CIRCL/vulnerability-scores huggingface dataset:
GHSA-383p-xqxx-rrmp Denial of service in Apache Struts
Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a denial of service (block access to a web site) via unspecified vectors.
CVSS v3.0 score: 5.3
CVE-2025-59527 FlowiseAI/Flowise has Server-Side Request Forgery (SSRF) vulnerability
Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5, a Server-Side Request Forgery (SSRF) vulnerability was discovered in the /api/v1/fetch-links endpoint of the Flowise application. This vulnerability allows an attacker to use the Flowise server as a proxy to access internal network web services and explore their link structures. This issue has been patched in version 3.0.6.
CVSS v3.1 score: 7.5
GHSA-53jx-xfrj-82rq 
SQL Injection vulnerability in GoAdminGroup GoAdmin (last release v1.2.26) allows a remote attacker to execute arbitrary code and obtain sensitive information via the the __sort_type URL parameter on all /admin/info/{table} endpoints
CVSS v3.1 score: 6.5
GHSA-h8pp-6w7x-wjwx 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Product Excel Import Export & Bulk Edit for WooCommerce allows Reflected XSS. This issue affects Product Excel Import Export & Bulk Edit for WooCommerce: from n/a through 4.7.
CVSS v3.1 score: 7.1
GHSA-2c2c-vqcm-ccr6 
Google V8 before 5.2.361.32, as used in Google Chrome before 52.0.2743.82, does not properly process left-trimmed objects, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted JavaScript code.
CVSS v3.0 score: 8.8
GHSA-7wwr-4xgr-q5cp 
The Microsoft Tech Companion (aka com.technet) application 1.0.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2018-11878 
In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, possibility of invalid memory access while processing driver command in WLAN function.
CVSS v3.0 score: 7.8
CVSS v2.0 score: 7.2
GHSA-3x8m-r3mg-qw2f 
Buffer overflow in passwd in BSD based operating systems 4.3 and earlier allows local users to gain root privileges by specifying a long shell or GECOS field.
CVE-2022-38011 Raw Image Extension Remote Code Execution Vulnerability
Raw Image Extension Remote Code Execution Vulnerability
CVSS v3.1 score: 7.3
CVE-2006-5809 
Multiple unspecified vulnerabilities in Jonathon J. Freeman OvBB before 0.13a have unknown impact and attack vectors.
CVSS v2.0 score: 10
CVE-2026-63230 Pre-authentication error-based SQL injection vulnerability
A pre-authentication error-based SQL injection
vulnerability in Koollab LMS allowed an unauthenticated attacker to read sensitive database
contents, including personally identifiable information, credentials, and valid
JWT tokens that may enable account takeover, via the SCORM report endpoint.
CVSS v3.1 score: 9.1
GHSA-2xq3-93rc-7m59 
HP Web Jetadmin 7.5.2546 allows remote attackers to cause a denial of service (crash) via a malformed request, possibly due to a stricmp() error from an invalid use of the "$" character.
CVE-2013-0318 
The admin page in the Banckle Chat module for Drupal does not properly restrict access, which allows remote attackers to bypass intended restrictions via unspecified vectors.
CVSS v2.0 score: 10
GHSA-f3c6-4rj5-35rc 
Cross-site scripting (XSS) vulnerability in misc.php in Woltlab Burning Board (wBB) 2.3.4 allows remote attackers to inject arbitrary web script or HTML via the percent parameter.  NOTE: this issue has been disputed in a followup post, although the original disclosure might be related to reflected XSS.
CVE-2018-1362 
IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, and 7.0.1 within Citizen Portal could allow an authenticated user to withdraw other user's submitted applications from the system and possibly obtain privileges. IBM X-Force ID: 137380.
CVSS v3.0 score: 5
CVSS v2.0 score: 6
GHSA-crx8-5gw7-25m9 
Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1-git.
CVSS v3.0 score: 3.5
GHSA-rxvx-vx9w-jw3j 
eth_get_gso_type in net/eth.c in QEMU 4.2.1 allows guest OS users to trigger an assertion failure. A guest can crash the QEMU process via packet data that lacks a valid Layer 3 protocol.
CVSS v3.1 score: 6.5
GHSA-22cm-3qf2-2wc7 LDAP Injection in is-user-valid
All versions of package is-user-valid are vulnerable to LDAP Injection which can lead to either authentication bypass or information exposure.
CVSS v3.1 score: 7.5
RHSA-2022:6522 Red Hat Security Advisory: .NET Core 3.1 on RHEL 7 security and bugfix update
dotnet: DenialOfService - ASP.NET Core MVC vulnerable to stack overflow via ModelStateDictionary recursion.
CVSS v3.1 score: 7.5
CVE-2024-1524 A local user can be impersonated when using federated authentication with Silent JIT Provisioning.
When the "Silent Just-In-Time Provisioning" feature is enabled for a federated identity provider (IDP)  there is a risk that a local user store user's information may be replaced during the account provisioning process in cases where federated users share the same username as local users. 

 There will be no impact on your deployment if any of the preconditions mentioned below are not met. Only when all the preconditions mentioned below are fulfilled could a malicious actor associate a targeted local user account with a federated IDP user account that they control.

The Deployment should have: 
-An IDP configured for federated authentication with Silent JIT provisioning enabled.

The malicious actor should have:
-A fresh valid user account in the federated IDP that has not been used earlier.
