ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-8649-jcf2-5whp: Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JavaFX 2.2.40 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.
GHSA-ccmh-pfgg-525g: In the Linux kernel, the following vulnerability has been resolved:sch_htb: make htb_deactivate() idempotentAlan reported a NULL pointer dereference in htb_next_rb_node()
after we made htb_qlen_notify() idempotent.It turns out in the following case it introduced some regression:htb_dequeue_tree():
  |-> fq_codel_dequeue()
    |-> qdisc_tree_reduce_backlog()
      |-> htb_qlen_notify()
        |-> htb_deactivate()
  |-> htb_next_rb_node()
  |-> htb_deactivate()For htb_next_rb_node(), after calling the 1st htb_deactivate(), the
clprio[prio]->ptr could be already set to  NULL, which means
htb_next_rb_node() is vulnerable here.For htb_deactivate(), although we checked qlen before calling it, in
case of qlen==0 after qdisc_tree_reduce_backlog(), we may call it again
which triggers the warning inside.To fix the issues here, we need to:Make htb_deactivate() idempotent, that is, simply return if we
already call it before.Make htb_next_rb_node() safe against ptr==NULL.Many thanks to Alan for testing and for the reproducer.
CVSS v3.1: 5.5
GHSA-6g5m-f5c9-9v5f: The SVG Map Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on multiple AJAX actions including 'save_data', 'delete_data', and 'add_popup'. This makes it possible for unauthenticated attackers to update the plugin's settings, delete map data, and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS v3.1: 6.1
GHSA-pp64-vq4m-47h3: In the Linux kernel, the following vulnerability has been resolved:fs: don't try and remove empty rbtree nodeWhen copying a namespace we won't have added the new copy into the
namespace rbtree until after the copy succeeded. Calling free_mnt_ns()
will try to remove the copy from the rbtree which is invalid. Simply
free the namespace skeleton directly.
CVSS v3.1: 5.5
GHSA-hmrm-3xmg-v873: A flaw was found in the Linux kernel before 5.8-rc1 in the implementation of the Enhanced IBPB (Indirect Branch Prediction Barrier). The IBPB mitigation will be disabled when STIBP is not available or when the Enhanced Indirect Branch Restricted Speculation (IBRS) is available. This flaw allows a local attacker to perform a Spectre V2 style attack when this configuration is active. The highest threat from this vulnerability is to confidentiality.
GHSA-ghrh-mw3v-vggj: Windows Hyper-V Denial of Service Vulnerability.
CVSS v3.1: 5.6
CVE-2015-6088: Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Microsoft Browser ASLR Bypass."
CVSS v2.0: 4.3
PYSEC-2021-46: before_upstream_connection in AuthPlugin in http/proxy/auth.py in proxy.py before 2.3.1 accepts incorrect Proxy-Authorization header data because of a boolean confusion (and versus or).
cisco-sa-sdwan-vman-sc-LRLfu2z: Cisco Catalyst SD-WAN Manager Vulnerabilities
Multiple vulnerabilities in Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an attacker to access an affected instance or cause a denial of service (DoS) condition on an affected system.

For more information about these vulnerabilities, see the Details ["#details"] section of this advisory.

Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.


CVSS v3.1: 7.1
GHSA-2853-mpq7-6f9j: A security vulnerability has been detected in UTT 进取 520W 1.7.7-180627. Impacted is the function strcpy of the file /goform/formConfigDnsFilterGlobal. Such manipulation of the argument timeRangeName leads to buffer overflow. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 5.5
CVSS v3.1: 5.7
CVE-2020-35339: In 74cms version 5.0.1, there is a remote code execution vulnerability in /Application/Admin/Controller/ConfigController.class.php and /ThinkPHP/Common/functions.php where attackers can obtain server permissions and control the server.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2026-40352: FastGPT: NoSQL Injection in updatePasswordByOld Leads to Account Takeover
FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password change endpoint is vulnerable to NoSQL injection. An authenticated attacker can bypass the "old password" verification by injecting MongoDB query operators. This allows an attacker who has gained a low-privileged session to change the password of their account (or others if combined with ID manipulation) without knowing the current one, leading to full account takeover and persistence. This issue has been fixed in version 4.14.9.5.
