ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-wjh6-3xg7-c2h2: In the Linux kernel, the following vulnerability has been resolved:hfsplus: fix uninit-value by validating catalog record sizeSyzbot reported a KMSAN uninit-value issue in hfsplus_strcasecmp(). The
root cause is that hfs_brec_read() doesn't validate that the on-disk
record size matches the expected size for the record type being read.When mounting a corrupted filesystem, hfs_brec_read() may read less data
than expected. For example, when reading a catalog thread record, the
debug output showed:HFSPLUS_BREC_READ: rec_len=520, fd->entrylength=26
  HFSPLUS_BREC_READ: WARNING - entrylength (26) < rec_len (520) - PARTIAL READ!hfs_brec_read() only validates that entrylength is not greater than the
buffer size, but doesn't check if it's less than expected. It successfully
reads 26 bytes into a 520-byte structure and returns success, leaving 494
bytes uninitialized.This uninitialized data in tmp.thread.nodeName then gets copied by
hfsplus_cat_build_key_uni() and used by hfsplus_strcasecmp(), triggering
the KMSAN warning when the uninitialized bytes are used as array indices
in case_fold().Fix by introducing hfsplus_brec_read_cat() wrapper that:Calls hfs_brec_read() to read the dataValidates the record size based on the type field:Fixed size for folder and file recordsVariable size for thread records (depends on string length)Returns -EIO if size doesn't match expectedFor thread records, check against HFSPLUS_MIN_THREAD_SZ before reading
nodeName.length to avoid reading uninitialized data at call sites that
don't zero-initialize the entry structure.Also initialize the tmp variable in hfsplus_find_cat() as defensive
programming to ensure no uninitialized data even if validation is
bypassed.
CVSS v3.1: 5.5
CVE-2022-3809: Axiomatic Bento4 mp4tag Mp4Tag.cpp ParseCommandLine denial of service
A vulnerability was found in Axiomatic Bento4 and classified as problematic. Affected by this issue is the function ParseCommandLine of the file Mp4Tag/Mp4Tag.cpp of the component mp4tag. The manipulation leads to denial of service. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-212666 is the identifier assigned to this vulnerability.
CVSS v3.1: 4.3
GHSA-hw93-9r88-26rp: Cross-site Scripting (XSS) vulnerability in BlueSpiceUserSidebar extension of BlueSpice allows user with regular account and edit permissions to inject arbitrary HTML into the personal menu navigation of their own and other users. This allows for targeted attacks.
CVSS v3.1: 5.4
CVE-2021-25986: Django-wiki - Stored Cross-Site Scripting (XSS) in Notifications Section
In Django-wiki, versions 0.0.20 to 0.7.8 are vulnerable to Stored Cross-Site Scripting (XSS) in Notifications Section. An attacker who has access to edit pages can inject JavaScript payload in the title field. When a victim gets a notification regarding the changes made in the application, the payload in the notification panel renders and loads external JavaScript.
CVSS v3.1: 5.4
CVE-2019-16986: In FusionPBX up to v4.5.7, the file resources\download.php uses an unsanitized "f" variable coming from the URL, which takes any pathname and allows a download of it. (resources\secure_download.php is also affected.)
CVSS v3.1: 6.5
CVSS v2.0: 4
CVE-2023-46582: SQL injection vulnerability in Inventory Management v.1.0 allows a local attacker to execute arbitrary SQL commands via the id paramter in the deleteProduct.php component.
CVSS v3.1: 7.8
RHSA-2026:4731: Red Hat Security Advisory: libpng security update
libpng: libpng: Denial of service and information disclosure via heap buffer over-read in png_image_finish_read libpng: libpng: Information disclosure and denial of service via integer truncation in simplified write API libpng: LIBPNG has a heap buffer overflow in png_set_quantize
CVSS v3.1: 7
GHSA-vg4f-4gf6-23hh: A vulnerability was found in Campcodes Video Sharing Website 1.0. It has been declared as critical. This vulnerability affects unknown code of the file admin_class.php. The manipulation of the argument email leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-225916.