-Knowledge of the username of a valid user in the local IDP. 
-An account at the federated IDP matching the targeted local username.
CVSS v3.1 score: 7.7
GHSA-4852-vrh7-28rf Reflected XSS in GraphQL Playground
Impact**directly impacted:**`graphql-playground-html@<1.6.22` - all unsanitized user input for `renderPlaygroundPage()`**all of our consuming packages** of `graphql-playground-html` are impacted:`graphql-playground-middleware-express@<1.7.16` - unsanitized user input to `expressPlayground()``graphql-playground-middleware-koa@<1.6.15` - unsanitized user input to `koaPlayground()``graphql-playground-middleware-lambda@<1.7.17` - unsanitized user input to `lambdaPlayground()``graphql-playground-middleware-hapi@<1.6.13` - unsanitized user input to `hapiPlayground()`as well as ***any other packages*** that use these methods with unsanitized user input.**not impacted:**`graphql-playground-electron` - uses `renderPlaygroundPage()` statically for a webpack build for electron bundle, no dynamic user input`graphql-playground-react` - usage of the component directly in a react application does not expose reflected XSS vulnerabilities. only the demo in `public/` contains the vulnerability, because it uses an old version of the html pacakge.Patchesupgrading to the above mentioned versions will solve the issue.If you're using `graphql-playground-html` directly, then:orThen, similar steps need to be taken for each middleware:[Upgrade Express Middleware](https://www.npmjs.com/package/graphql-playground-middleware-express#security-upgrade-steps)[Upgrade Koa Middleware](https://www.npmjs.com/package/graphql-playground-middleware-koa#security-upgrade-steps)[Upgrade Lambda Middleware](https://www.npmjs.com/package/graphql-playground-middleware-lambda#security-upgrade-steps)[Upgrade Hapi Middleware](https://www.npmjs.com/package/graphql-playground-middleware-hapi#security-upgrade-steps)WorkaroundsEnsure you properly sanitize *all* user input for options you use for whatever function to initialize GraphQLPlayground:for example, with `graphql-playground-html` and express:or, with `graphql-playground-express`:References[OWASP: How to Test for CSS Reflection Attacks](https://github.com/OWASP/wstg/blob/master/document/4-Web_Application_Security_Testing/07-Input_Validation_Testing/01-Testing_for_Reflected_Cross_Site_Scripting.md)[Original Report from Cure53](https://user-images.githubusercontent.com/1368727/84191028-dfb7b980-aa65-11ea-8e18-4b8706f538e2.jpg) (jpg)CreditsMasato Kinugawa of Cure53For more informationIf you have any questions or comments about this advisory:Open an issue in [graphql-playground](https://github.com/prisma-labs/graphql-playground/issues/new/choose)Email us at [rikki.schulte@gmail.com](mailto:rikki.schulte@gmail.com)
CVSS v3.1 score: 7.4
CVE-2024-9408 
In Eclipse GlassFish since version 6.2.5 it is possible to perform a Server Side Request Forgery attack in specific endpoints.
CVSS v4.0 score: 8.9
GHSA-gw2q-xcv4-xhg8 
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). The supported version that is affected is 11. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Solaris. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Solaris accessible data as well as unauthorized read access to a subset of Oracle Solaris accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N).
CVSS v3.1 score: 8.2
GHSA-9392-pj54-qqf8 WWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpoint
Summary`plugin/AuthorizeNet/processPayment.json.php` credits the logged-in user's wallet based only on the attacker-controlled `amount` POST parameter.The endpoint contains a TODO for real Authorize.Net charging, hardcodes `$paymentSuccess = true`, and then calls `YPTWallet::addBalance()` without validating
  any Authorize.Net transaction, webhook signature, hosted payment token, nonce, or server-side payment record.This allows any logged-in user to add arbitrary funds to their own AVideo wallet when the `AuthorizeNet` and `YPTWallet` plugins are enabled.DetailsAffected file:`plugin/AuthorizeNet/processPayment.json.php`Relevant code:Vulnerable flow:`$_POST['amount']` is read from the client.The endpoint only checks that the amount is greater than zero.The real Authorize.Net charge is not performed.`$paymentSuccess` is hardcoded to true.The logged-in user's wallet is credited with the client-supplied amount.There is no verification of:Authorize.Net transaction IDpayment tokenwebhook signaturepending payment recordexpected server-side amountcurrencyduplicate transaction/replay statePoCPrerequisites:AVideo with AuthorizeNet plugin enabledYPTWallet plugin enabledAttacker has any valid user accountSteps:Log in as a low-privileged user.Open the wallet page and record the current balance.Send the following request with the user's authenticated session cookie:The endpoint returns:Refresh the wallet page.The wallet balance is increased by 9999.No Authorize.Net hosted payment page, card payment, transaction confirmation, webhook, or server-side payment validation is required.ImpactA normal authenticated user can mint arbitrary wallet balance.Depending on the target site's configuration, this may allow the attacker to:purchase paid videos or subscriptions without paymentabuse any feature backed by YPTWallettransfer fake funds to other usersmanipulate accounting or payout-related workflowsbypass monetization controlsRecommended fixRemove or disable `processPayment.json.php` if it is obsolete.Never credit wallet balance from client-supplied `amount` alone.Use the existing Authorize.Net hosted token / webhook / transaction reconciliation flow.Require a verified Authorize.Net transaction ID and server-side amount lookup before calling `addBalance()`.Add regression tests proving arbitrary POSTs cannot credit a wallet.
