ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-34c5-v528-q6jq: net/ceph/auth_x.c in Ceph, as used in the Linux kernel before 3.16.3, does not properly consider the possibility of kmalloc failure, which allows remote attackers to cause a denial of service (system crash) or possibly have unspecified other impact via a long unencrypted auth ticket.
GHSA-fjgq-224f-fq37: Goa vulnerable to path traversal
Improper path santiziation in github.com/goadesign/goa before v3.0.9, v2.0.10, or v1.4.3 allow remote attackers to read files outside of the intended directory
CVSS v3.1: 7.5
GHSA-4f5j-ff9g-x3f2: Microsoft Office 2010 SP2, Office Compatibility Pack SP3, Word 2007 SP3, and Word 2010 SP2 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability." This vulnerability is different from those described in CVE-2017-0006, CVE-2017-0019, CVE-2017-0020, CVE-2017-0030, CVE-2017-0052, and CVE-2017-0053.
CVSS v3.0: 7.8
CVE-2024-8984: Denial of Service (DoS) in berriai/litellm
A Denial of Service (DoS) vulnerability exists in berriai/litellm version v1.44.5. This vulnerability can be exploited by appending characters, such as dashes (-), to the end of a multipart boundary in an HTTP request. The server continuously processes each character, leading to excessive resource consumption and rendering the service unavailable. The issue is unauthenticated and does not require any user interaction, impacting all users of the service.
CVSS v3.0: 7.5
CVE-2025-7452: kone-net go-chat Endpoint file_controller.go GetFile path traversal
A vulnerability was found in kone-net go-chat up to f9e58d0afa9bbdb31faf25e7739da330692c4c63. It has been declared as critical. This vulnerability affects the function GetFile of the file go-chat/api/v1/file_controller.go of the component Endpoint. The manipulation of the argument fileName leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
GHSA-3rh4-hgwg-p5c2: Windows Connected Devices Platform Service Information Disclosure Vulnerability.
CVSS v3.1: 4.7
CVE-2015-1070: WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
CVSS v2.0: 6.8
GHSA-p8qw-2q25-j7x7: A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to obtain secret data or modify memory.We have already fixed the vulnerability in the following versions:
QTS 5.2.1.2930 build 20241025 and later
QuTS hero h5.2.1.2929 build 20241025 and later
CVSS v4.0: 2.1
CVSS v3.1: 7.2
GHSA-r47r-9pfj-fpj9: C4G Basic Laboratory Information System 3.4 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL commands by injecting malicious code through the site parameter. Attackers can send GET requests to the users_select.php endpoint with crafted SQL payloads to extract sensitive database information including patient records and system credentials.
CVSS v4.0: 8.8
CVSS v3.1: 8.2
GHSA-cqww-fvwv-8hfg: Memory corruption in Audio while validating and mapping metadata.
CVSS v3.1: 6.7
GHSA-mqph-7h49-hqfm: Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository
ImpactThe translation memory API exposed unintended endpoints, which in turn didn't do proper access control.Patcheshttps://github.com/WeblateOrg/weblate/pull/18516WorkaroundsThe CDN add-on is not enabled by default.ReferencesThanks to @spbavarva for reporting this responsibly via GitHub.
CVSS v3.1: 6.8
CVE-2024-3386: PAN-OS: Predefined Decryption Exclusions Does Not Work as Intended
An incorrect string comparison vulnerability in Palo Alto Networks PAN-OS software prevents Predefined Decryption Exclusions from functioning as intended. This can cause traffic destined for domains that are not specified in Predefined Decryption Exclusions to be unintentionally excluded from decryption.
CVSS v3.1: 5.3
GHSA-qq6h-5g6j-q3cm: sweetalert2 v11.4.9 and above contains hidden functionality
