ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-qvfq-26w4-9f8v: SAP GUI for Windows & RFC service credentials are incorrectly stored in the memory of the program allowing an unauthenticated attacker to access information within systems, resulting in privilege escalation. On successful exploitation, this could result in disclosure of highly sensitive information. This has no impact on integrity, and availability.
CVSS v3.1: 6
CVE-2019-15080: An issue was discovered in a smart contract implementation for MORPH Token through 2019-06-05, an Ethereum token. A typo in the constructor of the Owned contract (which is inherited by MORPH Token) allows attackers to acquire contract ownership. A new owner can subsequently obtain MORPH Tokens for free and can perform a DoS attack.
CVSS v3.1: 7.5
CVSS v2.0: 5
GHSA-mc6q-88m2-653g: eCryptfs 104 and earlier uses a default salt to encrypt the mount passphrase, which makes it easier for attackers to obtain user passwords via a brute force attack.
GHSA-24j9-x2wg-9qv6: Apache Tomcat: CLIENT_CERT authentication does not fail as expected
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116.Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fixes the issue.
CVSS v3.1: 6.5
CVE-2016-1674: The extensions subsystem in Google Chrome before 51.0.2704.63 allows remote attackers to bypass the Same Origin Policy via unspecified vectors.
CVSS v3.0: 8.8
CVSS v2.0: 6.8
GHSA-4jv4-m99j-v5mh: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Security : Privileges). Supported versions that are affected are 8.0.13 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Server accessible data. CVSS 3.0 Base Score 6.5 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N).
CVSS v3.0: 6.5
CVE-2026-56766: Hydra - Stack Buffer Overflow in NTLM Authentication Handler
Hydra through 9.7, fixed in commit 9cc84c2, contains a stack buffer overflow in NTLM authentication across SMTP, POP3, IMAP, NNTP, HTTP, HTTP-Proxy, and HTTP-Proxy-Urlenum modules when processing malicious NTLM Type-2 challenges. A malicious server can send a crafted NTLM Type-2 challenge with an excessively long domain string, causing base64-encoded response data to overflow a 500-byte stack buffer by 18 to 330 bytes, enabling remote code execution on systems without stack protection.
CVSS v4.0: 8.6
CVSS v3.1: 8.8
GHSA-mj6x-679w-76wr: SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. An unauthenticated attacker can supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance.
CVSS v4.0: 9.3
CVSS v3.1: 9.8
GHSA-4c6m-4p4p-3j5f: Insufficient input validation in the SMU may
enable a privileged attacker to write beyond the intended bounds of a shared
memory buffer potentially leading to a loss of integrity.
CVSS v3.1: 7.5
GHSA-v7cf-pmr2-2fp7: Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS v3.1: 5.4
CVE-2006-1228: Session fixation vulnerability in Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8 allows remote attackers to gain privileges by tricking a user to click on a URL that fixes the session identifier.
CVSS v2.0: 5.1
GHSA-9j4g-mpf6-p3hh: Improper authentication in Smart Switch prior to version 3.7.69.15 allows remote attackers to bypass authentication.
CVSS v4.0: 7.1
CVSS v3.1: 9.8
CVE-2026-49218: ImageMagick: Policy Bypass in DCM decoder could result in image with invalid dimensions
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, a missing check in the DCM decoder could result in an image with invalid dimensions and that could cause crashes in other operation. This issue has been patched in versions 6.9.13-48 and 7.1.2-24.
CVSS v3.1: 7.5
CVE-2024-32990: Permission verification vulnerability in the system sharing pop-up module
Impact: Successful exploitation of this vulnerability will affect availability.
CVSS v3.1: 6.1
CVE-2025-22681: WordPress Content Cloner plugin <= 1.0.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Xfinitysoft Content Cloner super-seo-content-cloner allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Content Cloner: from n/a through <= 1.0.1.
CVSS v3.1: 4.3
CVE-2026-27289: Photoshop Desktop | Out-of-bounds Read (CWE-125)
Photoshop Desktop versions 27.4 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 7.8
CVE-2022-2401: Team members could access sensitive information of other users via an API call
Unrestricted information disclosure of all users in Mattermost version 6.7.0 and earlier allows team members to access some sensitive information by directly accessing the APIs.
CVSS v3.1: 6.5
CVE-2022-39141: A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.161), Simcenter Femap V2022.1 (All versions < V2022.1.3), Simcenter Femap V2022.2 (All versions < V2022.2.2). The affected application is vulnerable to out of bounds read past the end of an allocated buffer when parsing X_T files. An attacker could leverage this vulnerability to leak information in the context of the current process. (ZDI-CAN-17296)
CVSS v3.1: 7.8
cisco-sa-cssm-sqi-h5fDvZWp: Cisco Smart Software Manager Satellite SQL Injection Vulnerability
A vulnerability in the web-based management interface of Cisco Smart Software Manager Satellite could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system.

