ansulev/circl-vulnerability-scores huggingface dataset:
RHSA-2017:1833: Red Hat Security Advisory: chromium-browser security update
chromium-browser: use after free in indexeddb chromium-browser: use after free in ppapi chromium-browser: ui spoofing in blink chromium-browser: type confusion in extensions chromium-browser: out-of-bounds write in pdfium chromium-browser: user information leak via android intents chromium-browser: out-of-bounds read in skia chromium-browser: use after free in v8 chromium-browser: out-of-bounds write in ppapi chromium-browser: use after free in chrome apps chromium-browser: url spoofing in omnibox chromium-browser: uninitialized use in skia chromium-browser: uninitialized use in skia chromium-browser: ui spoofing in browser chromium-browser: url spoofing in omnibox chromium-browser: url spoofing in omnibox chromium-browser: user information leak via svg chromium-browser: type confusion in pdfium chromium-browser: ui spoofing in browser chromium-browser: ui spoofing in payments dialog chromium-browser: pointer disclosure in sqlite
CVSS v3.0: 6.5
CVE-2012-0518: Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3.0 allows remote attackers to affect integrity via unknown vectors related to Redirects, a different vulnerability than CVE-2012-3175.
CVSS v3.1: 4.7
CVSS v2.0: 4.3
CVE-2023-7291: Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'create_mollie_account'
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the create_mollie_account function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with subscriber-level access to set up a mollie account.
CVSS v3.1: 7.1
GHSA-jpx9-hmgp-grj6: The Funnel Builder by CartFlows â€“ Create High Converting Sales Funnels For WordPress plugin before 1.6.13 did not sanitise its facebook_pixel_id and google_analytics_id settings, allowing high privilege users to set XSS payload in them, which will either be executed on pages generated by the plugin, or the whole website depending on the settings used.
CVSS v3.1: 4.8
CVE-2025-47221: An arbitrary file write was found in Keyfactor SignServer versions prior to 7.3.2. The properties ARCHIVETODISK_FILENAME-PATTERN, ARCHIVETODISK_PATH_BASE, ARCHIVETODISK_PATH_PATTERN can be set to any path, even ones that will point to files that already exist. This vulnerability gives a user with admin access the possibility to write files in arbitrary directories in the server file system and potentially overwrite files accessible by the local user JBoss.
CVSS v3.1: 5.3
GHSA-w8rr-r2v3-4678: Web Automated Perl Portal (WebAPP) 0.9.9.4, and 0.9.9.3.4 Network Edition (NE) (aka WebAPP.NET) allows remote attackers to bypass filtering mechanisms via unknown vectors.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
GHSA-5rc3-9cqf-fhjx: An issue was discovered in Druva 6.9.0 for MacOS, allows attackers to gain escalated local privileges via the inSyncDecommission.
CVSS v3.1: 7.8
CVE-2019-5727: Splunk Web in Splunk Enterprise 6.5.x before 6.5.5, 6.4.x before 6.4.9, 6.3.x before 6.3.12, 6.2.x before 6.2.14, 6.1.x before 6.1.14, and 6.0.x before 6.0.15 and Splunk Light before 6.6.0 has Persistent XSS, aka SPL-138827.
CVSS v3.0: 5.4
CVSS v2.0: 3.5
GHSA-63qp-78mr-r5pw: RSA Authentication Agent version 8.0.1 and earlier for Web for both IIS and Apache Web Server are affected by a cross-site scripting vulnerability. The attackers could potentially exploit this vulnerability to execute arbitrary HTML or JavaScript code in the user's browser session in the context of the affected website.
CVSS v3.0: 6.1
GHSA-v2j6-8h5x-h578: The vulnerability discovered in WordPress Perfect Brands for WooCommerce plugin (versions <= 2.0.4) allows server information exposure.
CVE-2025-8368: Portabilis i-Educar pesquisa_pessoa_lst.php cross site scripting
A vulnerability classified as problematic was found in Portabilis i-Educar 2.9. This vulnerability affects unknown code of the file /intranet/pesquisa_pessoa_lst.php. The manipulation of the argument campo_busca/cpf leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 5.3
CVSS v3.1: 4.3
CVSS v3.0: 4.3
CVSS v2.0: 5
CVE-2021-36991: There is an Unauthorized file access vulnerability in Huawei Smartphone due to unstandardized path input.Successful exploitation of this vulnerability by creating malicious file paths can cause unauthorized file access.
