ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-v2mp-f475-gq8j: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14016.
GHSA-4qcm-px3r-jfr8: Mattermost fails to unescape Markdown strings in a memory-efficient way, allowing an attacker to cause a Denial of Service by sending a message containing a large number of escaped characters.
CVSS v3.1: 4.3
GHSA-3q36-3ffw-mmf8: The Ajax Search Lite  WordPress plugin before 4.12.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS v3.1: 4.7
GHSA-gg32-cp5g-4m8x: An issue in Beijing Sogou Technology Development Co., Ltd Sogou Input iOS 12.2.0 allows attackers to access sensitive user information via supplying a crafted link.
CVSS v3.1: 6.5
CVE-2024-32846: An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
CVSS v3.0: 9.1
CVE-2012-3659: WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-09-12-1.
CVSS v2.0: 6.8
CVE-2025-0133: PAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in GlobalProtect Gateway and Portal
A reflected cross-site scripting (XSS) vulnerability in the GlobalProtect™ gateway and portal features of Palo Alto Networks PAN-OS® software enables execution of malicious JavaScript in the context of an authenticated Captive Portal user's browser when they click on a specially crafted link. The primary risk is phishing attacks that can lead to credential theft—particularly if you enabled Clientless VPN.

There is no availability impact to GlobalProtect features or GlobalProtect users. Attackers cannot use this vulnerability to tamper with or modify contents or configurations of the GlobalProtect portal or gateways. The integrity impact of this vulnerability is limited to enabling an attacker to create phishing and credential-stealing links that appear to be hosted on the GlobalProtect portal.



For GlobalProtect users with Clientless VPN enabled, there is a limited impact on confidentiality due to inherent risks of Clientless VPN that facilitate credential theft. You can read more about this risk in the informational bulletin  PAN-SA-2025-0005 https://security.paloaltonetworks.com/PAN-SA-2025-0005   https://security.paloaltonetworks.com/PAN-SA-2025-0005 . There is no impact to confidentiality for GlobalProtect users if you did not enable (or you disable) Clientless VPN.
CVSS v4.0: 2.7
CVE-2026-42468: Buffer overflow vulnerability in Open Vehicle Monitoring System 3 (OVMS3) 3.3.005. In canformat_pcap.cpp , the parser's phdr.len field is not properly validated, allowing remote attackers to cause a denial of service or possibly execute arbitrary code via crafted PCAP input.
CVSS v3.1: 8.8
PYSEC-2022-10: PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method.
CVE-2022-48509: Race condition vulnerability due to multi-thread access to mutually exclusive resources in Huawei Share. Successful exploitation of this vulnerability may cause the program to exit abnormally.
CVSS v3.1: 5.9
CVE-2022-0225: A flaw was found in Keycloak. This flaw allows a privileged attacker to use the malicious payload as the group name while creating a new group from the admin console, leading to a stored Cross-site scripting (XSS) attack.
CVSS v3.1: 5.4
