ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2023-20586: Radeon™ Software Crimson ReLive Edition

A potential vulnerability was reported in Radeon™ Software Crimson ReLive Edition which may allow escalation of privilege. Radeon™ Software Crimson ReLive Edition falls outside of the security support lifecycle and AMD does not plan to release any mitigations
















CVSS v3.1: 9.8
GHSA-6q7m-p8cc-998r: Mattermost has a Missing Authorization vulnerability
Mattermost versions 10.11.x <= 10.11.1, 10.10.x <= 10.10.2, 10.5.x <= 10.5.10 fail to verify a user has permission to join a Mattermost team using the original invite token which allows any attacked to join any team on a Mattermost server regardless of restrictions via manipulating the OAuth state.
CVSS v3.1: 8.1
GHSA-5552-vwfp-xg92: Cross-site scripting (XSS) vulnerability in the Hatch theme 7.x-1.x before 7.x-1.4 for Drupal allows remote authenticated users with the "Administer content," "Create new article," or "Edit any article type content" permission to inject arbitrary web script or HTML via unspecified vectors.
GHSA-qrch-52m5-vv85: Flight vulnerable to sensitive information disclosure via default error handler
SummaryThe default error handler `Engine::_error()` writes the full exception message, exception code, and stack trace (including absolute filesystem paths) directly into the HTTP 500 response, with no debug gating. Production deployments leak internal paths, any secret interpolated into an exception message, and full module structure — giving attackers primitives for chaining other weaknesses (LFI, path traversal).Affected code`flight/Engine.php` (≈ lines 678-704):No `flight.debug` check, no environment gating.Proof of conceptAny uncaught exception — including those auto-raised from `handleError()` — returns:Reproduced against the live PoC app at `/poc5/error`.ImpactDisclosure of absolute filesystem paths (primes weaponization of LFI / path-traversal vulnerabilities in the same application).Disclosure of secrets (DB credentials, API tokens) when exceptions are constructed with interpolated configuration values.Enumeration of installed vendor packages and internal application structure.Patch (fixed in `3.18.1`, commit `b8dd23a`)A new `flight.debug` setting (default `false`) gates the verbose output. In production the handler now emits only `<h1>500 Internal Server Error</h1>`. Developers can set `flight.debug = true` in local environments to restore the full trace output.CreditDiscovered by **@Rootingg**.
CVSS v3.1: 7.5
GHSA-pxj4-78jw-m85v: The web interface of the Silicon Labs Simplicity Device Manager is exposed publicly and can be used to extract the NTLMv2 hash which an attacker could use to crack the user's domain password.
CVSS v4.0: 7.4
GHSA-qcv4-8qfq-9w76: Windows Direct Show Remote Code Execution Vulnerability
CVSS v3.1: 8.8
GHSA-vf95-jwm4-648w: The Any News Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'any-ticker' shortcode in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
CVE-2015-6369: The USB driver in Cisco Firepower Extensible Operating System 1.1(1.160) on Firepower 9000 devices allows physically proximate attackers to cause a denial of service via a crafted USB device that triggers invalid USB commands, aka Bug ID CSCux10531.
CVSS v2.0: 4.9
GHSA-wjc6-gjj8-cjmf: u'In the lbd service, an external user can issue a specially crafted debug command to overwrite arbitrary files with arbitrary content resulting in remote code execution.' in Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Wired Infrastructure and Networking in IPQ4019, IPQ6018, IPQ8064, IPQ8074, QCA4531, QCA9531, QCA9980
CVSS v3.1: 9.8
GHSA-x269-c5mf-x3rj: vBulletin through 5.5.4 mishandles custom avatars.
GHSA-mcqg-vw6x-qfjx: A security vulnerability has been detected in code-projects Simple Food Ordering System up to 1.0. Affected by this vulnerability is an unknown functionality of the file /food/sql/food.sql of the component Database Backup Handler. The manipulation leads to files or directories accessible. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. It is recommended to change the configuration settings.
CVSS v4.0: 5.5
CVSS v3.1: 5.3
RHSA-2012:0306: Red Hat Security Advisory: krb5 security and bug fix update
krb5-appl: ftpd incorrect group privilege dropping (MITKRB5-SA-2011-005)
CVE-2024-8599: Autodesk AutoCAD ACTranslators STP File Parsing Memory Corruption Code Execution Vulnerability
A maliciously crafted STP file when parsed in ACTranslators.exe through Autodesk AutoCAD can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process.
CVSS v3.1: 7.8
GHSA-2xpv-2vp6-3v7h: Unauthorized report deletion due to insufficient access control. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186.
CVSS v3.0: 4.3
GHSA-69cc-m82h-x8rm: An unauthenticated remote attacker can repeatedly send a single crafted connection request to leak memory. Against storescp in its default single-process mode, memory grows quickly and the service is eventually killed, after which it stops accepting connections until an operator restarts it.
CVSS v4.0: 8.7
CVSS v3.1: 7.5
CVE-2017-0918: Gitlab Community Edition version 10.3 is vulnerable to a path traversal issue in the GitLab CI runner component resulting in remote code execution.
CVSS v3.0: 8.8
CVSS v2.0: 6.5
CVE-2023-21438: Improper logic in HomeScreen prior to SMR Feb-2023 Release 1 allows physical attacker to access App preview protected by Secure Folder.
CVSS v3.1: 2.1
CVE-2016-6626: An issue was discovered in phpMyAdmin. An attacker could redirect a user to a malicious web page. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
CVSS v3.0: 5.4
CVSS v2.0: 5.8
GHSA-jjgp-6pj9-6629: There is a Memory Buffer Improper Operation Limit Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may cause the device to crash and restart.
CVSS v3.1: 7.5
GHSA-fcqj-f8qj-8gcp: scan.c for LibXPM may allow attackers to execute arbitrary code via a negative bitmap_unit value that leads to a buffer overflow.
CVE-2017-3634: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). Supported versions that are affected are 5.6.36 and earlier and 5.7.18 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
CVSS v3.0: 6.5
CVSS v2.0: 4
CVE-2026-39477: WordPress CartFlows plugin <= 2.2.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in Brainstorm Force CartFlows cartflows allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CartFlows: from n/a through <= 2.2.3.
CVSS v3.1: 4.3
GHSA-8f6m-3c4p-c477: Missing Authorization vulnerability in Brainstorm Force CartFlows cartflows allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CartFlows: from n/a through <= 2.2.3.
CVSS v3.1: 4.3
GHSA-w56p-x8x5-446c: A vulnerability was found in D-Link DI-8200G 17.12.20A1. This affects an unknown function of the file /upgrade_filter.asp. The manipulation of the argument path results in command injection. The attack may be performed from remote. The exploit has been made public and could be used.
CVSS v4.0: 2.1
CVSS v3.1: 6.3
CVE-2026-48968: WordPress Master Slider plugin <= 3.10.8 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Averta Master Slider allows DOM-Based XSS.

