ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-vfj7-wc6m-2f4v: Active debug code vulnerability exists in Mesh Wi-Fi router RP562B firmware version v1.0.2 and earlier. If this vulnerability is exploited, a network-adjacent authenticated attacker may obtain or alter the settings of the device .
CVSS v3.1: 4.6
GHSA-5f53-522j-j454: Flowise Missing Authentication on NVIDIA NIM Endpoints
Missing Authentication on NVIDIA NIM EndpointsSummaryThe NVIDIA NIM router (`/api/v1/nvidia-nim/*`) is whitelisted in the global authentication middleware, allowing unauthenticated access to privileged container management and token generation endpoints.Vulnerability Details| Field | Value |
|-------|-------|
| CWE | CWE-306: Missing Authentication for Critical Function |
| Affected File | `packages/server/src/utils/constants.ts` |
| Affected Line | Line 20 (`'/api/v1/nvidia-nim'` in `WHITELIST_URLS`) |
| CVSS 3.1 | 8.6 (High) |Root CauseIn `packages/server/src/utils/constants.ts`, the NVIDIA NIM route is added to the authentication whitelist:This causes the global auth middleware to skip authentication checks for all endpoints under `/api/v1/nvidia-nim/*`. None of the controller actions in `packages/server/src/controllers/nvidia-nim/index.ts` perform their own authentication checks.Affected Endpoints| Method | Endpoint | Risk |
|--------|----------|------|
| GET | `/api/v1/nvidia-nim/get-token` | Leaks valid NVIDIA API token |
| GET | `/api/v1/nvidia-nim/preload` | Resource consumption |
| GET | `/api/v1/nvidia-nim/download-installer` | Resource consumption |
| GET | `/api/v1/nvidia-nim/list-running-containers` | Information disclosure |
| POST | `/api/v1/nvidia-nim/pull-image` | Arbitrary image pull |
| POST | `/api/v1/nvidia-nim/start-container` | Arbitrary container start |
| POST | `/api/v1/nvidia-nim/stop-container` | Denial of Service |
| POST | `/api/v1/nvidia-nim/get-image` | Information disclosure |
| POST | `/api/v1/nvidia-nim/get-container` | Information disclosure |Impact1. NVIDIA API Token LeakageThe `/get-token` endpoint returns a valid NVIDIA API token without authentication. This token grants access to NVIDIA's inference API and can list 170+ LLM models.**Token obtained:****Token validation:**2. Container Runtime ManipulationOn systems with Docker/NIM installed, an unauthenticated attacker can:List running containers (reconnaissance)Stop containers (Denial of Service)Start containers with arbitrary imagesPull arbitrary Docker images (resource consumption, potential malicious images)Proof of Conceptpoc.pyExploitation StepsEvidence**Token retrieval without authentication:****Token grants access to NVIDIA API:****Container endpoints return 500 (not 401) proving auth bypass:**References[CWE-306: Missing Authentication for Critical Function](https://cwe.mitre.org/data/definitions/306.html)[OWASP API Security Top 10 - API2:2023 Broken Authentication](https://owasp.org/API-Security/editions/2023/en/0xa2-broken-authentication/)
CVSS v4.0: 7.7
CVE-2025-38217: hwmon: (ftsteutates) Fix TOCTOU race in fts_read()
In the Linux kernel, the following vulnerability has been resolved:

hwmon: (ftsteutates) Fix TOCTOU race in fts_read()

In the fts_read() function, when handling hwmon_pwm_auto_channels_temp,
the code accesses the shared variable data->fan_source[channel] twice
without holding any locks. It is first checked against
FTS_FAN_SOURCE_INVALID, and if the check passes, it is read again
when used as an argument to the BIT() macro.

This creates a Time-of-Check to Time-of-Use (TOCTOU) race condition.
Another thread executing fts_update_device() can modify the value of
data->fan_source[channel] between the check and its use. If the value
is changed to FTS_FAN_SOURCE_INVALID (0xff) during this window, the
BIT() macro will be called with a large shift value (BIT(255)).
A bit shift by a value greater than or equal to the type width is
undefined behavior and can lead to a crash or incorrect values being
returned to userspace.

