ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-hf99-hxhq-4f7v: Improper input validation in firmware for some Intel(R) NUCs may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS v3.1: 6.7
CVE-2016-7955: The logcheck function in session.inc in AlienVault OSSIM before 5.3.1, when an action has been created, and USM before 5.3.1 allows remote attackers to bypass authentication and consequently obtain sensitive information, modify the application, or execute arbitrary code as root via an "AV Report Scheduler" HTTP User-Agent header.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
GHSA-hj9x-fjf3-h23p: In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of input size validation before copying to buffer in PMIC function can lead to heap overflow.
CVSS v3.0: 7.8
GHSA-jj7f-gj82-922p: The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 does not include the HTTPOnly flag in a Set-Cookie header for an unspecified cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, a different vulnerability than CVE-2013-3984.
GHSA-vhwx-7fp7-5q6g: User names used to access the web management interface are limited to 
the device identifier, which is a numerical identifier no more than 10 
digits. A malicious actor can enumerate potential targets by 
incrementing or decrementing from known identifiers or through 
enumerating random digit sequences.
CVSS v4.0: 8.8
CVSS v3.1: 8.6
RHSA-2026:3078: Red Hat Security Advisory: grafana security update
grafana/grafana/pkg/services/dashboards: Grafana Dashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege Escalation
CVSS v3.1: 8.1
RHSA-2016:1844: Red Hat Security Advisory: libarchive security update
libarchive: NULL pointer access in RAR parser through bsdtar libarchive: NULL pointer access in CAB parser libarchive: Heap out of bounds read in LHA/LZH parser libarchive: Stack out of bounds read in ar parser libarchive: Global out of bounds read in mtree parser libarchive: NULL pointer access in 7z parser libarchive: Unclear crashes in ZIP parser libarchive: Heap out of bounds read in TAR parser libarchive: Unclear invalid memory read in mtree parser libarchive: NULL pointer access in RAR parser libarchive: Heap out of bounds read in mtree parser libarchive: Endless loop in ISO parser libarchive: Undefined behavior (signed integer overflow) in mtree parser libarchive: Undefined behavior / invalid shiftleft in TAR parser libarchive: out of bounds heap read in RAR parser libarchive: zip_read_mac_metadata() heap-based buffer overflow libarchive: Heap buffer overflow vulnerability in the 7zip read_SubStreamsInfo libarchive: Heap buffer overflow in the Rar decompression functionality libarchive: Memory allocate error with symbolic links in cpio archives libarchive: Archive Entry with type 1 (hardlink), but has a non-zero data size file overwrite libarchive: undefined behaviour (integer overflow) in iso parser libarchive: Buffer overflow when writing large iso9660 containers libarchive: Denial of service using a crafted gzip file
CVSS v3.0: 3.5
RHSA-2020:0464: Red Hat Security Advisory: 389-ds:1.4 security update
389-ds-base: Read permission check bypass via the deref plugin
CVSS v3.0: 6.5
GHSA-wjqm-hg65-p946: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Anubis anubis allows PHP Local File Inclusion.This issue affects Anubis: from n/a through <= 1.25.
CVSS v3.1: 8.1
CVE-2018-12260: An issue was discovered on Momentum Axel 720P 5.1.8 devices. The root password can be obtained in cleartext by issuing the command 'showKey' from the root CLI. This password may be the same on all devices
CVSS v3.0: 6.7
CVSS v2.0: 2.1
RHSA-2021:1351: Red Hat Security Advisory: thunderbird security update
Mozilla: More internal network hosts could have been probed by a malicious webpage Mozilla: Out of bound write due to lazy initialization Mozilla: Use-after-free in Responsive Design Mode Mozilla: Secure Lock icon could have been spoofed Mozilla: Blob URLs may have been granted additional privileges Mozilla: Arbitrary FTP command execution on FTP servers using an encoded URL Mozilla: Incorrect size computation in WebAssembly JIT could lead to null-reads Mozilla: Port blocking could be bypassed Mozilla: Race condition when reading from disk while verifying signatures
CVSS v3.1: 2.5
CVSS v3.0: 6.1
CVE-2021-23385: Open Redirect
This affects all versions of package Flask-Security. When using the get_post_logout_redirect and get_post_login_redirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False. **Note:** Flask-Security is not maintained anymore.
CVSS v3.1: 5.4
GHSA-9cv6-73mr-84fw: This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to access user-sensitive data.
CVSS v3.1: 5.5
GHSA-vf6r-32rf-hv67: GetSimple CMS 3.3.16 allows in parameter 'permalink' on the Settings page persistent Cross Site Scripting which is executed when you create and open a new page