This issue affects Master Slider: from n/a through 3.10.8.
CVSS v3.1: 6.5
GHSA-jjrx-x936-xwh4: A NULL Pointer Dereference vulnerability in Juniper Networks Junos OS Evolved on ACX7024, ACX7100-32C and ACX7100-48L allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS).If a specific IPv4 UDP packet is received and sent to the Routing Engine (RE) packetio crashes and restarts which causes a momentary traffic interruption. Continued receipt of such packets will lead to a sustained DoS.This issue does not happen with IPv6 packets.This issue affects Juniper Networks Junos OS Evolved on ACX7024, ACX7100-32C and ACX7100-48L:21.4-EVO versions earlier than 21.4R3-S6-EVO;22.1-EVO versions earlier than 22.1R3-S5-EVO;22.2-EVO versions earlier than 22.2R2-S1-EVO, 22.2R3-EVO;22.3-EVO versions earlier than 22.3R2-EVO.This issue does not affect Juniper Networks Junos OS Evolved versions earlier than 21.4R1-EVO.
CVSS v3.1: 7.5
RHSA-2023:4327: Red Hat Security Advisory: postgresql:15 security update
postgresql: schema_element defeats protective search_path changes postgresql: row security policies disregard user ID changes after inlining.
CVSS v3.1: 4.2
CVE-2020-1657: Junos OS: SRX Series: An attacker sending spoofed packets to IPSec peers may cause a Denial of Service.
On SRX Series devices, a vulnerability in the key-management-daemon (kmd) daemon of Juniper Networks Junos OS allows an attacker to spoof packets targeted to IPSec peers before a security association (SA) is established thereby causing a failure to set up the IPSec channel. Sustained receipt of these spoofed packets can cause a sustained Denial of Service (DoS) condition. This issue affects IPv4 and IPv6 implementations. This issue affects Juniper Networks Junos OS on SRX Series: 12.3X48 versions prior to 12.3X48-D90; 15.1X49 versions prior to 15.1X49-D190; 17.4 versions prior to 17.4R2-S9, 17.4R3; 18.1 versions prior to 18.1R3-S9; 18.2 versions prior to 18.2R3; 18.3 versions prior to 18.3R1-S7, 18.3R2-S3, 18.3R3; 18.4 versions prior to 18.4R1-S6, 18.4R2-S3, 18.4R3; 19.1 versions prior to 19.1R1-S4, 19.1R2. This issue does not affect 12.3 or 15.1 releases which are non-SRX Series releases.
CVSS v3.1: 7.5
GHSA-c58j-gphj-cp8j: Multiple unspecified vulnerabilities in the Syslink driver for Texas Instruments OMAP mobile processor, as used on NTT DOCOMO ARROWS Tab LTE F-01D, ARROWS X LTE F-05D, Disney Mobile on docomo F-08D, REGZA Phone T-01D, and PRADA phone by LG L-02D; and SoftBank SHARP handsets 102SH allow local users to execute arbitrary code or read kernel memory via unknown vectors related to userland data and "improper data validation."
CVE-2025-9143: Scada-LTS mailing_lists.shtm cross site scripting
A security flaw has been discovered in Scada-LTS 2.7.8.1. This affects an unknown part of the file mailing_lists.shtm. The manipulation of the argument name/userList/address results in cross site scripting. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited.
CVSS v4.0: 5.1
CVSS v3.1: 3.5
CVSS v3.0: 3.5
CVSS v2.0: 4
GHSA-p7xp-wvxw-xqvj: Unspecified vulnerability in i_utils.asp in PortalApp before 4.01a has unknown impact and attack vectors.
GHSA-c7c7-5mrx-q5c2: An SQL Injection vulnerability exists in Projectworlds Online Examination System 1.0 via the eid parameter in account.php.
CVE-2025-31459: WordPress Login Alert plugin <= 0.2.1 - CSRF to Stored XSS vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in PasqualePuzio Login Alert login-alert allows Stored XSS.This issue affects Login Alert: from n/a through <= 0.2.1.
CVSS v3.1: 7.1
GHSA-978x-c366-r634: Improper Neutralization of Formula Elements in a CSV File vulnerability in Muneeb Form Builder | Create Responsive Contact Forms.This issue affects Form Builder | Create Responsive Contact Forms: from n/a through 1.9.9.0.
