ansulev/circl-vulnerability-scores huggingface dataset:
RHSA-2026:2043: Red Hat Security Advisory: firefox security update
firefox: Spoofing issue in the Downloads Panel component firefox: thunderbird: Mitigation bypass in the DOM: Security component firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics component firefox: thunderbird: Sandbox escape due to integer overflow in the Graphics component firefox: thunderbird: Use-after-free in the IPC component firefox: thunderbird: Information disclosure in the Networking component firefox: thunderbird: Use-after-free in the JavaScript Engine component firefox: thunderbird: Use-after-free in the JavaScript: GC component firefox: thunderbird: Incorrect boundary conditions in the Graphics component firefox: thunderbird: Clickjacking issue, information disclosure in the PDF Viewer component firefox: thunderbird: Spoofing issue in the DOM: Copy & Paste and Drag & Drop component firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147
CVSS v3.1: 7.5
GHSA-vmj7-5m4c-5xj8: The Wonder Video Embed WordPress plugin before 1.8 does not escape parameters of its wonderplugin_video shortcode, which could allow users with a role as low as Contributor to perform Stored XSS attacks.
GHSA-9vgx-7hmw-rvwq: Cross-site scripting (XSS) vulnerability in DevTrack 6.x allows remote attackers to inject arbitrary web script or HTML via the "Keyword search" form field and unspecified other form fields that populate a public saved query.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVE-2020-4089: HCL Notes is vulnerable to an information leakage vulnerability through its support for the 'mailto' protocol. This vulnerability could result in files from the user's filesystem or connected network filesystems being leaked to a third party. All versions of HCL Notes 9, 10 and 11 are affected.
CVSS v3.1: 6.5
CVSS v2.0: 4.3
CVE-2019-10126: A flaw was found in the Linux kernel. A heap based buffer overflow in mwifiex_uap_parse_tail_ies function in drivers/net/wireless/marvell/mwifiex/ie.c might lead to memory corruption and possibly other consequences.
CVSS v3.0: 5.9
CVE-2023-40014: OpenZeppelin Contracts's ERC2771Context with custom forwarder may lead to zero-valued _msgSender
OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 4.0.0 and prior to version 4.9.3, contracts using `ERC2771Context` along with a custom trusted forwarder may see `_msgSender` return `address(0)` in calls that originate from the forwarder with calldata shorter than 20 bytes. This combination of circumstances does not appear to be common, in particular it is not the case for `MinimalForwarder` from OpenZeppelin Contracts, or any deployed forwarder the team is aware of, given that the signer address is appended to all calls that originate from these forwarders. The problem has been patched in v4.9.3.

CVSS v3.1: 5.3
CVE-2019-9109: XSS exists in WUZHI CMS 4.1.0 via index.php?m=message&f=message&v=add&username=[XSS] to coreframe/app/message/message.php.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
GHSA-9r4m-f3wc-7hw5: The Bluetooth stack in Android before 2.3.6 allows a physically proximate attacker to obtain contact information via an AT phonebook transfer.
RHSA-2025:11102: Red Hat Security Advisory: fence-agents security update
setuptools: Path Traversal Vulnerability in setuptools PackageIndex
CVSS v3.1: 7.1
GHSA-mx3g-vxfx-q944: In JetBrains YouTrack before 2020.1.1331, an external user could execute commands against arbitrary issues.
CVE-2025-22344: WordPress Media Category Library plugin <= 2.7 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in timmcdaniels Media Category Library media-category-library allows Reflected XSS.This issue affects Media Category Library: from n/a through <= 2.7.
CVSS v3.1: 7.1
GHSA-h5cw-625j-3rxh: React Router has CSRF issue in Action/Server Action Request Processing
React Router (or Remix v2) is vulnerable to CSRF attacks on document POST requests to UI routes when using server-side route `action` handlers in [Framework Mode](https://reactrouter.com/start/modes#framework), or when using React Server Actions in the new unstable RSC modes.[!NOTE]
This does not impact your application if you are using [Declarative Mode](https://reactrouter.com/start/modes#declarative) (`<BrowserRouter>`) or [Data Mode](https://reactrouter.com/start/modes#data) (`createBrowserRouter`/`<RouterProvider>`).
CVSS v3.1: 6.5
CVE-2018-12522: An issue was discovered in perfSONAR Monitoring and Debugging Dashboard (MaDDash) 2.0.2. A direct request to /style/ provides a directory listing.