CVE-2020-2710: Vulnerability in the Oracle Banking Payments product of Oracle Financial Services Applications (component: Core). Supported versions that are affected are 14.1.0-14.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Payments. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Banking Payments accessible data as well as unauthorized read access to a subset of Oracle Banking Payments accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
CVSS v3.0: 5.4
GHSA-mxhq-87fx-96v9: A vulnerability in Cisco CX Cloud Agent of could allow an authenticated, local attacker to elevate their privileges. This vulnerability is due to insecure file permissions. An attacker could exploit this vulnerability by calling the script with sudo. A successful exploit could allow the attacker to take complete control of the affected device.
CVSS v3.1: 6.7
GHSA-6m4q-5fp8-jrhp: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 49.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS v3.0: 9.8
ICSA-25-203-01: DuraComm DP-10iN-100-MU
The affected product is vulnerable to a cross-site scripting (XSS) attack. This could allow an attacker to prevent legitimate users from accessing the web interface. The affected product lacks access controls for a function that should require user authentication. This could allow an attacker to repeatedly reboot the device. The affected product transmits sensitive data without encryption over a channel that could be intercepted by attackers.
CVSS v3.1: 7.5
CVE-2023-45747: WordPress WP Lightbox 2 Plugin <= 3.0.6.5 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Syed Balkhi WP Lightbox 2 plugin <= 3.0.6.5 versions.
CVSS v3.1: 5.9
CVE-2025-27807: An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 9110, W920, W930, W1000, Modem 5123, Modem 5300, Modem 5400. The lack of a length check leads to out-of-bounds writes via malformed NAS packets.
CVSS v3.1: 9.1
GHSA-33rp-g78f-jw6r: The islist function in markdown.c in libmarkdown.a in DISCOUNT 2.2.3a allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted file, as demonstrated by mkd2html.
CVSS v3.0: 5.5
CVE-2022-25892: Denial of Service (DoS)
The package muhammara before 2.6.1, from 3.0.0 and before 3.1.1; all versions of package hummus are vulnerable to Denial of Service (DoS) when supplied with a maliciously crafted PDF file to be parsed.
CVSS v3.1: 7.5
GHSA-7m3f-x5vh-v652: In the RSS extension for MediaWiki through 1.38.1, when the $wgRSSAllowLinkTag config variable was set to true, and a new RSS feed was created with certain XSS payloads within its description tags and added to the $wgRSSUrlWhitelist config variable, stored XSS could occur via MediaWiki's template system whenever that feed was loaded via the rss document tag.
CVE-2020-29053: HRSALE 2.0.0 allows XSS via the admin/project/projects_calendar set_date parameter.
CVSS v3.1: 6.1
CVSS v2.0: 4.3
ICSA-23-045-01: Weintek EasyBuilder Pro cMT Series
The listed versions for Weintek EasyBuilder Pro are vulnerable to a ZipSlip attack caused by decompiling a malicious project file. This may allow an attacker to gain control of the user's computer or gain access to sensitive data.  CVE-2023-0104 has been assigned to this vulnerability. A CVSS v3 base score of 9.3 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:H).
CVSS v3.0: 9.3
ICSA-21-131-10: Siemens SCALANCE XM-400 and XR-500 Devices
The OSPF protocol implementation in affected devices incorrectly handles the number of LSA fields in combination with other modified fields.

