ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-9p9q-h6h7-37g9: The mod_proxy_ajp module in the Apache HTTP Server 2.2.12 through 2.2.21 places a worker node into an error state upon detection of a long request-processing time, which allows remote attackers to cause a denial of service (worker consumption) via an expensive request.
GHSA-45p5-v273-3qqr: Vert.x-Web vulnerable to Stored Cross-site Scripting in directory listings via file names
DescriptionIn the `StaticHandlerImpl#sendDirectoryListing(...)` method under the `text/html` branch, file and directory names are directly embedded into the `href`, `title`, and link text without proper HTML escaping.As a result, in environments where an attacker can control file names, injecting HTML/JavaScript is possible. Simply accessing the directory listing page will trigger an XSS.Affected Code:File: `vertx-web/src/main/java/io/vertx/ext/web/handler/impl/StaticHandlerImpl.java`Lines:709–713: `normalizedDir` is constructed without escaping714–731: `<li><a ...>` elements insert file names directly into attributes and body without escaping744: parent directory name construction746–751: `{directory}`, `{parent}`, and `{files}` are inserted into the HTML template without escapingReproduction StepsPrerequisites:Directory listing is enabled using `StaticHandler`  
(e.g., `StaticHandler.create("public").setDirectoryListing(true)`)The attacker has the ability to create arbitrary file names under a public directory (e.g., via upload functionality or a shared directory)Create a malicious file name (example for Unix-based OS):Create an empty file in `public/` with one of the following names:`<img src=x onerror=alert('XSS')>.txt`Or attribute injection: `evil" onmouseover="alert('XSS')".txt`Example:Start the server (example):Routing: `router.route("/public/*").handler(StaticHandler.create("public").setDirectoryListing(true));`Server: `vertx.createHttpServer().requestHandler(router).listen(8890);`Verification request (raw HTTP):Example response excerpt:When accessing `/public/` in a browser, the unescaped file name is interpreted as HTML, and event handlers such as `onerror` are executed.Potential Impact**Stored XSS**Arbitrary JavaScript executes in the browser context of users viewing the listing pagePossible consequences:Theft of session tokens, JWTs, localStorage contents, or CSRF tokensUnauthorized actions with admin privileges (user creation, permission changes, settings modifications)Watering hole attacks, including malware distribution or malicious script injection to other pages**Common Conditions That Make Exploitation Easier**Uploaded files are served directly under a publicly accessible directoryShared/synced directories (e.g., NFS, SMB, WebDAV, or cloud sync) are exposedZIP/TAR archives are extracted directly under the webroot and directory listing is enabled in production environmentsSimilar CVEs Previously ReportedCVE‑2024‑32966CVE‑2019‑15603
CVSS v4.0: 2.3
CVSS v3.1: 4.9
CVE-2024-50287: media: v4l2-tpg: prevent the risk of a division by zero
In the Linux kernel, the following vulnerability has been resolved:

media: v4l2-tpg: prevent the risk of a division by zero

As reported by Coverity, the logic at tpg_precalculate_line()
blindly rescales the buffer even when scaled_witdh is equal to
zero. If this ever happens, this will cause a division by zero.

