ansulev/circl-vulnerability-scores huggingface dataset:
RHSA-2025:9765: Red Hat Security Advisory: OpenShift Container Platform 4.16.43 bug fix and security update
cri-o: Checkpoint restore can be triggered from different namespaces openshift-api: openshift-controller-manager/build: Build Process in OpenShift Allows Overwriting of Node Pull Credentials glibc: static setuid binary dlopen may incorrectly search LD_LIBRARY_PATH
CVSS v3.1: 7
GHSA-3mv4-6x34-qw3c: A floating point exception (divide-by-zero) issue was discovered in SoX in functon read_samples() of voc.c file. An attacker with a crafted file, could cause an application to crash.
CVSS v3.1: 5.5
CVE-2020-25735: webTareas through 2.1 allows XSS in clients/editclient.php, extensions/addextension.php, administration/add_announcement.php, administration/departments.php, administration/locations.php, expenses/claim_type.php, projects/editproject.php, and general/newnotifications.php.
CVSS v3.1: 6.1
CVSS v2.0: 4.3
CVE-2025-56429: Cross Site Scripting vulnerability in Fearless Geek Media FearlessCMS v.0.0.2-15 allows a remote attacker to obtain sensitive information via the login.php component.
CVSS v3.1: 6.1
GHSA-44wp-g8f4-f4v5: Filament: Unauthenticated temporary file upload on auth pages
Any schema can contain a file upload form field, so Filament applies Livewire's `WithFileUploads` trait to the Livewire component the schema is embedded in. However, some schemas, such as the panel login form, do not require file uploads, and exposing unauthenticated temporary file uploads on these components is not an acceptable risk. On these components, an unauthenticated attacker could upload arbitrary files to the application's temporary storage, which could be abused to exhaust disk space or inflate storage costs.
CVSS v3.1: 6.5
CVE-2026-34849: UAF vulnerability in the screen management module.
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS v3.1: 2.5
CVE-1999-0271: Progressive Networks Real Video server (pnserver) can be crashed remotely.
CVSS v2.0: 5
GHSA-m8xw-r54w-w9ph: Improper initialization in the Intel(R) TXT SINIT ACM for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS v3.1: 6.7
GHSA-3h3c-qxj3-9h67: SAP BusinessObjects Business Intelligence Platform (Web Intelligence) - version 420, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. This allows a low privileged attacker to retrieve some data from the victim but will never be able to modify the document and publish these modifications to the server. It impacts the "Quick Prompt" workflow.
cisco-sa-apache-httpd-pathtrv-LAzg68cZ: Apache HTTP Server Vulnerabilities: October 2021
On October 5, 2021 and October 7, 2021, the Apache Software Foundation released two security announcements for the Apache HTTP Server that disclosed the following vulnerabilities:
    CVE-2021-41524: Null Pointer Dereference Vulnerability  CVE-2021-41773: Path Traversal and Remote Code Execution Vulnerability  CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

For descriptions of these vulnerabilities, see the Apache Security Announcement ["https://httpd.apache.org/security/vulnerabilities_24.html"]. For additional information, see the Cisco TALOS blog post, Threat Advisory: Apache HTTP Server zero-day vulnerability opens door for attackers ["https://blog.talosintelligence.com/2021/10/apache-vuln-threat-advisory.html"].

Cisco investigated its product line and concluded that no Cisco products are affected by these vulnerabilities.
CVE-2017-11507: A cross site scripting (XSS) vulnerability exists in Check_MK versions 1.2.8x prior to 1.2.8p25 and 1.4.0x prior to 1.4.0p9, allowing an unauthenticated attacker to inject arbitrary HTML or JavaScript via the output_format parameter, and the username parameter of failed HTTP basic authentication attempts, which is returned unencoded in an internal server error page.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
CVE-2026-53001: netfilter: xtables: restrict several matches to inet family
In the Linux kernel, the following vulnerability has been resolved:

netfilter: xtables: restrict several matches to inet family

This is a partial revert of:

  commit ab4f21e6fb1c ("netfilter: xtables: use NFPROTO_UNSPEC in more extensions")

to allow ipv4 and ipv6 only.