GHSA-2p4m-4mc7-m8w7: A weakness has been identified in Qi-ANXIN QAX Virus Removal up to 2025-10-22. The affected element is the function ZwTerminateProcess in the library QKSecureIO_Imp.sys of the component Mini Filter Driver. Executing a manipulation can lead to improper access controls. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 1.9
CVSS v3.1: 5.3
CVE-2018-8844: Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The web application does not, or cannot, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3.0: 8.8
CVSS v2.0: 6.8
CVE-2026-24965: WordPress Contest Gallery plugin <= 28.1.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contest Gallery: from n/a through <= 28.1.1.
CVSS v3.1: 4.3
GHSA-22hj-9cx7-p2hw: An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Unauthorized external users could perform Server Side Requests via the CI Lint API
CVSS v3.1: 7.5
CVE-2025-58256: WordPress DOAJ Export Plugin <= 1.0.4 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jonathan Brinley DOAJ Export doaj-export allows Stored XSS.This issue affects DOAJ Export: from n/a through <= 1.0.4.
CVSS v3.1: 5.9
CVE-2025-39395: WordPress WPAMS plugin <= 44.0 (17-08-2023) - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla WPAMS apartment-management allows SQL Injection.This issue affects WPAMS: from n/a through <= 44.0 (17-08-2023).
CVSS v3.1: 9.3
CVE-2020-9925: A logic issue was addressed with improved state management. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8, Safari 13.1.2, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. Processing maliciously crafted web content may lead to universal cross site scripting.
CVSS v3.1: 6.1
CVSS v2.0: 4.3
CVE-2026-8074: Improper Permission Check Allows User Manager to Deactivate Bot Accounts
Mattermost versions 11.7.x <= 11.7.0, 10.11.x <= 10.11.17 fail to enforce bot-specific permission checks on the user active status endpoint, which allows a User Manager with user management write access but no Integrations access to deactivate bot accounts via the PUT /api/v4/users/{id}/active API endpoint.. Mattermost Advisory ID: MMSA-2026-00667
CVSS v3.1: 3.8
GHSA-43wr-5mwj-x7p2: IBM Security Directory Server 6.4.0 is deployed with active debugging code that can create unintended entry points. IBM X-Force ID: 165952.
CVE-2011-2524: Directory traversal vulnerability in soup-uri.c in SoupServer in libsoup before 2.35.4 allows remote attackers to read arbitrary files via a %2e%2e (encoded dot dot) in a URI.
CVSS v2.0: 5
GHSA-74ch-7rh8-763r: A vulnerability was found in Ucweb UC Browser 11.2.5.932. It has been classified as critical. Affected is an unknown function of the component HTML Handler. The manipulation of the argument title leads to improper restriction of rendered ui layers (URL). It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS v3.1: 6.5
GHSA-3394-h5f6-fpwc: Multiple cross-site scripting (XSS) vulnerabilities in create.php in vCard 2.x allow remote attackers to inject arbitrary web script or HTML via the (1) card_id, (2) uploaded, (3) card_fontsize, or (4) card_color parameter.  NOTE: the card_id vector was later reported to affect vCard 2.9, and the uploaded vector for 2.6.
GHSA-jx77-74f8-98ch: Buffer Overflow vulnerability in FFmpeg 4.2 at convolution_y_10bit in libavfilter/vf_vmafmotion.c, which could let a remote malicious user cause a Denial of Service.
GHSA-v787-c3f2-p88r: In the Linux kernel, the following vulnerability has been resolved:posix-clock: Fix missing timespec64 check in pc_clock_settime()As Andrew pointed out, it will make sense that the PTP core
checked timespec64 struct's tv_sec and tv_nsec range before calling
ptp->info->settime64().As the man manual of clock_settime() said, if tp.tv_sec is negative or
tp.tv_nsec is outside the range [0..999,999,999], it should return EINVAL,
which include dynamic clocks which handles PTP clock, and the condition is
consistent with timespec64_valid(). As Thomas suggested, timespec64_valid()
only check the timespec is valid, but not ensure that the time is
in a valid range, so check it ahead using timespec64_valid_strict()
in pc_clock_settime() and return -EINVAL if not valid.There are some drivers that use tp->tv_sec and tp->tv_nsec directly to
write registers without validity checks and assume that the higher layer
has checked it, which is dangerous and will benefit from this, such as
hclge_ptp_settime(), igb_ptp_settime_i210(), _rcar_gen4_ptp_settime(),
and some drivers can remove the checks of itself.
CVSS v3.1: 5.5
CVE-2023-26595: Denial-of-service (DoS) vulnerability in Message of Cybozu Garoon 4.10.0 to 5.9.2 allows a remote authenticated attacker to cause a denial of service condition.
CVSS v3.1: 5.5
CVE-2023-27856: Rockwell Automation ThinManager ThinServer Path Traversal Download



