ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2023-49127: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
CVSS v3.1: 7.8
CVE-2004-0257: OpenBSD 3.4 and NetBSD 1.6 and 1.6.1 allow remote attackers to cause a denial of service (crash) by sending an IPv6 packet with a small MTU to a listening port and then issuing a TCP connect to that port.
CVSS v2.0: 5
CVE-2023-54312: samples/bpf: Fix buffer overflow in tcp_basertt
In the Linux kernel, the following vulnerability has been resolved:

samples/bpf: Fix buffer overflow in tcp_basertt

Using sizeof(nv) or strlen(nv)+1 is correct.
GHSA-q738-7qq7-r8ff: Command Injection in the CPE WAN Management Protocol (CWMP) registration in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6xx series, Aria7/AK7Xx series and Kami7B allows man-in-the-middle attackers to execute arbitrary commands with root level privileges.
CVE-2014-1575: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 33.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to improper interaction between threading and garbage collection in the GCRuntime::triggerGC function in js/src/jsgc.cpp, and unknown other vectors.
CVSS v2.0: 7.5
CVE-2016-6501: JFrog Artifactory before 4.11 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted serialized Java object, aka LDAP entry poisoning.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
CVE-2025-11991: JetFormBuilder <= 3.5.3 - Missing Authorization to Unauthenticated Form Generation
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the run_callback function in all versions up to, and including, 3.5.3. This makes it possible for unauthenticated attackers to generate forms using AI, consuming site's AI usage limits.
CVSS v3.1: 5.3
CVE-2018-15891: An issue was discovered in FreePBX core before 3.0.122.43, 14.0.18.34, and 5.0.1beta4. By crafting a request for adding Asterisk modules, an attacker is able to store JavaScript commands in a module name.
CVSS v3.0: 4.8
CVSS v2.0: 3.5
CVE-2025-40286: smb/server: fix possible memory leak in smb2_read()
In the Linux kernel, the following vulnerability has been resolved:

smb/server: fix possible memory leak in smb2_read()

