ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-3x59-vrmc-5mx6: @webiny/react-rich-text-renderer vulnerable to insecure rendering of rich text content
Overview`@webiny/react-rich-text-renderer` is a react component to render data coming from Webiny Headless CMS and Webiny Form Builder. The `@webiny/react-rich-text-renderer` package depends on the [editor.js](https://editorjs.io/) rich text editor to handle rich text content. The CMS stores rich text content from the `editor.js` into the database. When the `@webiny/react-rich-text-renderer` is used to render such content, it uses the `dangerouslySetInnerHTML` prop, without applying HTML sanitization. The issue arises when an actor, who in this context would specifically be a content manager with access to the CMS, inserts a malicious script as part of the user-defined input. This script is then injected and executed within the user's browser when the main page or admin page loads.Am I affected?You will be affected if you're running a Webiny project created prior to `5.35.0` and you're using the legacy rich text editor (which uses `editor.js` library under the hood). If you've already switched to using the new rich text editor, powered by Lexical editor, you will not be affected by this.How do I patch this vulnerability?Update to Webiny version `5.37.2`.
CVSS v3.1: 4.8
RHSA-2026:27288: Red Hat Security Advisory: kernel security, bug fix, and enhancement update
kernel: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() kernel: rxrpc: Fix RxGK token loading to check bounds kernel: mptcp: fix slab-use-after-free in __inet_lookup_established kernel: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync kernel: Buffer overflow in drivers/xen/sys-hypervisor.c kernel: xen/privcmd: fix double free via VMA splitting kernel: net: mana: fix use-after-free in add_adev() error path kernel: bnxt_en: Fix RSS context delete logic kernel: crypto: caam - fix overflow on long hmac keys kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers kernel: wifi: mac80211: remove station if connection prep fails kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result kernel: wifi: mac80211: use safe list iteration in radar detect work kernel: exit: prevent preemption of oopsing TASK_DEAD task kernel: net/sched: act_pedit: extend the writable skb range per key
CVSS v3.1: 6.7
GHSA-w9xw-rq9v-758p: Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 108 and Firefox ESR 102.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 109, Thunderbird < 102.7, and Firefox ESR < 102.7.
CVSS v3.1: 8.8
GHSA-2j62-pc6c-rfvc: Stored Cross-site scripting (XSS) vulnerability in the TP-Link EAP Controller and Omada Controller versions 2.5.4_Windows/2.6.0_Windows allows authenticated attackers to inject arbitrary web script or HTML via the implementation of portalPictureUpload functionality. This is fixed in version 2.6.1_Windows.
CVSS v3.0: 5.4
CVE-2017-0836: A remote code execution vulnerability in the Android media framework (libhevc). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-64893226.
CVSS v3.0: 7.8
CVSS v2.0: 9.3
GHSA-x64m-328j-2v43: Cross-Site Request Forgery (CSRF) vulnerability in WebToffee Decorator – WooCommerce Email Customizer allows Cross Site Request Forgery.This issue affects Decorator – WooCommerce Email Customizer: from n/a through 1.2.7.
CVSS v3.1: 4.3
CVE-2026-1134: itsourcecode Society Management System expenses.php cross site scripting
A vulnerability was identified in itsourcecode Society Management System 1.0. This affects an unknown function of the file /admin/expenses.php. The manipulation of the argument detail leads to cross site scripting. The attack may be initiated remotely. The exploit is publicly available and might be used.
CVSS v4.0: 5.3
CVSS v3.1: 4.3
CVSS v3.0: 4.3
CVSS v2.0: 5
CVE-2025-69152: WordPress Artale | Wedding Photography WordPress theme <= 2.2.2 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Artale | Wedding Photography WordPress <= 2.2.2 versions.
CVSS v3.1: 7.1
GHSA-94mg-mhw8-cfh2: ** DISPUTED **  PHP remote file inclusion vulnerability in modules/bannieres/bannieres.php in Jean-Christophe Ramos SCRIPT BANNIERES (aka ban 0.1 and PLS-Bannieres 1.21) allows remote attackers to execute arbitrary PHP code via a URL in the chemin parameter.  NOTE: the issue is disputed by other researchers, who observe that $chemin is defined before use.
