ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2015-8310: Cross-site scripting (XSS) vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to inject arbitrary web script or HTML via the playlistname field when creating a new playlist.
CVSS v3.0: 5.4
CVSS v2.0: 3.5
GHSA-q5gq-4fh4-pwcv: A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. Processing a maliciously crafted USD file may lead to unexpected application termination or arbitrary code execution.
CVE-2016-5463: Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1, 8.2.2, IP2014, IP2015, and IP2016 allows remote authenticated users to affect integrity via vectors related to SWSE Server, a different vulnerability than CVE-2016-5464.
CVSS v3.0: 4.1
CVSS v2.0: 3.5
GHSA-8wf3-m6g4-jx6p: Improper Authentication vulnerability in WAGO 750-8XX series with FW version <= FW07 allows an attacker to change some special parameters without authentication. This issue affects: WAGO 750-852 version FW07 and prior versions. WAGO 750-880/xxx-xxx version FW07 and prior versions. WAGO 750-881 version FW07 and prior versions. WAGO 750-831/xxx-xxx version FW07 and prior versions. WAGO 750-882 version FW07 and prior versions. WAGO 750-885/xxx-xxx version FW07 and prior versions. WAGO 750-889 version FW07 and prior versions.
CVE-2000-0676: Netscape Communicator and Navigator 4.04 through 4.74 allows remote attackers to read arbitrary files by using a Java applet to open a connection to a URL using the "file", "http", "https", and "ftp" protocols, as demonstrated by Brown Orifice.
CVSS v2.0: 5
CVE-2018-19409: An issue was discovered in Artifex Ghostscript before 9.26. LockSafetyParams is not checked correctly if another device is used.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
GHSA-gxp5-mv27-vjcj: Jervis's AES CBC Mode is Without Authentication
Vulnerabilityhttps://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L682-L684https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L720-L722`AES/CBC/PKCS5Padding` lacks authentication, making it vulnerable to padding oracle attacks and ciphertext manipulation.ImpactSeverity is considered low for internal uses of this library but if there's any consumer using these methods directly then this is considered critical.Unlikely to matter due to the design of how AES-256-CBC is used in conjunction with RSA and SHA-256 checksum within Jervis.Jervis uses RSA to encrypt AES keys and a SHA-256 checksum of the encrypted data in local-only storage inaccessible from the web.  After asymmetric decryption and before symmetric decryption, a SHA-256 checksum is performed on the metadata and encrypted data. All encrypted data is discarded if the checksum does not match without attempting to decrypt since the encrypted data is assumed invalid.  The data stored is GitHub App authentication tokens which will expire within one hour.PatchesJervis patch will migrate from `AES/CBC/PKCS5Padding` to `AES/GCM/NoPadding`.Upgrade to Jervis 2.2.WorkaroundsNoneReferences[Padding Oracle Attacks](https://en.wikipedia.org/wiki/Padding_oracle_attack)
CVSS v4.0: 8.7
CVSS v3.1: 7.5
RHSA-2022:8962: Red Hat Security Advisory: Red Hat Single Sign-On 7.6.1 security update on RHEL 8
keycloak: path traversal via double URL encoding keycloak: Session takeover with OIDC offline refreshtokens
CVSS v3.1: 6.8
GHSA-mx4h-4m2f-fwrr: Uninitialized Use in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
CVSS v3.1: 7.4
CVE-2024-26649: drm/amdgpu: Fix the null pointer when load rlc firmware
In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Fix the null pointer when load rlc firmware

If the RLC firmware is invalid because of wrong header size,
the pointer to the rlc firmware is released in function
amdgpu_ucode_request. There will be a null pointer error
in subsequent use. So skip validation to fix it.
CVSS v3.1: 5.5
GHSA-3rm8-425f-x7q5: Inappropriate implementation in PictureInPicture in Google Chrome prior to 113.0.5672.63 allowed a remote attacker who had compromised the renderer process to obfuscate the security UI via a crafted HTML page. (Chromium security severity: Low)
CVSS v3.1: 4.3
GHSA-qm8f-5cf9-f84f: Progea Movicon / PowerHMI 11.2.1085 and earlier allows remote attackers to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code via an EIDP packet with a large size field, which writes a zero byte to an arbitrary memory location.