`sweetalert2` versions 11.4.9 and above are vulnerable to hidden functionality that was introduced by the maintainer. The package outputs audio and/or video messages that do not pertain to the functionality of the package and is not included in versions 11.0.0 - 11.4.8.WorkaroundUse a version 11.0.0 - 11.4.8 of the package until the maintainer releases a fix.
GHSA-w2ww-h43r-25xg: Unspecified vulnerability in McAfee Network Data Loss Prevention before (NDLP) before 9.3 allows local users to obtain sensitive information and impact integrity via unknown vectors, related to partition mounting.
GHSA-g8hv-44v8-257w: The gnutls_x509_dn_oid_name function in lib/x509/common.c in GnuTLS 3.0 before 3.1.20 and 3.2.x before 3.2.10 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted X.509 certificate, related to a missing LDAP description for an OID when printing the DN.
GHSA-3ggg-9h5p-h885: The Shop Love (aka com.waterwish.shoplove) application 1.05 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
GHSA-jx87-jq84-246c: A vulnerability classified as critical was found in codeprojects Online Restaurant Management System 1.0. This vulnerability affects unknown code of the file /reservation_save.php. The manipulation of the argument first leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS v4.0: 6.9
CVSS v3.1: 7.3
GHSA-rffm-86xj-fhj6: Cribl UI 1.5.0 allows remote attackers to run arbitrary commands via an unauthenticated web request.
CVSS v3.0: 9.8
GHSA-v8w4-jr59-9qjp: Unquoted Windows search path vulnerability in BitDefender 8 allows local users to prevent BitDefender from starting by creating a malicious C:\program.exe, possibly due to the lack of quoting of the full pathname when executing a process.
CVE-2020-17509: ATS negative cache option is vulnerable to a cache poisoning attack. If you have this option enabled, please upgrade or disable this feature. Apache Traffic Server versions 7.0.0 to 7.1.11 and 8.0.0 to 8.1.0 are affected.
CVSS v3.1: 7.5
CVSS v2.0: 4.3
CVE-2018-6912: The decode_plane function in libavcodec/utvideodec.c in FFmpeg through 3.4.2 allows remote attackers to cause a denial of service (out of array read) via a crafted AVI file.
CVSS v3.0: 6.5
CVSS v2.0: 4.3
GHSA-86ff-qpjc-rhgq: SimpleImportProduct Prestashop Module v6.2.9 was discovered to contain a SQL injection vulnerability via the key parameter at send.php.
CVSS v3.1: 9.8
CVE-2018-15383: Cisco Adaptive Security Appliance Direct Memory Access Denial of Service Vulnerability
A vulnerability in the cryptographic hardware accelerator driver of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a temporary denial of service (DoS) condition. The vulnerability exists because the affected devices have a limited amount of Direct Memory Access (DMA) memory and the affected software improperly handles resources in low-memory conditions. An attacker could exploit this vulnerability by sending a sustained, high rate of malicious traffic to an affected device to exhaust memory on the device. A successful exploit could allow the attacker to exhaust DMA memory on the affected device, which could cause the device to reload and result in a temporary DoS condition.
CVSS v3.1: 7.5
CVSS v2.0: 7.8
GHSA-xf7g-gcvh-wfvm: Improper input validation in some Intel(R) XMM(TM) 7560 Modem software before version M2_7560_R_01.2146.00 may allow a privileged user to potentially enable escalation of privilege via physical access.
CVSS v3.1: 7.2
CVE-2009-3778: SQL injection vulnerability in Moodle Course List 6.x before 6.x-1.2, a module for Drupal, allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS v2.0: 7.5
CVE-2024-39516: Junos OS and Junos OS Evolved: With certain BGP options enabled, receipt of specifically malformed BGP update causes RPD crash
An Out-of-Bounds Read vulnerability in

