ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2024-29973: ** UNSUPPORTED WHEN ASSIGNED **
The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request.
CVSS v3.1: 9.8
CVE-2017-8401: In SWFTools 0.9.2, an out-of-bounds read of heap data can occur in the function png_load() in lib/png.c:724. This issue can be triggered by a malformed PNG file that is mishandled by png2swf. Attackers could exploit this issue for DoS.
CVSS v3.0: 6.5
CVSS v2.0: 4.3
GHSA-gpr9-gqg8-xj7v: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiAP-S 6.2 all verisons, and 6.4.0 through 6.4.9, FortiAP-W2 6.4 all versions, 7.0 all versions, 7.2.0 through 7.2.3, and 7.4.0 through 7.4.2, FortiAP 6.4 all versions, 7.0 all versions, 7.2.0 through 7.2.3, and 7.4.0 through 7.4.2 allow a local authenticated attacker to execute unauthorized code via the CLI.
CVSS v3.1: 6.7
GHSA-hr2v-3952-633q: Prototype Pollution in deep-extend
Versions of `deep-extend` before 0.5.1 are vulnerable to prototype pollution.RecommendationUpdate to version 0.5.1 or later.
CVSS v3.0: 9.8
RHBA-2015:0386: Red Hat Bug Fix Advisory: cups bug fix and enhancement update
cups: cross-site scripting flaw fixed in the 1.7.2 release cups: insufficient checking leads to privilege escalation cups: Incomplete fix for CVE-2014-3537 cups: allows local users to read arbitrary files via a symlink attack cups: world-readable permissions
CVE-2016-4650: Heap-based buffer overflow in IOHIDFamily in Apple iOS before 9.3.2, OS X before 10.11.5, and tvOS before 9.2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVSS v3.0: 7.8
CVSS v2.0: 9.3
CVE-2026-50548: Cursor Desktop sandbox escape via agent-controlled working directory
Cursor is a code editor built for programming with AI. Prior to 3.0, Cursor runs agent terminal commands in a sandbox by default, and the sandbox grants write access to the command's working directory. A flaw was identified in how the agent could modify the working_directory parameter, which could cause the sandbox to include writable paths outside the intended workspace. A malicious agent could set working_directory to a sensitive location and write arbitrary files outside the workspace under the user's privileges. This enables non-sandboxed Remote Code Execution — for example by overwriting the cursorsandbox helper so later commands run unsandboxed — with no user interaction beyond a benign prompt. This vulnerability is fixed in 3.0.
CVSS v4.0: 9.3
CVE-1999-0280: Remote command execution in Microsoft Internet Explorer using .lnk and .url files.
CVSS v2.0: 7.5
CVE-2006-2997: Cross-site scripting (XSS) vulnerability in ZMS 2.9 and earlier, when register_globals is enabled, allows remote attackers to inject arbitrary web script or HTML via the raw parameter in the search field.
CVSS v2.0: 2.6
CVE-2020-8232: An information disclosure vulnerability exists in EdgeMax EdgeSwitch firmware v1.9.0 that allowed read only users could obtain unauthorized information through SNMP community pages.
CVSS v3.1: 6.5
CVSS v2.0: 4
CVE-2012-5576: Multiple stack-based buffer overflows in file-xwd.c in the X Window Dump (XWD) plug-in in GIMP 2.8.2 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large (1) red, (2) green, or (3) blue color mask in an XWD file.
CVSS v2.0: 7.5
GHSA-fww6-h55r-7gx6: RG - AP180, Indoor Wall Plate Wireless AP AP180 series provided by Ruijie Networks Co., Ltd. contain an OS command injection vulnerability. An arbitrary OS command may be executed on the product by an attacker who logs in to the CLI service.
CVSS v4.0: 8.6
CVSS v3.1: 7.2
GHSA-3mcq-hx52-4939: scripts/license.pl in Veritas NetBackup Appliance 2.6.0.x through 2.6.0.4, 2.6.1.x through 2.6.1.2, 2.7.x through 2.7.3, and 3.0.x allow remote attackers to execute arbitrary commands via shell metacharacters in the hostName parameter to appliancews/getLicense.