CVE-2023-5992: Opensc: side-channel leaks while stripping encryption pkcs#1 padding
A vulnerability was found in OpenSC where PKCS#1 encryption padding removal is not implemented as side-channel resistant. This issue may result in the potential leak of private data.
CVSS v3.1: 5.6
CVE-2024-12756: Avaya Spaces HTML injection (HTMLi) Vulnerability
An HTML Injection vulnerability in Avaya Spaces may have allowed disclosure of sensitive information or modification of the page content seen by the user.
CVSS v3.1: 7.3
CVE-2017-16264: Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel of Insteon Hub running firmware version 1012. Specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow overwriting arbitrary data. An attacker should send an authenticated HTTP request to trigger this vulnerability. In cmd l_b, at 0x9d015cfc, the value for the `grp` key is copied using `strcpy` to the buffer at `$sp+0x1b4`.This buffer is 8 bytes large, sending anything longer will cause a buffer overflow.
CVSS v3.0: 8.5
CVE-1999-0166: NFS allows users to use a "cd .." command to access other directories besides the exported file system.
CVSS v2.0: 5
CVE-2022-48547: A reflected cross-site scripting (XSS) vulnerability in Cacti 0.8.7g and earlier allows unauthenticated remote attackers to inject arbitrary web script or HTML in the "ref" parameter at auth_changepassword.php.
CVSS v3.1: 6.1
CVE-2022-32207: When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally *widen* the permissions for the target file, leaving the updated file accessible to more users than intended.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
GHSA-wh8m-7455-r7m4: A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. It has been classified as critical. This affects the function RP_checkCredentialsByBBS of the file /goform/RP_checkCredentialsByBBS. The manipulation of the argument pwd leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
GHSA-pqjv-crw5-4v8p: Missing Authorization vulnerability in Mario Peshev WP-CRM System wp-crm-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-CRM System: from n/a through <= 3.4.5.
CVSS v3.1: 5.3
CVE-2017-9949: The grub_memmove function in shlr/grub/kern/misc.c in radare2 1.5.0 allows remote attackers to cause a denial of service (stack-based buffer underflow and application crash) or possibly have unspecified other impact via a crafted binary file, possibly related to a buffer underflow in fs/ext2.c in GNU GRUB 2.02.
CVSS v3.0: 7.8
CVSS v2.0: 6.8
CVE-2025-10428: SourceCodester Pet Grooming Management Software Setting seo_setting.php unrestricted upload
A security vulnerability has been detected in SourceCodester Pet Grooming Management Software 1.0. Affected is an unknown function of the file /admin/seo_setting.php of the component Setting Handler. The manipulation of the argument website_image leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
CVE-2026-1975: Free5GC pfcp_reports.go identityTriggerType null pointer dereference
A security flaw has been discovered in Free5GC up to 4.1.0. This impacts the function identityTriggerType of the file pfcp_reports.go. The manipulation results in null pointer dereference. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. Applying a patch is advised to resolve this issue.
CVSS v4.0: 6.9
CVSS v3.1: 5.3
CVSS v3.0: 5.3
CVSS v2.0: 5
GHSA-f79p-fhg6-6wgx: Cross Site Scripting (XSS) vulnerability in InvoicePlane 1.6 via filter_product input to file modal_product_lookups.php.
CVSS v3.1: 6.1
GHSA-q5pc-8xh3-x6j4: Cross-site request forgery (CSRF) vulnerability in index.php in BabbleBoard 1.1.6 allows remote authenticated users to hijack the authentication of administrators for requests that delete (1) categories or (2) groups; (3) ban users; or (4) delete users via the admin page.
CVE-2025-3265: PHPGurukul e-Diary Management System add-category.php sql injection
A vulnerability classified as critical was found in PHPGurukul e-Diary Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /add-category.php. The manipulation of the argument Category leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 6.9
CVSS v3.1: 7.3
CVSS v3.0: 7.3
CVSS v2.0: 7.5
GHSA-w28c-prr6-33rc: EGroupware Enterprise Line (EPL) before 1.1.20140505, EGroupware Community Edition before 1.8.007.20140506, and EGroupware before 14.1 beta allows remote authenticated administrators to execute arbitrary PHP code via crafted callback values to the call_user_func PHP function, as demonstrated using the newsettings[system] parameter. NOTE: this can be exploited by remote attackers by leveraging CVE-2014-2987.
