ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-cww3-jp3g-84xg: NVIDIA Display Driver for Windows contains a vulnerability where an attacker could trigger a use after free. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure.
CVSS v3.1: 7.8
GHSA-xfv3-wp5f-h673: libclamav/petite.c in ClamAV before 0.93.3 allows remote attackers to cause a denial of service via a malformed Petite file that triggers an out-of-bounds memory access.  NOTE: this issue exists because of an incomplete fix for CVE-2008-2713.
GHSA-3p8x-pc99-4p67: Cross-site scripting (XSS) vulnerability in Tenable Nessus before 6.9 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to handling of .nessus files.
CVSS v3.0: 5.4
GHSA-8cgg-rcwg-mmh6: Active Directory Domain Services Elevation of Privilege Vulnerability
CVSS v3.1: 8.8
PYSEC-2021-788: TensorFlow is an end-to-end open source platform for machine learning. In affected versions the shape inference code for `tf.raw_ops.Dequantize` has a vulnerability that could trigger a denial of service via a segfault if an attacker provides invalid arguments. The shape inference [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/ops/array_ops.cc#L2999-L3014) uses `axis` to select between two different values for `minmax_rank` which is then used to retrieve tensor dimensions. However, code assumes that `axis` can be either `-1` or a value greater than `-1`, with no validation for the other values. We have patched the issue in GitHub commit da857cfa0fde8f79ad0afdbc94e88b5d4bbec764. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
RHSA-2024:9679: Red Hat Security Advisory: webkit2gtk3 security update
webkitgtk: Memory corruption issue when processing web content webkitgtk: improper bounds checking leading to arbitrary code execution webkitgtk: arbitrary javascript code execution webkitgtk: Processing web content may lead to arbitrary code execution webkitgtk: Processing web content may lead to arbitrary code execution webkitgtk: Arbitrary Remote Code Execution webkitgtk: Processing web content may lead to arbitrary code execution webkitgtk: Processing maliciously crafted web content may lead to memory corruption webkitgtk: Processing maliciously crafted web content may lead to memory corruption chromium-browser: Use after free in ANGLE webkitgtk: type confusion may lead to arbitrary code execution webkitgtk: Processing web content may lead to arbitrary code execution webkitgtk: Processing web content may lead to arbitrary code execution webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution webkitgtk: Processing a file may lead to unexpected app termination or arbitrary code execution webkitgtk: webkit2gtk: Use after free may lead to Remote Code Execution webkitgtk: webkit2gtk: Out-of-bounds read was addressed with improved bounds checking webkitgtk: webkit2gtk: Out-of-bounds read was addressed with improved bounds checking webkitgtk: webkit2gtk: Use-after-free was addressed with improved memory management webkitgtk: webkit2gtk: Processing maliciously crafted web content may lead to an unexpected process crash webkitgtk: webkit2gtk: Processing maliciously crafted web content may lead to an unexpected process crash webkitgtk: webkit2gtk: Processing maliciously crafted web content may lead to an unexpected process crash webkit: Processing maliciously crafted web content may lead to memory corruption webkitgtk: Processing maliciously crafted web content may lead to memory corruption webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash webkitgtk: Processing maliciously crafted web content may lead to memory corruption webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash webkitgtk: A malicious website may exfiltrate data cross-origin
CVSS v3.1: 6.5
CVE-2026-13794: Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
CVE-2013-1312: Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer Use After Free Vulnerability."
CVSS v2.0: 9.3
CVE-2025-53840: Icinga DB Web Exposure of Sensitive Information to an Unauthorized Actor vulnerability
Icinga DB Web provides a graphical interface for Icinga monitoring. Starting in version 1.2.0 and prior to version 1.2.2, users with access to Icinga Dependency Views, are allowed to see hosts and services that they weren't meant to on the dependency map. However, the name of an object will not be revealed nor does this grant access to a host's or service's detail view. Please note that this only affects the restrictions `filter/hosts` and `filter/services`. `filter/objects` is not affected by this and restricts objects as it is supposed to. Version 1.2.2 applies these restrictions properly. As a workaround, one may downgrade to version 1.1.3.
