CIRCL/vulnerability-scores huggingface dataset:
GHSA-ccg6-h5cr-mf8v 
Integer overflow in the vma_to_resize function in mm/mremap.c in the Linux kernel before 2.6.39 allows local users to cause a denial of service (BUG_ON and system crash) via a crafted mremap system call that expands a memory mapping.
CVE-2023-32680 Missing SQL permissions check in metabase
Metabase is an open source business analytics engine. To edit SQL Snippets, Metabase should have required people to be in at least one group with native query editing permissions to a database–but affected versions of Metabase didn't enforce that requirement. This lack of enforcement meant that: Anyone–including people in sandboxed groups–could edit SQL snippets. They could edit snippets via the API or, in the application UI, when editing the metadata for a model based on a SQL question, and people in sandboxed groups could edit a SQL snippet used in a query that creates their sandbox. If the snippet contained logic that restricted which data that person could see, they could potentially edit that snippet and change their level of data access. The permissions model for SQL snippets has been fixed in Metabase versions 0.46.3, 0.45.4, 0.44.7, 1.46.3, 1.45.4, and 1.44.7. Users are advised to upgrade. Users unable to upgrade should ensure that SQL queries used to create sandboxes exclude SQL snippets.
CVSS v3.1 score: 5.8
CVE-2025-40080 nbd: restrict sockets to TCP and UDP
In the Linux kernel, the following vulnerability has been resolved:

nbd: restrict sockets to TCP and UDP

Recently, syzbot started to abuse NBD with all kinds of sockets.

Commit cf1b2326b734 ("nbd: verify socket is supported during setup")
made sure the socket supported a shutdown() method.

Explicitely accept TCP and UNIX stream sockets.
CVE-2020-8015 Local privilege escalation in exim package from user mail to root
A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of exim in openSUSE Factory allows local attackers to escalate from user mail to root. This issue affects: openSUSE Factory exim versions prior to 4.93.0.4-3.1.
CVSS v3.1 score: 8.4
RHSA-2025:12662 Red Hat Security Advisory: kernel security update
kernel: padata: fix UAF in padata_reorder kernel: HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() kernel: HID: intel-ish-hid: Fix use-after-free issue in hid_ishtp_cl_remove() kernel: memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove kernel: RDMA/core: Fix use-after-free when rename device name kernel: ext4: avoid journaling sb update on error if journal is destroying kernel: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc kernel: net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done kernel: net: ch9200: fix uninitialised access during mii_nway_restart kernel: net/sched: fix use-after-free in taprio_dev_notifier kernel: nvme-tcp: sanitize request list handling
CVSS v3.1 score: 7.1
CVE-2021-36915 WordPress Profile Builder plugin <= 3.6.0 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs Profile Builder plugin <= 3.6.0 at WordPress allows uploading the JSON file and updating the options. Requires Import and Export add-on.
CVSS v3.1 score: 4.2
CVE-2026-4249 Denial of Service via Malicious JSON Payloads in Throttling Events in Multiple WSO2 Products Causing Persistent Service Disruption
The throttling event handling mechanism in multiple WSO2 products accepts user-supplied JSON payloads without sufficient validation of their structure and content. This allows an unauthenticated remote attacker to inject malicious JSON data that can lead to a persistent denial of service condition.

Successful exploitation of this vulnerability can disrupt the API Gateway, preventing legitimate API traffic from being processed and impacting complete service availability. The denial of service is persistent, requiring manual intervention to restore normal operations.
CVSS v3.1 score: 8.6
CVE-2024-32713 WordPress AI Post Generator | AutoWriter plugin <= 3.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in AutoWriter AI Post Generator | AutoWriter.This issue affects AI Post Generator | AutoWriter: from n/a through 3.3.
CVSS v3.1 score: 5.4
CVE-2015-4173 
Unquoted Windows search path vulnerability in the autorun value in Dell SonicWall NetExtender before 7.5.227 and 8.0.x before 8.0.238, as used in the SRA firmware before 7.5.1.2-40sv and 8.x before 8.0.0.3-23sv, allows local users to gain privileges via a Trojan horse program in the %SYSTEMDRIVE% folder.
CVSS v2.0 score: 6.9
CVE-2012-5574 
lib/form/sfForm.class.php in Symfony CMS before 1.4.20 allows remote attackers to read arbitrary files via a crafted upload request.
CVSS v2.0 score: 5
GHSA-83mm-r262-4333 
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themefic Ultimate Addons for Contact Form 7.This issue affects Ultimate Addons for Contact Form 7: from n/a through 3.1.23.
CVSS v3.1 score: 8.5
CVE-2025-13025 Incorrect boundary conditions in the Graphics: WebGPU component
Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 145 and Thunderbird 145.
CVSS v3.1 score: 7.5
CVE-2024-28949 DoS via a large number of User Preferences
Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 don't limit the number of user preferences which allows an attacker to send a large number of user preferences potentially causing denial of service.