CVSS v3.1: 9.8
GHSA-pgf6-x544-v9h8: A directory traversal vulnerability exists in the Web Manager FsTFtp functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). A specially crafted HTTP request can lead to FsTFtp file overwrite. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVSS v3.1: 7.2
GHSA-2pvw-4fwr-jv5w: Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS v3.1: 5.4
GHSA-hjpp-qfqw-hpvq: Insufficient protection of the inter-process communication functions in ABB System 800xA products OPC Server for AC 800M, MMS Server for AC 800M and Base Software for SoftControl (all published versions) enables an attacker authenticated on the local system to inject data, affecting the online view of runtime data shown in Control Builder.
GHSA-f58x-232r-hg99: An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices. A format error in /etc/shadow, coupled with a logic bug in the LuCI - OpenWrt Configuration Interface framework, allows the undocumented system account mofidev to login to the cgi-bin/luci/quick/wizard management interface without a password by abusing a forgotten-password feature.
GHSA-f769-gvq4-hrfx: The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.9 via the 'bp-better-messages' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/bp-better-messages directory which can contain file attachments included in chat messages.
CVSS v3.1: 7.5
GHSA-p2j4-c4g6-rpf5: Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks
SummaryArc's user-SQL validator (`internal/api/query.go:ValidateSQLRequest`) blocked only `read_parquet(` and `arc_partition_agg(` via regex denylist. The broader DuckDB I/O function family — `read_csv_auto`, `read_csv`, `read_json`, `read_json_auto`, `read_text`, `read_blob`, `glob`, `parquet_metadata`, `parquet_schema`, `read_xlsx`, etc. — was not blocked. RBAC table-reference extraction inspected only `FROM`/`JOIN` clauses, so scalar table functions in the `SELECT` list slipped past both layers.ImpactAny authenticated user, including a token with `permissions: []`, can read arbitrary local files via:Confirmed reachable targets:`auth.db` — bcrypt hashes for every API token, plus legacy SHA-256 rows.`arc.toml` — S3 secrets, TLS keys.`/proc/self/environ` — environment-variable secrets.Cross-tenant Parquet files — bypasses RBAC because the tenant scope is enforced at the table layer, not on raw file paths.SSRF when `httpfs` is loaded (any S3-backed deployment) — `read_csv_auto('http://169.254.169.254/latest/meta-data/...')` reaches instance metadata IPs.PatchesFixed in 2026.06.1 (PR #442) via a structural sandbox at the DuckDB layer:`SET GLOBAL allowed_directories = [...]` enumerates Arc's legitimate filesystem prefixes (storage roots + tier prefixes + import upload dir + compaction temp).`SET GLOBAL enable_external_access = false` (one-way at runtime).Verified by reading back the flag.After lockdown, DuckDB refuses to open any file outside the allowlist and refuses further `INSTALL`/`LOAD`. Already-loaded extensions remain callable.WorkaroundsRestrict API access to known-trusted networks via firewall rules.Temporary mitigation: add `read_csv*`/`read_json*`/`glob` etc. to `dangerousSQLPattern` in `internal/api/query.go` pending 2026.06.1.CreditsReported by Alex Manson ([@NeuroWinter](https://github.com/NeuroWinter), https://neurowinter.com/) on 2026-05-19.
CVSS v4.0: 7.1
CVE-2026-42794: Reflected XSS via backslash bypass in GraphiQL js_escape in absinthe_plug
Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in absinthe-graphql absinthe_plug allows reflected cross-site scripting via the GraphiQL interface.