the routing protocol daemon (rpd) of 

 Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker sending a specifically malformed BGP packet to cause rpd to crash and restart, resulting in a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.


This issue only affects systems configured in
      either of two ways:

    
    
        *  systems with BGP traceoptions enabled

        *  systems with BGP traffic engineering
          configured

    


This issue can affect iBGP and eBGP with 

any address family

 configured. The specific attribute involved is non-transitive, and will not propagate across a network.

This issue affects:

Junos OS: 



  *  All versions before 21.4R3-S8,
  *  22.2 before 22.2R3-S5, 
  *  22.3 before 22.3R3-S4, 
  *  22.4 before 22.4R3-S3, 
  *  23.2 before 23.2R2-S2, 
  *  23.4 before 23.4R2; 




Junos OS Evolved: 



  *  All versions before 21.4R3-S8-EVO, 
  *  22.2-EVO before 22.2R3-S5-EVO, 
  *  22.3-EVO before 22.3R3-S4-EVO, 
  *  22.4-EVO before 22.4R3-S3-EVO, 
  *  23.2-EVO before 23.2R2-S2-EVO, 
  *  23.4-EVO before 23.4R2-EVO.
CVSS v4.0: 8.7
CVSS v3.1: 7.5
GHSA-m8w8-2hj8-vrjm: Gaim before 1.3.1 allows remote attackers to cause a denial of service (application crash) via a Yahoo! message with non-ASCII characters in a file name.
GHSA-wmg4-hccw-9xwx: The "Clear History and Website Data" feature in Apple Safari before 9.1.1, as used in iOS before 9.3.2 and other products, mishandles the deletion of browsing history, which might allow local users to obtain sensitive information by leveraging read access to a Safari directory.
CVSS v3.0: 3.3
GHSA-2wx3-jm7x-4xg5: The One Click Order Re-Order plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ced_ocor_save_general_setting' function in all versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change the plugin settings, including adding stored cross-site scripting.
CVSS v3.1: 6.4
GHSA-66q7-4wcm-7r85: Deserialization of Untrusted Data vulnerability in Dotstore Woocommerce Category Banner Management banner-management-for-woocommerce allows Object Injection.This issue affects Woocommerce Category Banner Management: from n/a through <= 2.5.1.
CVSS v3.1: 8.8
GHSA-m9vv-m3gv-47x8: Use after free in WebRTC in Google Chrome prior to 92.0.4515.159 allowed an attacker who convinced a user to visit a malicious website to potentially exploit heap corruption via a crafted HTML page.
GHSA-r6mj-gw85-2394: When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.
CVSS v3.1: 6.5
GHSA-3w6g-vv96-4ph6: A buffer overflow vulnerability exists in libsndfile version 1.2.2 and potentially earlier versions when processing malformed IRCAM audio files. The vulnerability occurs in the ircam_read_header function at src/ircam.c:164 during sample rate processing, leading to memory corruption and potential code execution.
CVSS v3.1: 7.5
CVE-2014-1513: TypedArrayObject.cpp in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 does not prevent a zero-length transition during use of an ArrayBuffer object, which allows remote attackers to execute arbitrary code or cause a denial of service (heap-based out-of-bounds write or read) via a crafted web site.
CVSS v3.1: 8.8
CVSS v2.0: 9.3
GHSA-jgj8-6rfv-fv92: Reflected XSS vulnerability in Shaarli v0.9.1 allows an unauthenticated attacker to inject JavaScript via the searchtags parameter to index.php. If the victim is an administrator, an attacker can (for example) take over the admin session or change global settings or add/delete links. It is also possible to execute JavaScript against unauthenticated users.
CVSS v3.0: 6.1
GHSA-mc93-wcph-m2mx: A spoofing vulnerability manifests in Microsoft Xamarin.Forms due to the default settings on Android WebView version prior to 83.0.4103.106, aka 'Xamarin.Forms Spoofing Vulnerability'.
CVSS v3.1: 4.7
GHSA-vh82-45mm-g28j: B64dec 1.1.2 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code by overwriting Structured Exception Handler (SEH) with crafted input. Attackers can leverage an egg hunter technique and carefully constructed payload to inject and execute malicious code during base64 decoding process.
CVSS v4.0: 8.4
CVSS v3.1: 9.8
CVE-2022-45063: xterm before 375 allows code execution via font ops, e.g., because an OSC 50 response may have Ctrl-g and therefore lead to command execution within the vi line-editing mode of Zsh. NOTE: font ops are not allowed in the xterm default configurations of some Linux distributions.
CVSS v3.1: 9.8
CVE-2025-5799: Tenda AC8 WifiExtraSet fromSetWirelessRepeat stack-based overflow
