ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2025-45156: Splashin iOS v2.0 fails to enforce server-side interval restrictions for location updates for free-tier users.
CVSS v3.1: 5.3
GHSA-m265-hw72-834q: In Wireshark 2.6.0 to 2.6.3, the CoAP dissector could crash. This was addressed in epan/dissectors/packet-coap.c by ensuring that the piv length is correctly computed.
CVSS v3.1: 7.5
GHSA-cpwq-wfh7-jf75: Use after free in V8 in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium security severity: Medium)
CVSS v3.1: 8.8
GHSA-f474-2mpq-x44c: Directory traversal vulnerability in Monkey HTTP Daemon 0.1.4 allows remote attackers to read arbitrary files via .. (dot dot) sequences.
CVE-2023-29177: Multiple buffer copy without checking size of input ('classic buffer overflow') vulnerabilities [CWE-120] in FortiADC version 7.2.0 and before 7.1.2 & FortiDDoS-F version 6.5.0 and before 6.4.1 allows a privileged attacker to execute arbitrary code or commands via specifically crafted CLI requests.
CVSS v3.1: 6.2
CVE-2025-5993: Path Traversal in ITCube CRM
ITCube CRM in versions from 2023.2 through 2025.2 is vulnerable to path traversal. Unauthenticated remote attacker is able to exploit vulnerable parameter fileName and construct payloads that allow to download any file accessible by the the web server process.
CVSS v4.0: 9.2
CVE-2021-41950: A directory traversal issue in ResourceSpace 9.6 before 9.6 rev 18277 allows remote unauthenticated attackers to delete arbitrary files on the ResourceSpace server via the provider and variant parameters in pages/ajax/tiles.php. Attackers can delete configuration or source code files, causing the application to become unavailable to all users.
CVSS v3.1: 9.1
CVSS v2.0: 6.4
GHSA-cqmh-x8qq-7fj3: The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
CVSS v3.1: 6.8
GHSA-9vmc-82xw-66jf: Multiple unspecified vulnerabilities in the Email Server component in Oracle Collaboration Suite 9.0.4.2, 10.1.1, 10.1.2.0, and 10.1.2.1 have unknown impact and attack vectors, aka Vuln# (1) OCS01, (2) OCS02, (3) OCS03, and (4) OCS04.
GHSA-wr3m-ccvr-j929: Microsoft Internet Explorer 7 allows remote attackers to cause a denial of service (browser hang) via JavaScript that matches a regular expression against a long string, as demonstrated using /(.)*/.
GHSA-p8hj-ppgc-2ffw: Use after free in Extensions in Google Chrome prior to 99.0.4844.74 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.
CVSS v3.1: 8.8
GHSA-2fmj-pq77-gvj7: The WP-Optimize WordPress plugin before 3.2.13, SrbTransLatin WordPress plugin through 2.4 use a third-party library that removes the escaping on some HTML characters, leading to a Cross-Site Scripting vulnerability.
CVSS v3.1: 6.1
CVE-2009-2002: Unspecified vulnerability in the WebLogic Portal component in BEA Product Suite 8.1.6, 9.2.3, 10.0.1, 10.2.1, and 10.3.1.0.0 allows remote attackers to affect integrity via unknown vectors.
CVSS v2.0: 4.3
GHSA-78pr-m5p7-52qj: Data Validation / Data Sanitization  vulnerabilities in Linux allows unvalidated and unsanitized data to be injected in an Aspect device. 
Affected products:ABB ASPECT - Enterprise v3.08.02; 
NEXUS Series v3.08.02; 
MATRIX Series v3.08.02
CVSS v4.0: 9.3
CVSS v3.1: 10
CVE-2025-49992: WordPress LearnPress Export Import plugin <= 4.0.9 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress LearnPress Export Import learnpress-import-export allows Reflected XSS.This issue affects LearnPress Export Import: from n/a through <= 4.0.9.
CVSS v3.1: 7.1
CVE-2017-6033: A DLL Hijacking issue was discovered in Schneider Electric Interactive Graphical SCADA System (IGSS) Software, Version 12 and previous versions. The software will execute a malicious file if it is named the same as a legitimate file and placed in a location that is earlier in the search path.
CVSS v3.0: 7.8
CVSS v2.0: 6.8
CVE-2015-8763: The EAP-PWD module in FreeRADIUS 3.0 through 3.0.8 allows remote attackers to have unspecified impact via a crafted (1) commit or (2) confirm message, which triggers an out-of-bounds read.
CVSS v3.0: 8.1
CVSS v2.0: 6.8
RHSA-2022:1820: Red Hat Security Advisory: udisks2 security and bug fix update
udisks2: insecure defaults in user-accessible mount helpers allow for a DoS
CVSS v3.1: 4.5
CVE-2026-5284: Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
CVSS v3.1: 7.5
CVE-2024-0853: OCSP verification bypass with TLS session reuse
curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (*OCSP stapling*) test failed. A subsequent transfer to
the same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check.
CVSS v3.1: 5.3
CVE-2019-13539: Medtronic Valleylab FT10 and FX8 Reversible One-way Hash
Medtronic Valleylab Exchange Client version 3.4 and below, Valleylab FT10 Energy Platform (VLFT10GEN) software version 4.0.0 and below, and Valleylab FX8 Energy Platform (VLFX8GEN) software version 1.1.0 and below use the descrypt algorithm for OS password hashing. While interactive, network-based logons are disabled, and attackers can use the other vulnerabilities within this report to obtain local shell access and access these hashes.
