ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-j497-52cv-pcp6: Buffer overflow in IBM WebSphere MQ 7.0 before 7.0.1.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted header field in a message.
GHSA-2g7p-7mvp-pw7m: Improper Control of Generation of Code ('Code Injection') vulnerability in Inpersttion Slivery Extender allows Code Injection.This issue affects Slivery Extender: from n/a through 1.0.2.
CVSS v3.1: 8.5
GHSA-6hm8-g2pm-5vgv: IBM Aspera Console 3.4.7 stores potentially sensitive information in log files that could be read by a local privileged user.
CVSS v3.1: 4.9
RHSA-2025:19106: Red Hat Security Advisory: kernel security update
kernel: NFS: Fix a race when updating an existing write kernel: vsock/virtio: Validate length in packet header before skb_put() kernel: mm: swap: fix potential buffer overflow in setup_clusters() kernel: NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() kernel: Linux kernel ALSA hda/ca0132 buffer overflow kernel: wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result()
CVSS v3.1: 7.5
GHSA-4xrm-h47x-xc5h: The Designs Nail Arts (aka com.decoracionesnailart.flickr) application 3.6.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
GHSA-8ph5-wgc5-5jj9: A hardware vulnerability in GPU memory modules allows attackers to accelerate micro-architectural attacks through the use of the JavaScript WebGL API.
CVSS v3.0: 4.8
CVE-2021-28969: eMPS 9.0.1.923211 on FireEye EX 3500 devices allows remote authenticated users to conduct SQL injection attacks via the sort_by parameter to the email search feature. According to the vendor, the issue is fixed in 9.0.3. NOTE: this is different from CVE-2020-25034 and affects newer versions of the software.
CVSS v3.1: 6.5
CVSS v2.0: 4
CVE-2016-5016: Pivotal Cloud Foundry 239 and earlier, UAA (aka User Account and Authentication Server) 3.4.1 and earlier, UAA release 12.2 and earlier, PCF (aka Pivotal Cloud Foundry) Elastic Runtime 1.6.x before 1.6.35, and PCF Elastic Runtime 1.7.x before 1.7.13 does not validate if a certificate is expired.
CVSS v3.0: 5.9
CVSS v2.0: 4.3
CVE-2013-2723: Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-2718, CVE-2013-2719, CVE-2013-2720, CVE-2013-2721, CVE-2013-2722, CVE-2013-2725, CVE-2013-2726, CVE-2013-2731, CVE-2013-2732, CVE-2013-2734, CVE-2013-2735, CVE-2013-2736, CVE-2013-3337, CVE-2013-3338, CVE-2013-3339, CVE-2013-3340, and CVE-2013-3341.
CVSS v2.0: 10
CVE-2018-15909: In Artifex Ghostscript 9.23 before 2018-08-24, a type confusion using the .shfill operator could be used by attackers able to supply crafted PostScript files to crash the interpreter or potentially execute code.
CVSS v3.0: 7.8
CVSS v2.0: 6.8
GHSA-55qq-jmpr-33w8: ftpd.c in (1) wu-ftpd 2.4.2 and (2) ftpd in HP HP-UX B.11.11 assigns uid 0 to the FTP client in certain operating-system misconfigurations in which PAM authentication can succeed even though no passwd entry is available for a user, which allows remote attackers to gain privileges, as demonstrated by a login attempt for an LDAP account when nsswitch.conf does not specify LDAP for passwd information.
GHSA-q2xq-8h7m-vrfm: Missing input validation in the ar/tar implementations of APT before version 2.1.2 could result in denial of service when processing specially crafted deb files.
CVSS v3.1: 5.5
CVE-2026-54019: Open WebUI: RAG ACL Bypass in Milvus Multitenancy Mode
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI added collection-level ACL checks, but the patch can still be bypassed when Milvus multitenancy mode is enabled. The ACL allows unknown non-KB collection names as legacy/ephemeral collections. In Milvus multitenancy mode, that user-controlled collection name becomes a resource_id and is interpolated into a Milvus expression without escaping. This is caused by an incomplete fix for CVE-2026-44560 This vulnerability is fixed in 0.9.6.
CVSS v3.1: 6.5
CVE-2021-33743: Windows Projected File System Elevation of Privilege Vulnerability
Windows Projected File System Elevation of Privilege Vulnerability
CVSS v3.1: 7.8
GHSA-qc8c-7fc5-pwj5: Unspecified vulnerability in the webcontainer implementation in IBM Lotus Sametime Connect 8.5.1 before CF1 has unknown impact and attack vectors, aka SPRs LXUU87S57H and LXUU87S93W.