Instead, add a WARN_ON_ONCE() to trigger such cases and return
without doing any precalculation.
CVSS v3.1: 5.5
GHSA-wr5r-wwgf-3hv8: ** DISPUTED ** An issue was discovered in SMA Solar Technology products. By sniffing for specific packets on the localhost, plaintext passwords can be obtained as they are typed into Sunny Explorer by the user. These passwords can then be used to compromise the overall device. NOTE: the vendor reports that exploitation likelihood is low because these packets are usually sent only once during installation. Also, only Sunny Boy TLST-21 and TL-21 and Sunny Tripower TL-10 and TL-30 could potentially be affected.
CVSS v3.0: 9.8
CVE-2024-1814: Spectra – WordPress Gutenberg Blocks <= 2.12.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial Block
The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Testimonial block in all versions up to, and including, 2.12.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
GHSA-wv34-m534-j822: Missing Authorization vulnerability in SoftLab Integrate Google Drive.This issue affects Integrate Google Drive: from n/a through 1.3.3.
CVSS v3.1: 5.4
CVE-2022-38121: POWERCOM CO., LTD. UPSMON PRO - Insufficiently Protected Credentials
UPSMON PRO configuration file stores user password in plaintext under public user directory. A remote attacker with general user privilege can access all users‘ and administrators' account names and passwords via this unprotected configuration file.
CVSS v3.1: 6.5
CVE-2026-7387: Mattermost group syncable endpoints allow privilege escalation via scheme_admin
Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 Mattermost fails to require role-management authorization when setting the scheme_admin flag on group syncable link and patch endpoints, which allows a user with group-link permissions to escalate themselves and group members to team or channel admin via crafted API requests.. Mattermost Advisory ID: MMSA-2026-00665
CVSS v3.1: 8.8
CVE-2024-39757: A stack-based buffer overflow vulnerability exists in the wireless.cgi AddMac() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVSS v3.1: 9.1
CVE-2026-41254: Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication.
CVSS v3.1: 4
CVE-2022-43196: dedecmdv6 v6.1.9 is vulnerable to Arbitrary file deletion via file_manage_control.php.
CVSS v3.1: 9.1
CVE-2016-0298: Directory traversal vulnerability in IBM Security Guardium Database Activity Monitor 10 before 10.0p100 allows remote authenticated users to read arbitrary files via a crafted URL.
CVSS v3.0: 6.5
CVSS v2.0: 4
GHSA-5w25-5hhf-992c: In the Activity Manager service, there is a possible information disclosure due to a confused deputy. This could lead to local disclosure of current foreground process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-115384617
GHSA-2hh7-f3x9-8mgq: An insecure direct object reference in webmail in totemo totemomail 7.0.0 allows an authenticated remote user to read and modify mail folder names of other users via enumeration.
GHSA-4683-qx8f-q55q: A vulnerability was determined in SGAI Space1 NAS N1211DS up to 1.0.915. Impacted is the function RENAME_FILE/OPERATE_FILE/NGNIX_UPLOAD of the file /cgi-bin/JSONAPI of the component gsaiagent. This manipulation causes command injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 2.1
CVSS v3.1: 6.3
GHSA-vgwc-m3fq-wv9x: TOTOLINK CP450 v4.1.0cu.747_B20191224 was discovered to contain a stack buffer overflow vulnerability in the setIpPortFilterRules function.
CVSS v3.1: 9.8
GHSA-gq8r-vgwp-9335: In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem function creates a command execution vulnerability.
CVSS v3.1: 9.8
CVE-2025-39800: btrfs: abort transaction on unexpected eb generation at btrfs_copy_root()
In the Linux kernel, the following vulnerability has been resolved:

btrfs: abort transaction on unexpected eb generation at btrfs_copy_root()