CVSS v3.1 score: 4.3
CVE-2026-11342 code-projects Hotel and Tourism Reservation System details.php sql injection
A vulnerability has been found in code-projects Hotel and Tourism Reservation System 1.0. This affects an unknown function of the file /details.php. Such manipulation of the argument room leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 7.3
CVSS v3.0 score: 7.3
CVSS v2.0 score: 7.5
CVE-2026-2697 Indirect Object Reference (IDOR) in Security Center
An Indirect Object Reference (IDOR) in Security Center allows an authenticated remote attacker to escalate privileges via the 'owner' parameter.
CVSS v4.0 score: 2.1
CVSS v3.1 score: 6.3
GHSA-g3rf-4jv4-r299 
A vulnerability was found in Seeyon Zhiyuan Interconnect FE Collaborative Office Platform 5.5.2 and classified as critical. This issue affects some unknown processing of the file /sysform/042/check.js%70. The manipulation of the argument Name leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 6.3
GHSA-h5vf-v8w8-8c3q 
Deserialization of Untrusted Data vulnerability in axiomthemes m2 | Construction and Tools Store m2-ce allows Object Injection.This issue affects m2 | Construction and Tools Store: from n/a through <= 1.1.2.
CVSS v3.1 score: 9.8
GHSA-75x3-rp8w-rwm7 
Cross-site request forgery (CSRF) vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack the authentication of users for requests to unlock albums via a crafted request.
CVSS v3.0 score: 8.8
CVE-2023-29756 
An issue found in Twilight v.13.3 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the SharedPreference files.
CVSS v3.1 score: 5.5
RHSA-2021:0114 Red Hat Security Advisory: .NET Core 3.1 on Red Hat Enterprise Linux security and bugfix update
dotnet: ASP.NET Core Callbacks outside of locks cause Krestel deadlock when using HTTP2
CVSS v3.1 score: 7.5
GHSA-j2mw-jhcw-5g7q 
Multiple unspecified vulnerabilities in LimeSurvey (formerly PHPSurveyor) before 1.71 have unknown impact and attack vectors.
CVE-2008-1288 
IBM Rational ClearQuest 7.0.1.1 and 7.0.0.2 might allow local or remote attackers to obtain sensitive information about users by reading user cookies.
CVSS v2.0 score: 5
GHSA-8w9m-wxhq-5hch 
Multiple use-after-free vulnerabilities in modules/screen_orientation/ScreenOrientationController.cpp in Blink, as used in Google Chrome before 39.0.2171.65, allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger improper handling of a detached frame, related to the (1) lock and (2) unlock methods.
CVE-2012-1721 
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, and 6 update 32 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2012-1722.
CVSS v2.0 score: 10
GHSA-4vpp-x82w-87gp 
The Latest Post Accordian Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3. This is due to missing or incorrect nonce validation on the 'lpaccordian' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS v3.1 score: 6.1
CVE-2022-41216 Cloudflow - Local File Inclusion Vulnerability
Local File Inclusion vulnerability within Cloudflow allows attackers to retrieve confidential information from the system.
CVSS v3.1 score: 8.3
CVE-2025-60450 
A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists due to insufficient validation and sanitization of SVG file uploads in the app\system\include\module\editor\Uploader.class.php component. This security flaw allows attackers to upload malicious SVG files containing JavaScript code that executes when the uploaded file is viewed or accessed.
CVSS v3.1 score: 6.1
GHSA-63pw-wc3v-c9g9 
Use after free in Blink History in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVSS v3.1 score: 8.8
GHSA-gqc2-f78h-r226 
WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-09-12-1.
CVE-2026-43135 media: cx23885: Add missing unmap in snd_cx23885_hw_params()
In the Linux kernel, the following vulnerability has been resolved:

media: cx23885: Add missing unmap in snd_cx23885_hw_params()