CVSS v3.1: 7.5
CVSS v2.0: 5
GHSA-xm98-p8mq-5j7x: Unspecified vulnerability in the Oracle FLEXCUBE Direct Banking component in Oracle Financial Services Software 12.0.3 allows remote authenticated users to affect confidentiality via vectors related to Accounts.
CVSS v3.0: 5.7
CVE-2023-47080: Adobe Substance 3D Stager v2.1.1 Vulnerability VI
Adobe Substance 3D Stager versions 2.1.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 5.5
CVE-2023-32504: WordPress Wise Chat Plugin <= 3.1.3 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in Kainex Wise Chat.This issue affects Wise Chat: from n/a through 3.1.3.
CVSS v3.1: 5.4
GHSA-hww9-65fx-h666: Off-by-one error in the iMonitor component in Novell eDirectory 8.8 SP3, 8.8 SP3 FTF3, and possibly other versions allows remote attackers to execute arbitrary code via an HTTP request with a crafted Accept-Language header, which triggers a stack-based buffer overflow.
CVE-2026-24928: Out-of-bounds write vulnerability in the file system module.
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS v3.1: 5.8
RHSA-2025:23428: Red Hat Security Advisory: Red Hat multicluster global hub 1.5.2 security update
github.com/containerd/containerd: containerd local privilege escalation
CVSS v3.1: 7.7
CVE-2026-44719: Mathesar: Missing collaborator checks allowed access to database-scoped Mathesar metadata
Mathesar is a web application that makes working with PostgreSQL databases both simple and powerful. From 0.2.0 to before 0.10.0, collaborators.list, tables.metadata.list, explorations.list, and forms.list accept a database_id without verifying that the requesting user was a collaborator on that database. An authenticated user on the same Mathesar installation could use these methods to view Mathesar-managed metadata for databases where they were not a collaborator. Depending on the database and features in use, exposed metadata could include collaborator mappings, table metadata, saved exploration metadata, and form metadata. For forms, the exposed metadata included form tokens. For public forms, possession of the token is equivalent to possession of the public form link, which allows submission to the form under the form’s configured PostgreSQL role. This vulnerability is fixed in 0.10.0.
CVSS v4.0: 5.3
GHSA-9rm4-mjvc-4m49: The FoFiType1::parse function in fofi/FoFiType1.cc in Xpdf 3.0.0, gpdf 2.8.2, kpdf in kdegraphics 3.3.1, and possibly other libraries and versions, does not check the return value of the getNextLine function, which allows context-dependent attackers to execute arbitrary code via a PDF file with a crafted Type 1 font that can produce a negative value, leading to a signed-to-unsigned integer conversion error and a buffer overflow.
CVE-2019-15538: An issue was discovered in xfs_setattr_nonsize in fs/xfs/xfs_iops.c in the Linux kernel through 5.2.9. XFS partially wedges when a chgrp fails on account of being out of disk quota. xfs_setattr_nonsize is failing to unlock the ILOCK after the xfs_qm_vop_chown_reserve call fails. This is primarily a local DoS attack vector, but it might result as well in remote DoS if the XFS filesystem is exported for instance via NFS.
CVSS v3.1: 7.5
CVSS v2.0: 7.8
GHSA-5vpm-55vx-4xcf: A potential improper access control vulnerability exists in the JSON-RPC interface of the Bosch Smart Home Controller (SHC) before 9.8.905 that may result in a successful denial of service of the SHC and connected sensors and actuators. In order to exploit the vulnerability, the adversary needs to have successfully paired an app or service, which requires user interaction.
CVSS v3.1: 5.3
GHSA-pv26-xp92-c6p8: Transient DOS while parsing the received TID-to-link mapping action frame.
CVSS v3.1: 7.5
CVE-2020-7868: Helpu remote code execution vulnerability
A remote code execution vulnerability exists in helpUS(remote administration tool) due to improper validation of parameter of ShellExecutionExA function used for login.