If we find an unexpected generation for the extent buffer we are cloning
at btrfs_copy_root(), we just WARN_ON() and don't error out and abort the
transaction, meaning we allow to persist metadata with an unexpected
generation. Instead of warning only, abort the transaction and return
-EUCLEAN.
CVSS v3.1: 5.5
GHSA-m97f-x4mr-4x3q: Moodle vulnerable to Cross-Site Request Forgery
Multiple cross-site request forgery (CSRF) vulnerabilities in Moodle 2.0.x before 2.0.2 allow remote attackers to hijack the authentication of arbitrary users for requests that mark the completion of (1) an activity or (2) a course.
CVSS v4.0: 6.6
GHSA-7m5q-w7p8-x8h4: An integer overflow and buffer overflow issues were found in the ACPI Error Record Serialization Table (ERST) device of QEMU in the read_erst_record() and write_erst_record() functions. Both issues may allow the guest to overrun the host buffer allocated for the ERST memory device. A malicious guest could use these flaws to crash the QEMU process on the host.
CVSS v3.1: 6.5
GHSA-xh9q-jvq8-p253: In showNextSecurityScreenOrFinish of KeyguardSecurityContainerController.java, there is a possible way to access the lock screen during device setup due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1: 7.8
GHSA-h8p2-8g72-qpgh: Apache Airflow Google Provider Improper Input Validation vulnerability
Improper Input Validation vulnerability in the Apache Airflow Google Provider. This issue affects Apache Airflow Google Provider versions before 8.10.0.
CVSS v3.1: 7.5
GHSA-4pr7-5493-phmj: Microsoft Outlook 2010 SP2, 2013 SP1, 2013 RT SP1, and 2016 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
CVSS v3.0: 7.8
CVE-2015-7018: FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6976, CVE-2015-6977, CVE-2015-6978, CVE-2015-6990, CVE-2015-6991, CVE-2015-6993, CVE-2015-7008, CVE-2015-7009, and CVE-2015-7010.
CVSS v2.0: 6.8
RHSA-2005:839: Red Hat Security Advisory: lynx security update
lynx arbitrary command execution
GHSA-jc82-7f3j-vfhx: Soda PDF Desktop XLS File Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Soda PDF Desktop. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the handling of XLS files. The issue results from allowing the execution of dangerous script without user warning. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27495.
CVSS v3.0: 7.8
GHSA-m78f-9p7v-48h9: In setErrorPlaybackState of BluetoothMediaBrowserService.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-156009462
CVE-2024-11289: Soledad <= 8.5.9 - Unauthenticated Limited Local File Inclusion
The Soledad theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 8.5.9 via several functions like penci_archive_more_post_ajax_func, penci_more_post_ajax_func, and penci_more_featured_post_ajax_func. This makes it possible for unauthenticated attackers to include and execute PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP files can be uploaded and included. The exploitability of this is limited to Windows.
CVSS v3.1: 8.1
GHSA-pwx7-84p4-42qc: In the Linux kernel, the following vulnerability has been resolved:vsock/virtio: fix potential underflow in virtio_transport_get_credit()The credit calculation in virtio_transport_get_credit() uses unsigned
arithmetic:ret = vvs->peer_buf_alloc - (vvs->tx_cnt - vvs->peer_fwd_cnt);If the peer shrinks its advertised buffer (peer_buf_alloc) while bytes
are in flight, the subtraction can underflow and produce a large
positive value, potentially allowing more data to be queued than the
peer can handle.Reuse virtio_transport_has_space() which already handles this case and
add a comment to make it clear why we are doing that.[Stefano: use virtio_transport_has_space() instead of duplicating the code]
[Stefano: tweak the commit message]
CVSS v3.1: 5.5
CVE-2025-5885: Konica Minolta bizhub cross-site request forgery
A vulnerability has been found in Konica Minolta bizhub up to 20250202 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 5.3
CVSS v3.1: 4.3
CVSS v3.0: 4.3
CVSS v2.0: 5
CVE-1999-0322: The open() function in FreeBSD allows local attackers to write to arbitrary files.
CVSS v2.0: 2.1
CVE-2024-38246: Win32k Elevation of Privilege Vulnerability
Win32k Elevation of Privilege Vulnerability
CVSS v3.1: 7
CVE-2023-27954: The issue was addressed by removing origin information. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, iOS 15.7.4 and iPadOS 15.7.4, tvOS 16.4, watchOS 9.4. A website may be able to track sensitive user information.
CVSS v3.1: 6.5
CVE-2020-11591: An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request and obtain the full application path along with the customer name.
CVSS v3.1: 5.3
CVSS v2.0: 5
CVE-2023-43636: Rootfs Not Protected



In EVE OS, the “measured boot” mechanism prevents a compromised device from accessing
the encrypted data located in the vault.

As per the “measured boot” design, the PCR values calculated at different stages of the boot
process will change if any of their respective parts are changed.

This includes, among other things, the configuration of the bios, grub, the kernel cmdline,
initrd, and more.

However, this mechanism does not validate the entire rootfs, so an attacker can edit the
filesystem and gain control over the system.

As the default filesystem used by EVE OS is squashfs, this is somewhat harder than an ext4,
which is easily changeable.

This will not stop an attacker, as an attacker can repackage the squashfs with their changes
in it and replace the partition altogether.

This can also be done directly on the device, as the “003-storage-init” container contains the
“mksquashfs” and “unsquashfs” binaries (with the corresponding libs).







An attacker can gain full control over the device without changing the PCR values, thus not
triggering the “measured boot” mechanism, and having full access to the vault.



Note:

This issue was partially fixed in these commits (after disclosure to Zededa), where the config
partition measurement was added to PCR13:

• aa3501d6c57206ced222c33aea15a9169d629141

• 5fef4d92e75838cc78010edaed5247dfbdae1889.

