ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-5f46-4729-jprm: SAP NetWeaver ABAP Server and ABAP Platform (Dispatcher), versions - KRNL32NUC - 7.22,7.22EXT, KRNL32UC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL - 7.22,8.04,7.49,7.53,7.73,7.77,7.81,7.82,7.83, allows an unauthenticated attacker without specific knowledge of the system to send a specially crafted packet over a network which will trigger an internal error in the system due to improper input validation in method DpRTmPrepareReq() causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified.
CVSS v3.1: 7.5
GHSA-h6jw-qxf7-j32c: LinuxKI v6.0-1 and earlier is vulnerable to an XSS which is resolved in release 6.0-2.
GHSA-9f4h-pj6m-jj35: Unspecified vulnerability in the Hyperion BI+ component in Oracle Hyperion 11.1.1.3, 11.1.1.4.107 and earlier, 11.1.2.1.129 and earlier, and 11.1.2.2.305 and earlier allows remote authenticated users to affect confidentiality via unknown vectors related to Intelligence Service.
GHSA-6433-x5p4-8jc7: libxmljs vulnerable to type confusion when parsing specially crafted XML
libxmljs is vulnerable to a type confusion vulnerability when parsing a specially crafted XML while invoking a function on the result of `attrs()` that was called on a parsed node. This vulnerability might lead to denial of service (on both 32-bit systems and 64-bit systems), data leak, infinite loop and remote code execution (on 32-bit systems with the XML_PARSE_HUGE flag enabled).
CVSS v4.0: 9.2
CVSS v3.1: 8.1
CVE-2025-66470: NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG content
NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are subject to a XSS vulnerability through the ui.interactive_image component of NiceGUI. The component renders SVG content using Vue's v-html directive without any sanitization. This allows attackers to inject malicious HTML or JavaScript via the SVG <foreignObject> tag whenever the image component is rendered or updated. This is particularly dangerous for dashboards or multi-user applications displaying user-generated content or annotations. This issue is fixed in version 3.4.0.
CVSS v3.1: 6.1
GHSA-qvcw-5pgw-6rvg: SQL injection vulnerability in mojoClassified.cgi in MojoPersonals allows remote attackers to execute arbitrary SQL commands via the cat parameter.
GHSA-pfrm-4rjw-g9q5: string-kit Inefficient Regular Expression Complexity vulnerability
A vulnerability classified as problematic was found in cronvel string-kit up to 0.12.7. This vulnerability affects the function naturalSort of the file lib/naturalSort.js. The manipulation leads to inefficient regular expression complexity. The attack can be initiated remotely. Upgrading to version 0.12.8 can address this issue. The name of the patch is 9cac4c298ee92c1695b0695951f1488884a7ca73. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217180.
CVSS v3.1: 7.5
CVE-2020-24271: A CSRF vulnerability was discovered in EasyCMS v1.6 that can add an admin account through index.php?s=/admin/rbacuser/insert/navTabId/rbacuser/callbackType/closeCurrent, then post username=***&password=***.
CVSS v3.1: 8.8
CVSS v2.0: 6.8
GHSA-3768-p22h-mhp7: An exploitable integer overflow vulnerability exists in the flattenIncrementally function in the xcf2png and xcf2pnm binaries of xcftools 1.0.7. An integer overflow can occur while calculating the row's allocation size, that could be exploited to corrupt memory and eventually execute arbitrary code. In order to trigger this vulnerability, a victim would need to open a specially crafted XCF file.
CVSS v3.1: 8.8
CVE-2023-46277: please (aka pleaser) through 0.5.4 allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl. (If both TIOCSTI and TIOCLINUX are disabled, this cannot be exploited.)
CVSS v3.1: 7.8
CVE-2022-3821: An off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c. An attacker could supply specific values for time and accuracy that leads to buffer overrun in format_timespan(), leading to a Denial of Service.
CVSS v3.1: 5.5
GHSA-r4hm-44p5-j553: Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Directory Management System v1.0 allows attackers to bypass authentication.