CVSS v3.1: 2.4
CVE-2024-13541: aDirectory – WordPress Directory Listing Plugin <= 2.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion
The aDirectory – WordPress Directory Listing Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the adqs_delete_listing() function in all versions up to, and including, 2.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary posts.
CVSS v3.1: 4.3
GHSA-4875-pvww-f65w: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UnboundStudio Accordion FAQ allows Reflected XSS.This issue affects Accordion FAQ: from n/a through 2.2.1.
CVSS v3.1: 7.1
GHSA-gcmg-m9m3-j5jw: Adobe Experience Manager version 6.5.9.0 (and earlier) are affected by an improper access control vulnerability that leads to a security feature bypass. By manipulating referer headers, an unauthenticated attacker could gain access to arbitrary pages that they are not authorized to access.
CVSS v3.1: 7.8
GHSA-8v7w-j6g2-p6j2: HTTP::Body::Multipart in the HTTP-Body 1.08, 1.17, and earlier module for Perl uses the part of the uploaded file's name after the first "." character as the suffix of a temporary file, which makes it easier for remote attackers to conduct attacks by leveraging subsequent behavior that may assume the suffix is well-formed.
CVE-2017-18762: Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects D3600 before 1.0.0.68, D6000 before 1.0.0.68, D6100 before 1.0.0.57, R6100 before 1.0.1.16, R6900P before 1.2.0.22, R7000 before 1.0.9.10, R7000P before 1.2.0.22, R7100LG before 1.0.0.40, WNDR3700v4 before 1.0.2.88, WNDR4300v1 before 1.0.2.90, WNDR4300v2 before 1.0.0.48, WNDR4500v3 before 1.0.0.48, and WNR2000v5 before 1.0.0.58.
CVSS v3.0: 8.8
GHSA-9q47-75mf-qmf9: setup.cgi on NETGEAR R6020 1.0.0.48 devices allows an admin to execute arbitrary shell commands via shell metacharacters in the ntp_server field.
CVE-2006-3947: PHP remote file inclusion vulnerability in components/com_mambatstaff/mambatstaff.php in the Mambatstaff 3.1b and earlier component for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
CVSS v2.0: 6.8
GHSA-jq73-v9pp-jgx4: The bindReplace function in the query factory in includes/classes/database.php in Loaded Commerce 7 does not properly handle : (colon) characters, which allows remote authenticated users to conduct SQL injection attacks via the First name and Last name fields in the address book.
GHSA-q7q9-7mhx-gjww: : Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Teplitsa of social technologies Leyka.This issue affects Leyka: from n/a through 3.31.6.
CVSS v3.1: 5.3
GHSA-29p9-47jw-cjm2: Allen-Bradley MicroLogix 1100 devices before B FRN 15.000 and 1400 devices before B FRN 15.003 allow remote authenticated users to insert the content of an arbitrary file into a FRAME element via unspecified vectors.
CVE-2021-24036: Passing an attacker controlled size when creating an IOBuf could cause integer overflow, leading to an out of bounds write on the heap with the possibility of remote code execution. This issue affects versions of folly prior to v2021.07.22.00. This issue affects HHVM versions prior to 4.80.5, all versions between 4.81.0 and 4.102.1, all versions between 4.103.0 and 4.113.0, and versions 4.114.0, 4.115.0, 4.116.0, 4.117.0, 4.118.0 and 4.118.1.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2018-6247: NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where a NULL pointer dereference may lead to denial of service or possible escalation of privileges.
CVSS v3.0: 8.8
CVSS v2.0: 7.2
CVE-2017-2813: An exploitable integer overflow vulnerability exists in the JPEG 2000 parser functionality of IrfanView 4.44. A specially crafted jpeg2000 image can cause an integer overflow leading to wrong memory allocation resulting in arbitrary code execution. Vulnerability can be triggered by viewing the image in via the application or by using thumbnailing feature of IrfanView.