This issue was made viable in version 9.0.0 when the calculation was moved to PCR14 but it was not included in the measured boot.
CVSS v3.1: 8.8
CVE-2026-3325: SQL injection in MegaCMS by CRM Sistemas de Fidelización
SQL injection (SQLi) in MegaCMS v12.0.0, specifically in the “id_territorio” parameter of the “/web_comunications/cms/get_provincias” endpoint. The vulnerability arises from inadequate validation and sanitisation of user input. Specifically, via a POST request, the “id_territorio” parameter, used immediately after the registration form is submitted, could be manipulated by an unauthenticated attacker to execute arbitrary SQL queries.
CVSS v4.0: 10
RHSA-2022:1162: Red Hat Security Advisory: OpenShift Container Platform 4.10.8 bug fix and security update
ovn-kubernetes: Ingress network policy can be overruled by egress network policy on another pod
CVSS v3.1: 8.2
GHSA-248v-wwj6-r5j3: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ehabstar User Role allows Reflected XSS. This issue affects User Role: from n/a through 1.0.
CVSS v3.1: 7.1
CVE-2020-0696: A security feature bypass vulnerability exists in Microsoft Outlook software when it improperly handles the parsing of URI formats, aka 'Microsoft Outlook Security Feature Bypass Vulnerability'.
CVSS v3.1: 6.5
CVSS v2.0: 4.3
CVE-2025-40555: A vulnerability has been identified in APOGEE PXC+TALON TC Series (BACnet) (All versions). Affected devices start sending unsolicited BACnet broadcast messages after processing a specific BACnet createObject request. This could allow an attacker residing in the same BACnet network to send a specially crafted message that results in a partial denial of service condition of the targeted device, and potentially reduce the availability of BACnet network. A power cycle is required to restore the device's normal operation.
CVSS v4.0: 5.3
CVSS v3.1: 4.7
GHSA-wq5x-gxqv-3rgf: A vulnerability in Central Web Authentication (CWA) with FlexConnect Access Points (APs) for Cisco Aironet 1560, 1810, 1810w, 1815, 1830, 1850, 2800, and 3800 Series APs could allow an authenticated, adjacent attacker to bypass a configured FlexConnect access control list (ACL). The vulnerability is due to the AP ignoring the ACL download from the client during authentication. An attacker could exploit this vulnerability by connecting to the targeted device with a vulnerable configuration. A successful exploit could allow the attacker to bypass a configured client FlexConnect ACL. This vulnerability affects the following Cisco products if they are running a vulnerable release of Central Web Authentication with FlexConnect Access Points Software: Aironet 1560 Series Access Points, Aironet 1810 Series OfficeExtend Access Points, Aironet 1810w Series Access Points, Aironet 1815 Series Access Points, Aironet 1830 Series Access Points, Aironet 1850 Series Access Points, Aironet 2800 Series Access Points, Aironet 3800 Series Access Points. Note: Central Web Authentication with FlexConnect Access Points was an unsupported configuration until 8.5.100.0. Cisco Bug IDs: CSCve17756.
CVSS v3.0: 4.1
CVE-2010-3189: The extSetOwner function in the UfProxyBrowserCtrl ActiveX control (UfPBCtrl.dll) in Trend Micro Internet Security Pro 2010 allows remote attackers to execute arbitrary code via an invalid address that is dereferenced as a pointer.
CVSS v2.0: 9.3
GHSA-hpj4-57qp-2v2m: Buffer overflow occurs in trusted applications due to lack of length check of parameters in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CVE-2024-21912: Rockwell Automation Arena Simulation vulnerable to out of bounds write

An arbitrary code execution vulnerability in Rockwell Automation Arena Simulation could let a malicious user insert unauthorized code into the software. This is done by writing beyond the designated memory area, which causes an access violation. Once inside, the threat actor can run harmful code on the system. This affects the confidentiality, integrity, and availability of the product. To trigger this, the user would unwittingly need to open a malicious file shared by the threat actor.


