialog can choose and display the wrong local default directory when instantiated. On some operating systems, this can lead to information disclosure, such as the operating system or the local account name. This vulnerability affects Firefox < 52 and Thunderbird < 52.
CVSS v3.0 score: 5.5
CVE-2024-0603 ZhiCms giftcontroller.php deserialization
A vulnerability classified as critical has been found in ZhiCms up to 4.0. This affects an unknown part of the file app/plug/controller/giftcontroller.php. The manipulation of the argument mylike leads to deserialization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250839.
CVSS v3.1 score: 7.3
CVSS v3.0 score: 7.3
CVSS v2.0 score: 7.5
GHSA-p8wc-fx77-5g4h 
Unspecified vulnerability in HP OpenView Performance Insight 5.3, 5.31, 5.4, 5.41, 5.41.001, and 5.41.002 allows remote attackers to obtain access via unknown vectors.
CVE-2021-0675 
In alac decoder, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06064258; Issue ID: ALPS06064258.
CVSS v3.1 score: 7.8
CVSS v2.0 score: 7.2
CVE-2008-0742 
Multiple directory traversal vulnerabilities in PowerScripts PowerNews 2.5.6 allow remote attackers to read and include arbitrary files via a .. (dot dot) in the (1) subpage parameter in (a) categories.inc.php, (b) news.inc.php, (c) other.inc.php, (d) permissions.inc.php, (e) templates.inc.php, and (f) users.inc.php in pnadmin/; and (2) the page parameter to (g) pnadmin/index.php.  NOTE: vector 2 is only exploitable by administrators.
CVSS v2.0 score: 7.5
CVE-2016-4225 
Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2016-4223 and CVE-2016-4224.
CVSS v3.1 score: 8.8
CVSS v2.0 score: 6.8
CVE-2021-0391 
In onCreate() of ChooseTypeAndAccountActivity.java, there is a possible way to learn the existence of an account, without permissions, due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-172841550
CVSS v3.1 score: 7.8
CVSS v2.0 score: 6.8
CVE-2024-30525 WordPress Move Addons for Elementor plugin <= 1.2.9 - Broken Access Control vulnerability
Missing Authorization vulnerability in moveaddons Move Addons for Elementor.This issue affects Move Addons for Elementor: from n/a through 1.2.9.
CVSS v3.1 score: 5.3
CVE-2024-35947 dyndbg: fix old BUG_ON in >control parser
In the Linux kernel, the following vulnerability has been resolved:

dyndbg: fix old BUG_ON in >control parser

Fix a BUG_ON from 2009.  Even if it looks "unreachable" (I didn't
really look), lets make sure by removing it, doing pr_err and return
-EINVAL instead.
CVSS v3.1 score: 5.5
CVE-2021-46028 
In mblog <= 3.5.0 there is a CSRF vulnerability in the background article management. The attacker constructs a CSRF load. Once the administrator clicks a malicious link, the article will be deleted.
CVSS v3.1 score: 4.3
CVSS v2.0 score: 4.3
CVE-2022-4671 PixCodes < 2.3.7 - Contributor+ Stored XSS in Shortcode
The PixCodes WordPress plugin before 2.3.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CVSS v3.1 score: 5.4
CVE-2024-22368 
The Spreadsheet::ParseXLSX package before 0.28 for Perl can encounter an out-of-memory condition during parsing of a crafted XLSX document. This occurs because the memoize implementation does not have appropriate constraints on merged cells.
CVSS v3.1 score: 5.5
GHSA-8qh8-q8w7-39v7 
Multiple cross-site scripting (XSS) vulnerabilities in Ublog Reload 1.0.5 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) login.asp; and allow remote authenticated users to inject arbitrary web script or HTML via unspecified parameters to (2) badword.asp, (3) polls.asp, and (4) users.asp.
CVE-2020-7360 Philips SmartControl DLL Hijacking
An Uncontrolled Search Path Element (CWE-427) vulnerability in SmartControl version 4.3.15 and versions released before April 15, 2020 may allow an authenticated user to escalate privileges by placing a specially crafted DLL file in the search path. This issue was fixed in version 1.0.7, which was released after April 15, 2020. (Note, the version numbering system changed significantly between version 4.3.15 and version 1.0.7.)
CVSS v3.1 score: 7.4
GHSA-47gr-pfr8-r958 
Argument injection vulnerability in the iim: URI handler in IBMIM.exe in IBM Installation Manager 1.3.2 and earlier, as used in IBM Rational Robot and Rational Team Concert, allows remote attackers to load arbitrary DLL files via the -vm option, as demonstrated by a reference to a UNC share pathname.
CVE-2018-9052 
In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0xf100283c.