Fix this by reading data->fan_source[channel] into a local variable
once, eliminating the race condition. Additionally, add a bounds check
to ensure the value is less than BITS_PER_LONG before passing it to
the BIT() macro, making the code more robust against undefined behavior.

This possible bug was found by an experimental static analysis tool
developed by our team.
CVSS v3.1: 4.7
RHSA-2021:1446: Red Hat Security Advisory: OpenJDK 11.0.11 Security Update for Portable Linux Builds
OpenJDK: Incomplete enforcement of JAR signing disabled algorithms (Libraries, 8249906)
CVSS v3.1: 5.3
GHSA-xg5f-prh7-r529: An issue was discovered in the Readdle Documents app before 6.9.7 for iOS. The application's file-transfer web server allows for cross-origin requests from any domain, and the WebSocket server lacks authorization control. Any web site can execute JavaScript code (that accesses a user's data) via cross-origin requests.
CVE-2018-16588: Privilege escalation can occur in the SUSE useradd.c code in useradd, as distributed in the SUSE shadow package through 4.2.1-27.9.1 for SUSE Linux Enterprise 12 (SLE-12) and through 4.5-5.39 for SUSE Linux Enterprise 15 (SLE-15). Non-existing intermediate directories are created with mode 0777 during user creation. Given that they are world-writable, local attackers might use this for privilege escalation and other unspecified attacks.  NOTE: this would affect non-SUSE users who took useradd.c code from a 2014-04-02 upstream pull request; however, no non-SUSE distribution is known to be affected.
CVSS v3.0: 7.8
CVSS v2.0: 4.6
GHSA-cf8w-7cf7-c7vg: Directory traversal vulnerability in code/track.php in FuzzyLime 3.03 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the p parameter, a different vector than CVE-2007-4805 and CVE-2008-3165.
CVE-2023-45759: WordPress Peter’s Custom Anti-Spam Plugin <= 3.2.2 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Peter Keung Peter’s Custom Anti-Spam plugin <= 3.2.2 versions.
CVSS v3.1: 7.1
RHSA-2023:6172: Red Hat Security Advisory: Red Hat Product OCP Tools 4.12 Openshift Jenkins security update
google-oauth-client: missing PKCE support in accordance with the RFC for OAuth 2.0 for Native Apps can lead to improper authorization snakeyaml: Denial of Service due to missing nested depth limitation for collections maven-shared-utils: Command injection via Commandline class apache-commons-text: variable interpolation RCE jenkins-2-plugins/script-security: Sandbox bypass vulnerability in Script Security Plugin jenkins-2-plugins/JUnit: Stored XSS vulnerability in JUnit Plugin jenkins-2-plugins/pipeline-build-step: Stored XSS vulnerability in Pipeline: Build Step Plugin Jenkins: Temporary file parameter created with insecure permissions Jenkins: Information disclosure through error stack traces related to agents golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)
CVSS v3.1: 7.5
CVE-2019-12630: Cisco Security Manager Java Deserialization Vulnerability
A vulnerability in the Java deserialization function used by Cisco Security Manager could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An attacker could exploit this vulnerability by sending a malicious serialized Java object to a specific listener on an affected system. A successful exploit could allow the attacker to execute arbitrary commands on the device with the privileges of casuser.
CVSS v3.0: 6.5
GHSA-4x9h-3vqq-2hx5: Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the deviceMac parameter in the addWifiMacFilter function.
CVSS v3.1: 7.5
GHSA-j69g-vpf2-hpg6: Ubiquiti UniFi 52 devices, when Hotspot mode is used, allow remote attackers to bypass intended restrictions on "free time" Wi-Fi usage by sending a /guest/s/default/ request to obtain a cookie, and then using this cookie in a /guest/s/default/login request with the byfree parameter.
CVSS v3.0: 5.9
CVE-2019-14359: On BC Vault devices, a side channel for the row-based SSD1309 OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able to leverage this behavior to recover a data value. In other words, the side channel is relevant only if the attacker has enough control over the device's USB connection to make power-consumption measurements at a time when secret data is displayed. The side channel is not relevant in other circumstances, such as a stolen device that is not currently displaying secret data. NOTE: the vendor's position is that there is no security impact: the only potentially leaked information is the number of characters in the PIN