CVSS v3.0: 5.3
CVSS v2.0: 5
CVE-2025-32280: WordPress WP Project Manager plugin < 2.6.25 - Cross Site Request Forgery (CSRF) Vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in weDevs WP Project Manager wedevs-project-manager allows Cross Site Request Forgery.This issue affects WP Project Manager: from n/a through < 2.6.25.
CVSS v3.1: 4.3
CVE-2009-4164: Cross-site scripting (XSS) vulnerability in the simple Glossar (simple_glossar) extension 1.0.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS v2.0: 4.3
CVE-2023-32194: Rancher permissions on 'namespaces' in any API group grants 'edit' permissions on namespaces in 'core'
A vulnerability has been identified when granting a create or * global role for a resource type of "namespaces"; no matter the API group, the subject will receive *
 permissions for core namespaces. This can lead to someone being capable
 of accessing, creating, updating, or deleting a namespace in the 
project.
CVSS v4.0: 8.6
CVSS v3.1: 7.2
GHSA-6r65-9v24-3q44: In the Linux kernel, the following vulnerability has been resolved:wifi: mt76: disable napi on driver removalA warning on driver removal started occurring after commit 9dd05df8403b
("net: warn if NAPI instance wasn't shut down"). Disable tx napi before
deleting it in mt76_dma_cleanup().WARNING: CPU: 4 PID: 18828 at net/core/dev.c:7288 __netif_napi_del_locked+0xf0/0x100
 CPU: 4 UID: 0 PID: 18828 Comm: modprobe Not tainted 6.15.0-rc4 #4 PREEMPT(lazy)
 Hardware name: ASUS System Product Name/PRIME X670E-PRO WIFI, BIOS 3035 09/05/2024
 RIP: 0010:__netif_napi_del_locked+0xf0/0x100
 Call Trace:
 <TASK>
 mt76_dma_cleanup+0x54/0x2f0 [mt76]
 mt7921_pci_remove+0xd5/0x190 [mt7921e]
 pci_device_remove+0x47/0xc0
 device_release_driver_internal+0x19e/0x200
 driver_detach+0x48/0x90
 bus_remove_driver+0x6d/0xf0
 pci_unregister_driver+0x2e/0xb0
 __do_sys_delete_module.isra.0+0x197/0x2e0
 do_syscall_64+0x7b/0x160
 entry_SYSCALL_64_after_hwframe+0x76/0x7eTested with mt7921e but the same pattern can be actually applied to other
mt76 drivers calling mt76_dma_cleanup() during removal. Tx napi is enabled
in their *_dma_init() functions and only toggled off and on again inside
their suspend/resume/reset paths. So it should be okay to disable tx
napi in such a generic way.Found by Linux Verification Center (linuxtesting.org).
CVSS v3.1: 5.5
CVE-2025-34178: Netgate pfSense CE Suricata package v7.0.8_2 Stored Cross-Site Scripting
In pfSense CE /suricata/suricata_app_parsers.php, the value of the policy_name parameter is not sanitized of HTML-related strings/characters before being directly displayed. This can result in stored cross-site scripting. The attacker must be authenticated with at least "WebCfg - Services: suricata package" permissions.
CVSS v4.0: 5.1
CVE-2019-20727: Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D6100 before 1.0.0.63, R7800 before 1.0.2.52, R8900 before 1.0.4.2, R9000 before 1.0.4.2, WNDR3700v4 before 1.0.2.102, WNDR4300v1 before 1.0.2.104, WNDR4300v2 before 1.0.0.58, WNDR4500v3 before 1.0.0.58, WNR2000v5 before 1.0.0.68, and XR500 before 2.3.2.32.
CVSS v3.0: 6.8
CVE-2024-6063: GPAC MP4Box dmx_m2ts.c m2tsdmx_on_event null pointer dereference
A vulnerability was found in GPAC 2.5-DEV-rev228-g11067ea92-master. It has been classified as problematic. This affects the function m2tsdmx_on_event of the file src/filters/dmx_m2ts.c of the component MP4Box. The manipulation leads to null pointer dereference. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is named 8767ed0a77c4b02287db3723e92c2169f67c85d5. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-268791.
CVSS v4.0: 4.8
CVSS v3.1: 3.3
CVSS v3.0: 3.3
CVSS v2.0: 1.7
CVE-2024-8497: Franklin Fueling Systems TS-550 EVO Absolute Path Traversal
Franklin Fueling Systems TS-550 EVO versions prior to 2.26.4.8967 possess a file that can be read arbitrarily that could allow an attacker obtain administrator credentials.