CVSS v3.0: 9.8
GHSA-365h-hvh8-45g8: A Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Routing Protocol Daemon (rpd) of Juniper Networks Junos OS, Junos OS Evolved allows a network-based unauthenticated attacker to cause a Denial of Service (DoS). When a BGP flow route with redirect IP extended community is received, and the reachability to the next-hop of the corresponding redirect IP is flapping, the rpd process might crash. Whether the crash occurs depends on the timing of the internally processing of these two events and is outside the attackers control. Please note that this issue also affects Route-Reflectors unless 'routing-options flow firewall-install-disable' is configured. This issue affects: Juniper Networks Junos OS: 18.4 versions prior to 18.4R2-S10, 18.4R3-S10; 19.1 versions prior to 19.1R3-S7; 19.2 versions prior to 19.2R1-S8, 19.2R3-S4; 19.4 versions prior to 19.4R3-S8; 20.2 versions prior to 20.2R3-S3; 20.3 versions prior to 20.3R3-S2; 20.4 versions prior to 20.4R3; 21.1 versions prior to 21.1R2. Juniper Networks Junos OS Evolved: All versions prior to 20.4R2-EVO; 21.1-EVO versions prior to 21.1R2-EVO. This issue does not affect Juniper Networks Junos OS versions prior to 18.4R1.
CVSS v3.1: 5.9
GHSA-xg8c-hf2j-jjw5: A weakness has been identified in Open5GS up to 2.7.7. Impacted is the function ogs_nnrf_nfm_handle_nf_profile of the file lib/sbi/nnrf-handler.c of the component NRF. This manipulation causes denial of service. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance.
CVSS v4.0: 2.1
CVSS v3.1: 4.3
GHSA-qr2g-p6q7-w82m: x402 SDK Security Advisory
ImpactA security vulnerability exists in outdated versions of the x402 SDK.This vulnerability does not affect users' private keys, smart contracts, or funds.The issue impacts resource servers accepting payments on Solana when the facilitator is running a vulnerable version of the x402 SDK.Who Should Take ActionFacilitators that process payments on Solana must upgrade the x402 SDK to the patched versions listed below.Clients are not required to upgrade.Resource servers are not required to upgrade unless they operate their own facilitator (self-facilitate).PatchesPlease update to the following package versions:Npm: @x402/svm >= 2.6.0Pypi: x402 >= 2.3.0Go: x402 >= 2.5.0
GHSA-c4jf-v948-ghj9: The wave.ai.browser application through 1.0.35 for Android allows a remote attacker to execute arbitrary JavaScript code via a crafted intent. It contains a manifest entry that exports the wave.ai.browser.ui.splash.SplashScreen activity. This activity uses a WebView component to display web content and doesn't adequately validate or sanitize the URI or any extra data passed in the intent by a third party application (with no permissions).
CVSS v3.1: 9.8
CVE-2009-3468: Multiple unspecified vulnerabilities in Common Desktop Environment (CDE) in Sun Solaris 10, when Trusted Extensions is enabled, allow local users to execute arbitrary commands or bypass the Mandatory Access Control (MAC) policy via unknown vectors, related to a menu typo and the Style Manager.
CVSS v2.0: 6.9
GHSA-r48m-vcgj-jw7q: A vulnerability was identified in Scada-LTS up to 2.7.8.1. Affected is the function Common.getHomeDir of the file br/org/scadabr/vo/exporter/ZIPProjectManager.java of the component Project Import. Such manipulation leads to path traversal. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 2.1
CVSS v3.1: 6.3
PYSEC-2022-168: Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.
GHSA-pr2x-5q4j-v542: In btm_acl_encrypt_change of btm_acl.cc, there is a possible way for a remote device to turn off encryption without resulting in a terminated connection due to an unusual root cause. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-251436534
CVSS v3.1: 5
CVE-1999-0091: Buffer overflow in AIX writesrv command allows local users to obtain root access.
CVSS v2.0: 7.2
GHSA-q6gx-vcq3-62cj: Tesla Model 3 bcmdhd Out-Of-Bounds Write Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected Tesla Model 3 vehicles. An attacker must first obtain the ability to execute code on the wifi subsystem in order to exploit this vulnerability.The specific flaw exists within the bcmdhd driver. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel. Was ZDI-CAN-20733.
