ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2024-24442: A NULL pointer dereference in the ngap_app::handle_receive routine of OpenAirInterface CN5G AMF (oai-cn5g-amf) up to v2.0.0 allows attackers to cause a Denial of Service (DoS) via a crafted NGAP message.
CVSS v3.1: 7.5
CVE-2025-31825: WordPress Category Icon plugin <= 1.0.1 - Arbitrary File Download vulnerability
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in pixelgrade Category Icon category-icon allows Path Traversal.This issue affects Category Icon: from n/a through <= 1.0.1.
CVSS v3.1: 4.9
CVE-2026-23027: LoongArch: KVM: Fix kvm_device leak in kvm_pch_pic_destroy()
In the Linux kernel, the following vulnerability has been resolved:

LoongArch: KVM: Fix kvm_device leak in kvm_pch_pic_destroy()

In kvm_ioctl_create_device(), kvm_device has allocated memory,
kvm_device->destroy() seems to be supposed to free its kvm_device
struct, but kvm_pch_pic_destroy() is not currently doing this, that
would lead to a memory leak.

So, fix it.
CVE-2019-20847: An issue was discovered in Mattermost Server before 5.18.0. An attacker can send a user_typing WebSocket event to any channel.
CVSS v3.1: 5.3
CVSS v2.0: 5
CVE-2018-5268: In OpenCV 3.3.1, a heap-based buffer overflow happens in cv::Jpeg2KDecoder::readComponent8u in modules/imgcodecs/src/grfmt_jpeg2000.cpp when parsing a crafted image file.
CVSS v3.1: 5.5
CVSS v2.0: 4.3
GHSA-9g4q-mq35-ffg3: Improper Privilege Management vulnerability in Cloudflare WARP on Windows allows File Manipulation.User with a low system privileges  can create a set of symlinks inside the C:\ProgramData\Cloudflare\warp-diag-partials folder. After triggering the 'Reset all settings" option the WARP service will delete the files that the symlink was pointing to. Given the WARP service operates with System privileges this might lead to deleting files owned by the System user.
This issue affects WARP: before 2024.12.492.0.
CVSS v4.0: 6.1
CVSS v3.1: 7.1
GHSA-7hrc-f2hg-5rgj: A vulnerability has been found in fossology and classified as problematic. This vulnerability affects unknown code. The manipulation of the argument sql/VarValue leads to cross site scripting. The attack can be initiated remotely. The name of the patch is 8e0eba001662c7eb35f045b70dd458a4643b4553. It is recommended to apply a patch to fix this issue. VDB-217426 is the identifier assigned to this vulnerability.
CVSS v3.1: 6.1
GHSA-qhj7-cvpp-4wm8: Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console).  Supported versions that are affected are 12.2.1.4.0 and  14.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise WebLogic Server.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in WebLogic Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of WebLogic Server. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).
CVSS v3.1: 8.3
GHSA-rcm5-8ghg-jhvv: Cross-site request forgery (CSRF) vulnerability in LOGITEC LAN-W300N/PR5B allows remote attackers to hijack the authentication of administrators via a specially crafted URL. As a result, unintended operations to the device such as changes of the device settings may be conducted.
CVE-2025-65202: TRENDnet TEW-657BRM 1.00.1 has an authenticated remote OS command injection vulnerability in the setup.cgi binary, exploitable via the HTTP parameters "command", "todo", and "next_file," which allows an attacker to execute arbitrary commands with root privileges.
CVSS v3.1: 8
CVE-2007-3033: Cross-site scripting (XSS) vulnerability in Windows Vista Feed Headlines Gadget (aka Sidebar RSS Feeds Gadget) in Windows Vista allows user-assisted remote attackers to execute arbitrary code via an RSS feed with crafted HTML attributes, which are not properly removed and are rendered in the local zone.
CVSS v2.0: 4.3
CVE-2023-24590: 



A format string issue in the Controller 6000's optional diagnostic web interface can be used to write/read from memory, and in some instances crash the Controller 6000 leading to a Denial of Service.

