ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-g6ch-jp62-x9c6: Cross-site scripting (XSS) vulnerability in the Date module before 7.x-2.8 for Drupal allows remote authenticated users with the permission to create a date field to inject arbitrary web script or HTML via the date field title.
GHSA-rx7m-68vc-ppxh: PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser
**Product:** PhpSpreadsheet
**Version:** 3.8.0
**CWE-ID:** CWE-918: Server-Side Request Forgery (SSRF)
**CVSS vector v.3.1:** 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
**CVSS vector v.4.0:** 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N)
**Description:** SSRF occurs when a processed HTML document is read and displayed in the browser
**Impact:** Server-Side Request Forgery
**Vulnerable component:** the `PhpOffice\PhpSpreadsheet\Worksheet\Drawing` class, `setPath` method
**Exploitation conditions:** getting a string from the user that is passed to the HTML reader
**Mitigation:** improved processing of the `$path` variable of the `setPath` method of the `PhpOffice\PhpSpreadsheet\Worksheet\Drawing` class is needed
**Researcher: Aleksey Solovev (Positive Technologies)**ResearchThe researcher discovered zero-day vulnerability Server-Side Request Forgery (SSRF) (in the `setPath` method of the `PhpOffice\PhpSpreadsheet\Worksheet\Drawing` class) in Phpspreadsheet.
The latest version (3.8.0) of the `phpoffice/phpspreadsheet` library was installed. Below are the details of the installation:*Listing 1. Installing the phpoffice/phpspreadsheet library*The code that processes the HTML string with further rendering and displaying the result in the browser.
*Listing 2. Executable file index.php using the PhpSpreadsheet library*Also, the `./doc/file.html` has the following content: the `img` tag with the `src` attribute, which contains the value `http:// 127.0.0.1:1337`*Listing 3. The ./doc/file.html file*The vulnerability lies in the `setPath` method of the `PhpOffice\PhpSpreadsheet\Worksheet\Drawing` class.Figure 1. The `PhpOffice\PhpSpreadsheet\Worksheet\Drawing` class, `setPath` method.![fig1](https://github.com/user-attachments/assets/75433f59-fac6-46d5-bcfd-6d0174bfcedd)Figure 2 below demonstrates the SSRF vulnerability exploitation.![fig2](https://github.com/user-attachments/assets/3601692b-b077-420f-a2fb-8af0b66b6475)Figure 2. Demonstration of the SSRF vulnerability exploitationAlso, there is code on line 154 that could potentially be used by an attacker to perform unsafe deserialization via the `phar` archive and the `file_exists` method.Figure 3. Opportunity to perform phar deserialization
![fig3](https://github.com/user-attachments/assets/3d7d4fc2-1b89-4925-82fa-e21c773efd47)Please, assign all credits to: Aleksey Solovev (Positive Technologies)CreditAleksey Solovev (Positive Technologies)
CVSS v4.0: 8.7
CVE-2023-36438: Windows TCP/IP Information Disclosure Vulnerability
Windows TCP/IP Information Disclosure Vulnerability
CVSS v3.1: 7.5
GHSA-v7fr-3jhm-3qhw: In the Linux kernel, the following vulnerability has been resolved:comedi: Make insn_rw_emulate_bits() do insn->n samplesThe `insn_rw_emulate_bits()` function is used as a default handler for
`INSN_READ` instructions for subdevices that have a handler for
`INSN_BITS` but not for `INSN_READ`.  Similarly, it is used as a default
handler for `INSN_WRITE` instructions for subdevices that have a handler
for `INSN_BITS` but not for `INSN_WRITE`. It works by emulating the
`INSN_READ` or `INSN_WRITE` instruction handling with a constructed
`INSN_BITS` instruction.  However, `INSN_READ` and `INSN_WRITE`
instructions are supposed to be able read or write multiple samples,
indicated by the `insn->n` value, but `insn_rw_emulate_bits()` currently
only handles a single sample.  For `INSN_READ`, the comedi core will
copy `insn->n` samples back to user-space.  (That triggered KASAN
kernel-infoleak errors when `insn->n` was greater than 1, but that is
being fixed more generally elsewhere in the comedi core.)Make `insn_rw_emulate_bits()` either handle `insn->n` samples, or return
an error, to conform to the general expectation for `INSN_READ` and
`INSN_WRITE` handlers.
CVSS v3.1: 7.8
CVE-2024-38447: NATO NCI ANET 3.4.1 allows Insecure Direct Object Reference via a modified ID field in a request for a private draft report (that belongs to an arbitrary user).