The vulnerability exists because the web-based management interface improperly validates values within SQL queries. An attacker could exploit this vulnerability by authenticating to the application and sending malicious SQL queries to an affected system. A successful exploit could allow the attacker to modify values on or return values from the underlying database or the operating system.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cssm-sqi-h5fDvZWp ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cssm-sqi-h5fDvZWp"]
CVSS v3.0: 6.8
CVE-2023-28620: WordPress Cyberus Key Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Cyberus Labs Cyberus Key plugin <= 1.0 versions.
CVSS v3.1: 5.9
CVE-2022-40258: Weak password hashes for Redfish & API
AMI Megarac Weak password hashes for
Redfish & API
CVSS v3.1: 5.3
CVE-2022-41436: An issue in OXHOO TP50 OXH1.50 allows unauthenticated attackers to access the administrative panel via browsing to the URL http://device_ip/index1.html.
CVSS v3.1: 9.1
CVE-2023-48745: WordPress Captcha Code plugin <= 2.9 - Captcha Bypass vulnerability
Improper Restriction of Excessive Authentication Attempts vulnerability in WebFactory Ltd Captcha Code allows Functionality Bypass.This issue affects Captcha Code: from n/a through 2.9.
CVSS v3.1: 5.3
GHSA-2h2g-hg5x-83g2: A cleartext storage of sensitive information vulnerability [CWE-312] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.2, FortiMail 7.4.0 through 7.4.4, FortiMail 7.2.0 through 7.2.7, FortiMail 7.0.0 through 7.0.8, FortiRecorder 7.2.0 through 7.2.3, FortiRecorder 7.0 all versions, FortiRecorder 6.4 all versions, FortiVoice 7.2.0, FortiVoice 7.0.0 through 7.0.6 may allow an authenticated malicious administrator to obtain user's secrets via CLI commands. Practical exploitability is limited by conditions out of the control of the attacker: An admin must log in to the targeted device.
CVSS v3.1: 4
CVE-2025-21122: Photoshop Desktop | Integer Underflow (Wrap or Wraparound) (CWE-191)
Photoshop Desktop versions 25.12, 26.1 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 7.8
GHSA-j5g3-6543-2hjc: The HVMOP_pagetable_dying hypercall in Xen 4.0, 4.1, and 4.2 does not properly check the pagetable state when running on shadow pagetables, which allows a local HVM guest OS to cause a denial of service (hypervisor crash) via unspecified vectors.
GHSA-cpgg-gfx5-33r2: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Crestron Automate VX allows Functionality Misuse.There is no visible indication when the system is recording and recording can be enabled remotely via a network API. 
This issue affects Automate VX: from 5.6.8161.21536 through 6.4.0.49.
CVSS v4.0: 5.3
CVE-2024-51775: Apache Zeppelin: Command Injection via CSWSH
Missing Origin Validation in WebSockets vulnerability in Apache Zeppelin.

The attacker could access the Zeppelin server from another origin without any restriction, and get internal information about paragraphs. 
This issue affects Apache Zeppelin: from 0.11.1 before 0.12.0.