An unauthenticated remote attacker could create a permanent denial-of-service condition by sending specially crafted OSPF packets. Successful exploitation requires OSPF to be enabled on an affected device.
CVSS v3.1: 7.5
CVE-2013-10004: Telecommunication Software SAMwin Contact Center Suite Password SAMwinLIBVB.dll passwordScramble improper authentication
A vulnerability classified as critical was found in Telecommunication Software SAMwin Contact Center Suite 5.1. This vulnerability affects the function passwordScramble in the library SAMwinLIBVB.dll of the component Password Handler. Incorrect implementation of a hashing function leads to predictable authentication possibilities. Upgrading to version 6.2 is able to address this issue. It is recommended to upgrade the affected component.
CVSS v3.1: 6.5
CVE-2016-1966: The nsNPObjWrapper::GetNewOrUsed function in dom/plugins/base/nsJSNPRuntime.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (invalid pointer dereference and memory corruption) via a crafted NPAPI plugin.
CVSS v3.0: 8.8
CVSS v2.0: 6.8
GHSA-6w5f-r2vm-m768: An issue was discovered in certain Apple products. macOS before 10.13.2 is affected. The issue involves the "Mail" component. It allows remote attackers to read cleartext e-mail content (for which S/MIME encryption was intended) by leveraging the lack of installation of an S/MIME certificate by the recipient.
CVSS v3.0: 7.5
GHSA-4367-36c5-2mx8: DedeCMS V5.7.99 was discovered to contain an arbitrary file upload vulnerability via the component /dede/file_manage_control.php.
CVSS v3.1: 7.2
GHSA-642p-r78x-7w9j: The Neeku Naaku Dash Dash (aka com.dakshaa.nndd) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2020-25117: The Admin CP in vBulletin 5.6.3 allows XSS via a Junior Member Title to User Title Manager.
CVSS v3.1: 4.8
CVSS v2.0: 3.5
GHSA-5hcr-g32p-h74c: Lavalite CMS Cross Site Scripting vulnerability
Cross Site Scripting vulnerability in Lavalite CMS v.10.1.0 allows attackers to execute arbitrary code and obtain sensitive information via a crafted payload to the URL.
CVSS v3.1: 6.1
RHSA-2021:0165: Red Hat Security Advisory: libpq security update
postgresql: Reconnection can downgrade connection security settings postgresql: psql's \gset allows overwriting specially treated variables
CVSS v3.1: 7.5
GHSA-mrvr-p347-36x4: SQL injection vulnerability in the Tasks plugin in Brim 2.0.0, when magic_quotes_gpc is disabled, allows remote authenticated users to execute arbitrary SQL commands via an arbitrary field in a search action to index.php.
GHSA-g6x4-57hp-j4xm: Authorization Bypass in Liferay Portal
An Insecure direct object reference (IDOR) vulnerability in the Dynamic Data Mapping module in Liferay Portal 7.3.2 through 7.4.3.4, and Liferay DXP 7.3 before update 4, and 7.4 GA allows remote authenticated users to view and access form entries via the `formInstanceRecordId` parameter.
CVSS v3.1: 4.3
RHSA-2016:0062: Red Hat Security Advisory: Red Hat JBoss Web Server 2.1.0 security update
expat: hash table collisions CPU usage DoS httpd: bypass of mod_headers rules via chunked requests httpd: HTTP request smuggling attack against chunked request parser
CVSS v3.0: 3.7
CVE-2005-1682: JavaMail API, as used by Solstice Internet Mail Server POP3 2.0, does not properly validate the message number in the MimeMessage constructor in javax.mail.internet.InternetHeaders, which allows remote authenticated users to read other users' e-mail messages by modifying the msgno parameter.  NOTE: Sun disputes this issue, stating "The report makes references to source code and files that do not exist in the mentioned products.
CVSS v2.0: 2.1
GHSA-r6g6-436h-6x63: A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. This issue affected versions prior to iOS 11.4.1, Safari 11.1.2.
CVSS v3.0: 7.5
CVE-2019-10716: An Information Disclosure issue in Verodin Director 3.5.3.1 and earlier reveals usernames and passwords of integrated security technologies via a /integrations.json JSON REST API request.
CVSS v3.1: 7.7
CVSS v2.0: 4