In error path, add cx23885_alsa_dma_unmap() to release the
resource acquired by cx23885_alsa_dma_map().
CVSS v3.1 score: 5.5
CVE-2024-1650 Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxRenameCategory
The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjaxRenameCategory function in all versions up to, and including, 1.0.7.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to rename categories.
CVSS v3.1 score: 4.3
GHSA-6wjh-ccr9-8vh3 
The custom-admin-page plugin before 0.1.2 for WordPress has multiple XSS issues.
CVSS v3.0 score: 6.1
CVE-2025-11640 Tomofun Furbo 360/Furbo Mini Bluetooth Low Energy cleartext transmission
A vulnerability was found in Tomofun Furbo 360 and Furbo Mini. This affects an unknown function of the component Bluetooth Low Energy. The manipulation results in cleartext transmission of sensitive information. Access to the local network is required for this attack. Attacks of this nature are highly complex. The exploitability is reported as difficult. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0 score: 2.3
CVSS v3.1 score: 3.1
CVSS v3.0 score: 3.1
CVSS v2.0 score: 1.8
CVE-2022-26646 
Online Banking System Protect v1.0 was discovered to contain a local file inclusion (LFI) vulnerability via the pages parameter.
CVSS v3.1 score: 9.8
CVSS v2.0 score: 7.5
GHSA-xg2q-j7hq-x7wj 
Stack-based buffer overflow in the NetpManageIPCConnect function in the Workstation service (wkssvc.dll) in Microsoft Windows 2000 SP4 and XP SP2 allows remote attackers to execute arbitrary code via NetrJoinDomain2 RPC messages with a long hostname.
CVE-2017-16349 
An exploitable XML external entity vulnerability exists in the reporting functionality of SAP BPC. A specially crafted XML request can cause an XML external entity to be referenced, resulting in information disclosure and potential denial of service. An attacker can issue authenticated HTTP requests to trigger this vulnerability.
CVSS v3.0 score: 6.4
CVE-2023-50570 
An issue in the component IPAddressBitsDivision of IPAddress v5.1.0 leads to an infinite loop. This is disputed because an infinite loop occurs only for cases in which the developer supplies invalid arguments. The product is not intended to always halt for contrived inputs.
CVSS v3.1 score: 5.5
RHSA-2021:2730 Red Hat Security Advisory: kernel security and bug fix update
kernel: Use after free via PI futex state kernel: use-after-free in net/bluetooth/hci_event.c when destroying an hci_chan kernel: size_t-to-int conversion vulnerability in the filesystem layer
CVSS v3.1 score: 7.8
CVE-2019-11326 
An issue was discovered on Topcon Positioning Net-G5 GNSS Receiver devices with firmware 5.2.2. The web interface of the product is protected by a login. A guest is allowed to login. Once logged in as a guest, an attacker can browse a URL to read the password of the administrative user. The same procedure allows a regular user to gain administrative privileges. The guest login is possible in the default configuration.
CVSS v3.1 score: 8.8
CVSS v2.0 score: 6.5
GHSA-rw73-mxr4-6595 
In PHP versions 7.2.x below 7.2.9, 7.3.x below 7.3.16 and 7.4.x below 7.4.34, while parsing EXIF data with exif_read_data() function, it is possible for malicious data to cause PHP to read one byte of uninitialized memory. This could potentially lead to information disclosure or crash.
CVSS v3.1 score: 5.4
GHSA-qhrq-6m4q-9x2x 
A flaw was found in the IPv4 Resource Reservation Protocol (RSVP) classifier in the Linux kernel. The xprt pointer may go beyond the linear part of the skb, leading to an out-of-bounds read in the `rsvp_classify` function. This issue may allow a local user to crash the system and cause a denial of service.
CVSS v3.1 score: 6.5
GHSA-wv9w-wxcx-6r72 
PDF-XChange Editor JPG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of JPG files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22138.
CVSS v3.0 score: 7.8
RHSA-2026:0629 Red Hat Security Advisory: satellite/foreman-mcp-server-rhel9 container image available as a Technology Preview
authlib: Authlib : JWE zip=DEF decompression bomb enables DoS mcp: DNS Rebinding Protection Disabled by Default in Model Context Protocol Python SDK
CVSS v3.1 score: 8.1
RHEA-2022:5221 Red Hat Enhancement Advisory: nodejs:12 bug fix and enhancement update
nodejs-json-schema: Prototype pollution vulnerability llhttp: HTTP Request Smuggling due to spaces in headers llhttp: HTTP Request Smuggling when parsing the body of chunked requests nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite nodejs: Improper handling of URI Subject Alternative Names nodejs: Certificate Verification Bypass via String Injection nodejs: Incorrect handling of certificate subject and issuer fields nodejs: Prototype pollution via console.table properties
CVSS v3.1 score: 8.2
GHSA-74g9-h4xg-q2rv 
A vulnerability was found in SourceCodester Aplaya Beach Resort Online Reservation System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file admin/mod_settings/controller.php?action=add. The manipulation of the argument type leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259460.
CVSS v3.1 score: 7.3
GHSA-5mx7-hhwx-7mq8 
Integer underflow in the ProcessCommandsInternal function in dec/decode.c in Brotli, as used in Google Chrome before 48.0.2564.109, allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via crafted data with brotli compression.
CVSS v3.0 score: 8.8
PYSEC-2026-996 
### Impact
When [`tensorflow::full_type::SubstituteFromAttrs`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/ops/math_ops.cc) receives a `FullTypeDef& t` that is not exactly three args, it triggers a `CHECK`-fail instead of returning a status.
```cpp
Status SubstituteForEach(AttrMap& attrs, FullTypeDef& t) {
  DCHECK_EQ(t.args_size(), 3);

  const auto& cont = t.args(0);
  const auto& tmpl = t.args(1);
  const auto& t_var = t.args(2);
```

### Patches
We have patched the issue in GitHub commit [6104f0d4091c260ce9352f9155f7e9b725eab012](https://github.com/tensorflow/tensorflow/commit/6104f0d4091c260ce9352f9155f7e9b725eab012).
The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range.


