ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-4w3h-xrfh-9v5v: Possible buffer over-read due to lack of length check while flashing meta images in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
ICSA-22-165-01: Johnson Controls Metasys ADS ADX OAS Servers
The affected products allow passwords to be guessed at a high rate.CVE-2022-21935 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been assigned; the CVSS vector string is (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). It is possible to inject and store malicious code into the web interfaces of the affected products.CVE-2022-21937 has been assigned to this vulnerability. A CVSS v3 base score of 8.7 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N). It is possible to inject and store malicious code into the Draft Graphics (MUI Graphics) web interfaces of the affected products.CVE-2022-21938 has been assigned to this vulnerability. A CVSS v3 base score of 8.1 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N).
CVSS v3.0: 8.1
RHSA-2020:1036: Red Hat Security Advisory: texlive security update
texlive: Buffer overflow in t1_check_unusual_charstring function in writet1.c
CVSS v3.0: 7
CVE-2020-15693: In Nim 1.2.4, the standard library httpClient is vulnerable to a CR-LF injection in the target URL. An injection is possible if the attacker controls any part of the URL provided in a call (such as httpClient.get or httpClient.post), the User-Agent header value, or custom HTTP header names or values.
CVSS v3.1: 6.5
CVSS v2.0: 6.4
CVE-2018-14036: Directory Traversal with ../ sequences occurs in AccountsService before 0.6.50 because of an insufficient path check in user_change_icon_file_authorized_cb() in user.c.
CVSS v3.0: 6.5
CVSS v2.0: 4
CVE-2007-5516: Unspecified vulnerability in the Oracle Process Mgmt & Notification component in Oracle Application Server 10.1.3.3 has unknown impact and remote attack vectors, aka AS01.
CVSS v2.0: 7.5
CVE-2005-3256: The key selection dialogue in Enigmail before 0.92.1 can incorrectly select a key with a user ID that does not have additional information, which allows parties with that key to decrypt the message.
CVSS v2.0: 5
CVE-2024-5412: A buffer overflow vulnerability in the library "libclinkc" of the Zyxel VMG8825-T50K firmware version 5.50(ABOM.8)C0 could allow an unauthenticated attacker to cause denial of service (DoS) conditions by sending a crafted HTTP request to a vulnerable device.
CVSS v3.1: 7.5
CVE-2019-1816: Cisco Web Security Appliance Privilege Escalation Vulnerability
A vulnerability in the log subscription subsystem of the Cisco Web Security Appliance (WSA) could allow an authenticated, local attacker to perform command injection and elevate privileges to root. The vulnerability is due to insufficient validation of user-supplied input on the web and command-line interface. An attacker could exploit this vulnerability by authenticating to the affected device and injecting scripting commands in the scope of the log subscription subsystem. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system and elevate privileges to root.
CVSS v3.0: 5.3
CVE-2018-9503: In rfc_process_mx_message of rfc_ts_frames.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9.0 Android ID: A-80432928
CVSS v3.0: 7.5
CVSS v2.0: 7.8
CVE-2026-40986: Spring Web Flow JS RemotingHandler renders non-HTML Response as HTML
Spring Web Flow's JavaScript RemotingHandler renders the body of an error response as HTML even when the response is not "text/html", which can result in a scripting attack in the user's browser if the error response from the server contains error details with input reflected from an attacker.

Affected versions:
Spring Web Flow 4.0.0; 3.0.0 through 3.0.1; 2.5.0 through 2.5.1.
CVSS v3.1: 4.8
CVE-2022-38529: tinyexr commit 0647fb3 was discovered to contain a heap-buffer overflow via the component rleUncompress.
CVSS v3.1: 7.8
GHSA-96mc-wq6x-h9ff: Artifex GSView 6.0 Beta on Windows allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .pdf file, related to "Data from Faulting Address controls Branch Selection starting at mupdfnet64!mIncrementalSaveFile+0x000000000000344e."
CVSS v3.0: 7.8
GHSA-7r2v-92jf-46xg: Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21025.
CVSS v3.0: 7.8
GHSA-5frq-m9mf-r3g2: Missing Authorization vulnerability in merkulove Headinger for Elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Headinger for Elementor: from n/a through 1.1.4.
CVSS v3.1: 5.4
GHSA-r75g-vg6w-4m4h: The Auto Amazon Links – Amazon Associates Affiliate Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 5.4.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS v3.1: 6.1
CVE-2009-0256: Session fixation vulnerability in the authentication library in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 allows remote attackers to hijack web sessions via unspecified vectors related to (1) frontend and (2) backend authentication.
CVSS v2.0: 7.5
CVE-2024-1907: Categorify <= 1.0.7.4 - Cross-Site Request Forgery via categorifyAjaxDeleteCategory
The Categorify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.7.4. This is due to missing or incorrect nonce validation on the categorifyAjaxDeleteCategory function. This makes it possible for unauthenticated attackers to delete categories via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS v3.1: 4.3
GHSA-3cpw-6qx8-jjgc: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of X_B files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17558.
CVSS v3.1: 7.8
CVE-2022-50869: fs/ntfs3: Fix slab-out-of-bounds in r_page
In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Fix slab-out-of-bounds in r_page

