ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2022-34311: IBM CICS TX session fixation
IBM CICS TX Standard and Advanced 11.1 could allow a user with physical access to the web browser to gain access to the user's session due to insufficiently protected credentials.  IBM X-Force ID:  229446.
CVSS v3.1: 4.3
GHSA-wvmm-9g2m-qqr7: The Xiaomi Security Center expresses heartfelt thanks to ADLab of VenusTech ! At the same time, we also welcome more outstanding and professional security experts and security teams to join the Mi Security Center (MiSRC) to jointly ensure the safe access of millions of Xiaomi users worldwide Life.
CVSS v3.1: 9.8
CVE-2026-5291: Inappropriate implementation in WebGL in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
CVSS v3.1: 6.5
CVE-2023-50267: MeterSphere horizontal privilege escalation vulnerability of resources in project scope.
MeterSphere is a one-stop open source continuous testing platform. Prior to 2.10.10-lts, the authenticated attackers can update resources which don't belong to him if the resource ID is known. This issue if fixed in 2.10.10-lts.  There are no known workarounds.
CVSS v3.1: 4.3
GHSA-49w5-c2q7-xqvq: An issue in JerryscriptProject jerryscript v.3.0.0 allows an attacker to obtain sensitive information via a crafted script to the arrays.
CVSS v3.1: 7.5
GHSA-7567-mgp8-r89c: A vulnerability in the Multimedia Email component of Mitel MiContact Center Business through 10.2.0.10 and Mitel CX through 1.1.0.1 could allow an unauthenticated attacker to conduct a Cross-Site Scripting (XSS) attack due to insufficient input validation. A successful exploit requires user interaction where the email channel is enabled. This could allow an attacker to execute arbitrary scripts in the victim's browser or desktop client application.
CVSS v3.1: 8.2
CVE-2024-46662: A improper neutralization of special elements used in a command ('command injection') in Fortinet FortiManager versions 7.4.1 through 7.4.3, FortiManager Cloud versions 7.4.1 through 7.4.3 allows attacker to escalation of privilege via specifically crafted packets
CVSS v3.1: 8.3
GHSA-8q6c-j3g3-gr6j: ext/misc/zipfile.c in SQLite 3.30.1 mishandles certain uses of INSERT INTO in situations involving embedded '\0' characters in filenames, leading to a memory-management error that can be detected by (for example) valgrind.
CVE-2025-32790: Dify Allows Insecure User Role Access Control for APP DSL Exporting
Dify is an open-source LLM app development platform. In versions 0.6.8 and prior, a vulnerability was identified in the DIFY AI where normal users are improperly granted permissions to export APP DSL. The feature in '/export' should only allow administrator users to export DSL. A workaround for this vulnerability involves updating the access control mechanisms to enforce stricter user role permissions and implementing role-based access controls (RBAC) to ensure that only users with admin privileges can export the APP DSL. This vulnerability is fixed in 0.6.13.
CVSS v3.1: 6.3
GHSA-2jc3-r6g9-7j93: An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 9820, 9825, 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, W920, W930, Modem 5123, Modem 5300. There is an out-of-bounds write due to a heap overflow in the GPRS protocol.
CVSS v3.1: 5.1
GHSA-qjhv-xmmx-gvgp: A vulnerability classified as problematic has been found in timschofield webERP up to 5.0.0.rc+13. This affects an unknown part of the file ConfirmDispatch_Invoice.php of the component Confirm Dispatch and Invoice Page. The manipulation of the argument Narrative leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 5.1
CVSS v3.1: 3.5
GHSA-xhfg-9rjc-3pv6: Incorrect handling of origin taint checking in Canvas in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS v3.0: 6.5
GHSA-98v3-fwpf-r4w2: Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN user to bypass Workplace/Connect Tunnel TOTP authentication.
CVSS v3.1: 7.2
ICSA-22-195-17: Siemens Opcenter Quality
The affected applications do not properly validate login information during authentication. This could lead to denial of service condition for existing users or allow unauthenticated remote attackers to successfully login without credentials.
CVSS v3.1: 9.6
CVE-2021-38112: In the Amazon AWS WorkSpaces client 3.0.10 through 3.1.8 on Windows, argument injection in the workspaces:// URI handler can lead to remote code execution because of the Chromium Embedded Framework (CEF) --gpu-launcher argument. This is fixed in 3.1.9.