CVSS v3.1: 8.8
CVE-2019-2432: Vulnerability in the Oracle Argus Safety component of Oracle Health Sciences Applications (subcomponent: Login). Supported versions that are affected are 8.1 and 8.2. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Argus Safety. While the vulnerability is in Oracle Argus Safety, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Argus Safety accessible data as well as unauthorized read access to a subset of Oracle Argus Safety accessible data. CVSS 3.0 Base Score 4.9 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N).
CVSS v3.0: 4.9
CVSS v2.0: 4.9
GHSA-jffw-8f4h-x7fq: On Juniper Networks Junos Space versions prior to 16.1R1, due to an insufficient authorization check, readonly users on the Junos Space administrative web interface can execute code on the device.
CVSS v3.0: 8.8
CVE-2018-17765: Ingenico Telium 2 POS terminals have undeclared TRACE protocol commands. This is fixed in Telium 2 SDK v9.32.03 patch N.
CVSS v3.1: 6.8
CVSS v2.0: 7.2
GHSA-m4j5-hgqq-5jf2: Insecure cookie sharing in Hawtio
It was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store (cookies are stored locally and are not passed between the client and the end URL) which means all clients using that proxy are sharing the same cookies.
CVSS v3.0: 9
GHSA-mrg2-jr6m-xfj9: A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the password parameter at /mail/MailController.java.
CVSS v3.1: 6.1
GHSA-97c8-qv9j-mr3j: Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS v3.1: 5.4
GHSA-v2x3-gcmp-cp36: An issue was discovered in JasPer 2.0.14. There is a heap-based buffer over-read of size 8 in the function jp2_decode in libjasper/jp2/jp2_dec.c.
CVSS v3.0: 7.8
GHSA-443j-7m97-75j3: This vulnerability allows remote attackers to overwrite files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the org.apache.jsp.u.jsp.reports.templates.network.traffic_005freport_jsp servlet, which listens on TCP port 8081 by default. When parsing the filename parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to overwrite any files accessible to the Administrator. Was ZDI-CAN-5191.
CVSS v3.0: 6.5
GHSA-rr65-f966-j89f: A vulnerability, which was classified as problematic, has been found in foxoverflow MySimplifiedSQL. This issue affects some unknown processing of the file MySimplifiedSQL_Examples.php. The manipulation of the argument FirstName/LastName leads to cross site scripting. The attack may be initiated remotely. The name of the patch is 3b7481c72786f88041b7c2d83bb4f219f77f1293. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217595.
CVSS v3.1: 6.1
GHSA-w8pp-8gqf-chff: Contec FXA3200 version 1.13.00 and under suffers from Insecure Permissions in the Wireless LAN Manager interface which allows malicious actors to execute Linux commands with root privilege via a hidden web page (/usr/www/ja/mnt_cmd.cgi).
CVSS v3.1: 8
GHSA-pr49-h722-qwhc: An issue in Markdown Preview Enhanced v0.6.5 and v0.19.6 for VSCode and Atom allows attackers to execute arbitrary commands during the GFM export process.
CVSS v3.1: 9.8
GHSA-w2xw-7pjh-2342: A stack overflow in the Catalog::readPageLabelTree2(Object*) function of XPDF v4.04 allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.
CVSS v3.1: 5.5
GHSA-mrvq-mp59-qvj4: In the Linux kernel, the following vulnerability has been resolved:veth: more robust handing of race to avoid txq getting stuckCommit dc82a33297fc ("veth: apply qdisc backpressure on full ptr_ring to
reduce TX drops") introduced a race condition that can lead to a permanently
stalled TXQ. This was observed in production on ARM64 systems (Ampere Altra
Max).The race occurs in veth_xmit(). The producer observes a full ptr_ring and
stops the queue (netif_tx_stop_queue()). The subsequent conditional logic,
intended to re-wake the queue if the consumer had just emptied it (if
(__ptr_ring_empty(...)) netif_tx_wake_queue()), can fail. This leads to a
"lost wakeup" where the TXQ remains stopped (QUEUE_STATE_DRV_XOFF) and
traffic halts.This failure is caused by an incorrect use of the __ptr_ring_empty() API
from the producer side. As noted in kernel comments, this check is not
guaranteed to be correct if a consumer is operating on another CPU. The
empty test is based on ptr_ring->consumer_head, making it reliable only for
the consumer. Using this check from the producer side is fundamentally racy.This patch fixes the race by adopting the more robust logic from an earlier
version V4 of the patchset, which always flushed the peer:(1) In veth_xmit(), the racy conditional wake-up logic and its memory barrier
are removed. Instead, after stopping the queue, we unconditionally call
__veth_xdp_flush(rq). This guarantees that the NAPI consumer is scheduled,
making it solely responsible for re-waking the TXQ.