A vulnerability was found in Tenda AC8 16.03.34.09. It has been declared as critical. Affected by this vulnerability is the function fromSetWirelessRepeat of the file /goform/WifiExtraSet. The manipulation of the argument wpapsk_crypto leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 8.7
CVSS v3.1: 8.8
CVSS v3.0: 8.8
CVSS v2.0: 9
GHSA-2xhv-22cq-xj7w: lucy-xss-filter before commit 7c1de6d allows an attacker to induce server-side HEAD requests to arbitrary URLs when the ObjectSecurityListener or EmbedSecurityListener option is enabled and embed or object tags are used with a src attribute missing a file extension.
CVSS v3.1: 6.1
CVE-2021-22155: An Authentication Bypass vulnerability in the SAML Authentication component of BlackBerry Workspaces Server (deployed with Appliance-X) version(s) 10.1, 9.1 and earlier could allow an attacker to potentially gain access to the application in the context of the targeted user’s account.
CVSS v3.1: 8.8
CVSS v2.0: 6.5
RHSA-2023:7213: Red Hat Security Advisory: squid:4 security update
squid: Request/Response smuggling in HTTP/1.1 and ICAP squid: Denial of Service in HTTP Digest Authentication
CVSS v3.1: 8.6
GHSA-ff6x-wgv6-wj7q: Cross-site scripting (XSS) vulnerability in flowplayer.swf in the Flash fallback feature in Flowplayer HTML5 5.4.3 allows remote attackers to inject arbitrary web script or HTML by using URL encoding within the callback parameter name.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7342.
CVE-2012-1062: Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine Applications Manager 9.x and 10.x allow remote attackers to inject arbitrary web script or HTML via the (1) period parameter to showHistoryData.do; (2) selectedNetwork, (3) network, or (4) group parameters to showresource.do; (5) header parameter to AlarmView.do; or (6) attName parameter to jsp/PopUp_Graph.jsp.  NOTE: the Search.do/query vector is already covered by CVE-2008-1566, and the jsp/ThresholdActionConfiguration.jsp redirectto vector is already covered by CVE-2008-0474.
CVSS v2.0: 4.3
GHSA-hhqm-f4m4-pq39: RaspAP raspap-webgui Command Injection vulnerability
Command injection vulnerability in RaspAP raspap-webgui 2.8.8 and earlier allows remote attackers to run arbitrary commands via crafted POST request to hostapd settings form.
CVSS v3.1: 8.8
CVE-2004-0511: Multiple unknown vulnerabilities in MMDF on OpenServer 5.0.6 and 5.0.7, and possibly other operating systems, may allow attackers to cause a denial of service by triggering a null dereference.
CVSS v2.0: 2.1
GHSA-fxgh-826p-6cx6: Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D6200 before 1.1.00.40, D7000 before 1.0.1.78, R6020 before 1.0.0.42, R6080 before 1.0.0.42, R6050 before 1.0.1.26, JR6150 before 1.0.1.26, R6120 before 1.0.0.66, R6220 before 1.1.0.110, R6230 before 1.1.0.110, R6260 before 1.1.0.64, R6800 before 1.2.0.62, R6700v2 before 1.2.0.62, R6900v2 before 1.2.0.62, R7450 before 1.2.0.62, AC2100 before 1.2.0.62, AC2400 before 1.2.0.62, AC2600 before 1.2.0.62, and WNR2020 before 1.1.0.62.
CVE-2014-2048: The user_openid app in ownCloud Server before 5.0.15 allows remote attackers to obtain access by leveraging an insecure OpenID implementation.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
GHSA-36hj-f8vr-vxrj: Cross-site scripting vulnerability in WP-OliveCart versions prior to 3.1.3 and WP-OliveCartPro versions prior to 3.1.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS v3.0: 6.1
GHSA-4mqw-3fmc-46fv: Unchecked return value in SDM firmware for Intel(R) Stratix 10 and Intel(R) Agilex 7 FPGAs before version 23.3 may allow an authenticated user to potentially enable denial of service via adjacent access.
CVSS v3.1: 7.6
CVE-2023-47231: WordPress ShortCodes UI Plugin <= 1.9.8 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Bainternet ShortCodes UI plugin <= 1.9.8 versions.
CVSS v3.1: 6.5
GHSA-qvgp-3pf6-vxc6: drivers/input/serio/i8042.c in the Linux kernel before 4.12.4 allows attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact because the port->exists value can change after it is validated.
CVSS v3.0: 7.8
GHSA-qcm4-6gpf-m44q: An information disclosure vulnerability exists in EdgeMax EdgeSwitch firmware v1.9.0 that allowed read only users could obtain unauthorized information through SNMP community pages.
RHSA-2026:1472: Red Hat Security Advisory: openssl security update