This issue affects: Gallagher Controller 6000 8.60 prior to vCR8.60.231116a (distributed in 8.60.2550 (MR7)), all versions of 8.50 and prior.




CVSS v3.1: 7.5
RHSA-2025:16414: Red Hat Security Advisory: ncurses security update
ncurses: segfaulting OOB read
CVSS v3.1: 6.1
RHSA-2026:27734: Red Hat Security Advisory: firefox security update
firefox: thunderbird: Privilege escalation in the Graphics: WebRender component firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 firefox: thunderbird: Use-after-free in the Networking: HTTP component firefox: thunderbird: Incorrect boundary conditions in the Web Audio component firefox: thunderbird: Sandbox escape in the DOM: Workers component firefox: thunderbird: Sandbox escape in the DOM: Navigation component firefox: thunderbird: Sandbox escape in the Security: Process Sandboxing component firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Networking component firefox: thunderbird: Memory safety bug fixed in Firefox ESR 140.12 firefox: thunderbird: JIT miscompilation in the DOM: Core & HTML component firefox: thunderbird: Mitigation bypass in the DOM: Security component firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 firefox: thunderbird: Information disclosure, sandbox escape in the Security: Process Sandboxing component firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 firefox: thunderbird: Information disclosure, sandbox escape in the Security: Process Sandboxing component firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 firefox: thunderbird: Mitigation bypass in the DOM: Security component firefox: thunderbird: Incorrect boundary conditions in the Graphics: CanvasWebGL component firefox: thunderbird: Denial-of-service in the Graphics: ImageLib component firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152 firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.37, Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152 firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 firefox: thunderbird: Incorrect boundary conditions in the Internationalization component
CVSS v3.1: 6.1
CVE-2016-6800: The default configuration of the Apache OFBiz framework offers a blog functionality. Different users are able to operate blogs which are related to specific parties. In the form field for the creation of new blog articles the user input of the summary field as well as the article field is not properly sanitized. It is possible to inject arbitrary JavaScript code in these form fields. This code gets executed from the browser of every user who is visiting this article. Mitigation: Upgrade to Apache OFBiz 16.11.01.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
CVE-2026-5571: Technostrobe HI-LED-WR120-G2 Configuration Data fs information disclosure
A vulnerability was identified in Technostrobe HI-LED-WR120-G2 5.5.0.1R6.03.30. The impacted element is an unknown function of the file /fs of the component Configuration Data Handler. Such manipulation of the argument File leads to information disclosure. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 6.9
CVSS v3.1: 5.3
CVSS v3.0: 5.3
CVSS v2.0: 5
CVE-2010-2071: The btrfs_xattr_set_acl function in fs/btrfs/acl.c in btrfs in the Linux kernel 2.6.34 and earlier does not check file ownership before setting an ACL, which allows local users to bypass file permissions by setting arbitrary ACLs, as demonstrated using setfacl.
CVSS v2.0: 4.6
GHSA-4rvx-65mq-9375: IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 before FP1 allows remote authenticated users to cause a denial of service (maintenance-mode transition and data-storage outage) by calling the System Administration Mode function.
CVE-2007-2317: Multiple PHP remote file inclusion vulnerabilities in MiniBB Forum 1.5a and earlier, as used by TOSMO/Mambo 4.0.12 and probably other products, allow remote attackers to execute arbitrary PHP code via a URL in the absolute_path parameter to bb_plugins.php in (1) components/minibb/ or (2) components/com_minibb, or (3) configuration.php.  NOTE: the com_minibb.php vector is already covered by CVE-2006-3690.
CVSS v2.0: 7.5
RHSA-2007:0674: Red Hat Security Advisory: perl-Net-DNS security update
perl-Net-DNS security issue Net:: DNS denial of service
GHSA-v665-872m-c6wh: A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setAccessDeviceCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Performing a manipulation of the argument mac results in os command injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.