In affected versions, path traversal exists when processing a message of type 8

 in Rockwell Automation's ThinManager ThinServer. 

An unauthenticated remote attacker can exploit this vulnerability to download arbitrary files on the disk drive where ThinServer.exe is installed.

 


CVSS v3.1: 7.5
GHSA-hqxh-r866-2rgj: A reportpage index expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).
CVE-2009-3497: SQL injection vulnerability in view_listing.php in Vastal I-Tech Agent Zone (aka The Real Estate Script) allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS v2.0: 7.5
GHSA-f529-5jxm-j388: A vulnerability was found in dayrui XunRuiCMS up to 4.6.4. It has been declared as critical. This vulnerability affects unknown code of the file /Control/Api/Api.php. The manipulation of the argument thumb leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
GHSA-v5fp-56v2-97qv: vpn-user-portal (aka eduVPN or Let's Connect!) before 2.3.14, as packaged for Debian 10, Debian 11, and Fedora, allows remote authenticated users to obtain OS filesystem access, because of the interaction of QR codes with an exec that uses the -r option. This can be leveraged to obtain additional VPN access.
CVSS v3.1: 6.5
CVE-2013-1284: Race condition in the kernel in Microsoft Windows 8, Windows Server 2012, and Windows RT allows local users to gain privileges via a crafted application that leverages improper handling of objects in memory, aka "Kernel Race Condition Vulnerability."
CVSS v2.0: 4.9
GHSA-2439-vfhj-mg5g: A security flaw has been discovered in D-Link DWR-M920 up to 1.1.50. Impacted is the function sub_42261C of the file /boafrm/formFilter. The manipulation of the argument ip6addr results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been released to the public and may be exploited.
CVSS v4.0: 7.4
CVSS v3.1: 8.8
CVE-2025-4276: UsbCoreDxe: improper input validation may lead to arbitrary code execution
UsbCoreDxe has a vulnerability which can be used to write arbitrary memory inside SMRAM and execute arbitrary code at SMM level.
CVSS v3.1: 7.5
GHSA-3qhc-99ww-4gq4: The secure script in LogWatch before 2.6-2 allows attackers to prevent LogWatch from detecting malicious activity via certain strings in the secure file that are later used as part of a regular expression, which causes the parser to crash, aka "logwatch log processing regular expression DoS."
GHSA-xpqw-6gx7-v673: SVGO DoS through entity expansion in DOCTYPE (Billion Laughs)
SummarySVGO accepts XML with custom entities, without guards against entity expansion or recursion. This can result in a small XML file (811 bytes) stalling the application and even crashing the Node.js process with `JavaScript heap out of memory`.DetailsThe upstream XML parser ([sax](https://www.npmjs.com/package/sax)) doesn't interpret custom XML entities by default. We pattern matched custom XML entities from the `DOCTYPE`, inserting them into `parser.ENTITIES`, and enabled `unparsedEntities`. This gives us the desired behavior of supporting SVGs with entities declared in the `DOCTYPE`.However, entities can reference other entities, which can enable small SVGs to explode exponentially when we try to parse them.Proof of ConceptImpactIf SVGO is run on untrusted input (i.e., user uploaded to server-side application), then the untrusted SVG can effectively stall or crash the application with an SVG < 1 KB in size.It's unlikely to impact users who just use SVGO locally on their own SVGs or in build pipelines.PatchesSVGO has patched v4.0.1, v3.3.3, and v2.8.1! However, it's strongly recommended to upgrade to v4 regardless, as previous versions are not officially supported anymore.Workarounds== 4.0.0For v4, users do not specifically have to upgrade SVGO, though it is recommended to do so. A package manager can be used to upgrade sax recursively:For example:New options were introduced upstream which makes the way SVGO parses SVGs safe by default.>= 2.1.0, <= 3.3.2Users of v3 and v2 will have to take manual action. If users can't upgrade, they may be able to work around this as long as the project doesn't require support for custom XML entities, though it's not a simple flag.Parse the DOCTYPE directly and check for the presence of custom entities. If entities are present, throw/escape before passing them to SVGO.Resources[Wikipedia: Billion laughs attack](https://en.wikipedia.org/wiki/Billion_laughs_attack)
CVSS v3.1: 7.5
CVE-2016-6263: The stringprep_utf8_nfkc_normalize function in lib/nfkc.c in libidn before 1.33 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via crafted UTF-8 data.
CVSS v3.0: 7.5
CVSS v2.0: 5
CVE-2017-14069: SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the usernw array parameter to nowarn.php.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
CVE-2023-0777: Authentication Bypass by Primary Weakness in modoboa/modoboa
Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to 2.0.4.
CVSS v3.0: 8.6
CVE-2024-7386: Premium Packages – Sell Digital Products Securely <= 5.9.1 - Cross-Site Request Forgery
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.9.1. This is due to missing nonce validation on the addRefund() function. This makes it possible for unauthenticated attackers to perform actions such as initiating refunds via a forged request granted they can trick a site administrator or shop manager into performing an action such as clicking on a link.