- xt_mac
- xt_owner
- xt_physdev

These extensions are not used by ebtables in userspace.

Moreover, xt_realm is only for ipv4, since dst->tclassid is ipv4
specific.
GHSA-35v7-q7c2-qg94: Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access).  Supported versions that are affected are 20.12.1.0-20.12.21.5, 21.12.1.0-21.12.20.0 and  22.12.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera P6 Enterprise Project Portfolio Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Primavera P6 Enterprise Project Portfolio Management accessible data as well as  unauthorized read access to a subset of Primavera P6 Enterprise Project Portfolio Management accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
CVSS v3.1: 5.4
GHSA-93q5-9xfx-j4cw: The STARTTLS implementation in the server in Ipswitch IMail 11.03 and earlier does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.
CVE-2009-3735: The ActiveScan Installer ActiveX control in as2stubie.dll before 1.3.3.0 in PandaActiveScan Installer 2.0 in Panda ActiveScan downloads software in an as2guiie.cab archive located at an arbitrary URL, and does not verify the archive's digital signature before installation, which allows remote attackers to execute arbitrary code via a URL argument to an unspecified method.
CVSS v2.0: 9.3
CVE-2022-30137: Azure Service Fabric Container Elevation of Privilege Vulnerability
Executive Summary
An Elevation of Privilege (EOP) vulnerability has been identified within Service Fabric clusters that run Docker containers.  Exploitation of this EOP vulnerability requires an attacker to gain remote code execution within a container.  All Service Fabric and Docker versions are impacted.
CVSS v3.1: 6.7
CVE-2015-4905: Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via vectors related to Server : DML.
CVSS v2.0: 4
GHSA-33v9-7cpf-3wr4: Out-of-bounds read in Push Message Routing Service allows an authorized attacker to disclose information locally.
CVSS v3.1: 5.5
GHSA-964q-9m59-j738: Cisco WebEx Training Center provides different error messages for registration attempts depending on whether the e-mail address exists, which allows remote attackers to enumerate attendees via a series of requests, aka Bug ID CSCul36003.
GHSA-26qf-2r89-746r: Unrestricted Upload of File with Dangerous Type vulnerability in Shafiq Digital Lottery allows Upload a Web Shell to a Web Server.This issue affects Digital Lottery: from n/a through 3.0.5.
CVSS v3.1: 10
GHSA-jqff-3935-jcw9: drivers/usb/gadget/legacy/inode.c in the Linux kernel through 5.16.8 mishandles dev->buf release.
CVSS v3.1: 7.8
RHSA-2024:6827: Red Hat Security Advisory: OpenShift Container Platform 4.16.14 security update
webob: WebOb's location header normalization during redirect leads to open redirect
CVSS v3.1: 6.1
GHSA-2c6v-8r3v-gh6p: Gogs has a Protected Branch Deletion Bypass in Web Interface
SummaryAn access control bypass vulnerability in Gogs web interface allows any repository collaborator with Write permissions to delete protected branches (including the default branch) by sending a direct POST request, completely bypassing the branch protection mechanism. This vulnerability enables privilege escalation from Write to Admin level, allowing low-privilege users to perform dangerous operations that should be restricted to administrators only.Although Git Hook layer correctly prevents protected branch deletion via SSH push, the web interface deletion operation does not trigger Git Hooks, resulting in complete bypass of protection mechanisms.DetailsAffected Component**File**: `internal/route/repo/branch.go`**Function**: `DeleteBranchPost` (lines 110-155)**Route Configuration**: `internal/cmd/web.go:589`Root CauseThe `DeleteBranchPost` function performs the following checks when deleting a branch:✅ User authentication (`reqSignIn`)✅ Write permission check (`reqRepoWriter`)✅ Branch existence verification✅ CommitID matching (optional parameter)❌ **Missing protected branch check**❌ **Missing default branch check**While the UI layer (`internal/route/repo/issue.go:646-658`) correctly checks protected branch status and hides the delete button, attackers can directly construct POST requests to bypass UI restrictions.Vulnerable Code**Vulnerable implementation** (`internal/route/repo/branch.go:110-155`):**Correct implementation in Git Hook** (`internal/cmd/hook.go:122-125`):**Correct UI layer check** (`internal/route/repo/issue.go:646-658`):PoCPrerequisitesHave Write permissions to the target repository (collaborator or team member)Target repository has protected branches configured (e.g., main, master, develop)Access to Gogs web interfaceSend Malicious POST RequestImpact**Bypass branch protection mechanism**: The core function of protected branches is to prevent deletion, and this vulnerability completely undermines this mechanism**Delete default branch**: Can cause repository to become inaccessible (git clone/pull failures)**Bypass code review**: After deleting protected branch, can push new branch bypassing Pull Request requirements**Privilege escalation**: Writer permission users can perform operations that should only be allowed for Admins
CVSS v4.0: 7.1
CVE-2022-48006: An arbitrary file upload vulnerability in taocms v3.0.2 allows attackers to execute arbitrary code via a crafted PHP file. This vulnerability is exploited via manipulation of the upext variable at /include/Model/Upload.php.
