ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-ggwq-rh53-chpg: Sensitive information accessible by physical probing of JTAG interface for some Intel(R) Processors with SGX may allow an unprivileged user to potentially enable information disclosure via physical access.
CVSS v3.1: 2.4
CVE-2018-10904: It was found that glusterfs server does not properly sanitize file paths in the "trusted.io-stats-dump" extended attribute which is used by the "debug/io-stats" translator. Attacker can use this flaw to create files and execute arbitrary code. To exploit this attacker would require sufficient access to modify the extended attributes of files on a gluster volume.
CVSS v3.0: 8.8
GHSA-25jr-qm4x-mvhx: In Dovecot before 2.3.11.3, sending a specially formatted NTLM request will crash the auth service because of an out-of-bounds read.
CVSS v3.1: 7.5
GHSA-rcc4-42qj-g2jr: An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with unvalidated length at nfs_readlink_reply in the "else" block after calculating the new path length.
CVSS v3.0: 9.8
CVE-2024-27292: Docassemble unauthorized access through URL manipulation
Docassemble is an expert system for guided interviews and document assembly. The vulnerability allows attackers to gain unauthorized access to information on the system through URL manipulation. It affects versions 1.4.53 to 1.4.96. The vulnerability has been patched in version 1.4.97 of the master branch.
CVSS v3.1: 7.5
GHSA-6878-6wc2-pf5h: Sequential calls of encryption API (`encrypt`, `wrap`, and `dump`) result in nonce reuse
**Problem**: Trying to create a new encrypted message with the same cocoon object generates the same ciphertext. It mostly affects `MiniCocoon` and `Cocoon` objects with custom seeds and RNGs (where `StdRng` is used under the hood).**Note**: The issue does **NOT** affect objects created with **`Cocoon::new`** which utilizes `ThreadRng`.**Cause**: `StdRng` produces the same nonce because `StdRng::clone` resets its state.**Measure**: Make encryption API mutable (`encrypt`, `wrap`, and `dump`).**Workaround**: Create a new cocoon object with a new **seed** per each encryption.How to ReproduceWorkaroundFor `cocoon <= 0.3.3`, create a new cocoon with a different **seed** per each `encrypt`/`wrap`/`dump` call.
CVSS v3.1: 4.5
GHSA-hqvh-84g9-cp75: Unspecified vulnerability in the SIP server in SIP Enablement Services (SES) in Avaya Communication Manager 3.1.x and 4.x allows remote authenticated users to cause a denial of service (resource consumption) via unknown vectors.
CVE-2024-4002: Carousel, Slider, Gallery by WP Carousel < 2.6.9 - Editor+ Stored XSS
The Carousel, Slider, Gallery by WP Carousel  WordPress plugin before 2.6.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS v3.1: 3.5
GHSA-5c8f-8f5q-mw49: The Samsung printer firmware before 20121031 has a hardcoded read-write SNMP community, which makes it easier for remote attackers to obtain administrative access via an SNMP request.
GHSA-h5wg-wcrq-7mp8: hw/rdma/vmw/pvrdma_main.c in QEMU does not implement a read operation (such as uar_read by analogy to uar_write), which allows attackers to cause a denial of service (NULL pointer dereference).
CVSS v3.1: 7.5
GHSA-v3xx-rxcf-rp8q: atmfd.dll in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows remote attackers to obtain sensitive information from process memory via a crafted Open Type font on a web site, aka "Open Type Font Information Disclosure Vulnerability."
CVSS v3.0: 6.5
GHSA-rcrv-228c-gprj: Invalid URL generation in bitlyshortener
ImpactDue to a sudden upstream breaking change by Bitly, versions of `bitlyshortener` <0.6.0 generate invalid short URLs. All users are affected and must update immediately.PatchesUpgrading `bitlyshortener` to 0.6.0 or newer will prevent the generation such invalid short URLs.WorkaroundsA workaround is to replace "https://j.mp/" in each generated short URL with "https://bit.ly/".References[Release notes](https://github.com/impredicative/bitlyshortener/releases)
GHSA-475h-mvc3-86vc: Cross-site scripting (XSS) vulnerability in index.php in the Search module for Php-Nuke allows remote attackers to inject arbitrary script as other users via the input field.
