ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2024-12539: Elasticsearch Incorrect Authorization
An issue was discovered where improper authorization controls affected certain queries that could allow a malicious actor to circumvent Document Level Security in Elasticsearch and get access to documents that their roles would normally not allow.
CVSS v4.0: 6
CVE-2016-3706: Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in the GNU C Library (aka glibc or libc6) allows remote attackers to cause a denial of service (crash) via vectors involving hostent conversion. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4458.
CVSS v3.1: 7.5
CVSS v2.0: 5
GHSA-g2c3-vwff-m3xr: Font-Converter Vulnerable to Arbitrary Command Injection
Overviewfont-converter is a FontForge wrapper that allows conversion between different font formats (TTF, WOFF, OTF)All versions of this package are vulnerable to Arbitrary Command Injection due to missing sanitization of input that potentially flows into the `child_process.exec()` function.PoC
CVSS v3.1: 9.8
CVE-2023-27367: NETGEAR RAX30 libcms_cli Command Injection Remote Code Execution Vulnerability
NETGEAR RAX30 libcms_cli Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR RAX30 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the libcms_cli module. The issue results from the lack of proper validation of a user-supplied command before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19838.
CVSS v3.0: 8
CVE-2011-2605: CRLF injection vulnerability in the nsCookieService::SetCookieStringInternal function in netwerk/cookie/nsCookieService.cpp in Mozilla Firefox before 3.6.18 and 4.x through 4.0.1, and Thunderbird before 3.1.11, allows remote attackers to bypass intended access restrictions via a string containing a \n (newline) character, which is not properly handled in a JavaScript "document.cookie =" expression, a different vulnerability than CVE-2011-2374.
CVSS v2.0: 4.3
GHSA-vp74-83j6-mv6x: dasdec_mkuser on the Digital Alert Systems DASDEC EAS device before 2.0-2 and the Monroe Electronics R189 One-Net EAS device before 2.0-2 generates predictable passwords, which might make it easier for attackers to obtain non-administrative access via unspecified vectors.
CVSS v3.1: 7.3
RHSA-2013:1217: Red Hat Security Advisory: xml-security security update
Java: XML signature spoofing
RHSA-2026:22299: Red Hat Security Advisory: Red Hat OpenShift Developer Tools - Source-to-Image 1.6.2
crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root
CVSS v3.1: 7.8
GHSA-6x9q-xqg4-r93h: An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
CVSS v3.0: 8.8
CVE-2024-58298: Compuware iStrobe Web 20.13 Pre-Auth Remote Code Execution via File Upload
Compuware iStrobe Web 20.13 contains a pre-authentication remote code execution vulnerability that allows unauthenticated attackers to upload malicious JSP files through a path traversal in the file upload form. Attackers can exploit the 'fileName' parameter to upload a web shell and execute arbitrary commands by sending POST requests to the uploaded JSP endpoint.
CVSS v4.0: 9.2
CVE-2012-6354: The management GUI on the IBM SAN Volume Controller and Storwize V7000 6.x before 6.4.1.3 allows remote attackers to bypass authentication and obtain superuser access via IP packets.
CVSS v2.0: 7.5
CVE-2019-4071: IBM Tivoli Storage Productivity Center (IBM Spectrum Control Standard Edition 5.2.1 through 5.2.17) could allow a remote attacker to execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 157063.
CVSS v3.0: 6.8
GHSA-r945-3x7m-hrjx: Capgo before 12.128.2 contains an information disclosure vulnerability in the GET /statistics/app/:app_id endpoint that allows app-limited API keys to distinguish existing sibling app IDs through differential error responses. Attackers can enumerate real app IDs outside their allowed scope by observing 500 PGRST116 errors for inaccessible apps versus 401 errors for nonexistent apps, breaking tenant isolation.
CVSS v4.0: 5.3
CVSS v3.1: 4.3
GHSA-9wgw-hmc7-9m96: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Livemesh Livemesh Addons for WPBakery Page Builder allows Stored XSS.This issue affects Livemesh Addons for WPBakery Page Builder: from n/a through 3.7.