CVSS v4.0 score: 7.1
CVSS v3.1 score: 4.3
RHSA-2012:0475 Red Hat Security Advisory: tomcat6 security update
tomcat: hash table collisions CPU usage DoS (oCERT-2011-003) tomcat: large number of parameters DoS
CVE-2016-5754 
Presence of a .htaccess file could leak information in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before SP2.
CVSS v3.0 score: 7.5
CVSS v2.0 score: 5
CVE-2021-46888 
An issue was discovered in hledger before 1.23. A Stored Cross-Site Scripting (XSS) vulnerability exists in toBloodhoundJson that allows an attacker to execute JavaScript by encoding user-controlled values in a payload with base64 and parsing them with the atob function.
CVSS v3.1 score: 5.4
GHSA-6mp6-gp33-936j 
Stack overflow vulnerability in parse_unary Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafted file.
CVSS v3.1 score: 5.5
GHSA-76jh-wm3g-gchp 
An Improper Control of Interaction Frequency vulnerability [CWE-799] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow a remote unauthenticated attacker to bypass the authentication rate-limit via crafted requests. The success of the attack depends on the attacker's resources and the password target complexity.
CVSS v3.1 score: 8.1
RHSA-2025:11375 Red Hat Security Advisory: kernel-rt security update
kernel: net: atlantic: fix aq_vec index out of range error kernel: net: atm: fix use after free in lec_send()
CVSS v3.1 score: 7
CVE-2024-54115 
Out-of-bounds read vulnerability in the DASH module
Impact: Successful exploitation of this vulnerability will affect availability.
CVSS v3.1 score: 4.3
CVE-2007-2770 
Stack-based buffer overflow in Eudora 7.1 allows user-assisted, remote SMTP servers to execute arbitrary code via a long SMTP reply.  NOTE: the user must click through a warning about a possible buffer overflow exploit to trigger this issue.
CVSS v2.0 score: 9.3
GHSA-2r64-2qmr-9w43 
WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
GHSA-pf98-xx8j-74qh 
The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Local File Inclusion, Arbitrary Settings Update, and User Creation in all versions up to, and including, 2.1.6 via several functions called by the 'checkFormRequest' function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Attackers can also update arbitrary settings and create user accounts even when registration is disabled, leading to user creation with a default role of Administrator.
CVSS v3.1 score: 9.8
CVE-2025-36220 Vulnerabilities exists in IBM Cloud Pak for Data System (CPDS 1.0) - Cyclops.
IBM Cloud Pak for Data System - Cyclops 11.3.0.2 through  Interim Fix 002 IBM Cloud Pak for Data System is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.
CVSS v3.1 score: 4.3
CVE-2005-0371 
Armagetron 0.2.6.0 and earlier and Armagetron Advanced 0.2.7.0 and earlier allow remote attackers to cause a denial of service (freeze) via a large number of player connections that do not send any data.
CVSS v2.0 score: 5
CVE-2018-25410 SIM-PKH 2.4.1 SQL Injection via media.php id Parameter
SIM-PKH 2.4.1 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send GET requests to /admin/media.php with module=pengurus and act=editpengurus parameters containing SQL UNION statements to extract database information including usernames, database names, and version details.
CVSS v4.0 score: 7.1
CVSS v3.1 score: 7.1
GHSA-pvvr-9j3m-hvhg 
In the Linux kernel, the following vulnerability has been resolved:drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink referenceprev_sink is unconditionally retained via dc_sink_retain at function
  entry, but the DP alt mode timeout path inside SIGNAL_TYPE_DISPLAY_PORT
  returns false without releasing prev_sink. All other return paths in the
  function correctly call dc_sink_release(prev_sink), making this the only
  missing cleanup.(cherry picked from commit 45510cf662dcf46b5d8926d454f338809f107b9d)
GHSA-4rxp-f57w-8645 
In onCreate of RequestManageCredentials.java, there is a possible way for a third party app to install certificates without user approval due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-205150380
CVSS v3.1 score: 7.8
PYSEC-2026-1686 
### Impact

It was discovered that due to improper handling and escaping of user-provided query parameters, a maliciously crafted Nautobot URL could potentially be used to execute a Reflected Cross-Site Scripting (Reflected XSS) attack against users. All filterable object-list views in Nautobot are vulnerable, including:

- /dcim/location-types/
- /dcim/locations/
- /dcim/racks/
- /dcim/rack-groups/
- /dcim/rack-reservations/
- /dcim/rack-elevations/
- /tenancy/tenants/
- /tenancy/tenant-groups/
- /extras/tags/
- /extras/statuses/
- /extras/roles/
- /extras/dynamic-groups/
- /dcim/devices/
- /dcim/platforms/
- /dcim/virtual-chassis/
- /dcim/device-redundancy-groups/
- /dcim/interface-redundancy-groups/
- /dcim/device-types/
- /dcim/manufacturers/
- /dcim/cables/
- /dcim/console-connections/
- /dcim/power-connections/
- /dcim/interface-connections/
- /dcim/interfaces/
- /dcim/front-ports/
- /dcim/rear-ports/
- /dcim/console-ports/
- /dcim/console-server-ports/
- /dcim/power-ports/
- /dcim/power-outlets/
- /dcim/device-bays/
- /dcim/inventory-items/
- /ipam/ip-addresses/
- /ipam/prefixes
- /ipam/rirs/
- /ipam/namespaces/
- /ipam/vrfs/
- /ipam/route-targets/
- /ipam/vlans/
- /ipam/vlan-groups/
- /ipam/services/
- /virtualization/virtual-machines/
- /virtualization/interfaces/
- /virtualization/clusters/
- /virtualization/cluster-types/
- /virtualization/cluster-groups/
- /circuits/circuits/
- /circuits/circuit-types/
- /circuits/providers/
- /circuits/provider-networks/
- /dcim/power-feeds/
- /dcim/power-panels/
- /extras/secrets/
- /extras/secrets-groups/
- /extras/jobs/
- /extras/jobs/scheduled-jobs/approval-queue/
- /extras/jobs/scheduled-jobs/
- /extras/job-results/
- /extras/job-hooks/
- /extras/job-buttons/
- /extras/object-changes/
- /extras/git-repositories/
- /extras/graphql-queries/
- /extras/relationships/
- /extras/notes/
- /extras/config-contexts/
- /extras/config-context-schemas/
- /extras/export-templates/
- /extras/external-integrations/
- /extras/webhooks/
- /extras/computed-fields/
- /extras/custom-fields/
- /extras/custom-links/

as well as any similar object-list views provided by any Nautobot App.