  This handles the race where veth_poll() consumes all packets and completes
NAPI *before* veth_xmit() on the producer side has called netif_tx_stop_queue.
The __veth_xdp_flush(rq) will observe rx_notify_masked is false and schedule
NAPI.(2) On the consumer side, the logic for waking the peer TXQ is moved out of
veth_xdp_rcv() and placed at the end of the veth_poll() function. This
placement is part of fixing the race, as the netif_tx_queue_stopped() check
must occur after rx_notify_masked is potentially set to false during NAPI
completion.
  This handles the race where veth_poll() consumes all packets, but haven't
finished (rx_notify_masked is still true). The producer veth_xmit() stops the
TXQ and __veth_xdp_flush(rq) will observe rx_notify_masked is true, meaning
not starting NAPI.  Then veth_poll() change rx_notify_masked to false and
stops NAPI.  Before exiting veth_poll() will observe TXQ is stopped and wake
it up.
CVE-2024-10198: code-projects Pharmacy Management System Manage Customer Page manage_customer.php cross site scripting
A vulnerability was found in code-projects Pharmacy Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /manage_customer.php of the component Manage Customer Page. The manipulation of the argument suppliers_name/address leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory mentions contradicting files to be affected. Other parameters might be affected as well.
CVSS v4.0: 5.1
CVSS v3.1: 2.4
CVSS v3.0: 2.4
CVSS v2.0: 3.3
CVE-2024-46561: Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the queryret parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS v3.1: 7.5
RHSA-2005:867: Red Hat Security Advisory: gpdf security update
security flaw security flaw security flaw security flaw
GHSA-m5vg-qcpp-rq6f: ** UNSUPPORTED WHEN ASSIGNED ** This vulnerability exists in D3D Security IP Camera due to usage of insecure Real-Time Streaming Protocol (RTSP) version for live video streaming.  A remote attacker could exploit this vulnerability by crafting a RTSP packet leading to unauthorized access to live feed of the targeted device.    NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS v4.0: 8.7
CVE-2022-36634: An access control issue in ZKTeco ZKBioSecurity V5000 3.0.5_r allows attackers to arbitrarily create admin users via a crafted HTTP request.
CVSS v3.1: 8.8
GHSA-6hqr-fv35-99wh: An exploitable file write vulnerability exists in the memory module functionality of Allen Bradley Micrologix 1400 Series B FRN 21.2 and before. A specially crafted packet can cause a file write resulting in a new program being written to the memory module. An attacker can send an unauthenticated packet to trigger this vulnerability.
CVSS v3.0: 7.5
CVE-2023-38002: IBM Storage Scale session fixation
IBM Storage Scale 5.1.0.0 through 5.1.9.2 could allow an authenticated user to steal or manipulate an active session to gain access to the system.  IBM X-Force ID:  260208.
CVSS v3.1: 5
GHSA-fm53-c89v-pw28: A use-after-free flaw was found in btrfs_search_slot in fs/btrfs/ctree.c in btrfs in the Linux Kernel.This flaw allows an attacker to crash the system and possibly cause a kernel information lea
CVSS v3.1: 6.3
RHSA-2023:4350: Red Hat Security Advisory: python-requests security update
python-requests: Unintended leak of Proxy-Authorization header
CVSS v3.1: 6.1
GHSA-g9h5-7rff-phrm: The CGI implementation on Cisco TelePresence endpoint devices with software 1.2.x through 1.5.x allows remote attackers to execute arbitrary commands via a malformed request, related to "command injection vulnerabilities," aka Bug ID CSCtb31640.
CVE-2020-29056: An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104, FD1104B, FD1104S, FD1104SN, FD1108S, FD1204S-R2, FD1204SN, FD1204SN-R2, FD1208S-R2, FD1216S-R1, FD1608GS, FD1608SN, FD1616GS, FD1616SN, and FD8000 devices. One can escape from a shell and acquire root privileges by leveraging the TFTP download configuration.