CVE-2020-7462: In 11.4-PRERELEASE before r360733 and 11.3-RELEASE before p13, improper mbuf handling in the kernel causes a use-after-free bug by sending IPv6 Hop-by-Hop options over the loopback interface. The use-after-free situation may result in unintended kernel behaviour including a kernel panic.
CVSS v3.1: 5.5
CVSS v2.0: 4.9
GHSA-56q5-c3xh-qfp3: An integer overflow in WatchGuard Firebox and XTM appliances allows an unauthenticated remote attacker to trigger a buffer overflow and potentially execute arbitrary code by sending a malicious request to exposed management ports. This is fixed in Fireware OS 12.8.1, 12.5.10, and 12.1.4.
CVSS v3.1: 9.8
GHSA-79hj-rjpx-23q8: popup.php in Virtual War (aka VWar) 1.6.1 R2 allows remote attackers to bypass intended member restrictions and read news posts via a modified newsid parameter in a printnews action.
GHSA-prjq-f4q3-fvfr: github.com/russellhaering/gosaml2 is vulnerable to NULL Pointer Dereference
ImpactIn versions prior to v0.7.0 it was possible for an attacker to supply an invalid assertion which would trigger a panic due to a nil-pointer dereference.PatchesThe issue was patched in v0.7.0, released on March 2, 2022.WorkaroundsCallers to `gosaml2` can use `recover()` to handle panics to mitigate a potential DoS.ReferencesSee issue [#59](https://github.com/russellhaering/gosaml2/issues/59) for details.
CVSS v3.1: 7.5
CVE-2020-35338: The Web Administrative Interface in Mobile Viewpoint Wireless Multiplex Terminal (WMT) Playout Server 20.2.8 and earlier has a default account with a password of "pokon."
CVSS v3.1: 9.8
CVSS v2.0: 7.5
GHSA-68pf-743m-hv2w: Logstash 1.4.x before 1.4.5 and 1.5.x before 1.5.4 with Lumberjack output or the Logstash forwarder does not validate SSL/TLS certificates from the Logstash server, which might allow attackers to obtain sensitive information via a man-in-the-middle attack.
CVSS v3.0: 5.9
CVE-2018-7238: A buffer overflow vulnerability exist in the web-based GUI of Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow an unauthenticated, remote attacker to execute arbitrary code.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2018-4168: An issue was discovered in certain Apple products. iOS before 11.3 is affected. The issue involves the "Files Widget" component. It allows physically proximate attackers to obtain sensitive information by leveraging the display of cached data on a locked device.
CVSS v3.0: 4.6
CVSS v2.0: 2.1
CVE-2024-25885: An issue in the getcolor function in utils.py of xhtml2pdf v0.2.13 allows attackers to cause a Regular expression Denial of Service (ReDOS) via supplying a crafted string.
CVSS v3.1: 7.5
CVE-2018-4186: In Safari before 11.1, an information leakage issue existed in the handling of downloads in Safari Private Browsing. This issue was addressed with additional validation.
CVSS v3.0: 7.5
CVSS v2.0: 5
GHSA-4mgq-4xh9-wr7m: An issue was discovered in ROS2 Iron Irwini versions ROS_VERSION 2 and ROS_PYTHON_VERSION 3, allows remote attackers to execute arbitrary code via packages or nodes within the ROS2 system.
GHSA-3x54-79xc-w2f4: net/rds/sysctl.c in the Linux kernel before 3.19 uses an incorrect data type in a sysctl table, which allows local users to obtain potentially sensitive information from kernel memory or possibly have unspecified other impact by accessing a sysctl entry.
CVE-2025-2580: Contact Form by Bit Form <= 2.18.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
The Contact Form by Bit Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.18.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS v3.1: 4.9
CVE-2014-5946: The forumhawaaworldcom (aka com.tapatalk.forumhawaaworldcom) application 3.4.12 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0: 5.4
CVE-2025-68552: WordPress WooCommerce Coming Soon Product with Countdown plugin <= 5.0 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WebCodingPlace WooCommerce Coming Soon Product with Countdown woo-coming-soon-product allows PHP Local File Inclusion.This issue affects WooCommerce Coming Soon Product with Countdown: from n/a through <= 5.0.
