ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-rvc3-4jrj-mxxp: In wlan service, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07453549; Issue ID: ALPS07453549.
CVSS v3.1: 4.4
RHSA-2020:1520: Red Hat Security Advisory: Red Hat JBoss Web Server 5.3 release
tomcat: local privilege escalation tomcat: Session fixation when using FORM authentication tomcat: Regression in handling of Transfer-Encoding header allows for HTTP request smuggling tomcat: Mishandling of Transfer-Encoding header allows for HTTP request smuggling tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability
CVSS v3.1: 7.6
RHSA-2023:2161: Red Hat Security Advisory: fence-agents security and bug fix update
python-oauthlib: DoS when attacker provides malicious IPV6 URI
CVSS v3.1: 6.5
GHSA-84r8-h488-8mwc: In the Linux kernel, the following vulnerability has been resolved:spi: qup: Don't skip cleanup in remove's error pathReturning early in a platform driver's remove callback is wrong. In this
case the dma resources are not released in the error path. this is never
retried later and so this is a permanent leak. To fix this, only skip
hardware disabling if waking the device fails.
CVSS v3.1: 5.5
CVE-2024-53816: WordPress Tutor LMS Elementor Addons plugin <= 2.1.5 - Broken Access Control vulnerability
Missing Authorization vulnerability in Themeum Tutor LMS Elementor Addons tutor-lms-elementor-addons.This issue affects Tutor LMS Elementor Addons: from n/a through <= 2.1.5.
CVSS v3.1: 4.3
GHSA-7x83-244x-q653: A CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists that
could cause the user to be tricked into performing unintended actions when external address
frames are not properly restricted.Affected Products: NetBotz 4 - 355/450/455/550/570 (V4.7.0and prior)
CVSS v3.1: 6.5
GHSA-5qfv-m3qx-54v6: Stack-based buffer overflow in Yokogawa CENTUM CS 1000 R3.08.70 and earlier, CENTUM CS 3000 R3.09.50 and earlier, CENTUM CS 3000 Entry R3.09.50 and earlier, CENTUM VP R5.04.20 and earlier, CENTUM VP Entry R5.04.20 and earlier, ProSafe-RS R3.02.10 and earlier, Exaopc R3.72.00 and earlier, Exaquantum R2.85.00 and earlier, Exaquantum/Batch R2.50.30 and earlier, Exapilot R3.96.10 and earlier, Exaplog R3.40.00 and earlier, Exasmoc R4.03.20 and earlier, Exarqe R4.03.20 and earlier, Field Wireless Device OPC Server R2.01.02 and earlier, PRM R3.12.00 and earlier, STARDOM VDS R7.30.01 and earlier, STARDOM OPC Server for Windows R3.40 and earlier, FAST/TOOLS R10.01 and earlier, B/M9000CS R5.05.01 and earlier, B/M9000 VP R7.03.04 and earlier, and FieldMate R1.01 or R1.02 allows remote attackers to cause a denial of service (process outage) via a crafted packet.
GHSA-v4pj-8r82-6phx: In Dovecot before 2.3.10.1, a crafted SMTP/LMTP message triggers an unauthenticated use-after-free bug in submission-login, submission, or lmtp, and can lead to a crash under circumstances involving many newlines after a command.
GHSA-98hc-x583-4p47: Anviz CX2 Lite and CX7 are vulnerable to unauthenticated firmware uploads. This causes crafted 
archives to be accepted, enabling attackers to plant and execute code 
and obtain a reverse shell.
CVSS v3.1: 9.8
CVE-2002-1175: The getmxrecord function in Fetchmail 6.0.0 and earlier does not properly check the boundary of a particular malformed DNS packet from a malicious DNS server, which allows remote attackers to cause a denial of service (crash) when Fetchmail attempts to read data beyond the expected boundary.