GHSA-wwmh-65qv-chwq: Certain Federal Office of Information Technology Systems and Telecommunication FOITT products are affected by improper handling of exceptional conditions. This affects COVID Certificate App IOS 2.2.0 and below affected, patch in progress and COVID Certificate Check App IOS 2.2.0 and below affected, patch in progress. A denial of service (physically proximate) could be caused by scanning a crafted QR code.
CVE-2015-8948: idn in GNU libidn before 1.33 might allow remote attackers to obtain sensitive memory information by reading a zero byte as input, which triggers an out-of-bounds read.
CVSS v3.0: 7.5
CVSS v2.0: 5
CVE-2026-44788: SharpCompress: Directory traversal via directory entries in WriteToDirectory (zip slip variant)
SharpCompress is a fully managed C# library to deal with many compression types and formats. In 0.47.4 and earlier, a path traversal vulnerability in IArchive.WriteToDirectory() allows a malicious archive to create directories outside the intended extraction root. For TAR archives, this can be escalated to arbitrary file writes by chaining with a symlink entry, giving a full write primitive on the target filesystem subject to the permissions of the running process.
CVSS v3.1: 5.9
GHSA-2679-hjp3-6965: The mintToken function of a smart contract implementation for VSCToken, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS v3.0: 7.5
CVE-2018-18023: In ImageMagick 7.0.8-13 Q16, there is a heap-based buffer over-read in the SVGStripString function of coders/svg.c, which allows attackers to cause a denial of service via a crafted SVG image file.
CVSS v3.0: 6.5
CVSS v2.0: 4.3
CVE-2022-36258: A SQL injection vulnerability in CustomerDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via the parameters such as "searchTxt".
CVSS v3.1: 7.5
CVE-2011-4579: The svq1_decode_frame function in the SVQ1 decoder (svq1dec.c) in libavcodec in FFmpeg 0.5.x before 0.5.7, 0.6.x before 0.6.4, 0.7.x before 0.7.9, and 0.8.x before 0.8.8; and in Libav 0.5.x before 0.5.6, 0.6.x before 0.6.4, and 0.7.x before 0.7.3 allows remote attackers to cause a denial of service (memory corruption) via a crafted SVQ1 stream, related to "dimensions changed."
CVSS v2.0: 4.3
CVE-2003-1213: The default installation of MaxWebPortal 1.30 stores the portal database under the web document root with insecure access control, which allows remote attackers to obtain sensitive information via a direct request to database/db2000.mdb.
CVSS v2.0: 7.5
GHSA-vm8v-fr63-mfh4: In the Linux kernel, the following vulnerability has been resolved:flow_dissector: do not dissect PPPoE PFC framesRFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT
RECOMMENDED for PPPoE. In practice, pppd does not support negotiating
PFC for PPPoE sessions, and the flow dissector driver has assumed an
uncompressed frame until the blamed commit.During the review process of that commit [1], support for PFC is
suggested. However, having a compressed (1-byte) protocol field means
the subsequent PPP payload is shifted by one byte, causing 4-byte
misalignment for the network header and an unaligned access exception
on some architectures.The exception can be reproduced by sending a PPPoE PFC frame to an
ethernet interface of a MIPS board, with RPS enabled, even if no PPPoE
session is active on that interface:$ 0   : 00000000 80c40000 00000000 85144817
$ 4   : 00000008 00000100 80a75758 81dc9bb8
$ 8   : 00000010 8087ae2c 0000003d 00000000
$12   : 000000e0 00000039 00000000 00000000
$16   : 85043240 80a75758 81dc9bb8 00006488
$20   : 0000002f 00000007 85144810 80a70000
$24   : 81d1bda0 00000000
$28   : 81dc8000 81dc9aa8 00000000 805ead08
Hi    : 00009d51
Lo    : 2163358a
epc   : 805e91f0 __skb_flow_dissect+0x1b0/0x1b50
ra    : 805ead08 __skb_get_hash_net+0x74/0x12c
Status: 11000403        KERNEL EXL IE
Cause : 40800010 (ExcCode 04)
BadVA : 85144817
PrId  : 0001992f (MIPS 1004Kc)
Call Trace:
[<805e91f0>] __skb_flow_dissect+0x1b0/0x1b50
[<805ead08>] __skb_get_hash_net+0x74/0x12c
[<805ef330>] get_rps_cpu+0x1b8/0x3fc
[<805fca70>] netif_receive_skb_list_internal+0x324/0x364
[<805fd120>] napi_complete_done+0x68/0x2a4
[<8058de5c>] mtk_napi_rx+0x228/0xfec
[<805fd398>] __napi_poll+0x3c/0x1c4
[<805fd754>] napi_threaded_poll_loop+0x234/0x29c
[<805fd848>] napi_threaded_poll+0x8c/0xb0
[<80053544>] kthread+0x104/0x12c
[<80002bd8>] ret_from_kernel_thread+0x14/0x1cCode: 02d51821  1060045b  00000000 <8c640000> 3084000f  2c820005  144001a2  00042080  8e220000To reduce the attack surface and maintain performance, do not process
PPPoE PFC frames.[1] https://lore.kernel.org/r/20220630231016.GA392@debian.home
CVSS v3.1: 7.5
GHSA-5m9f-jxr5-6jv9: A malformed input file can lead to a segfault due to an out of bounds array access in raptor_xml_writer_start_element_common.