CVSS v3.1: 9.8
GHSA-gj4j-4qw6-9rp8: In the Linux kernel, the following vulnerability has been resolved:net/mlx5e: Fix mlx5e_priv_init() cleanup flowWhen mlx5e_priv_init() fails, the cleanup flow calls mlx5e_selq_cleanup which
calls mlx5e_selq_apply() that assures that the `priv->state_lock` is held using
lockdep_is_held().Acquire the state_lock in mlx5e_selq_cleanup().Kernel log:WARNING: suspicious RCU usage
6.8.0-rc3_net_next_841a9b5 #1 Not tainteddrivers/net/ethernet/mellanox/mlx5/core/en/selq.c:124 suspicious rcu_dereference_protected() usage!other info that might help us debug this:rcu_scheduler_active = 2, debug_locks = 1
2 locks held by systemd-modules/293:
 #0: ffffffffa05067b0 (devices_rwsem){++++}-{3:3}, at: ib_register_client+0x109/0x1b0 [ib_core]
 #1: ffff8881096c65c0 (&device->client_data_rwsem){++++}-{3:3}, at: add_client_context+0x104/0x1c0 [ib_core]stack backtrace:
CPU: 4 PID: 293 Comm: systemd-modules Not tainted 6.8.0-rc3_net_next_841a9b5 #1
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0x8a/0xa0
 lockdep_rcu_suspicious+0x154/0x1a0
 mlx5e_selq_apply+0x94/0xa0 [mlx5_core]
 mlx5e_selq_cleanup+0x3a/0x60 [mlx5_core]
 mlx5e_priv_init+0x2be/0x2f0 [mlx5_core]
 mlx5_rdma_setup_rn+0x7c/0x1a0 [mlx5_core]
 rdma_init_netdev+0x4e/0x80 [ib_core]
 ? mlx5_rdma_netdev_free+0x70/0x70 [mlx5_core]
 ipoib_intf_init+0x64/0x550 [ib_ipoib]
 ipoib_intf_alloc+0x4e/0xc0 [ib_ipoib]
 ipoib_add_one+0xb0/0x360 [ib_ipoib]
 add_client_context+0x112/0x1c0 [ib_core]
 ib_register_client+0x166/0x1b0 [ib_core]
 ? 0xffffffffa0573000
 ipoib_init_module+0xeb/0x1a0 [ib_ipoib]
 do_one_initcall+0x61/0x250
 do_init_module+0x8a/0x270
 init_module_from_file+0x8b/0xd0
 idempotent_init_module+0x17d/0x230
 __x64_sys_finit_module+0x61/0xb0
 do_syscall_64+0x71/0x140
 entry_SYSCALL_64_after_hwframe+0x46/0x4e
 </TASK>
CVSS v3.1: 5.5
CVE-2024-3179: Concrete CMS version 9 before 9.2.8 and previous versions before 8.5.16 are vulnerable to Stored XSS in the Custom Class page
Concrete CMS version 9 before 9.2.8 and previous versions before 8.5.16 are vulnerable to Stored XSS in the Custom Class page editing. Prior to the fix, a rogue administrator could insert malicious code in the custom class field due to insufficient validation of administrator provided data. The Concrete CMS security team gave this vulnerability a CVSS v3.1 score of 3.1 with a vector of  AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator . Thanks Alexey Solovyev for reporting.
CVSS v3.1: 3.1
CVE-2008-6475: SQL injection vulnerability in the guestbook component (components/guestbook/guestbook.php) in Drake CMS 0.4.11 and earlier allows remote attackers to execute arbitrary SQL commands via the Via HTTP header (HTTP_VIA) to index.php.
CVSS v2.0: 7.5
GHSA-h249-8hpj-j6ph: A vulnerability has been found in BoyunCMS up to 1.21 on PHP7 and classified as critical. Affected by this vulnerability is an unknown functionality of the file install/install2.php of the component Installation Handler. The manipulation of the argument db_host leads to deserialization. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 2.9
CVSS v3.1: 5.6
CVE-2026-27370: WordPress Chaty plugin <= 3.5.1 - Sensitive Data Exposure vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in Premio Chaty chaty allows Retrieve Embedded Sensitive Data.This issue affects Chaty: from n/a through <= 3.5.1.
CVSS v3.1: 7.5
CVE-2021-3729: Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
CVSS v3.0: 4.3
CVE-2024-28279: Code-projects Computer Book Store 1.0 is vulnerable to SQL Injection via book.php?bookisbn=.
CVSS v3.1: 7.3
GHSA-m2x5-qm6j-4fgp: Some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) were affected by a buffer overflow vulnerability in the LPD service. This would allow an unauthenticated attacker to cause a Denial of Service (DoS) in the LPD service and potentially execute arbitrary code on the device.
CVE-2009-1154: Cisco IOS XR 3.8.1 and earlier allows remote attackers to cause a denial of service (process crash) via a long BGP UPDATE message, as demonstrated by a message with many AS numbers in the AS Path Attribute.