Memory leak occurs when ksmbd_vfs_read() fails.
Fix this by adding the missing kvfree().
GHSA-qqvg-8fp4-2xff: CEWE PHOTO IMPORTER 6.4.3 contains a denial of service vulnerability that allows local attackers to crash the application by importing a specially crafted image file. Attackers can create a malformed JPG file with an oversized buffer and trigger the crash through the import functionality during the image processing workflow.
CVSS v4.0: 6.9
CVSS v3.1: 6.2
CVE-2025-62798: Sharp user-provided input can be evaluated in a SharpShowTextField with Vue template syntax
Sharp is a content management framework built for Laravel as a package. Prior to 9.11.1, a Cross-Site Scripting (XSS) vulnerability was discovered in code16/sharp when rendering content using the SharpShowTextField component. In affected versions, expressions wrapped in {{ & }} were evaluated by Vue. This allowed attackers to inject arbitrary JavaScript or HTML that executes in the browser when the field is displayed. The issue has been fixed in v9.11.1 .
CVSS v3.1: 5.4
GHSA-88gj-pxgp-vc28: Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS v3.1: 4.2
CVE-2011-0721: Multiple CRLF injection vulnerabilities in (1) chfn and (2) chsh in shadow 1:4.1.4 allow local users to add new users or groups to /etc/passwd via the GECOS field.
CVSS v2.0: 6.4
GHSA-wh7h-j72f-r8p8: libpcp in Performance Co-Pilot (PCP) before 3.6.5 allows remote attackers to cause a denial of service and possibly execute arbitrary code via (1) a PDU with the numcreds field value greater than the number of actual elements to the __pmDecodeCreds function in p_creds.c; (2) the string byte number value to the __pmDecodeNameList function in p_pmns.c; (3) the numids value to the __pmDecodeIDList function in p_pmns.c; (4) unspecified vectors to the __pmDecodeProfile function in p_profile.c; the (5) status number value or (6) string number value to the __pmDecodeNameList function in p_pmns.c; (7) certain input to the __pmDecodeResult function in p_result.c; (8) the name length field (namelen) to the DecodeNameReq function in p_pmns.c; (9) a crafted PDU_FETCH request to the __pmDecodeFetch function in p_fetch.c; (10) the namelen field in the __pmDecodeInstanceReq function in p_instance.c; (11) the buflen field to the __pmDecodeText function in p_text.c; (12) PDU_INSTANCE packets to the __pmDecodeInstance in p_instance.c; or the (13) c_numpmid or (14) v_numval fields to the __pmDecodeLogControl function in p_lcontrol.c, which triggers integer overflows, heap-based buffer overflows, and/or buffer over-reads.
CVE-2020-9636: Adobe Framemaker versions 2019.0.5 and below have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS v3.1: 8.8
CVSS v2.0: 6.8
GHSA-889g-6x77-qwm5: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webilop WooCommerce HTML5 Video allows Reflected XSS. This issue affects WooCommerce HTML5 Video: from n/a through 1.7.10.
CVSS v3.1: 7.1
RHSA-2015:1188: Red Hat Security Advisory: chromium-browser security update
chromium-browser: Scheme validation error in WebUI chromium-browser: Cross-origin bypass in Blink chromium-browser: Cross-origin bypass in Blink chromium-browser: Normalization error in HSTS/HPKP preload list
CVE-2009-0867: The HRM-S service in Fujitsu Enhanced Support Facility 3.0 and 3.0.1 allows remote attackers to obtain (1) hardware and (2) software information via unspecified requests in a client connection.
CVSS v2.0: 5
CVE-2020-15364: The Nexos theme through 1.7 for WordPress allows top-map/?search_location= reflected XSS.
CVSS v3.1: 6.1
CVSS v2.0: 4.3
GHSA-h7wr-5x75-2c5h: A post-authenticated vulnerability in SonicWall SMA100 allows an attacker to export the configuration file to the specified email address. This vulnerability impacts SMA100 version 10.2.0.5 and earlier.
CVE-2024-23340: @hono/node-server can't handle "double dots" in URL
@hono/node-server is an adapter that allows users to run Hono applications on Node.js. Since v1.3.0, @hono/node-server has used its own Request object with `url` behavior that is unexpected. In the standard API, if the URL contains `..`, here called "double dots", the URL string returned by Request will be in the resolved path. However, the `url` in @hono/node-server's Request as does not resolve double dots, so `http://localhost/static/.. /foo.txt` is returned. This causes vulnerabilities when using `serveStatic`. Modern web browsers and a latest `curl` command resolve double dots on the client side, so this issue doesn't affect those using either of those tools. However, problems may occur if accessed by a client that does not resolve them. Version 1.4.1 includes the change to fix this issue. As a workaround, don't use `serveStatic`.


CVSS v3.1: 5.3
CVE-2015-6718: The CBSharedReviewIfOfflineDialog method in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-6707, CVE-2015-6708, CVE-2015-6709, CVE-2015-6710, CVE-2015-6711, CVE-2015-6712, CVE-2015-6713, CVE-2015-6714, CVE-2015-6715, CVE-2015-6716, CVE-2015-6717, CVE-2015-6719, CVE-2015-6720, CVE-2015-6721, CVE-2015-6722, CVE-2015-6723, CVE-2015-6724, CVE-2015-6725, CVE-2015-7614, CVE-2015-7616, CVE-2015-7618, CVE-2015-7619, CVE-2015-7620, and CVE-2015-7623.
CVSS v2.0: 6.8
RHSA-2026:8437: Red Hat Security Advisory: RHTAS 1.4 - GA Release of Model Transparency
pyOpenSSL: DTLS cookie callback buffer overflow pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)
CVSS v3.1: 7.5
CVSS v3.0: 7.5
CVE-2012-0881: Apache Xerces2 Java Parser before 2.12.0 allows remote attackers to cause a denial of service (CPU consumption) via a crafted message to an XML service, which triggers hash table collisions.
CVSS v3.0: 7.5
CVSS v2.0: 7.8
cisco-sa-ipcamera-lldp-mem-wGqundTq: Cisco Video Surveillance 7000 Series IP Cameras Link Layer Discovery Protocol Memory Leak Vulnerabilities
Multiple vulnerabilities in the Link Layer Discovery Protocol (LLDP) implementation for Cisco Video Surveillance 7000 Series IP Cameras could allow an unauthenticated, adjacent attacker to cause a memory leak, which could lead to a denial of service (DoS) condition on an affected device.