When PAGE_SIZE is 64K, if read_log_page is called by log_read_rst for
the first time, the size of *buffer would be equal to
DefaultLogPageSize(4K).But for *buffer operations like memcpy,
if the memory area size(n) which being assigned to buffer is larger
than 4K (log->page_size(64K) or bytes(64K-page_off)), it will cause
an out of boundary error.
 Call trace:
  [...]
  kasan_report+0x44/0x130
  check_memory_region+0xf8/0x1a0
  memcpy+0xc8/0x100
  ntfs_read_run_nb+0x20c/0x460
  read_log_page+0xd0/0x1f4
  log_read_rst+0x110/0x75c
  log_replay+0x1e8/0x4aa0
  ntfs_loadlog_and_replay+0x290/0x2d0
  ntfs_fill_super+0x508/0xec0
  get_tree_bdev+0x1fc/0x34c
  [...]

Fix this by setting variable r_page to NULL in log_read_rst.
GHSA-39fj-6jmr-w7rx: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Molongui Author Box for Authors, Co-Authors, Multiple Authors and Guest Authors – Molongui plugin <= 4.6.19 versions.
CVSS v3.1: 7.1
GHSA-4pcg-wr6c-h9cq: fastify/websocket vulnerable to uncaught exception via crash on malformed packet
ImpactAny application using @fastify/websocket could crash if a specific, malformed packet is sent.All versions of fastify-websocket are also impacted. That module is deprecated, so it will not be patched.PatchesThis has been patched in v7.1.1 (fastify v4) and v5.0.1 (fastify v3).WorkaroundsNo known workaround is available. However, it should be possible to attach the error handler manually.
The recommended path is upgrading to the patched versions.Credits[marcolanaro](https://github.com/marcolanaro) for finding and patching this vulnerabilityFor more informationIf you have any questions or comments about this advisory:Open an issue in [@fastify/websocket](https://github.com/fastify/fastify-websocket)Email us at [hello@matteocollina.com](mailto:hello@matteocollina.com)
CVSS v3.1: 7.5
CVE-2025-49835: GHSL-2025-047: GPT-SoVITS Command Injection vulnerability
GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is a command injection vulnerability in webui.py open_asr function. asr_inp_dir (and a number of other variables) takes user input, which is passed to the open_asr function, which concatenates the user input into a command and runs it on the server, leading to arbitrary command execution. At time of publication, no known patched versions are available.
CVSS v4.0: 8.9
GHSA-p555-vm74-xq5v: The Availability Calendar WordPress plugin before 1.2.2 does not sanitise or escape its Category Names before outputting them in page/post where the associated shortcode is embed, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
CVE-2021-47206: usb: host: ohci-tmio: check return value after calling platform_get_resource()
In the Linux kernel, the following vulnerability has been resolved:

usb: host: ohci-tmio: check return value after calling platform_get_resource()