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
CVE-2020-36906 P5 FNIP-8x16A FNIP-4xSH 1.0.20 Cross-Site Request Forgery via User Management
P5 FNIP-8x16A FNIP-4xSH 1.0.20 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent. Attackers can craft malicious web pages to add new admin users, change passwords, and modify system configurations by tricking authenticated users into loading a specially crafted form.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 4.3
CVE-2019-18300 
A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server can trigger a Denial-of-Service condition by sending specifically crafted packets to port 5010/tcp. This vulnerability is independent from CVE-2019-18290, CVE-2019-18291, CVE-2019-18292, CVE-2019-18294, CVE-2019-18298, CVE-2019-18299, CVE-2019-18301, CVE-2019-18302, CVE-2019-18303, CVE-2019-18304, CVE-2019-18305, CVE-2019-18306, and CVE-2019-18307. Please note that an attacker needs to have network access to the MS3000 in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.
CVSS v3.1 score: 7.5
CVSS v2.0 score: 5
CVE-2024-51658 WordPress WP Course Manager plugin <= 1.3 - CSRF to Stored XSS vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Henrik Hoff WP Course Manager wp-course-manager allows Stored XSS.This issue affects WP Course Manager: from n/a through <= 1.3.
CVSS v3.1 score: 7.1
GHSA-jp9v-xrg8-j2hv 
Windows Uniscribe in Microsoft Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, 1607, 1703, and Server 2016; Office 2007 SP3; Office 2010 SP2; Word Viewer; Office for Mac 2011 and 2016; Skype for Business 2016; Lync 2013 SP1; Lync 2010; Lync 2010 Attendee; and Live Meeting 2007 Add-in and Console allows an attacker to obtain information to further compromise a user's system via a specially crafted document or an untrusted webpage, aka "Graphics Component Information Disclosure Vulnerability."
CVSS v3.0 score: 5.3
CVE-2021-24180 Related Posts for WordPress < 2.0.4 - Authenticated Reflected Cross-Site Scripting (XSS)
Unvalidated input and lack of output encoding within the Related Posts for WordPress plugin before 2.0.4 lead to a Reflected Cross-Site Scripting (XSS) vulnerability within the 'lang' GET parameter while editing a post, triggered when users with the capability of editing posts access a malicious URL.
CVSS v3.1 score: 5.4
CVSS v2.0 score: 3.5
CVE-2023-49285 Denial of Service in HTTP Message Processing in Squid
Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Buffer Overread bug Squid is vulnerable to a Denial of Service attack against Squid HTTP Message processing. This bug is fixed by Squid version 6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS v3.1 score: 8.6
CVE-2023-42849 
The issue was addressed with improved memory handling. This issue is fixed in iOS 17.1 and iPadOS 17.1, macOS Monterey 12.7.1, watchOS 10.1, iOS 16.7.2 and iPadOS 16.7.2, macOS Ventura 13.6.1, macOS Sonoma 14.1. An attacker that has already achieved kernel code execution may be able to bypass kernel memory mitigations.
CVSS v3.1 score: 6.5
CVE-2015-8753 
SAP Afaria 7.0.6001.5 allows remote attackers to bypass authorization checks and wipe or lock mobile devices via a crafted request, related to "Insecure signature," aka SAP Security Note 2134905.
CVSS v3.0 score: 9.1
CVSS v2.0 score: 9.4
CVE-2014-2025 
Unrestricted file upload vulnerability in an unspecified third party tool in United Planet Intrexx Professional before 5.2 Online Update 0905 and 6.x before 6.0 Online Update 10 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via unknown vectors.
CVSS v3.1 score: 9.8
CVSS v2.0 score: 7.5
RHSA-2023:6158 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
python-django: Denial-of-service possibility in django.utils.text.Truncator python-urllib3: Cookie request header isn't stripped during cross-origin redirects
CVSS v3.1 score: 5.9
GHSA-j77x-557v-p2cj 
Buffer overflow in fs/cifs/connect.c in CIFS in the Linux kernel 2.6.29 and earlier allows remote attackers to cause a denial of service (crash) via a long nativeFileSystem field in a Tree Connect response to an SMB mount request.
CVE-2014-2373 Accuenergy Accuenergy Acuvim II Client-Side Enforcement of Server-Side Security
The AXN-NET Ethernet module accessory 3.04 for the Accuenergy Acuvim II allows remote attackers to discover passwords and modify settings via vectors involving JavaScript.
CVSS v2.0 score: 7.5
CVE-2024-33867 
An issue was discovered in linqi before 1.4.0.1 on Windows. There is a hardcoded password salt.
CVSS v3.1 score: 4.8
GHSA-9j22-cgg5-j3gq 
The Data Provisioning Agent (aka DP Agent) in SAP HANA allows remote attackers to cause a denial of service (process crash) via unspecified vectors, aka SAP Security Note 2262710.
CVSS v3.0 score: 7.5
GHSA-m4pf-mx59-j65p 
planetGallery allows remote attackers to gain administrator privileges via a direct request to admin/gallery_admin.php.
CVE-2018-19276 
OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated user to execute arbitrary commands on the targeted system via crafted XML data in a request body.
CVSS v3.0 score: 10
GHSA-x4xc-8g7v-c85h 
The SiteGround Security WordPress plugin before 1.3.1 does not properly sanitize user input before using it in an SQL query, leading to an authenticated SQL injection issue.
CVSS v3.1 score: 8.8
CVE-2024-32673 
Improper Validation of Array Index vulnerability in Samsung Open Source Walrus Webassembly runtime engine allows a segmentation fault issue.