CVSS v3.1: 6.5
GHSA-86jf-f87h-wc84: In zsh before 5.3, an off-by-one error resulted in undersized buffers that were intended to support PATH_MAX characters.
CVSS v3.0: 9.8
GHSA-4f9r-x588-pp2h: Fleet's user account creation via invite does not enforce invited email address
SummaryFleet contained an issue in the user invitation flow where the email address provided during invite acceptance was not validated against the email address associated with the invite. An attacker who obtained a valid invite token could create an account under an arbitrary email address while inheriting the role granted by the invite, including global admin.ImpactIf an attacker gains access to a valid invite token, they can create a Fleet user account with an email address of their choosing while inheriting the invite’s assigned role and team memberships.This issue:Requires possession of a valid invite tokenDoes not bypass authentication controls beyond invite-based account creationDoes not expose data without successful account creationWorkaroundsIf upgrading immediately is not possible:Treat invite links as sensitive credentials and avoid sharing them in public or semi-public channels (e.g., Slack, Teams).Revoke and reissue invites if there is any concern that an invite link may have been exposed.Prefer issuing invites with the minimum required privileges and elevating roles after account creation when appropriate.For more informationIf there are any questions or comments about this advisory:Send an email to [security@fleetdm.com](mailto:security@fleetdm.com)CreditsFleet thanks @fuzzztf for responsibly reporting this issue.
CVSS v4.0: 4.9
CVE-2021-31961: Windows InstallService Elevation of Privilege Vulnerability
Windows InstallService Elevation of Privilege Vulnerability
CVSS v3.1: 6.1
CVE-2015-8873: Stack consumption vulnerability in Zend/zend_exceptions.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allows remote attackers to cause a denial of service (segmentation fault) via recursive method calls.
CVSS v3.1: 7.5
CVSS v2.0: 5
CVE-2005-3909: SQL injection vulnerability in merchants/index.php in Post Affiliate Pro 2.0.4 and earlier allows remote attackers to execute arbitrary SQL commands via the sortorder parameter.
CVSS v2.0: 7.5
GHSA-8pxw-9c75-6w56: NeuVector admin account has insecure default password
ImpactA vulnerability exists in NeuVector versions up to and including **5.4.5**, where a fixed string is used as the default password for the built-in `admin` account. If this password is not changed immediately after deployment, any workload with network access within the cluster could use the default credentials to obtain an authentication token. This token can then be used to perform any operation via NeuVector APIs.In earlier versions, NeuVector supports setting the default (bootstrap) password for the `admin` account using a Kubernetes Secret named `neuvector-bootstrap-secret`. This Secret must contain a key named `bootstrapPassword`. However, if NeuVector fails to retrieve this value, it falls back to the fixed default password.PatchesThis issue is resolved in NeuVector version **5.4.6** and later. For rolling upgrades, it's strongly recommended to change the default `admin` password to a secure one.Starting from version **5.4.6**, NeuVector introduces additional Kubernetes RBAC permissions to ensure the bootstrap password can be securely managed via Secrets:These RBAC roles are automatically applied when deploying via Helm.If deploying or upgrading manually, you must create these roles before starting NeuVector.**NOTE:** If these roles are not present, the NeuVector controller (from version 5.4.6 onward) does not start.Behavior in Patched Versions**Upgrades:** NeuVector does not reset any existing account passwords. It's strongly recommended to change the default `admin` password to a secure one.**New deployments:**If `bootstrapPassword` is not set in the `neuvector-bootstrap-secret, NeuVector generates a secure password and stores it in the same Secret.On first login, the default `admin` must retrieve the password using:The password must be changed during the first login via the NeuVector UI.**NOTE:** If the default `admin` password is set using a Kubernetes ConfigMap or a persistent backup (not a fixed string), this value takes precedence over the Secret-based mechanism.WorkaroundsFor existing vulnerable versions, log in to the NeuVector UI immediately after deployment and update the default `admin` password.ReferencesIf you have any questions or comments about this advisory:Reach out to the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.Open an issue in the [NeuVector](https://github.com/neuvector/neuvector/issues/new/choose) repository.Verify with our [support matrix](https://www.suse.com/suse-neuvector/support-matrix/all-supported-versions/neuvector-v-all-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/#suse-security).