CVSS v2.0: 5
GHSA-rfq2-gv2r-vgjg: RIOT OS versions up to and including 2026.01-devel-317 contain a stack-based buffer overflow vulnerability in the ethos utility due to missing bounds checking when processing incoming serial frame data. The vulnerability occurs in the _handle_char() function, where incoming frame bytes are appended to a fixed-size stack buffer without verifying that the current write index remains within bounds. An attacker capable of sending crafted serial or TCP-framed input can cause the current write index to exceed the buffer size, resulting in a write past the end of the stack buffer. This condition leads to memory corruption and application crash.
CVSS v4.0: 6.8
CVSS v3.1: 9.8
CVE-2025-50983: SQL Injection vulnerability exists in the sortKey parameter of the GET /api/v1/wanted/cutoff API endpoint in readarr 0.4.15.2787. The endpoint fails to properly sanitize user-supplied input, allowing attackers to inject and execute arbitrary SQL commands against the backend SQLite database. Sqlmap confirmed exploitation via stacked queries, demonstrating that the parameter can be abused to run arbitrary SQL statements. A heavy query was executed using SQLite's RANDOMBLOB() and HEX() functions to simulate a time-based payload, indicating deep control over database interactions.
CVSS v3.1: 8.3
GHSA-7224-w4v6-8r9w: Adobe InDesign versions ID18.3 (and earlier) and ID17.4.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 5.5
GHSA-m9c4-g8c9-pfxc: CLTPHP <=6.0 is vulnerable to Directory Traversal.
CVSS v3.1: 6.5
CVE-2019-5893: Nelson Open Source ERP v6.3.1 allows SQL Injection via the db/utils/query/data.xml query parameter.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
GHSA-rrv6-2rwj-j9fw: Piwik 1.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by plugins/Widgetize/Widgetize.php and certain other files.
CVE-2025-49826: Next.js DoS vulnerability via cache poisoning
Next.js is a React framework for building full-stack web applications. From versions 15.0.4-canary.51 to before 15.1.8, a cache poisoning bug leading to a Denial of Service (DoS) condition was found in Next.js. This issue does not impact customers hosted on Vercel. Under certain conditions, this issue may allow a HTTP 204 response to be cached for static pages, leading to the 204 response being served to all users attempting to access the page. This issue has been addressed in version 15.1.8.
CVSS v3.1: 7.5
CVE-2023-48379: Softnext Mail SQR Expert - Blind Server-Side Request Forgey (SSRF)
Softnext Mail SQR Expert is an email management platform, it has inadequate filtering for a specific URL parameter within a specific function. An unauthenticated remote attacker can perform Blind SSRF attack to discover internal network topology base on URL error response.
CVSS v3.1: 5.3
GHSA-gvrm-gvc6-p3g4: The WP Filter & Combine RSS Feeds plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the post_listing_page() function in all versions up to, and including, 0.4. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete feeds.
CVSS v3.1: 4.3
GHSA-8rcc-ggf9-rq92: A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v1.0 for Windows could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The PIA client is vulnerable to a DLL injection vulnerability during the software update process. The updater loads several libraries from a folder that authenticated users have write access to. A low privileged user can leverage this vulnerability to execute arbitrary code as SYSTEM.
CVSS v3.0: 7.8
CVE-2025-49153: Path Traversal in MICROSENS NMP Web+
The affected products could allow an unauthenticated attacker to overwrite files and execute arbitrary code.
CVSS v4.0: 9.3
CVE-2007-2227: The MHTML protocol handler in Microsoft Outlook Express 6 and Windows Mail in Windows Vista does not properly handle Content-Disposition "notifications," which allows remote attackers to obtain sensitive information from other Internet Explorer domains, aka "Content Disposition Parsing Cross Domain Information Disclosure Vulnerability."
CVSS v2.0: 4.3
CVE-2021-43182: In JetBrains Hub before 2021.1.13415, a DoS via user information is possible.
CVSS v3.1: 7.5
CVSS v2.0: 5
GHSA-vmgr-pj64-hmwj: Stack-based buffer overflow in ext/phar/tar.c in PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted TAR archive.
CVSS v3.0: 9.8
CVE-2004-0104: Multiple format string vulnerabilities in Metamail 2.7 and earlier allow remote attackers to execute arbitrary code.