CVSS v4.0: 8.7
CVSS v3.1: 7.5
GHSA-rvg8-pwq2-xj7q: Out-of-bounds Read in base64url
Versions of `base64url` before 3.0.0 are vulnerable to to out-of-bounds reads as it allocates uninitialized Buffers when number is passed in input on Node.js 4.x and below.RecommendationUpdate to version 3.0.0 or later.
CVE-2004-1777: A "range check error" in Skype for Windows before 0.98.0.28 allows local and remote attackers to cause a denial of service (application crash) via long command line arguments or a long callto:// URL, a different vulnerability than CVE-2004-1114.
CVSS v2.0: 5
GHSA-55h6-p6m7-f4h7: An Insufficiently Protected Credentials issue was discovered in Schneider Electric Modicon PLCs Modicon M241, all firmware versions, and Modicon M251, all firmware versions. Log-in credentials are sent over the network with Base64 encoding leaving them susceptible to sniffing. Sniffed credentials could then be used to log into the web application.
CVSS v3.1: 9.8
PYSEC-2014-51: Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, does not reseed the pseudo-random number generator (PRNG), which makes it easier for remote attackers to guess the value via unspecified vectors.  NOTE: this issue was SPLIT from CVE-2012-5508 due to different vulnerability types (ADT2).
GHSA-fgcr-gvff-j4cq: Race condition in Linux 2.6, when threads are sharing memory mapping via CLONE_VM (such as linuxthreads and vfork), might allow local users to cause a denial of service (deadlock) by triggering a core dump while waiting for a thread that has just performed an exec.
CVSS v3.1: 4.7
CVE-2026-39907: Unisys WebPerfect Image Suite 3.0 NTLMv2 Hash Leakage via WCF SOAP
Unisys WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604 expose an unauthenticated WCF SOAP endpoint on TCP port 1208 that accepts unsanitized file paths in the ReadLicense action's LFName parameter, allowing remote attackers to trigger SMB connections and leak NTLMv2 machine-account hashes. Attackers can submit crafted SOAP requests with UNC paths to force the server to initiate outbound SMB connections, exposing authentication credentials that may be relayed for privilege escalation or lateral movement within the network.
CVSS v4.0: 7
GHSA-7hmh-f259-p857: Heap-based buffer overflow in SubEdit Player build 4056 and 4066 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a long subtitle file.
GHSA-53mw-8pff-677j: A vulnerability in the JSON file handling of gaizhenbiao/chuanhuchatgpt version 20240410 allows any user to delete any JSON file on the server, including critical configuration files such as `config.json` and `ds_config_chatbot.json`. This issue arises due to improper validation of file paths, enabling directory traversal attacks. An attacker can exploit this vulnerability to disrupt the functioning of the system, manipulate settings, or potentially cause data loss or corruption.
CVSS v3.0: 8.2
CVE-2007-4029: libvorbis 1.1.2, and possibly other versions before 1.2.0, allows context-dependent attackers to cause a denial of service via (1) an invalid mapping type, which triggers an out-of-bounds read in the vorbis_info_clear function in info.c, and (2) invalid blocksize values that trigger a segmentation fault in the read function in block.c.
CVSS v2.0: 6.8
GHSA-w9f8-gxf9-rhvw: Open WebUI's Insecure Direct Object Reference (IDOR) allows access to other users' memories
SummaryAny authenticated user can read other users' private memories via `/api/v1/retrieval/query/collection`Details**Vulnerability 1: Missing authorization in collection querying**In `backend/open_webui/routers/retrieval.py`, the `query_collection_handler` function accepts a list of `collection_names` but performs no ownership validation:Collection names follow predictable patterns:User files: `file-{FILE_UUID}`User memories: `user-memory-{USER_UUID}` (requires Memory experimental feature)PoC**Environment:** Open WebUI v0.8.3, default configuration.