CVSS v3.0 score: 7.8
CVSS v2.0 score: 6.1
GHSA-jhmm-9jgg-76j8 
A vulnerability in the CLI of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to overwrite or read arbitrary files. The attacker would need valid administrator privilege-level credentials. This vulnerability is due to improper input validation of CLI command arguments. An attacker could exploit this vulnerability by using directory traversal techniques when executing a vulnerable command. A successful exploit could allow the attacker to overwrite or read arbitrary files on an affected device.
GHSA-h84w-4wfq-6h9c 
OS Command Injection vulnerability when changing date settings or hostname using web GUI of Nozomi Networks Guardian and CMC allows authenticated administrators to perform remote code execution. This issue affects: Nozomi Networks Guardian 20.0.7.3 version 20.0.7.3 and prior versions. Nozomi Networks CMC 20.0.7.3 version 20.0.7.3 and prior versions.
GHSA-5pp7-xmxh-rxh5 
A potential vulnerability in the SMI callback function used in the legacy BIOS mode USB drivers in some legacy Lenovo and IBM System x servers may allow arbitrary code execution. Servers operating in UEFI mode are not affected.
CVE-2026-46599 Excessive resource consumption in PackBits decompression in golang.org/x/image/tiff
The TIFF decoder does not place a limit on the size of PackBits-compressed data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height and encoded size) to make the decoder decode large amounts of compressed data.
CVSS v3.1 score: 7.5
CVE-2018-16881 
A denial of service vulnerability was found in rsyslog in the imptcp module. An attacker could send a specially crafted message to the imptcp socket, which would cause rsyslog to crash. Versions before 8.27.0 are vulnerable.
CVSS v3.0 score: 5.3
GHSA-3gg7-9q2x-79fc Improper Restriction of Rendered UI Layers or Frames in Keycloak
A vulnerability was found in all versions of Keycloak where, the pages on the Admin Console area of the application are completely missing general HTTP security headers in HTTP-responses. This does not directly lead to a security issue, yet it might aid attackers in their efforts to exploit other problems. The flaws unnecessarily make the servers more prone to Clickjacking, channel downgrade attacks and other similar client-based attack vectors.
GHSA-hxfj-rc88-5v2p 
MedDream PACS Server 6.8.3.751 contains an authenticated remote code execution vulnerability that allows authorized users to upload malicious PHP files. Attackers can exploit the uploadImage.php endpoint by authenticating and uploading a PHP shell to execute arbitrary system commands with elevated privileges.
CVSS v4.0 score: 8.7
CVSS v3.1 score: 8.8
GHSA-mqr3-r4rf-9575 
The Security - Complete (aka com.webroot.security.complete) application 3.6.0.6610 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
GHSA-wg3q-w98j-244c 
In the Linux kernel, the following vulnerability has been resolved:sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx()put_prev_task_scx() warns when a runnable task drops to a lower sched_class
without SCX_OPS_ENQ_LAST, on the assumption that balance_one() would have
kept it running. Core scheduling breaks that: a forced-idle SMT sibling
reschedules through the core_pick fast path in pick_next_task(), which skips
pick_task_scx() and thus balance_one(), so a runnable task can drop to idle
with ENQ_LAST unset.Gate the warning on sched_cpu_cookie_match(): a cookie mismatch means core
scheduling forced the idle, while a match (or core scheduling off) still
catches a genuine missing-ENQ_LAST drop.
GHSA-rr8j-hjqf-g6cv 
A flaw has been found in Jiangmin Antivirus 21. Impacted is the function MessageNotifyCallback in the library kvcore.sys of the component Minifilter Port. Executing a manipulation can lead to improper access controls. The attack needs to be launched locally. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0 score: 7.1
CVSS v3.1 score: 7.8
GHSA-j6px-673q-87gh 
An integer overflow error within the "parse_qt()" function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.12 can be exploited to trigger an infinite loop via a specially crafted Apple QuickTime file.