### Patches

Fixed in Nautobot 1.6.20 and 2.2.3.

### Workarounds

No workaround has been identified

### References

- #5646 
- #5647

**Credit to [Michael Panorios](mailto:michael.panorios@pwc.com) for reporting this issue.**
CVSS v3.1 score: 7.5
GHSA-p82f-f9j2-69q4 
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes VegaDays vegadays allows PHP Local File Inclusion.This issue affects VegaDays: from n/a through <= 1.2.0.
CVSS v3.1 score: 8.1
GHSA-4cfc-p468-p49f 
Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the security_5g parameter at /goform/WifiBasicSet.
CVSS v3.1 score: 6.5
GHSA-gp8r-64c4-ggqw 
Improper syscall input validation in AMD TEE
(Trusted Execution Environment) may allow an attacker with physical access and
control of a Uapp that runs under the bootloader to reveal the contents of the
ASP (AMD Secure Processor) bootloader accessible memory to a serial port,
resulting in a potential loss of integrity.
CVSS v3.1 score: 6.1
CVE-2014-6957 
The scottcolibmn (aka com.bredir.boopsie.scottlib) application 4.5.110 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0 score: 5.4
GHSA-7xj5-h6cr-5xf4 
In the Linux kernel, the following vulnerability has been resolved:hamradio: defer ax25 kfree after unregister_netdevThere is a possible race condition (use-after-free) like below(USE)                       |  (FREE)
ax25_sendmsg                 |
 ax25_queue_xmit             |
  dev_queue_xmit             |
   __dev_queue_xmit          |
    __dev_xmit_skb           |
     sch_direct_xmit         | ...
      xmit_one               |
       netdev_start_xmit     | tty_ldisc_kill
        __netdev_start_xmit  |  mkiss_close
         ax_xmit             |   kfree
          ax_encaps          |
                             |Even though there are two synchronization primitives before the kfree:wait_for_completion(&ax->dead). This can prevent the race with
routines from mkiss_ioctl. However, it cannot stop the routine coming
from upper layer, i.e., the ax25_sendmsg.netif_stop_queue(ax->dev). It seems that this line of code aims to
halt the transmit queue but it fails to stop the routine that already
being xmit.This patch reorder the kfree after the unregister_netdev to avoid the
possible UAF as the unregister_netdev() is well synchronized and won't
return if there is a running routine.
GHSA-33c7-g5wf-767m 
SQL injection vulnerability in section.php in 6rbScript 3.3 allows remote attackers to execute arbitrary SQL commands via the singerid parameter in a singers action.
GHSA-6r28-26q2-vxwj 
Go before 1.15.12 and 1.16.x before 1.16.5 attempts to allocate excessive memory (issue 1 of 2).
CVSS v3.1 score: 7.5
PYSEC-2026-385 
A remote code execution (RCE) vulnerability exists in the lightning-ai/pytorch-lightning library version 2.2.1 due to improper handling of deserialized user input and mismanagement of dunder attributes by the `deepdiff` library. The library uses `deepdiff.Delta` objects to modify application state based on frontend actions. However, it is possible to bypass the intended restrictions on modifying dunder attributes, allowing an attacker to construct a serialized delta that passes the deserializer whitelist and contains dunder attributes. When processed, this can be exploited to access other modules, classes, and instances, leading to arbitrary attribute write and total RCE on any self-hosted pytorch-lightning application in its default configuration, as the delta endpoint is enabled by default.
CVSS v3.0 score: 9.8
GHSA-fpqf-jx9q-7w86 
Cross-Site Request Forgery (CSRF) vulnerability in Palasthotel by Edward Bock, Katharina Rompf Sunny Search plugin <= 1.0.2 versions.
CVSS v3.1 score: 8.8
CVE-2026-24433 Tenda W30E V2 Stored XSS via Username Field
Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) contain a stored cross-site scripting vulnerability in the user creation functionality. Insufficient input validation allows attacker-controlled script content to be stored and later executed when administrative users access the affected management pages.