These vulnerabilities are due to incorrect processing of certain LLDP packets at ingress time. An attacker could exploit these vulnerabilities by sending crafted LLDP packets to an affected device. A successful exploit could allow the attacker to cause the affected device to continuously consume memory, which could cause the device to crash and reload, resulting in a DoS condition.

Note: LLDP is a Layer 2 protocol. To exploit these vulnerabilities, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent).

Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.


CVSS v3.1: 6.5
GHSA-qc2v-4qpc-hvf2: Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13 allows remote attackers to take control of sessions via unspecified vectors related to the (1) commenting feature and (2) community script.
CVE-2015-8370: Multiple integer underflows in Grub2 1.98 through 2.02 allow physically proximate attackers to bypass authentication, obtain sensitive information, or cause a denial of service (disk corruption) via backspace characters in the (1) grub_username_get function in grub-core/normal/auth.c or the (2) grub_password_get function in lib/crypto.c, which trigger an "Off-by-two" or "Out of bounds overwrite" memory error.
CVSS v3.1: 7.4
CVSS v2.0: 6.9
CVE-2024-57045: A vulnerability in the D-Link DIR-859 router with firmware version A3 1.05 and earlier permits unauthorized individuals to bypass the authentication. An attacker can obtain a user name and password by forging a post request to the / getcfg.php page.
CVSS v3.1: 9.8
GHSA-52c2-xvqv-6rr4: Missing Authorization vulnerability in Salesforce Pardot.This issue affects Pardot: from n/a through 2.1.0.
CVSS v3.1: 4.3
CVE-2011-3880: Google Chrome before 15.0.874.102 does not prevent use of an unspecified special character as a delimiter in HTTP headers, which has unknown impact and remote attack vectors.
CVSS v2.0: 7.5
CVE-2023-31407: Cross-Site Scripting (XSS) vulnerability in SAP Business Planning and Consolidation
SAP Business Planning and Consolidation - versions 740, 750, allows an authorized attacker to upload a malicious file, resulting in Cross-Site Scripting vulnerability. After successful exploitation, an attacker can cause limited impact on confidentiality and integrity of the application.