CVSS v3.1: 8.8
CVSS v2.0: 9.3
CVE-2025-55141: Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with read-only admin privileges to configure authentication related settings.
CVSS v3.1: 8.8
GHSA-m74j-pp4x-r2g8: Cordaware bestinformed Microsoft Windows client before 6.2.1.0 is affected by insecure SSL certificate verification and insecure access patterns. These issues allow remote attackers to downgrade encrypted connections to cleartext.
CVSS v3.0: 9.8
CVE-2024-56058: WordPress VRPConnector plugin <= 2.0.1 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in denniskravetstns VRPConnector vrpconnector allows Object Injection.This issue affects VRPConnector: from n/a through <= 2.0.1.
CVSS v3.1: 9.8
GHSA-mpwp-xmh4-pqx8: The Conditional Menus WordPress plugin before 1.2.1 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS v3.1: 6.1
GHSA-pqvw-6c6x-gvwh: libass 0.15.x before 0.15.1 has a heap-based buffer overflow in decode_chars (called from decode_font and process_text) because the wrong integer data type is used for subtraction.
CVSS v3.1: 7.8
CVE-2025-20882: Out-of-bounds write in accessing uninitialized memory for svc1td in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to execute arbitrary code with privilege. User interaction is required for triggering this vulnerability.
CVSS v3.1: 7
GHSA-26f4-26w7-pvrq: joyplus-cms 1.6.0 has XSS in manager/admin_ajax.php?action=save&tab={pre}vod_type via the t_name parameter.
CVSS v3.0: 4.8
cisco-sa-vman-cmdinj-nRHKgfHX: Cisco SD-WAN vManage Command Injection Vulnerability
A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to inject arbitrary commands on an affected system and cause a denial of service (DoS) condition.

This vulnerability is due to improper input validation of user-supplied input to the device template configuration. An attacker could exploit this vulnerability by submitting crafted input to the device template configuration. A successful exploit could allow the attacker to cause a DoS condition on the affected system.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.


CVSS v3.1: 6.5
GHSA-pmxg-qpwm-87cr: CoreGraphics in Apple Mac OS X 10.4.6, when "Enable access for assistive devices" is on, allows an application to bypass restrictions for secure event input and read certain events from other applications in the same window session by using Quartz Event Services.
CVE-2012-0427: yast2-add-on-creator in SUSE inst-source-utils 2008.11.26 before 2008.11.26-0.9.1 and 2012.9.13 before 2012.9.13-0.8.1 allows local users to gain privileges via a crafted (1) file name or (2) directory name.
CVSS v2.0: 7.2
GHSA-79x7-r2x4-xpj2: Reflected cross-site scripting (XSS) vulnerabilities in Trend Micro Mobile Security (Enterprise) could allow an exploit against an authenticated victim that visits a malicious link provided by an attacker.Please note, this vulnerability is similar to, but not identical to, CVE-2023-41177.
CVSS v3.1: 6.1
CVE-2011-3160: Unspecified vulnerability in HP Data Protector Notebook Extension 6.20 and Data Protector for Personal Computers 7.0 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1228.
CVSS v2.0: 10
CVE-2025-4996: Intelbras RF 301K Add Static IP cross site scripting
A vulnerability, which was classified as problematic, has been found in Intelbras RF 301K 1.1.5. This issue affects some unknown processing of the component Add Static IP. The manipulation of the argument Description leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.
CVSS v4.0: 4.8
CVSS v3.1: 2.4
CVSS v3.0: 2.4
CVSS v2.0: 3.3
GHSA-7wq3-fgh6-wjpx: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in p-themes Porto Theme - Functionality porto-functionality allows Stored XSS.This issue affects Porto Theme - Functionality: from n/a through <= 3.6.2.