CVSS v3.0: 7.8
CVE-2026-6179: Stored Cross Site Scripting in NightWolf Penetration Testing Platform
Stored Cross Site Scripting in NightWolf Penetration Testing Platform allows attack trigger and run malicious script in user's browser
CVSS v4.0: 6.3
CVE-2025-36114: IBM QRadar SOAR Plugin App path traversal
IBM QRadar SOAR Plugin App 1.0.0 through 5.6.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.
CVSS v3.1: 6.5
CVE-2024-33043: Buffer Over-read in FM Host
Transient DOS while handling PS event when Program Service name length offset value is set to 255.
CVSS v3.1: 5.5
GHSA-v53p-6626-4vj7: Wondershare UBackit 2.0.5 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted path in the wsbackup service to inject malicious executables that would run with LocalSystem permissions during service startup.
CVSS v4.0: 8.5
CVSS v3.1: 8.4
GHSA-2r4p-gw5x-3p8w: General Electric (GE) Multilink ML800, ML1200, ML1600, and ML2400 switches with firmware before 5.5.0 and ML810, ML3000, and ML3100 switches with firmware before 5.5.0k have hardcoded credentials, which allows remote attackers to modify configuration settings via the web interface.
CVSS v3.1: 9.8
CVE-2026-8205: Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in Calendar Block since action_get_events does not check canView on the calendar
Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in the Calendar Block since action_get_events does not check canView on the calendar which results in restricted event details being disclosed. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks lalalala5678 for reporting.
CVSS v4.0: 6.3
RHSA-2022:0368: Red Hat Security Advisory: rpm security update
rpm: RPM does not require subkeys to have a valid binding signature
CVSS v3.1: 4.4
GHSA-v35q-rg96-5gx6: A security feature bypass vulnerability exists in Device Guard that could allow an attacker to inject malicious code into a Windows PowerShell session, aka "Device Guard Code Integrity Policy Security Feature Bypass Vulnerability." This affects Windows Server 2016, Windows 10, Windows Server 2019, Windows 10 Servers.
CVSS v3.0: 5.3
CVE-2014-0408: Unspecified vulnerability in Oracle Java SE 7u45, when running on OS X, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.
CVSS v2.0: 9.3
GHSA-xvww-xhx6-22pf: SillyTavern has a path traversal in `/api/chats/import` allows arbitrary file write outside intended chat directory
SummaryA path traversal vulnerability in `/api/chats/import` allows an authenticated attacker to write attacker-controlled files outside the intended chats directory by injecting traversal sequences into `character_name`.Details`character_name` is used unsafely as part of the destination filename and then passed into `path.join(...)` without sanitization.Evidence:Import handler entrypoint:  
<https://github.com/SillyTavern/SillyTavern/blob/b7bb8be35a5c779b4db12a4a5b94d7e49096071c/src/endpoints/chats.js#L680-L686>Unsanitized `character_name` used in output filename:  
<https://github.com/SillyTavern/SillyTavern/blob/b7bb8be35a5c779b4db12a4a5b94d7e49096071c/src/endpoints/chats.js#L719-L723>Same write pattern in JSONL import branch:  
<https://github.com/SillyTavern/SillyTavern/blob/b7bb8be35a5c779b4db12a4a5b94d7e49096071c/src/endpoints/chats.js#L759-L766>Endpoint auth context (authenticated user access):  
<https://github.com/SillyTavern/SillyTavern/blob/b7bb8be35a5c779b4db12a4a5b94d7e49096071c/src/server-main.js#L239>Example payload:`character_name=../../../../tmp/st_poc`This causes the final destination path to escape from `<user>/chats/<avatar>/...` and write to an attacker-controlled location such as `/tmp/...` (or any writable path for the service account).PoCPrerequisites:Valid authenticated session cookie (`cookie.txt`)Valid CSRF token (`$TOKEN`)Prepare payload:Trigger arbitrary write:Observed result:A file is created outside chats directory, for example:  
`/tmp/st_poc - <timestamp> imported.jsonl`ImpactIntegrity: attacker can create files in unintended filesystem locations.Availability: can be used for disk abuse and disruptive file placement.Can become more severe when chained with other local processing behaviors.ResolutionThe issue was addressed in version 1.17.0
CVSS v3.1: 8.1
GHSA-h78g-xfxf-q2rf: An out-of-bounds write vulnerability exists in the SetAttributeList attribute_count_request functionality of EIP Stack Group OpENer development commit 58ee13c. A specially crafted EtherNet/IP request can lead to an out of bounds write, potentially causing the server to crash or allow for remote code execution. An attacker can send a series of EtherNet/IP requests to trigger this vulnerability.
