ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-544x-2jx9-4pfg: Path traversal in Apache Karaf
Apache Karaf obr:* commands and run goal on the karaf-maven-plugin have partial path traversal which allows to break out of expected folder. The risk is low as obr:* commands are not very used and the entry is set by user. This has been fixed in revision: https://gitbox.apache.org/repos/asf?p=karaf.git;h=36a2bc4 https://gitbox.apache.org/repos/asf?p=karaf.git;h=52b70cf Mitigation: Apache Karaf users should upgrade to 4.2.15 or 4.3.6 or later as soon as possible, or use correct path. JIRA Tickets: https://issues.apache.org/jira/browse/KARAF-7326
CVSS v3.1: 5.3
RHSA-2025:16861: Red Hat Security Advisory: mysql:8.0 security update
mysql: Parser unspecified vulnerability (CPU Apr 2025) mysql: Parser unspecified vulnerability (CPU Apr 2025) mysql: InnoDB unspecified vulnerability (CPU Apr 2025) mysql: Options unspecified vulnerability (CPU Apr 2025) mysql: DML unspecified vulnerability (CPU Apr 2025) mysql: Optimizer unspecified vulnerability (CPU Apr 2025) mysql: DDL unspecified vulnerability (CPU Apr 2025) mysql: Optimizer unspecified vulnerability (CPU Apr 2025) mysql: Replication unspecified vulnerability (CPU Apr 2025) mysql: Optimizer unspecified vulnerability (CPU Apr 2025) mysql: Replication unspecified vulnerability (CPU Apr 2025) mysql: Replication unspecified vulnerability (CPU Apr 2025) mysql: Replication unspecified vulnerability (CPU Apr 2025) mysql: Optimizer unspecified vulnerability (CPU Apr 2025) mysql: Optimizer unspecified vulnerability (CPU Apr 2025) mysql: Optimizer unspecified vulnerability (CPU Apr 2025) mysql: mariadb: InnoDB unspecified vulnerability (CPU Apr 2025) mysql: InnoDB unspecified vulnerability (CPU Apr 2025) mysql: PS unspecified vulnerability (CPU Apr 2025) mysql: Stored Procedure unspecified vulnerability (CPU Apr 2025) mysql: InnoDB unspecified vulnerability (CPU Apr 2025) mysql: Components Services unspecified vulnerability (CPU Apr 2025) mysql: PS unspecified vulnerability (CPU Apr 2025) mysql: Components Services unspecified vulnerability (CPU Apr 2025) mysql: UDF unspecified vulnerability (CPU Apr 2025) mysql: mariadb: mysqldump unspecified vulnerability (CPU Apr 2025) mysql: InnoDB unspecified vulnerability (CPU Jul 2025) mysql: DML unspecified vulnerability (CPU Jul 2025) mysql: Optimizer unspecified vulnerability (CPU Jul 2025) mysql: Stored Procedure unspecified vulnerability (CPU Jul 2025) mysql: mysqldump unspecified vulnerability (CPU Jul 2025) mysql: Optimizer unspecified vulnerability (CPU Jul 2025) mysql: Optimizer unspecified vulnerability (CPU Jul 2025) mysql: Optimizer unspecified vulnerability (CPU Jul 2025) mysql: InnoDB unspecified vulnerability (CPU Jul 2025) mysql: Components Services unspecified vulnerability (CPU Jul 2025) mysql: Optimizer unspecified vulnerability (CPU Jul 2025) mysql: InnoDB unspecified vulnerability (CPU Jul 2025) mysql: Optimizer unspecified vulnerability (CPU Jul 2025) mysql: InnoDB unspecified vulnerability (CPU Jul 2025) mysql: DDL unspecified vulnerability (CPU Jul 2025) mysql: DDL unspecified vulnerability (CPU Jul 2025) mysql: InnoDB unspecified vulnerability (CPU Jul 2025) mysql: Encryption unspecified vulnerability (CPU Jul 2025) mysql: Optimizer  unspecified vulnerability (CPU Jul 2025) mysql: InnoDB unspecified vulnerability (CPU Jul 2025) mysql: Thread Pooling unspecified vulnerability (CPU Jul 2025) mysql: Optimizer unspecified vulnerability (CPU Jul 2025) mysql: Optimizer unspecified vulnerability (CPU Jul 2025) mysql: DDL unspecified vulnerability (CPU Jul 2025) mysql: Replication unspecified vulnerability (CPU Jul 2025)
CVSS v3.1: 4.9
GHSA-4cvp-jw4q-vr74: Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component: Finance LOV).  Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Trade Management.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Trade Management accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVSS v3.1: 7.5
GHSA-qhx8-7h22-7544: Unrestricted file upload vulnerability in JSPWiki 2.4.104 and 2.5.139 allows remote attackers to upload and execute arbitrary .jsp files via an unspecified manipulation that attaches a .jsp file to an "entry page."