CVSS v3.1: 6.5
RHSA-2020:2041: Red Hat Security Advisory: squid:4 security update
squid: improper check for new member in ESIExpression::Evaluate allows for stack buffer overflow squid: parsing of header Proxy-Authentication leads to memory corruption squid: improper access restriction upon Digest Authentication nonce replay could lead to remote code execution
CVSS v3.1: 8.1
CVSS v3.0: 4.3
RHSA-2024:8029: Red Hat Security Advisory: thunderbird security update
firefox: Use-after-free in Animation timeline (128.3.1 ESR Chemspill)
CVSS v3.1: 9.8
GHSA-gpg8-6x89-ff83: Vulnerability in the Oracle Application Express Quick Poll component of Oracle Database Server. The supported version that is affected is Prior to 20.2. Easily exploitable vulnerability allows low privileged attacker having Valid User Account privilege with network access via HTTP to compromise Oracle Application Express Quick Poll. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Application Express Quick Poll, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Application Express Quick Poll accessible data as well as unauthorized read access to a subset of Oracle Application Express Quick Poll accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
CVE-2026-0728: code-projects Intern Membership Management System delete_admin.php sql injection
A security vulnerability has been detected in code-projects Intern Membership Management System 1.0. This issue affects some unknown processing of the file /intern/admin/delete_admin.php. Such manipulation of the argument admin_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.
CVSS v4.0: 5.1
CVSS v3.1: 4.7
CVSS v3.0: 4.7
CVSS v2.0: 5.8
CVE-2025-55409: FoxCMS 1.2.6, there is a Cross Site Scripting vulnerability in /index.php/article. This allows attackers to execute arbitrary code.
CVSS v3.1: 8.8
CVE-2023-24348: D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the curTime parameter at /goform/formSetACLFilter.
CVSS v3.1: 9.8
GHSA-48c8-gm7m-5q7v: Packeteer PacketShaper uses fixed increments in TCP initial sequence number (ISN) values, which allows remote attackers to predict the ISN value, and perform session hijacking or disruption.
GHSA-hpv3-f5p7-pxj9: Jenkins lambdatest-automation Plugin may expose Credentials access token
Jenkins lambdatest-automation Plugin 1.20.10 and earlier logs LAMBDATEST Credentials access token at the INFO level.This can result in accidental exposure of the token through the default system log.lambdatest-automation Plugin 1.21.0 no longer logs LAMBDATEST Credentials access token.
CVSS v3.1: 2.7
GHSA-gfrg-8rq8-4fc9: In Brocade SANnav before Brocade SANnav v2.31 and v2.3.0a, it was observed that Docker instances inside the appliance have insecure mount points, allowing reading and writing access to sensitive files. The vulnerability could allow a sudo privileged user on the host OS to read and write access to these files.
CVSS v3.1: 4.4
GHSA-f347-8q55-7xg9: Evernote prior to 5.5.1 has insecure password change
CVE-2006-5461: Avahi before 0.6.15 does not verify the sender identity of netlink messages to ensure that they come from the kernel instead of another process, which allows local users to spoof network changes to Avahi.
CVSS v2.0: 2.1
CVE-2007-3648: SQL injection vulnerability in Webmatic before 2.6.2, and possibly other versions before 2.7, allows remote attackers to execute arbitrary SQL commands via unspecified vectors, possibly related to admin/admin_album.php and admin/admin_downloads.php.  NOTE: some of these details are obtained from third party information.
CVSS v2.0: 7.5
GHSA-v3qj-6mjm-fxx7: Heap-based buffer overflow in the DecodeImage function in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted "run-length count" in an image in a WMF file.
GHSA-2v3j-gjfq-5ccx: Use after free in storage in Google Chrome prior to 100.0.4896.88 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension.
CVSS v3.1: 9.6
CVE-2023-2875: eScan Antivirus IoControlCode PROCOBSRVESX.SYS 0x22E008u null pointer dereference
A vulnerability, which was classified as problematic, was found in eScan Antivirus 22.0.1400.2443. Affected is the function 0x22E008u in the library PROCOBSRVESX.SYS of the component IoControlCode Handler. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. VDB-229854 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v3.1: 5.5
CVSS v3.0: 5.5
CVSS v2.0: 4.6
CVE-2016-8588: The hotfix_upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via shell metacharacters in the file name of an uploaded file.
CVSS v3.0: 7.3
CVSS v2.0: 6
GHSA-fg2q-6f3h-w7w8: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codeaffairs Wp Text Slider Widget allows Stored XSS.This issue affects Wp Text Slider Widget: from n/a through 1.0.
CVSS v3.1: 6.5
GHSA-33jv-3p35-h2qx: Vulnerabilities in the KDE kvt terminal program allow local users to gain root privileges.