It will cause null-ptr-deref if platform_get_resource() returns NULL,
we need check the return value.
CVSS v3.1: 5.5
GHSA-2f4j-64mc-h8m2: The Developer Tools feature suffers from a XUL injection vulnerability due to improper sanitization of the web page source code. In the worst case, this could allow arbitrary code execution when opening a malicious page with the style editor tool. This vulnerability affects Firefox ESR < 52.3 and Firefox < 55.
CVSS v3.0: 8.8
RHSA-2008:0223: Red Hat Security Advisory: seamonkey security update
Firefox JavaScript garbage collection crash
GHSA-mjf9-q9gc-82xc: In the Linux kernel through 3.2, the rds_message_alloc_sgs() function does not validate a value that is used during DMA page allocation, leading to a heap-based out-of-bounds write (related to the rds_rdma_extra_size function in net/rds/rdma.c).
CVSS v3.0: 7.8
RHSA-2025:16920: Red Hat Security Advisory: kernel-rt security update
kernel: firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails kernel: nfsd: don't ignore the return code of svc_proc_register() kernel: net_sched: hfsc: Fix a UAF vulnerability in class handling kernel: sctp: linearize cloned gso packets in sctp_rcv
CVSS v3.1: 7.5
CVE-2025-58018: WordPress Mail Subscribe List Plugin <= 2.1.10 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Richard Leishman Mail Subscribe List mail-subscribe-list allows Stored XSS.This issue affects Mail Subscribe List: from n/a through <= 2.1.10.
CVSS v3.1: 6.5
CVE-2025-62474: Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.
CVSS v3.1: 7.8
CVE-2023-27359: TP-Link AX1800 hotplugd Firewall Rule Race Condition Vulnerability
TP-Link AX1800 hotplugd Firewall Rule Race Condition Vulnerability. This vulnerability allows remote attackers to gain access to LAN-side services on affected installations of TP-Link Archer AX21 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the hotplugd daemon. The issue results from firewall rule handling that allows an attacker access to resources that should be available to the LAN interface only. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the root user.
. Was ZDI-CAN-19664.
CVSS v3.0: 9.8
GHSA-2h72-2hx7-mmcq: grant table v2 status pages may remain accessible after de-allocation Guest get permitted access to certain Xen-owned pages of memory. The majority of such pages remain allocated / associated with a guest for its entire lifetime. Grant table v2 status pages, however, get de-allocated when a guest switched (back) from v2 to v1. The freeing of such pages requires that the hypervisor know where in the guest these pages were mapped. The hypervisor tracks only one use within guest space, but racing requests from the guest to insert mappings of these pages may result in any of them to become mapped in multiple locations. Upon switching back from v2 to v1, the guest would then retain access to a page that was freed and perhaps re-used for other purposes.
CVSS v3.1: 7.8
GHSA-2v79-q5m2-86r3: In libmpeg2dec, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if another exploit allowed this to be triggered with different parameters, with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-137794014
GHSA-8584-j2xq-qr4w: A vulnerability in the Sourcefire tunnel control channel protocol in Cisco Firepower System Software running on Cisco Firepower Threat Defense (FTD) sensors could allow an authenticated, local attacker to execute specific CLI commands with root privileges on the Cisco Firepower Management Center (FMC), or through Cisco FMC on other Firepower sensors and devices that are controlled by the same Cisco FMC. To send the commands, the attacker must have root privileges for at least one affected sensor or the Cisco FMC. The vulnerability exists because the affected software performs insufficient checks for certain CLI commands, if the commands are executed via a Sourcefire tunnel connection. An attacker could exploit this vulnerability by authenticating with root privileges to a Firepower sensor or Cisco FMC, and then sending specific CLI commands to the Cisco FMC or through the Cisco FMC to another Firepower sensor via the Sourcefire tunnel connection. A successful exploit could allow the attacker to modify device configurations or delete files on the device that is running Cisco FMC Software or on any Firepower device that is managed by Cisco FMC.
CVSS v3.0: 8.2
RHSA-2026:4445: Red Hat Security Advisory: .NET 10.0 security update
.net: .NET: Denial of Service via out-of-bounds read asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation
CVSS v3.1: 7.5
GHSA-8mq5-f87c-x4p2: A logic issue was addressed with improved checks. This issue is fixed in visionOS 2.4, iOS 18.4 and iPadOS 18.4, tvOS 18.4, macOS Sequoia 15.4. Processing maliciously crafted web content may result in the disclosure of process memory.
CVSS v3.1: 6.5
GHSA-cp66-x46c-28rg: A vulnerability was identified in strukturag libheif up to 1.21.2. This impacts the function Track::load of the file libheif/sequences/track.cc of the component stsz/stts. The manipulation leads to out-of-bounds read. The attack needs to be performed locally. The exploit is publicly available and might be used. Applying a patch is the recommended action to fix this issue. The patch available is inofficial and not approved yet.
CVSS v4.0: 1.9
CVSS v3.1: 3.3
CVE-2024-43899: drm/amd/display: Fix null pointer deref in dcn20_resource.c
In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Fix null pointer deref in dcn20_resource.c