CVSS v2.0: 7.5
CVE-2025-38212: ipc: fix to protect IPCS lookups using RCU
In the Linux kernel, the following vulnerability has been resolved:

ipc: fix to protect IPCS lookups using RCU

syzbot reported that it discovered a use-after-free vulnerability, [0]

[0]: https://lore.kernel.org/all/67af13f8.050a0220.21dd3.0038.GAE@google.com/

idr_for_each() is protected by rwsem, but this is not enough.  If it is
not protected by RCU read-critical region, when idr_for_each() calls
radix_tree_node_free() through call_rcu() to free the radix_tree_node
structure, the node will be freed immediately, and when reading the next
node in radix_tree_for_each_slot(), the already freed memory may be read.

Therefore, we need to add code to make sure that idr_for_each() is
protected within the RCU read-critical region when we call it in
shm_destroy_orphaned().
CVSS v3.1: 7.8
RHSA-2026:6621: Red Hat Security Advisory: crun security update
crun: crun: Privilege escalation due to incorrect parsing of the `--user` option
CVSS v3.1: 7.8
CVE-2025-54634: Vulnerability of improper processing of abnormal conditions in huge page separation.
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS v3.1: 8
CVE-2017-0026: The kernel-mode drivers in Microsoft Windows 10 Gold, 1511, and 1607 and Windows Server 2016 allow local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability." This vulnerability is different from those described in CVE-2017-0024, CVE-2017-0056, CVE-2017-0078, CVE-2017-0079, CVE-2017-0080, CVE-2017-0081, and CVE-2017-0082.
CVSS v3.0: 7.8
CVSS v2.0: 7.2
CVE-2019-5243: There is a Clickjacking vulnerability in Huawei HG255s product. An attacker may trick user to click a link and affect the integrity of a device by exploiting this vulnerability.
CVSS v3.0: 4.3
CVSS v2.0: 4.3
CVE-2015-4485: Heap-based buffer overflow in the resize_context_buffers function in libvpx in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code via malformed WebM video data.
CVSS v2.0: 10
GHSA-324q-xqr3-9238: In the Linux kernel, the following vulnerability has been resolved:drm/bridge: anx7625: Fix overflow issue on reading EDIDThe length of EDID block can be longer than 256 bytes, so we should use
`int` instead of `u8` for the `edid_pos` variable.
CVSS v3.1: 5.5
GHSA-4c2w-wcw4-8jv9: Jenkins Rundeck Plugin CSRF vulnerability
Jenkins Rundeck Plugin does not perform permission checks on a method implementing form validation. This allows users with Overall/Read access to Jenkins to initiate a connection test to an attacker-specified server with attacker-specified username and password.Additionally, the form validation method does not require POST requests, resulting in a CSRF vulnerability.
CVSS v3.0: 4.3
GHSA-7g7j-3m53-cvx2: Apple iOS before 9 allows attackers to discover the e-mail address of a player via a crafted Game Center app.
GHSA-rchg-6562-67qr: Substance3D - Designer versions 15.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 7.8
CVE-2020-8808: The CorsairLLAccess64.sys and CorsairLLAccess32.sys drivers in CORSAIR iCUE before 3.25.60 allow local non-privileged users (including low-integrity level processes) to read and write to arbitrary physical memory locations, and consequently gain NT AUTHORITY\SYSTEM privileges, via a function call such as MmMapIoSpace.
CVSS v3.1: 7.8
CVSS v2.0: 7.2
CVE-2024-37825: An issue in EnvisionWare Computer Access & Reservation Control SelfCheck v1.0 (fixed in OneStop 3.2.0.27184 Hotfix May 2024) allows unauthenticated attackers on the same network to perform a directory traversal.
CVSS v3.1: 5.4
GHSA-2249-qr5p-5wfx: Unspecified vulnerability in Oracle Database Server 9.2.0.7, Application Server 9.0.4.2 and 10.1.2.1, Collaboration Suite Release 2, version 9.0.4.2 (Oracle9i), and E-Business Suite and Applications 11.5.10 has unspecified impact and attack vectors, as identified by Oracle Vuln# WF01 in the Oracle Workflow Cartridge component.