CVE-2025-60207: WordPress Custom User Registration Fields for WooCommerce plugin <= 2.1.2 - Arbitrary File Upload Vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in Addify Custom User Registration Fields for WooCommerce user-registration-plugin-for-woocommerce allows Upload a Web Shell to a Web Server.This issue affects Custom User Registration Fields for WooCommerce: from n/a through <= 2.1.2.
CVSS v3.1: 10
CVE-2022-4104: A loop with an unreachable exit condition can be triggered by passing a crafted JPEG file to the Lepton image compression tool, resulting in a denial-of-service.
CVSS v3.1: 5.5
GHSA-9mp4-77wg-rwx9: @clerk/backend Performs Insufficient Verification of Data Authenticity
ImpactApplications that use the `verifyWebhook()` helper to verify incoming Clerk webhooks are susceptible to accepting improperly signed webhook events.Patches`@clerk/backend`: the helper has been patched as of `2.4.0``@clerk/astro`: the helper has been patched as of `2.10.2``@clerk/express`: the helper has been patched as of `1.7.4``@clerk/fastify`: the helper has been patched as of `2.4.4``@clerk/nextjs`: the helper has been patched as of `6.23.3``@clerk/nuxt`: the helper has been patched as of `1.7.5``@clerk/react-router`: the helper has been patched as of `1.6.4``@clerk/remix`: the helper has been patched as of `4.8.5``@clerk/tanstack-react-start`: the helper has been patched as of `0.18.3`ResolutionThe issue was resolved in **`@clerk/backend` `2.4.0`** by:Properly parsing the webhook request's signatures and comparing them against the signature generated from the received eventWorkaroundsIf unable to upgrade, developers can workaround this issue by verifying webhooks manually, per [this documentation](https://clerk.com/docs/webhooks/overview#protect-your-webhooks-from-abuse).
CVSS v3.1: 7.5
CVE-2013-6875: SQL injection vulnerability in functions/prepend_adm.php in Nagios Core Config Manager in Nagios XI before 2012R2.4 allows remote attackers to execute arbitrary SQL commands via the tfPassword parameter to nagiosql/index.php.
CVSS v2.0: 7.5
GHSA-f75m-g5x9-px2w: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Motorix motorix allows PHP Local File Inclusion.This issue affects Motorix: from n/a through <= 1.6.
CVSS v3.1: 8.1
GHSA-h7jg-8c4h-2f2v: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Everest Themes Arya Multipurpose theme <= 1.0.5 versions.
CVSS v3.1: 7.1
GHSA-4g2g-8pcm-99w8: Improper Handling of Additional Special Element in GitHub repository squidex/squidex prior to 7.4.0.
CVSS v3.1: 6.1
CVE-2006-6747: SQL injection vulnerability in show_news.php in Xt-News 0.1 allows remote attackers to execute arbitrary SQL commands via the id_news parameter.
CVSS v2.0: 7.5
CVE-2024-35519: Netgear EX6120 v1.0.0.68, Netgear EX6100 v1.0.2.28, and Netgear EX3700 v1.0.0.96 are vulnerable to command injection in operating_mode.cgi via the ap_mode parameter.
CVSS v3.1: 8.4
CVE-2025-32408: In Soffid Console 3.6.31 before 3.6.32, authorization to use the pam service is mishandled.
CVSS v3.1: 2.5
CVE-2024-37173: [Multiple CVEs] Multiple vulnerabilities in SAP CRM (WebClient UI)
Due to insufficient input validation, SAP
  CRM WebClient UI allows an unauthenticated attacker to craft a URL link which
  embeds a malicious script. When a victim clicks on this link, the script will
  be executed in the victim's browser giving the attacker the ability to access
  and/or modify information with no effect on availability of the application.
CVSS v3.1: 6.1
GHSA-chp3-8jq7-78c6: Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server.
GHSA-jrmh-qf4p-w726: The IMAP functionality in PHP before 4.3.1 allows remote attackers to cause a denial of service via an e-mail message with a (1) To or (2) From header with an address that contains a large number of "\" (backslash) characters.
GHSA-gf69-6hf2-hp8v: Heap-based buffer overflow in the Microsoft Word document conversion feature in Corel WordPerfect allows remote attackers to execute arbitrary code via a crafted document.
