ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-49f5-2882-wx3j: VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202004101-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.5), and Fusion (11.x before 11.5.5) contain a heap-overflow vulnerability in the USB 2.0 controller (EHCI). A malicious actor with local access to a virtual machine may be able to exploit this vulnerability to execute code on the hypervisor from a virtual machine. Additional conditions beyond the attacker's control must be present for exploitation to be possible.
GHSA-538q-pgq4-6rw9: Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker to execute code locally.
CVSS v3.1: 7.8
GHSA-c5hv-mrw8-7c5r: RAID Manager provided by Century Corporation registers a Windows service with an unquoted file path. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege.
CVSS v4.0: 8.4
CVSS v3.0: 6.7
CVE-2025-34059: Dahua Smart Cloud Gateway Registration Management Platform SQL Injection
An SQL injection vulnerability exists in the Dahua Smart Cloud Gateway Registration Management Platform via the username parameter in the /index.php/User/doLogin endpoint. The application fails to properly sanitize user input, allowing unauthenticated attackers to inject arbitrary SQL statements and potentially disclose sensitive information. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.
CVSS v4.0: 8.7
CVE-2026-32355: WordPress JetEngine plugin < 3.8.4.1 - Deserialization of untrusted data vulnerability
Deserialization of Untrusted Data vulnerability in Crocoblock JetEngine jet-engine allows Object Injection.This issue affects JetEngine: from n/a through < 3.8.4.1.
CVSS v3.1: 8.8
GHSA-3mcr-6m85-5gwv: An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and earlier versions. This vulnerability occurs as a result of computation that reads data that is past the end of the target buffer; the computation is part of the XPS image conversion. A successful attack can lead to sensitive data exposure.
CVSS v3.0: 6.5
CVE-2022-47343: In engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.
CVSS v3.1: 5.5
RHSA-2016:0369: Red Hat Security Advisory: rabbitmq-server security and bug fix update
RabbitMQ: /api/... XSS vulnerability RabbitMQ: /api/definitions response splitting vulnerability
CVE-2025-15659: WordPress Elizaibots plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in Elizaibots <= 1.0.2 versions.
CVSS v3.1: 6.5
CVE-2024-38659: enic: Validate length of nl attributes in enic_set_vf_port
In the Linux kernel, the following vulnerability has been resolved:

enic: Validate length of nl attributes in enic_set_vf_port

enic_set_vf_port assumes that the nl attribute IFLA_PORT_PROFILE
is of length PORT_PROFILE_MAX and that the nl attributes
IFLA_PORT_INSTANCE_UUID, IFLA_PORT_HOST_UUID are of length PORT_UUID_MAX.
These attributes are validated (in the function do_setlink in rtnetlink.c)
using the nla_policy ifla_port_policy. The policy defines IFLA_PORT_PROFILE
as NLA_STRING, IFLA_PORT_INSTANCE_UUID as NLA_BINARY and
IFLA_PORT_HOST_UUID as NLA_STRING. That means that the length validation
using the policy is for the max size of the attributes and not on exact
size so the length of these attributes might be less than the sizes that
enic_set_vf_port expects. This might cause an out of bands
read access in the memcpys of the data of these
attributes in enic_set_vf_port.
CVSS v3.1: 7.1
GHSA-vx9m-xjwf-8cqm: uutils coreutils has an Improper Handling of Unicode Encoding Issue
A logic error in the split utility of uutils coreutils causes the corruption of output filenames when provided with non-UTF-8 prefix or suffix inputs. The implementation utilizes to_string_lossy() when constructing chunk filenames, which automatically rewrites invalid byte sequences into the UTF-8 replacement character (U+FFFD). This behavior diverges from GNU split, which preserves raw pathname bytes intact. In environments utilizing non-UTF-8 encodings, this vulnerability leads to the creation of files with incorrect names, potentially causing filename collisions, broken automation, or the misdirection of output data.
CVSS v3.1: 3.3
GHSA-gc9v-66vr-w74v: In LteRrcNrProAsnDecode of LteRrcNr_Codec.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-180956894References: N/A
CVSS v3.1: 7.5
CVE-2022-43120: A cross-site scripting (XSS) vulnerability in the /panel/fields/add component of Intelliants Subrion CMS v4.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Field default value text field.
CVSS v3.1: 6.1
CVE-2008-2287: Symantec Altiris Deployment Solution 6.8.x and 6.9.x before 6.9.176 does not properly protect the install directory, which might allow local users to gain privileges by replacing an application component with a Trojan horse.
CVSS v2.0: 7.2
GHSA-79hc-vhwf-7fj9: PostEcards stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for postcards.mdb.
GHSA-rx48-9x9v-rpp3: The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content  WordPress plugin before 4.15.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS v3.1: 4.8
CVE-2024-33221: An issue in the component AsusBSItf.sys of ASUSTeK Computer Inc ASUS BIOS Flash Driver v3.2.12.0 allows attackers to escalate privileges and execute arbitrary code via sending crafted IOCTL requests.
CVSS v3.1: 7.8
CVE-2021-47158: net: dsa: sja1105: add error handling in sja1105_setup()
In the Linux kernel, the following vulnerability has been resolved:

net: dsa: sja1105: add error handling in sja1105_setup()

If any of sja1105_static_config_load(), sja1105_clocking_setup() or
sja1105_devlink_setup() fails, we can't just return in the middle of
sja1105_setup() or memory will leak. Add a cleanup path.
CVSS v3.1: 5.5
CVE-2017-5701: Insecure platform configuration in system firmware for Intel NUC7i3BNK, NUC7i3BNH, NUC7i5BNK, NUC7i5BNH, NUC7i7BNH versions BN0049 and below allows an attacker with physical presence to run arbitrary code via unauthorized firmware modification during BIOS Recovery.
CVSS v3.0: 7.1
CVSS v2.0: 4.4
GHSA-7rxg-g96w-25cm: Missing Authorization vulnerability in Pluggabl LLC Booster Plus for WooCommerce.This issue affects Booster Plus for WooCommerce: from n/a before 7.1.3.
CVSS v3.1: 6.5
CVE-2026-52962: ceph: fix a buffer leak in __ceph_setxattr()
In the Linux kernel, the following vulnerability has been resolved:

ceph: fix a buffer leak in __ceph_setxattr()

The old_blob in __ceph_setxattr() can store
ci->i_xattrs.prealloc_blob value during the retry.
However, it is never called the ceph_buffer_put()
for the old_blob object. This patch fixes the issue of
the buffer leak.
GHSA-q6q9-4v2f-8943: Sophos Endpoint Protection 10.7 uses an unsalted SHA-1 hash for password storage in %PROGRAMDATA%\Sophos\Sophos Anti-Virus\Config\machine.xml, which makes it easier for attackers to determine a cleartext password, and subsequently choose unsafe malware settings, via rainbow tables or other approaches.
CVSS v3.0: 7.8
GHSA-2qjj-29x2-ffcq: A privilege escalation vulnerability in Trend Micro Antivirus for Mac 2019 (v9.0.1379 and below) could potentially allow an attacker to create a symbolic link to a target file and modify it.
GHSA-r2xx-q7ff-w5p5: Unrestricted Upload of File with Dangerous Type vulnerability in WidgiLabs Plugin Propagator allows Upload a Web Shell to a Web Server.This issue affects Plugin Propagator: from n/a through 0.1.
CVSS v3.1: 10
GHSA-3xpw-r9fx-85m3: The _CalcHashValueWithLength function in FastBackServer.exe in the Server in IBM Tivoli Storage Manager (TSM) FastBack 5.5.0.0 through 5.5.6.0 and 6.1.0.0 through 6.1.0.1 does not properly validate an unspecified length value, which allows remote attackers to cause a denial of service (daemon crash) by sending data over TCP.  NOTE: this might overlap CVE-2010-3060.
GHSA-rm66-mcp2-mm7m: OpenOffice.org (OOo) Office Suite allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a prepared link in a crafted document.
CVE-2024-35841: net: tls, fix WARNIING in __sk_msg_free
In the Linux kernel, the following vulnerability has been resolved:

net: tls, fix WARNIING in __sk_msg_free

A splice with MSG_SPLICE_PAGES will cause tls code to use the
tls_sw_sendmsg_splice path in the TLS sendmsg code to move the user
provided pages from the msg into the msg_pl. This will loop over the
msg until msg_pl is full, checked by sk_msg_full(msg_pl). The user
can also set the MORE flag to hint stack to delay sending until receiving
more pages and ideally a full buffer.

If the user adds more pages to the msg than can fit in the msg_pl
scatterlist (MAX_MSG_FRAGS) we should ignore the MORE flag and send
the buffer anyways.