CVE-2009-3226: SQL injection vulnerability in index.php in AlmondSoft Almond Classifieds Ads Enterprise and Almond Affiliate Network Classifieds allows remote attackers to execute arbitrary SQL commands via the replid parameter in a manw_repl add_form action.  NOTE: some of these details are obtained from third party information.
CVSS v2.0: 7.5
GHSA-rwxw-454x-pcjq: An issue was discovered in Faronics Insight 10.0.19045 on Windows. An unauthenticated attacker is able to upload any type of file to any location on the Teacher Console's computer, enabling a variety of different exploitation paths including code execution. It is also possible for the attacker to chain this vulnerability with others to cause a deployed DLL file to immediately execute as NT AUTHORITY/SYSTEM.
CVSS v3.1: 8.8
GHSA-mwvx-wp54-2xv5: Exposure of resource to wrong sphere issue exists in WL-WN531AX2 firmware versions prior to 2023526, which may allow a network-adjacent attacker to use functions originally available after login without logging in.
CVSS v3.1: 8.1
GHSA-v4p3-mv8c-jvgx: DHCP Server Service Denial of Service Vulnerability
CVSS v3.1: 7.5
GHSA-6jp6-9rf9-gc66: Cross-site Scripting in Weblate
ImpactDue to improper neutralization, it was possible to perform cross-site scripting via crafted user and language names.PatchesThe issues were fixed in the 4.11 release. The following commits are addressing it:f6753a1a1c63fade6ad418fbda827c6750ab0bda9e19a8414337692cc90da2a91c9af5420f2952f122d577b1f1e88665a88b4569380148030e0f8389WorkaroundsYou can look for crafted user and language names to see if you were affected.Referenceshttps://hackerone.com/reports/1486674https://hackerone.com/reports/1486718https://hackerone.com/reports/1485226For more informationIf you have any questions or comments about this advisory:Open a topic in [discussions](https://github.com/WeblateOrg/weblate/discussions)Email us at [care@weblate.org](mailto:care@weblate.org)
CVSS v4.0: 5.1
CVSS v3.1: 5.4
CVE-2018-15586: Enigmail before 2.0.6 is prone to to OpenPGP signatures being spoofed for arbitrary messages using a PGP/INLINE signature wrapped within a specially crafted multipart HTML email.
CVSS v3.0: 6.5
CVSS v2.0: 4.3
CVE-2025-59559: WordPress Payrexx Payment Gateway for WooCommerce Plugin <= 3.1.5 - Broken Access Control Vulnerability
Missing Authorization vulnerability in payrexx Payrexx Payment Gateway for WooCommerce woo-payrexx-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payrexx Payment Gateway for WooCommerce: from n/a through <= 3.1.5.
CVSS v3.1: 4.3
GHSA-wqjj-hx84-v449: Django Vulnerable to MySQL Injection
The (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 do not properly perform type conversion, which allows remote attackers to have unspecified impact and vectors, related to "MySQL typecasting."
CVSS v4.0: 8.1
CVSS v3.1: 9.8
RHSA-2023:4171: Red Hat Security Advisory: java-17-openjdk security update
OpenJDK: HTTP client insufficient file name validation (8302475) OpenJDK: ZIP file parsing infinite loop (8302483) OpenJDK: weakness in AES implementation (8308682) OpenJDK: modulo operator array indexing issue (8304460) OpenJDK: array indexing integer overflow issue (8304468) OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312) harfbuzz: allows attackers to trigger O(n^2) growth via consecutive marks
CVSS v3.1: 7.5
CVE-2024-44730: Incorrect access control in the function handleDataChannelChat(dataMessage) of Mirotalk before commit c21d58 allows attackers to forge chat messages using an arbitrary sender name.
CVSS v3.1: 9.1
GHSA-4c2g-m3v7-xp4r: Insufficient input validation in HECI subsystem in Intel(R) CSME before version 11.21.55, Intel? Server Platform Services before version 4.0 and Intel? Trusted Execution Engine Firmware before version 3.1.55 may allow a privileged user to potentially enable escalation of privileges via local access.
CVSS v3.0: 6.7
GHSA-7gh6-9wwx-gf4f: An issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. There is an incorrect access vulnerability that allows an unauthorized user to view private group names.
CVSS v3.0: 4.3
CVE-2025-4138: Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory
Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata.