PYSEC-2023-76: Vyper is a pythonic smart contract language for the EVM. The storage allocator does not guard against allocation overflows in versions prior to 0.3.8. An attacker can overwrite the owner variable. This issue was fixed in version 0.3.8.
GHSA-3xj4-fw84-qhvx: An SQL Injection vulnerabilty exists in the oretnom23 Pharmacy Point of Sale System 1.0 in the login function in actions.php.
CVE-2024-30182: WordPress HT Mega – Absolute Addons For Elementor plugin <= 2.4.3 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DevItems HT Mega ht-mega-for-elementor.This issue affects HT Mega: from n/a through <= 2.4.3.
CVSS v3.1: 6.5
CVE-2024-20896: Use of implicit intent for sensitive communication in Configuration message prior to SMR Jul-2024 Release 1 allows local attackers to get sensitive information.
CVSS v3.1: 5.5
CVE-2026-0405: Authentication Bypass in NETGEAR Orbi Devices
An authentication bypass vulnerability in NETGEAR Orbi devices allows 
users connected to the local network to access the router web interface 
as an admin.
CVSS v4.0: 6.1
GHSA-r8m8-j8rp-h564: A spoofing vulnerability exists when Microsoft Edge improperly handles specific HTML content, aka "Microsoft Edge Spoofing Vulnerability." This affects Microsoft Edge.
CVSS v3.0: 4.3
GHSA-hwr4-f3g6-5mmp: IceCMS v3.4.7 and before was discovered to contain a hardcoded JWT key, allowing an attacker to forge JWT authentication information.
CVSS v3.1: 9.8
GHSA-84pg-r97c-2cx7: Buffer overflow in WLAN NAN function due to lack of check of count value received in NAN availability attribute in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in IPQ8074, MSM8996AU, QCA6174A, QCA6574AU, QCA8081, QCA9377, QCA9379, QCS404, QCS405, QCS605, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM630, SDM660, SXR1130
CVSS v3.1: 9.8
GHSA-xr38-33h6-9m6r: In filters/reframe_latm.c in GPAC 1.0.1 there is a Null Pointer Dereference, when gf_filter_pck_get_data is called. The first arg pck may be null with a crafted mp4 file,which results in a crash.
GHSA-w29j-8phw-ffjf: Moodle has a time restriction bypass
An issue in Moodle's timed assignment feature allowed students to bypass the time restriction, potentially giving them more time than allowed to complete an assessment.
CVSS v3.1: 5.4
GHSA-8768-4fq8-2xfv: Macromedia Shockwave Flash plugin version 8 and earlier allows remote attackers to cause a denial of service via malformed tag length specifiers in a SWF file.
GHSA-p6qx-ghxm-389h: OctoPrint has XSS in its Suppressed Command Notifications
ImpactOctoPrint versions up to and including 1.11.7 as well as 2.0.0rc1 and 2.0.0rc2 are affected by a vulnerability that allows injection of arbitrary HTML and JavaScript into Suppressed Command notifications popups generated by the printer.An attacker who successfully convinces a victim to print a specially crafted file could exploit this issue to disrupt ongoing prints, extract information (including sensitive configuration settings, if the targeted user has the necessary permissions for that), or perform other actions on behalf of the targeted user within the OctoPrint instance.PatchesThe vulnerability has been patched in version 1.11.8 and 2.0.0rc3.WorkaroundOctoPrint administrators can mitigate the risk by disabling popups:for Action Command notifications, set _OctoPrint Settings -> Serial Connection -> Behaviour -> Sanity Checking -> Display notifications for suppressed commands_ to _Never show notifications_It is also strongly recommended to ensure that files being printed originate from trusted sources, and, whenever possible, are sliced with an application's own slicer.CreditsThis vulnerability was discovered and responsibly disclosed to OctoPrint by [Jacopo Tediosi](https://github.com/jacopotediosi).Timeline2026-03-18: Report received
2026-04-01: Report verified
2026-04-01: Fix ready for 2.0.0
2026-06-22: Fix backported to 1.11.x
2026-06-23: Fix released with 1.11.8 and 2.0.0rc3
CVSS v4.0: 4.6
GHSA-hqvg-7vm6-9j8v: Cross Site Scripting vulnerability in ZenTaoPMS v.18.6 allows a local attacker to obtain sensitive information via a crafted script.