CVSS v3.1: 8.1
CVE-2025-66037: OpenSC: Out of Bounds vulnerability
OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, feeding a crafted input to the fuzz_pkcs15_reader harness causes OpenSC to perform an out-of-bounds heap read in the X.509/SPKI handling path. Specifically, sc_pkcs15_pubkey_from_spki_fields() allocates a zero-length buffer and then reads one byte past the end of that allocation. This issue has been patched in version 0.27.0.
CVSS v3.1: 3.9
GHSA-fjcv-hq7v-8jmr: Directory traversal vulnerability in FTPx Corp FTP Explorer 10.5.19.1 for Windows, and probably earlier versions, allows remote FTP servers to write arbitrary files via a "..\" (dot dot backslash) in a filename.
GHSA-9ccc-jjcg-fp9r: Cross-site scripting (XSS) vulnerability in the Yahoo! User Interface Library in Cybozu Garoon before 3.7.2, when Internet Explorer 9 or 10 or Chrome is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
GHSA-ch4c-h46j-p5r9: A vulnerability classified as critical has been found in code-projects Simple Car Rental System 1.0. This affects an unknown part of the file /pay.php. The manipulation of the argument mpesa leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 5.5
CVSS v3.1: 7.3
GHSA-jv37-r43f-6p9j: A vulnerability has been found in Tenda FH1202 1.2.0.14(408). This affects the function fromDhcpListClient of the file /goform/DhcpListClient. The manipulation of the argument page leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 7.4
CVSS v3.1: 8.8
CVE-2022-24858: Default redirect callback vulnerable to open redirects
next-auth v3 users before version 3.29.2 are impacted. next-auth version 4 users before version 4.3.2 are also impacted. Upgrading to 3.29.2 or 4.3.2 will patch this vulnerability. If you are not able to upgrade for any reason, you can add a configuration to your callbacks option. If you already have a `redirect` callback, make sure that you match the incoming `url` origin against the `baseUrl`.
CVSS v3.1: 6.1
GHSA-xvf2-x5rr-6g4q: The wccp-pro WordPress plugin before 15.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS v3.1: 4.8
CVE-2024-30598: Tenda FH1203 v2.0.1.6 firmware has a stack overflow vulnerability in the security_5g parameter of the formWifiBasicSet function.
CVSS v3.1: 6.5
CVE-2020-6551: Use after free in WebXR in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS v3.1: 8.8
CVSS v2.0: 9.3
GHSA-qrv4-p2mg-jq8g: A vulnerability was determined in code-projects Student File Management System 1.0. This vulnerability affects unknown code of the file /admin/update_student.php. Executing manipulation can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
CVSS v4.0: 1.9
CVSS v3.1: 2.4
GHSA-fx3r-35h9-pmhx: Vulnerabilities exist in the Aruba EdgeConnect Enterprise command line interface that allow remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.
CVSS v3.1: 7.2
GHSA-9x37-h43v-mqc4: Xshell before 7.0.0.76 allows attackers to cause a crash by triggering rapid changes to the title bar.
CVE-2014-3180: In kernel/compat.c in the Linux kernel before 3.17, as used in Google Chrome OS and other products, there is a possible out-of-bounds read. restart_syscall uses uninitialized data when restarting compat_sys_nanosleep. NOTE: this is disputed because the code path is unreachable
CVSS v3.1: 9.1
CVSS v2.0: 6.4
GHSA-h95q-q7mj-92qm: Stack-based buffer overflow vulnerabilities affecting Vonetsindustrial wifi bridge relays and wifi bridge repeaters, software versions 
3.3.23.6.9 and prior, enable an unauthenticated remote attacker to 
execute arbitrary code.
CVSS v4.0: 10
CVSS v3.1: 10
CVE-2017-5063: A numeric overflow in Skia in Google Chrome prior to 58.0.3029.81 for Linux, Windows, and Mac, and 58.0.3029.83 for Android, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
CVSS v3.1: 8.8
CVSS v2.0: 6.8
RHSA-2023:5529: Red Hat Security Advisory: bind security update
bind: stack exhaustion in control channel code may lead to DoS
CVSS v3.1: 7.5
GHSA-h845-ghqm-6gv2: In KeePassX before 0.4.4, a cleartext copy of password data is created upon a cancel of an XML export action. This allows context-dependent attackers to obtain sensitive information by reading the .xml dotfile.
CVSS v3.0: 7.5
CVE-2016-0550: Unspecified vulnerability in the Oracle CRM Technical Foundation component in Oracle E-Business Suite 11.5.10.2, 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote attackers to affect confidentiality and integrity via vectors related to CRM HTML Administration.