You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "data" or "tar". See the tarfile  extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter  for more information.

Note that for Python 3.14 or later the default value of filter= changed from "no filtering" to `"data", so if you are relying on this new default behavior then your usage is also affected.

Note that none of these vulnerabilities significantly affect the installation of source distributions which are tar archives as source distributions already allow arbitrary code execution during the build process. However when evaluating source distributions it's important to avoid installing source distributions with suspicious links.
CVSS v3.1: 7.5
CVE-2025-0123: PAN-OS: Information Disclosure Vulnerability in HTTP/2 Packet Captures
A vulnerability in the Palo Alto Networks PAN-OS® software enables unlicensed administrators to view clear-text data captured using the  packet capture feature https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/monitoring/take-packet-captures/take-a-custom-packet-capture  in decrypted HTTP/2 data streams traversing network interfaces on the firewall. HTTP/1.1 data streams are not impacted.

In normal conditions, decrypted packet captures are available to firewall administrators after they obtain and install a free Decryption Port Mirror license. The license requirement ensures that this feature can only be used after approved personnel purposefully activate the license. For more information, review how to  configure decryption port mirroring https://docs.paloaltonetworks.com/network-security/decryption/administration/monitoring-decryption/configure-decryption-port-mirroring .

The administrator must obtain network access to the management interface (web, SSH, console, or telnet) and successfully authenticate to exploit this issue. Risk of this issue can be greatly reduced by restricting access to the management interface to only trusted administrators and from only internal IP addresses according to our recommended  critical deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .

Customer firewall administrators do not have access to the packet capture feature in Cloud NGFW. This feature is available only to authorized Palo Alto Networks personnel permitted to perform troubleshooting.

Prisma® Access is not impacted by this vulnerability.
CVSS v4.0: 0
GHSA-wxvp-w945-h2rg: Memory corruption while calculating offset from partition start point.
CVSS v3.1: 6.8
GHSA-gc56-w3pr-7w7f: The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Cache Poisoning in all versions up to, and including, 9.0.48. This is due to the plugin not serving cached data from server-side responses and instead relying on user-input. This makes it possible for unauthenticated attackers to poison the cache location for location search results.
CVSS v3.1: 5.3
CVE-2024-8841: PDF-XChange Editor PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
PDF-XChange Editor PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24432.
CVSS v3.0: 3.3
GHSA-992f-wf4w-x36v: Prototype Pollution in merge-objects
All versions of `merge-objects` are vulnerable to Prototype Pollution.RecommendationNo fix is available for this vulnerability at this time. It is our recommendation to use an alternative package.
GHSA-96g7-g7g9-jxw8: happy-dom allows for server side code to be executed by a <script> tag
ImpactConsumers of the NPM package `happy-dom`PatchesThe security vulnerability has been patched in v15.10.2WorkaroundsNo easy workarounds to my knowledgeReferences[#1585](https://github.com/capricorn86/happy-dom/issues/1585)
CVSS v4.0: 9.3
GHSA-6qmp-qcvf-x3pr: In TigerVNC 1.7.1 (VNCSConnectionST.cxx VNCSConnectionST::fence), an authenticated client can cause a double free, leading to denial of service or potentially code execution.
CVSS v3.0: 8.8
CVE-2025-54131: Cursor bypasses its allow list to execute arbitrary commands
Cursor is a code editor built for programming with AI. In versions below 1.3, an attacker can bypass the allow list in auto-run mode with a backtick (`) or $(cmd). If a user has swapped Cursor from its default settings (requiring approval for every terminal call) to an allowlist, an attacker can execute arbitrary command execution outside of the allowlist without user approval. An attacker can trigger this vulnerability if chained with indirect prompt injection. This is fixed in version 1.3.
CVSS v3.1: 6.4
RHEA-2025:2421: Red Hat Enhancement Advisory: microcode_ctl bug fix and enhancement update
microcode_ctl: Improper input validation in UEFI firmware microcode_ctl: Improper input validation in UEFI firmware microcode_ctl: Improper input validation in XmlCli feature for UEFI firmware microcode_ctl: Improper input validation in UEFI firmware microcode_ctl: Improper input validation in UEFI firmware CseVariableStorageSmm
CVSS v3.1: 7.5
CVE-2024-56532: ALSA: us122l: Use snd_card_free_when_closed() at disconnection
In the Linux kernel, the following vulnerability has been resolved:

ALSA: us122l: Use snd_card_free_when_closed() at disconnection

The USB disconnect callback is supposed to be short and not too-long
waiting.  OTOH, the current code uses snd_card_free() at
disconnection, but this waits for the close of all used fds, hence it
can take long.  It eventually blocks the upper layer USB ioctls, which
may trigger a soft lockup.

An easy workaround is to replace snd_card_free() with
snd_card_free_when_closed().  This variant returns immediately while
the release of resources is done asynchronously by the card device
release at the last close.

The loop of us122l->mmap_count check is dropped as well.  The check is
useless for the asynchronous operation with *_when_closed().
CVSS v3.1: 5.5