CVSS v3.1: 5.4
RHSA-2024:8802: Red Hat Security Advisory: openexr security update
OpenEXR: Heap Overflow in Scanline Deep Data Parsing
CVSS v3.1: 9.1
GHSA-hcwc-2gm5-v9g6: A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. The profile activity page was not restricting the amount of results one could request, potentially resulting in a denial of service.
CVE-2025-7230: INVT VT-Designer PM3 File Parsing Type Confusion Remote Code Execution Vulnerability
INVT VT-Designer PM3 File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of INVT VT-Designer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PM3 files. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25723.
CVSS v3.0: 7.8
GHSA-c5jg-79fj-f9xf: A vulnerability has been identified in Solid Edge (All versions < V224.0 Update 2). The affected applications contain a stack overflow vulnerability while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
CVSS v3.1: 7.8
CVE-2024-43604: Outlook for Android Elevation of Privilege Vulnerability
Outlook for Android Elevation of Privilege Vulnerability
CVSS v3.1: 5.7
GHSA-5j6j-9vjj-6r3v: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ApusTheme Butcher allows Reflected XSS. This issue affects Butcher: from n/a through 2.40.
CVSS v3.1: 7.1
CVE-2015-5315: The eap_pwd_process function in eap_peer/eap_pwd.c in wpa_supplicant 2.x before 2.6 does not validate that the reassembly buffer is large enough for the final fragment when EAP-pwd is enabled in a network configuration profile, which allows remote attackers to cause a denial of service (process termination) via a large final fragment in an EAP-pwd message.
CVSS v3.0: 5.9
CVSS v2.0: 4.3
GHSA-prxr-vjgc-2cq9: Concrete CMS is Vulnerable to Cross-Site Request Forgery
Concrete CMS 9.5.0 and below emits a CSRF token in the local_available_update.php view ($token->output('do_update')) but the corresponding do_update() method in concrete/controllers/single_page/dashboard/system/update/update.php never calls $this->token->validate('do_update'). The form is rendered as a POST form, meaning the token reaches the browser, but because the controller discards it without verification, an attacker can craft a cross-site POST that triggers a core CMS update to an attacker-specified version string.  In order to be vulnerable, theictim must be passing canUpgrade()anda valid update version must be present under DIR_CORE_UPDATES.
CVSS v4.0: 7.5
GHSA-42vv-qrvv-www9: Foxit PDF Reader Annotation Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the handling of Annotation objects. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24135.
CVSS v3.0: 3.3
CVE-2021-31840: DLL preload vulnerability in McAfee Agent for Windows
A vulnerability in the preloading mechanism of specific dynamic link libraries in McAfee Agent for Windows prior to 5.7.3 could allow an authenticated, local attacker to perform a DLL preloading attack with unsigned DLLs. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system. This would result in the user gaining elevated permissions and being able to execute arbitrary code.
CVSS v3.1: 7.3
CVE-2026-25711: Chargemap chargemap.com Insufficient Session Expiration
The WebSocket backend uses charging station identifiers to uniquely 
associate sessions but allows multiple endpoints to connect using the 
same session identifier. This implementation results in predictable 
session identifiers and enables session hijacking or shadowing, where 
the most recent connection displaces the legitimate charging station and
 receives backend commands intended for that station. This vulnerability
 may allow unauthorized users to authenticate as other users or enable a
 malicious actor to cause a denial-of-service condition by overwhelming 
the backend with valid session requests.