CVSS v3.0: 2.4
CVSS v2.0: 2.1
PYSEC-2017-69: Restkit allows man-in-the-middle attackers to spoof TLS servers by leveraging use of the ssl.wrap_socket function in Python with the default CERT_NONE value for the cert_reqs argument.
GHSA-xrq6-2chv-2c9r: This vulnerability allows remote attackers to bypass authentication on affected installations of BMC Track-It! 20.21.01.102. Authentication is not required to exploit this vulnerability. The specific flaw exists within the authorization of HTTP requests. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-14618.
CVE-2006-0819: Dwarf HTTP Server 1.3.2 allows remote attackers to obtain the source code of JSP files via (1) dot, (2) space, (3) slash, or (4) NULL characters in the filename extension of an HTTP request.
CVSS v2.0: 7.8
GHSA-wqgp-h8fj-p489: A low privileged remote attacker can gain the root password due to improper removal of sensitive information before storage or transfer.
CVSS v3.1: 8
GHSA-h4p3-cg85-78c7: The Manage Bank Statements in SAP S/4HANA allows authenticated attacker to bypass certain functionality restrictions of the application and upload files to a reversed bank statement. This vulnerability has a low impact on the application's integrity, with no effect on confidentiality and availability of the application.
CVSS v3.1: 4.3
CVE-2025-32021: Weblate VCS credentials included in URL parameters are potentially logged and saved into browser history as plaintext
Weblate is a web based localization tool. Prior to version 5.11, when creating a new component from an existing component that has a source code repository URL specified in settings, this URL is included in the client's URL parameters during the creation process. If, for example, the source code repository URL contains GitHub credentials, the confidential PAT and username are shown in plaintext and get saved into browser history. Moreover, if the request URL is logged, the credentials are written to logs in plaintext. If using Weblate official Docker image, nginx logs the URL and the token in plaintext. This issue is patched in version 5.11.
CVSS v3.1: 2.2
CVE-2022-2890: Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrm
Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.
CVSS v3.0: 9
GHSA-59r4-qr9h-8crh: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Amazing Team amazing neo icon font for elementor allows DOM-Based XSS.This issue affects amazing neo icon font for elementor: from n/a through 2.0.1.
CVSS v3.1: 6.5
RHSA-2023:3566: Red Hat Security Advisory: thunderbird security update
Mozilla: Click-jacking certificate exceptions through rendering lag Mozilla: Memory safety bugs fixed in Firefox 114 and Firefox ESR 102.12
CVSS v3.1: 9.8
CVE-2004-1532: AppServ 2.5.x and earlier installs a default username and password, which allows remote attackers to gain access.
CVSS v2.0: 7.5
GHSA-wvv5-9542-fhxh: In cPanel before 57.9999.54, /scripts/checkinfopages exposed a TTY to an unprivileged process (SEC-114).
CVSS v3.0: 8.8
GHSA-3r2c-w822-3j3f: IBM Security Guardium Insights 2.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 174406.
CVE-2023-27729: Nginx NJS v0.7.10 was discovered to contain an illegal memcpy via the function njs_vmcode_return at src/njs_vmcode.c.
CVSS v3.1: 7.5
GHSA-p655-2748-w2pm: Cross-zone scripting vulnerability in the Internet Explorer web control in Skype 3.1 through 3.6.0.244 on Windows allows remote attackers to inject arbitrary web script or HTML in the Local Machine Zone via the Full Name field of a reviewer of a business item entry, accessible through (1) the SkypeFind dialog and (2) a skype:?skypefind URI for the skype: URI handler.
GHSA-7q5w-m9wx-x74m: An issue in the sqlo_natural_join_cond component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS v3.1: 7.5
GHSA-m68q-4gqq-2h33: In Zulip Server versions before 1.7.2, there were XSS issues with the frontend markdown processor.
CVSS v3.0: 6.1
CVE-2024-52837: Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to access the manipulated URL or input for the exploit to execute.
CVSS v3.1: 5.4
RHSA-2016:0504: Red Hat Security Advisory: python-django security update