CVSS v3.1: 9.8
CVSS v2.0: 10
CVE-2024-39770: Multiple buffer overflow vulnerabilities exist in the internet.cgi set_qos() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.This vulnerability exists in the `en_enable` POST parameter.
CVSS v3.1: 9.1
GHSA-hj4m-mcvw-qf65: A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file admin/page-login.php. The manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-218426 is the identifier assigned to this vulnerability.
CVSS v3.1: 9.8
GHSA-hc32-g7rr-m838: Raysoft/Raybase Video Cam Server 1.0.0 beta allows remote attackers to conduct administrator operations and cause a denial of service (server or camera shutdown) via a direct request to admin.html.
RHSA-2024:4639: Red Hat Security Advisory: qt5-qtbase security update
qtbase: qtbase: Delay any communication until encrypted() can be responded to
CVSS v3.1: 7.5
GHSA-4gwr-3v6m-22jj: JetBrains TeamCity Plugin before 2020.2.85695 SSRF. Vulnerability that could potentially expose user credentials.
RHSA-2026:19200: Red Hat Security Advisory: corosync security update
corosync: Corosync: Denial of Service and information disclosure via crafted UDP packet corosync: Corosync: Denial of Service via integer overflow in join message validation
CVSS v3.1: 7.5
CVE-2019-13003: An issue was discovered in GitLab Community and Enterprise Edition before 12.0.3. One of the parsers used by Gilab CI was vulnerable to a resource exhaustion attack. It allows Uncontrolled Resource Consumption.
CVSS v3.1: 7.5
CVSS v2.0: 5
CVE-2022-38871: In Free5gc v3.0.5, the AMF breaks due to malformed NAS messages.
CVSS v3.1: 7.5
CVE-2022-42205: PHPGurukul Hospital Management System In PHP V 4.0 is vulnerable to Cross Site Scripting (XSS) via add-patient.php.
CVSS v3.1: 5.4
CVE-2024-0743: An unchecked return value in TLS handshake code could have caused a potentially exploitable crash. This vulnerability affects Firefox < 122, Firefox ESR < 115.9, and Thunderbird < 115.9.
CVSS v3.1: 7.5
CVE-2021-38189: An issue was discovered in the lettre crate before 0.9.6 for Rust. In an e-mail message body, an attacker can place a . character after two <CR><LF> sequences and then inject arbitrary SMTP commands.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
GHSA-7924-wvgm-wqr4: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Odihost Easy Gallery allows SQL Injection.This issue affects Easy Gallery: from n/a through 1.4.
CVSS v3.1: 8.5
RHSA-2017:0175: Red Hat Security Advisory: java-1.8.0-oracle security update
OpenJDK: incorrect ECDSA signature extraction from the DER input (Libraries, 8168714) OpenJDK: missing ObjectIdentifier length check (Libraries, 8168705) OpenJDK: DSA implementation timing attack (Libraries, 8168728) OpenJDK: ECDSA implementation timing attack (Libraries, 8168724) OpenJDK: incorrect URL parsing in URLStreamHandler (Networking, 8167223) JDK: unspecified vulnerability fixed in 8u121 (Java Mission Control) OpenJDK: URLClassLoader insufficient access control checks (Networking, 8151934) OpenJDK: untrusted input deserialization in RMI registry and DCG (RMI, 8156802) OpenJDK: LdapLoginModule incorrect userDN extraction (JAAS, 8161743) OpenJDK: imageio PNGImageReader failed to honor ignoreMetadata for iTXt and zTXt chunks (2D, 8166988) JDK: unspecified vulnerability fixed in 6u141, 7u131, and 8u121 (Deployment) OpenJDK: integer overflow in SocketOutputStream boundary check (Networking, 8164147) JDK: unspecified vulnerability fixed in 8u121 (Java Mission Control) OpenJDK: insufficient protected field access checks in atomic field updaters (Libraries, 8165344) OpenJDK: insecure class construction (Hotspot, 8167104)
CVSS v3.0: 8.8
CVE-1999-1306: Cisco IOS 9.1 and earlier does not properly handle extended IP access lists when the IP route cache is enabled and the "established" keyword is set, which could allow attackers to bypass filters.