CVSS v4.0: 8.9
CVSS v3.1: 9.8
CVE-2007-4443: The UCC dedicated server for the Unreal engine, possibly 2003 and 2004, on Windows allows remote attackers to cause a denial of service (continuous beep and server slowdown) via a string containing many 0x07 characters in (1) a request to the images/ directory, (2) the Content-Type field, (3) a HEAD request, and possibly other unspecified vectors.
CVSS v2.0: 5
GHSA-3j5r-3852-j63v: A missing check_access() function in the lollms_binding_infos module of the parisneo/lollms repository, version V14, allows attackers to add, modify, and remove bindings arbitrarily. This vulnerability affects the /install_binding and /reinstall_binding endpoints, among others, enabling unauthorized access and manipulation of binding settings without requiring the client_id value.
CVSS v3.0: 8
CVE-2023-3212: A NULL pointer dereference issue was found in the gfs2 file system in the Linux kernel. It occurs on corrupt gfs2 file systems when the evict code tries to reference the journal descriptor structure after it has been freed and set to NULL. A privileged local user could use this flaw to cause a kernel panic.
CVSS v3.1: 4.4
GHSA-mgxj-66hj-35x8: In the Linux kernel, the following vulnerability has been resolved:workqueue: Fix spruious data race in __flush_work()When flushing a work item for cancellation, __flush_work() knows that it
exclusively owns the work item through its PENDING bit. 134874e2eee9
("workqueue: Allow cancel_work_sync() and disable_work() from atomic
contexts on BH work items") added a read of @work->data to determine whether
to use busy wait for BH work items that are being canceled. While the read
is safe when @from_cancel, @work->data was read before testing @from_cancel
to simplify code structure:While the read data was never used if !@from_cancel, this could trigger
KCSAN data race detection spuriously:==================================================================
  BUG: KCSAN: data-race in __flush_work / __flush_workwrite to 0xffff8881223aa3e8 of 8 bytes by task 3998 on cpu 0:
   instrument_write include/linux/instrumented.h:41 [inline]
   ___set_bit include/asm-generic/bitops/instrumented-non-atomic.h:28 [inline]
   insert_wq_barrier kernel/workqueue.c:3790 [inline]
   start_flush_work kernel/workqueue.c:4142 [inline]
   __flush_work+0x30b/0x570 kernel/workqueue.c:4178
   flush_work kernel/workqueue.c:4229 [inline]
   ...read to 0xffff8881223aa3e8 of 8 bytes by task 50 on cpu 1:
   __flush_work+0x42a/0x570 kernel/workqueue.c:4188
   flush_work kernel/workqueue.c:4229 [inline]
   flush_delayed_work+0x66/0x70 kernel/workqueue.c:4251
   ...value changed: 0x0000000000400000 -> 0xffff88810006c00dReorganize the code so that @from_cancel is tested before @work->data is
accessed. The only problem is triggering KCSAN detection spuriously. This
shouldn't need READ_ONCE() or other access qualifiers.No functional changes.
CVSS v3.1: 4.7
GHSA-g4wx-8hqp-p3wm: Ruijie EG Series Routers version EG_3.0(1)B11P216 and before allows unauthenticated attackers to remotely execute arbitrary code due to incorrect filtering.
CVSS v3.1: 9.8
CVE-2025-7759: thinkgem JeeSite UEditor Image Grabber ActionEnter.java server-side request forgery
A vulnerability was identified in thinkgem JeeSite up to 5.12.0. This vulnerability affects unknown code of the file modules/core/src/main/java/com/jeesite/common/ueditor/ActionEnter.java of the component UEditor Image Grabber. Such manipulation of the argument Source leads to server-side request forgery. The attack may be performed from remote. The exploit is publicly available and might be used. The name of the patch is 1c5e49b0818037452148e0f8ff69ed04cb8fefdc. It is advisable to implement a patch to correct this issue.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
CVE-2003-0781: Unknown vulnerability in ecartis before 1.0.0 does not properly validate user input, which allows attackers to obtain mailing list passwords.