RHSA-2022:5622: Red Hat Security Advisory: container-tools:rhel8 security and bug fix update
psgo: Privilege escalation in 'podman top'
CVSS v3.1: 8
RHSA-2020:0514: Red Hat Security Advisory: chromium-browser security update
libxslt: use after free in xsltCopyText in transform.c could lead to information disclosure sqlite: invalid pointer dereference in exprListAppendList in window.c sqlite: mishandling of certain uses of SELECT DISTINCT involving a LEFT JOIN in flattenSubquery in select.c leads to a NULL pointer dereference sqlite: zipfileUpdate in ext/misc/zipfile.c mishandles a NULL pathname during an update of a ZIP archive sqlite: error mishandling because of incomplete fix of CVE-2019-19880 chromium-browser: Integer overflow in JavaScript chromium-browser: Type Confusion in JavaScript chromium-browser: Insufficient policy enforcement in storage chromium-browser: Out of bounds write in WebRTC chromium-browser: Out of bounds memory access in WebAudio chromium-browser: Out of bounds write in WebRTC chromium-browser: Out of bounds memory access in streams chromium-browser: Insufficient validation of untrusted input in Blink chromium-browser: Insufficient policy enforcement in extensions chromium-browser: Insufficient policy enforcement in Blink chromium-browser: Insufficient policy enforcement in Blink chromium-browser: Out of bounds read in JavaScript chromium-browser: Inappropriate implementation in Skia chromium-browser: Incorrect security UI in sharing chromium-browser: Uninitialized use in PDFium chromium-browser: Insufficient policy enforcement in AppCache chromium-browser: Inappropriate implementation in CORS chromium-browser: Insufficient validation of untrusted input in Omnibox chromium-browser: Insufficient policy enforcement in downloads chromium-browser: Incorrect security UI in Omnibox chromium-browser: Inappropriate implementation in Blink sqlite: Out-of-bounds read in SELECT with ON/USING clause chromium-browser: Use after free in audio chromium-browser: Insufficient policy enforcement in CORS chromium-browser: Inappropriate implementation in Omnibox chromium-browser: Insufficient policy enforcement in navigation chromium-browser: Insufficient validation of untrusted input in Omnibox chromium-browser: Insufficient validation of untrusted input in Omnibox chromium-browser: Inappropriate implementation in Blink chromium-browser: Insufficient policy enforcement in Safe Browsing chromium-browser: Inappropriate implementation in JavaScript chromium-browser: Insufficient data validation in streams chromium-browser: Inappropriate implementation in installer chromium-browser: Inappropriate implementation in AppCache chromium-browser: Inappropriate implementation in interstitials chromium-browser: Insufficient policy enforcement in CSP chromium-browser: Incorrect security UI in permissions
CVSS v3.1: 4.3
CVSS v3.0: 4.3
RHSA-2023:5922: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4 security update
HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)
CVSS v3.1: 7.5
CVE-2023-3495: Out-of-bounds Write Vulnerability in Hitachi EH-VIEW (KeypadDesigner)
** UNSUPPORTED WHEN ASSIGNED ** Out-of-bounds Write vulnerability in Hitachi EH-VIEW (KeypadDesigner) allows local attackers to potentially execute arbitray code on affected EH-VIEW installations. User interaction is required to exploit the vulnerabilities in that the user must open a malicious file. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVSS v3.1: 7.8
CVE-2007-4039: Argument injection vulnerability involving Mozilla, when certain URIs are registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in an unspecified URI, which are inserted into the command line when invoking the handling process, a similar issue to CVE-2007-3670.
CVSS v3.1: 9.8
CVSS v2.0: 4.3
CVE-2023-20606: In apusys, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07571104; Issue ID: ALPS07571104.