CVSS v2.0: 6.4
GHSA-jjvp-wfp8-rv69: globalpom-utils has Insecure Temporary File
A vulnerability has been found in devent globalpom-utils up to 4.5.0 and classified as critical. This vulnerability affects the function `createTmpDir` of the file `globalpomutils-fileresources/src/main/java/com/anrisoftware/globalpom/fileresourcemanager/FileResourceManagerProvider.java`. The manipulation leads to insecure temporary file. The attack can be initiated remotely. Upgrading to version 4.5.1 can address this issue. The name of the patch is 77a820bac2f68e662ce261ecb050c643bd7ee560. It is recommended to upgrade the affected component. VDB-217570 is the identifier assigned to this vulnerability.
CVSS v3.1: 9.8
GHSA-j452-xhg8-qg39: Mafintosh's protocol-buffers-schema is vulnerable to prototype pollution
JavaScript is vulnerable to prototype pollution in Mafintosh's protocol-buffers-schema Version 3.6.0, where an attacker may alter the application logic, bypass security checks, cause a DoS or achieve remote code execution.
CVSS v3.1: 6.5
CVE-2020-26193: Dell EMC PowerScale OneFS versions 8.1.0 - 9.1.0 contain an improper input validation vulnerability. A user with the ISI_PRIV_CLUSTER privilege may exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS, with the privileges of the vulnerable application.
CVSS v3.1: 7.8
GHSA-v5c2-f543-4vhm: In the Linux kernel, the following vulnerability has been resolved:f2fs: fix null reference error when checking end of zoneThis patch fixes a potentially null pointer being accessed by
is_end_zone_blkaddr() that checks the last block of a zone
when f2fs is mounted as a single device.
CVSS v3.1: 5.5
GHSA-cvq3-56r9-hh2h: In the Linux kernel, the following vulnerability has been resolved:auxdisplay: lcd2s: Fix memory leak in ->remove()Once allocated the struct lcd2s_data is never freed.
Fix the memory leak by switching to devm_kzalloc().
CVSS v3.1: 5.5
CVE-2025-12598: SourceCodester Best House Rental Management System admin_class.php save_tenant sql injection
A flaw has been found in SourceCodester Best House Rental Management System 1.0. Affected by this issue is the function save_tenant of the file /admin_class.php. Executing manipulation of the argument firstname can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used. Other parameters might be affected as well.
CVSS v4.0: 5.1
CVSS v3.1: 4.7
CVSS v3.0: 4.7
CVSS v2.0: 5.8
GHSA-mqh9-5jp9-6799: YetiForce CRM vulnerable to stored Cross-site Scripting via LayoutEditor module
YetiForce CRM versions 6.4.0 and prior are vulnerable to cross-site scripting via the `LayoutEditor` module. A patch is available at commit eebc12601495ada38495076bec12841b2477516b.
CVSS v3.1: 5.4
CVE-2022-45033: A cross-site scripting (XSS) vulnerability in Expense Tracker 1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Chat text field.
CVSS v3.1: 5.4
CVE-2026-45307: Speakr: Open redirect in is_safe_url via parser mismatch on next parameter
Speakr is a personal, self-hosted web application designed for transcribing audio recordings. Prior to 0.8.20-alpha, the is_safe_url() helper used to validate post-login redirect targets applied urljoin(request.host_url, target) before parsing, while the controller passed the raw target to redirect(). A scheme-relative input such as ////evil.com resolved to a same-host URL during validation but was emitted verbatim in the Location header, where the browser interpreted it as a network-path-relative redirect to an attacker-controlled host. This vulnerability is fixed in 0.8.20-alpha.
CVSS v3.1: 6.1
GHSA-p86m-fr3f-pv77: DomainMOD through 4.11.01 has XSS via the admin/domain-fields/ notes field in an Add Custom Field action for Custom Domain Fields.
CVSS v3.0: 5.4
GHSA-645g-q3pq-8q25: A vulnerability exists in Trellix Agent for Windows version 5.7.8 and earlier, that allows local users, during install/upgrade workflow, to replace one of the Agent’s executables before it can be executed. This allows the user to elevate their permissions.
CVSS v3.1: 7.8
GHSA-69jq-wmhm-pw4j: The Create Discoveries feature of Open-AudIT before 3.2.0 allows an authenticated attacker to execute arbitrary OS commands via a crafted value for a URL field.