Fixes a hang thats triggered when MPV is run on a DCN401 dGPU:

mpv --hwdec=vaapi --vo=gpu --hwdec-codecs=all

and then enabling fullscreen playback (double click on the video)

The following calltrace will be seen:

[  181.843989] BUG: kernel NULL pointer dereference, address: 0000000000000000
[  181.843997] #PF: supervisor instruction fetch in kernel mode
[  181.844003] #PF: error_code(0x0010) - not-present page
[  181.844009] PGD 0 P4D 0
[  181.844020] Oops: 0010 [#1] PREEMPT SMP NOPTI
[  181.844028] CPU: 6 PID: 1892 Comm: gnome-shell Tainted: G        W  OE      6.5.0-41-generic #41~22.04.2-Ubuntu
[  181.844038] Hardware name: System manufacturer System Product Name/CROSSHAIR VI HERO, BIOS 6302 10/23/2018
[  181.844044] RIP: 0010:0x0
[  181.844079] Code: Unable to access opcode bytes at 0xffffffffffffffd6.
[  181.844084] RSP: 0018:ffffb593c2b8f7b0 EFLAGS: 00010246
[  181.844093] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000004
[  181.844099] RDX: ffffb593c2b8f804 RSI: ffffb593c2b8f7e0 RDI: ffff9e3c8e758400
[  181.844105] RBP: ffffb593c2b8f7b8 R08: ffffb593c2b8f9c8 R09: ffffb593c2b8f96c
[  181.844110] R10: 0000000000000000 R11: 0000000000000000 R12: ffffb593c2b8f9c8
[  181.844115] R13: 0000000000000001 R14: ffff9e3c88000000 R15: 0000000000000005
[  181.844121] FS:  00007c6e323bb5c0(0000) GS:ffff9e3f85f80000(0000) knlGS:0000000000000000
[  181.844128] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  181.844134] CR2: ffffffffffffffd6 CR3: 0000000140fbe000 CR4: 00000000003506e0
[  181.844141] Call Trace:
[  181.844146]  <TASK>
[  181.844153]  ? show_regs+0x6d/0x80
[  181.844167]  ? __die+0x24/0x80
[  181.844179]  ? page_fault_oops+0x99/0x1b0
[  181.844192]  ? do_user_addr_fault+0x31d/0x6b0
[  181.844204]  ? exc_page_fault+0x83/0x1b0
[  181.844216]  ? asm_exc_page_fault+0x27/0x30
[  181.844237]  dcn20_get_dcc_compression_cap+0x23/0x30 [amdgpu]
[  181.845115]  amdgpu_dm_plane_validate_dcc.constprop.0+0xe5/0x180 [amdgpu]
[  181.845985]  amdgpu_dm_plane_fill_plane_buffer_attributes+0x300/0x580 [amdgpu]
[  181.846848]  fill_dc_plane_info_and_addr+0x258/0x350 [amdgpu]
[  181.847734]  fill_dc_plane_attributes+0x162/0x350 [amdgpu]
[  181.848748]  dm_update_plane_state.constprop.0+0x4e3/0x6b0 [amdgpu]
[  181.849791]  ? dm_update_plane_state.constprop.0+0x4e3/0x6b0 [amdgpu]
[  181.850840]  amdgpu_dm_atomic_check+0xdfe/0x1760 [amdgpu]
CVSS v3.1: 5.5
CVE-2008-3581: Cross-site scripting (XSS) vulnerability in index.php in Qsoft K-Links allows remote attackers to inject arbitrary web script or HTML via the login_message parameter in a login action.
CVSS v2.0: 4.3
CVE-2025-63513: kishan0725 Hospital Management System v4 has an Insecure Direct Object Reference (IDOR) vulnerability in the appointment cancellation functionality.
CVSS v3.1: 6.5
CVE-2010-3989: Cross-site request forgery (CSRF) vulnerability in HP Insight Control Virtual Machine Management before 6.2 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS v2.0: 6.8
GHSA-p364-qwq2-fh4v: Firefox 1.0.6 allows attackers to cause a denial of service (crash) via a Proxy Auto-Config (PAC) script that uses an eval statement. NOTE: it is not clear whether an untrusted party has any role in triggering this issue, so it might not be a vulnerability.
GHSA-r3jc-vhf4-6v32: CKAN has Cross-site Scripting vector in the Datatables view plugin
The [Datatables view plugin](https://docs.ckan.org/en/2.10/maintaining/data-viewer.html#datatables-view) did not properly escape record data coming from the DataStore, leading to a potential XSS vector.ImpactSites running CKAN >= 2.7.0 with the `datatables_view` plugin activated. This is a plugin included in CKAN core, that not activated by default but it is widely used to preview tabular data.PatchesThis vulnerability has been fixed in CKAN 2.10.5 and 2.11.0WorkaroundsPrevent importing of tabular files to the DataStore via DataPusher, XLoader,etc, at least those published from untrusted sources.