CVSS v3.1: 4.4
GHSA-jr4f-gcmh-6qhw: On Juniper Networks Junos OS and Junos OS Evolved devices processing a specially crafted BGP UPDATE or KEEPALIVE message can lead to a routing process daemon (RPD) crash and restart, causing a Denial of Service (DoS). Continued receipt and processing of this message will create a sustained Denial of Service (DoS) condition. This issue affects both IBGP and EBGP deployments over IPv4 or IPv6. This issue affects: Juniper Networks Junos OS: 17.3 versions prior to 17.3R3-S11; 17.4 versions prior to 17.4R2-S13, 17.4R3-S4; 18.1 versions prior to 18.1R3-S12; 18.2 versions prior to 18.2R2-S8, 18.2R3-S7; 18.3 versions prior to 18.3R3-S4; 18.4 versions prior to 18.4R1-S8, 18.4R2-S7, 18.4R3-S7; 19.1 versions prior to 19.1R1-S6, 19.1R2-S2, 19.1R3-S4; 19.2 versions prior to 19.2R1-S6, 19.2R3-S1; 19.3 versions prior to 19.3R2-S5, 19.3R3-S1; 19.4 versions prior to 19.4R1-S4, 19.4R1-S4, 19.4R2-S3, 19.4R3-S1; 20.1 versions prior to 20.1R2; 20.2 versions prior to 20.2R2; 20.3 versions prior to 20.3R1-S1, 20.3R2. Juniper Networks Junos OS Evolved: 20.3 versions prior to 20.3R2-EVO.
GHSA-gw5h-h6hj-f56g: Gogs vulnerable to improper PAM authorization handling
ImpactExpired PAM accounts and accounts with expired passwords are continued to be seen as valid. Installations use PAM as authentication sources are affected.PatchesExpired PAM accounts and accounts with expired passwords are no longer being seen as valid. Users should upgrade to 0.12.5 or the latest 0.13.0+dev.WorkaroundsIn addition to marking PAM accounts as expired, also disable/lock them. Running `usermod -L <username>` will add an exclamation mark to the password hash and would result in wrong passwords responses when trying to login.Referenceshttps://huntr.dev/bounties/ea82cfc9-b55c-41fe-ae58-0d0e0bd7ab62/For more informationIf you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/6810.
CVSS v3.0: 8.2
CVE-2009-3509: Cross-site scripting (XSS) vulnerability in admin/admin_index.php in CJ Dynamic Poll PRO 2.0 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
CVSS v2.0: 4.3
RHSA-2018:1710: Red Hat Security Advisory: redhat-virtualization-host security update
Kernel: KVM: error in exception handling leads to wrong debug stack value hw: cpu: speculative store bypass Kernel: error in exception handling leads to DoS
CVSS v3.0: 6.5
CVE-2021-3756: Heap-based Buffer Overflow in hoene/libmysofa
libmysofa is vulnerable to Heap-based Buffer Overflow
CVSS v3.0: 6.2
GHSA-qgg8-9g55-hvf5: The web server on the Camtron CMNC-200 Full HD IP Camera and TecVoz CMNC-200 Megapixel IP Camera with firmware 1.102A-008 allows remote attackers to cause a denial of service (device reboot) via a large number of requests in a short time interval.
CVE-2003-0299: The IMAP Client, as used in mutt 1.4.1 and Balsa 2.0.10, allows remote malicious IMAP servers to cause a denial of service and possibly execute arbitrary code via certain large mailbox size values that cause either integer signedness errors or integer overflow errors.
CVSS v2.0: 7.5
GHSA-3h4v-5rmg-5m36: A vulnerability, which was classified as problematic, was found in Open5GS up to 2.7.5. Affected is the function gmm_state_de_registered/gmm_state_exception of the file src/amf/gmm-sm.c of the component AMF. The manipulation leads to denial of service. It is possible to launch the attack remotely. Upgrading to version 2.7.6 is able to address this issue. The name of the patch is 1f30edac27f69f61cff50162e980fe58fdeb30ca. It is recommended to upgrade the affected component.
CVSS v4.0: 6.9
CVSS v3.1: 5.3
GHSA-pggw-rqfm-72rh: EC-CUBE DOM-based cross-site scripting vulnerability
DOM-based cross-site scripting vulnerability in EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote attacker to inject an arbitrary script by having an administrative user of the product to visit a specially crafted page.
CVSS v3.1: 5.4
CVE-2018-17468: Incorrect handling of timer information during navigation in Blink in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to obtain cross origin URLs via a crafted HTML page.
CVSS v3.0: 6.5
CVSS v2.0: 4.3
GHSA-x7jx-72g4-98cw: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vincent Boiardt Easy Flash Embed allows Stored XSS. This issue affects Easy Flash Embed: from n/a through 1.0.