CVSS v2.0: 7.5
RHSA-2025:23857: Red Hat Security Advisory: gimp:2.8 security update
gimp: GIMP DCM File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability gimp: GIMP XWD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
CVSS v3.1: 7.8
GHSA-h3rg-qv35-27xm: 6SHR system from Gether Technology does not properly validate uploaded file types, allowing remote attackers with regular privileges to upload web shell scripts and use them to execute arbitrary system commands on the server.
CVSS v3.1: 8.8
GHSA-29mx-4gvm-rgfp: Tenda AC7 V1.0 V15.03.06.44 and Tenda AC5 V1.0RTL_V15.03.06.28 were discovered to contain a stack overflow via parameter entrys and mitInterface at url /goform/addressNat.
CVSS v3.1: 9.8
CVE-1999-0177: The uploader program in the WebSite web server allows a remote attacker to execute arbitrary programs.
CVSS v2.0: 7.5
GHSA-vf7p-j8x6-xvwp: Incorrect Authorization in Apache Solr
When using ConfigurableInternodeAuthHadoopPlugin for authentication, Apache Solr versions prior to 8.8.2 would forward/proxy distributed requests using server credentials instead of original client credentials. This would result in incorrect authorization resolution on the receiving hosts.
CVSS v3.1: 9.1
GHSA-34hg-pm9j-p7gx: A vulnerability affecting F-Secure antivirus engine was discovered whereby unpacking UPX file can lead to denial-of-service. The vulnerability can be exploited remotely by an attacker. A successful attack will result in denial-of-service of the antivirus engine.
CVE-2017-14171: In libavformat/nsvdec.c in FFmpeg 2.4 and 3.3.3, a DoS in nsv_parse_NSVf_header() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted NSV file, which claims a large "table_entries_used" field in the header but does not contain sufficient backing data, is provided, the loop over 'table_entries_used' would consume huge CPU resources, since there is no EOF check inside the loop.
CVSS v3.0: 6.5
CVSS v2.0: 7.1
CVE-2022-44284: Dinstar FXO Analog VoIP Gateway DAG2000-16O is vulnerable to Cross Site Scripting (XSS).
CVSS v3.1: 5.4
GHSA-xc7h-mpv6-3v2w: BEA Tuxedo 8.0 before RP392 and 8.1 before RP293, and WebLogic Enterprise 5.1 before RP174, echo the password in cleartext, which allows physically proximate attackers to obtain sensitive information via the (1) cnsbind, (2) cnsunbind, or (3) cnsls commands.
CVE-2022-31100: Reachable Assertion in rulex
rulex is a new, portable, regular expression language. When parsing untrusted rulex expressions, rulex may crash, possibly enabling a Denial of Service attack. This happens when the expression contains a multi-byte UTF-8 code point in a string literal or after a backslash, because rulex tries to slice into the code point and panics as a result. This is a security concern for you, if your service parses untrusted rulex expressions (expressions provided by an untrusted user), and your service becomes unavailable when the thread running rulex panics. The crashes are fixed in version **0.4.3**. Affected users are advised to update to this version. The only known workaround for this issue is to assume that regular expression parsing will panic and to add logic to catch panics.
CVSS v3.1: 6.5
RHSA-2025:7507: Red Hat Security Advisory: thunderbird security update
firefox: thunderbird: Privilege escalation in Firefox Updater thunderbird: Information Disclosure of /tmp directory listing thunderbird: Leak of hashed Window credentials via crafted attachment URL thunderbird: User Interface (UI) Misrepresentation of attachment URL firefox: thunderbird: Process isolation bypass using "javascript:" URI links in cross-origin frames firefox: thunderbird: Unsafe attribute access during XPath parsing firefox: thunderbird: Memory safety bugs fixed in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10 firefox: thunderbird: Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird 128.10
CVSS v3.1: 8.8
CVE-2014-1309: WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.
CVSS v2.0: 6.8
CVE-2021-36863: WordPress Quiz And Survey Master plugin <= 7.3.4 - Auth. Stored Cross-Site Scripting (XSS) vulnerability
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in ExpressTech Quiz And Survey Master plugin <= 7.3.4 on WordPress.
CVSS v3.1: 5.4
GHSA-x63q-h2jf-q88h: The SNMP service in the Belkin 54G (F5D7130) wireless router allows remote attackers to cause a denial of service via unknown vectors.