CVSS v3.0 score: 6.5
GHSA-cfjq-28r2-4jv5 Zitadel May Bypass Second Authentication Factor
SummaryA vulnerability in Zitadel's token verification prematurely marked sessions as authenticated when only one factor was verified.ImpactZitadel provides an API for managing sessions, enabling custom login experiences in a dedicated UI or direct integration into applications. Session Tokens are issued for active sessions, which can be used as Bearer tokens to call the Zitadel API.Starting from 2.55.0 (see other affected versions below), Zitadel only required multi factor authentication in case the login policy has either enabled `requireMFA` or `requireMFAForLocalUsers`. If a user has set up MFA without this requirement, Zitadel would consider single factor auhtenticated sessions as valid as well and not require multiple factors.Bypassing second authentication factors weakens multifactor authentication and enables attackers to bypass the more secure factor. An attacker can target the TOTP code alone, only six digits, bypassing password verification entirely and potentially compromising accounts with 2FA enabled.Affected VersionsSystems using the session API (v2 beta and v2) directly or via the new login UI in the following versions are affected:**4.x**: `4.0.0` to `4.5.0` (including RC versions)**3.x**: `3.0.0` to `3.4.2` (including RC versions)**2.x**: `v2.53.6` to `v2.53.9`,  `v2.54.3` to `v2.54.10`, `2.55.0` to `2.71.17`PatchesThe vulnerability has been addressed in the latest releases. The patch resolves the issue by requiring a configured second factor regardless of the login policies `requireMFA` or `requireMFAForLocalUsers` configuration.4.x: Upgrade to >=[4.6.0](https://github.com/zitadel/zitadel/releases/tag/v4.6.0)
3.x: Update to >=[3.4.3](https://github.com/zitadel/zitadel/releases/tag/v3.4.3)
2.x: Update to >=[2.71.18](https://github.com/zitadel/zitadel/releases/tag/v2.71.18)WorkaroundsThe recommended solution is to update Zitadel to a patched version.QuestionsIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)CreditsThis vulnerability was found by [zentrust partners GmbH](https://zentrust.partners) during a scheduled penetration test. Thank you to the analysts Martin Tschirsich, Joud Zakharia, Christopher Baumann.
The full report will be made public after the complete review.
CVSS v4.0 score: 8.7
CVE-2026-31578 media: as102: fix to not free memory after the device is registered in as102_usb_probe()
In the Linux kernel, the following vulnerability has been resolved:

media: as102: fix to not free memory after the device is registered in as102_usb_probe()

In as102_usb driver, the following race condition occurs:
```
		CPU0						CPU1
as102_usb_probe()
  kzalloc(); // alloc as102_dev_t
  ....
  usb_register_dev();
						fd = sys_open("/path/to/dev"); // open as102 fd
						....
  usb_deregister_dev();
  ....
  kfree(); // free as102_dev_t
  ....
						sys_close(fd);
						  as102_release() // UAF!!
						    as102_usb_release()
						      kfree(); // DFB!!
```

When a USB character device registered with usb_register_dev() is later
unregistered (via usb_deregister_dev() or disconnect), the device node is
removed so new open() calls fail. However, file descriptors that are
already open do not go away immediately: they remain valid until the last
reference is dropped and the driver's .release() is invoked.

In as102, as102_usb_probe() calls usb_register_dev() and then, on an
error path, does usb_deregister_dev() and frees as102_dev_t right away.
If userspace raced a successful open() before the deregistration, that
open FD will later hit as102_release() --> as102_usb_release() and access
or free as102_dev_t again, occur a race to use-after-free and
double-free vuln.

The fix is to never kfree(as102_dev_t) directly once usb_register_dev()
has succeeded. After deregistration, defer freeing memory to .release().

In other words, let release() perform the last kfree when the final open
FD is closed.
CVSS v3.1 score: 7.8
CVE-2026-28984 
The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10. Processing maliciously crafted web content may lead to an unexpected Safari crash.
GHSA-qv8p-84pr-826v 
Use after free in Dawn in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS v3.1 score: 8.8
ICSA-25-105-04 Growatt Cloud Applications
An authenticated attacker can achieve stored XSS by exploiting improper sanitization of the plant name value while adding or editing a plant. An unauthenticated attacker can check the existence of usernames in the system by querying an API. An authenticated attacker can obtain any plant name by knowing the plant ID. An unauthenticated attacker can obtain a user's plant list by knowing the username. An unauthenticated attacker can obtain a list of smart devices by knowing a valid username. An  unauthenticated attacker can infer the existence of usernames in the system by querying an API. An unauthenticated attacker can get users' emails by knowing usernames. A password reset email will be sent in response to this unsolicited request. An unauthenticated attacker can obtain a serial number of a smart meter(s) using its owner's username.  An attacker can change registered email addresses of other users and take over arbitrary accounts. Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "rooms"). Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "scenes"). An attacker can get information about the groups of the smart home devices for arbitrary users (i.e., "rooms"). Unauthenticated attackers can query an API endpoint and get device details. Unauthenticated attackers can rename arbitrary devices of arbitrary users (i.e., EV chargers). An unauthenticated attacker can obtain other users' charger information. An unauthenticated attacker can obtain EV charger energy consumption information of other users. An unauthenticated attacker can obtain EV charger version and firmware upgrading history by knowing the charger ID. An unauthenticated attacker can delete any user's "rooms" by knowing the user's and room IDs. An unauthenticated attacker can hijack other users' devices and potentially control them. An attacker can export other users' plant information. An attacker can upload an arbitrary file instead of a plant image. Due to lack of server-side input validation, attackers can inject malicious JavaScript code into users personal spaces of the web portal. An unauthenticated attackers can obtain a list of smart devices by knowing a valid username through an unprotected API. Unauthenticated attackers can send configuration settings to device and possible perform physical actions remotely (e.g., on/off). Unauthenticated attackers can trigger device actions associated with specific "scenes" of arbitrary users. Unauthenticated attackers can query information about total energy consumed by EV chargers of arbitrary users. Unauthenticated attackers can retrieve serial number of smart meters associated to a specific user account. Unauthenticated attackers can rename "rooms" of arbitrary users. Unauthenticated attackers can add devices of other users to their scenes (or arbitrary scenes of other arbitrary users). Unauthenticated attackers can retrieve full list of users associated with arbitrary accounts.