python-django: Malicious redirect and possible XSS attack via user-supplied redirect URLs containing basic auth python-django: User enumeration through timing difference on password hasher work factor upgrade
RHSA-2004:408: Red Hat Security Advisory: mod_ssl security update
mod_proxy hook format string
CVE-2000-0482: Check Point Firewall-1 allows remote attackers to cause a denial of service by sending a large number of malformed fragmented IP packets.
CVSS v2.0: 5
CVE-2014-4595: Multiple cross-site scripting (XSS) vulnerabilities in the WP RESTful plugin 0.1 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) oauth_callback parameter to html_api_authorize.php or the (2) oauth_token_temp or (3) oauth_callback_temp parameter to html_api_login.php.
CVSS v2.0: 4.3
GHSA-f9xr-7pwr-89qh: Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Attachments, File Upload).  Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Framework.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Applications Framework accessible data as well as  unauthorized read access to a subset of Oracle Applications Framework accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
CVSS v3.1: 5.4
GHSA-q37m-3v7r-cx35: admin/uploads.php in PHP-Update 2.7 and earlier allows remote attackers to gain privileges by setting the rights[7] parameter to 1 during a login action.
CVE-2020-28631: Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_sedge() seh->source().
CVSS v3.0: 10
CVE-2011-2264: Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.3.2.0 and 8.3.5.0 allows context-dependent attackers to affect confidentiality, integrity, and availability via unknown vectors related to Outside In Filters.  NOTE: the previous information was obtained from the July 2011 CPU.  Oracle has not commented on claims from a reliable third party that this is a stack-based buffer overflow in the imcdr2.flt library for the CorelDRAW parser.
CVSS v2.0: 4.4
GHSA-48hc-h5m8-9fxf: Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/label/delete.
CVSS v3.1: 8.8
CVE-2020-24497: Insufficient Access Control in the firmware for Intel(R) E810 Ethernet Controllers before version 1.4.1.13 may allow a privileged user to potentially enable denial of service via local access.
CVSS v3.1: 4.4
CVSS v2.0: 2.1
CVE-2020-4340: IBM Security Secret Server prior to 10.9 could allow an attacker to bypass SSL security due to improper certificate validation. IBM X-Force ID: 178180.
CVSS v3.0: 3.1
GHSA-5qgj-73pm-mvf2: The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the SetPF API.
CVSS v3.1: 5.4
CVE-2015-7322: The Secure Meeting (Pulse Collaboration) in Pulse Connect Secure (formerly Juniper Junos Pulse) before 7.1R22.1, 7.4, 8.0 before 8.0R11, and 8.1 before 8.1R3 provides different messages for attempts to join a meeting depending on the status of the meeting, which allows remote attackers to enumerate valid meeting ids via a series of requests.
CVSS v2.0: 5
CVE-2018-20071: Insufficiently strict origin checks during JIT payment app installation in Payments in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to install a service worker for a domain that can host attacker controled files via a crafted HTML page.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
CVE-2024-6879: Quiz and Survey Master (QSM) < 9.1.1 - Contributor+ Stored XSS
The Quiz and Survey Master (QSM)  WordPress plugin before 9.1.1 fails to validate and escape certain Quiz fields before displaying them on a page or post where the Quiz is embedded, which could allows contributor and above roles to perform Stored Cross-Site Scripting (XSS) attacks.
CVSS v3.1: 4.7
CVE-2024-38049: Windows Distributed Transaction Coordinator Remote Code Execution Vulnerability
Windows Distributed Transaction Coordinator Remote Code Execution Vulnerability
CVSS v3.1: 6.6
CVE-2026-2502: xmlrpc attacks blocker <= 1.0 - Unauthenticated Stored Cross-Site Scripting via 'X-Forwarded-For'
The xmlrpc attacks blocker plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0, via the 'X-Forwarded-For' HTTP header. This is due to the plugin trusting and logging attacker-controlled IP header data and rendering debug log entries without output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the debug log page.
CVSS v3.1: 6.1