CVSS v2.0: 3.3
GHSA-6mrf-xcxq-m2f3: Mismatch vulnerability in the serialization process in the communication system. Successful exploitation of this vulnerability may affect availability.
CVSS v3.1: 7.5
RHSA-2026:19456: Red Hat Security Advisory: libcap security update
libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file()
CVSS v3.1: 6.7
CVE-2024-9416: Modula Image Gallery <= 2.10.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox 5 JavaScript Library
The Modula Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript library (versions <= 5.0.36) due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
GHSA-g7r4-c4q3-g2pj: The Content Egg WordPress plugin before 5.3.0 does not sanitise and escape the page parameter before outputting back in an attribute in the Autoblogging admin dashboard, leading to a Reflected Cross-Site Scripting
CVSS v3.1: 6.1
GHSA-w7r2-997h-qpf4: A vulnerability was identified in Tenda F453 1.0.0.3/3.As. Impacted is the function fromPptpUserAdd of the file /goform/PPTPDClient. Such manipulation of the argument username/opttype leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used.
CVSS v4.0: 7.4
CVSS v3.1: 8.8
CVE-2023-34614: An issue was discovered jmarsden/jsonij thru 0.5.2 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.
CVSS v3.1: 7.5
GHSA-m4h7-xr3p-j35q: A vulnerability in version 0.90 of the Open Floodlight SDN controller software could allow an attacker with access to the OpenFlow control network to selectively disconnect individual switches from the SDN controller, causing degradation and eventually denial of network access to all devices connected to the targeted switch.
CVSS v3.1: 7.5
GHSA-59fh-9f3p-7m39: Flowise: Mass Assignment in PUT /api/v1/user Allows Authenticated Users to Override Password Hash and Bypass Password Change Verification
SummaryA Mass Assignment vulnerability in the PUT /api/v1/user endpoint allows authenticated users to directly modify restricted user fields, including the credential (password hash), bypassing the intended password change workflow.Because the endpoint forwards the entire request body to the service layer without filtering, an attacker can override the credential field without providing the current password.This bypasses several security protections including:old password verificationpassword hashing enforcementpassword policy validationsession invalidation on password changeWhile the vulnerability cannot be used to modify other users due to an ID check in the controller, it allows attackers who obtain a temporary session (e.g., via token theft or XSS) to establish persistent account access.DetailsThe endpoint **PUT /api/v1/user** allows authenticated users to update their user profile.The controller checks that the authenticated user matches the provided id, preventing direct IDOR:However, the controller forwards the entire request body directly to the service layer without filtering:Inside UserService.updateUser, the incoming data is merged into the existing user entity:Because newUserData is derived from req.body and there is no field allowlist, any field present in the User entity may be modified.This includes sensitive fields such as:credentialtempTokentokenExpirystatusemailThe service implements a secure password change workflow that requires the following fields:Example code:However, this logic can be bypassed by directly supplying a credential value in the request body.Because the merge operation applies all fields from newUserData, the supplied credential hash will overwrite the stored password hash.PoC**Step 1 -  Authenticate**Login as any normal user and obtain a valid JWT token.**POST /api/v1/auth/login****Step 2 - Generate a password hash**Generate a bcrypt hash for a password you control.Example:bcrypt("attacker_password")Example hash:$2b$10$abc123examplehashvalue...Step 3 - Send crafted update requestStep 4 - Login with attacker passwordThe password hash in the database is replaced by the supplied value.The attacker can now authenticate using:**attacker_password**without ever providing the previous password.ImpactThis vulnerability allows authenticated users to bypass the password change security controls.Security protections that are bypassed include:current password verificationpassword hashing enforcementpassword policy validationsession invalidation on password changeAlthough the controller prevents modification of other users' accounts, the vulnerability enables persistence after account compromise.Example attack scenario:An attacker temporarily obtains a user's session (XSS, token leak, shared device, etc.)The attacker sends the crafted update request with a new password hashThe attacker now permanently controls the accountAuthentication logic bypassPrivilege persistence after compromiseWeak account recovery guarantees
CVSS v4.0: 6
CVE-2018-13368: A local privilege escalation in Fortinet FortiClient for Windows 6.0.4 and earlier allows attacker to execute unauthorized code or commands via the command injection.