CVSS v3.1: 7.5
CVE-2026-2861: Foswiki Changes/Viewfile/Oops information disclosure
A vulnerability was detected in Foswiki up to 2.1.10. The affected element is an unknown function of the component Changes/Viewfile/Oops. The manipulation results in information disclosure. It is possible to launch the attack remotely. The exploit is now public and may be used. Upgrading to version 2.1.11 is sufficient to fix this issue. The patch is identified as 31aeecb58b64/d8ed86b10e46. Upgrading the affected component is recommended.
CVSS v4.0: 6.9
CVSS v3.1: 5.3
CVSS v3.0: 5.3
CVSS v2.0: 5
GHSA-wqcc-4xm8-jw2j: Police Statistics Database System developed by Gotac has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read, modify, and delete database contents by using a specific functionality.
CVSS v4.0: 9.3
CVSS v3.1: 9.8
CVE-2019-19628: In GitLab EE 11.3 through 12.5.3, 12.4.5, and 12.3.8, insufficient parameter sanitization for the Maven package registry could lead to privilege escalation and remote code execution vulnerabilities under certain conditions.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
GHSA-mr99-mrrj-m2g2: Stack-based buffer overflow in WECON LeviStudio allows remote attackers to execute arbitrary code via a crafted file.
CVSS v3.0: 7.8
GHSA-43h8-7v35-466p: In the Linux kernel, the following vulnerability has been resolved:e100: Fix possible use after free in e100_xmit_prepareIn e100_xmit_prepare(), if we can't map the skb, then return -ENOMEM, so
e100_xmit_frame() will return NETDEV_TX_BUSY and the upper layer will
resend the skb. But the skb is already freed, which will cause UAF bug
when the upper layer resends the skb.Remove the harmful free.
CVSS v3.1: 7.8
GHSA-4m5w-43cx-p687: Microsoft Index Server 2.0 in Windows NT 4.0, and Indexing Service in Windows 2000, allows remote attackers to read server-side include files via a malformed search request, aka a new variant of the "Malformed Hit-Highlighting" vulnerability.
CVE-2018-4065: An exploitable cross-site scripting vulnerability exists in the ACEManager ping_result.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP ping request can cause reflected javascript code execution, resulting in the execution of javascript code running on the victim's browser. An attacker can get a victim to click a link, or embedded URL, that redirects to the reflected cross-site scripting vulnerability to trigger this vulnerability.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
CVE-2023-40008: WordPress Simple Org Chart Plugin <= 2.3.4 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in Gangesh Matta Simple Org Chart plugin <= 2.3.4 versions.
CVSS v3.1: 4.3
GHSA-p3rv-qj56-2fqx: Cross-site Scripting in Pyhtml2pdf
Pyhtml2pdf version 0.0.6 allows an external attacker to remotely obtainarbitrary local files. This is possible because the application does notvalidate the HTML content entered by the user.
CVSS v3.1: 7.5
CVE-2013-5476: The Zone-Based Firewall (ZFW) feature in Cisco IOS 15.1 through 15.2, when content filtering or HTTP ALG inspection is enabled, allows remote attackers to cause a denial of service (device reload or hang) via crafted IPv4 HTTP traffic, aka Bug ID CSCtx56174.
CVSS v2.0: 7.8
PYSEC-2021-97: The thefuck (aka The Fuck) package before 3.31 for Python allows Path Traversal that leads to arbitrary file deletion via the "undo archive operation" feature.
CVE-2012-1442: The ELF file parser in Quick Heal (aka Cat QuickHeal) 11.00, McAfee Anti-Virus Scanning Engine 5.400.0.1158, McAfee Gateway (formerly Webwasher) 2010.1C, eSafe 7.0.17.0, Kaspersky Anti-Virus 7.0.0.125, F-Secure Anti-Virus 9.0.16160.0, Sophos Anti-Virus 4.61.0, Antiy Labs AVL SDK 2.0.3.7, Rising Antivirus 22.83.00.03, Fortinet Antivirus 4.2.254.0, and Panda Antivirus 10.0.2.7 allows remote attackers to bypass malware detection via an ELF file with a modified class field. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different ELF parser implementations.