CVE-2024-56323: OpenFGA Authorization Bypass
OpenFGA is an authorization/permission engine. IN OpenFGA v1.3.8 to v1.8.2 (Helm chart openfga-0.1.38 to openfga-0.2.19, docker v1.3.8 to v.1.8.2)  are vulnerable to authorization bypass under the following conditions: 1. calling Check API or ListObjects with a model that uses [conditions](https://openfga.dev/docs/modeling/conditions), and 2. calling Check API or ListObjects API with [contextual tuples](https://openfga.dev/docs/concepts#what-are-contextual-tuples) that include conditions and 3. OpenFGA is configured with caching enabled (`OPENFGA_CHECK_QUERY_CACHE_ENABLED`). Users are advised to upgrade to v1.8.3. There are no known workarounds for this vulnerability.
CVSS v4.0: 5.8
GHSA-7m2j-268v-rc6r: The Page Builder Gutenberg Blocks – CoBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via external iCal feed data in all versions up to, and including, 3.1.16 due to insufficient output escaping of event titles, descriptions, and locations fetched from external iCal feeds in the Events block rendering function. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
GHSA-vjj5-xg7p-f752: Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'buyer_address' parameter of the buyer_detail_submit.php resource does not validate the characters received and they are sent unfiltered to the database.
CVSS v3.1: 9.8
CVE-2007-0387: SQL injection vulnerability in models/category.php in the Weblinks component for Joomla! SVN 20070118 (com_weblinks) allows remote attackers to execute arbitrary SQL commands via the catid parameter.
CVSS v2.0: 7.5
GHSA-r843-rvx7-3rjg: Improper Validation of Specified Quantity in Input vulnerability in ShapedPlugin, LLC Product Slider Pro for WooCommerce allows Malicious Software Implanted.This issue affects Product Slider Pro for WooCommerce: from n/a before 3.5.3.No patched version is available - the vendor has applied a fix to an existing release without publishing a new version. While the patch provided by the vendor is valid, releasing it under the existing version number leaves users unable to reliably determine whether they are running a patched or vulnerable installation. As a result, we treat this as an unpatched version.
CVSS v3.1: 10
CVE-2025-6230: A SQL injection vulnerability was reported in Lenovo Vantage that could allow a local attacker to modify the local SQLite database and execute limited SQLite commands.
CVSS v4.0: 4.8
CVSS v3.1: 5.3
GHSA-f6hg-g687-vqrf: In btm_proc_smp_cback of tm_ble.cc, there is a possible memory corruption due to a use after free. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-120612744.
CVE-2023-51440: A vulnerability has been identified in SIMATIC CP 343-1 (6GK7343-1EX30-0XE0) (All versions), SIMATIC CP 343-1 Lean (6GK7343-1CX10-0XE0) (All versions), SIPLUS NET CP 343-1 (6AG1343-1EX30-7XE0) (All versions), SIPLUS NET CP 343-1 Lean (6AG1343-1CX10-2XE0) (All versions). Affected products incorrectly validate TCP sequence numbers. This could allow an unauthenticated remote attacker to create a denial of service condition by injecting spoofed TCP RST packets.
CVSS v3.1: 7.5
GHSA-cf5j-2xcw-p6fg: A use after free issue was addressed with improved memory management. This issue is fixed in iOS 15.4 and iPadOS 15.4. An application may be able to execute arbitrary code with kernel privileges.
CVSS v3.1: 7.8
GHSA-3m25-8xh3-c6p2: In the Linux kernel, the following vulnerability has been resolved:cachestat: fix page cache statistics permission checkingWhen the 'cachestat()' system call was added in commit cf264e1329fb
("cachestat: implement cachestat syscall"), it was meant to be a much
more convenient (and performant) version of mincore() that didn't need
mapping things into the user virtual address space in order to work.But it ended up missing the "check for writability or ownership" fix for
mincore(), done in commit 134fca9063ad ("mm/mincore.c: make mincore()
more conservative").This just adds equivalent logic to 'cachestat()', modified for the file
context (rather than vma).
CVSS v3.1: 5.5
GHSA-w5qr-r2gc-x7mw: The PKI functionality in Mac OS X 10.2.8 and 10.3.2 allows remote attackers to cause a denial of service (service crash) via malformed ASN.1 sequences.
GHSA-gw5x-mfp3-c35v: Microsoft SharePoint Server Security Feature BypassVulnerability.
CVSS v3.1: 4.3
GHSA-r4vp-2v6m-cqmg: DLL hijacking vulnerability in TTplayer version 7.0.2, allows local attackers to escalate privileges and execute arbitrary code via urlmon.dll.
CVSS v3.1: 7.8
CVE-2018-14089: An issue was discovered in a smart contract implementation for Virgo_ZodiacToken, an Ethereum token. In this contract, 'bool sufficientAllowance = allowance <= _value' will cause an arbitrary transfer in the function transferFrom because '<=' is used instead of '>=' (which was intended). An attacker can transfer from any address to his address, and does not need to meet the 'allowance > value' condition.