'Elixir.Absinthe.Plug.GraphiQL':js_escape/1 in lib/absinthe/plug/graphiql.ex escapes single quotes and newlines in the query GET parameter before embedding it in an inline JavaScript string, but does not escape backslashes. An attacker can bypass the escaping by prefixing a quote with a backslash (e.g. \'), breaking out of the string context and executing arbitrary JavaScript in the victim's browser.

This issue affects absinthe_plug: from 1.2.0 before 1.5.10.
CVSS v4.0: 2.3
GHSA-fjmr-jwp3-2g59: Possible unauthorized memory access in the hypervisor. Incorrect configuration provides access to subsystem page tables. Product: Android. Versions: Kernel 3.18. Android ID: A-32576499. References: QC-CR#964185.
CVSS v3.0: 7.8
CVE-2017-5472: A use-after-free vulnerability with the frameloader during tree reconstruction while regenerating CSS layout when attempting to use a node in the tree that no longer exists. This results in a potentially exploitable crash. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
GHSA-7f84-77mg-9mgg: Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations.
CVSS v3.0: 9.8
GHSA-v55w-rvx7-pq26: A missing authentication for critical function vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions, FortiOS 6.2.9 through 6.2.17 allows attacker to execute unauthorized code or commands via specially crafted packets.
CVSS v3.1: 6.5
GHSA-3vfp-fjr2-hwh6: Cross-site scripting (XSS) vulnerability in the Import Legacy Media plugin 0.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filename parameter to getid3/demos/demo.mimeonly.php.
CVE-2025-32233: WordPress Revive.so plugin <= 2.0.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in WP Chill Revive.so revive-so allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Revive.so: from n/a through <= 2.0.3.
CVSS v3.1: 4.3
CVE-2025-37883: s390/sclp: Add check for get_zeroed_page()
In the Linux kernel, the following vulnerability has been resolved:

s390/sclp: Add check for get_zeroed_page()