Users are recommended to upgrade to version 0.12.0, which fixes the issue.
CVSS v3.1: 7.5
GHSA-wr3c-hrxx-6gqh: The Remote Client and change management integrations in IBM Rational ClearCase 7.1.x, 8.0.0.x before 8.0.0.18, and 8.0.1.x before 8.0.1.11 do not properly validate hostnames in X.509 certificates from SSL servers, which allows remote attackers to spoof servers and obtain sensitive information or modify network traffic via a crafted certificate. IBM X-Force ID: 106715.
CVSS v3.0: 7.4
CVE-2021-0531: In memory management driver, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-185195272
CVSS v3.1: 7.8
CVSS v2.0: 4.6
CVE-2002-2369: Perception LiteServe 2.0 allows remote attackers to read password protected files via a leading "/./" in a URL.
CVSS v2.0: 5
RHSA-2025:18098: Red Hat Security Advisory: kernel-rt security update
kernel: firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails kernel: usb: dwc3: gadget: check that event count does not exceed event buffer length kernel: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too kernel: net_sched: ets: Fix double list add in class with netem as child qdisc kernel: i40e: fix MMIO write access to an invalid page in i40e_clear_hw kernel: do_change_type(): refuse to operate on unmounted/not ours mounts kernel: smb: client: fix use-after-free in cifs_oplock_break
CVSS v3.1: 7
CVE-2017-6745: A vulnerability in the cache server within Cisco Videoscape Distribution Suite (VDS) for Television 3.2(5)ES1 could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on a targeted appliance. The vulnerability is due to excessive mapped connections exhausting the allotted resources within the system. An attacker could exploit this vulnerability by sending large amounts of inbound traffic to a device with the intention of overloading certain resources. A successful exploit could cause the device to reload, resulting in a DoS condition. Cisco Bug IDs: CSCvc39260.
CVSS v3.0: 7.5
CVSS v2.0: 7.8
GHSA-pg9g-gj66-h46r: WRH-733GBK and WRH-733GWH contain an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in the telnet function. If a remote unauthenticated attacker sends a specially crafted request to the affected product, an arbitrary OS command may be executed.
CVSS v4.0: 9.3
CVSS v3.0: 9.8
RHSA-2016:2749: Red Hat Security Advisory: rh-mysql56-mysql security update
mysql: unspecified vulnerability in subcomponent: Server: Optimizer (CPU October 2016) mysql: unspecified vulnerability in subcomponent: Server: InnoDB (CPU October 2016) mysql: race condition while setting stats during MyISAM table repair (CPU Oct 2016) mysql: insecure error log file handling in mysqld_safe (CPU Oct 2016) mysql: unspecified vulnerability in subcomponent: Server: GIS (CPU October 2016) mysql: unspecified vulnerability in subcomponent: Server: Federated (CPU October 2016) mysql: general_log can write to configuration files, leading to privilege escalation (CPU Oct 2016) mysql: race condition while setting stats during MyISAM table repair (CPU Oct 2016) mysql: insecure error log file handling in mysqld_safe (CPU Oct 2016) mysql: unspecified vulnerability in subcomponent: Server: Types (CPU October 2016)
CVSS v3.0: 4.3
GHSA-245h-h68p-v4jq: crmeb_java v1.3.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the mergeList method in class com.zbkj.front.pub.ImageMergeController.
CVSS v3.1: 5.3
CVE-2016-8484: An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-28823575.
CVSS v3.0: 9.8
CVSS v2.0: 10
CVE-2026-52918: Bluetooth: serialize accept_q access
In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: serialize accept_q access

bt_sock_poll() walks the accept queue without synchronization, while
child teardown can unlink the same socket and drop its last reference.
The unsynchronized accept queue walk has existed since the initial
Bluetooth import.