CVSS v3.1 score: 5.3
CVE-2019-9815 
If hyperthreading is not disabled, a timing attack vulnerability exists, similar to previous Spectre attacks. Apple has shipped macOS 10.14.5 with an option to disable hyperthreading in applications running untrusted code in a thread through a new sysctl. Firefox now makes use of it on the main thread and any worker threads. *Note: users need to update to macOS 10.14.5 in order to take advantage of this change.*. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.
CVSS v3.0 score: 8.1
CVSS v2.0 score: 6.8
CVE-2017-16227 
The aspath_put function in bgpd/bgp_aspath.c in Quagga before 1.2.2 allows remote attackers to cause a denial of service (session drop) via BGP UPDATE messages, because AS_PATH size calculation for long paths counts certain bytes twice and consequently constructs an invalid message.
CVSS v3.0 score: 7.5
CVSS v2.0 score: 5
CVE-2017-11238 
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the image conversion engine when processing Enhanced Metafile Format (EMF) data related to curve drawing. Successful exploitation could lead to arbitrary code execution.
CVSS v3.0 score: 6.5
CVSS v2.0 score: 4.3
GHSA-7523-xcc2-m3rm 
Open Management Infrastructure Information Disclosure Vulnerability
CVSS v3.1 score: 6.5
GHSA-vpjv-xvjr-pg3c 
The AMD IOMMU support in Xen 4.2.x, 4.1.x, 3.3, and other versions, when using AMD-Vi for PCI passthrough, uses the same interrupt remapping table for the host and all guests, which allows guests to cause a denial of service by injecting an interrupt into other guests.
CVE-2019-9582 
eQ-3 Homematic CCU2 outdated base software packages allows Denial of Service. CCU2 affected versions: 2.35.16, 2.41.5, 2.41.8, 2.41.9, 2.45.6, 2.45.7, 2.47.10, 2.47.12, 2.47.15.
CVSS v3.0 score: 7.5
CVSS v2.0 score: 7.8
CVE-2025-7897 harry0703 MoneyPrinterTurbo API Endpoint base.py verify_token missing authentication
A vulnerability was found in harry0703 MoneyPrinterTurbo up to 1.2.6 and classified as critical. Affected by this issue is the function verify_token of the file app/controllers/base.py of the component API Endpoint. The manipulation leads to missing authentication. The attack may be launched remotely.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 7.3
CVSS v3.0 score: 7.3
CVSS v2.0 score: 7.5
GHSA-75m9-98v2-hjpm PyTorch Lightning load_from_checkpoint has an insecure checkpoint deserialization
PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability (CWE-502) in the checkpoint loading mechanism. The LightningModule.load_from_checkpoint() method, which is commonly used to load saved model states, internally calls torch.load() without setting the security-restrictive weights_only=True parameter. This default behavior allows the deserialization of arbitrary Python objects via the Pickle module. A remote attacker can exploit this by providing a maliciously crafted checkpoint file, leading to arbitrary code execution on the victim's system when the file is loaded.
CVSS v3.1 score: 7.8
CVE-2011-1200 
Google Chrome before 10.0.648.127 does not properly perform a cast of an unspecified variable during text rendering, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted document.
CVSS v2.0 score: 6.8
CVE-2022-40671 WordPress Rate my Post – WP Rating System plugin <= 3.3.4 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Rate my Post – WP Rating System plugin <= 3.3.4 at WordPress.
CVSS v3.1 score: 4.3
GHSA-jp5m-rmjh-rg7r 
Multiple vulnerabilities in the Server Message Block Version 2 (SMB2) processor of the Snort detection engine on multiple Cisco products could allow an unauthenticated, remote attacker to bypass the configured policies or cause a denial of service (DoS) condition on an affected device. These vulnerabilities are due to improper management of system resources when the Snort detection engine is processing SMB2 traffic. An attacker could exploit these vulnerabilities by sending a high rate of certain types of SMB2 packets through an affected device. A successful exploit could allow the attacker to trigger a reload of the Snort process, resulting in a DoS condition. Note: When the snort preserve-connection option is enabled for the Snort detection engine, a successful exploit could also allow the attacker to bypass the configured policies and deliver a malicious payload to the protected network. The snort preserve-connection setting is enabled by default. See the Details ["#details"] section of this advisory for more information. Note: Only products that have Snort 3 configured are affected. Products that are configured with Snort 2 are not affected.