CVSS v3.1: 7.5
RHSA-2026:4242: Red Hat Security Advisory: kernel security update
kernel: Linux kernel: Use-after-free vulnerability in page_pool_recycle_in_ring can lead to arbitrary code execution kernel: Linux kernel ALSA USB audio driver: Buffer overflow leading to information disclosure and denial of service
CVSS v3.1: 7.3
CVE-2022-29241: Known or guessable hidden files may be accessed in Jupyter Server
Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter Notebook. Prior to version 1.17.1, if notebook server is started with a value of `root_dir` that contains the starting user's home directory, then the underlying REST API can be used to leak the access token assigned at start time by guessing/brute forcing the PID of the jupyter server. While this requires an authenticated user session, this URL can be used from a cross-site scripting payload or from a hooked or otherwise compromised browser to leak this access token to a malicious third party. This token can be used along with the REST API to interact with Jupyter services/notebooks such as modifying or overwriting critical files, such as .bashrc or .ssh/authorized_keys, allowing a malicious user to read potentially sensitive data and possibly gain control of the impacted system. This issue is patched in version 1.17.1.
CVSS v3.1: 7.1
GHSA-37q9-236v-5578: Buffer overflow in AOL Instant Messenger before 4.3.2229 allows remote attackers to execute arbitrary commands via a long "goim" command.
GHSA-w4pr-xjh8-387g: Buffer overflow in DNS resolver functions that perform lookup of network names and addresses, as used in BIND 4.9.8 and ported to glibc 2.2.5 and earlier, allows remote malicious DNS servers to execute arbitrary code through a subroutine used by functions such as getnetbyname and getnetbyaddr.
CVE-2024-29035: Umbraco's Blind SSRF Leads to Port Scan by using Webhooks
Umbraco is an ASP.NET CMS. Failing webhooks logs are available when solution is not in debug mode. Those logs can contain information that is critical. This vulnerability is fixed in 13.1.1.
CVSS v3.1: 4.1
CVE-2025-34423: MailEnable < 10.54 DLL Hijacking via Unsafe Loading of MEAIAU.DLL
MailEnable versions prior to 10.54 contain an unsafe DLL loading vulnerability that can lead to local arbitrary code execution. The MailEnable administrative executable attempts to load MEAIAU.DLL from its installation directory without sufficient integrity validation or a secure search order. A local attacker with write access to that directory can plant a malicious MEAIAU.DLL, which is then loaded on execution, resulting in attacker-controlled code running with the privileges of the process.
CVSS v4.0: 8.5
GHSA-983j-f2fq-2775: In the Linux kernel, the following vulnerability has been resolved:binder: fix freeze UAF in binder_release_work()When a binder reference is cleaned up, any freeze work queued in the
associated process should also be removed. Otherwise, the reference is
freed while its ref->freeze.work is still queued in proc->work leading
to a use-after-free issue as shown by the following KASAN report:==================================================================
  BUG: KASAN: slab-use-after-free in binder_release_work+0x398/0x3d0
  Read of size 8 at addr ffff31600ee91488 by task kworker/5:1/211CPU: 5 UID: 0 PID: 211 Comm: kworker/5:1 Not tainted 6.11.0-rc7-00382-gfc6c92196396 #22
  Hardware name: linux,dummy-virt (DT)
  Workqueue: events binder_deferred_func
  Call trace:
   binder_release_work+0x398/0x3d0
   binder_deferred_func+0xb60/0x109c
   process_one_work+0x51c/0xbd4
   worker_thread+0x608/0xee8Allocated by task 703:
   __kmalloc_cache_noprof+0x130/0x280
   binder_thread_write+0xdb4/0x42a0
   binder_ioctl+0x18f0/0x25ac
   __arm64_sys_ioctl+0x124/0x190
   invoke_syscall+0x6c/0x254Freed by task 211:
   kfree+0xc4/0x230
   binder_deferred_func+0xae8/0x109c
   process_one_work+0x51c/0xbd4
   worker_thread+0x608/0xee8This commit fixes the issue by ensuring any queued freeze work is removed
when cleaning up a binder reference.
CVSS v3.1: 7.8
CVE-2015-0579: Cisco TelePresence Video Communication Server (VCS) and Cisco Expressway allow remote attackers to cause a denial of service (memory and CPU consumption, and partial outage) via crafted SIP packets, aka Bug ID CSCur12473.
CVSS v2.0: 5
CVE-2022-44693: Microsoft SharePoint Server Remote Code Execution Vulnerability
Microsoft SharePoint Server Remote Code Execution Vulnerability
CVSS v3.1: 8.8
GHSA-6xrv-xv3c-4g9r: An untrusted search path vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacker to escalate their privileges on affected installations.Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.This is a similar, but not identical vulnerability as CVE-2023-34145.