CVSS v2.0: 4.3
CVE-2018-15938: Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS v3.0: 7.8
CVSS v2.0: 9.3
GHSA-7wq4-v54m-6v3f: Out-of-bounds Read vulnerability in tildearrow furnace (‎extern/libsndfile-modified/src modules). This vulnerability is associated with program files flac.C‎.This issue affects furnace: before 0.7.
CVSS v4.0: 8.4
GHSA-c2q6-w8rj-wvhw: hw/pci/pcie_sriov.c in QEMU through 10.0.3 mishandles the VF Enable bit write mask, a related issue to CVE-2024-26327.
CVSS v3.1: 4.2
RHSA-2020:2418: Red Hat Security Advisory: unbound security update
unbound: amplification of an incoming query into a large number of queries directed to a target unbound: infinite loop via malformed DNS answers received from upstream servers
CVSS v3.1: 7.5
CVE-2024-9350: DPD Baltic Shipping <= 1.2.83 - Reflected Cross-Site Scripting
The DPD Baltic Shipping plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search_value' parameter in all versions up to, and including, 1.2.83 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS v3.1: 6.1
CVE-2020-7882: anySign directory traversal vulnerability
Using the parameter of getPFXFolderList function, attackers can see the information of authorization certification and delete the files. It occurs because the parameter contains path traversal characters(ie. '../../../')
CVSS v3.1: 7.5
GHSA-qw28-fg2g-m9gh: Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 on Linux contains a SQL Injection vulnerability (CWE-89) in the system configuration module. A remote attacker can send specially crafted HTTP POST requests to the /php/request.php endpoint via the sql parameter in application/x-www-form-urlencoded data (e.g., action=do&sql=<query_here>&reload_driver=0) to execute arbitrary SQL commands and potentially achieve remote code execution.
CVSS v4.0: 9.3
CVSS v3.1: 9.8
GHSA-7p5m-v798-f8vv: Electerm Local code through electerm's single-instance socket
Impact_Local code execution without UI interaction: any same-user process can send a JSON payload to electerm's single-instance socket/pipe, causing the app to create tabs and potentially spawn attacker-controlled local processes. Affects electerm single-instance installs on the machine._Patcheshttps://github.com/electerm/electerm/commit/0599e67069b00e376a2e962649aaad6096e63507WorkaroundsDo not run unsafe commandReferencesReport / credit: https://github.com/Curly-Haired-BaboonElecterm releases: https://github.com/electerm/electerm/releases
CVSS v4.0: 9.3
GHSA-cvpc-h9hw-p85x: When APM 13.0.0-13.1.x is deployed as an OAuth Resource Server, APM becomes a client application to an external OAuth authorization server. In certain cases when communication between the BIG-IP APM and the OAuth authorization server is lost, APM may not display the intended message in the failure response
CVSS v3.0: 5.9
CVE-2016-3433: Unspecified vulnerability in the Oracle Business Intelligence Enterprise Edition component in Oracle Fusion Middleware 11.1.1.7.0 and 11.1.1.9.0 allows remote authenticated users to affect confidentiality and integrity via vectors related to Analytics Web Administration.
CVSS v3.0: 5.4
CVSS v2.0: 4.9
CVE-2019-12377: A vulnerable upl/async_upload.asp web API endpoint in Ivanti LANDESK Management Suite (LDMS, aka Endpoint Manager) 10.0.1.168 Service Update 5 allows arbitrary file upload, which may lead to arbitrary remote code execution.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
CVE-2018-10897: A directory traversal issue was found in reposync, a part of yum-utils, where reposync fails to sanitize paths in remote repository configuration files. If an attacker controls a repository, they may be able to copy files outside of the destination directory on the targeted system via path traversal. If reposync is running with heightened privileges on a targeted system, this flaw could potentially result in system compromise via the overwriting of critical system files. Version 1.1.31 and older are believed to be affected.
CVSS v3.0: 8.8
CVE-2024-23923: Alpine Halo9 prh_l2_sar_data_ind Use-After-Free Remote Code Execution Vulnerability
Alpine Halo9 prh_l2_sar_data_ind Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine Halo9 devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the prh_l2_sar_data_ind function. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of root.