CVSS v3.1: 9.8
GHSA-27jp-wm6q-gp25: sqlparse: formatting list of tuples leads to denial of service
SummaryThe below gist hangs while attempting to format a long list of tuples.This was found while [drafting a regression test for Dja
ngo 5.2's composite primary key feature](https://code.djangoproject.com/ticket/36416#comment:3), which allows querying composite fields with tuples.
CVSS v4.0: 6.9
CVE-2024-37070: IBM Concert Software information disclosure
IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 could allow an authenticated user to obtain sensitive information that could aid in further attacks against the system.
CVSS v3.1: 4.3
GHSA-g46f-36qj-57q9: IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 164066.
CVSS v3.1: 5.4
GHSA-7xxf-4qg8-75qc: Cross-Site Request Forgery (CSRF) vulnerability in mendibass Browser Address Bar Color allows Stored XSS. This issue affects Browser Address Bar Color: from n/a through 3.3.
CVSS v3.1: 7.1
GHSA-vf5v-7xg7-4m2w: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Envato Affiliater allows Reflected XSS. This issue affects Envato Affiliater: from n/a through 1.2.4.
CVSS v3.1: 7.1
GHSA-rrqm-hcmh-g838: login.aspx in the SmarterTools SmarterStats 6.0 web server does not include the HTTPOnly flag in a Set-Cookie header for the loginsettings cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
GHSA-xp9c-w8w2-2477: Multiple cross-site scripting (XSS) vulnerabilities in EMC RSA Archer GRC 5.x before 5.4 SP1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
GHSA-8xh8-2w7w-92cr: Cross-site scripting (XSS) vulnerability in admin.php in OpenSolution Quick.Cms.Lite 2.1 allows remote attackers to inject arbitrary web script or HTML via the query string.
RHSA-2019:0681: Red Hat Security Advisory: thunderbird security update
mozilla: Use after free in Skia Mozilla: Proxy Auto-Configuration file can define localhost access to be proxied thunderbird: flaw in verification of S/MIME signature resulting in signature spoofing mozilla: Integer overflow in Skia Mozilla: Memory safety bugs fixed in Firefox 66 and Firefox ESR 60.6 Mozilla: Use-after-free when removing in-use DOM elements Mozilla: Type inference is incorrect for constructors entered through on-stack replacement with IonMonkey Mozilla: IonMonkey leaks JS_OPTIMIZED_OUT magic value to script Mozilla: Improper bounds checks when Spectre mitigations are disabled Mozilla: Type-confusion in IonMonkey JIT compiler Mozilla: Use-after-free with SMIL animation controller Mozilla: IonMonkey MArraySlice has incorrect alias information Mozilla: Ionmonkey type confusion with __proto__ mutations
CVSS v3.0: 8.8
CVE-2020-13879: IrfanView B3D PlugIns before version 4.56 has a B3d.dll!+214f heap-based out-of-bounds write.
CVSS v3.1: 9.8
CVE-2026-0965: Libssh: libssh: denial of service via improper configuration file handling
A flaw was found in libssh where it can attempt to open arbitrary files during configuration parsing. A local attacker can exploit this by providing a malicious configuration file or when the system is misconfigured. This vulnerability could lead to a Denial of Service (DoS) by causing the system to try and access dangerous files, such as block devices or large system files, which can disrupt normal operations.
CVSS v3.0: 3.3
GHSA-76rh-4p5x-jmq8: HiveManager Classic through 8.1r1 allows arbitrary JSP code execution by modifying a backup archive before a restore, because the restore feature does not validate pathnames within the archive. An authenticated, local attacker - even restricted as a tenant - can add a jsp at HiveManager/tomcat/webapps/hm/domains/$yourtenant/maps (it will be exposed at the web interface).