CVSS v3.1: 7.8
CVE-2021-39776: In NFC, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-192614125
CVSS v3.1: 7.8
CVSS v2.0: 4.6
CVE-2014-3487: The cdf_read_property_info function in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, does not properly validate a stream offset, which allows remote attackers to cause a denial of service (application crash) via a crafted CDF file.
CVSS v2.0: 4.3
CVE-2023-31848: davinci 0.3.0-rc is vulnerable to Server-side request forgery (SSRF).
CVSS v3.1: 8.8
GHSA-fqwg-5wxg-6mp3: The Forms Authentication feature in the ASP.NET subsystem in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5 SP1, 3.5.1, and 4.0 allows remote authenticated users to obtain access to arbitrary user accounts via a crafted username, aka "ASP.Net Forms Authentication Bypass Vulnerability."
CVE-2025-15536: BYVoid OpenCC MaxMatchSegmentation.cpp MaxMatchSegmentation heap-based overflow
A weakness has been identified in BYVoid OpenCC up to 1.1.9. This vulnerability affects the function opencc::MaxMatchSegmentation of the file src/MaxMatchSegmentation.cpp. This manipulation causes heap-based buffer overflow. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. Patch name: 345c9a50ab07018f1b4439776bad78a0d40778ec. To fix this issue, it is recommended to deploy a patch.
CVSS v4.0: 4.8
CVSS v3.1: 5.3
CVSS v3.0: 5.3
CVSS v2.0: 4.3
GHSA-j22r-rxv9-h8pm: A vulnerability, which was classified as problematic, has been found in iteachyou Dreamer CMS 4.1.3. This issue affects some unknown processing of the file /resource/js/ueditor-1.4.3.3. The manipulation leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 5.3
CVSS v3.1: 4.3
GHSA-hjg6-2c9h-3rgp: Authorization bypass through User-Controlled key vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Automation System allows Exploitation of Trusted Identifiers.This issue affects Library Automation System: from v.21.6 before v.22.1.
CVSS v3.1: 8.8
CVE-2008-2970: Multiple session fixation vulnerabilities in Academic Web Tools (AWT YEKTA) 1.4.3.1, and 1.4.2.8 and earlier, allow remote attackers to hijack web sessions by setting the PHPSESSID parameter to (1) index.php and (2) login.php in homepg/.
CVSS v2.0: 7.5
CVE-2023-41209: D-Link DAP-1325 SetHostIPv6StaticSettings StaticDNS1 Stack-based Buffer Overflow Remote Code Execution Vulnerability
D-Link DAP-1325 SetHostIPv6StaticSettings StaticDNS1 Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of XML data provided to the HNAP1 SOAP endpoint. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-18835.
CVSS v3.0: 8.8
CVE-2026-8404: Potential exposure of private data via case-sensitive Cache-Control directives in UpdateCacheMiddleware
An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.
`django.middleware.cache.UpdateCacheMiddleware` in Django does not match `Cache-Control` response directives case-insensitively, which allows remote attackers to read responses that were incorrectly cached because their `Cache-Control` directives used uppercase or mixed-case values.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Ahmed Badawe for reporting this issue.
CVSS v4.0: 2.3
CVSS v3.1: 3.1
GHSA-vp62-m958-qj8c: Gravitee API Management contains Path Traversal
**This CVE addresses the partial fix for CVE-2019-25075**Gravitee API Management before 3.15.13 allows path traversal through HTML injection. A certain HTML injection combined with path traversal in the Email service in Gravitee API Management before 3.15.13 allows anonymous users to read arbitrary files via a /management/users/register request.A patch was published in 2019 for this vulnerability but did not appear to have solved the issue. Version 3.15.13 did remove the flaw.
CVSS v3.1: 8.6
GHSA-mch4-wjp2-wj65: Format string vulnerability in the log function in SUS 2.0.2, and other versions before 2.0.6, allows local users to execute arbitrary code via format string specifiers in a command line argument that is passed directly to syslog.
GHSA-fgx3-vmfh-pjgw: Authenticated (subscriber+) plugin settings change leading to Stored Cross-Site Scripting (XSS) vulnerability in Akash soni's AS – Create Pinterest Pinboard Pages plugin <= 1.0 at WordPress.
CVSS v3.1: 5.4
GHSA-frxp-xxx8-hrg6: Missing Authorization in DayByDay CRM
In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account (employee type user), can view the absences of all users in the system including administrators. This type of user is not authorized to view this kind of information.
