ansulev/circl-vulnerability-scores huggingface dataset:
RHSA-2019:4110: Red Hat Security Advisory: java-1.7.1-ibm security update
OpenJDK: Missing restrictions on use of custom SocketImpl (Networking, 8218573) OpenJDK: NULL pointer dereference in DrawGlyphList (2D, 8222690) OpenJDK: Unexpected exception thrown by Pattern processing crafted regular expression (Concurrency, 8222684) OpenJDK: Unexpected exception thrown by XPathParser processing crafted XPath expression (JAXP, 8223505) OpenJDK: Incorrect handling of nested jar: URLs in Jar URL handler (Networking, 8223892) OpenJDK: Unexpected exception thrown by XPath processing crafted XPath expression (JAXP, 8224532) OpenJDK: Unexpected exception thrown during Font object deserialization (Serialization, 8224915) OpenJDK: Integer overflow in bounds check in SunGraphics2D (2D, 8225292) OpenJDK: Incorrect handling of HTTP proxy responses in HttpURLConnection (Networking, 8225298) OpenJDK: Excessive memory allocation in CMap when reading TrueType font (2D, 8225597) OpenJDK: Insufficient filtering of HTML event attributes in Javadoc (Javadoc, 8226765)
CVSS v3.0: 4.7
CVE-2026-49843: FreeSWITCH: Pre-authentication session eviction via attacker-chosen `sessid` in `mod_verto`
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, mod_verto's JSON-RPC handler bound the connection to the client-supplied sessid on the first frame, before the authentication gate. Binding inserts the connection into the global session hash and, on a key collision, drops the prior occupant of that slot — sending it a verto.punt, detaching its calls, and closing its socket. An unauthenticated network attacker who knows a target session UUID could therefore evict the legitimate client. This issue has been patched in version 1.11.1.
CVSS v3.1: 5.3
GHSA-mg7q-m2xr-9g59: Cross-Site Request Forgery (CSRF) vulnerability in John Weissberg Print Science Designer allows Stored XSS. This issue affects Print Science Designer: from n/a through 1.3.155.
CVSS v3.1: 7.1
GHSA-qhpr-qc52-3wv3: The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 does not include the HTTPOnly flag in a Set-Cookie header for a cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, as demonstrated by cookies used by help.php and certain other files.
CVE-2006-0280: Unspecified vulnerability in Oracle PeopleSoft Enterprise Portal 8.4 Bundle 15, 8.8 Bundle 10, and 8.9 Bundle 2 has unspecified impact and attack vectors, as identified by Oracle Vuln# PSE01.
CVSS v2.0: 10
CVE-2022-35282: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to server-side request forgery (SSRF). By sending a specially crafted request, an attacker with local network access could exploit this vulnerability to obtain sensitive data.
CVSS v3.0: 4.3
GHSA-26f4-fvxg-f5mr: An XSS vulnerability in project list in OpenProject before 9.0.4 and 10.x before 10.0.2 allows remote attackers to inject arbitrary web script or HTML via the sortBy parameter because error messages are mishandled.
CVSS v3.1: 6.1
CVE-2026-32243: Discourse: Stored XSS in discourse-ai shared conversations onebox
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, an attacker with the ability to create shared AI conversations could inject arbitrary HTML and JavaScript via crafted conversation titles. This payload would execute in the browser of any user viewing the onebox preview, potentially allowing session hijacking or unauthorized actions on behalf of the victim. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.
CVSS v4.0: 5.3
GHSA-phhw-r78f-69qv: Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS v3.1: 5.4
CVE-2025-11072: Download Counter Button <= 1.8.6.7 - Unauthenticated Arbitrary File Download
The MelAbu WP Download Counter Button WordPress plugin through 1.8.6.7 does not validate the path of files to be downloaded, which could allow unauthenticated attacker to read/download arbitrary files.
CVSS v3.1: 5.3
CVE-2023-3346: Denial of Service (DoS) and Remote Code Execution Vulnerability in MITSUBISHI CNC Series
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in MITSUBSHI CNC Series allows a remote unauthenticated attacker to cause Denial of Service (DoS) condition and execute arbitrary code on the product by sending specially crafted packets. In addition, system reset is required for recovery.
CVSS v3.1: 9.8
CVE-2023-20125: Cisco BroadWorks Network Server TCP Denial of Service Vulnerability
A vulnerability in the local interface of Cisco BroadWorks Network Server could allow an unauthenticated, remote attacker to exhaust system resources, causing a denial of service (DoS) condition.