CVSS v3.1: 6.5
GHSA-grqp-gq33-35cw: SQL Injection in HandlerTag_KID.ashx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via Network
CVSS v3.1: 8.8
GHSA-w69v-xfw6-rr96: PHPMyWind 5.5 has XSS in member.php via an HTTP Referer header,
CVSS v3.0: 5.4
PYSEC-2022-117: Tensorflow is an Open Source Machine Learning Framework. The implementation of `SparseCountSparseOutput` can be made to crash a TensorFlow process by an integer overflow whose result is then used in a memory allocation. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
GHSA-vvpg-5wfc-53jj: cdbattags lua-resty-jwt 0.2.3 allows attackers to bypass all JWT-parsing signature checks by crafting a JWT with an enc header with the value A256GCM.
CVSS v3.1: 8.1
CVE-2004-2168: BaSoMail 1.24 allows remote attackers to cause a denial of service (CPU consumption) via multiple connections to TCP port (1) 25 (SMTP) or (2) 110 (POP3).
CVSS v2.0: 5
RHSA-2025:0875: Red Hat Security Advisory: OpenShift Container Platform 4.17.15 security and extras update
cross-spawn: regular expression denial of service express: Improper Input Handling in Express Redirects send: Code Execution Vulnerability in Send Library serve-static: Improper Sanitization in serve-static path-to-regexp: Backtracking regular expressions cause ReDoS golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html body-parser: Denial of Service Vulnerability in body-parser dompurify: DOMPurify vulnerable to tampering by prototype pollution path-to-regexp: path-to-regexp Unpatched `path-to-regexp` ReDoS in 0.1.x nanoid: nanoid mishandles non-integer values jinja2: Jinja has a sandbox breakout through malicious filenames jinja2: Jinja has a sandbox breakout through indirect reference to format method
CVSS v3.1: 6.3
RHSA-2010:0564: Red Hat Security Advisory: jboss-seam2 security update
Seam2: Improper sanitization of parametrized JBoss EL expressions (ACE)
CVE-2022-27827: Improper validation vulnerability in MediaMonitorDimension prior to SMR Apr-2022 Release 1 allows attackers to launch certain activities.
CVSS v3.1: 8.5
CVE-2019-10936: Affected devices improperly handle large amounts of specially crafted UDP packets.

This could allow an unauthenticated remote attacker to trigger a denial of service condition.
CVSS v3.1: 7.5
GHSA-x4wj-j28r-ww47: SQL injection vulnerability in D3Jeeb Pro 3 allows remote attackers to execute arbitrary SQL commands via the catid parameter in (1) fastlinks.php and (2) catogary.php.
GHSA-9xxx-prxf-wghm: FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/links/add_link
CVSS v3.1: 8.8
GHSA-x73g-5x4f-9mqr: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Fineract.This issue affects Apache Fineract: <1.8.5.Users are recommended to upgrade to version 1.8.5 or 1.9.0, which fix the issue.
CVSS v3.1: 9.9
GHSA-rxqq-pvx6-72wc: The qmi_wwan_bind function in drivers/net/usb/qmi_wwan.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (divide-by-zero error and system crash) or possibly have unspecified other impact via a crafted USB device.
CVSS v3.0: 6.6
RHSA-2025:1582: Red Hat Security Advisory: nodejs:18 security update
undici: Undici Uses Insufficiently Random Values nodejs: GOAWAY HTTP/2 frames cause memory leak outside heap
CVSS v3.1: 5.3
CVE-2025-12976: Events Manager <= 7.2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'events_list_grouped' Shortcode
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'events_list_grouped' shortcode in all versions up to, and including, 7.2.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
GHSA-hjvf-5wjr-24jf: Buffer overflow in the queue manager in IBM WebSphere MQ 6.x before 6.0.2.7 and 7.x before 7.0.1.0 allows remote attackers to execute arbitrary code via a crafted request.
CVE-2017-10749: XnView Classic for Windows Version 2.40 allows attackers to execute arbitrary code or cause a denial of service via a crafted .rle file, related to a "User Mode Write AV near NULL starting at wow64!Wow64NotifyDebugger+0x000000000000001d."
CVSS v3.0: 7.8
CVSS v2.0: 4.6
CVE-2019-16696: phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/edit.php table parameter when action=add is used.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2025-27479: Kerberos Key Distribution Proxy Service Denial of Service Vulnerability
Insufficient resource pool in Windows Kerberos allows an unauthorized attacker to deny service over a network.
CVSS v3.1: 7.5
CVE-2023-24867: Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
CVSS v3.1: 8.8