CVSS v3.0: 8.8
CVE-2008-6982: Cross-site scripting (XSS) vulnerability in index.php in devalcms 1.4a allows remote attackers to inject arbitrary web script or HTML via the currentpath parameter.
CVSS v2.0: 4.3
GHSA-4c8g-jvcx-v4hv: Deno: process.loadEnvFile() bypasses env permission checks and mutates process.env with only read access
SummaryIn Deno, environment access is gated by the `env` permission. You can deny it
with `--deny-env`, or restrict it to a specific allowlist with
`--allow-env=FOO,BAR`. The expectation is that a program running without `env`
permission cannot change `process.env`.`process.loadEnvFile()` (the Node-compatible API for loading variables from a
`.env` file) does **not** honor this. It only checks that the program has
**read** permission for the dotenv file, then writes every key in that file
into the process environment — even when `env` access is denied.In effect, **`--allow-read` plus a writable or attacker-controlled `.env` file
is enough to defeat `--deny-env`.**Am I affected?You are potentially affected if **all** of the following are true:You run Deno **v2.3.0 or newer**.Your program (or any dependency it imports) calls `process.loadEnvFile()`
from `node:process`.You rely on Deno's permission model — specifically `--deny-env`, an
`--allow-env=…` allowlist, or running without granting `env` — as a
security boundary.The `.env` path passed to `loadEnvFile()` can be controlled or modified by
a less-trusted party (untrusted input, user-writable directory, third-party
dependency, etc.) and is covered by your `--allow-read` grant.If your program does not use `process.loadEnvFile()` at all, or if it already
grants full `env` access, this advisory does not change your risk.
CVSS v3.1: 5.2
GHSA-r4fj-r33x-8v88: wenxian: Command Injection in GitHub Actions Workflow via `issue_comment.body`
SummaryA GitHub Actions workflow uses untrusted user input from `issue_comment.body` directly inside a shell command, allowing potential command injection and arbitrary code execution on the runner.DetailsThe workflow is triggered by `issue_comment`, which can be controlled by external users.
In the following step:the value of `github.event.comment.body` is directly interpolated into a shell command inside `run:`.Since GitHub Actions evaluates `${{ }}` before execution, attacker-controlled input is injected into the shell context without sanitization. This creates a command injection risk.Additionally, the extracted value is later reused in another step that constructs output using backticks:which may further propagate unsafe content.PoCGo to an issue in the repositoryPost a comment such as:`@njzjz-bot paper123" ) ; whoami ; #
`Observe whether the command is executed or reflected in logs/output
<img width="658" height="203" alt="poc" src="https://github.com/user-attachments/assets/084ac264-8cb9-4721-8279-26a1da9b891f" />The injected payload successfully breaks out of the quoted context and executes arbitrary shell commands.As shown in the workflow logs, the injected `whoami` command is executed, and the output (`runner`) is printed. This confirms that attacker-controlled input from `github.event.comment.body` is interpreted as shell commands.This demonstrates a clear command injection vulnerability in the workflow.ImpactRemote attackers can inject arbitrary shell commands via issue commentsPotential impacts:Execution of arbitrary commands in GitHub Actions runnerAccess to `GITHUB_TOKEN`Exfiltration of repository dataCI/CD pipeline compromiseThis issue affects all current versions of the repository as the vulnerable workflow is present in the main branch.Suggested FixAvoid directly interpolating untrusted user input into shell commands.Instead, pass `github.event.comment.body` through an environment variable and reference it safely within the script:
CVSS v3.1: 9.8
CVE-2020-0965: A remoted code execution vulnerability exists in the way that Microsoft Windows Codecs Library handles objects in memory, aka 'Microsoft Windows Codecs Library Remote Code Execution Vulnerability'.
CVSS v3.1: 7.8
CVSS v2.0: 4.6
GHSA-636c-9w9h-cf2q: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Estatik Estatik Mortgage Calculator plugin <= 2.0.7 versions.
CVSS v3.1: 7.1
GHSA-cjg9-h8wq-j253: Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit components in Oracle Java SE 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries.