GHSA-qcff-4j87-mv7g: In the Linux kernel, the following vulnerability has been resolved:pinctrl: renesas: core: Fix possible null-ptr-deref in sh_pfc_map_resources()It will cause null-ptr-deref when using 'res', if platform_get_resource()
returns NULL, so move using 'res' after devm_ioremap_resource() that
will check it to avoid null-ptr-deref.
And use devm_platform_get_and_ioremap_resource() to simplify code.
CVSS v3.1: 5.5
CVE-2011-4942: Multiple cross-site scripting (XSS) vulnerabilities in admin/configuration.php in Geeklog before 1.7.1sr1 allow remote attackers to inject arbitrary web script or HTML via the (1) subgroup or (2) conf_group parameters.  NOTE: this vulnerability might require a user-assisted attack or a bypass of a CSRF protection mechanism.
CVSS v2.0: 4.3
GHSA-7g6w-p3rw-6h75: In the Linux kernel, the following vulnerability has been resolved:randomize_kstack: Improve entropy diffusionThe kstack_offset variable was really only ever using the low bits for
kernel stack offset entropy. Add a ror32() to increase bit diffusion.
GHSA-4fwj-8595-wp25: Mattermost has Insufficiently Protected Credentials
Mattermost versions 10.5.x <= 10.5.7, 9.11.x <= 9.11.16 fail to negotiate a new token when accepting the invite which allows a user that intercepts both invite and password to send synchronization payloads to the server that originally created the invite via the REST API.
CVSS v3.1: 2.2
GHSA-jgfq-fj6m-6wxm: The Welcart e-Commerce plugin for WordPress is vulnerable to SQL Injection via the cookie in all versions up to, and including, 2.11.21 due to insufficient escaping on the user supplied value and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS v3.1: 6.5
GHSA-5jwg-6jjq-4x9g: A security flaw has been discovered in SourceCodester Interview Management System up to 1.0. Affected by this issue is some unknown functionality of the file /addCandidate.php. The manipulation of the argument candName results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be exploited.
CVSS v4.0: 2.1
CVSS v3.1: 6.3
CVE-2013-4227: Cross-site request forgery (CSRF) vulnerability in the persona_xsrf_token function in persona.module in the Mozilla Persona module 7.x-1.x before 7.x-1.11 for Drupal allows remote attackers to hijack the authentication of aribitrary users via a security token that is not a string data type.
CVSS v3.1: 8.8
CVSS v2.0: 6.8
CVE-2023-0796: LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3592, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit afaabc3e.
CVSS v3.1: 6.8
CVE-2006-2079: Cross-site scripting (XSS) vulnerability in portfolio.php in Verosky Media Instant Photo Gallery, possibly before 1.0.2, allows remote attackers to inject arbitrary web script or HTML via the cat_id parameter.
CVSS v2.0: 4.3
CVE-2012-2175: Buffer overflow in the Attachment_Times method in a certain ActiveX control in dwa85W.dll in IBM Lotus iNotes 8.5.x before 8.5.3 FP2 allows remote attackers to execute arbitrary code via a long argument.
CVSS v2.0: 9.3
CVE-2024-23531: An Integer Overflow vulnerability in WLInfoRailService component of Ivanti Avalanche before 6.4.3 allows an unauthenticated remote attacker to perform denial of service attacks. In certain rare conditions this could also lead to reading content from memory. 
CVSS v3.0: 7.5
CVE-2024-40984: ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine."
In the Linux kernel, the following vulnerability has been resolved:

ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine."

Undo the modifications made in commit d410ee5109a1 ("ACPICA: avoid
"Info: mapping multiple BARs. Your kernel is fine.""). The initial
purpose of this commit was to stop memory mappings for operation
regions from overlapping page boundaries, as it can trigger warnings
if different page attributes are present.

However, it was found that when this situation arises, mapping
continues until the boundary's end, but there is still an attempt to
read/write the entire length of the map, leading to a NULL pointer
deference. For example, if a four-byte mapping request is made but
only one byte is mapped because it hits the current page boundary's
end, a four-byte read/write attempt is still made, resulting in a NULL
pointer deference.

Instead, map the entire length, as the ACPI specification does not
mandate that it must be within the same page boundary. It is
permissible for it to be mapped across different regions.
CVSS v3.1: 5.5