ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-gvx8-q9hp-2vcv: Buffer overflow in pamtofits of NetPBM 10.30 through 10.33 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code when assembling the header, possibly related to an off-by-one error.
GHSA-ghjj-x456-6m6f: Due to missing authorization checks in the SAP S/4HANA OData Service (Manage Technical Object Structures), an attacker could update and delete child entities via exposed OData services without proper authorization. This vulnerability results in a low impact on integrity, while confidentiality and availability are not impacted.
CVSS v3.1: 4.3
GHSA-pf8f-3pq9-mrv7: A flaw was found in grub2 where the grub_extcmd_dispatcher() function calls grub_arg_list_alloc() to allocate memory for the grub's argument list. However, it fails to check in case the memory allocation fails. Once the allocation fails, a NULL point will be processed by the parse_option() function, leading grub to crash or, in some rare scenarios, corrupt the IVT data.
CVSS v3.1: 5.2
CVE-2021-28322: Diagnostics Hub Standard Collector Service Elevation of Privilege Vulnerability
Diagnostics Hub Standard Collector Service Elevation of Privilege Vulnerability
CVSS v3.1: 7.8
GHSA-3w5p-vghj-6qj4: Kofax Power PDF GIF File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of GIF files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20488.
CVSS v3.0: 7.8
CVE-2024-51608: WordPress AmaDiscount Plugin plugin <= 1.0 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in colinph970 AmaDiscount amadiscount allows SQL Injection.This issue affects AmaDiscount: from n/a through <= 1.0.
CVSS v3.1: 8.5
CVE-2021-30004: In wpa_supplicant and hostapd 2.9, forging attacks may occur because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c.
CVSS v3.1: 5.3
CVSS v2.0: 5
CVE-2023-41192: D-Link DAP-1325 HNAP SetAPLanSettings PrimaryDNS Command Injection Remote Code Execution Vulnerability
D-Link DAP-1325 HNAP SetAPLanSettings PrimaryDNS Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of a request parameter provided to the HNAP1 SOAP endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-18812.
CVSS v3.0: 8.8
CVE-2023-49007: In Netgear Orbi RBR750 firmware before V7.2.6.21, there is a stack-based buffer overflow in /usr/sbin/httpd.
CVSS v3.1: 9.8
GHSA-g3r8-4wh4-cpp2: NULL Pointer Dereference in Conda vim prior to 8.2.
CVSS v3.1: 5.5
GHSA-qx2w-wx28-8mhv: Incorrect implementation in authentication protocol in M-Files Client before 22.5.11356.0 allows high privileged user to get other users tokens to another resource.
CVSS v3.1: 4.9
GHSA-6h9h-22rh-cwhj: The WP Js List Pages Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' shortcode attribute in all versions up to, and including, 1.21 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
GHSA-xm86-62fx-w5xf: server.cpp in Monopd 0.9.3 allows remote attackers to cause a denial of service (CPU and memory consumption) via a string containing a large number of characters that are escaped when Monopd produces XML output.
GHSA-5356-67pr-8ffv: Windows Runtime Remote Code Execution Vulnerability
CVSS v3.1: 7
GHSA-4xv5-h636-p47w: Multiple OS Command Injection vulnerabilities affecting Kasda KW6512 router software version KW6512_Linux_V1.0 enable an authenticated remote attacker to execute arbitrary OS commands via Quick Setup and Internet page parameters passed to internet.cgi.
CVSS v3.1: 9.1
GHSA-mjqr-4hcp-7rrh: An issue found in Yandex Navigator v.6.60 for Android allows unauthorized apps to cause escalation of privilege attacks by manipulating the SharedPreference files.
CVSS v3.1: 7.8
GHSA-3q7v-j28r-j6hx: A vulnerability was determined in code-projects Content Management System 1.0. This impacts an unknown function of the file search.php. This manipulation of the argument Value causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
CVSS v4.0: 5.5
CVSS v3.1: 7.3
CVE-2020-29503: Dell EMC PowerStore versions prior to 1.0.3.0.5.xxx contain a file permission Vulnerability. A locally authenticated attacker could potentially exploit this vulnerability, leading to the information disclosure of certain system directory.