CVSS v3.1: 6.5
GHSA-86r4-gcfx-wv72: An issue has been discovered in hunter2 affecting all versions before 2.1.0. Improper handling of auto-completion input allows an authenticated attacker to extract other users email addresses
CVSS v3.1: 6.5
GHSA-xj7v-jqv6-v48w: The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file upload in versions up to, and including, 1.3.9.6. This is due to insufficient file type validation that occurs when custom blacklist types are configured, which replaces the default dangerous extension denylist instead of merging with it, and the wpcf7_antiscript_file_name() sanitization function being bypassed for filenames containing non-ASCII characters. This makes it possible for unauthenticated attackers to upload arbitrary files, such as PHP files, to the server, which can be leveraged to achieve remote code execution.
CVSS v3.1: 8.1
CVE-2025-10126: MyBrain Utilities <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
The MyBrain Utilities plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugins's 'mbumap' shortcode in all versions up to, and including, 1.0.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
GHSA-g2r8-292m-w5rg: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThinkUpThemes Consulting allows Stored XSS.This issue affects Consulting: from n/a through 1.5.0.
CVSS v3.1: 6.5
CVE-2000-0053: Microsoft Commercial Internet System (MCIS) IMAP server allows remote attackers to cause a denial of service via a malformed IMAP request.
CVSS v2.0: 7.5
GHSA-pvxc-vj6p-fp82: Heap buffer overflow in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
CVSS v3.1: 6.5
GHSA-r549-hx7w-7xr9: CMS Made Simple 2.2.15 contains a stored cross-site scripting vulnerability that allows authenticated users with Content Manager access to inject malicious scripts through SVG file uploads. Attackers can upload SVG files containing embedded JavaScript to the file manager, which executes when other authenticated users access the uploaded file, enabling cookie theft and session hijacking.
CVSS v4.0: 5.1
CVSS v3.1: 6.4
CVE-2018-18355: Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.
CVSS v3.0: 4.3
CVSS v2.0: 4.3
GHSA-mpxp-vvhq-p258: Type Confusion in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVSS v3.1: 9.6
CVE-2024-34065: @strapi/plugin-users-permissions leaks 3rd party authentication tokens and authentication bypass
Strapi is an open-source content management system. By combining two vulnerabilities (an `Open Redirect` and `session token sent as URL query parameter`) in @strapi/plugin-users-permissions before version 4.24.2, is its possible of an unauthenticated attacker to bypass authentication mechanisms and retrieve the 3rd party tokens. The attack requires user interaction (one click). Unauthenticated attackers can leverage two vulnerabilities to obtain an 3rd party token and the bypass authentication of Strapi apps. Users should upgrade @strapi/plugin-users-permissions to version 4.24.2 to receive a patch.
CVSS v3.1: 7.1
CVE-2018-8116: A denial of service vulnerability exists in the way that Windows handles objects in memory, aka "Microsoft Graphics Component Denial of Service Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
CVSS v3.0: 5.5
CVSS v2.0: 2.1
GHSA-8m58-mc8v-v548: Incorrect access control in the Dashboard API on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to bypass authentication due to insecure token generation.
CVSS v3.0: 9.8
GHSA-fxpw-xr3m-jjjw: Google Chrome before 7.0.517.41 does not properly handle forms, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted HTML document.
GHSA-q5xx-4g5h-3h6c: VMS 4.0 through 5.3 allows local users to gain privileges via the ANALYZE/PROCESS_DUMP dcl command.
CVE-2024-10897: Tutor LMS Elementor Addons <= 2.1.5 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation
The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the install_etlms_dependency_plugin() function in all versions up to, and including, 2.1.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install Elementor or Tutor LMS. Please note the impact of this issue is incredibly limited due to the fact that these two plugins will likely already be installed as a dependency of the plugin.