CVSS v4.0 score: 5.1
GHSA-4xrg-5554-qffr 
OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that generates predictable numbers, which makes it easier for remote attackers to conduct brute force guessing attacks against cryptographic keys.
CVSS v3.1 score: 7.5
GHSA-5r4c-4wm4-c532 
Use after free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally.
CVSS v3.1 score: 7.8
GHSA-pjhx-j53p-c5f5 ThinkPHP deserialization vulnerability
A deserialization vulnerability in the component \controller\Index.php of Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code.
CVSS v4.0 score: 8.9
CVSS v3.1 score: 9.8
CVE-2023-3917 Improper Validation of Specified Type of Input in GitLab
Denial of Service in pipelines affecting all versions of Gitlab EE and CE prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows attacker to cause pipelines to fail.
CVSS v3.1 score: 4.3
CVE-2020-36854 Async JavaScript <= 2.19.07.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting
The Async JavaScript plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including,  2.19.07.14. This is due to missing authorization checks on the aj_steps AJAX aciton along with a lack on sanitization on the settings saved via the function. This makes it possible for authenticated attackers with subscriber level permissions and above to inject malicious web scripts into a page that execute whenever a user accesses that page.
CVSS v3.1 score: 6.4
GHSA-5m5x-66vw-r2rp 
The CE21 Suite plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the wp_ajax_nopriv_ce21_single_sign_on_save_api_settings AJAX action in versions 2.2.1 to 2.3.1. This makes it possible for unauthenticated attackers to update the plugin's API settings including a secret key used for authentication. This allows unauthenticated attackers to create new admin accounts on an affected site.
CVSS v3.1 score: 9.8
CVE-2018-4974 
Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have a Use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVSS v3.0 score: 8.8
CVSS v2.0 score: 6.8
CVE-2016-0784 
Directory traversal vulnerability in the Import/Export System Backups functionality in Apache OpenMeetings before 3.1.1 allows remote authenticated administrators to write to arbitrary files via a .. (dot dot) in a ZIP archive entry.
CVSS v3.0 score: 6.5
CVSS v2.0 score: 4
CVE-2006-1056 
The Linux kernel before 2.6.16.9 and the FreeBSD kernel, when running on AMD64 and other 7th and 8th generation AuthenticAMD processors, only save/restore the FOP, FIP, and FDP x87 registers in FXSAVE/FXRSTOR when an exception is pending, which allows one process to determine portions of the state of floating point instructions of other processes, which can be leveraged to obtain sensitive information such as cryptographic keys. NOTE: this is the documented behavior of AMD64 processors, but it is inconsistent with Intel processors in a security-relevant fashion that was not addressed by the kernels.
CVSS v2.0 score: 2.1
CVE-2004-0284 
Microsoft Internet Explorer 6.0, Outlook 2002, and Outlook 2003 allow remote attackers to cause a denial of service (CPU consumption), if "Do not save encrypted pages to disk" is disabled, via a web site or HTML e-mail that contains two null characters (%00) after the host name.
CVSS v2.0 score: 5
GHSA-gxfh-rxpm-86pc 
Unsanitized input in an OS command in the virtual desktop session name handling in AWS Research and Engineering Studio (RES) version 2025.03 through 2025.12.01 might allow a remote authenticated actor to execute arbitrary commands as root on the virtual desktop host via a crafted session name.To remediate this issue, users are advised to upgrade to RES version 2026.03 or apply the corresponding mitigation patch to their existing environment.
CVSS v4.0 score: 8.7
CVSS v3.1 score: 8.8
GHSA-vvp4-x27q-hqwj 
In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link.
CVSS v3.1 score: 6.1
GHSA-5j8j-gxqm-7cm8 
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Icegram Icegram Collect plugin <= 1.3.8 versions.
CVSS v3.1 score: 4.8
GHSA-c2fw-gwff-m58h 
HP CentralView Fraud Risk Management 11.1, 11.2, and 11.3; CentralView Revenue Leakage Control 4.1, 4.2, and 4.3; CentralView Dealer Performance Audit 2.0 and 2.1; CentralView Credit Risk Control 2.1, 2.2, and 2.3; CentralView Roaming Fraud Control 2.1, 2.2, and 2.3; and CentralView Subscription Fraud Prevention 2.0 and 2.1 allow remote attackers to obtain sensitive information via unspecified vectors, a different vulnerability than CVE-2015-5406 and CVE-2015-5407.
GHSA-wpc5-5qhg-m23f 
Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. Specially crafted malicious URLs can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger these vulnerabilities.This vulnerability affects the phpexe parameter.
CVSS v3.1 score: 6.1
GHSA-ph64-7g39-3mrm 
Buffer overflow in binmail in HP Tru64 UNIX 5.1a, 5.1, 5.0a, 4.0g, and 4.0f allows local users to gain privileges.
CVE-2021-33285 
In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS attribute is supplied to the function ntfs_get_attribute_value, a heap buffer overflow can occur allowing for memory disclosure or denial of service. The vulnerability is caused by an out-of-bound buffer access which can be triggered by mounting a crafted ntfs partition. The root cause is a missing consistency check after reading an MFT record : the "bytes_in_use" field should be less than the "bytes_allocated" field. When it is not, the parsing of the records proceeds into the wild.