CVSS v4.0: 6.9
CVSS v3.1: 7.3
GHSA-5vqg-gqhg-cw89: The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to missing authorization to unauthorized data modification and deletion due to a missing capability check on the 'delete_object' function in all versions up to, and including, 3.28.25. This makes it possible for unauthenticated attackers to delete arbitrary posts, pages, products, taxonomy terms, and user accounts.
CVSS v3.1: 9.1
CVE-2018-13779: The mintToken function of a smart contract implementation for YLCToken, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS v3.0: 7.5
CVSS v2.0: 5
GHSA-fg66-pm82-5944: The Happy Addons for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.21.0 via the `ha_duplicate_thing` admin action handler. This is due to the `can_clone()` method only checking `current_user_can('edit_posts')` (a general capability) without performing object-level authorization such as `current_user_can('edit_post', $post_id)`, and the nonce being tied to the generic action name `ha_duplicate_thing` rather than to a specific post ID. This makes it possible for authenticated attackers, with Contributor-level access and above, to clone any published post, page, or custom post type by obtaining a valid clone nonce from their own posts and changing the `post_id` parameter to target other users' content. The clone operation copies the full post content, all post metadata (including potentially sensitive widget configurations and API tokens), and taxonomies into a new draft owned by the attacker.
CVSS v3.1: 5.4
GHSA-pf2v-q93p-8954: Veritas NetBackup 7.0 contains an unquoted service path vulnerability in the NetBackup INET Daemon service that allows local users to potentially execute arbitrary code. Attackers can exploit the unquoted path in C:\Program Files\Veritas\NetBackup\bin\bpinetd.exe to inject malicious code that would execute with elevated LocalSystem privileges.
CVSS v4.0: 8.5
CVSS v3.1: 7.8
GHSA-g84x-mcqj-x9qq: AIOHTTP vulnerable to DoS through chunked messages
SummaryHandling of chunked messages can result in excessive blocking CPU usage when receiving a large number of chunks.ImpactIf an application makes use of the `request.read()` method in an endpoint, it may be possible for an attacker to cause the server to spend a moderate amount of blocking CPU time (e.g. 1 second) while processing the request. This could potentially lead to DoS as the server would be unable to handle other requests during that time.Patch: https://github.com/aio-libs/aiohttp/commit/dc3170b56904bdf814228fae70a5501a42a6c712
Patch: https://github.com/aio-libs/aiohttp/commit/4ed97a4e46eaf61bd0f05063245f613469700229
CVSS v4.0: 6.6
GHSA-h754-2839-mqvq: Stack-based buffer overflow vulnerability in the 'conn-indicator' binary running as root on the TP-Link Archer AX50 router, in firmware versions prior to 1.0.15 build 241203 rel61480. This vulnerability allows an attacker to execute arbitrary code on the device over LAN and WAN networks.
CVSS v4.0: 9.2
CVE-2016-10686: fis-sass-all is another libsass wrapper for node. fis-sass-all downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
CVSS v3.0: 8.1
CVSS v2.0: 9.3
CVE-2026-46362: phpMyFAQ - Authorization Bypass in Admin Pages via Non-Terminating Permission Check
phpMyFAQ before 4.1.2 contains an authorization bypass vulnerability in AbstractAdministrationController::userHasPermission() that fails to terminate execution after sending a forbidden response. Attackers can access all permission-protected admin pages by requesting their URLs as authenticated users, exposing admin logs, user data, system information, and application configuration.
CVSS v4.0: 7.1
CVSS v3.1: 6.5
CVE-2019-15800: An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. Due to lack of input validation in the cmd_sys_traceroute_exec(), cmd_sys_arp_clear(), and cmd_sys_ping_exec() functions in the libclicmd.so library contained in the firmware, an attacker could leverage these functions to call system() and execute arbitrary commands on the switches. (Note that these functions are currently not called in this version of the firmware, however an attacker could use other vulnerabilities to finally use these vulnerabilities to gain code execution.)