**Setup:**Register two users: admin (first user) and attacker (second user).As admin, upload a PDF document through chat.As admin, enable Memory (Settings → Personalization → Memory) and add some memories.**Exploitation — Step 1: Enumerate all users**Response reveals all users including admin's UUID, email, and role:**Exploitation — Step 2: Read admin's memories**Using the admin UUID obtained in Step 1, query their private memory collection:Response returns admin's private memories:**Note:** Step 2 requires the Memory experimental feature to be enabled. Steps 1 and 3 work on default configuration.**Exploitation — Step 3: Read admin's private file (Vulnerability 1)**File collections use the pattern `file-{FILE_UUID}`. The file UUID must be obtained separately. Once known:Response returns admin's private document content and full metadata:Impact**Document theft:** Any authenticated user can read the full content and metadata of files uploaded by any other user, including admins.**User enumeration:** All user UUIDs, emails, names, and roles are exposed to any authenticated user via `/api/v1/users/search`.**Memory leakage:** When the Memory experimental feature is enabled, personal memories stored by users for LLM personalization can be read by any other user — directly contradicting the official documentation.**No admin privileges required:** A regular user account is sufficient to exploit all of the above.Suggested Fix**1. Add ownership validation in `/api/v1/retrieval/query/collection`:****2. Restrict `/api/v1/users/search`** to admin-only or limit the fields returned to non-privileged users.DisclosureAI was used to assist with writing this report. The vulnerability was identified and confirmed through hands-on testing on Open WebUI v0.8.3. All screenshots are from real testing.
CVSS v3.1: 3.1
CVE-2023-5785: Netentsec NS-ASG Application Security Gateway addaddress_interpret.php sql injection
A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been classified as critical. This affects an unknown part of the file /protocol/firewall/addaddress_interpret.php. The manipulation of the argument messagecontent leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-243591. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v3.1: 5.5
CVSS v3.0: 5.5
CVSS v2.0: 5.2
GHSA-6wh7-hrcm-fv9m: The registry in Windows NT can be accessed remotely by users who are not administrators.
CVE-2025-34429: 1Panel CSRF Web Port Configuration Change
1Panel versions 1.10.33 - 2.0.15 contain a cross-site request forgery (CSRF) vulnerability in the web port configuration functionality. The port-change endpoint lacks CSRF defenses such as anti-CSRF tokens or Origin/Referer validation. An attacker can craft a malicious webpage that submits a port-change request; when a victim visits it while authenticated, the browser includes valid session cookies and the request succeeds. This allows an attacker to change the port on which the 1Panel web service listens, causing loss of access on the original port and resulting in service disruption or denial of service, and may unintentionally expose the service on an attacker-chosen port.
CVSS v4.0: 7
CVE-2013-3754: Unspecified vulnerability in the Solaris Cluster component in Oracle and Sun Systems Products Suite 3.3 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to HA for TimesTen.
CVSS v2.0: 7.2
CVE-2021-25699: The OpenSSL component of the Teradici PCoIP Software Client prior to version 21.07.0 was compiled without the no-autoload-config option, which allowed an attacker to elevate to the privileges of the running process via placing a specially crafted dll in a build configuration directory.
CVSS v3.1: 7.8
CVSS v2.0: 4.4
GHSA-x8j8-538p-x6xv: A vulnerability, which was classified as problematic, has been found in libretro RetroArch up to 1.19.1 on Windows. Affected by this issue is some unknown functionality in the library profapi.dll of the component Startup. The manipulation leads to untrusted search path. An attack has to be approached locally. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 4.8
CVSS v3.1: 5.3
GHSA-qwwx-f8r3-v9pc: A vulnerability, which was classified as critical, was found in PHPGurukul Credit Card Application Management System 1.0. Affected is an unknown function of the file /admin/index.php. The manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 6.9
CVSS v3.1: 7.3
GHSA-r2fr-8m3m-rwqg: config.php in Cacti 0.8.6e and earlier allows remote attackers to set the no_http_headers switch, then modify session information to gain privileges and disable the use of addslashes to conduct SQL injection attacks.
CVE-2015-0647: Cisco IOS 12.2, 12.4, 15.0, 15.2, and 15.3 allows remote attackers to cause a denial of service (device reload) via malformed Common Industrial Protocol (CIP) UDP packets, aka Bug ID CSCum98371.
CVSS v2.0: 7.8
CVE-2026-23723: WeGIA has a Critical SQL Injection in Atendido_ocorrenciaControle via id_memorando parameter
WeGIA is a web manager for charitable institutions. Prior to 3.6.2, an authenticated SQL Injection vulnerability was identified in the Atendido_ocorrenciaControle endpoint via the id_memorando parameter. This flaw allows for full database exfiltration, exposure of sensitive PII, and potential arbitrary file reads in misconfigured environments. This vulnerability is fixed in 3.6.2.