CVSS v3.1: 4.3
GHSA-qv37-qfq4-c558: Caucho Resin 1.3b1 and earlier allows remote attackers to read source code for Javabean files by inserting a .jsp before the WEB-INF specifier in an HTTP request.
GHSA-gf5r-4gp7-7h4h: Addressed remote code execution vulnerability in AvailableApps.php that allowed escalation of privileges in Western Digital My Cloud NAS devices prior to 5.04.114 (issue 3 of 3).
GHSA-9h84-32h7-9r5v: Unspecified vulnerability in the Siebel Core - Highly Interactive Client component in Oracle Siebel Suite 7.7.2.12, 7.8.2.14, 8.0.0.10, and 8.1.1.3 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2010-2405.
CVE-2017-5135: Certain Technicolor devices have an SNMP access-control bypass, possibly involving an ISP customization in some cases. The Technicolor (formerly Cisco) DPC3928SL with firmware D3928SL-P15-13-A386-c3420r55105-160127a could be reached by any SNMP community string from the Internet; also, you can write in the MIB because it provides write properties, aka Stringbleed. NOTE: the string-bleed/StringBleed-CVE-2017-5135 GitHub repository is not a valid reference as of 2017-04-27; it contains Trojan horse code purported to exploit this vulnerability.
CVSS v3.0: 9.1
CVSS v2.0: 6.4
CVE-2025-9417: itsourcecode Apartment Management System addemployee.php sql injection
A weakness has been identified in itsourcecode Apartment Management System 1.0. This issue affects some unknown processing of the file /employee/addemployee.php. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
GHSA-3g7c-5v2x-h72w: DotBr 0.1 allows remote attackers to execute arbitrary shell commands via the cmd parameter to (1) exec.php3 or (2) system.php3.
CVE-2015-7872: The key_gc_unused_keys function in security/keys/gc.c in the Linux kernel through 4.2.6 allows local users to cause a denial of service (OOPS) via crafted keyctl commands.
CVSS v2.0: 2.1
RHSA-2019:0462: Red Hat Security Advisory: java-1.7.0-openjdk security update
OpenJDK: memory disclosure in FileChannelImpl (Libraries, 8206290)
CVSS v3.0: 3.1
CVE-2026-35546: Anviz Products Missing Authentication for Critical Function
Anviz CX2 Lite and CX7 are vulnerable to unauthenticated firmware uploads. This causes crafted 
archives to be accepted, enabling attackers to plant and execute code 
and obtain a reverse shell.
CVSS v3.1: 9.8
GHSA-2jv7-gvqw-mxm4: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.4 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user with group import permissions to create labels in private projects due to improper authorization validation in the group import process under certain circumstances.
CVSS v3.1: 4.3
GHSA-2crv-pj7h-4r9x: In FreeBSD 12.1-STABLE before r357213, 12.1-RELEASE before 12.1-RELEASE-p2, 12.0-RELEASE before 12.0-RELEASE-p13, 11.3-STABLE before r357214, and 11.3-RELEASE before 11.3-RELEASE-p6, URL handling in libfetch with URLs containing username and/or password components is vulnerable to a heap buffer overflow allowing program misbehavior or malicious code execution.
GHSA-3p55-pgh8-7x5v: In the Linux kernel, the following vulnerability has been resolved:cpufreq: qcom-hw: Fix memory leak in qcom_cpufreq_hw_read_lut()If "cpu_dev" fails to get opp table in qcom_cpufreq_hw_read_lut(),
the program will return, resulting in "table" resource is not released.