CVE-2023-40609: WordPress Contact form 7 Custom validation Plugin <= 1.1.3 is vulnerable to SQL Injection
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aiyaz, maheshpatel Contact form 7 Custom validation allows SQL Injection.This issue affects Contact form 7 Custom validation: from n/a through 1.1.3.
CVSS v3.1: 8.2
GHSA-v9r3-mcxc-m58r: A vulnerability was detected in cdevroe unmark up to 1.9.3. This affects an unknown part of the file /application/controllers/Marks.php. The manipulation of the argument url results in server-side request forgery. The attack may be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 2.1
CVSS v3.1: 6.3
GHSA-8gpv-c454-3hfc: Alkacon OpenCms is vulnerable to XSS via cmis-online/type
A Cross Site Scripting vulnerability in Alkacon OpenCms before 10.5.1 exists via cmis-online/type.
CVSS v3.1: 6.1
GHSA-q2qw-7ccw-vchv: autoload/netrw.vim (aka the Netrw Plugin) 109, 131, and other versions before 133k for Vim 7.1.266, other 7.1 versions, and 7.2 stores credentials for an FTP session, and sends those credentials when attempting to establish subsequent FTP sessions to servers on different hosts, which allows remote FTP servers to obtain sensitive information in opportunistic circumstances by logging usernames and passwords.  NOTE: the upstream vendor disputes a vector involving different ports on the same host, stating "I'm assuming that they're using the same id and password on that unchanged hostname, deliberately."
CVE-2026-43655: An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. An app may be able to cause unexpected system termination or read kernel memory.
CVSS v3.1: 7.3
CVE-2026-26029: sf-mcp-server has a Command Injection in query_records tool due to unsafe use of child_process.exec
sf-mcp-server is an implementation of Salesforce MCP server for Claude for Desktop. A command injection vulnerability exists in sf-mcp-server due to unsafe use of child_process.exec when constructing Salesforce CLI commands with user-controlled input. Successful exploitation allows attackers to execute arbitrary shell commands with the privileges of the MCP server process.
CVSS v3.1: 7.5
CVE-2019-19047: A memory leak in the mlx5_fw_fatal_reporter_dump() function in drivers/net/ethernet/mellanox/mlx5/core/health.c in the Linux kernel before 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering mlx5_crdump_collect() failures, aka CID-c7ed6d0183d5.
CVSS v3.1: 5.5
CVSS v2.0: 4.9
GHSA-525v-9xr8-x3v9: A security feature bypass exists when Windows incorrectly validates kernel driver signatures, aka "Windows Security Feature Bypass Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-1035.
CVSS v3.0: 5.3
GHSA-jv87-v39g-62xp: Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acrobat Reader DC Continuous before 15.017.20050 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-4255.
CVSS v3.0: 9.8
GHSA-rw49-g9m4-rprv: QuickTime in Apple OS X before 10.11.6 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted FlashPix bitmap image, a different vulnerability than CVE-2016-4596, CVE-2016-4600, and CVE-2016-4602.
CVSS v3.0: 8.8
GHSA-2r72-fwfv-2p48: Azure Sphere Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2020-16981, CVE-2020-16989, CVE-2020-16992, CVE-2020-16993.
CVSS v3.1: 6.9
CVE-2021-3167: In Cloudera Data Engineering (CDE) 1.3.0, JWT authentication tokens are exposed to administrators in virtual cluster server logs.
CVSS v3.1: 6.5
CVSS v2.0: 4
GHSA-rvg4-6g78-c4gf: EMC RSA Authentication Manager before 8.2 SP1 P6 has a cross-site scripting vulnerability that could potentially be exploited by malicious users to compromise the affected system.