CVSS v3.1 score: 6.5
GHSA-qmrf-jrpr-rjx6 
The Yandex Lockbox secrets backend in Apache Airflow's Yandex provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with this backend, a caller in one team could resolve a secret belonging to another team by supplying an id that spells out that team's namespace, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode and using this backend. Users are advised to upgrade to apache-airflow-providers-yandex 4.5.1 or later, which refuses the team-agnostic fall-through for an id that could name a team namespace.
CVSS v3.1 score: 6.5
CVE-2008-6233 
SQL injection vulnerability in index.php in Five Dollar Scripts Drinks script allows remote attackers to execute arbitrary SQL commands via the recid parameter.
CVSS v2.0 score: 7.5
GHSA-jffc-hfc6-pjf5 
Cross-site scripting (XSS) vulnerability in Simple Machines Forum (SMF) 2.0.2 allows remote attackers to inject arbitrary web script or HTML via the scheduled parameter to index.php.
RHSA-2016:1851 Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP 2.4.6 Service Pack 1 security update
HTTPD: sets environmental variable based on user supplied Proxy request header
CVSS v3.0 score: 5
CVE-2024-1279 Paid Memberships Pro < 2.12.9 - Contributor+ Arbitrary User Custom Field Disclosure
The Paid Memberships Pro WordPress plugin before 2.12.9 does not prevent user with at least the contributor role from leaking other users' sensitive metadata.
CVSS v3.1 score: 4.3
CVE-2023-5413 Image horizontal reel scroll slideshow <= 13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The Image horizontal reel scroll slideshow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'ihrss-gallery' shortcode in versions up to, and including, 13.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1 score: 6.4
CVE-2024-2770 Campcodes Complete Online Beauty Parlor Management System contact-us.php sql injection
A vulnerability was found in Campcodes Complete Online Beauty Parlor Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/contact-us.php. The manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-257606 is the identifier assigned to this vulnerability.
CVSS v3.1 score: 6.3
CVSS v3.0 score: 6.3
CVSS v2.0 score: 6.5
CVE-2026-8612 WWW::Mechanize::Cached versions before 2.00 for Perl deserialize cached HTTP responses from a world-writable on-disk cache, enabling local response forgery and code execution
WWW::Mechanize::Cached versions before 2.00 for Perl deserialize cached HTTP responses from a world-writable on-disk cache, enabling local response forgery and code execution.

With no explicit cache backend, WWW::Mechanize::Cached constructs a default Cache::FileCache under /tmp/FileCache without overriding the backend's documented directory_umask of 000, so the cache root and its subdirectories are created mode 0777 with no sticky bit. Cache entries are named by sha1_hex of the request and read back through Storable::thaw on the next cache hit.

A local attacker with write access to the cache tree can replace a victim's cache entry for a known URL with an arbitrary frozen HTTP::Response blob, causing the victim's next get() of that URL to return attacker controlled response bytes. Because the bytes are passed to Storable::thaw, a victim process that has loaded any class with a side-effectful STORABLE_thaw, DESTROY, or overload hook can be escalated to arbitrary code execution.
CVSS v3.1 score: 5.3
GHSA-v9qf-m6g5-9c72 
IBM Cognos Analytics Mobile 1.1 for Android could allow a user with physical access to the device, to obtain sensitive information from debugging code log messages.
CVSS v3.1 score: 2.4
CVE-2024-20520 Cisco Small Business RV042, RV042G, RV320, and RV325 Remote Command Execution Vulnerabilities
A vulnerability in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers could allow an authenticated, Administrator-level, remote attacker to execute arbitrary code as the root user. To exploit this vulnerability, an attacker would need to have valid Administrator credentials on the affected device.
&nbsp;
This vulnerability is due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code on the underlying operating system as the root user.
CVSS v3.1 score: 6.5
CVE-2006-6162 
Cross-site scripting (XSS) vulnerability in tiki-edit_structures.php in TikiWiki 1.9.6 allows remote attackers to inject arbitrary web script or HTML via the pageAlias parameter.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS v2.0 score: 4.3
CVE-1999-0226 
Windows NT TCP/IP processes fragmented IP packets improperly, causing a denial of service.
CVSS v2.0 score: 10
GHSA-8cjq-457m-xw4w 
HP Continuous Delivery Automation (CDA) 1.30 allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.
CVSS v3.0 score: 9.8
GHSA-7qpr-85r9-qfcc 
Cross-Site Request Forgery (CSRF) vulnerability in Diversified Technology Corp., WPYog, and Gagan Deep Singh DTC Documents allows Cross Site Request Forgery.This issue affects DTC Documents: from n/a through 1.1.05.