What actually happens though is we abort the msg to msg_pl scatterlist
setup and then because we forget to set 'full record' indicating we
can no longer consume data without a send we fallthrough to the 'continue'
path which will check if msg_data_left(msg) has more bytes to send and
then attempts to fit them in the already full msg_pl. Then next
iteration of sender doing send will encounter a full msg_pl and throw
the warning in the syzbot report.

To fix simply check if we have a full_record in splice code path and
if not send the msg regardless of MORE flag.
CVSS v3.1: 5.5
GHSA-7m7f-gq9c-523w: Owlfiles File Manager 12.0.1 contains a cross-site scripting vulnerability that allows attackers to inject malicious scripts through the path parameter in HTTP server endpoints. Attackers can craft URLs targeting the download and list endpoints with embedded script tags to execute arbitrary JavaScript in users' browsers.
CVSS v4.0: 5.1
CVSS v3.1: 6.2
GHSA-53rq-74j9-r638: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, after a subsystem reset, iwpriv is not giving correct information.
CVSS v3.0: 7.8
CVE-2016-0184: Use-after-free vulnerability in GDI in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted document, aka "Direct3D Use After Free Vulnerability."
CVSS v3.0: 8.8
CVSS v2.0: 9.3
GHSA-qmm9-x5gr-4gfm: Open Redirect in hekto
Versions of `hekto` before 0.2.4 are vulnerable to open redirect when a domain name is used as part of the `.html` filename.RecommendationUpdate to version 0.2.4 or later.
CVSS v3.1: 6.1
GHSA-584r-x68q-cm4j: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alex Moss FireCask Like & Share Button plugin <= 1.1.5 versions.
CVSS v3.1: 5.9
CVE-2018-16638: Evolution CMS 1.4.x allows XSS via the manager/ search parameter.
CVSS v3.0: 5.4
CVSS v2.0: 3.5
RHSA-2025:7640: Red Hat Security Advisory: git security update
git: The sideband payload is passed unfiltered to the terminal in git
CVSS v3.1: 7.5
GHSA-75j3-qq88-rrpc: SNMP service in Atmel 802.11b VNET-B Access Point 1.3 and earlier, as used in Netgear ME102 and Linksys WAP11, accepts arbitrary community strings with requested MIB modifications, which allows remote attackers to obtain sensitive information such as WEP keys, cause a denial of service, or gain access to the network.
GHSA-mpjj-4688-3fxg: Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` in Multiples parameters
SummaryA Stored Cross-Site Scripting (XSS) vulnerability was identified in the `/admin/pages/[page]` endpoint of the _Grav_ application. This vulnerability allows attackers to inject malicious scripts into the `data[header][metadata]`, `data[header][taxonomy][category]`, and `data[header][taxonomy][tag]` parameters. These scripts are stored in the page frontmatter and executed automatically whenever the affected page is accessed or rendered in the administrative interface.Details**Vulnerable Endpoint:** `POST /admin/pages/[page]`  
**Parameters:**`data[header][metadata]``data[header][taxonomy][category]``data[header][taxonomy][tag]`The application fails to properly sanitize user input when saving page metadata or taxonomy fields via the Admin Panel. As a result, an attacker with access to the admin interface can inject a malicious script using these parameters, and the script will be stored in the page's YAML frontmatter. When the page or metadata is rendered (especially in the Admin Panel), the payload is executed in the browser of any user with access.PoC**Payload:**`<script>alert('PoC-XXS51')</script>`Steps to Reproduce:Log into the _Grav_ Admin Panel and navigate to **Pages**.Create or edit a page.Inject the payload above into any of the following fields in the Options tab:**Metadata** key name**Category** under Taxonomy**Tag** under Taxonomy
![image](https://github.com/user-attachments/assets/b66f3d4d-8f9d-40a9-83a8-5a365814c00b)![image](https://github.com/user-attachments/assets/a1164198-2e25-4746-acb5-71f4874aebbe)Save the page.
![image](https://github.com/user-attachments/assets/6c9c0ba4-bce3-4a72-a10f-39b0b886a10c)When the page is loaded again in the Admin Panel or potentially on the frontend (depending on how the metadata is used), the script is executed, confirming the **Stored XSS** vulnerability.ImpactStored XSS vulnerabilities can result in serious consequences, including:**Session hijacking:** Attackers can steal authentication cookies or tokens**Malware delivery:** Injected scripts can download malicious software**Credential theft:** Fake input fields can capture usernames and passwords**Sensitive data exposure:** Access to internal metadata and browser data**Administrative access compromise:** Especially dangerous in admin-facing interfaces**Phishing attacks:** Users can be redirected to external malicious sites**Reputation damage:** Executing arbitrary scripts in trusted systems undermines credibilityby [CVE-Hunters](https://github.com/Sec-Dojo-Cyber-House/cve-hunters)
CVSS v4.0: 6.2
GHSA-rv59-69qx-jg7m: IBM Cloud Private Kubernetes API server 2.1.0, 3.1.0, 3.1.1, and 3.1.2 can be used as an HTTP proxy to not only cluster internal but also external target IP addresses. IBM X-Force ID: 158145.
GHSA-2rm2-mwc8-f72w: Insufficient user input filtering leads to arbitrary file read by non-authenticated attacker, which results in sensitive information disclosure.
CVSS v3.1: 6.5
CVE-2021-21417: Use after free in fluidsynth
fluidsynth is a software synthesizer based on the SoundFont 2 specifications. A use after free violation was discovered in fluidsynth, that can be triggered when loading an invalid SoundFont file.
CVSS v3.1: 7.2
CVE-2016-3136: The mct_u232_msr_to_state function in drivers/usb/serial/mct_u232.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted USB device without two interrupt-in endpoint descriptors.
CVSS v3.0: 4.6
CVSS v2.0: 4.9
GHSA-97q5-m7rf-rp7v: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, two concurrent threads/processes can write the value of "0" to the debugfs file that controls ipa ipc log which will lead to the double-free in ipc_log_context_destroy(). Another issue is the Use-After-Free which can happen due to the race condition when the ipc log is deallocated via the debugfs call during a log print.
CVSS v3.0: 7.8
GHSA-wwpp-jxxg-w2qr: Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have a buffer overrun vulnerability. Successful exploitation could lead to arbitrary code execution .
RHSA-2025:18817: Red Hat Security Advisory: OpenJDK 8u472 Windows Security Update
openjdk: Enhance certificate handling (Oracle CPU 2025-10) openjdk: Enhance Path Factories (Oracle CPU 2025-10)
CVSS v3.1: 4.8
CVE-2025-37944: wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process
In the Linux kernel, the following vulnerability has been resolved:

wifi: ath12k: Fix invalid entry fetch in ath12k_dp_mon_srng_process

Currently, ath12k_dp_mon_srng_process uses ath12k_hal_srng_src_get_next_entry
to fetch the next entry from the destination ring. This is incorrect because
ath12k_hal_srng_src_get_next_entry is intended for source rings, not destination
rings. This leads to invalid entry fetches, causing potential data corruption or
crashes due to accessing incorrect memory locations. This happens because the
source ring and destination ring have different handling mechanisms and using
the wrong function results in incorrect pointer arithmetic and ring management.

To fix this issue, replace the call to ath12k_hal_srng_src_get_next_entry with
ath12k_hal_srng_dst_get_next_entry in ath12k_dp_mon_srng_process. This ensures
that the correct function is used for fetching entries from the destination
ring, preventing invalid memory accesses.

Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1
Tested-on: WCN7850 hw2.0 WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
CVSS v3.1: 7.8
CVE-2026-0560: Server-Side Request Forgery (SSRF) in parisneo/lollms
A Server-Side Request Forgery (SSRF) vulnerability exists in parisneo/lollms versions prior to 2.2.0, specifically in the `/api/files/export-content` endpoint. The `_download_image_to_temp()` function in `backend/routers/files.py` fails to validate user-controlled URLs, allowing attackers to make arbitrary HTTP requests to internal services and cloud metadata endpoints. This vulnerability can lead to internal network access, cloud metadata access, information disclosure, port scanning, and potentially remote code execution.
CVSS v3.0: 7.5
CVE-2017-1104: IBM Quality Manager (RQM) 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 120666.
CVSS v3.0: 5.4
CVSS v2.0: 3.5
RHSA-2022:5530: Red Hat Security Advisory: squid:4 security update
squid: DoS when processing gopher server responses
CVSS v3.1: 7.5
GHSA-prj4-rp5q-vh2f: Due to a race condition in a bus driver, a double free in msm_bus_floor_vote_context() can potentially occur in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.
CVSS v3.0: 7
CVE-2025-60566: D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetMACFilter.
CVSS v3.1: 7.5
GHSA-6p27-p48f-vh67: All versions of FactoryTalk View SE disclose the hostnames and file paths for certain files within the system. A remote, authenticated attacker may be able to leverage this information for reconnaissance efforts. Rockwell Automation recommends enabling built in security features found within FactoryTalk View SE. Users should follow guidance found in knowledge base articles 109056 and 1126943 to set up IPSec and/or HTTPs.
CVE-2021-29728: IBM Sterling Secure Proxy 6.0.1, 6.0.2, 2.4.3.2, and 3.4.3.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 201160.
CVSS v3.0: 4.9
CVE-2005-0284: SQL injection vulnerability in addentry.php in Woltlab Burning Book 1.0 Gold, 1.1.1e, and possibly other versions, allows remote attackers to execute arbitrary SQL commands via the user-agent parameter.
CVSS v2.0: 7.5
CVE-2024-13117: Social Share Buttons for WordPress <= 2.7 - Unauthenticated Image Upload & Path Traversal
The Social Share Buttons for WordPress plugin through 2.7 allows an unauthenticated user to upload arbitrary images and change the path where they are uploaded
CVSS v3.1: 6.5
CVE-2024-2421: LenelS2 NetBox Improper Neutralization of Special Elements