GHSA-p2qf-9vp6-3jjq: HuTool XML parsing module has blind XXE vulnerability
A vulnerability, which was classified as problematic, has been found in Dromara HuTool up to 5.8.19. Affected by this issue is the function readBySax of the file XmlUtil.java of the component XML Parsing Module. The manipulation leads to xml external entity reference.
CVSS v3.1: 7.5
GHSA-52gf-54f2-3825: An improper access control vulnerability in FortiMail version 7.4.0 configured with RADIUS authentication and remote_wildcard enabled may allow a remote unauthenticated attacker to bypass admin login via a crafted HTTP request.
CVSS v3.1: 9.8
GHSA-42f9-rjch-58qh: In the Linux kernel, the following vulnerability has been resolved:wifi: cfg80211: validate HE operation element parsingValidate that the HE operation element has the correct
length before parsing it.
CVSS v3.1: 5.5
RHSA-2025:16166: Red Hat Security Advisory: OpenShift Container Platform 4.14.57 security and extras update
helm.sh/helm/v3: Helm Chart Code Execution
CVSS v3.1: 8.5
GHSA-mxq8-mx56-69hw: LTB (aka LDAP Tool Box) Self Service Password before 1.3 allows a change to a user password (without knowing the old password) via a crafted POST request, because the ldap_bind return value is mishandled and the PHP data type is not constrained to be a string.
CVSS v3.0: 9.8
CVE-2022-26322: Possible Insertion of Sensitive Information into Log File Vulnerability in Identity Manager
Possible Insertion of Sensitive Information into Log File Vulnerability

in Identity Manager has been discovered in
OpenText™ 
Identity Manager REST Driver. This impact version before 1.1.2.0200.
CVSS v3.1: 4.9
GHSA-6348-w693-wj25: NAS Navigator2 Windows version by BUFFALO INC. registers a Windows service with an unquoted file path. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege.
CVSS v4.0: 8.4
CVSS v3.0: 6.7
CVE-2020-16980: Windows iSCSI Target Service Elevation of Privilege Vulnerability
<p>An elevation of privilege vulnerability exists when the Windows iSCSI Target Service improperly handles file operations. An attacker who successfully exploited this vulnerability could gain elevated privileges.</p>
<p>To exploit the vulnerability, an attacker would first need code execution on a victim system. An attacker could then run a specially crafted application.</p>
<p>The security update addresses the vulnerability by ensuring the Windows iSCSI Target Service properly handles file operations.</p>
CVSS v3.1: 7.8
CVE-2020-3357: Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers SSL Remote Code Execution and Denial of Service Vulnerability
A vulnerability in the Secure Sockets Layer (SSL) VPN feature of Cisco Small Business RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device or cause the device to reload, resulting in a denial of service (DoS) condition. The vulnerability exists because HTTP requests are not properly validated. An attacker could exploit this vulnerability by sending a crafted HTTP request over an SSL connection to an affected device. A successful exploit could allow the attacker to remotely execute arbitrary code on the device or cause the device to reload, resulting in a DoS condition.
CVSS v3.1: 9.8
GHSA-mqc7-5qj8-5f3j: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Whitebox-Studio Scape scape allows Path Traversal.This issue affects Scape: from n/a through < 1.5.16.
CVSS v3.1: 8.6
GHSA-9gmc-4822-r428: An issue was discovered in Reprise License Manager 11.0. This vulnerability is a Path Traversal where the attacker, by changing a field in the Web Request, can have access to files on the File System of the Server. By specifying a pathname in the POST parameter "lf" to the goform/edit_lf_get_data URI, the attacker can retrieve the content of a file.
CVSS v3.0: 8.1
GHSA-6mjq-g2c9-7fgq: Missing Authorization vulnerability in Migrate Clone allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Clone: from n/a through 2.4.5.
CVSS v3.1: 4.3
GHSA-hmp9-rfcp-g569: libopenmpt before 0.4.3 allows a crash due to a NULL pointer dereference when doing a portamento from an OPL instrument to an empty instrument note map slot.
CVSS v3.0: 7.5
GHSA-7qrm-23cw-h659: Multiple stack-based buffer overflows in TIBCO SmartPGM FX allow remote attackers to execute arbitrary code or cause a denial of service (service stop and file-transfer outage) via unspecified vectors.  NOTE: as of 20071016, the only disclosure is a vague pre-advisory with no actionable information. However, since it is from a well-known researcher, it is being assigned a CVE identifier for tracking purposes.