CVSS v3.1: 9.6
CVE-2012-5122: Google Chrome before 23.0.1271.64 does not properly perform a cast of an unspecified variable during handling of input, which allows remote attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVSS v2.0: 7.5
CVE-2018-21220: Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affects D3600 before 1.0.0.67, D6000 before 1.0.0.67, D6100 before 1.0.0.56, D7800 before 1.0.1.30, R6100 before 1.0.1.20, R7500 before 1.0.0.118, R7500v2 before 1.0.3.24, R9000 before 1.0.2.52, WNDR3700v4 before 1.0.2.96, WNDR4300 before 1.0.2.98, WNDR4300v2 before 1.0.0.50, WNDR4500v3 before 1.0.0.50, and WNR2000v5 before 1.0.0.62.
CVSS v3.0: 8.8
CVE-2024-43277: WordPress UsersWP plugin <= 1.2.15 - Broken Access Control vulnerability
Missing Authorization vulnerability in AyeCode Ltd UsersWP allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UsersWP: from n/a through 1.2.15.
CVSS v3.1: 5.3
CVE-2023-33257: Verint Engagement Management 15.3 Update 2023R2 is vulnerable to HTML injection via the user data form in the live chat.
CVSS v3.1: 5.4
CVE-2026-40435: BIG-IP httpd access control vulnerability
When configured, IP-based access restrictions for httpd do not cover all endpoints, which may allow connections from blocked addresses.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS v4.0: 6.9
CVSS v3.1: 5.3
CVE-2023-43087: 

Dell PowerScale OneFS 8.2.x, 9.0.0.x-9.5.0.x contains an improper handling of insufficient permissions. A low privileged remote attacker could potentially exploit this vulnerability to cause information disclosure.


CVSS v3.1: 4.3
RHSA-2018:2933: Red Hat Security Advisory: kernel security and bug fix update
kernel: TCP segments with random offsets allow a remote denial of service (SegmentSmack) kernel: IP fragments with random offsets allow a remote denial of service (FragmentSmack) kernel: mm: use-after-free in do_get_mempolicy function allows local DoS or other unspecified impact kernel: Integer overflow in Linux's create_elf_tables function
CVSS v3.0: 7.8
CVE-2026-26162: Windows OLE Elevation of Privilege Vulnerability
Access of resource using incompatible type ('type confusion') in Windows OLE allows an authorized attacker to elevate privileges locally.
CVSS v3.1: 7.8
CVE-2023-34973: QTS, QuTS hero
An insufficient entropy vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows remote users to predict secret via unspecified vectors.

We have already fixed the vulnerability in the following versions:
QTS 5.0.1.2425 build 20230609 and later
QTS 5.1.0.2444 build 20230629 and later
QuTS hero h5.1.0.2424 build 20230609 and later

CVSS v3.1: 3.1
GHSA-64rg-7pf2-5p8v: Dell PowerScale OneFS, 9.0.0.x-9.4.0.x, contain a cleartext storage of sensitive information vulnerability in S3 component. An authenticated local attacker could potentially exploit this vulnerability, leading to information disclosure.
CVSS v3.1: 5.5
GHSA-6mhv-9623-3chf: An issue was discovered in Xen through 4.9.x allowing guest OS users to cause a denial of service (host OS crash) or gain host OS privileges by leveraging an incorrect mask for reference-count overflow checking in shadow mode.
CVSS v3.0: 7.8
GHSA-62gf-43c6-cfmp: The system console configuration option 'log-out-on-disconnect' In Juniper Networks Junos OS Evolved fails to log out an active CLI session when the console cable is disconnected. This could allow a malicious attacker with physical access to the console the ability to resume a previous interactive session and possibly gain administrative privileges. This issue affects all Juniper Networks Junos OS Evolved versions after 18.4R1-EVO, prior to 20.2R1-EVO.
GHSA-jm33-7hwp-f5h7: A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0923, CVE-2020-0924, CVE-2020-0925, CVE-2020-0926, CVE-2020-0927, CVE-2020-0930, CVE-2020-0954, CVE-2020-0973, CVE-2020-0978.
CVSS v3.1: 5.4
GHSA-vfwv-gjcf-p528: Use-after-free vulnerability in the nsTreeSelection function in Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 might allow remote attackers to execute arbitrary code via vectors involving a XUL tree selection, related to a "dangling pointer vulnerability." NOTE: this issue exists because of an incomplete fix for CVE-2010-2753.