CVSS v3.0: 7.8
CVSS v2.0: 4.6
CVE-2014-5764: The Antivirus Free (aka com.zrgiu.antivirus) application 7.2.16.02 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0: 5.4
GHSA-gwgm-pgv3-cwqf: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
CVSS v3.1: 8.8
CVE-2022-3182: Improper Access Control vulnerability in the Duo SMS two-factor of Devolutions Remote Desktop Manager 2022.2.14 and earlier allows attackers to bypass the application lock. This issue affects: Devolutions Remote Desktop Manager version 2022.2.14 and prior versions.
CVSS v3.1: 7
GHSA-232p-59mg-f98p: Microweber Cross-site Scripting can result in redirection to a malicious site
Microweber versions 1.3.1 and prior are vulnerable to HTML injection that an attacker can use to redirect someone to a malicious site. A patch is available at commit 68f0721571653db865a5fa01c7986642c82e919c and expected to be part of version 1.3.2.
CVSS v3.1: 6.1
GHSA-fxxv-hjf4-692m: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in videousermanuals.Com White Label CMS allows Reflected XSS.This issue affects White Label CMS: from n/a through 2.7.4.
CVSS v3.1: 7.1
GHSA-w66p-78g4-mr7g: OpenStack Keystone Insufficient token expiration
OpenStack Keystone, as used in OpenStack Folsom 2012.2, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by creating new tokens through token chaining.  NOTE: this issue exists because of a CVE-2012-3426 regression.
CVSS v4.0: 8.2
CVSS v3.1: 5.9
GHSA-rhh5-9m4r-jmx3: In ppmp_validate_wsm of drm_fw.c, there is a possible EoP due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-238720411References: N/A
CVSS v3.1: 7.8
CVE-2017-12475: The AP4_Processor::Process function in Core/Ap4Processor.cpp in Bento4 mp4encrypt before 1.5.0-616 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted mp4 file.
CVSS v3.0: 5.5
CVSS v2.0: 4.3
GHSA-3hcq-vq68-gcc7: A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.14.1), RUGGEDCOM ROX RX1400 (All versions < V2.14.1), RUGGEDCOM ROX RX1500 (All versions < V2.14.1), RUGGEDCOM ROX RX1501 (All versions < V2.14.1), RUGGEDCOM ROX RX1510 (All versions < V2.14.1), RUGGEDCOM ROX RX1511 (All versions < V2.14.1), RUGGEDCOM ROX RX1512 (All versions < V2.14.1), RUGGEDCOM ROX RX1524 (All versions < V2.14.1), RUGGEDCOM ROX RX1536 (All versions < V2.14.1), RUGGEDCOM ROX RX5000 (All versions < V2.14.1). The affected devices have a privilege escalation vulnerability, if exploited, an attacker could gain root user access.
GHSA-3m8w-2mvj-9q7j: Missing Authorization vulnerability in Webcodin WCP Contact Form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCP Contact Form: from n/a through 3.1.0.
CVSS v3.1: 4.3
CVE-2017-7302: The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a swap_std_reloc_out function in bfd/aoutx.h that is vulnerable to an invalid read (of size 4) because of missing checks for relocs that could not be recognised. This vulnerability causes Binutils utilities like strip to crash.
CVSS v3.0: 7.5
CVSS v2.0: 5
CVE-2009-4094: PHP remote file inclusion vulnerability in class/php/d4m_ajax_pagenav.php in the D4J eZine (com_ezine) component 2.1 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[mosConfig_absolute_path parameter.
CVSS v2.0: 7.5
GHSA-3vpm-m9q4-g8qr: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav WP Lead Capturing Pages allows Blind SQL Injection. This issue affects WP Lead Capturing Pages: from n/a through 2.3.
CVSS v3.1: 9.3
GHSA-qxpv-rxq7-rg72: An issue was discovered in Keeper Password Manager for Desktop version 16.10.2, and the KeeperFill Browser Extensions version 16.5.4, allows local attackers to gain sensitive information via plaintext password storage in memory after the user is already logged in, and may persist after logout.
CVSS v3.1: 5.5
CVE-2021-44529: A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody).
CVSS v3.1: 9.8
CVSS v2.0: 7.5
GHSA-3mf2-h46x-xfpw: IBM Security Access Manager for Web is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS v3.0: 6.1
CVE-2018-14370: In Wireshark 2.6.0 to 2.6.1 and 2.4.0 to 2.4.7, the IEEE 802.11 protocol dissector could crash. This was addressed in epan/crypt/airpdcap.c via bounds checking that prevents a buffer over-read.