CVSS v2.0: 10
CVE-2025-5694: PHPGurukul Human Metapneumovirus Testing Management System search-report-result.php sql injection
A vulnerability was found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /search-report-result.php. The manipulation of the argument serachdata leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
GHSA-qp4r-jw7x-qg64: Unspecified vulnerability in Oracle Application Server 9.0.4.3, 10.1.2.0.2, and 10.1.2.2; Collaboration Suite 9.0.4.2 and 10.1.2; and E-Business Suite and Applications 11.5.10CU2 has unknown impact and attack vectors related to Oracle Reports Developer, aka REP01.
GHSA-crr8-wrxj-8vg6: Jsish v3.5.0 was discovered to contain a heap-buffer-overflow in ./src/jsiUtils.c.
CVSS v3.1: 9.8
GHSA-3mh5-q9p2-6cqr: RCS module in Huawei ALP-AL00B smart phones with software versions earlier than 8.0.0.129, BLA-AL00B smart phones with software versions earlier than 8.0.0.129 has a remote control vulnerability. An attacker can trick a user to install a malicious application. When the application connects with RCS for the first time, it needs user to manually click to agree. In addition, the attacker needs to obtain the key that RCS uses to authenticate the application. Successful exploitation may cause the attacker to control keyboard remotely.
CVSS v3.0: 4.4
CVE-2021-27641: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated TIF file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
CVSS v3.0: 4.3
CVE-2010-4463: Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 21 through 6 Update 23 allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.
CVSS v2.0: 10
CVE-2019-2679: Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.2.28 and prior to 6.0.6. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox and unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.0 Base Score 7.3 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H).
CVSS v3.0: 7.3
CVSS v2.0: 3.6
CVE-2025-61536: FelixRiddle dev-jobs-handlebars 1.0 uses absolute password-reset (magic) links using the untrusted `req.headers.host` header and forces the `http://` scheme. An attacker who can control the `Host` header (or exploit a misconfigured proxy/load-balancer that forwards the header unchanged) can cause reset links to point to attacker-controlled domains or be delivered via insecure HTTP, enabling token theft, phishing, and account takeover.
CVSS v3.1: 8.2
GHSA-hc92-9h3m-c39j: Incorrect cast in anymap
An issue was discovered in the anymap crate through 0.12.1 for Rust. It violates soundness via conversion of a *u8 to a *u64.
CVSS v3.1: 9.8
CVE-2019-20829: An issue was discovered in Foxit Reader and PhantomPDF before 9.6. It has a NULL pointer dereference via FXSYS_wcslen in an Epub file.
CVSS v3.1: 7.5
CVSS v2.0: 5
GHSA-57hj-hrjv-grpg: An arbitrary file upload vulnerability in the Media Manager component of DokuWiki 2024-02-06a allows attackers to execute arbitrary code via uploading a crafted SVG file.
CVSS v3.1: 6.1
GHSA-pmwf-r7hc-gwpq: The ManageFilters.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to enumerate usernames via an incorrect authorisation check.
CVSS v3.1: 5.3
CVE-2025-24816: An Improper Access Control vulnerability in Nokia MantaRay NM
Nokia MantaRay is subject to an Improper Access Control vulnerability due to insufficient authorization within the API. Successful exploitation could allow an authenticated attacker to retrieve confidential information beyond their assigned privileges.
GHSA-rhm7-5gpj-qgx2: IIS 4.0 and 5.0 .ASP pages send the same Session ID cookie for secure and insecure web sessions, which could allow remote attackers to hijack the secure web session of the user if that user moves to an insecure session, aka the "Session ID Cookie Marking" vulnerability.
CVE-2019-14406: cPanel before 78.0.18 has stored XSS in the BoxTrapper Queue Listing (SEC-493).
CVSS v3.0: 6.1
CVSS v2.0: 4.3
RHSA-2006:0608: Red Hat Security Advisory: seamonkey security update
security flaw security flaw security flaw security flaw security flaw security flaw security flaw security flaw security flaw security flaw security flaw security flaw security flaw vulnerabilities: CVE-2006-{3113,3677,3801-3812}
GHSA-qcfr-j8mx-6wf3: SourceCodester Library Management System 1.0 is affected by SQL Injection allowing an attacker to bypass the user authentication and impersonate any user on the system.