RHSA-2015:1009: Red Hat Security Advisory: Red Hat JBoss Portal 6.2.0 update
CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix bouncycastle: TLS CBC padding timing attack WS: EJB3 role restrictions are not applied to jaxws handlers tomcat: multiple content-length header poisoning flaws JSF: XSS due to insufficient escaping of user-supplied content in outputText tags and EL expressions XStream: remote code execution due to insecure XML deserialization PicketBox/JBossSX: Unauthorized access to and modification of application server configuration and state by application jboss-as-server: Unchecked access to MSC Service Registry under JSM CXF: The SecurityTokenService accepts certain invalid SAML Tokens as valid CXF: UsernameTokens are sent in plaintext with a Symmetric EncryptBeforeSigning policy apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream EAP6: Plain text password logging during security audit JBossSX/PicketBox: World readable audit.log file Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter RichFaces: remote denial of service via memory exhaustion 6: JSM policy not respected by deployed applications Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs Tomcat/JBossWeb: Request smuggling via malicious content length header Xalan-Java: insufficient constraints in secure processing feature CXF: HTML content posted to SOAP endpoint could cause OOM errors CXF: Large invalid content could cause temporary space to fill Tomcat/JBossWeb: XML parser hijack by malicious web application netty: DoS via memory exhaustion during data aggregation Tomcat/JBossWeb: request smuggling and limited DoS in ChunkedInputFilter WSRP: Information disclosure via unsafe concurrency handling in interceptor Security: Invalid EJB caller role check implementation JAX-RS: Information disclosure via XML eXternal Entity (XXE) RESTEasy: XXE via parameter entities apache-poi: XML eXternal Entity (XXE) flaw PicketLink: XXE via insecure DocumentBuilderFactory usage apache-poi: entity expansion (billion laughs) flaw CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix CLI: Insecure default permissions on history file cas-client: Bypass of security constraints via URL parameter injection RESTeasy: External entities expanded by DocumentProvider wss4j: Apache WSS4J is vulnerable to Bleichenbacher's attack (incomplete fix for CVE-2011-2487) wss4j: Apache WSS4J doesn't correctly enforce the requireSignedEncryptedDataElements property
CVSS v3.0: 4.8
GHSA-chc6-5gxm-wqvp: Multiple cross-site scripting vulnerabilities in signed.php in Hinton Design phphg Guestbook 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) location, (2) website, or (3) message parameter.
CVE-2022-46646: Exposure of sensitive information to an unauthorized actor for some Intel Unison software may allow an authenticated user to potentially enable information disclosure via local access.
CVSS v3.1: 2.2
CVE-2008-3875: The kernel in Sun Solaris 8 through 10 and OpenSolaris before snv_90 allows local users to bypass chroot, zones, and the Solaris Trusted Extensions multi-level security policy, and establish a covert communication channel, via unspecified vectors involving system calls.
CVSS v2.0: 7.2
GHSA-f8hq-773h-3f28: sikcms 1.1 has CSRF via admin.php?m=Admin&c=Users&a=userAdd to add an administrator account.
CVSS v3.0: 8.8
CVE-2023-39054: An information leak in Tokudaya.ekimae_mc v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
CVSS v3.1: 7.5
CVE-2006-1494: Directory traversal vulnerability in file.c in PHP 4.4.2 and 5.1.2 allows local users to bypass open_basedir restrictions allows remote attackers to create files in arbitrary directories via the tempnam function.
CVSS v2.0: 2.6
CVE-2023-6495: YARPP – Yet Another Related Posts Plugin <= 5.30.9 - Authenticated(Administrator+) Cross-Site Scripting
The YARPP – Yet Another Related Posts Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to and including 5.30.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS v3.1: 4.4
GHSA-h779-883h-mr35: In Dovecot before 2.3.11.3, sending a specially formatted RPA request will crash the auth service because a length of zero is mishandled.
CVSS v3.1: 7.5
GHSA-wg94-64mm-c924: Unspecified vulnerability in Smarty before 3.0.0 beta 6 allows remote attackers to execute arbitrary PHP code by injecting this code into a cache file.
CVE-2026-46939: Vulnerability in the Oracle Configure to Order product of Oracle E-Business Suite (component: Supply to Order Workbench).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Configure to Order.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Configure to Order accessible data as well as  unauthorized access to critical data or complete access to all Oracle Configure to Order accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
CVSS v3.1: 8.1
GHSA-4f88-x3x5-4xc4: An issue was discovered in Adobe InDesign 12.1.0 and earlier versions. An exploitable memory corruption vulnerability exists. Successful exploitation could lead to arbitrary code execution.