CVSS v3.1: 4.3
CVE-2026-43644: podinfo 6.11.2 Reflected XSS via /echo Endpoint
podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints where the echoHandler writes request body content directly to the response without setting explicit Content-Type or X-Content-Type-Options headers. Attackers can craft cross-origin HTML pages with auto-submitting forms containing script payloads in the request body, which are served as text/html due to Go's content type detection, allowing the reflected script to execute in the podinfo origin context when victims visit the attacker's page.
CVSS v4.0: 5.1
CVSS v3.1: 5.4
GHSA-hvr4-fqgg-4q98: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound ViperBar allows Reflected XSS. This issue affects ViperBar: from n/a through 2.0.
CVSS v3.1: 7.1
GHSA-6hmq-vw9f-p5pf: A NULL Pointer Dereference vulnerability in the messaging_ipc.dll component as used in Bitdefender Total Security, Internet Security, Antivirus Plus, Endpoint Security Tools, VPN Standalone allows an attacker to arbitrarily crash product processes and generate crashdump files.
This issue affects:
Bitdefender Total Security
versions prior to 26.0.3.29.
Bitdefender Internet Security
versions prior to 26.0.3.29.
Bitdefender Antivirus Plus
versions prior to 26.0.3.29.
Bitdefender Endpoint Security Tools
versions prior to 7.2.2.92.
Bitdefender VPN Standalone
versions prior to 25.5.0.48.
CVSS v3.1: 6.1
GHSA-67g9-87g9-j8g9: A vulnerability in the FTP inspection engine of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass FTP inspection. The vulnerability is due to ineffective flow tracking of FTP traffic. An attacker could exploit this vulnerability by sending crafted FTP traffic through an affected device. A successful exploit could allow the attacker to bypass FTP inspection and successfully complete FTP connections.
CVSS v3.1: 5.3
CVE-2026-48759: TypeBot: Cross-Workspace Theme Template IDOR (Modification and Deletion)
TypeBot is a chatbot builder tool. Versions 3.15.2 and below have an Insecure Direct Object Reference vulnerability through cross-workspace Theme Template modification and deletion. The handleSaveThemeTemplate and handleDeleteThemeTemplate handlers validate that the authenticated user is a non-guest member of the provided workspaceId, but then operate on themeTemplateId via Prisma queries that do NOT include workspaceId in the WHERE clause. This allows any authenticated user to modify or delete theme templates belonging to any other workspace and may expose Template IDs via shared typebots or network traffic. This issue has been fixed in version 3.16.0.
CVSS v3.1: 7.1
GHSA-8p4x-fq8v-xhv4: Arbitrary file read vulnerability in Jenkins Continuous Integration with Toad Edge Plugin
Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier allows attackers with Item/Configure permission to read arbitrary files on the Jenkins controller by specifying an input folder on the Jenkins controller as a parameter to its build steps.
CVSS v3.1: 6.5
RHSA-2025:0288: Red Hat Security Advisory: Bug fix of NetworkManager
DHCP: DHCP routing options can manipulate interface-based VPN traffic
CVSS v3.1: 7.6
RHSA-2021:0421: Red Hat Security Advisory: rh-nodejs14-nodejs security update
nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS nodejs-y18n: prototype pollution vulnerability nodejs-ini: Prototype pollution via malicious INI file nodejs: use-after-free in the TLS implementation c-ares: ares_parse_{a,aaaa}_reply() insufficient naddrttls validation DoS nodejs: HTTP request smuggling via two copies of a header field in an http request nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function
CVSS v3.1: 5.6
CVSS v3.0: 4.3
RHSA-2025:15841: Red Hat Security Advisory: Red Hat Enterprise Linux AI 1.5 (NVIDIA)
vllm: vLLM Allows Remote Code Execution via PyNcclPipe Communication Service python-pillow: pillow: Pillow DDS Heap Buffer Overflow
CVSS v3.1: 7.1
RHSA-2024:0499: Red Hat Security Advisory: libssh security update
ssh: Prefix truncation attack on Binary Packet Protocol (BPP)
CVSS v3.1: 5.9
GHSA-2225-p3w2-pmwj: The SlideShowPro SC plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `slideShowProSC` shortcode in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
GHSA-3h9h-qfvw-98hq: OpenEXR Makes Use of Uninitialized Memory