CVSS v3.0: 7.5
CVSS v2.0: 5
GHSA-jgfr-c5jr-627r: An issue was discovered in /fcgi/scrut_fcgi.fcgi in Plixer Scrutinizer before 19.3.1. The csvExportReport endpoint action generateCSV is vulnerable to SQL injection through the sorting parameter, allowing an unauthenticated user to execute arbitrary SQL statements in the context of the application's backend database server.
CVSS v3.1: 9.8
CVE-2025-68613: n8n Vulnerable to Remote Code Execution via Expression Injection
n8n is an open source workflow automation platform. Versions starting with 0.211.0 and prior to 1.120.4, 1.121.1, and 1.122.0 contain a critical Remote Code Execution (RCE) vulnerability in their workflow expression evaluation system. Under certain conditions, expressions supplied by authenticated users during workflow configuration may be evaluated in an execution context that is not sufficiently isolated from the underlying runtime. An authenticated attacker could abuse this behavior to execute arbitrary code with the privileges of the n8n process. Successful exploitation may lead to full compromise of the affected instance, including unauthorized access to sensitive data, modification of workflows, and execution of system-level operations. This issue has been fixed in versions 1.120.4, 1.121.1, and 1.122.0. Users are strongly advised to upgrade to a patched version, which introduces additional safeguards to restrict expression evaluation. If upgrading is not immediately possible, administrators should consider the following temporary mitigations: Limit workflow creation and editing permissions to fully trusted users only; and/or deploy n8n in a hardened environment with restricted operating system privileges and network access to reduce the impact of potential exploitation. These workarounds do not fully eliminate the risk and should only be used as short-term measures.
CVSS v3.1: 10
CVE-2019-12263: Wind River VxWorks 6.9.4 and vx7 has a Buffer Overflow in the TCP component (issue 4 of 4). There is an IPNET security vulnerability: TCP Urgent Pointer state confusion due to race condition.
CVSS v3.1: 8.1
CVSS v2.0: 6.8
GHSA-qppx-qccp-qx6c: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in netgsm Netgsm netgsm allows Reflected XSS.This issue affects Netgsm: from n/a through <= 2.9.63.
CVSS v3.1: 7.1
CVE-2022-35716: IBM UrbanCode Deploy (UCD) 6.2.0.0 through 6.2.7.16, 7.0.0.0 through 7.0.5.11, 7.1.0.0 through 7.1.2.7, and 7.2.0.0 through 7.2.3.0 could allow an authenticated user to obtain sensitive information in some instances due to improper security checking. IBM X-Force ID: 231360.
CVSS v3.0: 5.3
CVE-2024-21571: Snyk has identified a remote code execution (RCE) vulnerability in all versions of Code Agent. The vulnerability enables an attacker to execute arbitrary code within the Code Agent container. Exploiting this vulnerability would require an attacker to have network access to the Code Agent within the deployment environment. External exploitation of this vulnerability is unlikely and depends on both misconfigurations of the cluster and/or chaining with another vulnerability. However, internal exploitation (with a cluster misconfiguration) could still be possible.
CVSS v3.1: 8.1
CVE-2018-18389: Due to incorrect access control in Neo4j Enterprise Database Server 3.4.x before 3.4.9, the setting of LDAP for authentication with STARTTLS, and System Account for authorization, allows an attacker to log into the server by sending any valid username with an arbitrary password.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
GHSA-qhg5-7qj6-827m: In the Linux kernel, the following vulnerability has been resolved:soc: qcom: ocmem: Fix refcount leak in of_get_ocmemof_parse_phandle() returns a node pointer with refcount
incremented, we should use of_node_put() on it when not need anymore.
Add missing of_node_put() to avoid refcount leak.
of_node_put() will check NULL pointer.
CVSS v3.1: 5.5
CVE-2020-0333: In UrlQuerySanitizer, there is a possible improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-73822755
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2024-3751: Seriously Simple Podcasting < 3.3.0 - Admin+ Stored XSS
The Seriously Simple Podcasting WordPress plugin before 3.3.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS v3.1: 4.8
CVE-2022-50161: mtd: maps: Fix refcount leak in of_flash_probe_versatile
In the Linux kernel, the following vulnerability has been resolved:

mtd: maps: Fix refcount leak in of_flash_probe_versatile

of_find_matching_node_and_match() returns a node pointer with refcount
incremented, we should use of_node_put() on it when not need anymore.
Add missing of_node_put() to avoid refcount leak.
CVSS v3.1: 5.5