Add check for the return value of get_zeroed_page() in
sclp_console_init() to prevent null pointer dereference.
Furthermore, to solve the memory leak caused by the loop
allocation, add a free helper to do the free job.
CVSS v3.1: 5.5
RHSA-2024:0627: Red Hat Security Advisory: gnutls security update
gnutls: incomplete fix for CVE-2023-5981
CVSS v3.1: 7.5
GHSA-9xj3-pxmc-gv6m: In the Linux kernel, the following vulnerability has been resolved:Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb()Add the same NULL guard already present in
l2cap_sock_resume_cb() and l2cap_sock_ready_cb().
CVSS v3.1: 5.5
CVE-2023-52028: TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the setTracerouteCfg function.
CVSS v3.1: 9.8
GHSA-j6q3-j45m-mw2x: A vulnerability was found in ZKTeco ZKBio CVSecurity V5000 4.1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Summer Schedule Handler. The manipulation of the argument Schedule Name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-268694 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 5.3
CVSS v3.1: 3.5
CVE-2024-1853: Zemana AntiLogger v2.74.204.664 - Arbitrary Process Termination
Zemana AntiLogger v2.74.204.664 is vulnerable to an Arbitrary Process Termination vulnerability by triggering the 0x80002048 IOCTL code of the zam64.sys and zamguard64.sys drivers.


CVSS v3.1: 5.5
CVE-2020-9812: An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, watchOS 6.2.5. A local user may be able to read kernel memory.
CVSS v3.1: 5.5
CVSS v2.0: 7.1
GHSA-99f6-2857-qp6f: SAP NetWeaver Enterprise Portal (KMC) - version 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability. KMC servlet is vulnerable to XSS attack. The execution of script content by a victim registered on the portal could compromise the confidentiality and integrity of victim’s web browser session.
CVSS v3.1: 6.1
CVE-2017-17695: Techno - Portfolio Management Panel through 2017-11-16 allows SQL Injection via the panel/search.php s parameter.
CVSS v3.0: 8.8
CVSS v2.0: 6.5
CVE-2022-0150: WP Accessibility Helper (WAH) < 0.6.0.7 - Reflected Cross-Site Scripting (XSS)
The WP Accessibility Helper (WAH) WordPress plugin before 0.6.0.7 does not sanitise and escape the wahi parameter before outputting back its base64 decode value in the page, leading to a Reflected Cross-Site Scripting issue
CVSS v3.1: 6.1
CVSS v2.0: 4.3
cisco-sa-20191106-wsa-xss: Cisco Web Security Appliance Management Interface Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface of an affected device.

The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script or HTML code in the context of the interface, which could allow the attacker to gain access to sensitive, browser-based information.

There are no workarounds that address this vulnerability.

This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191106-wsa-xss ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191106-wsa-xss"]
CVSS v3.0: 6.1
RHSA-2016:1594: Red Hat Security Advisory: python-django security update
django: XSS in admin's add/change related popup
CVSS v3.0: 6.1
GHSA-q9wj-wcmj-8r7j: Cross-site scripting (XSS) vulnerability in the Administration Console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.29 and 7.1 before 7.0.0.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
RHSA-2025:0440: Red Hat Security Advisory: iperf3 security update
iperf: Denial of Service in iperf Due to Improper JSON Handling
CVSS v3.1: 7.5
CVE-2024-5575: Ditty < 3.1.43 - Author+ Stored XSS
The Ditty  WordPress plugin before 3.1.43 does not sanitise and escape some of its blocks' settings, which could allow high privilege users such as authors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
CVSS v3.1: 4.7
GHSA-5mmc-9chw-pm3p: The x86 emulator in Xen does not properly treat x86 NULL segments as unusable when accessing memory, which might allow local HVM guest users to gain privileges via vectors involving "unexpected" base/limit values.
CVSS v3.0: 7.8
GHSA-vvrg-mw82-38g2: Previous versions of Puppet Agent didn't verify the peer in the SSL connection prior to downloading the CRL. This issue is resolved in Puppet Agent 6.4.0.