This vulnerability exists because rate limiting does not occur for certain incoming TCP connections. An attacker could exploit this vulnerability by sending a high rate of TCP connections to the server. A successful exploit could allow the attacker to cause TCP connection resources to grow rapidly until the Cisco BroadWorks Network Server becomes unusable.
Note: To recover from this vulnerability, either Cisco BroadWorks Network Server software must be restarted or the Cisco BroadWorks Network Server node must be rebooted. For more information, see the  section of this advisory.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
CVSS v3.1: 8.6
GHSA-p8c7-jh4h-q359: Microsoft Edge (Chromium-based) Tampering Vulnerability
CVSS v3.1: 4.2
GHSA-mw9q-g6cf-hfc4: Improper validation of array index in Power Management Firmware (PMFW) may allow a privileged attacker to cause an out-of-bounds memory read within PMFW, potentially leading to a denial of service.
CVSS v3.1: 2.3
CVE-2011-5307: Cross-site scripting (XSS) vulnerability in index.php in the PhotoSmash plugin 1.0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter.
CVSS v2.0: 4.3
GHSA-hrvr-7x5w-xpmq: CPython 3.9 and earlier doesn't disallow configuring an empty list ("[]") for SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vulnerability is of low severity due to NPN being not widely used and specifying an empty list likely being uncommon in-practice (typically a protocol name would be configured).
CVSS v3.1: 6.5
CVE-2021-35971: Veeam Backup and Replication 10 before 10.0.1.4854 P20210609 and 11 before 11.0.0.837 P20210507 mishandles deserialization during Microsoft .NET remoting.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
GHSA-5r22-m8q2-2p79: Allegra uploadFile Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.The specific flaw exists within the uploadFile method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of LOCAL SERVICE. Was ZDI-CAN-22510.
CVSS v3.0: 7.2
GHSA-6wcf-5xfc-f4pv: Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality via unknown vectors related to Load Testing for Web Apps, a different vulnerability than CVE-2016-0477 and CVE-2016-0478.  NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the DownloadServlet servlet, which allows remote attackers to read arbitrary files via directory traversal sequences in the reportName parameter.
GHSA-xr38-w74q-r8jv: Permissions not properly checked in Invenio-Drafts-Resources
ImpactInvenio-Drafts-Resources does not properly check permissions when a record is published. The vulnerability is exploitable in a default installation of InvenioRDM. An authenticated user is able via REST API calls to publish draft records of other users if they know the record identifier and the draft validates (e.g. all require fields filled out). An attacker is not able to modify the data in the record, and thus e.g. *cannot* change a record from restricted to public.DetailsThe service's ``publish()`` method contains the following permission check:However, the record should have been passed into the permission check so that the need generators have access to e.g. the record owner.The bug is activated in Invenio-RDM-Records which has a need generator called ``RecordOwners()``, which when no record is passed in defaults to allow any authenticated user:PatchesThe problem is patched in Invenio-Drafts-Resources v0.13.7 and 0.14.6+, which is part of InvenioRDM v6.0.1 and InvenioRDM v7.0 respectively.You can verify the version installed of Invenio-Drafts-Resources via PIP:References[Security policy](https://invenio.readthedocs.io/en/latest/community/security-policy.html)For more informationIf you have any questions or comments about this advisory:Chat with us on Discord: https://discord.gg/8qatqBC
CVSS v4.0: 5.1
CVSS v3.1: 6.4
GHSA-34fh-h7r7-h3wg: Certain third-party packages for CVSup 16.1h, such as SuSE Linux, contain untrusted paths in the ELF RPATH fields of certain executables, which could allow local users to execute arbitrary code by causing cvsup to link against malicious libraries that are created in world-writable directories such as /usr/src/packages.
GHSA-7c5g-6hjv-j6hp: A vulnerability was determined in Edimax BR-6675nD 1.12. Affected is the function stainfo of the file /goform/stainfo. This manipulation of the argument interface causes command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 2.1
CVSS v3.1: 6.3
CVE-2025-63051: WordPress REHub Framework plugin < 19.9.9.4 - Sensitive Data Exposure vulnerability
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in sizam REHub Framework rehub-framework allows Retrieve Embedded Sensitive Data.This issue affects REHub Framework: from n/a through < 19.9.9.4.
CVSS v3.1: 4.3
CVE-2023-4759: Improper handling of case insensitive filesystems in Eclipse JGit allows arbitrary file write
Arbitrary File Overwrite in Eclipse JGit <= 6.6.0