This issue affects Walrus: before 72c7230f32a0b791355bbdfc78669701024b0956.
CVSS v4.0 score: 6.7
CVSS v3.1 score: 5.5
GHSA-v555-pg2x-h7pp 
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface of an affected device. The vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
GHSA-hmwv-4vph-2r3h 
in OpenHarmony v4.0.0 and prior versions allow a local attacker cause heap overflow through  integer overflow.
CVSS v3.1 score: 2.9
RHSA-2026:22111 Red Hat Security Advisory: ovn25.09 security update
ovn: ovn: Heap Over-Read in ICMP Error Response Generation ovn: OVN: Information disclosure via crafted DHCPv6 packets
CVSS v3.1 score: 8.6
CVE-2008-5053 
PHP remote file inclusion vulnerability in admin.rssreader.php in the Simple RSS Reader (com_rssreader) 1.0 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_live_site parameter.
CVSS v2.0 score: 10
GHSA-6gp6-xj27-g89q Duplicate Advisory: Cross-site Scripting (XSS) in name field of Custom Reports
Duplicate AdvisoryThis advisory has been withdrawn because it is a duplicate of GHSA-m6m9-gr85-79vm. This link is maintained to preserve external references.Original DescriptionCross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.21.
CVSS v3.0 score: 6.8
GHSA-389v-vqc7-p3xm 
Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/domain_management.php?whitelist_add
CVSS v3.1 score: 8.8
GHSA-fwqh-jqxf-956w 
The fragment_add_work function in epan/reassemble.c in Wireshark 0.8.19 through 1.0.1 allows remote attackers to cause a denial of service (crash) via a series of fragmented packets with non-sequential fragmentation offset values, which lead to a buffer over-read.
GHSA-849g-hffp-q3mh 
In the FastRPC driver in Android releases from CAF using the linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before security patch level 2018-06-05, a Use After Free condition can occur when mapping on the remote processor fails.
CVSS v3.0 score: 7.8
GHSA-q5pp-5q2h-g8rv Duplicate Advisory: Cross-site scripting vulnerability in TinyMCE
Duplicate AdvisoryThis advisory has been withdrawn because it is a duplicate of GHSA-5h9g-x5rv-25wg. This link is maintained to preserve external references.Original DescriptionTinyMCE versions before 5.6.0 are affected by a stored cross-site scripting vulnerability. An unauthenticated and remote attacker could insert crafted HTML into the editor resulting in arbitrary JavaScript execution in another user's browser.
CVE-2022-24062 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro 13.2.0.21165. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15104.
CVSS v3.0 score: 7.8
CVE-2023-31166 Improper Limitation of a Pathname to a Restricted Directory
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to create folders in arbitrary paths of the file system.

See SEL Service Bulletin dated 2022-11-15 for more details.
CVSS v3.1 score: 4.1
GHSA-rj4c-wfrf-5354 
Buffer overflow in the YMMAPI.YMailAttach ActiveX control (ymmapi.dll) before 2005.1.1.4 in Yahoo! Messenger allows remote attackers to execute arbitrary code via a crafted HTML document.  NOTE: some details were obtained from third party information.
GHSA-5466-cwj2-cpv7 
Directory traversal vulnerability in attachments.php in News Manager 2.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the id parameter.
CVE-2020-25770 
An out-of-bounds read information disclosure vulnerabilities in Trend Micro Apex One may allow a local attacker to disclose sensitive information to an unprivileged account on vulnerable installations of the product. An attacker must first obtain the ability to execute low-privileged code on the target in order to exploit these vulnerabilities. The subs affected in this vulnerability makes it unique compared to similar CVEs such as CVE-2020-24564 and CVE-2020-25771.
CVSS v3.1 score: 5.5
CVSS v2.0 score: 2.1
CVE-2025-54294 Extension - stackideas.com - SQLi vulnerability in Komento component 4.0.0-4.0.7 for Joomla
A SQLi vulnerability in Komento component 4.0.0-4.0.7for Joomla was discovered. The issue allows unprivileged users to execute arbitrary SQL commands.
CVSS v4.0 score: 9.3
RHSA-2025:1756 Red Hat Security Advisory: mysql security update
mysql: MySQL Server: Denial of service in Thread Pooling component
CVSS v3.1 score: 7.5
GHSA-2q64-fx5h-2j6c 
The packet-processing microcode in Cisco IOS 15.2(2)EA, 15.2(2)EA1, 15.2(2)EA2, and 15.2(4)EA on Industrial Ethernet 4000 devices and 15.2(2)EB and 15.2(2)EB1 on Industrial Ethernet 5000 devices allows remote attackers to cause a denial of service (packet data corruption) via crafted IPv4 ICMP packets, aka Bug ID CSCuy13431.
CVSS v3.0 score: 7.5
CVE-2021-46333 
Moddable SDK v11.5.0 was discovered to contain an invalid memory access vulnerability via the component __asan_memmove.
CVSS v3.1 score: 5.5
CVSS v2.0 score: 4.3
CVE-2023-34671 
Improper Access Control leads to privilege escalation affecting Elenos ETG150 FM transmitter running on version 3.12 by exploiting user's role in the user profile. An attack could occur over the public Internet in some cases.
CVSS v3.1 score: 8.8
CVE-2024-32800 WordPress Popup – Popup More Popups plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Felix Moira Popup More Popups allows Stored XSS.This issue affects Popup More Popups: from n/a through 2.3.1.
CVSS v3.1 score: 6.5
CVE-2009-3228 
The tc_fill_tclass function in net/sched/sch_api.c in the tc subsystem in the Linux kernel 2.4.x before 2.4.37.6 and 2.6.x before 2.6.31-rc9 does not initialize certain (1) tcm__pad1 and (2) tcm__pad2 structure members, which might allow local users to obtain sensitive information from kernel memory via unspecified vectors.
CVSS v2.0 score: 2.1
CVE-2026-43463 rxrpc, afs: Fix missing error pointer check after rxrpc_kernel_lookup_peer()
In the Linux kernel, the following vulnerability has been resolved:

rxrpc, afs: Fix missing error pointer check after rxrpc_kernel_lookup_peer()

rxrpc_kernel_lookup_peer() can also return error pointers in addition to
NULL, so just checking for NULL is not sufficient.

Fix this by:

 (1) Changing rxrpc_kernel_lookup_peer() to return -ENOMEM rather than NULL
     on allocation failure.

 (2) Making the callers in afs use IS_ERR() and PTR_ERR() to pass on the
     error code returned.
CVSS v3.1 score: 5.5
GHSA-vpqf-wpxq-x62q 
Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript when viewing Shared Folders via JavaScript in Shared Folders' names.
CVSS v3.0 score: 5.4
GHSA-hw66-pxhg-8fx8 
DB_LOOKUP in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) 2.21 and earlier does not properly check if a file is open, which allows remote attackers to cause a denial of service (infinite loop) by performing a look-up on a database while iterating over it, which triggers the file pointer to be reset.
CVE-2007-0701 
PHP remote file inclusion vulnerability in inc/common.inc.php in Epistemon 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the inc_path parameter.
CVSS v2.0 score: 7.5
GHSA-r34v-gqmw-qvgj Podman Symlink Vulnerability
An issue was discovered in Podman in libpod before 1.6.0. It resolves a symlink in the host context during a copy operation from the container to the host, because an undesired glob operation occurs. An attacker could create a container image containing particular symlinks that, when copied by a victim user to the host filesystem, may overwrite existing files with others from the host.
CVSS v3.1 score: 5.5
CVE-2021-46523 
Cesanta MJS v2.20.0 was discovered to contain a heap buffer overflow via to_json_or_debug at mjs/src/mjs_json.c.
CVSS v3.1 score: 7.8
CVSS v2.0 score: 6.8
GHSA-rh9j-f5f8-rvgc Authentication bypass vulnerability in Apple Game Center auth adapter
ImpactThe certificate in Apple Game Center auth adapter not validated. As a result, authentication could potentially be bypassed by making a fake certificate accessible via certain Apple domains and providing the URL to that certificate in an authData object.PatchesTo prevent this, a new `rootCertificateUrl` property is introduced to the Parse Server Apple Game Center auth adapter which takes the URL to the root certificate of Apple's Game Center authentication certificate. If no value is set, the `rootCertificateUrl` property defaults to the URL of the [current root certificate](https://developer.apple.com/news/?id=stttq465) as of May 27, 2022.Keep in mind that the root certificate can change at any time (expected to be announced by Apple) and that it is the developer's responsibility to keep the root certificate URL up-to-date when using the Parse Server Apple Game Center auth adapter.WorkaroundsNone.Referenceshttps://github.com/parse-community/parse-server/security/advisories/GHSA-rh9j-f5f8-rvgchttps://developer.apple.com/news/?id=stttq465https://github.com/parse-community/parse-serverMore informationFor questions or comments about this vulnerability visit our [community forum](http://community.parseplatform.org) or [community chat](http://chat.parseplatform.org)Report other vulnerabilities at [report.parseplatform.org](https://report.parseplatform.org)
CVSS v3.1 score: 8.6
CVE-2001-1401 
Bugzilla before 2.14 does not properly restrict access to confidential bugs, which could allow Bugzilla users to bypass viewing permissions via modified bug id parameters in (1) process_bug.cgi, (2) show_activity.cgi, (3) showvotes.cgi, (4) showdependencytree.cgi, (5) showdependencygraph.cgi, (6) showattachment.cgi, or (7) describecomponents.cgi.
CVSS v2.0 score: 7.5
CVE-2021-35092 
Processing DCB/AVB algorithm with an invalid queue index from IOCTL request could lead to arbitrary address modification in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music
CVSS v3.1 score: 6.7
CVE-2023-34647 
PHPgurukl Hostel Management System v.1.0 is vulnerable to Cross Site Scripting (XSS).
CVSS v3.1 score: 6.1
GHSA-m5xf-x7q6-3rm7 KubeVela VelaUX APIserver has SSRF vulnerability
ImpactUsers using the VelaUX APIServer could be affected by this vulnerability.When using Helm Chart as the component delivery method, the request address of the warehouse is not restricted, and there is a blind SSRF vulnerability.This issue is patched in 1.5.9 and 1.6.2.ReferencesFix by: #5000For more informationIf you have any questions or comments about this advisory:Open an issue in [KubeVela repo](https://github.com/kubevela/kubevela)Email us at [here](https://github.com/kubevela/kubevela#contact-us)
CVSS v3.1 score: 4.9
GHSA-vp9p-frm6-465h 
The MeWidget module on Huawei P7 smartphones with software P7-L10 V100R001C00B136 and earlier versions could lead to the disclosure of contact information.
CVSS v3.0 score: 3.3
CVE-2026-45349 Open WebUI: Broken Access Control for Completions API
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, a user just needs to use the API endpoint: /api/chat/completions with their own API key (generated in OWUI) and the Chat ID of another user to continue the conversation of the other user. This vulnerability is fixed in 0.9.0.
CVSS v3.1 score: 7.1
CVE-2008-7115 
The web interface to the Belkin Wireless G router and ADSL2 modem F5D7632-4V6 with firmware 6.01.08 allows remote attackers to bypass authentication and gain administrator privileges via a direct request to (1) statusprocess.exe, (2) system_all.exe, or (3) restore.exe in cgi-bin/.  NOTE: the setup_dns.exe vector is already covered by CVE-2008-1244.
CVSS v2.0 score: 10
GHSA-fchq-jwhc-r9q2 
Buffer overflows in Icecast before 1.3.10 allow remote attackers to cause a denial of service (crash) and execute arbitrary code.
CVE-2026-49064 WordPress GetPaid plugin <= 2.8.49 - Sensitive Data Exposure vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in Stiofan GetPaid allows Retrieve Embedded Sensitive Data.