CVSS v3.1: 9.8
GHSA-frrc-qvjw-hwj9: It was found that 389-ds-base since 1.3.6.1 up to and including 1.4.0.3 did not always handle internal hash comparison operations correctly during the authentication process. A remote, unauthenticated attacker could potentially use this flaw to bypass the authentication process under very rare and specific circumstances.
CVSS v3.0: 8.1
CVE-2024-5315: Multiple vulnerabilities in DOLIBARR's ERP CMS
Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in the database through the parameters 

viewstatut in /dolibarr/commande/list.php.
CVSS v3.1: 9.1
CVE-2022-35488: In Zammad 5.2.0, an attacker could manipulate the rate limiting in the 'forgot password' feature of Zammad, and thereby send many requests for a known account to cause Denial Of Service by many generated emails which would also spam the victim.
CVSS v3.1: 7.5
CVE-2024-54398: WordPress Flaming Forms plugin <= 1.0.1 - CSRF to Stored XSS vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in jcaruso001 Flaming Forms flaming-forms allows Stored XSS.This issue affects Flaming Forms: from n/a through <= 1.0.1.
CVSS v3.1: 7.1
CVE-2025-20784: In display, there is a possible memory corruption due to uninitialized data. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10182882; Issue ID: MSV-4683.
CVSS v3.1: 6.7
CVE-2013-3173: Buffer overflow in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT allows local users to gain privileges via a crafted application that leverages improper handling of objects in memory, aka "Win32k Buffer Overwrite Vulnerability."
CVSS v2.0: 7.2
RHSA-2023:0190: Red Hat Security Advisory: java-17-openjdk security update
OpenJDK: handshake DoS attack against DTLS connections (JSSE, 8287411) OpenJDK: soundbank URL remote loading (Sound, 8293742)
CVSS v3.1: 3.7
CVE-2002-1462: details2.php in OrganicPHP PHP-affiliate 1.0, and possibly later versions, allows remote attackers to modify information of other users by modifying certain hidden form fields.
CVSS v2.0: 5
CVE-2026-24361: WordPress LearnPress – Course Review plugin <= 4.1.9 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress LearnPress – Course Review learnpress-course-review allows Stored XSS.This issue affects LearnPress – Course Review: from n/a through <= 4.1.9.
CVSS v3.1: 6.5
GHSA-4g84-qrqg-4cjp: Cross-site scripting (XSS) vulnerability in display_dialog.php in M2 OptimalSite 0.1 and 2.4 allows remote attackers to inject arbitrary web script or HTML via the image parameter.
CVE-2026-33628: Invoice Ninja Denylist Bypass may Lead to Stored XSS via Invoice Line Items
Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel. Invoice line item descriptions in Invoice Ninja v5.13.0 bypass the XSS denylist filter, allowing stored XSS payloads to execute when invoices are rendered in the PDF preview or client portal. The line item description field was not passed through `purify::clean()` before rendering. This is fixed in v5.13.4 by the vendor by adding `purify::clean()` to sanitize line item descriptions.
CVSS v3.1: 5.4
GHSA-w2mg-683w-6gr8: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nazmur Rahman Text Selection Color allows Stored XSS. This issue affects Text Selection Color: from n/a through 1.6.