CVSS v3.1: 4.1
GHSA-fr87-vfpx-7mj9: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Video Gallery plugin <= 1.0.10 versions.
CVSS v3.1: 7.1
CVE-2008-5489: SQL injection vulnerability in channel_detail.php in ClipShare Pro 4, and 2006 through 2007, allows remote attackers to execute arbitrary SQL commands via the chid parameter.
CVSS v2.0: 7.5
CVE-2026-5998: zhayujie chatgpt-on-wechat CowAgent API Memory Content Endpoint service.py dispatch path traversal
A flaw has been found in zhayujie chatgpt-on-wechat CowAgent up to 2.0.4. This affects the function dispatch of the file agent/memory/service.py of the component API Memory Content Endpoint. This manipulation of the argument filename causes path traversal. The attack can be initiated remotely. The exploit has been published and may be used. Upgrading to version 2.0.5 mitigates this issue. Patch name: 174ee0cafc9e8e9d97a23c305418251485b8aa89. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
CVSS v4.0: 6.9
CVSS v3.1: 5.3
CVSS v3.0: 5.3
CVSS v2.0: 5
GHSA-69jw-68vm-vprw: A stored cross-site scripting (Stored XSS) vulnerability in file preview in WeKan before 6.75 allows remote authenticated users to inject arbitrary web script or HTML via names of file attachments. Any user can obtain the privilege to rename within their own board (where they have BoardAdmin access), and renameAttachment does not block XSS payloads.
CVSS v3.1: 5.4
GHSA-g982-9r8g-6qxw: Ciborg gem for Ruby allows local users to write files and gain privileges via Symlink
There is a /tmp file race condition in `chef/travis-cookbooks/ci_environment/perlbrew/recipes/default.rb` in the ciborg gem 3.0.0 when creating `/tmp/perlbrew-installer`. If a malicious local user creates the file first they can overwrite the contents with their own code executing it as the ciborg process owner.
CVSS v3.0: 5.5
GHSA-7p9f-6x8j-gxxp: CRI-O: Maliciously structured checkpoint file can gain arbitrary node access
ImpactPatches1.31.1, 1.30.6, 1.29.8Workaroundsset `enable_criu_support = false`References_Are there any links users can visit to find out more?_
CVSS v4.0: 6.9
CVSS v3.1: 7.4
GHSA-qqh8-49g9-w933: Opera before 11.65 does not ensure that the address field corresponds to the displayed web page during blocked navigation, which makes it easier for remote attackers to conduct spoofing attacks by detecting and preventing attempts to load a different web page.
CVE-2026-23678: Binardat 10G08-0800GSM Network Switch Traceroute CLI Command Injection
Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior contain a command injection vulnerability in the traceroute diagnostic function of the affected device web management interface. By injecting the %1a character into the hostname parameter, an authenticated attacker with access to the web interface can execute arbitrary CLI commands on the device.
CVSS v4.0: 8.7
CVSS v3.1: 8.8
GHSA-8vch-5qw4-g554: Cross-Site Request Forgery (CSRF) vulnerability in Suresh Kumar wp-login customizer allows Stored XSS.This issue affects wp-login customizer: from n/a through 1.0.
CVSS v3.1: 7.1
CVE-2019-18936: UniValue::read() in UniValue before 1.0.5 allow attackers to cause a denial of service (the class internal data reaches an inconsistent state) via input data that triggers an error.
CVSS v3.1: 7.5
CVSS v2.0: 5
CVE-2011-3810: TinyWebGallery (TWG) 1.8.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by i_frames/i_register.php.