CVE-2025-60094: WordPress Stackable Plugin <= 3.18.1 - Broken Access Control Vulnerability
Missing Authorization vulnerability in Benjamin Intal Stackable stackable-ultimate-gutenberg-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stackable: from n/a through <= 3.18.1.
CVSS v3.1: 4.3
CVE-2022-39311: Compromised agents may be able to execute remote code on GoCD Server
GoCD is a continuous delivery server. GoCD helps you automate and streamline the build-test-release cycle for continuous delivery of your product. GoCD versions prior to 21.1.0 are vulnerable to remote code execution on the server from a malicious or compromised agent. The Spring RemoteInvocation endpoint exposed agent communication and allowed deserialization of arbitrary java objects, as well as subsequent remote code execution. Exploitation requires agent-level authentication, thus an attacker would need to either compromise an existing agent, its network communication or register a new agent to practically exploit this vulnerability. This issue is fixed in GoCD version 21.1.0. There are currently no known workarounds.
CVSS v3.1: 9.1
GHSA-x957-32v9-m7vg: Drupal Acquia DAM allows Forceful Browsing
Missing Authorization vulnerability in Drupal Acquia DAM allows Forceful Browsing. This issue affects Acquia DAM: from 0.0.0 before 1.1.5.
CVSS v3.1: 7.5
CVE-2024-51956: Stored XSS vulnerability in ArcGIS Server Administrator Directory
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.  The privileges required to execute this attack are high, requiring publisher capabilities.  The impact is low to both confidentiality and integrity while having no impact to availability.
CVSS v3.1: 4.8
GHSA-g4wf-rhgg-rv7x: The Dexp BL250 Android device with a build fingerprint of DEXP/BL250/BL250:8.1.0/O11019/1530858027:user/release-keys contains a pre-installed app with a package name of com.mediatek.wfo.impl app (versionCode=27, versionName=8.1.0) that allows any app co-located on the device to modify a system property through an exported interface without proper authorization.
RHSA-2026:17688: Red Hat Security Advisory: firefox security update
firefox: thunderbird: Use-after-free in the DOM: Core & HTML component firefox: thunderbird: Use-after-free in the WebRTC component firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component firefox: thunderbird: Information disclosure due to uninitialized memory in the Graphics: Canvas2D component firefox: thunderbird: Privilege escalation in the Graphics: WebRender component firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component firefox: thunderbird: Incorrect boundary conditions in the WebRTC component firefox: thunderbird: Incorrect boundary conditions in the WebRTC component firefox: thunderbird: Use-after-free in the JavaScript Engine component firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component firefox: thunderbird: Use-after-free in the Widget: Cocoa component firefox: thunderbird: Privilege escalation in the Networking component firefox: thunderbird: Spoofing issue in the DOM: Core & HTML component firefox: thunderbird: Mitigation bypass in the File Handling component firefox: thunderbird: Incorrect boundary conditions in the DOM: Device Interfaces component firefox: thunderbird: Information disclosure in the Form Autofill component firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS firefox: thunderbird: Other issue in the Libraries component in NSS firefox: thunderbird: Privilege escalation in the Debugger component firefox: thunderbird: Other issue in the Storage: IndexedDB component firefox: thunderbird: Mitigation bypass in the DOM: Security component firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS firefox: thunderbird: Incorrect boundary conditions in the WebRTC: Networking component firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150
CVSS v3.1: 7.5
GHSA-j5rv-8887-pg3h: An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The RSS To SMS module processes XML files in an unsafe manner. This opens the application to an XML External Entity attack that can be used to perform SSRF or read arbitrary local files.
RHSA-2007:0993: Red Hat Security Advisory: kernel security update
ALSA memory disclosure flaw kernel ieee80211 off-by-two integer underflow open(O_ATOMICLOOKUP) leaks dentry
RHSA-2020:1913: Red Hat Security Advisory: e2fsprogs security, bug fix, and enhancement update
e2fsprogs: Crafted ext4 partition leads to out-of-bounds write e2fsprogs: Out-of-bounds write in e2fsck/rehash.c
CVSS v3.1: 7.5
CVSS v3.0: 6.4
CVE-2024-34051: A Reflected Cross-site scripting (XSS) vulnerability located in htdocs/compta/paiement/card.php of Dolibarr before 19.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into the facid parameter.