CVSS v3.1 score: 6.7
CVSS v2.0 score: 6.9
RHSA-2015:0803 Red Hat Security Advisory: kernel security and bug fix update
kernel: integer overflow in fb_mmap kernel: isofs: unbound recursion when processing relocated directories kernel: isofs: unbound recursion when processing relocated directories kernel: infiniband: uverbs: unprotected physical memory access
CVE-2021-23139 
A null pointer vulnerability in Trend Micro Apex One and Worry-Free Business Security 10.0 SP1 could allow an attacker to crash the CGI program on affected installations.
CVSS v3.1 score: 7.5
CVSS v2.0 score: 5
GHSA-rr9h-8v7w-6v77 
IP TOOLS 2.50 contains a local buffer overflow vulnerability in the SNMP Scanner component that allows local attackers to crash the application by supplying oversized input. Attackers can paste malicious data into the 'From Addr' and 'To Addr' fields and trigger the crash by clicking the Start button, causing denial of service and SEH overwrite.
CVSS v4.0 score: 6.8
CVSS v3.1 score: 5.5
CVE-2003-0247 
Unknown vulnerability in the TTY layer of the Linux kernel 2.4 allows attackers to cause a denial of service ("kernel oops").
CVSS v2.0 score: 5
CVE-2026-65578 WordPress Agora theme <= 1.9 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Agora <= 1.9 versions.
CVSS v3.1 score: 9.8
CVE-2014-6927 
The Myanmar Housing : mmHome (aka com.mmhome3) application 1.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0 score: 5.4
GHSA-q52p-4hj9-4wrq 
A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function follow_page_pte of the file mm/gup.c of the component BPF. The manipulation leads to race condition. The attack can be launched remotely. It is recommended to apply a patch to fix this issue. The identifier VDB-211921 was assigned to this vulnerability.
CVSS v3.1 score: 7.5
CVE-2025-13954 Hard-coded cryptographic keys in EZCast Pro II Dongle
Hard-coded cryptographic keys in Admin UI of EZCast Pro II before version 1.17478.177 allows attackers to bypass authorization checks and gain full access to the admin UI
CVSS v4.0 score: 9.3
GHSA-gr8j-qm8r-rfgg Moodle Improper Access Control
The "restore teacher" feature in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to overwrite the course idnumber.
CVSS v3.0 score: 4.3
CVE-2018-18211 
PbootCMS 1.2.1 has SQL injection via the HTTP POST data to the api.php/cms/addform?fcode=1 URI.
CVSS v3.0 score: 8.1
CVSS v2.0 score: 6.8
GHSA-q66v-vvpj-vg9p 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Digital zoom studio DZS Video Gallery allows Reflected XSS.This issue affects DZS Video Gallery: from n/a through 12.25.
CVSS v3.1 score: 7.1
GHSA-rq75-xpj3-jxm4 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files modules/ext.CheckUser/checkuser/checkUserHelper/buildUserElement.Js.This issue affects CheckUser: from * before 1.44.1.
CVSS v4.0 score: 0
CVSS v3.1 score: 6.1
CVE-2014-9821 
Heap-based buffer overflow in ImageMagick allows remote attackers to have unspecified impact via a crafted xpm file.
CVSS v3.1 score: 7.8
CVSS v2.0 score: 6.8
GHSA-h9c2-9fv8-2xjq 
Null pointer dereference vulnerability in parser_irot function in libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds write by remote attacker.
CVSS v3.1 score: 9.8
CVE-2022-22154 Junos Fusion: A Satellite Device can be controlled by rewiring it to a foreign AD causing a DoS
In a Junos Fusion scenario an External Control of Critical State Data vulnerability in the Satellite Device (SD) control state machine of Juniper Networks Junos OS allows an attacker who is able to make physical changes to the cabling of the device to cause a denial of service (DoS). An SD can get rebooted and subsequently controlled by an Aggregation Device (AD) which does not belong to the original Fusion setup and is just connected to an extended port of the SD. To carry out this attack the attacker needs to have physical access to the cabling between the SD and the original AD. This issue affects: Juniper Networks Junos OS 16.1R1 and later versions prior to 18.4R3-S10; 19.1 versions prior to 19.1R3-S7; 19.2 versions prior to 19.2R3-S4. This issue does not affect Juniper Networks Junos OS versions prior to 16.1R1.
CVSS v3.1 score: 6.8
CVE-2021-1746 
This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. Processing a maliciously crafted image may lead to arbitrary code execution.
CVSS v3.1 score: 7.8
CVSS v2.0 score: 6.8
GHSA-qh62-99w2-xfq5 
A SQL Injection vulnerability was identified in the admin/edit-directory.php file of the PHPGurukul Directory Management System v2.0. Attackers can exploit this vulnerability via the email parameter in a POST request to execute arbitrary SQL commands.
CVSS v3.1 score: 5.3
GHSA-3274-8h4c-g6q9 
In xpdf, the xref table contains an infinite loop which allows remote attackers to cause a denial of service (application crash) in xpdf-based PDF viewers.
CVSS v3.1 score: 5.5
CVE-2017-9877 
IrfanView version 4.44 (32bit) with FPX Plugin 4.46 allows attackers to execute arbitrary code or cause a denial of service via a crafted .fpx file, related to "Data from Faulting Address controls Code Flow starting at FPX!FPX_GetScanDevicePropertyGroup+0x000000000000c998."