CVSS v2.0: 5
GHSA-98rv-gpf2-fj42: In the Linux kernel, the following vulnerability has been resolved:mshv: Fix create memory region overlap checkThe current check is incorrect; it only checks if the beginning or end
of a region is within an existing region. This doesn't account for
userspace specifying a region that begins before and ends after an
existing region.Change the logic to a range intersection check against gfns and uaddrs
for each region.Remove mshv_partition_region_by_uaddr() as it is no longer used.
CVE-2021-25233: An improper access control vulnerability in Trend Micro Apex One (on-prem and SaaS), OfficeScan XG SP1, and Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to obtain information about a specific configuration download file.
CVSS v3.1: 5.3
CVSS v2.0: 5
CVE-2019-13325: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.909. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of EPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8922.
CVSS v3.0: 7.8
CVE-2020-27900: An issue existed in the handling of snapshots. The issue was resolved with improved permissions logic. This issue is fixed in macOS Big Sur 11.0.1. A malicious application may be able to preview files it does not have access to.
CVSS v3.1: 5.5
CVSS v2.0: 4.3
GHSA-rm94-php9-pvrq: Google Chrome before 13.0.782.215 allows remote attackers to bypass the Same Origin Policy via vectors related to empty origins.
GHSA-mjqh-7v2m-9p6m: libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 22935234.
GHSA-mpqr-5j8f-hhp9: WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
CVE-2006-5892: SQL injection vulnerability in MoreInfo.asp in The Net Guys ASPired2Poll 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS v2.0: 7.5
CVE-2005-2785: cosmoshop 8.10.78 and earlier stores passwords in plaintext in the database, which allows local users to obtain sensitive information.
CVSS v2.0: 2.1
CVE-2023-45173: IBM AIX denial of service
IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the NFS kernel extension to cause a denial of service.  IBM X-Force ID:  267971.
CVSS v3.1: 6.2
ICSA-21-357-02: Johnson Controls exacq Enterprise Manager
An attacker could enter malicious data into the affected product, causing remote code execution.CVE-2021-44228 has been assigned to this vulnerability. A CVSS v3 base score of 10.0 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
CVSS v3.0: 10
CVE-2010-1844: Unspecified vulnerability in Image Capture in Apple Mac OS X 10.6.x before 10.6.5 allows remote attackers to cause a denial of service (memory consumption and system crash) via a crafted image.
CVSS v2.0: 7.1
PYSEC-2021-77: An issue was discovered in management/commands/hyperkitty_import.py in HyperKitty through 1.3.4. When importing a private mailing list's archives, these archives are publicly visible for the duration of the import. For example, sensitive information might be available on the web for an hour during a large migration from Mailman 2 to Mailman 3.
GHSA-2rm7-j397-3fqg: AVideo: Missing Authorization in Playlist Schedule Creation Allows Cross-User Broadcast Hijacking
SummaryThe `plugin/PlayLists/View/Playlists_schedules/add.json.php` endpoint allows any authenticated user with streaming permission to create or modify broadcast schedules targeting any playlist on the platform, regardless of ownership. When the schedule executes, the rebroadcast runs under the victim playlist owner's identity, allowing content hijacking and stream disruption.DetailsThe endpoint at `plugin/PlayLists/View/Playlists_schedules/add.json.php` performs only a capability check, not an ownership check:The `Playlists_schedules::save()` method (line 182) only validates that `playlists_id` is non-empty — no ownership check:When the schedule triggers via `plugin/PlayLists/run.php`, the rebroadcast executes under the **playlist owner's** user ID, not the schedule creator's:By contrast, all other playlist modification endpoints properly verify ownership via `PlayLists::canManagePlaylist()`:This check is used in `saveShowOnTV.json.php:43`, `playListToSerie.php:24`, and `getPlaylistButtons.php:34`, but is entirely absent from `add.json.php`.Additionally, the `delete.json.php` endpoint requires `User::isAdmin()` (line 11), making the disparity with `add.json.php` even clearer.When providing an existing schedule `id` via POST (line 18), no ownership check is performed on the existing schedule record either, allowing modification of any schedule on the platform.PoCImpact**Content hijacking:** Attacker can force-broadcast content from any user's playlist, including private or paid content**Stream disruption:** Scheduled rebroadcast can interfere with a victim's ongoing live streams**Identity abuse:** Rebroadcast executes under the victim's user identity, making it appear the victim initiated the broadcast**Resource consumption:** Scheduled broadcasts consume the victim's server bandwidth allocation**Schedule tampering:** Existing schedules can be modified or redirected by any streaming userRecommended FixAdd ownership validation in `add.json.php` before saving:
CVSS v3.1: 6.3
CVE-2015-6633: The display drivers in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23987307.