CVSS v3.1 score: 5.4
GHSA-g736-3qxc-3xmm 
Potential security vulnerabilities have been identified in the HP One 
Agent for certain HP PC products, which might allow
               for escalation of privilege and/or denial of service. HP 
is releasing software updates to mitigate these potential 
vulnerabilities.
CVSS v4.0 score: 8.5
GHSA-xv7r-9vq4-9wrq Project Wonder WebObjects vulnerable to Arbitrary HTTP Header Injection and Cross-site Scripting
Project Wonder WebObjects 1.0 through 7.3 is vulnerable to Arbitrary HTTP Header injection and URL- or Header-based XSS reflection in all web-server adaptor interfaces. A patch for this issue is available at commit number b0d2d74f13203268ea254b02552600850f28014b.
CVSS v3.1 score: 6.1
CVE-2019-17549 
ESET Cyber Security before 6.8.1.0 is vulnerable to a denial-of-service allowing any user to stop (kill) ESET processes. An attacker can abuse this bug to stop the protection from ESET and launch his attack.
CVSS v3.1 score: 6.5
CVSS v2.0 score: 4
CVE-2020-3899 
A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, watchOS 6.2, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for Windows 7.18. A remote attacker may be able to cause arbitrary code execution.
CVSS v3.1 score: 8.8
CVSS v2.0 score: 9.3
GHSA-59wc-27pm-mx9p 
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sergey AIWU ai-copilot-content-generator allows Blind SQL Injection.This issue affects AIWU: from n/a through <= 1.5.4.
CVSS v3.1 score: 9.3
GHSA-63f3-2rgp-79qx 
In the Linux kernel, the following vulnerability has been resolved:tls: fix race between tx work scheduling and socket closeSimilarly to previous commit, the submitting thread (recvmsg/sendmsg)
may exit as soon as the async crypto handler calls complete().
Reorder scheduling the work before calling complete().
This seems more logical in the first place, as it's
the inverse order of what the submitting thread will do.
CVSS v3.1 score: 4.7
CVE-2021-0397 
In sdp_copy_raw_data of sdp_discovery.cc, there is a possible system compromise due to a double free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-174052148
CVSS v3.1 score: 9.8
CVSS v2.0 score: 7.5
CVE-2025-3277 
An integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated integer is then used to allocate a buffer. When SQLite then writes the resulting string to the buffer, it uses the original, untruncated size and thus a wild Heap Buffer overflow of size ~4GB can be triggered. This can result in arbitrary code execution.
CVSS v4.0 score: 6.9
RHSA-2020:1864 Red Hat Security Advisory: gcc security and bug fix update
gcc: POWER9 "DARN" RNG intrinsic produces repeated output
CVSS v3.0 score: 7.5
CVE-2026-6399 General Options <= 1.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'ad_contact_number' Parameter
The General Options plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.1.0. This is due to the use of sanitize_text_field() for output escaping in the Contact Number (ad_contact_number) field — a function that strips HTML tags but does not encode double-quote characters to their HTML entity equivalent (&quot;). When the stored value is echoed inside a double-quoted HTML attribute (value="..."), an attacker-supplied double-quote character breaks out of the attribute context. Even with WordPress's wp_magic_quotes mechanism (which prefixes quotes with a backslash), the resulting \" sequence is NOT treated as an escaped quote by HTML parsers — the backslash is rendered as a literal character and the bare double-quote still closes the attribute. This makes it possible for authenticated attackers with Administrator-level access and above to inject arbitrary web scripts in the admin settings page that will execute whenever any administrator visits the General Options settings page.
CVSS v3.1 score: 4.4
CVE-2025-34312 IPFire < v2.29 Command Injection via URL Filter Blacklist
IPFire versions prior to 2.29 (Core Update 198) contain a command injection vulnerability that allows an authenticated attacker to execute arbitrary commands as the 'nobody' user via the BE_NAME parameter when installing a blacklist. When a blacklist is installed the application issues an HTTP POST to /cgi-bin/urlfilter.cgi and interpolates the value of BE_NAME directly into a shell invocation without appropriate sanitation. Crafted input can inject shell metacharacters, leading to arbitrary command execution in the context of the 'nobody' user.
CVSS v4.0 score: 8.7
CVE-2010-0104 
Unspecified vulnerability in the Broadcom Integrated NIC Management Firmware 1.x before 1.40.0.0 and 8.x before 8.08 on the HP Small Form Factor and Microtower platforms allows remote attackers to execute arbitrary code via unknown vectors.
CVSS v2.0 score: 10
GHSA-q93j-qg8p-98hf 
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused
GHSA-m74q-p473-55fr 
Use-after-free vulnerability in the WebAudio implementation in Blink, as used in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an audio-rendering thread in which AudioNode data is improperly maintained.