SummaryWhile fuzzing `openexr_exrcheck_fuzzer`, Valgrind reports a conditional branch depending on uninitialized data inside `generic_unpack`. This indicates a use of uninitialized memory (CWE-457). The issue is reproducible with the current OSS-Fuzz harness and a single-file PoC.Details**Environment:**Tooling: `valgrind --tool=memcheck --track-origins=yes`Target: `openexr_exrcheck_fuzzer`OS: Ubuntu 20.04.6 LTS focal x86_64openexr version and Git-commit hash: ` openexr 3.4.2 | commit fd657e8a41e157e5841c7cc2e2a5efe094b069a1 (grafted, HEAD -> main, origin/main, origin/HEAD)`Function: `generic_unpack`Possible root cause (based on observed symptoms):
The unpacker is branching on bytes in a scratch buffer that were never written because the decode step didn’t fully populate it.The first use flagged is in `generic_unpack()`. That function reads from the decompressed/expanded pixel buffer to scatter data into the framebuffer. A “conditional jump depends on uninitialised value(s)” means it’s consulting bytes in that buffer before they were written.Valgrind says the uninitialised value “was created by a heap allocation (malloc)”, not the stack: this matches a per-tile/per-scanline decode scratch buffer allocated in `exr_decoding_run()`.**Valgrind Trace (top frames):**PoCIn the attached archive, you will find:The executable used for our tests.The testcase used to trigger the bug.To observe the bug, simply run the OSS-Fuzz helper script:ImpactUndefined BehaviorPotential crashDenial of Service**Credit:** Aldo Ristori
[archive0.zip](https://github.com/user-attachments/files/23024726/archive0.zip)Update Note:Other saved testcases from the fuzzing campaign trigger the same underlying bug, but with a different manifestation. So there is one root cause (missing post-decode validation / zero-init before any unpack), with different call-sites. Below there are several archives, formatted like the previous one, that reproduce the other test cases.**Other observed sinks (distinct manifestations of the same bug):****Deep pointers path:**
generic_unpack_deep_pointers (deep scanline/tiled)
[archive1.zip](https://github.com/user-attachments/files/23024736/archive1.zip)**Deep sample table path:**
unpack_sample_table (deep scanline)
[archive2.zip](https://github.com/user-attachments/files/23024740/archive2.zip)**Half conversion path:**
half_to_float_buffer_f16c via unpack_half_to_float_3chan_planar
[archive3.zip](https://github.com/user-attachments/files/23024744/archive3.zip)**Deep compositing:**
CompositeDeepScanLine::readPixels → ThreadPool::addTask → LineCompositeTask::execute
[archive4.zip](https://github.com/user-attachments/files/23024746/archive4.zip)
CVSS v4.0: 2
CVSS v3.1: 7.5
CVE-2019-25305: JumpStart 0.6.0.0 - 'jswpbapi' Unquoted Service Path
JumpStart 0.6.0.0 contains an unquoted service path vulnerability in the jswpbapi service running with LocalSystem privileges. Attackers can exploit the unquoted path containing spaces to inject and execute malicious code with elevated system permissions.
CVSS v4.0: 8.5
CVSS v3.1: 7.8
GHSA-fwgq-j9r9-qjgr: Casdoor has an authentication bypass
Casdoor versions 2.362.0 and earlier contain a vulnerability that allows an attacker to bypass authentication by supplying an arbitrary signing certificate. The buildSpCertificateStore function extracts the X.509 certificate directly from the incoming SAMLResponse instead of using the trusted pre-configured Identity Provider certificate, allowing an attacker to forge assertions signed with an attacker-controlled key.
CVSS v3.1: 9.1
CVE-2018-25050: Harvest Chosen abstract-chosen.coffee AbstractChosen cross site scripting
A vulnerability, which was classified as problematic, has been found in Harvest Chosen up to 1.8.6. Affected by this issue is the function AbstractChosen of the file coffee/lib/abstract-chosen.coffee. The manipulation of the argument group_label leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.8.7 is able to address this issue. The name of the patch is 77fd031d541e77510268d1041ed37798fdd1017e. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216956.
CVSS v3.1: 3.5
CVSS v3.0: 3.5
GHSA-mqh7-fvwx-6qg3: The Telnet service for Polycom ViewStation before 7.2.4 does not restrict the number of failed login attempts, which makes it easier for remote attackers to guess usernames and passwords via a brute force attack.
CVSS v3.1: 7.5