CVSS v2.0: 9.3
CVE-2006-6965: CRLF injection vulnerability in lib/exe/fetch.php in DokuWiki 2006-03-09e, and possibly earlier, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the media parameter.  NOTE: this issue can be leveraged for XSS attacks.
CVSS v2.0: 4.3
CVE-2019-19001: eSOMS X-FrameOption
For ABB eSOMS versions 4.0 to 6.0.2, the X-Frame-Options header is not configured in HTTP response. This can potentially allow 'ClickJacking' attacks where an attacker can frame parts of the application on a malicious web site, revealing sensitive user information such as authentication credentials.
CVSS v3.1: 6.5
CVE-2025-59299: File Parsing Out-Of-Bounds Write Vulnerability in DIAScreen
Delta Electronics DIAScreen lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process.
CVSS v4.0: 6.8
GHSA-xh25-q4c4-w86w: In sg_remove_scat of scsi/sg.c, there is a possible memory corruption due to
    an unusual root cause. This could lead to local escalation of privilege with
    System execution privileges needed. User interaction is not needed for
    exploitation.
CVSS v4.0: 10
CVSS v3.1: 6.7
CVE-2026-10256: itsourcecode Content Management System save_comment.php sql injection
A vulnerability was identified in itsourcecode Content Management System 1.0. This vulnerability affects unknown code of the file /save_comment.php. The manipulation of the argument Name leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
RHSA-2016:1392: Red Hat Security Advisory: thunderbird security update
Mozilla: Miscellaneous memory safety hazards (rv:45.2) (MFSA 2016-49)
CVE-2014-7193: The Crumb plugin before 3.0.0 for Node.js does not properly restrict token access in situations where a hapi route handler has CORS enabled, which allows remote attackers to obtain sensitive information, and potentially obtain the ability to spoof requests to non-CORS routes, via a crafted web site that is visited by an application consumer.
CVSS v2.0: 5.8
CVE-2025-20614: External control of file name or path for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (low) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
CVSS v4.0: 5.6
CVSS v3.1: 6.7
GHSA-78w9-7xq3-h66c: An issue was discovered in mcp-neo4j 0.3.0 allowing attackers to gain sensitive information or execute arbitrary commands via the SSE service.
CVSS v3.1: 7.5
GHSA-fg7x-g82r-94qc: Ruby Time component ReDoS issue
A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.
CVSS v3.1: 7.5
GHSA-qj47-r3gf-wx2h: Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to execute code over a network.
CVSS v3.1: 8
GHSA-xc3w-wqx5-qrf9: The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Controls in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Office 2003 Web Components SP3; SQL Server 2000 SP4, 2005 SP4, and 2008 SP2, SP3, and R2; BizTalk Server 2002 SP1; Commerce Server 2002 SP4, 2007 SP2, and 2009 Gold and R2; Visual FoxPro 8.0 SP1 and 9.0 SP2; and Visual Basic 6.0 Runtime allow remote attackers to execute arbitrary code via a crafted (a) web site, (b) Office document, or (c) .rtf file that triggers "system state" corruption, as exploited in the wild in April 2012, aka "MSCOMCTL.OCX RCE Vulnerability."