CVE-2025-10942 H3C Magic B3 aspForm EditMacList buffer overflow
A vulnerability was identified in H3C Magic B3 up to 100R002. This affects the function AddMacList/EditMacList of the file /goform/aspForm. The manipulation of the argument param leads to buffer overflow. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0 score: 8.7
CVSS v3.1 score: 8.8
CVSS v3.0 score: 8.8
CVSS v2.0 score: 9
RHSA-2024:0050 Red Hat Security Advisory: OpenShift Container Platform 4.14.8 bug fix and security update
golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) opentelemetry: DoS vulnerability in otelhttp
CVSS v3.1 score: 7.5
CVE-2019-17358 
Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays. An authenticated attacker could use this to influence object data values and control actions taken by Cacti or potentially cause memory corruption in the PHP module.
CVSS v3.1 score: 8.1
CVSS v2.0 score: 5.5
CVE-2026-66467 WordPress FluentCommunity plugin <= 2.7.5 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting (XSS) in FluentCommunity <= 2.7.5 versions.
CVSS v3.1 score: 6.5
CVE-2025-26940 WordPress Pie Register Premium plugin <= 3.8.3.2 - Path Traversal to Non-Arbitrary File Deletion vulnerability
Path Traversal vulnerability in NotFound Pie Register Premium. This issue affects Pie Register Premium: from n/a through 3.8.3.2.
CVSS v3.1 score: 6.3
CVE-2018-7282 
The username parameter of the TITool PrintMonitor solution during the login request is vulnerable to and/or time-based blind SQLi.
CVSS v3.1 score: 9.8
CVSS v2.0 score: 7.5
CVE-2007-5450 
Unspecified vulnerability in Safari on the Apple iPod touch (aka iTouch) and iPhone 1.1.1 allows user-assisted remote attackers to cause a denial of service (application crash), and enable filesystem browsing by the local user, via a certain TIFF file.
CVSS v2.0 score: 9.3
GHSA-mj3c-gfpv-gpfm 
GPAC MP4box 2.1-DEV-rev593-g007bf61a0 is vulnerable to Buffer Overflow in gf_hevc_read_sps_bs_internal function of media_tools/av_parsers.c:8261
CVSS v3.1 score: 7.8
CVE-2018-18392 
Privilege Escalation via Broken Access Control in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.
CVSS v3.0 score: 8.8
CVSS v2.0 score: 6.5
GHSA-rcv8-v727-xg26 
The Hub in the Snap One OvrC cloud platform is a device used to centralize and manage nested devices connected to it. A vulnerability exists in which an attacker could impersonate a hub and send device requests to claim already claimed devices. The OvrC cloud platform receives the requests but does not validate if the found devices are already managed by another user.
CVSS v3.1 score: 8.6
GHSA-975m-wwjm-9r48 
A vulnerability was found in Totolink A8000RU 7.1cu.643_b20200521. Affected is the function setIptvCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation of the argument setIptvCfg results in os command injection. The attack can be initiated remotely. The exploit has been made public and could be used.
CVSS v4.0 score: 8.9
CVSS v3.1 score: 9.8
GHSA-8hj6-5qgp-wcmq 
An issue was discovered on Samsung mobile devices with O(8.x) software. Attackers can disable Gallery permanently. The Samsung ID is SVE-2019-14031 (May 2019).
CVE-2006-3952 
Stack-based buffer overflow in EFS Software Easy File Sharing FTP Server 2.0 allows remote attackers to execute arbitrary code via a long argument to the PASS command.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS v2.0 score: 7.5
CVE-2021-33495 
OX App Suite 7.10.5 allows XSS via an OX Chat system message.
CVSS v3.1 score: 6.1
CVSS v2.0 score: 4.3
CVE-2026-62726 Windows Telephony Service Elevation of Privilege Vulnerability
Use after free in Windows Telephony Service allows an authorized attacker to elevate privileges locally.
CVSS v3.1 score: 7
CVE-2022-48381 
In modem control device, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
CVSS v3.1 score: 4.4
GHSA-p3j2-h76v-9w9x 
In getAllConfigFlags of SettingsProvider.cpp, there is a possible illegal read due to a missing permission check. This could lead to local information disclosure of config flags with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-143299398
CVE-2026-23024 idpf: fix memory leak of flow steer list on rmmod
In the Linux kernel, the following vulnerability has been resolved:

idpf: fix memory leak of flow steer list on rmmod

The flow steering list maintains entries that are added and removed as
ethtool creates and deletes flow steering rules. Module removal with active
entries causes memory leak as the list is not properly cleaned up.

Prevent this by iterating through the remaining entries in the list and
freeing the associated memory during module removal. Add a spinlock
(flow_steer_list_lock) to protect the list access from multiple threads.