CVSS v3.1: 9.8
CVE-2008-0140: Directory traversal vulnerability in error.php in Uebimiau Webmail 2.7.10 and 2.7.2 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the selected_theme parameter, a different vector than CVE-2007-3172.
CVSS v2.0: 6.4
GHSA-66qf-8j2h-9xmq: A valid, authenticated administrative user can query a web interface API to reveal the configured LDAP client password used by XCC to authenticate to an external LDAP server in certain configurations.  There is no exposure where no LDAP client password is configured
CVSS v3.1: 4.9
CVE-2020-9703: Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have a stack exhaustion vulnerability. Successful exploitation could lead to application denial-of-service.
CVSS v3.1: 5.5
CVSS v2.0: 4.3
CVE-2020-4449: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional could allow a remote attacker to obtain sensitive information with a specially-crafted sequence of serialized objects. IBM X-Force ID: 181230.
CVSS v3.0: 7.5
GHSA-38gr-cjjp-3f5w: When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate.Note: The HTTP/3 QUIC module is not enabled by default and is considered experimental. For more information, refer to  Support for QUIC and HTTP/3 https://nginx.org/en/docs/quic.html .Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS v3.1: 7.5
CVE-2004-2553: The Ignition Project ignitionServer 0.1.2 through 0.1.2-R2 allows remote authenticated users with local IRC operator privileges to obtain global IRC operator privileges by using the unofficial umode command with the +ORD argument.
CVSS v2.0: 6
CVE-2023-52949: Missing authentication for critical function vulnerability in proxy settings functionality in Synology Active Backup for Business Agent before 2.7.0-3221 allows local users to obtain user credential via unspecified vectors.
CVSS v3.1: 5.5
GHSA-v9v7-xmqp-c9gw: Cross-site scripting (XSS) vulnerability in index.php in Ariadne 2.4.1 allows remote attackers to inject arbitrary web script or HTML via the ARLogin parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
GHSA-9j42-4j78-g4mh: FFmpeg prior to commit bf814 was discovered to contain an out of bounds read via the dist->alphabet_size variable in the read_vlc_prefix() function.
CVSS v3.1: 5.5
GHSA-gww2-cgc8-8xg9: A command injection vulnerability exists in GestioIP 3.0 commit ac67be and earlier in ip_checkhost.cgi. Crafted input to the 'ip' parameter allows attackers to execute arbitrary shell commands on the server via embedded base64-encoded payloads. Authentication may be required depending on deployment configuration.
CVSS v4.0: 8.7
GHSA-85p9-8fq8-87g2: main_internet.php on the Western Digital My Net N600 and N750 with firmware 1.03.12 and 1.04.16, and the N900 and N900C with firmware 1.05.12, 1.06.18, and 1.06.28, allows remote attackers to discover the cleartext administrative password by reading the "var pass=" line within the HTML source code.
CVE-2024-9988: Crypto <= 2.19 - Authentication Bypass via register
The Crypto plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.19. This is due to missing validation on the user being supplied in the 'crypto_connect_ajax_process::register' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.
CVSS v3.1: 9.8
CVE-2023-3826: IBOS OA Interview edit&op=status sql injection
A vulnerability has been found in IBOS OA 4.5.5 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /?r=recruit/resume/edit&op=status of the component Interview Handler. The manipulation of the argument resumeid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-235147. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
GHSA-6528-8492-63gh: A command injection vulnerability may be exploited after the admin's authentication via the configuration backup restoration function of the TP-Link Archer BE230 v1.2. Successful exploitation could allow an attacker to gain full administrative control of the device, resulting in severe compromise of configuration integrity, network security, and service availability.This CVE covers one of multiple distinct OS command injection issues identified across separate code paths. Although similar in nature, each instance is tracked under a unique CVE ID.This issue affects Archer BE230 v1.2 < 1.2.4 Build 20251218 rel.70420.
CVSS v4.0: 8.5
CVSS v3.1: 7.2
CVE-2013-5642: The SIP channel driver (channels/chan_sip.c) in Asterisk Open Source 1.8.x before 1.8.23.1, 10.x before 10.12.3, and 11.x before 11.5.1; Certified Asterisk 1.8.15 before 1.8.15-cert3 and 11.2 before 11.2-cert2; and Asterisk Digiumphones 10.x-digiumphones before 10.12.3-digiumphones allows remote attackers to cause a denial of service (NULL pointer dereference, segmentation fault, and daemon crash) via an invalid SDP that defines a media description before the connection description in a SIP request.
CVSS v2.0: 5
CVE-2021-41296: ECOA BAS controller - Weak Password Requirements
ECOA BAS controller uses weak set of default administrative credentials that can be easily guessed in remote password attacks and gain full control of the system.
CVSS v3.1: 9.8
CVE-2024-26618: arm64/sme: Always exit sme_alloc() early with existing storage
In the Linux kernel, the following vulnerability has been resolved:

arm64/sme: Always exit sme_alloc() early with existing storage

When sme_alloc() is called with existing storage and we are not flushing we
will always allocate new storage, both leaking the existing storage and
corrupting the state. Fix this by separating the checks for flushing and
for existing storage as we do for SVE.

Callers that reallocate (eg, due to changing the vector length) should
call sme_free() themselves.
CVSS v3.1: 5.5
GHSA-2pr3-956j-4qvg: Software Integrity Attacks vulnerability in Intel Security Anti-Virus Engine (AVE) 5200 through 5800 allows local users to bypass local security protection via a crafted input file.
CVSS v3.1: 7.3
CVE-2013-3628: Zabbix 2.0.9 has an Arbitrary Command Execution Vulnerability
CVSS v3.1: 8.8
CVSS v2.0: 6.5
GHSA-jrgj-6p6v-gf22: dproxy-nexgen (aka dproxy nexgen) uses a static UDP source port (selected randomly only at boot time) in upstream queries sent to DNS resolvers. This allows DNS cache poisoning because there is not enough entropy to prevent traffic injection attacks.
CVSS v3.1: 5.3
CVE-2018-25332: GitBucket 4.23.1 Unauthenticated Remote Code Execution
GitBucket 4.23.1 contains an unauthenticated remote code execution vulnerability that allows attackers to execute arbitrary commands by exploiting weak secret token generation and insecure file upload functionality. Attackers can brute-force the Blowfish encryption key, upload a malicious JAR plugin via the git-lfs endpoint, and execute system commands through an exposed exploit endpoint.
CVSS v4.0: 9.3
CVSS v3.1: 9.8
GHSA-v8r3-qw2m-qq7q: Buffer overflow vulnerability in the codec module
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS v3.1: 4.6
GHSA-36w8-h6xw-wxr6: An issue was discovered in QPDF before 7.0.0. There is a large heap-based out-of-bounds read in the Pl_Buffer::write function in Pl_Buffer.cc. It is caused by an integer overflow in the PNG filter.
CVSS v3.0: 5.5
GHSA-8p8h-vpmc-q8xq: Quantum StorNext Web GUI API before 7.2.4 grants access to internal StorNext configuration and unauthorized modification of some software configuration parameters via undocumented user credentials. This affects StorNext RYO before 7.2.4, StorNext Xcellis Workflow Director before 7.2.4, and ActiveScale Cold Storage.
CVSS v3.1: 7.2
GHSA-fw6x-q668-xp72: Hospira Symbiq Infusion System 3.13 and earlier allows remote authenticated users to trigger "unanticipated operations" by leveraging "elevated privileges" for an unspecified call to an incorrectly exposed function.
CVSS v3.0: 8.8
CVE-2023-2174: BadgeOS <= 3.7.1.6 - Missing Authorization in delete_badgeos_log_entries
The BadgeOS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_badgeos_log_entries function in versions up to, and including, 3.7.1.6. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete the plugin's log entries.
CVSS v3.1: 4.3
GHSA-wq23-w7cm-hgg8: A lack of rate limiting in the 'Forgot Password', 'Email Settings' feature of PHPJabbers Car Park Booking System v3.0 allows attackers to send an excessive amount of email for a legitimate user, leading to a possible Denial of Service (DoS) via a large amount of generated e-mail messages.
CVSS v3.1: 4.3