CVSS v3.1: 5.9
RHSA-2024:2776: Red Hat Security Advisory: OpenShift Container Platform 4.15.13 packages and security update
jose-go: improper handling of highly compressed data
CVSS v3.1: 4.3
GHSA-crvf-pv9v-3xvj: In the Linux kernel, the following vulnerability has been resolved:mm/rmap: fix potential out-of-bounds page table access during batched unmapAs pointed out by David[1], the batched unmap logic in
try_to_unmap_one() may read past the end of a PTE table when a large
folio's PTE mappings are not fully contained within a single page
table.While this scenario might be rare, an issue triggerable from userspace
must be fixed regardless of its likelihood.  This patch fixes the
out-of-bounds access by refactoring the logic into a new helper,
folio_unmap_pte_batch().The new helper correctly calculates the safe batch size by capping the
scan at both the VMA and PMD boundaries.  To simplify the code, it also
supports partial batching (i.e., any number of pages from 1 up to the
calculated safe maximum), as there is no strong reason to special-case
for fully mapped folios.
CVSS v3.1: 7.1
GHSA-m295-m3x4-3mmc: Jenkins Libvirt Slaves Plugin vlnerable to Cross-Site Request Forgery
A cross-site request forgery vulnerability in Jenkins Libvirt Slaves Plugin allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVSS v3.1: 8.8
CVE-1999-1263: Metamail before 2.7-7.2 allows remote attackers to overwrite arbitrary files via an e-mail message containing a uuencoded attachment that specifies the full pathname for the file to be modified, which is processed by uuencode in Metamail scripts such as sun-audio-file.
CVSS v2.0: 2.6
GHSA-hh5q-529x-q322: The strnlen_user function in Linux kernel before 2.6.16 on IBM S/390 can return an incorrect value, which allows local users to cause a denial of service via unknown vectors.
GHSA-pxp2-fv6q-mfmr: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eskom Computer Water Metering Software allows Command Line Execution through SQL Injection.This issue affects Water Metering Software: before 23.04.06.
CVSS v3.1: 9.8
GHSA-7g5p-gwhh-rffh: Stack-based buffer overflow in kl1.sys in Kaspersky Anti-Virus 6.0 and 7.0 and Internet Security 6.0 and 7.0 allows local users to gain privileges via an IOCTL 0x800520e8 call.
GHSA-2wq7-hx2p-5748: Improper authorization in Azure Bot Framework SDK allows an unauthorized attacker to elevate privileges over a network.
CVSS v3.1: 8.7
CVE-2005-4717: Microsoft Internet Explorer 6.0 on Windows NT 4.0 SP6a, Windows 2000 SP4, Windows XP SP1, Windows XP SP2, and Windows Server 2003 SP1 allows remote attackers to cause a denial of service (client crash) via a certain combination of a malformed HTML file and a CSS file that triggers a null dereference, probably related to rendering of a DIV element that contains a malformed IMG tag, as demonstrated by IEcrash.htm and IEcrash.rar.
CVSS v2.0: 5
GHSA-v77c-hvv5-38w8: Microsoft DWM Core Library Elevation of Privilege Vulnerability
CVSS v3.1: 7.8
CVE-2009-5151: The stub component of Absolute Computrace Agent V70.785 executes code from a disk's inter-partition space without requiring a digital signature for that code, which allows attackers to execute code on the BIOS. This allows a privileged local user to achieve persistent control of BIOS behavior, independent of later disk changes.
CVSS v3.0: 6.7
CVSS v2.0: 7.2
CVE-2026-5823: itsourcecode Construction Management System borrowed_tool_report.php sql injection
A weakness has been identified in itsourcecode Construction Management System 1.0. Affected by this issue is some unknown functionality of the file /borrowed_tool_report.php. This manipulation of the argument Home causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
RHSA-2024:11346: Red Hat Security Advisory: gstreamer1-plugins-good security update
gstreamer1-plugins-good: OOB-write in isomp4/qtdemux.c gstreamer1-plugins-good: OOB-write in convert_to_s334_1a gstreamer1-plugins-good: uninitialized stack memory in Matroska/WebM demuxer gstreamer1-plugins-good: integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes gstreamer1-plugins-good: null pointer dereference in gst_gdk_pixbuf_dec_flush
CVSS v3.1: 6.5
GHSA-3gf7-4rgh-4xjv: A elevation of privilege vulnerability in the Upstream Linux linux kernel. Product: Android. Versions: Android kernel. Android ID: A-36007735.
CVSS v3.0: 7.8
CVE-2019-15722: An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.2.1. Particular mathematical expressions in GitLab Markdown can exhaust client resources.
CVSS v3.1: 7.5
CVSS v2.0: 5
GHSA-cfp2-gfv9-jqxx: The WordPress Google Map Professional (Map In Your Language) WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS v3.1: 6.1