GHSA-q6m5-rpfj-c92f: In the Linux kernel, the following vulnerability has been resolved:of: module: prevent NULL pointer dereference in vsnprintf()In of_modalias(), we can get passed the str and len parameters which would
cause a kernel oops in vsnprintf() since it only allows passing a NULL ptr
when the length is also 0. Also, we need to filter out the negative values
of the len parameter as these will result in a really huge buffer since
snprintf() takes size_t parameter while ours is ssize_t...Found by Linux Verification Center (linuxtesting.org) with the Svace static
analysis tool.
CVSS v3.1: 5.3
GHSA-wrhc-5xmp-hp3p: A heap-based buffer overflow vulnerability exits in GNU LibreDWG v0.12.5 via the bit_read_RC function at bits.c.
CVSS v3.1: 8.8
CVE-2016-10903: The GoDaddy godaddy-email-marketing-sign-up-forms plugin before 1.1.3 for WordPress has CSRF.
CVSS v3.0: 8.8
CVSS v2.0: 6.8
CVE-2026-28496: FOSSBilling: Server-side template injection in Twig template rendering enables information disclosure and RCE
FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 have a Server-Side Template Injection (SSTI) vulnerability in the template rendering system. Administrators with access to features that render Twig templates (email templates, mass mail campaigns, custom payment adapters, and the `string_render` API endpoint) can inject arbitrary Twig expressions, leading to information disclosure and remote code execution. The vulnerability exists because Twig templates are rendered without a sandbox, allowing access to the full Twig environment, API context, and the application's dependency injection container. Version 0.8.0 patches the issue. Some workarounds are available. Audit existing email templates for suspicious Twig expressions, rotate all admin and client API tokens, and/or block external access to /api/system/* at reverse proxy/WAF to mitigate chaining with GHSA-78x5-c8gw-8279.
CVSS v4.0: 9.4
CVE-2016-1547: An off-path attacker can cause a preemptible client association to be demobilized in NTP 4.2.8p4 and earlier and NTPSec a5fb34b9cc89b92a8fef2f459004865c93bb7f92 by sending a crypto NAK packet to a victim client with a spoofed source address of an existing associated peer. This is true even if authentication is enabled.
CVSS v3.0: 5.3
CVSS v2.0: 5
GHSA-qrwq-c33r-6gpp: A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 15 and iPadOS 15. A malicious application may be able to execute arbitrary code with system privileges on devices with an Apple Neural Engine.
GHSA-q4jm-588w-2cpr: The google-document-embedder plugin before 2.6.1 for WordPress has XSS.
CVSS v3.0: 6.1
GHSA-c39g-wmc4-j8vm: It was found that an attacker could issue a xattr request via glusterfs FUSE to cause gluster brick process to crash which will result in a remote denial of service. If gluster multiplexing is enabled this will result in a crash of multiple bricks and gluster volumes.
CVSS v3.1: 6.5
CVE-2022-40067: Tenda AC21 V 16.03.08.15 is vulnerable to Buffer Overflow via /bin/httpd, function: formSetVirtualSer.
CVSS v3.1: 7.5
GHSA-8pm8-q9qq-gqgp: In the Linux kernel, the following vulnerability has been resolved:iommu/vt-d: Clear Present bit before tearing down PASID entryThe Intel VT-d Scalable Mode PASID table entry consists of 512 bits (64
bytes). When tearing down an entry, the current implementation zeros the
entire 64-byte structure immediately using multiple 64-bit writes.Since the IOMMU hardware may fetch these 64 bytes using multiple
internal transactions (e.g., four 128-bit bursts), updating or zeroing
the entire entry while it is active (P=1) risks a "torn" read. If a
hardware fetch occurs simultaneously with the CPU zeroing the entry, the
hardware could observe an inconsistent state, leading to unpredictable
behavior or spurious faults.Follow the "Guidance to Software for Invalidations" in the VT-d spec
(Section 6.5.3.3) by implementing the recommended ownership handshake:Clear only the 'Present' (P) bit of the PASID entry.Use a dma_wmb() to ensure the cleared bit is visible to hardware
before proceeding.Execute the required invalidation sequence (PASID cache, IOTLB, and
Device-TLB flush) to ensure the hardware has released all cached
references.Only after the flushes are complete, zero out the remaining fields
of the PASID entry.Also, add a dma_wmb() in pasid_set_present() to ensure that all other
fields of the PASID entry are visible to the hardware before the Present
bit is set.