Protect accept_q with a dedicated lock for queue updates and polling.
Also rework bt_accept_dequeue() to take temporary child references under
the queue lock before dropping it and locking the child socket.
CVSS v3.1: 8.8
GHSA-wq85-8jmh-r875: Adobe Reader and Acrobat 8.x before 8.3, 9.x before 9.4.5, and 10.x before 10.1 on Windows and Mac OS X allow attackers to cause a denial of service (memory corruption) via unspecified vectors.
CVE-2026-7641: Import and export users and customers <= 2.0.8 - Authenticated (Subscriber+) Privilege Escalation via Multisite Capability Meta Fields
The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 2.0.8 via the `save_extra_user_profile_fields()` function. This is due to an incomplete blocklist that correctly restricts capability meta keys for the primary site (e.g., `wp_capabilities`, `wp_user_level`) but fails to block the equivalent meta keys for any other subsite in a WordPress Multisite network (e.g., `wp_2_capabilities`, `wp_2_user_level`), allowing these keys to pass the `in_array()` check and be written directly to user meta via `update_user_meta()`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to escalate their privileges to Administrator on any subsite within the Multisite network by submitting a crafted profile update to `/wp-admin/profile.php`. Exploitation requires that an administrator has previously imported a CSV file containing multisite-prefixed capability column headers and has enabled the 'Show fields in profile?' option, which causes those keys to be stored in the `acui_columns` option and exposed as editable fields on the user profile page.
CVSS v3.1: 8.8
CVE-2012-0425: LanItems.ycp in save_y2logs in yast2-network before 2.24.4 in SUSE YaST writes cleartext Wi-Fi credentials to the y2log log file, which allows context-dependent attackers to obtain sensitive information by reading the (1) WIRELESS_WPA_PASSWORD or (2) WIRELESS_CLIENT_KEY_PASSWORD field.
CVSS v2.0: 7.8
CVE-2018-2445: AdminTools in SAP BusinessObjects Business Intelligence, versions 4.1, 4.2, allows an attacker to manipulate the vulnerable application to send crafted requests on behalf of the application, resulting in a Server-Side Request Forgery (SSRF) vulnerability.
CVSS v3.0: 9.6
CVSS v2.0: 5.5
GHSA-9wpf-67qh-4ww2: The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widget's custom_id in all versions up to, and including, 3.20.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
GHSA-475m-mm7r-j479: In the Linux kernel, the following vulnerability has been resolved:usb: potential integer overflow in usbg_make_tpg()The variable tpgt in usbg_make_tpg() is defined as unsigned long and is
assigned to tpgt->tport_tpgt, which is defined as u16. This may cause an
integer overflow when tpgt is greater than USHRT_MAX (65535). I
haven't tried to trigger it myself, but it is possible to trigger it
by calling usbg_make_tpg() with a large value for tpgt.I modified the type of tpgt to match tpgt->tport_tpgt and adjusted the
relevant code accordingly.This patch is similar to commit 59c816c1f24d ("vhost/scsi: potential
memory corruption").
GHSA-mh84-747x-6j6c: The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pm_decline_join_group_request and pm_approve_join_group_request functions in all versions up to, and including, 5.9.4.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to approve or decline join group requests which is normally should be available to administrators only.
CVSS v3.1: 4.3
CVE-2025-69425: Ruckus vRIoT IoT Controller < 3.0.0.0 Hardcoded Tokens RCE
The Ruckus vRIoT IoT Controller firmware versions prior to 3.0.0.0 (GA) expose a command execution service on TCP port 2004 running with root privileges. Authentication to this service relies on a hardcoded Time-based One-Time Password (TOTP) secret and an embedded static token. An attacker who extracts these credentials from the appliance or a compromised device can generate valid authentication tokens and execute arbitrary OS commands with root privileges, resulting in complete system compromise.
CVSS v4.0: 10
RHSA-2011:1197: Red Hat Security Advisory: libvirt security and bug fix update
libvirt: integer overflow in VirDomainGetVcpus
GHSA-6pwg-gg6j-5crm: Ignite Realtime Openfire privilege escalation vulnerability
An issue in Ignite Realtime Openfire v.4.8.0 and before allows a remote attacker to escalate privileges via the ROOM_CACHE component.
GHSA-8p9r-f949-699g: Path Traversal in browserless-chrome
This affects all versions of browserless-chrome before 1.43.0. User input flowing from the workspace endpoint gets used to create a file path filePath and this is fetched and then sent back to a user. This can be escaped to fetch arbitrary files from a server.
CVSS v3.1: 7.5
GHSA-3rm8-fj97-4hq7: The ptsname function in FreeBSD 6.0 through 7.0-PRERELEASE does not properly verify that a certain portion of a device name is associated with a pty of a user who is calling the pt_chown function, which might allow local users to read data from the pty from another user.
CVE-2024-42224: net: dsa: mv88e6xxx: Correct check for empty list
In the Linux kernel, the following vulnerability has been resolved:

net: dsa: mv88e6xxx: Correct check for empty list

Since commit a3c53be55c95 ("net: dsa: mv88e6xxx: Support multiple MDIO
busses") mv88e6xxx_default_mdio_bus() has checked that the
return value of list_first_entry() is non-NULL.

This appears to be intended to guard against the list chip->mdios being
empty.  However, it is not the correct check as the implementation of
list_first_entry is not designed to return NULL for empty lists.

Instead, use list_first_entry_or_null() which does return NULL if the
list is empty.

Flagged by Smatch.
Compile tested only.
CVSS v3.1: 6.1
GHSA-q5m4-m8x7-8pj5: A vulnerability classified as critical was found in SourceCodeHero Clothes Recommendation System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/home.php. The manipulation of the argument view/view1 leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 5.1
CVSS v3.1: 4.7
GHSA-w27h-rqjh-6c8p: Directory traversal vulnerability in the file upload CGI of Gast Arbeiter 1.3 allows remote attackers to write arbitrary files via a .. (dot dot) in the req_file parameter.
CVE-2012-0806: Buffer overflow in Bip 0.8.8 and earlier might allow remote authenticated users to execute arbitrary code via vectors involving a series of TCP connections that triggers use of many open file descriptors.
CVSS v2.0: 6.5
CVE-2025-11069: westboy CicadasCMS Add Department save cross site scripting
A vulnerability was determined in westboy CicadasCMS 1.0. Affected by this issue is some unknown functionality of the file /system/org/save of the component Add Department Handler. This manipulation of the argument Name causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
CVSS v4.0: 4.8
CVSS v3.1: 2.4
CVSS v3.0: 2.4
CVSS v2.0: 3.3
ICSA-17-045-01: Advantech WebAccess
The DLL hijacking vulnerability has been identified, which may allow an attacker to run a malicious DLL file within the search path resulting in execution of arbitrary code.CVE-2017-5175 has been assigned to this vulnerability. A CVSS v3 base score of 7.1 has been assigned; the CVSS vector string is (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H).
CVSS v3.0: 7.1
RHSA-2025:13493: Red Hat Security Advisory: RHOAI 2.22.1 - Red Hat OpenShift AI
ray: Ray Dashboard Command Injection ray: Ray Job Submission Arbitrary Code Execution
CVSS v3.1: 9.8
CVE-2025-53108: HomeBox Missing User Authorization
HomeBox is a home inventory and organization system. Prior to 0.20.1, HomeBox contains a missing authorization check in the API endpoints responsible for updating and deleting inventory item attachments. This flaw allows authenticated users to perform unauthorized actions on inventory item attachments that they do not own. This issue could lead to unauthorized data manipulation or loss of critical inventory data. This issue has been patched in version 0.20.1. There are no workarounds, users must upgrade.
CVSS v4.0: 5.3
CVE-2001-0222: webmin 0.84 and earlier allows local users to overwrite and create arbitrary files via a symlink attack.
CVSS v2.0: 1.2
GHSA-8xww-j655-r7f4: Unspecified vulnerability in the Integrated Lights Out Manager (ILOM) component in Oracle Sun Systems Products Suite ILOM before 3.2.4 allows remote authenticated users to affect confidentiality via unknown vectors related to Backup Restore.
GHSA-2gc6-xpq3-f7gm: A potential vulnerability in the SMI callback function used in the NVME driver in some Lenovo Desktop, ThinkStation, and ThinkEdge models may allow an attacker with local access and elevated privileges to execute arbitrary code.
CVSS v3.1: 6.7