CVSS v4.0: 6.1
CVSS v3.1: 6.8
RHSA-2009:1061: Red Hat Security Advisory: freetype security update
freetype: multiple integer overflows
CVE-2025-14744: Filename spoofing via Unicode Right-to-Left Override in Firefox for iOS
Unicode RTLO characters could allow malicious websites to spoof filenames in the downloads UI for Firefox for iOS, potentially tricking users into saving files of an unexpected file type. This vulnerability was fixed in Firefox for iOS 144.0.
CVSS v3.1: 6.5
CVE-2024-50859: The ip_import_acl_csv request in GestioIP v3.5.7 is vulnerable to Reflected XSS. When a user uploads an improperly formatted file, the content may be reflected in the HTML response, allowing the attacker to execute malicious scripts or exfiltrate data.
CVSS v3.1: 4.8
CVE-2021-37424: ManageEngine ADSelfService Plus before 6112 is vulnerable to domain user account takeover.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2024-3495: Country State City Dropdown CF7 <= 2.7.2 - Unauthenticated SQL Injection
The Country State City Dropdown CF7 plugin for WordPress is vulnerable to SQL Injection via the ‘cnt’ and 'sid' parameters in versions up to, and including, 2.7.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS v3.1: 9.8
GHSA-w8rc-pgxq-x2cj: Negative charge in shopping cart in Shopizer
ImpactUsing API or Controller based versions negative quantity is not adequately validated hence creating incorrect shopping cart and order total.PatchesAdding a back-end verification to check that quantity parameter isn't negative. If so, it is set to 1. Patched in 2.11.0WorkaroundsWithout uprading, it's possible to just apply the fixes in the same files it's done for the patch. Or you use javax constraint validation on the quantity parameter.References[Input Validation](https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html)
[Using bean validation constraint](https://javaee.github.io/tutorial/bean-validation002.html)
[Commits with fixes](https://github.com/shopizer-ecommerce/shopizer/commit/929ca0839a80c6f4dad087e0259089908787ad2a)
CVE Details below : [Mitre](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11007)
[NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-11007)CreditsFound and solved by Yannick Gosset from Aix-Marseille University cybersecurity
master program supervised by Yassine Ilmi
CVSS v3.1: 6.5
GHSA-5jvj-hxmh-6h6j: OpenClaw: Gateway HTTP Session History Route Bypasses Operator Read Scope
SummaryGateway HTTP Session History Route Bypasses Operator Read ScopeAffected Packages / VersionsPackage: `openclaw`Affected versions: `<= 2026.3.24`First patched version: `2026.3.25`Latest published npm version at verification time: `2026.3.24`DetailsThe HTTP `/sessions/:sessionKey/history` route previously authenticated bearer tokens but skipped the same `operator.read` check used by `chat.history` over WebSocket. Commit `1c45123231516fa50f8cf8522ba5ff2fb2ca7aea` makes HTTP callers declare operator scopes and rejects history reads that do not include `operator.read`.Verified vulnerable on tag `v2026.3.24` and fixed on `main` by commit `1c45123231516fa50f8cf8522ba5ff2fb2ca7aea`.Fix Commit(s)`1c45123231516fa50f8cf8522ba5ff2fb2ca7aea`
CVSS v4.0: 5.3
GHSA-jpjg-ww2x-6ww6: Improper neutralization of special elements used in a command ('Command Injection') vulnerability in File service functionality in Synology DiskStation Manager (DSM) before 6.2.4-25556-2 allows remote authenticated users to execute arbitrary commands via unspecified vectors.
CVSS v3.1: 8.8