Was ZDI-CAN-22945
CVSS v3.1: 8.8
GHSA-gq98-53rq-qr5h: Hashicorp Vault vulnerable to Cross-site Scripting
Vault and Vault Enterprise's (Vault) key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI through key values. This vulnerability, CVE-2023-2121, is fixed in Vault 1.14.0, 1.13.3, 1.12.7, and 1.11.11.
CVSS v3.1: 4.3
GHSA-hfm2-m84q-6rc9: A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges on the underlying Linux operating system (OS) of an affected device. This vulnerability is due to insufficient input validation of commands that are supplied by the user. An attacker could exploit this vulnerability by authenticating to a device and submitting crafted input to an affected command. A successful exploit could allow the attacker to execute commands on the underlying Linux OS with root privileges.
GHSA-r7w2-px2g-jxj7: A vulnerability was found in D-Link DIR-600L up to 2.07B01. It has been classified as critical. Affected is the function formSetWAN_Wizard534. The manipulation of the argument host leads to buffer overflow. It is possible to launch the attack remotely. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS v4.0: 8.7
CVSS v3.1: 8.8
CVE-2002-0081: Buffer overflows in (1) php_mime_split in PHP 4.1.0, 4.1.1, and 4.0.6 and earlier, and (2) php3_mime_split in PHP 3.0.x allows remote attackers to execute arbitrary code via a multipart/form-data HTTP POST request when file_uploads is enabled.
CVSS v2.0: 7.5
CVE-2015-2483: Microsoft Internet Explorer 10 and 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Information Disclosure Vulnerability."
CVSS v2.0: 5
GHSA-939f-fg49-mpq8: A vulnerability classified as problematic was found in Thinkware Car Dashcam F800 Pro up to 20250226. Affected by this vulnerability is an unknown functionality of the component Connection Handler. The manipulation leads to denial of service. The attack can only be initiated within the local network. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 2.3
CVSS v3.1: 3.1
ICSA-24-319-13: Rockwell Automation Verve Reporting (Update A)
Verve Reporting utilizes Kibana, which contains a remote code execution vulnerability that allows an attacker with access to ML and alerting connecting features as well as write access to internal ML to trigger a prototype pollution vulnerability, which can ultimately lead to arbitrary code execution. The code execution is limited to the container.
CVSS v3.1: 7.2
GHSA-6mx3-3vqg-hpp2: Django allows unprivileged users to read the password hashes of arbitrary accounts
An issue was discovered in Django 2.1 before 2.1.2, in which unprivileged users can read the password hashes of arbitrary accounts. The read-only password widget used by the Django Admin to display an obfuscated password hash was bypassed if a user has only the "view" permission (new in Django 2.1), resulting in display of the entire password hash to those users. This may result in a vulnerability for sites with legacy user accounts using insecure hashes.
CVSS v4.0: 6.9
CVSS v3.0: 4.9
GHSA-xfxm-78mc-4747: Buffer overflow scenario if the client sends more than 5 io_vec requests to the server in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24
CVSS v3.1: 7.8
RHSA-2023:3292: Red Hat Security Advisory: httpd24-httpd security update
httpd: HTTP request splitting with mod_rewrite and mod_proxy
CVSS v3.1: 9.8
GHSA-4q63-mr2m-57hf: kubevirt allows a local attacker to execute arbitrary code via a crafted command
An issue in kubevirt kubevirt v1.2.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component.
CVSS v3.1: 5.9
CVE-2018-18714: RegFilter.sys in IOBit Malware Fighter 6.2 and earlier is susceptible to a stack-based buffer overflow when an attacker uses IOCTL 0x8006E010. This can lead to denial of service (DoS) or code execution with root privileges.
CVSS v3.0: 7.8
CVSS v2.0: 7.2
CVE-2025-55503: Tenda AC6 V15.03.06.23_multi has a stack overflow vulnerability via the deviceName parameter in the saveParentControlInfo function.
CVSS v3.1: 7.3
GHSA-7m6g-3fpv-8gmx: Incorrect access control in mihomo v1.19.11 allows authenticated attackers with low-level privileges to read arbitrary files with elevated privileges via obtaining the external control key from the config file.
CVSS v3.1: 6.5