CVSS v3.0: 5.4
RHSA-2026:3966: Red Hat Security Advisory: kernel security update
kernel: Linux kernel io_uring: Local privilege escalation, information disclosure, or denial of service via use-after-free kernel: mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats kernel: macvlan: fix possible UAF in macvlan_forward_source()
CVSS v3.1: 7.8
CVE-2023-38461: In vowifiservice, there is a possible missing permission check.This could lead to local denial of service with no additional execution privileges
CVSS v3.1: 5.5
CVE-2006-5191: PHP remote file inclusion vulnerability in includes/functions_static_topics.php in the Nivisec Static Topics module for phpBB 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
CVSS v2.0: 5.1
GHSA-7v5c-fgmf-m9v8: The Asial Monaca Debugger application before 1.4.2 for Android allows remote attackers to obtain sensitive (1) account or (2) session ID information in a system log file via a crafted application.
CVE-2018-8401: An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX Graphics Kernel Elevation of Privilege Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8400, CVE-2018-8405, CVE-2018-8406.
CVSS v3.0: 7.8
CVSS v2.0: 7.2
GHSA-xj47-w234-57fj: Use of Hard-coded Cryptographic Key vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 24.09.06.Users are recommended to upgrade to version 24.09.06, which fixes the issue.
CVSS v3.1: 9.1
CVE-2014-8450: Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors, a different vulnerability than CVE-2015-4449, CVE-2015-4450, CVE-2015-5088, CVE-2015-5089, and CVE-2015-5092.
CVSS v2.0: 5
RHSA-2023:4079: Red Hat Security Advisory: firefox security update
Mozilla: Use-after-free in WebRTC certificate generation Mozilla: Potential use-after-free from compartment mismatch in SpiderMonkey Mozilla: Fullscreen notification obscured Mozilla: Lack of warning when opening Diagcab files Mozilla: Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13, and Thunderbird 102.13
CVSS v3.1: 8.8
GHSA-74hf-jfjp-cf88: The Fluent Forms plugin for WordPress is vulnerable to Arbitrary File Read in versions up to and including 6.2.1. This is due to insufficient path validation in the getAttachments() method of EmailNotificationActions, which resolves attacker-supplied file-upload URLs into filesystem paths without verifying that the resolved path stays inside the WordPress uploads directory: a strpos() prefix check on the raw URL can be bypassed with traversal sequences, wp_normalize_path() does not resolve ".\..\" segments, and file_exists() then resolves them at the kernel level. This makes it possible for authenticated attackers with administrator access to read arbitrary files readable by the web-server user — including wp-config.php with its database credentials and authentication salts — by submitting a form whose admin notification is configured to attach a file-upload field and supplying a crafted URL of the shape <upload_baseurl>/../../<target> as the file-field value. The resolved file is attached to the outbound admin-notification email via wp_mail(). While the email can be triggered by unauthenticated users, the email recipient is not user-controlled.
CVSS v3.1: 4.9
GHSA-crh6-pj8c-xrhc: Open WebUI Allows Arbitrary File Write via the `/models/upload` Endpoint
In open-webui version 0.3.8, the endpoint `/models/upload` is vulnerable to arbitrary file write due to improper handling of user-supplied filenames. The vulnerability arises from the usage of `file_path = f"{UPLOAD_DIR}/{file.filename}"` without proper input validation or sanitization. An attacker can exploit this by manipulating the `file.filename` parameter to include directory traversal sequences, causing the resulting `file_path` to escape the intended `UPLOAD_DIR` and potentially overwrite arbitrary files on the system. This can lead to unauthorized modifications of system binaries, configuration files, or sensitive data, potentially enabling remote command execution.
CVSS v3.0: 6.5
GHSA-hww9-gvfj-fjcw: Race condition in Lapce v0.2.8 allows an attacker to elevate privileges on the system
CVSS v3.1: 7.3
GHSA-945j-48p3-f37w: tcpdump before 3.8.1 allows remote attackers to cause a denial of service (infinite loop) via certain ISAKMP packets, a different vulnerability than CVE-2004-0057.
CVE-2011-4800: Directory traversal vulnerability in Serv-U FTP Server before 11.1.0.5 allows remote authenticated users to read and write arbitrary files, and list and create arbitrary directories, via a "..:/" (dot dot colon forward slash) in the (1) list, (2) put, or (3) get commands.
CVSS v2.0: 9