CVE-2021-27448: A miscommunication in the file system allows adversaries with access to the MU320E to escalate privileges on the MU320E (all firmware versions prior to v04A00.1).
CVSS v3.1: 7.8
CVSS v2.0: 4.6
GHSA-rf3w-f826-mq92: The Perfect Portal Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'perfect_portal_intake_form' shortcode in all versions up to, and including, 3.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
GHSA-73cj-343r-hjc2: In store_cmd of ftm4_pdc.c, there is a possible out of bounds write due to
    an incorrect bounds check. This could lead to local escalation of privilege
    with System execution privileges needed. User interaction is not needed for
    exploitation.
CVSS v3.1: 7.8
GHSA-qr37-7423-hq8p: Tor before 0.2.1.29 and 0.2.2.x before 0.2.2.21-alpha does not properly manage key data in memory, which might allow local users to obtain sensitive information by leveraging the ability to read memory that was previously used by a different process.
GHSA-4f96-mfg4-qx5f: Data Access from Outside Expected Data Manager Component in GitHub repository openemr/openemr prior to 7.0.0.
CVSS v3.1: 8.1
CVE-2023-48432: An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0. XSS, with resultant session stealing, can occur via JavaScript code in a link (for a webmail redirection endpoint) within en email message, e.g., if a victim clicks on that link within Zimbra webmail.
CVSS v3.1: 6.1
RHSA-2025:22257: Red Hat Security Advisory: OpenShift Container Platform 4.20.6 bug fix and security update
helm.sh/helm/v3: Helm YAML Parsing Panic Vulnerability helm.sh/helm/v3: Helm Chart JSON Schema Denial of Service
CVSS v3.1: 6.5
CVE-2023-37298: Joplin before 2.11.5 allows XSS via a USE element in an SVG document.
CVSS v3.1: 6.1
GHSA-xjpj-3mr7-gcpf: Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options
SummaryThe Handlebars CLI precompiler (`bin/handlebars` / `lib/precompiler.js`) concatenates user-controlled strings — template file names and several CLI options — directly into the JavaScript it emits, without any escaping or sanitization. An attacker who can influence template filenames or CLI arguments can inject arbitrary JavaScript that executes when the generated bundle is loaded in Node.js or a browser.Description`lib/precompiler.js` generates JavaScript source by string-interpolating several values directly into the output. Four distinct injection points exist:1. Template name injection`template.name` is derived from the file system path. A filename containing `"` or `'];` breaks out of the string literal and injects arbitrary JavaScript.2. Namespace injection (`-n` / `--namespace`)`opts.namespace` is emitted as raw JavaScript. Anything after a `;` in the value becomes an additional JavaScript statement.3. CommonJS path injection (`-c` / `--commonjs`)`opts.commonjs` is interpolated inside double quotes with no escaping, allowing `"` to close the string and inject further code.4. AMD path injection (`-h` / `--handlebarPath`)`opts.handlebarPath` is interpolated inside single quotes, allowing `'` to close the array element.All four injection points result in code that executes when the generated bundle is `require()`d or loaded in a browser.Proof of Concept**Template name vector (creates a file `pwned` on disk):****Namespace vector:****CommonJS vector:****AMD vector:**Workarounds**Validate all CLI inputs** before invoking the precompiler. Reject filenames and option values  that contain characters with JavaScript string-escaping significance (`"`, `'`, `;`, etc.).**Use a fixed, trusted namespace string** passed via a configuration file rather than  command-line arguments in automated pipelines.**Run the precompiler in a sandboxed environment** (container with no write access to sensitive  paths) to limit the impact of successful exploitation.**Audit template filenames** in any repository or package that is consumed by an automated  build pipeline.
CVSS v3.1: 8.2
CVE-2025-48605: In multiple functions of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1: 8.4