In Eclipse JGit, all versions <= 6.6.0.202305301015-r, a symbolic link present in a specially crafted git repository can be used to write a file to locations outside the working tree when this repository is cloned with JGit to a case-insensitive filesystem, or when a checkout from a clone of such a repository is performed on a case-insensitive filesystem.

This can happen on checkout (DirCacheCheckout), merge (ResolveMerger via its WorkingTreeUpdater), pull (PullCommand using merge), and when applying a patch (PatchApplier). This can be exploited for remote code execution (RCE), for instance if the file written outside the working tree is a git filter that gets executed on a subsequent git command.

The issue occurs only on case-insensitive filesystems, like the default filesystems on Windows and macOS. The user performing the clone or checkout must have the rights to create symbolic links for the problem to occur, and symbolic links must be enabled in the git configuration.

Setting git configuration option core.symlinks = false before checking out avoids the problem.

The issue was fixed in Eclipse JGit version 6.6.1.202309021850-r and 6.7.0.202309050840-r, available via  Maven Central https://repo1.maven.org/maven2/org/eclipse/jgit/  and  repo.eclipse.org https://repo.eclipse.org/content/repositories/jgit-releases/ . A backport is available in 5.13.3 starting from  5.13.3.202401111512-r.


The JGit maintainers would like to thank RyotaK for finding and reporting this issue.