CVSS v3.1: 7.8
CVE-2021-21011: Uncontrolled Search Path Element in Adobe Captivate 2019
Adobe Captivate 2019 version 11.5.1.499 (and earlier) is affected by an uncontrolled search path element vulnerability that could lead to privilege escalation. An attacker with permissions to write to the file system could leverage this vulnerability to escalate privileges.
CVSS v3.1: 7
GHSA-m32m-7r76-7jh4: Cross Site Request Forgery vulnerability in Spina CMS v.2.18.0 and before allows a remote attacker to escalate privileges via a crafted URL
CVSS v3.1: 8.8
RHSA-2025:12876: Red Hat Security Advisory: ncurses security update
ncurses: segfaulting OOB read
CVSS v3.1: 6.1
GHSA-598p-9996-xww3: In OpenMRS 2.9 and prior, the sessionLocation parameter for the login page is vulnerable to cross-site scripting.
GHSA-4vj4-4373-qj2m: ** DISPUTED **  Multiple PHP remote file inclusion vulnerabilities in Modules Builder (modbuild) 4.1 for Comdev One Admin allow remote attackers to execute arbitrary PHP code via a URL in the path[docroot] parameter to (1) config-bak.php or (2) config.php.  NOTE: CVE disputes this vulnerability because the unmodified scripts set the applicable variable to the empty string; reasonable modified copies would use a fixed pathname string.
CVSS v3.1: 9.8
CVE-2026-7647: Profile Builder Pro <= 3.14.5 - Unauthenticated PHP Object Injection
The Profile Builder Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 3.14.5. This is due to the use of PHP's maybe_unserialize() function on the attacker-controlled 'args' POST parameter within the wppb_request_users_pins_action_callback() AJAX handler, which lacked any nonce verification, type checking, or input validation before deserialization. Because the handler was registered with both wp_ajax_ and wp_ajax_nopriv_ hooks, it was reachable by completely unauthenticated users. This makes it possible for unauthenticated attackers to inject arbitrary PHP objects into application memory.
CVSS v3.1: 8.1
CVE-2022-43985: Apache Airflow prior to 2.4.2 has an open redirect
In Apache Airflow versions prior to 2.4.2, there was an open redirect in the webserver's `/confirm` endpoint.
CVSS v3.1: 6.1
CVE-2005-3326: SQL injection vulnerability in usercp.php in MyBulletinBoard (MyBB) allows remote attackers to execute arbitrary SQL commands via the awayday parameter.
CVSS v2.0: 7.5
GHSA-h9cw-v634-8jcw: If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.
CVSS v3.1: 9.8
GHSA-cvx7-x8pj-x2gw: CoreDNS Vulnerable to DoQ Memory Exhaustion via Stream Amplification
SummaryA **Denial of Service (DoS)** vulnerability was discovered in the CoreDNS DNS-over-QUIC (DoQ) server implementation. The server previously created a new goroutine for every incoming QUIC stream without imposing any limits on the number of concurrent streams or goroutines. A remote, unauthenticated attacker could open a large number of streams, leading to uncontrolled memory consumption and eventually causing an Out Of Memory (OOM) crash — especially in containerized or memory-constrained environments.Impact**Component**: `server_quic.go`**Attack Vector**: Remote, network-based**Attack Complexity**: Low**Privileges Required**: None**User Interaction**: None**Impact**: High availability loss (OOM kill or unresponsiveness)This issue affects deployments with `quic://` enabled in the Corefile. A single attacker can cause the CoreDNS instance to become unresponsive using minimal bandwidth and CPU.PatchesThe patch introduces two key mitigation mechanisms:**`max_streams`**: Caps the number of concurrent QUIC streams per connection. Default: `256`.**`worker_pool_size`**: Introduces a server-wide, bounded worker pool to process incoming streams. Default: `1024`.This eliminates the 1:1 stream-to-goroutine model and ensures that CoreDNS remains resilient under high concurrency. The new configuration options are exposed through the `quic` Corefile block:These defaults are generous and aligned with typical DNS-over-QUIC client behavior.WorkaroundsIf you're unable to upgrade immediately, you can:Disable QUIC support by removing or commenting out the `quic://` block in your CorefileUse container runtime resource limits to detect and isolate excessive memory usageMonitor QUIC connection patterns and alert on anomaliesReferences[RFC 9250 - DNS over Dedicated QUIC Connections](https://datatracker.ietf.org/doc/html/rfc9250)[quic-go GitHub project](https://github.com/quic-go/quic-go)[QUIC stream exhaustion class of vulnerabilities (related)](https://www.usenix.org/conference/usenixsecurity23/presentation/botella)CreditThanks to [@thevilledev](https://github.com/thevilledev) for disclovering this vulnerability and contributing a high-quality fix.For more informationPlease consult our [security guide](https://github.com/coredns/coredns/blob/master/.github/SECURITY.md) for more information regarding our security process.