CVSS v3.1 score: 5.5
GHSA-566f-w63p-987f 
A vulnerability classified as problematic was found in Teleopti WFM up to 7.1.0. Affected by this vulnerability is an unknown functionality of the file /TeleoptiWFM/Administration/GetOneTenant of the component Administration. The manipulation leads to information disclosure (Credentials). The attack can be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.
CVSS v3.1 score: 6.5
CVE-2023-31289 
Pexip Infinity before 31.2 has Improper Input Validation for signalling, allowing remote attackers to trigger an abort.
CVSS v3.1 score: 7.5
GHSA-98jw-m4q8-f849 
A vulnerability has been identified in NX 1980 Series (All versions < V1984). The plmxmlAdapterIFC.dll contains an out-of-bounds read while parsing user supplied IFC files which could result in a read past the end of an allocated buffer. This could allow an attacker to cause a denial-of-service condition or read sensitive information from memory locations.
GHSA-wf7c-j44x-2379 
In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.107, 9.1.2312.204, and 9.1.2312.111, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a search query with an improperly formatted  "INGEST_EVAL" parameter as part of a [Field Transformation](https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Managefieldtransforms) which could crash the Splunk daemon (splunkd).
CVSS v3.1 score: 6.5
CVE-2018-20168 
Google gVisor before 2018-08-22 reuses a pagetable in a different level with the paging-structure cache intact, which allows attackers to cause a denial of service ("physical address not valid" panic) via a crafted application.
CVSS v3.0 score: 5.5
CVSS v2.0 score: 4.3
GHSA-vxw6-8w5q-c95r 
IBM Team Concert (RTC) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126856.
CVSS v3.0 score: 5.4
CVE-2025-3750 Network Posts Extended <= 7.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_height Parameter
The Network Posts Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘post_height’ parameter in all versions up to, and including, 7.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1 score: 6.4
GHSA-v9q5-hp45-m55v 
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, and SD 820A, when executing a TA which has been granted privileges to the CPVC MINK class it is possible for the TA to access methods exposed by the CPVC interface.
CVSS v3.0 score: 9.8
GHSA-3pc7-c3mc-73r6 
By default, dedicated folders of CRYHOD for Windows up to 2024.3 can be accessed by other users to misuse technical files and make them perform tasks with higher privileges. Configuration of CRYHOD has to be modified to prevent this vulnerability.
CVSS v3.1 score: 7.8
CVE-2025-67727 Parse Server GitHub CI workflow vulnerable to RCE through Improper Privilege Management
Parse Server is an open source backend that can be deployed to any infrastructure that runs Node.js. In versions prior to 8.6.0-alpha.2, a GitHub CI workflow is triggered in a way that grants the GitHub Actions workflow elevated permissions, giving it access to GitHub secrets and write permissions which are defined in the workflow. Code from a fork or lifecycle scripts is potentially included. Only the repository's CI/CD infrastructure is affected, including any public GitHub forks with GitHub Actions enabled. This issue is fixed version 8.6.0-alpha.2 and commits 6b9f896 and e3d27fe.
CVSS v4.0 score: 6.9
CVE-2023-0848 Netgear WNDR3700v2 Web Management Interface denial of service
A vulnerability was found in Netgear WNDR3700v2 1.0.1.14. It has been rated as problematic. This issue affects some unknown processing of the component Web Management Interface. The manipulation leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221147.
CVSS v3.1 score: 5.3
CVSS v3.0 score: 5.3
CVSS v2.0 score: 5
CVE-2016-1094 
Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1045, CVE-2016-1046, CVE-2016-1047, CVE-2016-1048, CVE-2016-1049, CVE-2016-1050, CVE-2016-1051, CVE-2016-1052, CVE-2016-1053, CVE-2016-1054, CVE-2016-1055, CVE-2016-1056, CVE-2016-1057, CVE-2016-1058, CVE-2016-1059, CVE-2016-1060, CVE-2016-1061, CVE-2016-1065, CVE-2016-1066, CVE-2016-1067, CVE-2016-1068, CVE-2016-1069, CVE-2016-1070, CVE-2016-1075, CVE-2016-1121, CVE-2016-1122, CVE-2016-4102, and CVE-2016-4107.
CVSS v3.0 score: 9.8
CVSS v2.0 score: 10
CVE-2005-0204 
Linux kernel before 2.6.9, when running on the AMD64 and Intel EM64T architectures, allows local users to write to privileged IO ports via the OUTS instruction.
CVSS v2.0 score: 2.1
GHSA-44vv-mm86-7cg6 phpMyAdmin server-side request forgery (SSRF)
The setup script for phpMyAdmin before 4.0.10.19, 4.4.x before 4.4.15.10, and 4.6.x before 4.6.6 allows remote attackers to conduct server-side request forgery (SSRF) attacks via unspecified vectors.
CVSS v3.0 score: 8.6