CVSS v3.1: 8.8
RHSA-2020:1513: Red Hat Security Advisory: git security update
git: Crafted URL containing new lines can cause credential leak
CVSS v3.1: 7.5
CVE-2025-58050: PCRE2: heap-buffer-overflow read in match_ref due to missing boundary restoration in SCS
The PCRE2 library is a set of C functions that implement regular expression pattern matching. In version 10.45, a heap-buffer-overflow read vulnerability exists in the PCRE2 regular expression matching engine, specifically within the handling of the (*scs:...) (Scan SubString) verb when combined with (*ACCEPT) in src/pcre2_match.c. This vulnerability may potentially lead to information disclosure if the out-of-bounds data read during the memcmp affects the final match result in a way observable by the attacker. This issue has been resolved in version 10.46.
CVSS v4.0: 6.9
CVE-2009-4384: Multiple cross-site scripting (XSS) vulnerabilities in Scriptsez.net Ez Poll Hoster (EPH) allow remote attackers to inject arbitrary web script or HTML via the (1) pid parameter in a code action to index.php and the (2) uid parameter in a view action to profile.php.
CVSS v2.0: 4.3
PYSEC-2019-234: In TensorFlow before 1.15, a heap buffer overflow in UnsortedSegmentSum can be produced when the Index template argument is int32. In this case data_size and num_segments fields are truncated from int64 to int32 and can produce negative numbers, resulting in accessing out of bounds heap memory. This is unlikely to be exploitable and was detected and fixed internally in TensorFlow 1.15 and 2.0.
CVE-2023-22384: Buffer Copy Without Checking Size of Input in VR Service
Memory Corruption in VR Service while sending data using Fast Message Queue (FMQ).
CVSS v3.1: 6.7
CVE-2026-39864: Kamailio Auth: Processing Vulnerability For Additional Authenticated User Identity Checks
Kamailio is an open source implementation of a SIP Signaling Server. Prior to 6.0.5 and 5.8.7, an out-of-bounds read in the auth module of Kamailio (formerly OpenSER and SER) allows remote attackers to cause a denial of service (process crash) via a specially crafted SIP packet if a successful user authentication without a database backend is followed by additional user identity checks. This vulnerability is fixed in 6.0.5 and 5.8.7.
CVSS v3.1: 4.4
GHSA-rm2m-chmf-gp2r: Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16 allow man-in-the-middle attackers to spoof the address bar by operating a proxy server that provides a 407 HTTP status code accompanied by web script, as demonstrated by a phishing attack on an HTTPS site.
GHSA-r397-ff8c-wv2g: aiomysql allows arbitrary access to client files through vulnerability of a malicious MySQL server
SummaryThe client-side settings are not checked before sending local files to MySQL server, which allows obtaining arbitrary files from the client using a rogue server.DetailsIt is possible to create a rogue MySQL server that emulates authorization, ignores client flags and requests arbitrary files from the client by sending a LOAD_LOCAL instruction packet. Related to CVE-2019-2503.PoCFirst, start up a rogue MySQL server that ignores client-side flags and sends LOAD_LOCAL packet to the client – tested with https://github.com/rmb122/rogue_mysql_serverCreate a file to be stolen by the rogue server: `echo "gotcha" > /tmp/my_secret_file.txt`Clone the repo: `git clone git@github.com:rmb122/rogue_mysql_server.git && cd rogue_mysql_server`Build the server: `make rogue_mysql_server`Generate a sample config: `rogue_mysql_server -generate`In `config.yaml` change `file_list` to `["/tmp/my_secret_file.txt"]`Run the server: `./rogue_mysql_server -config config.yaml`Next, the vulnerability can be seen in action with the following script, which can be run in a second terminal:The rogue server will output log messages indicating successful file read and save the contents in the `loot/` directoryImpactThis vulnerability impacts products and environments that require connection to untrusted MySQL servers or allow the possibility for them to be compromised.Fix suggestionCan be fixed by porting relevant changes from PyMySQL – https://github.com/PyMySQL/PyMySQL/commit/b5e17cee46e0706dbfd707cdd2024452f0fb3267
CVSS v4.0: 8.2