CVSS v3.1: 7.5
GHSA-3542-2fj4-6438: Fuji Electric V-Server 4.0.3.0 and prior, An integer underflow vulnerability has been identified, which may allow remote code execution.
CVSS v3.0: 9.8
CVE-2010-2530: Multiple integer signedness errors in smb_subr.c in the netsmb module in the kernel in NetBSD 5.0.2 and earlier, FreeBSD, and Apple Mac OS X allow local users to cause a denial of service (panic) via a negative size value in a /dev/nsmb ioctl operation, as demonstrated by a (1) SMBIOC_LOOKUP or (2) SMBIOC_OPENSESSION ioctl call.
CVSS v2.0: 4.9
CVE-2024-4246: Tenda i21 formQosManageDouble_auto stack-based overflow
A vulnerability, which was classified as critical, was found in Tenda i21 1.0.0.14(4656). This affects the function formQosManageDouble_auto. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The identifier VDB-262137 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v3.1: 8.8
CVSS v3.0: 8.8
CVSS v2.0: 9
CVE-2025-29573: Cross-Site Scripting (XSS) vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module.
CVSS v3.1: 6.1
GHSA-m8p9-v77c-rq98: Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain a sensitive information disclosure vulnerability. A local malicious user may exploit this vulnerability to read sensitive information and use it.
GHSA-6p5j-938v-6wm9: Out-of-bounds read in firmware for the Intel(R) Integrated Sensor Solution before versions 5.4.2.4579v3, 5.4.1.4479 and 5.0.0.4143 may allow a privileged user to potentially enable denial of service via local access.
CVSS v3.1: 4.4
CVE-2020-25379: Wordpress Plugin Store / Mike Rooijackers Recall Products V0.8 fails to sanitize input from the 'Manufacturer[]' parameter which allows an authenticated attacker to inject a malicious SQL query.
CVSS v3.1: 8.8
CVSS v2.0: 6.5
GHSA-5j8c-vpp7-h3mx: The Web Configuration Utility in Meinberg LANTIME devices with firmware before 6.24.004 allows remote attackers to read arbitrary files by leveraging failure to restrict URL access.
CVSS v3.0: 6.5
CVE-2022-30931: Employee Leaves Management System (ELMS) V 2.1 is vulnerable to Cross Site Request Forgery (CSRF) via /myprofile.php.
CVSS v3.1: 6.5
CVSS v2.0: 4.3
GHSA-m9jp-fv72-2g3f: Missing Authorization vulnerability in Addonify Addonify addonify-quick-view allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Addonify: from n/a through <= 2.0.4.
CVSS v3.1: 8.1
GHSA-rwgj-jw84-j3xw: Directory traversal vulnerability in force-download.php in the Download Shortcode plugin 0.2.3 and earlier for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
GHSA-2qrc-2p98-7jhh: Use-after-free vulnerability in modules/speech/SpeechSynthesis.cpp in Blink, as used in Google Chrome before 33.0.1750.149, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper handling of a certain utterance data structure.
CVE-2019-25294: html5_snmp 1.11 - 'Remark' Persistent Cross-Site Scripting
html5_snmp 1.11 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts through the 'Remark' parameter in add_router_operation.php. Attackers can craft a POST request with a script payload in the Remark field to execute arbitrary JavaScript in victim browsers when the page is loaded.
CVSS v4.0: 5.1
CVSS v3.1: 6.1
GHSA-f9wj-wv6x-9pj8: IBM Robotic Process Automation for Cloud Pak 21.0.1 through 21.0.7.3 and 23.0.0 through 23.0.3 is vulnerable to insufficient security configuration which may allow creation of namespaces within a cluster.  IBM X-Force ID:  244500.