CVSS v3.1: 4.3
GHSA-m6fx-m8hc-572m: OpenClaw: Telegram audio preflight transcription enables resource consumption by unauthorized senders
SummaryTelegram audio preflight transcription enables resource consumption by unauthorized sendersCurrent Maintainer TriageStatus: narrowNormalized severity: mediumAssessment: v2026.3.28 still lets unauthorized Telegram group senders trigger audio preflight before allowlist enforcement, but the real impact is resource or billing burn rather than direct data exposure or host compromise.Affected Packages / VersionsPackage: `openclaw` (npm)Latest published npm version: `2026.3.31`Vulnerable version range: `<=2026.3.28`Patched versions: `>= 2026.3.31`First stable tag containing the fix: `v2026.3.31`Fix Commit(s)`c4fa8635d03943ffe9e294d501089521dca635c5` — 2026-03-30T12:19:31+01:00OpenClaw thanks @AntAISecurityLab for reporting.
CVSS v4.0: 6.9
CVSS v3.1: 5.3
GHSA-68h7-99q4-4vwh: The WriteCaffHeader function in cli/caff.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.
CVSS v3.0: 5.5
CVE-2025-64199: WordPress wpresidence theme <= 5.3.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in WpEstate wpresidence wpresidence allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpresidence: from n/a through <= 5.3.2.
CVSS v3.1: 5.3
GHSA-w59w-3fq8-w77h: Flexsense DiskBoss 7.7.14 contains a local buffer overflow vulnerability in the 'Input Directory' component that allows unauthenticated attackers to execute arbitrary code on the system. Attackers can exploit this by pasting a specially crafted directory path into the 'Add Input Directory' field.
CVSS v4.0: 8.6
CVSS v3.1: 7.8
GHSA-9vpf-fvq4-6558: A vulnerability, which was classified as problematic, has been found in kkFileView. Affected by this issue is the function setWatermarkAttribute of the file /picturesPreview. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-216776.
CVSS v3.1: 6.1
CVE-2024-23998: goanother Another Redis Desktop Manager =<1.6.1 is vulnerable to Cross Site Scripting (XSS) via src/components/Setting.vue.
CVSS v3.1: 5
RHSA-2008:0006: Red Hat Security Advisory: httpd security update
mod_autoindex XSS httpd: mod_imagemap XSS apache mod_status cross-site scripting mod_proxy_ftp XSS
CVE-2019-17239: includes/settings/class-alg-download-plugins-settings.php in the download-plugins-dashboard plugin through 1.5.0 for WordPress has multiple unauthenticated stored XSS issues.
CVSS v3.1: 6.1
CVSS v2.0: 4.3
CVE-2026-12621: Cross-Site Scripting (XSS) Vulnerability in Password Reset Redirect in GridTime™ 3000 GNSS Time Server
Improper neutralization of input during web page generation XSS 
vulnerability in the GridTime 3000 (password reset form) allows XSS. 
This issue affects GridTime 3000: from 1.0r0.03 before 1.2r0.0.
CVSS v4.0: 5.3
RHSA-2009:0398: Red Hat Security Advisory: seamonkey security update
Firefox XUL garbage collection issue (cansecwest pwn2own) Firefox XSLT memory corruption issue
CVE-2009-1758: The hypervisor_callback function in Xen, possibly before 3.4.0, as applied to the Linux kernel 2.6.30-rc4, 2.6.18, and probably other versions allows guest user applications to cause a denial of service (kernel oops) of the guest OS by triggering a segmentation fault in "certain address ranges."
CVSS v2.0: 5
CVE-2010-3345: Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka "HTML Element Memory Corruption Vulnerability."
CVSS v2.0: 9.3
CVE-2023-2370: SourceCodester Online DJ Management System GET Parameter manage_event.php sql injection
A vulnerability classified as critical has been found in SourceCodester Online DJ Management System 1.0. Affected is an unknown function of the file admin/events/manage_event.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-227646 is the identifier assigned to this vulnerability.
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
CVE-2023-29631: PrestaShop jmsslider 1.6.0 is vulnerable to Incorrect Access Control via ajax_jmsslider.php.
CVSS v3.1: 9.8
CVE-2024-29927: WordPress WishSuite plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HasTheme WishSuite allows Stored XSS.This issue affects WishSuite: from n/a through 1.3.7.
CVSS v3.1: 6.5
CVE-2006-3108: Cross-site scripting (XSS) vulnerability in EmailArchitect Email Server 6.1 allows remote attackers to inject arbitrary Javascript via an HTML div tag with a carriage return between the onmouseover attribute and its value, which bypasses the mail filter.
CVSS v2.0: 4.3
GHSA-f972-7cqm-cm9w: In the Linux kernel, the following vulnerability has been resolved:mmc: via-sdmmc: fix return value check of mmc_add_host()mmc_add_host() may return error, if we ignore its return value,
it will lead two issues:The memory that allocated in mmc_alloc_host() is leaked.In the remove() path, mmc_remove_host() will be called to
delete device, but it's not added yet, it will lead a kernel
crash because of null-ptr-deref in device_del().Fix this by checking the return value and goto error path which
will call mmc_free_host().
CVE-2024-43841: wifi: virt_wifi: avoid reporting connection success with wrong SSID
In the Linux kernel, the following vulnerability has been resolved:

wifi: virt_wifi: avoid reporting connection success with wrong SSID

When user issues a connection with a different SSID than the one
virt_wifi has advertised, the __cfg80211_connect_result() will
trigger the warning: WARN_ON(bss_not_found).

The issue is because the connection code in virt_wifi does not
check the SSID from user space (it only checks the BSSID), and
virt_wifi will call cfg80211_connect_result() with WLAN_STATUS_SUCCESS
even if the SSID is different from the one virt_wifi has advertised.
Eventually cfg80211 won't be able to find the cfg80211_bss and generate
the warning.

Fixed it by checking the SSID (from user space) in the connection code.
CVSS v3.1: 3.3
GHSA-63vv-f5j8-wjcr: JFrog Artifactory prior to version 7.33.6 and 6.23.38, is vulnerable to CSRF ( Cross-Site Request Forgery) for specific endpoints. This issue affects: JFrog JFrog Artifactory JFrog Artifactory versions before 7.33.6 versions prior to 7.x; JFrog Artifactory versions before 6.23.38 versions prior to 6.x.
CVSS v3.1: 8.8
GHSA-2cwj-8chv-9pp9: XML External Entity attack in log4net
Apache log4net before 2.0.10 does not disable XML external entities when parsing log4net configuration files. This could allow for XXE-based attacks in applications that accept arbitrary configuration files from users.
CVSS v3.1: 9.8
GHSA-xrc8-933j-f74c: Server-side request forgery (ssrf) in Azure Databricks allows an unauthorized attacker to elevate privileges over a network.
CVSS v3.1: 10