CVSS v3.1: 9.8
CVSS v2.0: 10
GHSA-8gpq-43rv-vcwq: A reflected cross site scripting (XSS) vulnerability was discovered on Samsung sww-3400rw Router devices via the m2 parameter of the sess-bin/command.cgi
CVSS v3.1: 6.1
GHSA-8p8v-wh79-9r56: Django vulnerable to Uncontrolled Resource Consumption
An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29.`URLField.to_python()` in Django calls `urllib.parse.urlsplit()`, which performs NFKC normalization on Windows that is disproportionately slow for certain Unicode characters, allowing a remote attacker to cause denial of service via large URL inputs containing these characters.Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Seokchan Yoon for reporting this issue.
CVSS v3.1: 7.5
GHSA-4xwm-8vcx-7p9c: An issue in dlink DIR 832x 240802 allows a remote attacker to execute arbitrary code via the macaddr key value to the function 0x42232c
CVSS v3.1: 9.8
GHSA-mvv3-rqf3-rc36: Unspecified vulnerability in Microsoft Excel 2000 SP3 through 2007, Viewer 2003, Compatibility Pack, and Office for Mac 2004 allows user-assisted remote attackers to execute arbitrary code via malformed formulas, aka "Excel Formula Parsing Vulnerability."
GHSA-3fp4-v27w-gh48: In ged, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07202966; Issue ID: ALPS07202966.
CVSS v3.1: 6.7
GHSA-939v-xh4g-2mvp: An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the "HelpViewer" component. A cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML by bypassing the Same Origin Policy for quarantined HTML documents.
CVSS v3.0: 6.1
GHSA-frgj-3j56-7q4c: Format Plugins versions 1.1.1 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 5.5
CVE-2020-28618: Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_vertex() vh->shalfloop().
CVSS v3.0: 10
CVE-2024-26044: Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
Adobe Experience Manager versions 6.5.19 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into a webpage. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable script. This could result in arbitrary code execution in the context of the victim's browser.
CVSS v3.1: 5.4
RHEA-2019:2270: Red Hat Enhancement Advisory: openjpeg2 bug fix and enhancement update
openjpeg2: Excessive iteration in openjp2/t1.c:opj_t1_encode_cblks can allow for denial of service via crafted BMP file
CVSS v3.0: 3.3
GHSA-68qr-46rm-f7wh: The freelinking module for Drupal, as used in the Freelinking for Case Tracker module, does not properly check access permissions for (1) nodes or (2) users, which allows remote attackers to obtain sensitive information via a crafted link.
GHSA-2v4f-h7wf-hprx: Missing Authorization vulnerability in WPEngine Inc. Advanced Custom Fields PRO allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Custom Fields PRO: from n/a through 6.3.1.
CVSS v3.1: 5.4
GHSA-7g2j-wp9p-8rcr: The tun_chr_poll function in drivers/net/tun.c in the tun subsystem in the Linux kernel 2.6.30 and 2.6.30.1, when the -fno-delete-null-pointer-checks gcc option is omitted, allows local users to gain privileges via vectors involving a NULL pointer dereference and an mmap of /dev/net/tun, a different vulnerability than CVE-2009-1894.
GHSA-964v-w3xw-28j6: An issue was discovered in drivers/iio/dac/ad5755.c in the Linux kernel before 4.8.6. There is an out of bounds write in the function ad5755_parse_dt.
CVSS v3.0: 7.8
GHSA-968g-c3p8-6hvf: Exim before 4.96 has an invalid free in pam_converse in auths/call_pam.c because store_free is not used after store_malloc.
CVSS v3.1: 7.5
GHSA-5f6v-fgcw-j5px: The dl module in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not check "taintness" of inputs, which allows context-dependent attackers to bypass safe levels and execute dangerous functions by accessing a library using DL.dlopen.