CVSS v3.1: 8.8
GHSA-3m99-h3hp-w9j7: Moodle remote code execution via quiz questions
Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote authenticated users to execute arbitrary code via a calculated question in a quiz.
CVE-2017-11910: ChakraCore and Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11886, CVE-2017-11889, CVE-2017-11890, CVE-2017-11893, CVE-2017-11894, CVE-2017-11895, CVE-2017-11901, CVE-2017-11903, CVE-2017-11905, CVE-2017-11905, CVE-2017-11907, CVE-2017-11908, CVE-2017-11909, CVE-2017-11911, CVE-2017-11912, CVE-2017-11913, CVE-2017-11914, CVE-2017-11916, CVE-2017-11918, and CVE-2017-11930.
CVSS v3.0: 7.5
CVSS v2.0: 7.6
GHSA-jp8r-f23p-3228: PHPGurukul Complaint Management System 2.0 is vulnerable to SQL Injection via the subcategory and category parameters in subcategory.php.
CVSS v3.1: 6.5
GHSA-mfh5-4mhh-m8jh: Foris before 101.1.1, as used in Turris OS, lacks certain HTML escaping in the login template.
CVSS v3.1: 9.8
GHSA-7x5v-hwh5-w3m8: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pantherius Modal Survey.This issue affects Modal Survey: from n/a through 2.0.2.0.1.
CVSS v3.1: 9.3
GHSA-xj8q-rwwx-7r65: Libde265 v1.0.10 was discovered to contain a heap-buffer-overflow vulnerability in the derive_spatial_luma_vector_prediction function in motion.cc.
CVSS v3.1: 7.8
GHSA-hfr6-3rjr-jmhf: The Leagoo P1 device with a build fingerprint of sp7731c_1h10_32v4_bird:6.0/MRA58K/android.20170629.214736:user/release-keys contains a pre-installed platform app with a package name of com.wtk.factory (versionCode=1, versionName=1.0) that contains an exported broadcast receiver named com.wtk.factory.MMITestReceiver allows any app co-located on the device to programmatically initiate a factory reset. In addition, the app initiating the factory reset does not require any permissions. A factory reset will remove all user data and apps from the device. This will result in the loss of any data that have not been backed up or synced externally. The capability to perform a factory reset is not directly available to third-party apps (those that the user installs themselves with the exception of enabled Mobile Device Management (MDM) apps), although this capability can be obtained by leveraging an unprotected app component of a pre-installed platform app.
RHSA-2013:1451: Red Hat Security Advisory: java-1.7.0-openjdk security update
OpenJDK: java.util.TimeZone does not restrict setting of default time zone (Libraries, 8001029) OpenJDK: XML parsing Denial of Service (JAXP, 8017298) OpenJDK: insufficient html escaping in jhat (jhat, 8011081) OpenJDK: Inet6Address class IPv6 address processing errors (Libraries, 8015743) OpenJDK: image conversion out of bounds read (2D, 8014102) OpenJDK: key data leak via toString() methods (Libraries, 8011071) OpenJDK: Incorrect awt_getPixelByte/awt_getPixelShort/awt_setPixelByte/awt_setPixelShort image raster checks (2D, 8014093) OpenJDK: JTable not properly performing certain access checks (Swing, 8013744) OpenJDK: insufficient InterfaceImplementor security checks (Scripting, 8017299) OpenJDK: insufficient security checks (Beans, 8012071) OpenJDK: insufficient escaping of window title string (Javadoc, 8016675) OpenJDK: default keytab path information leak (JGSS, 8022931) OpenJDK: javax.xml.transform.TransformerFactory does not properly honor XMLConstants.FEATURE_SECURE_PROCESSING (JAXP, 8012425) OpenJDK: insufficient checks of KDC replies (JGSS, 8014341) OpenJDK: javac does not ignore certain ignorable characters (Javadoc, 8016653) OpenJDK: JPEGImageReader and JPEGImageWriter missing band size checks (2D, 8013510) OpenJDK: RMIConnection stub missing permission check (CORBA, 8011157) OpenJDK: VersionHelper12 does not honor modifyThreadGroup restriction (JNDI, 8013739) OpenJDK: insufficient security checks (JAXWS, 8017505) OpenJDK: com.sun.org.apache.xml.internal.security.utils.UnsyncByteArrayOutputStream Denial of Service (Security, 8021290) OpenJDK: XML parsing Denial of Service (JAXP, 8014530) OpenJDK: Java2d Disposer security bypass (2D, 8017287) OpenJDK: checkPackageAccess missing security check (Libraries, 8017291) OpenJDK: Vulnerability in Libraries component (Libraries, 7023639) OpenJDK: getDeclaringClass() information leak (Libraries, 8014349) OpenJDK: ObjectInputStream/ObjectOutputStream missing checks (Libraries, 8014987) OpenJDK: insufficient DataFlavor security checks (AWT, 8012277) OpenJDK: Missing CORBA security checks (Libraries, 8017196) OpenJDK: XML stream factory finder information leak (JAXP, 8013502)
PYSEC-2023-45: redis-py before 4.5.3, as used in ChatGPT and other products, leaves a connection open after canceling an async Redis command at an inopportune time (in the case of a pipeline operation), and can send response data to the client of an unrelated request in an off-by-one manner. The fixed versions for this CVE Record are 4.3.6, 4.4.3, and 4.5.3; however, CVE-2023-28859 is a separate vulnerability.
CVE-2015-5786: Apple QuickTime before 7.7.8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted file, a different vulnerability than CVE-2015-5785.
CVSS v2.0: 6.8
GHSA-6hmv-g545-7x8f: Live.me - live stream video chat, 3.7.20, 2017-11-06, Android application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key.
CVSS v3.1: 7.5
GHSA-g969-264w-g9pr: In Redmine before 3.4.11 and 4.0.x before 4.0.4, persistent XSS exists due to textile formatting errors.
GHSA-j8wr-fwf2-vvr9: Command Injection in create-choo-electron
All versions of the package create-choo-electron are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization.
CVSS v3.1: 9.8
GHSA-w52f-8m83-9j69: The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3206 and CVE-2016-3207.
CVSS v3.0: 7.5
GHSA-6rf6-j58x-xvx2: Smarthome 1.0.2.364 and earlier versions,HiAPP 7.3.0.303 and earlier versions,HwParentControl 2.0.0 and earlier versions,HwParentControlParent 5.1.0.12 and earlier versions,Crowdtest 1.5.3 and earlier versions,HiWallet 8.0.0.301 and earlier versions,Huawei Pay 8.0.0.300 and earlier versions,Skytone 8.1.2.300 and earlier versions,HwCloudDrive(EMUI6.0) 8.0.0.307 and earlier versions,HwPhoneFinder(EMUI6.0) 9.3.0.310 and earlier versions,HwPhoneFinder(EMUI5.1) 9.2.2.303 and earlier versions,HiCinema 8.0.2.300 and earlier versions,HuaweiWear 21.0.0.360 and earlier versions,HiHealthApp 3.0.3.300 and earlier versions have an information exposure vulnerability. Encryption keys are stored in the system. The attacker can implement reverse engineering to obtain the encryption keys, causing information exposure.
CVSS v3.1: 7.5
GHSA-2mmx-5mfh-2536: An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It mishandles IP-based rate limiting.
RHSA-2021:3496: Red Hat Security Advisory: firefox security update
Mozilla: Memory safety bugs fixed in Firefox 92, Firefox ESR 78.14 and Firefox ESR 91.1
CVSS v3.1: 8.8
GHSA-jqqj-j2ch-3qv8: Atmail v6.6.0 was discovered to contain a SQL injection vulnerability via the username parameter on the login page.
CVSS v3.1: 9.8
CVE-2022-39122: In sensor driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in kernel.
CVSS v3.1: 5.5
CVE-2024-55586: Nette Database through 3.2.4 allows SQL injection in certain situations involving an untrusted filter that is directly passed to the where method. NOTE: the vendor's position is that this is intended behavior.
CVSS v3.1: 9.8
CVE-2024-9498: Uncontrolled search path can lead to DLL hijacking in USBXpress SDK installer
DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress SDK