CVSS v3.1: 7.2
CVE-2007-1780: Cross-site scripting (XSS) vulnerability in the DHT shell (owdhtshell) in Overlay Weaver 0.5.9 to 0.5.11, when invoked with the -x option, allows remote attackers to inject arbitrary web script or HTML via fields in certain input forms.
CVSS v2.0: 4.3
GHSA-3pqg-7243-253q: SQL injection vulnerability in makale.php in Makale 0.26 and possibly other versions, a module for XOOPS, allows remote attackers to execute arbitrary SQL commands via the id parameter.  NOTE: some of these details are obtained from third party information.
CVE-2025-0433: Master Addons <= 2.0.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 2.0.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
GHSA-3pv8-6f4r-ffg2: tar has a PAX header desynchronization issue
SummaryWhen a tar stream contains multiple "header" entries prior to a file entry, tar-rs applies the PAX header (`x`) to the _next_ entry in the stream, regardless of type. For example, a stream of `x -> L -> file` (PAX, GNU longname, file) would result in `x`'s extensions being applied to `L` rather than to `file`.[Per POSIX pax](https://pubs.opengroup.org/onlinepubs/9799919799/utilities/pax.html), this is incorrect: a PAX header always applies to a file entry, not any intermediary entries. See the "pax Header Block" section for the specific prescription there.As a result of this, an attacker can contrive a tar containing a sequence of tar headers such that tar-rs applies the PAX header's `size` extension to the next header in sequence, effectively desynchronizing the stream and enabling tar-rs specific skippage/extraction of members. In other words, a file can be contrived to extract differently on tar-rs than on other tar parsers.PoC[This tar](https://github.com/user-attachments/files/27141941/pax-overrides-extension-header.tar.zip) (zipped for size) demonstrates the desynchronization: with `tar tvf`:with `tar-rs`:In the above case, the PoC is not weaponized, so it jumps into the middle of an entry and subsequently fails the checksum test rather than silently continuing with attacker-controlled archive state.ImpactThis is very similar to GHSA-j5gw-2vrg-8fgx and GHSA-fp55-jw48-c537 in impact -- an attacker can use this to extract (or not extract) files from a tar stream depending on the tar parser used, which in turn can be used to obscure the presence of malicious files.
GHSA-54j9-9c57-rpf4: The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wte_trip_tax' shortcode in all versions up to, and including, 6.7.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
CVE-2021-1730: Microsoft Exchange Server Spoofing Vulnerability
<p>A spoofing vulnerability exists in Microsoft Exchange Server which could result in an attack that would allow a malicious actor to impersonate the user.</p>
<p>This update addresses this vulnerability.</p>
<p>To prevent these types of attacks, Microsoft recommends customers to download inline images from different DNSdomains than the rest of OWA. Please see further instructions in the FAQ to put in place this mitigations.</p>
CVSS v3.1: 5.4
CVE-2006-6717: The Allied Telesis AT-9000/24 Ethernet switch accepts management packets from arbitrary VLANs, contrary to the documentation, which allows remote attackers to conduct attacks against the switch from unexpected locations.
CVSS v2.0: 7.5
GHSA-6pmc-6xmw-ff5m: Cross site scripting (XSS) vulnerability in application/controllers/AdminController.php in xujinliang zibbs 1.0, allows attackers to execute arbitrary code via the bbsmeta parameter.
GHSA-65rf-w3qg-h7vh: Memory safety bugs present in Firefox 118. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 119.
CVSS v3.1: 9.8
CVE-2011-0218: WebKit, as used in Apple Safari before 5.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2011-07-20-1.
CVSS v2.0: 9.3
CVE-2025-31212: This issue was addressed through improved state management. This issue is fixed in iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. An app may be able to access sensitive user data.
CVSS v3.1: 5.5
CVE-2024-30962: Buffer Overflow vulnerability in Open Robotics Robotic Operating System 2 (ROS2) navigation2- ROS2-humble and navigation 2-humble allows a local attacker to execute arbitrary code via the nav2_amcl process
CVSS v3.1: 7.8
CVE-2016-6686: The NVIDIA profiler in Android before 2016-10-05 on Nexus 9 devices allows attackers to obtain sensitive information via a crafted application, aka internal bug 30163101.
CVSS v3.0: 5.5
CVSS v2.0: 4.3