CVE-2014-8734: The Organic Groups Menu (aka OG Menu) module before 7.x-2.2 for Drupal allows remote authenticated users with the "access administration pages" permission to change module settings via unspecified vectors.
CVSS v2.0: 3.5
CVE-2020-3451: Cisco Small Business RV340 Series Routers Command Injection and Remote Code Execution Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV340 Series Routers could allow an authenticated, remote attacker with administrative credentials to execute arbitrary commands on the underlying operating system (OS) as a restricted user. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS v3.1: 4.7
CVE-2023-5140: Bonus for Woo < 5.8.3 - Reflected Cross-Site Scripting
The Bonus for Woo WordPress plugin before 5.8.3 does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS v3.1: 6.1
GHSA-r5vf-grcx-5vqp: Mattermost allows authenticated users to gain access to private repositories
Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate the OAuth token scope on the callback which allows an authenticated Mattermost user to gain access to private repositories via modifying the scope parameter in the GitHub authorization URL. Mattermost Advisory ID: MMSA-2026-00628
CVSS v3.1: 5.4
CVE-2025-5202: Open Asset Import Library Assimp HL1MDLLoader.cpp validate_header out-of-bounds
A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been declared as problematic. Affected by this vulnerability is the function HL1MDLLoader::validate_header of the file assimp/code/AssetLib/MDL/HalfLife/HL1MDLLoader.cpp. The manipulation leads to out-of-bounds read. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
CVSS v4.0: 4.8
CVSS v3.1: 3.3
CVSS v3.0: 3.3
CVSS v2.0: 1.7
CVE-2025-6002: VirtueMart - Unrestricted File Upload
An unrestricted file upload vulnerability exists in the Product Image section of the VirtueMart backend. Authenticated attackers can upload files with arbitrary extensions, including executable or malicious files, potentially leading to remote code execution or other security impacts depending on server configuration.
CVSS v3.1: 7.2
GHSA-xgq3-h8hp-5qjg: Multiple PHP remote file inclusion vulnerabilities in Open Education System (OES) 0.1 beta allow remote attackers to execute arbitrary PHP code via a URL in the CONF_INCLUDE_PATH parameter to (1) forum/admin.php and (2) plotgraph/index.php in admin/modules/modules/, and (3) admin_user/mod_admuser.php and (4) ogroup/mod_group.php in admin/modules/user_account/, different vectors than CVE-2007-1446.
CVE-2017-16834: PNP4Nagios through 0.6.26 has /usr/bin/npcd and npcd.cfg owned by an unprivileged account but root code execution depends on these files, which allows local users to gain privileges by leveraging access to this unprivileged account.
CVSS v3.0: 7.8
CVSS v2.0: 7.2
CVE-2015-3135: Heap-based buffer overflow in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-4432 and CVE-2015-5118.
CVSS v2.0: 10
CVE-2017-10991: The WP Statistics plugin through 12.0.9 for WordPress has XSS in the rangestart and rangeend parameters on the wps_referrers_page page.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
GHSA-p4xf-rf54-rj3x: pnpm: Git Fetch Argument Injection via Lockfile resolution.commit
Summarypnpm passes the lockfile-controlled git `resolution.commit` value to `git fetch` without a `--` separator or commit-format validation. For git dependencies fetched through the shallow-fetch path, a malicious lockfile can replace the expected 40-character commit hash with a Git option such as `--upload-pack=<command>`. For SSH and local transports, `--upload-pack` can execute the supplied command. HTTPS transports ignore `--upload-pack`, so the practical attack surface is primarily SSH or local git dependencies.Vulnerability DetailsThe vulnerable path is in `fetching/git-fetcher/src/index.ts`. When a git dependency host is configured for shallow fetching, pnpm calls:Because `resolution.commit` is appended before a `--` separator, Git can parse a commit value beginning with `-` as an option. The same file later passes the value to `git checkout` without a separator:`resolution.commit` comes from the lockfile and is typed as a plain `string`; pnpm does not validate it as a 40-character hexadecimal commit before passing it to Git.Proof of ConceptThe PoC uses a local `file://githost/...` repository because the injection requires a local or SSH transport. HTTPS transport ignores `--upload-pack`.ImpactCode execution as the user running `pnpm install`, under specific transport conditions. The attacker must modify `pnpm-lock.yaml`, and the affected dependency must use SSH or local git transport. HTTPS transport (the common case) is immune.Suggested RemediationAdd a `--` separator before lockfile-controlled git revision values. Validate `resolution.commit` matches `/^[0-9a-f]{40}$/i` before passing to Git.Discovered by [AutoFyn](https://github.com/SignalPilot-Labs/AutoFyn)
Full audit report: [audit_report.md](https://github.com/tempcollab/pnpm/blob/main/autofyn_audit/audit_report.md)
Exploit script: [exploit.sh](https://github.com/tempcollab/pnpm/blob/main/autofyn_audit/exploits/vuln11_git_upload_pack_rce/exploit.sh)
CVSS v3.1: 6.4
GHSA-5h72-hx69-2686: Tenda AC9 V3.0 V15.03.06.42_multi and Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 were discovered to contain a stack overflow via parameter list at url /goform/SetStaticRouteCfg.