GHSA-6hmj-wm73-g83p: IBM Cloud Pak Foundational Services Identity Provider (idP) API (IBM Cloud Pak for Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2) allows CRUD Operations with an invalid token. This could allow an unauthenticated attacker to view, update, delete or create an IdP configuration.  IBM X-Force ID:  261130.
CVSS v3.1: 6.5
CVE-2022-48682: In deletefiles in FDUPES before 2.2.0, a TOCTOU race condition allows arbitrary file deletion via a symlink.
CVSS v3.1: 6
RHSA-2022:0083: Red Hat Security Advisory: Red Hat build of Eclipse Vert.x 4.1.8 security update
log4j-core: remote code execution via JDBC Appender log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228) log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern
CVSS v3.1: 5.9
GHSA-8vg8-h2xx-w3r2: The Multiplayer Games WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/multiplayergames.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.7.
GHSA-8p4j-qh7w-684c: wpsupdater.exe in Kingsoft WPS Office through 11.2.0.10382 allows remote code execution by modifying HKEY_CURRENT_USER in the registry.
CVSS v3.1: 9.8
CVE-2025-48007: Potential XSS in Extension:BlueSpiceAvatars
Improper Encoding or Escaping of Output vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceAvatars) allows Cross-Site Scripting (XSS).
This issue affects BlueSpice: from 5 through 5.1.1.
CVSS v4.0: 5.9
GHSA-2769-pfcp-47gw: Cross-site scripting (XSS) vulnerability in proxy.asp in Sambar Server 6.3 BETA 2 and possibly earlier versions allows remote attackers to inject arbitrary web script or HTML via the (1) Remote Proxy Server or (2) Proxy Filter IPs field.
CVE-2025-55317: Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in Microsoft AutoUpdate (MAU) allows an authorized attacker to elevate privileges locally.
CVSS v3.1: 7.8
GHSA-c8j4-9hch-jp6v: A vulnerability was found in code-projects Chat System 1.0 and classified as critical. This issue affects some unknown processing of the file /user/add_chatroom.php. The manipulation of the argument chatname/chatpass leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVE-2026-32620: Discourse: Missing post-level authorization allows whisper metadata disclosure
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, non-staff users could access read receipt information for staff-only posts they weren't supposed to see. No post content was exposed, only metadata about who read the post and when. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.
CVSS v4.0: 5.3
GHSA-4h3w-rhv9-c9xx: IBM Security Guardium EcoSystem 10.5 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 141223.
CVSS v3.0: 7.8
GHSA-4422-p6xr-vfgh: Windows Installer Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-26415.
CVSS v3.1: 7.8
CVE-2020-6474: Use after free in Blink in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS v3.1: 8.8
CVSS v2.0: 6.8
GHSA-x4cr-2cm2-hc5c: Internet Explorer 5.5 and earlier allows remote attackers to display a URL in the address bar that is different than the URL that is actually being displayed, which could be used in web site spoofing attacks, aka the "Web page spoofing vulnerability."
GHSA-4rp7-g99v-fxm6: Use-after-free vulnerability in the DOM id handling functionality in Google Chrome before 11.0.696.57 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted HTML document.