LenelS2 NetBox access control and event monitoring system was discovered to contain an unauthenticated RCE in versions prior to and including 5.6.1, which allows an attacker to execute malicious commands with elevated permissions.
CVSS v4.0: 9.3
GHSA-9952-gv64-x94c: CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability
ImpactThis vulnerability affects applications that:Use the ImageMagick handler for image processing (`imagick` as the image library)**AND** either:Allow file uploads with user-controlled filenames and process uploaded images using the `resize()` method**OR** use the `text()` method with user-controlled text content or optionsAn attacker can:Upload a file with a malicious filename containing shell metacharacters that get executed when the image is processed**OR** provide malicious text content or options that get executed when adding text to imagesPatchesUpgrade to v4.6.2 or later.Workarounds**Switch to the GD image handler** (`gd`, the default handler), which is not affected by either vulnerability**For file upload scenarios**: Instead of using user-provided filenames, generate random names to eliminate the attack vector with `getRandomName()` when using the `move()` method, or use the `store()` method, which automatically generates safe filenames**For text operations**: If you must use ImageMagick with user-controlled text, sanitize the input to only allow safe characters: `preg_replace('/[^a-zA-Z0-9\s.,!?-]/', '', $text)` and validate/restrict text optionsReferences[OWASP Command Injection Prevention](https://owasp.org/www-community/attacks/Command_Injection)[CWE-78: OS Command Injection](https://cwe.mitre.org/data/definitions/78.html)
CVSS v3.1: 9.8
CVE-2024-10204: Heap-based Buffer Overflow and Uninitialized Variable vulnerabilities exist in eDrawings from Release SOLIDWORKS 2024 through Release SOLIDWORKS 2025
Heap-based Buffer Overflow and Uninitialized Variable vulnerabilities exist in the X_B and SAT file reading procedure in eDrawings from Release SOLIDWORKS 2024 through Release SOLIDWORKS 2025. These vulnerabilities could allow an attacker to execute arbitrary code while opening a specially crafted X_B or SAT file.
CVSS v3.1: 7.8
CVE-2021-28156: HashiCorp Consul Enterprise version 1.8.0 up to 1.9.4 audit log can be bypassed by specifically crafted HTTP events. Fixed in 1.9.5, and 1.8.10.
CVSS v3.1: 7.5
CVSS v2.0: 5
CVE-2024-28710: Cross Site Scripting vulnerability in LimeSurvey before 6.5.0+240319 allows a remote attacker to execute arbitrary code via a lack of input validation and output encoding in the Alert Widget's message component.
CVSS v3.1: 6.1
GHSA-6h69-r77q-c662: A SQL injection vulnerability in Yvan Dotet PostgreSQL Query Deluxe module (aka query_deluxe) 17.x before 17.0.0.4 allows a remote attacker to gain privileges via the query parameter to models/querydeluxe.py:QueryDeluxe::get_result_from_query.
CVSS v3.1: 9.8
GHSA-ggw3-6ch2-q6vf: netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /WebPages/applyhardware.php.
CVSS v3.1: 8.8
GHSA-82vg-5v4f-f9wq: Namada-apps can Crash with Excessive Computation in Mempool Validation
ImpactA malicious transaction may cause a crash in mempool validation.A transaction with authorization section containing 256 public keys or more with valid matching signatures triggers an integer overflow in signature verification that causes a the node to panic.PatchesThis issue has been patched in apps version 1.1.0. The mempool validation has been fixed to avoid overflow.WorkaroundsThere are no workarounds and users are advised to upgrade.
CVSS v4.0: 9.2