 



 installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
CVSS v3.1: 8.6
CVE-2013-6365: Horde Groupware Web mail 5.1.2 has CSRF with requests to change permissions
CVSS v3.1: 5.3
CVSS v2.0: 2.6
GHSA-xwh6-w3pq-2jj3: An Access of Uninitialized Pointer vulnerability in the SIP ALG of Juniper Networks Junos OS allows an unauthenticated network-based attacker to cause a Denial of Service (DoS). Continued receipt of these specific packets will cause a sustained Denial of Service condition. On all MX and SRX platforms, if the SIP ALG is enabled, an MS-MPC or MS-MIC, or SPC will crash if it receives a SIP message with a specific contact header format. This issue affects Juniper Networks Junos OS on MX Series and SRX Series: 20.4 versions prior to 20.4R3; 21.1 versions prior to 21.1R2-S1, 21.1R3; 21.2 versions prior to 21.2R2. This issue does not affect versions prior to 20.4R1.
CVSS v3.1: 7.5
CVE-2006-2217: SQL injection vulnerability in index.php in Invision Power Board allows remote attackers to execute arbitrary SQL commands via the pid parameter in a reputation action.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS v2.0: 7.5
GHSA-rxhf-h39p-vq9j: An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0986, CVE-2020-1237, CVE-2020-1246, CVE-2020-1262, CVE-2020-1266, CVE-2020-1269, CVE-2020-1273, CVE-2020-1274, CVE-2020-1275, CVE-2020-1276, CVE-2020-1307, CVE-2020-1316.
GHSA-h7p6-gcj3-4r6j: FreshDNS version 1.0.3 and prior contains a Cross Site Scripting (XSS) vulnerability in Account data form; Zone editor that can result in Execution of attacker's JavaScript code in victim's session. This attack appear to be exploitable via The attacker stores a specially crafted string as their Full Name in their account details. The victim (e.g. the administrator of the FreshDNS instance) opens the User List in the admin interface.. This vulnerability appears to have been fixed in 1.0.5 and later.
CVSS v3.0: 5.4
GHSA-935w-hgm5-gg86: Missing Authorization vulnerability in ollybach WPPizza allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WPPizza: from n/a through 3.19.8.
CVSS v3.1: 4.3
CVE-2025-0769: PixelYourSite 10.1.1.1 - Insecure deserialization
PixelYourSite - Your smart PIXEL (TAG) and API Manager 10.1.1.1 was found to be vulnerable. Unvalidated user input is used directly in an unserialize function in myapp/modules/facebook/facebook-server-a sync-task.php.
CVSS v4.0: 6.3
GHSA-4w6g-25w8-c8vc: ** DISPUTED ** SQL injection vulnerability in the 'reorder' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'name' parameter. NOTE: The vendor disputes this issue because the documentation states that this method is not intended for use with untrusted input.
CVSS v3.0: 8.1