CVSS v3.0 score: 7.8
CVSS v2.0 score: 6.8
GHSA-85vc-29fc-65gw 
The Grav form plugin (getgrav/grav-plugin-form) before 9.1.13 contains an open redirect vulnerability. Since v9.1.11, the redirect process action evaluates user-supplied form data inside Twig expressions, and Grav::redirect() accepts external URLs without origin validation. When a form blueprint defines a redirect target such as redirect: "{{ form.value('next') }}" using an attacker-controllable field, an unauthenticated form submitter can supply a value like https://evil.com to cause a 302 redirect to an arbitrary external site, enabling phishing.
CVSS v4.0 score: 7.1
CVSS v3.1 score: 6.5
CVE-2021-0171 
Improper access control in software for Intel(R) PROSet/Wireless Wi-Fi and Killer(TM) Wi-Fi in Windows 10 and 11 may allow an authenticated user to potentially enable information disclosure via local access.
CVSS v3.1 score: 5.5
CVSS v2.0 score: 2.1
RHSA-2025:2867 Red Hat Security Advisory: grub2 security update
grub2: net: Out-of-bounds write in grub_net_search_config_file()
CVSS v3.1 score: 7.6
GHSA-6f2c-6pxj-74jw 
epan/dissectors/packet-nbap.c in the NBAP dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate conversation data, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted packet.
CVSS v3.0 score: 5.5
CVE-2024-23515 WordPress Cincopa video and media plugin <= 1.159 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Cincopa Post Video Players.This issue affects Post Video Players: from n/a through 1.159.
CVSS v3.1 score: 5.4
GHSA-vwx3-wp3j-h8gh 
Use After Free (UAF) vulnerability in the audio PCM driver module under special conditions. Successful exploitation of this vulnerability may cause audio features to perform abnormally.
CVSS v3.1 score: 9.8
CVE-2024-12109 Product Labels For Woocommerce < 1.5.9 - Admin+ SQLi
The Product Labels For Woocommerce (Sale Badges) WordPress plugin before 1.5.9 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
CVSS v3.1 score: 4.1
GHSA-jr39-gjqh-hwmq 
IrfanView 4.53 allows Data from a Faulting Address to control Code Flow starting at JPEG_LS+0x0000000000001d8a.
CVSS v3.1 score: 7.8
GHSA-j7q5-3vqr-jj47 
In the Linux kernel, the following vulnerability has been resolved:wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext()Replace one-element array with a flexible-array member in
`struct host_cmd_ds_802_11_scan_ext`.With this, fix the following warning:elo 16 17:51:58 surfacebook kernel: ------------[ cut here ]------------
elo 16 17:51:58 surfacebook kernel: memcpy: detected field-spanning write (size 243) of single field "ext_scan->tlv_buffer" at drivers/net/wireless/marvell/mwifiex/scan.c:2239 (size 1)
elo 16 17:51:58 surfacebook kernel: WARNING: CPU: 0 PID: 498 at drivers/net/wireless/marvell/mwifiex/scan.c:2239 mwifiex_cmd_802_11_scan_ext+0x83/0x90 [mwifiex]
CVSS v3.1 score: 5.5
GHSA-863x-vcg8-vghr 
Select Dell Client Commercial and Consumer platforms support a BIOS password reset capability that is designed to assist authorized customers who forget their passwords. Dell is aware of unauthorized password generation tools that can generate BIOS recovery passwords. The tools, which are not authorized by Dell, can be used by a physically present attacker to reset BIOS passwords and BIOS-managed Hard Disk Drive (HDD) passwords. An unauthenticated attacker with physical access to the system could potentially exploit this vulnerability to bypass security restrictions for BIOS Setup configuration, HDD access and BIOS pre-boot authentication.
GHSA-4rjp-pffc-mwxj 
An Improper Privilege Management vulnerability in the Windows Installer framework used in the Juniper Networks Juniper Identity Management Service (JIMS) allows an unprivileged user to trigger a repair operation. Running a repair operation, in turn, will trigger a number of file operations in the %TEMP% folder of the user triggering the repair. Some of these operations will be performed from a SYSTEM context (started via the Windows Installer service), including the execution of temporary files. An attacker may be able to provide malicious binaries to the Windows Installer, which will be executed with high privilege, leading to a local privilege escalation. This issue affects Juniper Networks Juniper Identity Management Service (JIMS) versions prior to 1.4.0.
CVSS v3.1 score: 7.8
GHSA-27fh-xm3c-9mq3 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Foliovision: Making the web work for you FV Flowplayer Video Player allows Stored XSS.This issue affects FV Flowplayer Video Player: from n/a through 7.5.41.7212.
CVSS v3.1 score: 6.5
GHSA-7hgh-vq2w-c3xf 
Unknown vulnerability in the Mail application for Mac OS X 10.1.5 and 10.2.8 with unknown impact, a different vulnerability than CVE-2004-0086.
GHSA-rgxx-f3cp-vg8p 
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, integer overflow may occur when values passed from HLOS (graphics driver busy time, and total time) in TZBSP_GFX_DCVS_UPDATE_ID are very large.
CVSS v3.0 score: 9.8
GHSA-c2px-jcgw-9x57 NukeViet Cross-Site Request Forgery (CSRF)
`modules\users\admin\add_user.php` in NukeViet 4.4 allows CSRF to add a user account via the `admin/index.php?nv=users&op=user_add` URI.