This issue affects GetPaid: from n/a through 2.8.49.
CVSS v3.1 score: 7.5
GHSA-v538-gr8w-jr93 
The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability check on the 'create_refund' function in all versions up to, and including, 1.0.42. This makes it possible for authenticated attackers, with Contributor-level access and above, to update the status of refund requests, including approving and refusing refunds.
CVSS v3.1 score: 5.3
GHSA-gxg5-5cmr-3588 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Job Board Manager allows Reflected XSS. This issue affects Job Board Manager: from n/a through 2.1.60.
CVSS v3.1 score: 7.1
GHSA-2hfc-5xf7-x5gq 
IBM Maximo Asset Management 7.6.1.1, 7.6.1.2, 7.6.1.3 and IBM Maximo Application Suite 8.8 and 8.9 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 230958.
CVSS v3.1 score: 5.4
CVE-2024-43276 WordPress Child Theme Creator by Orbisius plugin <= 1.5.4 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Svetoslav Marinov (Slavi) Child Theme Creator allows Reflected XSS.This issue affects Child Theme Creator: from n/a through 1.5.4.
CVSS v3.1 score: 7.1
CVE-2025-30701 
Vulnerability in the RAS Security component of Oracle Database Server.  Supported versions that are affected are 19.3-19.26, 21.3-21.17 and  23.4-23.7. Easily exploitable vulnerability allows low privileged attacker having User Account privilege with network access via Oracle Net to compromise RAS Security.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all RAS Security accessible data as well as  unauthorized access to critical data or complete access to all RAS Security accessible data. CVSS 3.1 Base Score 7.3 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N).
CVSS v3.1 score: 7.3
CVE-2008-1176 
Cross-site scripting (XSS) vulnerability in function/sideblock.php in Affiliate Market (affmarket) 0.1 BETA allows remote attackers to inject arbitrary web script or HTML via the sideblock4 parameter.
CVSS v2.0 score: 2.6
GHSA-h8qw-xqm9-q66j Mattermost Server is vulnerable to XSS through customizable theme color-code values
An issue was discovered in Mattermost Server before 3.1.0. It allows XSS via theme color-code values.
CVSS v3.1 score: 5.4
CVE-2026-4292 Privilege abuse in ModelAdmin.list_editable
An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.
Admin changelist forms using `ModelAdmin.list_editable` incorrectly allowed new
instances to be created via forged `POST` data.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Cantina for reporting this issue.
CVSS v3.1 score: 2.7
RHSA-2025:1086 Red Hat Security Advisory: ovn22.12 security update
ovn: egress ACLs may be bypassed via specially crafted UDP packet
CVSS v3.1 score: 8.1
GHSA-r74x-hfrh-mh6j 
Session Hijacking vulnerability in Hitachi Ops Center Analyzer.This issue affects Hitachi Ops Center Analyzer: from 10.0.0-00 before 11.0.1-00.
CVSS v3.1 score: 7.5
GHSA-r7vp-rjp7-f82g 
A vulnerability classified as critical was found in Pixelimity 1.0. Affected by this vulnerability is an unknown functionality of the file /install/index.php of the component Installation. The manipulation of the argument site_description leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 5.1
CVSS v3.1 score: 4.7
GHSA-3hjf-m6vc-vh7h 
In the Linux kernel, the following vulnerability has been resolved:btrfs: don't BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc()We handle errors here properly, ENOMEM isn't fatal, return the error.
CVSS v3.1 score: 5.5
PYSEC-2026-2431 
### Summary
curl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl.

Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curl_cffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, which may bypass certain network controls.

### Details
The issue comes from how curl_cffi handles outbound requests
- User-supplied URLs are passed directly to libcurl without checking whether they resolve to internal IP ranges (e.g., 127.0.0.1, 169.254.0.0/16).
- Redirects are automatically followed (CURLOPT_FOLLOWLOCATION = 1) inside libcurl.
- There is no validation of redirect destinations at the Python layer.

This means that even if an application only allows requests to external URLs, an attacker can
- Provide a URL pointing to an attacker-controlled server
- Return a redirect response pointing to an internal service
- Have curl_cffi follow that redirect automatically

As a result, internal endpoints (such as cloud instance metadata APIs) can be accessed.

Additionally, curl_cffi supports TLS fingerprint impersonation (e.g., impersonate="chrome"). In environments where outbound requests are filtered based on TLS fingerprinting, this can make such requests harder to detect or block

This behavior is similar to previously reported redirect-based SSRF issues such as CVE-2025-68616, where redirects allowed access to unintended internal resources.

### PoC
1. Direct internal request
```
import curl_cffi
resp = curl_cffi.get("http://169.254.169.254/latest/meta-data/")
print(resp.text)
```
2. Redirect to internal service
Attacker server:
```
GET /test
→ 302 Location: http://169.254.169.254/latest/meta-data/
```
Victim code:
```
import curl_cffi
resp = curl_cffi.get("https://attacker.example/test")
print(resp.text)
```
Result
- Initial request goes to attacker server
- Redirect is returned
- libcurl follows the redirect automatically
- Internal metadata endpoint is accessed

3. With TLS impersonation
```
import curl_cffi\
resp = curl_cffi.get(
    "https://attacker.example/test",
    impersonate="chrome")
```
In some environments, this may help the request bypass TLS-based filtering controls.


### Impact
An attacker who can control the requested URL may be able to:
- Access internal network services
- Reach cloud metadata endpoints and retrieve sensitive information
- Bypass certain outbound filtering mechanisms (depending on environment)
This corresponds to CWE-918 Server-Side Request Forgery.
CVSS v3.1 score: 8.6
CVE-2023-42453 Improper validation of receipts allows forged read receipts in matrix synapse
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. Users were able to forge read receipts for any event (if they knew the room ID and event ID). Note that the users were not able to view the events, but simply mark it as read. This could be confusing as clients will show the event as read by the user, even if they are not in the room. This issue has been patched in version 1.93.0. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS v3.1 score: 3.1
CVE-2023-29643 
Cross Site Scripting (XSS) vulnerability in PerfreeBlog 3.1.2 allows attackers to execute arbitrary code via the Post function.
CVSS v3.1 score: 5.4
CVE-2020-19110 
SQL Injection vulnerability in Online Book Store v1.0 via the bookisbn parameter to book.php parameter, which could let a remote malicious user execute arbitrary code.
CVSS v3.1 score: 9.8
CVSS v2.0 score: 7.5
GHSA-xgqm-c7vm-24xf 
Joomla com_booking component 2.4.9 contains an information disclosure vulnerability that allows unauthenticated attackers to enumerate user accounts by exploiting the getUserData function in the customer controller. Attackers can send GET requests to index.php with option=com_booking, controller=customer, task=getUserData, and an id parameter to retrieve user names, usernames, and email addresses through brute force enumeration.
CVSS v4.0 score: 8.7
CVSS v3.1 score: 7.5
CVE-2022-24522 Skype Extension for Chrome Information Disclosure Vulnerability
Skype Extension for Chrome Information Disclosure Vulnerability
CVSS v3.1 score: 6.5
GHSA-xpcp-ch6h-733h 
Buffer overflow in Change passwd 3.1 (chpasswd) SquirrelMail plugin allows local users to execute arbitrary code via long command line arguments.