CVSS v3.1: 5.4
GHSA-gfrm-669r-42x9: Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
CVSS v3.1: 6.5
GHSA-jx25-8rr2-353v: A vulnerability, which was classified as problematic, has been found in drogon up to 1.8.1. Affected by this issue is some unknown functionality of the component Session Hash Handler. The manipulation leads to small space of random values. The attack may be launched remotely. Upgrading to version 1.8.2 is able to address this issue. The name of the patch is c0d48da99f66aaada17bcd28b07741cac8697647. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-213464.
CVSS v3.1: 5.3
CVE-2025-4474: Frontend Dashboard 1.0 - 2.2.7 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via fed_admin_setting_form_function Function
The Frontend Dashboard plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the fed_admin_setting_form_function() function in versions 1.0 to 2.2.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the plugin’s 'register' role setting to make new user registrations default to the administrator role, leading to an elevation of privileges to that of an administrator.
CVSS v3.1: 8.8
GHSA-7f9m-hvg7-85rq: In multiple locations, there is a possible way to persistently DoS the device due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1: 7.1
RHSA-2017:1260: Red Hat Security Advisory: jboss-ec2-eap security, bug fix, and enhancement update
Resteasy: Yaml unmarshalling vulnerable to RCE
CVSS v3.0: 8.1
CVE-2014-3155: net/spdy/spdy_write_queue.cc in the SPDY implementation in Google Chrome before 35.0.1916.153 allows remote attackers to cause a denial of service (out-of-bounds read) by leveraging incorrect queue maintenance.
CVSS v2.0: 5
GHSA-j3x5-mghf-xvfw: Craft Commerce is Vulnerable to SQL Injection in Commerce Purchasables Table Sorting
SummaryCraft Commerce is vulnerable to **SQL Injection** in the purchasables table endpoint. The `sort` parameter is split by `|` and the first part (column name) is passed directly as an array key to `orderBy()` without whitelist validation. Yii2's query builder does **NOT** escape array keys, allowing an authenticated attacker to inject arbitrary SQL into the `ORDER BY` clause.PoCRequired PermissionsGeneralAccess the control panelAccess Craft CommerceCraft CommerceManage ordersEdit ordersSteps to reproduceLog in to the control panelNavigate to **Commerce** > **Orders** > Create a new orderClick on "Add a line item" to show the purchasables tableIntercept the AJAX request and modify the `sort` parameter as follows:Observe the delay in the response, confirming the injectionAlternatively, you can use the following `curl` (bash syntax) command (replace cookie and target domain as needed):ImpactWith this Blind SQLi, an attacker can:**Exfiltrate data** character-by-character (same technique as [GHSA-pmgj-gmm4-jh6j](https://github.com/craftcms/commerce/security/advisories/GHSA-pmgj-gmm4-jh6j)).**Modify or destroy data** (drop tables, update records, alter schema).
CVSS v4.0: 8.7
GHSA-9m3q-c2qh-cgvf: Missing Authorization vulnerability in CloudPanel CLP Varnish Cache clp-varnish-cache allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CLP Varnish Cache: from n/a through <= 1.0.2.
CVSS v3.1: 8.1
RHSA-2025:18984: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Container Release Update
langchain-text-splitters: XXE Vulnerability in langchain-text-splitters llama-index-core: Insecure Temporary File Handling in run-llama/llama_index django: Potential SQL injection in QuerySet.annotate(), alias(), aggregate(), and extra() on MySQL and MariaDB1 django: Potential partial directory-traversal via archive.extract()
CVSS v3.1: 8.8
GHSA-9hv9-fhrr-m92v: In N2W before 4.3.2 and 4.4.0 before 4.4.1, improper validation of API request parameters enables remote code execution.
CVSS v3.1: 9.8
GHSA-jmw5-58c7-587h: Apache Karaf Decanter has Deserialization of Untrusted Data in its Log Socket Collector
Deserialization of Untrusted Data vulnerability in Apache Karaf Decanter.The Decanter Log Socket Collector exposes port 4560 without authentication. If the collector exposes allowed classes property, this configuration can be bypassed. The Log Socket Collector is vulnerable to deserialization of untrusted data, eventually causing DoS.NB: Decanter Log Socket Collector is not installed by default. Users who have not installed the Decanter Log Socket are not impacted by this issue.This issue affects Apache Karaf Decanter before 2.12.0.Users are recommended to upgrade to version 2.12.0, which fixes the issue.
CVSS v3.1: 3.7
GHSA-3qxq-rx8j-qpmj: Cross-site scripting (XSS) vulnerability in the meta plugin in Ikiwiki before 1.1.47 allows remote attackers to inject arbitrary web script or HTML via meta tags.
GHSA-398j-r5c5-vrph: In Cloud Foundry router routing-release all versions prior to v0.163.0 and cf-release all versions prior to v274, in some applications, it is possible to append a combination of characters to the URL that will allow for an open redirect. An attacker could exploit this as a phishing attack to gain access to user credentials or other sensitive data. NOTE: 274 resolves the vulnerability but has a serious bug that is fixed in 275.
CVSS v3.0: 6.1
GHSA-m5p4-gvpx-4mvr: GuardDog: Unsanitized human-readable scan output allows terminal escape injection from malicious package content
SummaryGuardDog includes attacker-controlled filenames, file locations, messages, and code snippets in its default human-readable output without escaping terminal control characters. A malicious package can therefore inject ANSI or OSC escape sequences into analyst terminals or CI logs.DescriptionThe finding formatter stores file paths and snippets from scanned content:The human-readable reporter later prints these values directly:No escaping is applied for control characters such as `\x1b`. A malicious package can therefore ship a filename like:or matched source lines containing terminal escapes, which survive into the final CLI output.Reproduction summaryCreate a file whose name contains `\x1b[2J`.Feed a semgrep-style result referencing that file into `Analyzer._format_semgrep_response()`.Render the result with `HumanReadableReporter.print_scan_results()`.The output string contains the raw escape bytes, which a terminal may interpret.Key code paths`guarddog/analyzer/analyzer.py:377-392``guarddog/reporters/human_readable.py:36-42``guarddog/reporters/human_readable.py:84-91`Practical impactThis can be used to:clear or rewrite analyst terminal outputinject misleading or spoofed log content in CIemit clickable OSC 8 hyperlinks or title changes in compatible terminalsPrior public disclosure checkAs of 2026-03-18, no matching public GitHub advisory, CVE, or public repo issue was found for this specific bug.Suggested fixEscape or strip terminal control characters before rendering any attacker-controlled value in human-readable output. This should cover package names, file paths, messages, and code snippets.
CVSS v3.1: 5
CVE-2025-6821: code-projects Inventory Management System createOrder.php sql injection
A vulnerability was found in code-projects Inventory Management System 1.0. It has been classified as critical. This affects an unknown part of the file /php_action/createOrder.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 6.9
CVSS v3.1: 7.3
CVSS v3.0: 7.3
CVSS v2.0: 7.5
GHSA-5wjp-4jpf-wmfh: Elastic Enterprise Search App Search versions before 7.14.0 was vulnerable to an issue where API keys were not bound to the same engines as their creator. This could lead to a less privileged user gaining access to unauthorized engines.
CVE-2012-4210: The Style Inspector in Mozilla Firefox before 17.0 and Firefox ESR 10.x before 10.0.11 does not properly restrict the context of HTML markup and Cascading Style Sheets (CSS) token sequences, which allows user-assisted remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted stylesheet.
CVSS v2.0: 9.3
CVE-2024-31456: GLPI contains an authenticated SQL injection
GLPI is a Free Asset and IT Management Software package. Prior to 10.0.15, an authenticated user can exploit a SQL injection vulnerability from map search. This vulnerability is fixed in 10.0.15.
CVSS v3.1: 7.7
CVE-2022-30687: Trend Micro Maximum Security 2022 is vulnerable to a link following vulnerability that could allow a low privileged local user to manipulate the product's secure erase feature to delete arbitrary files.
CVSS v3.1: 7.1
CVSS v2.0: 6.6
CVE-2002-1449: eUpload 1.0 stores the password.txt password file in plaintext under the web document root, which allows remote attackers to overwrite arbitrary files by reading password.txt.
CVSS v2.0: 7.5
CVE-2023-53566: netfilter: nft_set_rbtree: fix null deref on element insertion
In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_set_rbtree: fix null deref on element insertion