CVSS v3.1: 9.8
CVE-2026-43184: rnbd-srv: Zero the rsp buffer before using it
In the Linux kernel, the following vulnerability has been resolved:

rnbd-srv: Zero the rsp buffer before using it

Before using the data buffer to send back the response message, zero it
completely. This prevents any stray bytes to be picked up by the client
side when there the message is exchanged between different protocol
versions.
CVSS v3.1: 7.5
GHSA-rqxq-4234-gv49: A vulnerability, which was classified as critical, was found in dingfanzu CMS up to 20250210. Affected is an unknown function of the file /ajax/loadShopInfo.php. The manipulation of the argument shopId leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVE-2019-8077: Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure .
CVSS v3.1: 7.5
CVSS v2.0: 5
GHSA-g37f-r5c6-x58f: There is a command injection vulnerability in some ZTE mobile internet products. Due to insufficient input validation of multiple network parameters, an authenticated attacker could use the vulnerability to execute arbitrary commands.
CVSS v3.1: 8.4
GHSA-438j-26hg-98wc: SSH before 2.0, with RC4 encryption and the "disallow NULL passwords" option enabled, makes it easier for remote attackers to guess portions of user passwords by replaying user sessions with certain modifications, which trigger different messages depending on whether the guess is correct or not.
CVE-2012-10005: manikandan170890 php-form-builder-class Textarea Textarea.php cross site scripting
A vulnerability has been found in manikandan170890 php-form-builder-class and classified as problematic. Affected by this vulnerability is an unknown functionality of the file PFBC/Element/Textarea.php of the component Textarea Handler. The manipulation of the argument value leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The patch is named 74897993818d826595fd5857038e6703456a594a. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218155.
CVSS v3.1: 3.5
CVSS v3.0: 3.5
CVSS v2.0: 4
CVE-2016-3281: Microsoft Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Word Automation Services on SharePoint Server 2010 SP2, and Office Web Apps 2010 SP2 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
CVSS v3.0: 7.8
CVSS v2.0: 9.3
GHSA-mc7j-m4q9-fwj9: Windows Remote Desktop Licensing Service Denial of Service Vulnerability
CVSS v3.1: 5.9
GHSA-2xp8-j5vh-vcrw: A flaw was found in Red Hat Quay, where it has a persistent Cross-site Scripting (XSS) vulnerability when displaying a repository's notification. This flaw allows an attacker to trick a user into performing a malicious action to impersonate the target user. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
GHSA-mr7q-c9w9-wh4h: go-ethereum is vulnerable to DoS via malicious p2p message affecting a vulnerable node
**Impact**A vulnerable node can be forced to shutdown/crash using a specially crafted message. 
More details to be released later.**Credit**This issue was reported to the Ethereum Foundation Bug Bounty Program by DELENE TCHIO ROMUALD.
CVSS v4.0: 7.1
CVE-2020-28950: The installer of Kaspersky Anti-Ransomware Tool (KART) prior to KART 4.0 Patch C was vulnerable to a DLL hijacking attack that allowed an attacker to elevate privileges during installation process.
CVSS v3.1: 7.8
CVSS v2.0: 6.9