CVSS v3.0: 9.8
CVE-2025-46261: WordPress Seriously Simple Podcasting plugin <= 3.9.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Stored XSS.This issue affects Seriously Simple Podcasting: from n/a through <= 3.9.0.
CVSS v3.1: 5.9
GHSA-8q5w-6x37-j5hg: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WalkerWP Walker Core walker-core allows DOM-Based XSS.This issue affects Walker Core: from n/a through <= 1.3.17.
CVSS v3.1: 6.5
RHSA-2026:1623: Red Hat Security Advisory: kernel-rt security update
kernel: e1000e: fix heap overflow in e1000_set_eeprom kernel: i40e: fix idx validation in config queues msg kernel: i40e: add validation for ring_len param kernel: Linux kernel: vsock vulnerability may lead to memory corruption
CVSS v3.1: 7
GHSA-5vcg-x4hx-4gmx: The AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning before v3.0.210, F-Stream before v3.0.210, and RestartToUEFI before v1.0.6.2 expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges.
CVSS v3.0: 7.8
CVE-2016-0459: Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 11.5.10.2, 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote authenticated users to affect integrity via unknown vectors related to Popup Windows.
CVSS v2.0: 4
CVE-2023-39265: Apache Superset: Possible Unauthorized Registration of SQLite Database Connections
Apache Superset would allow for SQLite database connections to be incorrectly registered when an attacker uses alternative driver names like sqlite+pysqlite or by using database imports. This could allow for unexpected file creation on Superset webservers. Additionally, if Apache Superset is using a SQLite database for its metadata (not advised for production use) it could result in more severe vulnerabilities related to confidentiality and integrity. This vulnerability exists in Apache Superset versions up to and including 2.1.0.
CVSS v3.1: 3.8
CVE-2012-2972: The (1) server and (2) agent components in CA ARCserve Backup r12.5, r15, and r16 on Windows do not properly validate RPC requests, which allows remote attackers to cause a denial of service (service crash) via a crafted request.
CVSS v2.0: 5
GHSA-pcrh-gj77-j4mw: Concrete CMS is vulnerable to Stored XSS via external-link page cvName
Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via external-link page cvName because updateCollectionAliasExternal bypasses being sanitized.
CVSS v4.0: 2
GHSA-hxxh-jpvq-vr5x: Windows Telephony Service Remote Code Execution Vulnerability
CVSS v3.1: 8.8
CVE-2018-5886: A pointer in an ADSPRPC command is not properly validated in all Android releases from CAF using the Linux kernel (Android for MSM, Firefox OS for MSM, QRD Android), which can lead to kernel memory being accessed.
CVSS v3.0: 7.5
CVSS v2.0: 5
CVE-2026-12104: Authenticated OS Command Injection in Bondix
OS command injection in the environment and tunnel configuration functionality in SIMA GmbH Bondix through version 1.25.7.5 on Linux allows an authenticated attacker with configuration write access to execute arbitrary operating-system commands via crafted configuration values passed to server-side scripts.
CVSS v4.0: 8.6
GHSA-jprr-w597-h565: Stack-based buffer overflow in the SET_WPS_IE IOCTL implementation in wlan_hdd_hostapd.c in the WLAN (aka Wi-Fi) driver for the Linux kernel 3.x and 4.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges via a crafted application that uses a long WPS IE element.
CVSS v3.1: 7.8
RHSA-2024:8170: Red Hat Security Advisory: fence-agents security update
pypa/setuptools: Remote code execution via download functions in the package_index module in pypa/setuptools
CVSS v3.1: 8.8
GHSA-p7c7-98j2-8p2x: The BN_from_montgomery function in crypto/bn/bn_mont.c in OpenSSL 0.9.8e and earlier does not properly perform Montgomery multiplication, which might allow local users to conduct a side-channel attack and retrieve RSA private keys.