CVSS v3.0: 7.5
CVSS v2.0: 5
CVE-2021-23429: Denial of Service (DoS)
All versions of package transpile are vulnerable to Denial of Service (DoS) due to a lack of input sanitization or whitelisting, coupled with improper exception handling in the .to() function.
CVSS v3.1: 6.5
GHSA-qjv3-rw45-pg9j: Zenphoto before 1.4.3.4 admin-news-articles.php date parameter XSS.
GHSA-gj2r-phwg-6rww: Kubernetes users may update Pod labels to bypass network policy
ImpactAn attacker with the ability to update pod labels can cause Cilium to apply incorrect network policies.This issue arises due to the fact that on pod update, Cilium incorrectly uses user-provided pod labels to select the policies which apply to the workload in question.This can affect:Cilium network policies that use the namespace, service account or cluster constructs to restrict trafficCilium clusterwide network policies that use Cilium namespace labels to select the PodKubernetes network policiesNon-existent construct names can be provided, which bypass all network policies applicable to the construct. For example, providing a pod with a non-existent namespace as the value of the `io.kubernetes.pod.namespace` label results in none of the namespaced CiliumNetworkPolicies applying to the pod in question.This attack requires the attacker to have [Kubernetes API Server access](https://docs.cilium.io/en/latest/security/threat-model/#kubernetes-api-server-attacker), as described in the Cilium Threat Model.PatchesThis issue affects:Cilium <= v1.14.1Cilium <= v1.13.6Cilium <= v1.12.13This issue has been resolved in:Cilium v1.14.2Cilium v1.13.7Cilium v1.12.14WorkaroundsAn admission webhook can be used to prevent pod label updates to the `k8s:io.kubernetes.pod.namespace` and `io.cilium.k8s.policy.*` keys.AcknowledgementsThe Cilium community has worked together with members of Palantir and Isovalent to prepare these mitigations. Special thanks to @odinuge for reporting this issue and to @nebril for the fix.For more informationIf you have any questions or comments about this advisory, please reach out on [Slack](https://docs.cilium.io/en/latest/community/community/#slack).If you think you have found a vulnerability in Cilium, we strongly encourage you to report it to our private security mailing list – [security@cilium.io](mailto:security@cilium.io) – first, before disclosing them in any public forums. This is a private mailing list where only members of the Cilium internal security team are subscribed to, and is treated as top priority.
CVSS v3.1: 5.4
GHSA-9f2x-4g7j-783f: A vulnerability was determined in seladb PcapPlusPlus 25.05. The impacted element is the function pcpp::SSLClientHelloMessage::getHandshakeVersion of the file Packet++/src/SSLHandshake.cpp of the component TLS Hello Handler. Executing a manipulation of the argument handshakeVersion can lead to heap-based buffer overflow. It is possible to launch the attack remotely. This attack is characterized by high complexity. The exploitability is regarded as difficult. The exploit has been publicly disclosed and may be utilized. This patch is called 98e671010bc7c87b95898c22ae289220ae92542b. It is best practice to apply a patch to resolve this issue.
CVSS v4.0: 2.9
CVSS v3.1: 5.6
RHSA-2009:1430: Red Hat Security Advisory: firefox security update
firefox: URL bar spoofing vulnerability Firefox 3.5 3.0.14 browser engine crashes Firefox 3.5.2 3.0.14 browser engine crashes Firefox 3.5.3 3.0.14 browser engine crashes Firefox 3.5 3.0.14 JavaScript engine crashes Firefox 3.5.2 3.0.14 JavaScript engine crashes Firefox 3.0.14 Insufficient warning for PKCS11 module installation and removal Firefox 3.5.3 3.0.14 TreeColumns dangling pointer vulnerability Firefox 3.5.3 3.0.14 Location bar spoofing via tall line-height Unicode characters Firefox 3.5.3 3.0.14 Chrome privilege escalation with FeedWriter
CVE-2016-7382: For the NVIDIA Quadro, NVS, GeForce, and Tesla products, NVIDIA GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys for Windows or nvidia.ko for Linux) handler where a missing permissions check may allow users to gain access to arbitrary physical memory, leading to an escalation of privileges.
CVSS v3.0: 7.8
CVSS v2.0: 7.2
CVE-2022-25734: Loop with Unreachable Exit Condition in MODEM
Denial of service in modem due to missing null check while processing IP packets with padding
CVSS v3.1: 7.5