CVSS v3.0: 7.8
GHSA-h9cx-xjg6-5v2w: Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering
ImpactThe `gcr` Receiver type in Flux notification-controller does not validate the `email` claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations.Exploitation requires the attacker to know the Receiver's webhook URL. The webhook path is generated as `/hook/sha256sum(token+name+namespace)`, where the token is a random string stored in a Kubernetes Secret. There is no API or endpoint that enumerates webhook URLs. An attacker cannot discover the path without either having access to the cluster and permissions to read the Receiver's `.status.webhookPath` in the target namespace, or obtaining the URL through other means (e.g. leaked secrets or access to Pub/Sub config).Upon successful authentication, the controller triggers a reconciliation for all resources listed in the Receiver's `.spec.resources`. However, the practical impact is limited: Flux reconciliation is idempotent, so if the desired state in the configured sources (Git, OCI, Helm) has not changed, the reconciliation results in a no-op with no effect on cluster state. Additionally, Flux controllers deduplicate reconciliation requests, sending many requests in a short period results in only a single reconciliation being processed.PatchesThe fix in notification-controller v1.8.3 refactors the GCR Receiver authentication to allow users to extend the verification to `email` and `audience` claims in the JWT. This enables operators to configure their Receiver's secret with the expected GCP Service Account email and audience, which the controller will validate against the token's claims before accepting the request.Email validation example:For more information, please see the GCR Receiver documentation: https://fluxcd.io/flux/components/notification/receivers/#gcrCreditsThanks to Saroj Khadka for reporting this issue to the Flux Security Team.
CVSS v3.1: 3.1
GHSA-f4hj-wx9v-jvfh: Multiple cross-site scripting (XSS) vulnerabilities in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allow remote attackers to inject arbitrary web script or HTML via (1) the result parameter to register.php; (2) the user parameter to search.php; the (3) cat_msg, (4) source_msg, (5) postponed_selected, (6) unapproved_selected, and (7) news_per_page parameters in a list action to the editnews module of index.php; and (8) the link tag in news comments.  NOTE: some of the vulnerabilities require register_globals to be enabled and/or magic_quotes_gpc to be disabled.
CVE-2021-38823: The IceHrm 30.0.0 OS website was found vulnerable to Session Management Issue. A signout from an admin account does not invalidate an admin session that is opened in a different browser.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2019-0813: An elevation of privilege vulnerability exists when Windows Admin Center improperly impersonates operations in certain situations, aka 'Windows Admin Center Elevation of Privilege Vulnerability'.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
GHSA-wwvm-hxm2-p9r6: Vulnerability in the Primavera Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported versions that are affected are 16.1.0.0-16.1.5.1, 18.0.0.0-18.0.2.0 and 19.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Portfolio Management. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera Portfolio Management accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N).
GHSA-4576-pgh2-g34j: derhansen/sf_event_mgt vulnerable to Broken Access Control in Backend Module
The existing access control check for events in the backend module got broken during the update of the extension to TYPO3 12.4, because the `RedirectResponse` from the `$this->redirect()` function was never handled.
CVSS v3.1: 4.3
GHSA-8cvf-5jgg-fw72: Stack-based buffer overflow in the MicroWorld Agent service (MWAGENT.EXE) in MicroWorld Technologies eScan before 9.0.718.1 allows remote attackers to execute arbitrary code via a long command.
CVE-2025-48642: In jump_to_payload of payload.rs, there is a possible information disclosure due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1: 5.5
CVE-2026-32453: WordPress Avada Core plugin < 5.15.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in ThemeFusion Avada Core fusion-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Avada Core: from n/a through < 5.15.0.
CVSS v3.1: 5.3
GHSA-f775-fgwg-5qvw: Memory safety bugs present in Firefox 60. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 61.
CVSS v3.0: 9.8
CVE-2019-3992: ELOG 3.1.4-57bea22 and below is affected by an information disclosure vulnerability. A remote unauthenticated attacker can access the server's configuration file by sending an HTTP GET request. Amongst the configuration data, the attacker may gain access to valid admin usernames and, in older versions of ELOG, passwords.
CVSS v3.1: 7.5
CVSS v2.0: 5
CVE-2024-33956: WordPress Custom WooCommerce Checkout Fields Editor plugin <= 1.3.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in ThemeLocation Custom WooCommerce Checkout Fields Editor.This issue affects Custom WooCommerce Checkout Fields Editor: from n/a through 1.3.0.
CVSS v3.1: 4.3