CVSS v3.1: 4.6
CVE-2018-25171: EdTv 2 SQL Injection via id Parameter
EdTv 2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send GET requests to the admin/edit_source endpoint with crafted SQL UNION statements to extract database information including schema names, user credentials, and version details.
CVSS v4.0: 8.8
CVSS v3.1: 8.2
CVE-2018-19069: An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The CGIProxy.fcgi?cmd=setTelnetSwitch feature is authorized for the root user with a password of toor.
CVSS v3.0: 9.8
CVSS v2.0: 10
CVE-2010-2234: Cross-site request forgery (CSRF) vulnerability in Apache CouchDB 0.8.0 through 0.11.0 allows remote attackers to hijack the authentication of administrators for direct requests to an installation URL.
CVSS v2.0: 6.8
GHSA-wp4w-phjg-9h6j: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Equadio equadio allows PHP Local File Inclusion.This issue affects Equadio: from n/a through <= 1.1.3.
CVSS v3.1: 8.1
CVE-2026-8513: Use after free in Input in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
CVSS v3.1: 8.3
CVE-2025-11232: Invalid characters cause assert
To trigger the issue, three configuration parameters must have specific settings: "hostname-char-set" must be left at the default setting, which is "[^A-Za-z0-9.-]"; "hostname-char-replacement" must be empty (the default); and "ddns-qualifying-suffix" must *NOT* be empty (the default is empty). DDNS updates do not need to be enabled for this issue to manifest. A client that sends certain option content would then cause kea-dhcp4 to exit unexpectedly.
This issue affects Kea versions 3.0.1 through 3.0.1 and 3.1.1 through 3.1.2.
CVSS v3.1: 7.5
CVE-2015-4447: Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-4435, CVE-2015-4438, CVE-2015-4441, CVE-2015-4445, CVE-2015-4451, CVE-2015-4452, CVE-2015-5085, and CVE-2015-5086.
CVSS v2.0: 10
CVE-2025-3416: Rust-openssl: rust-openssl use-after-free in `md::fetch` and `cipher::fetch`
A flaw was found in OpenSSL's handling of the properties argument in certain functions. This vulnerability can allow use-after-free exploitation, which may result in undefined behavior or incorrect property parsing, leading to OpenSSL treating the input as an empty string.
CVSS v3.1: 3.7
CVE-2019-19821: A post-authentication privilege escalation in the web application of Combodo iTop allows regular authenticated users to access information and modify information with administrative privileges by not following the HTTP Location header in server responses. This is fixed in all iTop packages (community, essential, professional) in versions : 2.5.4, 2.6.3, 2.7.0
CVSS v3.1: 8.1
CVSS v2.0: 5.5
CVE-2022-2404: WP Popup Builder < 1.2.9 - Reflected Cross-Site Scripting
The WP Popup Builder WordPress plugin before 1.2.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
CVSS v3.1: 6.1
GHSA-gg88-hgcr-39f4: The Disney Go Express Search allows remote attackers to access and modify search information for users by connecting to an HTTP server on the user's system.
CVE-2025-58970: WordPress Doctreat theme <= 1.6.7 - Content Injection vulnerability
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in AmentoTech Doctreat doctreat allows Code Injection.This issue affects Doctreat: from n/a through <= 1.6.7.
CVSS v3.1: 6.3
CVE-2006-4497: SQL injection vulnerability in comments.php in IwebNegar 1.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS v2.0: 7.5
CVE-2002-1054: Directory traversal vulnerability in Pablo FTP server 1.0 build 9 and earlier allows remote authenticated users to list arbitrary directories via "..\" (dot-dot backslash) sequences in a LIST command.
CVSS v2.0: 6.4