CVSS v3.1 score: 6.5
CVE-2023-3092 SMTP Mail <= 1.3.46 - Unauthenticated Stored Cross-Site Scripting via Email Subject
The SMTP Mail plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 1.3.46 due to insufficient input sanitization and output escaping when the 'Save Data SendMail' feature is enabled. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1 score: 7.2
CVE-2021-26726 Remote code execution in Valmet DNA before Collection 2021
A remote code execution vulnerability affecting a Valmet DNA service listening on TCP port 1517, allows an attacker to execute commands with SYSTEM privileges This issue affects: Valmet DNA versions from Collection 2012 until Collection 2021.
CVSS v3.1 score: 8.8
GHSA-897h-qq8f-vw6q 
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Jon Vincent Mendoza Dynamic Elementor Addons allows PHP Local File Inclusion.This issue affects Dynamic Elementor Addons: from n/a through 1.0.0.
CVSS v3.1 score: 7.5
GHSA-f6r7-6w34-x2gp Keycloak Vulnerable to Improper Validation of Specified Quantity in Input
A flaw was found in Keycloak. A remote attacker with high privileges, such as a realm administrator configuring a malicious Lightweight Directory Access Protocol (LDAP) server or an attacker compromising an upstream LDAP server, could exploit this vulnerability. By sending a malformed LDAP password policy response during a password authentication request, the attacker can trigger an OutOfMemoryError. This causes the Keycloak Java Virtual Machine (JVM) to terminate, leading to a denial of service (DoS) for all realms on the affected node.
CVSS v3.1 score: 4.9
CVE-2025-4874 PHPGurukul News Portal Project contactus.php sql injection
A vulnerability was found in PHPGurukul News Portal Project 4.1 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/contactus.php. The manipulation of the argument pagetitle leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 7.3
CVSS v3.0 score: 7.3
CVSS v2.0 score: 7.5
GHSA-654w-wx9h-5mgg 
A Path Traversal vulnerability has been identified in the Email Security appliance allows an attacker to manipulate file system paths by injecting crafted directory-traversal sequences (such as ../) and may access files and directories outside the intended restricted path.
CVSS v3.1 score: 5.3
GHSA-pwx5-6wxg-px5h Insecure Variable Substitution in Vela
ImpactVela pipelines can use variable substitution combined with insensitive fields like `parameters`, `image` and `entrypoint` to inject secrets into a plugin/image and — by using common substitution string manipulation — can bypass log masking and expose secrets without the use of the commands block. This unexpected behavior primarily impacts secrets restricted by the "no commands" option. This can lead to unintended use of the secret value, and increased risk of exposing the secret during image execution bypassing log masking.Given by the following substitution examples:
using `parameters`using `image` tagusing `entrypoint` as a shim for `commands`**To exploit this** the pipeline author must be supplying the secrets to a plugin that is designed in such a way that will print those parameters in logs. Plugin parameters are not designed for sensitive values and are often intentionally printed throughout execution for informational/debugging purposes. Parameters should therefore be treated as insensitive.While Vela provides secrets masking, secrets exposure is not entirely solved by the masking process. A docker image (plugin) can easily expose secrets if they are not handled properly, or altered in some way. There is a responsibility on the end-user to understand how values injected into a plugin are used. This is a risk that exists for many CICD systems (like GitHub Actions) that handle sensitive runtime variables. Rather, the greater risk is that users who restrict a secret to the "no commands" option and use image restriction can still have their secret value exposed via substitution tinkering, which turns the image and command restrictions into a false sense of security.PatchesN/AWorkaroundsDo not provide sensitive values to plugins that can potentially expose them, especially in `parameters` that are not intended to be used for sensitive values.Ensure plugins (especially those that utilize shared secrets) follow best practices to avoid logging parameters that are expected to be sensitive.Minimize secrets with `pull_request` events enabled, as this allows users to change pipeline configurations and pull in secrets to steps not typically part of the CI process.Make use of the build approval setting, restricting builds from untrusted usersLimit use of shared secrets, as they are less restrictive to access by nature.Referenceshttps://github.com/go-vela/workerFor more informationIf you have any questions or comments about this advisory:Email us at [vela@target.com](mailto:vela@target.com)Affected products: `go-vela/worker`
CVSS v3.1 score: 7.7
GHSA-6pqf-c99p-758v org.xwiki.commons:xwiki-commons-xml's HTML sanitizer allows form elements in restricted
ImpactThe HTML sanitizer that is included in XWiki since version 14.6RC1 allowed form and input HTML tags. In the context of XWiki, this allows an attacker without script right to either create forms that can be used for phishing attacks or also in the context of a sheet, the attacker could add an input like `{{html}}<input type="hidden" name="content" value="{{groovy}}println(&quot;Hello from Groovy!&quot;)" />{{/html}}` that would allow remote code execution when it is submitted by an admin (the sheet is rendered as part of the edit form). The attacker would need to ensure that the edit form looks plausible, though, which can be non-trivial as without script right the attacker cannot display the regular content of the document.PatchesThis has been patched in XWiki 14.10.6 and 15.2RC1 by removing the central form-related tags from the list of allowed tags.WorkaroundsAn admin can manually disallow the tags by adding `form, input, select, textarea, button` to the configuration option `xml.htmlElementSanitizer.forbidTags` in the `xwiki.properties` configuration file.Referenceshttps://jira.xwiki.org/browse/XCOMMONS-2634https://github.com/xwiki/xwiki-commons/commit/99484d48e899a68a1b6e33d457825b776c6fe8c3
CVSS v3.1 score: 9