CVSS v3.1: 7.8
GHSA-8wwh-ch83-69x8: A flaw has been found in yanyutao0402 ChanCMS up to 3.3.1. Affected by this issue is some unknown functionality of the file /cms/article/search. This manipulation of the argument keyword causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used.
CVSS v4.0: 2.1
CVSS v3.1: 6.3
CVE-2022-38512: The Translation module in Liferay Portal v7.4.3.12 through v7.4.3.36, and Liferay DXP 7.4 update 8 through 36 does not check permissions before allowing a user to export a web content for translation, allowing attackers to download a web content page's XLIFF translation file via crafted URL.
CVSS v3.1: 6.5
GHSA-8j53-m3j2-jcrr: The Software Development Kit (SDK) and Run Time Environment (RTE) 1.4.1 and 1.4.2 for Tru64 UNIX allows remote attackers to cause a denial of service (Java Virtual Machine hang) via object deserialization.
GHSA-884w-698f-927f: Arbitrary File Write via Archive Extraction in unzipper
Versions of `unzipper` before 0.8.13 are vulnerable to arbitrary file write when used to extract a specifically crafted archive that contains path traversal filenames (`../../file.txt` for example).RecommendationUpdate to version 0.3.18 or later.
CVSS v3.0: 5.5
GHSA-p4w7-mhw7-7vgx: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in BestWebSoft Car Rental by BestWebSoft plugin <= 1.1.2 versions.
CVSS v3.1: 4.8
CVE-2026-43041: net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak
In the Linux kernel, the following vulnerability has been resolved:

net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak

__radix_tree_create() allocates and links intermediate nodes into the
tree one by one. If a subsequent allocation fails, the already-linked
nodes remain in the tree with no corresponding leaf entry. These orphaned
internal nodes are never reclaimed because radix_tree_for_each_slot()
only visits slots containing leaf values.

The radix_tree API is deprecated in favor of xarray. As suggested by
Matthew Wilcox, migrate qrtr_tx_flow from radix_tree to xarray instead
of fixing the radix_tree itself [1]. xarray properly handles cleanup of
internal nodes — xa_destroy() frees all internal xarray nodes when the
qrtr_node is released, preventing the leak.

[1] https://lore.kernel.org/all/20260225071623.41275-1-jiayuan.chen@linux.dev/T/
CVSS v3.1: 5.5
GHSA-8q59-68wh-w68x: An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. There is a heap-based buffer over-read in _bfd_doprnt in bfd.c because elf_object_p in elfcode.h mishandles an e_shstrndx section of type SHT_GROUP by omitting a trailing '\0' character.
CVSS v3.1: 5.5
GHSA-jcmf-mmvx-3hgc: Multiple reflected Cross-Site Scripting (XSS) vulnerabilities in damasac thaipalliative_lte through version 3.0 allow remote attackers to inject arbitrary web script or HTML via the idFormMain parameter (line 24), the id parameter (lines 25, 75), and the ptid_key parameter (lines 26, 42) in /substudy/ezform.php. User input is echoed into HTML attributes and JavaScript contexts without encoding.
CVSS v3.1: 6.1
GHSA-x7cf-6gp3-q5f8: Duplicate Advisory: MCP Streamable HTTP redirects could forward configured custom headers to another origin
Duplicate AdvisoryThis advisory has been withdrawn because it is a duplicate of GHSA-rjxq-qqhf-8hwh. This link is maintained to preserve external references.Original DescriptionOpenClaw before 2026.5.12 contains an information disclosure vulnerability in streamable-http MCP servers that forwards operator-configured custom headers during cross-origin redirects. Attackers controlling or compromising an MCP endpoint can redirect requests to exfiltrate sensitive headers like API keys or tenant-routing credentials to attacker-controlled origins.
CVSS v4.0: 6
CVSS v3.1: 7.1
CVE-2020-29556: The Backup functionality in Grav CMS through 1.7.0-rc.17 allows an authenticated attacker to read arbitrary local files on the underlying server by exploiting a path-traversal technique. (This vulnerability can also be exploited by an unauthenticated attacker due to a lack of CSRF protection.)
CVSS v3.1: 5.5
CVSS v2.0: 2.1
GHSA-4xf7-rh96-6ff2: Buffer overflow in the Intel Graphics Driver in Apple OS X before 10.10.4 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-3695, CVE-2015-3696, CVE-2015-3697, CVE-2015-3698, CVE-2015-3699, CVE-2015-3701, and CVE-2015-3702.