There is no guarantee that rb_prev() will not return NULL in nft_rbtree_gc_elem():

general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]
 nft_add_set_elem+0x14b0/0x2990
  nf_tables_newsetelem+0x528/0xb30

Furthermore, there is a possible use-after-free while iterating,
'node' can be free'd so we need to cache the next value to use.
CVSS v3.1: 5.5
CVE-2023-39240: ASUS RT-AX55、RT-AX56U_V2 - Format String - 3

It is identified a format string vulnerability in ASUS RT-AX56U V2’s iperf client function API. This vulnerability is caused by lacking validation for a specific value within its set_iperf3_cli.cgi module. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.


CVSS v3.1: 7.2
CVE-2025-63421: An issue in filosoft Comerc.32 Commercial Invoicing v.16.0.0.3 allows a local attacker to execute arbitrary code via the comeinst.exe file
CVSS v3.1: 7.8
GHSA-994x-rh34-x939: IrfanView version 4.44 (32bit) allows remote attackers to execute code via a crafted .mov file, because of a "User Mode Write AV near NULL" issue.
CVSS v3.0: 7.8
CVE-2018-6188: django.contrib.auth.forms.AuthenticationForm in Django 2.0 before 2.0.2, and 1.11.8 and 1.11.9, allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirm_login_allowed() method, as demonstrated by discovering whether a user account is inactive.
CVSS v3.0: 7.5
CVSS v2.0: 5
GHSA-vj4v-72c4-7jpw: A vulnerability, which was classified as critical, was found in harry0703 MoneyPrinterTurbo up to 1.2.6. Affected is the function upload_bgm_file of the file app/controllers/v1/video.py of the component File Extension Handler. The manipulation of the argument File leads to unrestricted upload. It is possible to launch the attack remotely.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVE-2023-22094: Vulnerability in the MySQL Installer product of Oracle MySQL (component: Installer: General).  Supported versions that are affected are Prior to 1.6.8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Installer executes to compromise MySQL Installer.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in MySQL Installer, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all MySQL Installer accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Installer. Note: This patch is used in MySQL Server bundled version 8.0.35 and 5.7.44. CVSS 3.1 Base Score 7.9 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H).
CVSS v3.1: 7.9
CVE-2022-44379: Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/classes/Master.php?f=delete_service.
CVSS v3.1: 7.2