CVSS v3.1: 5.1
GHSA-xqm4-vhfh-f746: Improper Neutralization of Input During Web Page Generation vulnerability in DInGO dLibra software in the parameter 'filter' in the endpoint 'indexsearch' allows a Reflected Cross-Site Scripting (XSS). An attacker might trick somebody into using a crafted URL, which will cause a script to be run in user's browser. This issue affects DInGO dLibra software in versions from 6.0 before 6.3.20.
CVSS v4.0: 5.3
CVE-2022-38201: An unvalidated redirect vulnerability exists in Esri ArcGIS Quick Capture Web Designer versions 10.8.1 to 10.9.1.
An unvalidated redirect vulnerability exists in Esri Portal for ArcGIS Quick Capture Web Designer versions 10.8.1 to 10.9.1. A remote, unauthenticated attacker can potentially induce an unsuspecting authenticated user to access an an attacker controlled domain.
CVSS v3.1: 6.1
GHSA-xq2c-xc9f-44f4: SAP Enterprise Threat Detection, versions 1.0, 2.0, does not sufficiently encode error response pages in case of errors, allowing XSS payload reflecting in the response, leading to reflected Cross Site Scripting.
GHSA-5p7x-xg54-cjrq: libming 0.4.8 contains a memory leak vulnerability in /libming/src/actioncompiler/listaction.c.
CVSS v3.1: 4.3
GHSA-24xm-58mr-jc27: In the Linux kernel, the following vulnerability has been resolved:pinctrl: canaan: k230: add NULL check in DT parseAdd a NULL check for the return value of of_get_property() when
retrieving the "pinmux" property in the group parser. This avoids
a potential NULL pointer dereference if the property is missing
from the device tree node.Also fix a typo ("sintenel") in the device ID match table comment,
correcting it to "sentinel".
CVSS v3.1: 5.5
CVE-2023-32318: User session not correctly destroyed on logout
Nextcloud server provides a home for data. A regression in the session handling between Nextcloud Server and the Nextcloud Text app prevented a correct destruction of the session on logout if cookies were not cleared manually. After successfully authenticating with any other account the previous session would be continued and the attacker would be authenticated as the previously logged in user. It is recommended that the Nextcloud Server is upgraded to 25.0.6 or 26.0.1.
CVSS v3.1: 7.2
GHSA-f7j2-g8jg-8p26: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DGN files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-15514.
CVE-2012-3602: WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-09-12-1.
CVSS v2.0: 6.8
CVE-2019-6340: Drupal core - Highly critical - Remote Code Execution
Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)
CVSS v3.1: 8.1
CVSS v2.0: 6.8
GHSA-6rp6-p89c-5fpr: Code Blocks 17.12 contains a local buffer overflow vulnerability that allows attackers to execute arbitrary code by crafting a malicious file name with Unicode characters. Attackers can trigger the vulnerability by pasting a specially crafted payload into the file name field during project creation, potentially executing system commands like calc.exe.
CVSS v4.0: 8.4
CVSS v3.1: 8.4
CVE-2025-15017: A vulnerability exists in serial device servers where active debug code remains enabled in the UART interface. An attacker with physical access to the device can directly connect to the UART interface and, without authentication, user interaction, or execution conditions, gain unauthorized access to internal debug functionality. Exploitation is low complexity and allows an attacker to execute privileged operations and access sensitive system resources, resulting in a high impact to the confidentiality, integrity, and availability of the affected device. No security impact to external or dependent systems has been identified.
CVSS v4.0: 7
CVE-2006-0133: Multiple directory traversal vulnerabilities in AIX 5.3 ML03 allow local users to determine the existence of files and read partial contents of certain files via a .. (dot dot) in the argument to (1) getCommand.new (aka getCommand) and (2) getShell, a different vulnerability than CVE-2005-4273.
CVSS v2.0: 3.6
GHSA-8288-jpqp-95fx: Duplicate Advisory: OpenClaw has Bypass in Webhook Rate Limiting via Pre-Authentication Secret Validation
Duplicate AdvisoryThis advisory has been withdrawn because CVE-2026-34508 has been rejected as a duplicate of CVE-2026-34505. This link is maintained to preserve external references.Original DescriptionOpenClaw before 2026.3.12 applies rate limiting only after webhook authentication succeeds, allowing attackers to bypass rate limits and brute-force webhook secrets without triggering 429 responses. Attackers can repeatedly guess invalid secrets to discover valid credentials and subsequently submit forged Zalo webhook traffic.
CVSS v4.0: 6.3
CVSS v3.1: 6.5
GHSA-3cr5-frrf-7285: , aka 'Kerberos Security Feature Bypass Vulnerability'.
CVSS v3.1: 6.5