openssl: OpenSSL: Arbitrary code execution or denial of service through crafted PKCS#12 file openssl: OpenSSL: Remote code execution or Denial of Service via oversized Initialization Vector in CMS parsing openssl: OpenSSL: Denial of Service via NULL pointer dereference in QUIC protocol handling openssl: OpenSSL: Data integrity bypass in `openssl dgst` command due to silent truncation openssl: OpenSSL: Denial of Service due to excessive memory allocation in TLS 1.3 certificate compression openssl: OpenSSL: Denial of Service due to out-of-bounds write in BIO filter openssl: OpenSSL: Information disclosure and data tampering via specific low-level OCB encryption/decryption calls openssl: OpenSSL: Arbitrary code execution due to out-of-bounds write in PKCS#12 processing openssl: OpenSSL: Denial of Service via malformed TimeStamp Response openssl: OpenSSL: Denial of Service via malformed PKCS#12 file processing openssl: OpenSSL: Denial of Service due to type confusion in PKCS#12 file processing openssl: OpenSSL: Denial of Service via type confusion in PKCS#7 signature verification
CVSS v3.1: 5.9
CVE-2023-35958: Multiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 VCDATA parsing functionality of GTKWave 3.3.115. A specially-crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the copy function `fstFread`.
CVSS v3.1: 7.8
GHSA-9p44-j4g5-cfx5: Trivy Action has a script injection via sourced env file in composite action
Command Injection in aquasecurity/trivy-action via Unsanitized Environment Variable ExportA command injection vulnerability exists in `aquasecurity/trivy-action` due to improper handling of action inputs when exporting environment variables. The action writes `export VAR=<input>` lines to `trivy_envs.txt` based on user-supplied inputs and subsequently sources this file in `entrypoint.sh`.Because input values are written without appropriate shell escaping, attacker-controlled input containing shell metacharacters (e.g., `$(...)`, backticks, or other command substitution syntax) may be evaluated during the sourcing process. This can result in arbitrary command execution within the GitHub Actions runner context.**Severity:**ModerateCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:NCWE-78: Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’)**Impact:**Successful exploitation may lead to arbitrary command execution in the CI runner environment.**Affected Versions:**Versions >= 0.31.0 and <= 0.33.1Introduced in commit `7aca5ac`**Affected Conditions:**The vulnerability is exploitable when a consuming workflow passes attacker-controlled data into any action input that is written to `trivy_envs.txt`. Access to user input is required by the malicious actor.A representative exploitation pattern involves incorporating untrusted pull request metadata into an action parameter. For example:If the pull request title contains shell syntax, it may be executed when the generated environment file is sourced.**Not Affected:**Workflows that do not pass attacker-controlled data into `trivy-action` inputsWorkflows that upgrade to a patched version that properly escapes shell values or eliminates the `source ./trivy_envs.txt` patternWorkflows where user input is not accessible.**Call Sites:**`action.yaml:188` — `set_env_var_if_provided` writes unescaped `export` lines`entrypoint.sh:9` — sources `./trivy_envs.txt`
CVSS v3.1: 5.9
CVE-2011-4832: Directory traversal vulnerability in CaupoShop Pro 2.x, CaupoShop Classic 3.01, and CaupoShop Pro 3.70 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the template parameter in a template action.
CVSS v2.0: 7.5
GHSA-vwcv-7hjf-vgcf: A Race condition vulnerability in unzip_file in admin/import/class-import-settings.php in the Yoast SEO (wordpress-seo) plugin before 9.2.0 for WordPress allows an SEO Manager to perform command execution on the Operating System via a ZIP import.
CVSS v3.0: 6.6
CVE-2022-1273: Import WP < 2.4.6 - Admin+ Arbitrary File Upload to RCE
The Import WP WordPress plugin before 2.4.6 does not validate the imported file in some cases, allowing high privilege users such as admin to upload arbitrary files (such as PHP), leading to RCE
CVSS v3.1: 7.2
CVSS v2.0: 6.5
CVE-2013-1145: Memory leak in Cisco IOS 12.2, 12.4, 15.0, and 15.1, when Zone-Based Policy Firewall SIP application layer gateway inspection is enabled, allows remote attackers to cause a denial of service (memory consumption or device reload) via malformed SIP messages, aka Bug ID CSCtl99174.
CVSS v2.0: 7.8
GHSA-pfx2-hm33-3j69: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the print method. By performing actions in JavaScript, an attacker can trigger a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-6032.
CVSS v3.0: 8.8
RHSA-2021:0472: Red Hat Security Advisory: .NET Core 3.1 on Red Hat Enterprise Linux security and bugfix update
dotnet: certificate chain building recursion Denial of Service
CVSS v3.1: 6.5
GHSA-42p4-5wp9-wj4j: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Wilmër wilmer allows PHP Local File Inclusion.This issue affects Wilmër: from n/a through < 3.5.
CVSS v3.1: 9.8