CVSS v3.1: 7
GHSA-fxvh-v448-8246: Multiple vulnerabilities in Cisco Intersight Virtual Appliance could allow an unauthenticated, adjacent attacker to access sensitive internal services from an external interface. These vulnerabilities are due to insufficient restrictions for IPv4 or IPv6 packets that are received on the external management interface. An attacker could exploit these vulnerabilities by sending specific traffic to this interface on an affected device. A successful exploit could allow the attacker to access sensitive internal services and make configuration changes on the affected device.
CVSS v3.1: 8.3
GHSA-qvqp-gw9w-cv39: In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.
CVSS v3.1: 5.5
CVE-2018-19128: In Libav 12.3, there is a heap-based buffer over-read in decode_frame in libavcodec/lcldec.c that allows an attacker to cause denial-of-service via a crafted avi file.
CVSS v3.0: 6.5
CVSS v2.0: 4.3
GHSA-ph65-8qf2-63qx: Acrobat Reader versions 24.005.20307, 24.001.30213, 24.001.30193, 20.005.30730, 20.005.30710 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 4.7
CVE-2020-19596: Buffer overflow vulnerability in Core FTP Server v1.2 Build 583, via a crafted username.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
GHSA-f3pg-qwvg-p99c: Lenient Parsing of Content-Length Header When Prefixed with Plus Sign
Summaryhyper's HTTP/1 server code had a flaw that incorrectly parses and accepts requests with a `Content-Length` header with a prefixed plus sign, when it should have been rejected as illegal. This combined with an upstream HTTP proxy that doesn't parse such `Content-Length` headers, but forwards them, can result in "request smuggling" or "desync attacks".VulnerabilityThe flaw exists in all prior versions of hyper, if built with [`rustc` v1.5.0 or newer](https://github.com/rust-lang/rust/pull/28826/commits/123a83326fb95366e94a3be1a74775df4db97739).Example:This request gets accepted and hyper reads the body as abc. The request _should_ be rejected, according to RFC 7230, since the ABNF for `Content-Length` only allows for `DIGIT`s. This is due to using the `FromStr` implementation for `u64` in the standard library. By differing from the spec, it is possible to send requests like these to endpoints that have different HTTP implementations, with different interpretations of the payload semantics, and cause "desync attacks".In this particular case, an upstream proxy would need to error when parsing the `Content-Length`, but _not_ reject the request (swallowing its own error), and forwarding the request as-is with the `Content-Length` still included. _Then_ the upstream proxy and hyper would disagree on the length of the request body. The combination of these factors would be extremely rare.Read more about desync attacks: https://portswigger.net/research/http-desync-attacks-request-smuggling-rebornImpactTo determine if vulnerable, all these things must be true:**Using hyper as an HTTP server**. While the lenient decoder also exists in the client, a vulnerability does not exist around _responses_.**Using HTTP/1**. The HTTP/2 code uses a stricter parser.**Using a vulnerable HTTP proxy upstream to hyper**. If an upstream proxy correctly rejects the illegal `Content-Length` header, *OR* can parse the length with the plus sign, the desync attack cannot succeed.PatchesWe have released the following patch versions:v0.14.10 (to be released when this advisor is published)WorkaroundsBesides upgrading hyper, you can take the following options:Reject requests manually that contain a plus sign prefix in the `Content-Length` header.Ensure any upstream proxy handles `Content-Length` headers with a plus sign prefix.CreditsThis issue was initially reported by [Mattias Grenfeldt](https://grenfeldt.dev/) and Asta Olofsson.
CVSS v3.1: 3.1
GHSA-mx87-47cg-9wpg: An issue was discovered in ntopng 3.4 before 3.4.180617. The PRNG involved in the generation of session IDs is not seeded at program startup. This results in deterministic session IDs being allocated for active user sessions. An attacker with foreknowledge of the operating system and standard library in use by the host running the service and the username of the user whose session they're targeting can abuse the deterministic random number generation in order to hijack the user's session, thus escalating their access.
CVSS v3.0: 8.1
CVE-2019-14804: studio/polyglot.php?page=etemplates in UNA 10.0.0-RC1 allows XSS via the System Name field under Emails during template editing.
CVSS v3.0: 4.8
CVSS v2.0: 3.5
GHSA-hhmh-w64h-2vvx: A buffer overflow vulnerability in the Databuf function in types.cpp of Exiv2 v0.27.1 leads to a denial of service (DOS).
CVSS v3.1: 6.5
GHSA-6mf2-xqwv-jhq3: In the Linux kernel, the following vulnerability has been resolved:Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp()l2cap_ecred_reconf_rsp() casts the incoming data to struct
l2cap_ecred_conn_rsp (the ECRED *connection* response, 8 bytes with
result at offset 6) instead of struct l2cap_ecred_reconf_rsp (2 bytes
with result at offset 0).This causes two problems:The sizeof(*rsp) length check requires 8 bytes instead of the
correct 2, so valid L2CAP_ECRED_RECONF_RSP packets are rejected
with -EPROTO.rsp->result reads from offset 6 instead of offset 0, returning
wrong data when the packet is large enough to pass the check.Fix by using the correct type.  Also pass the already byte-swapped
result variable to BT_DBG instead of the raw __le16 field.
CVSS v3.1: 7.1
GHSA-cp54-gcvg-x9q6: An issue was discovered in certain Apple products. macOS before 10.12.6 is affected. The issue involves the "Bluetooth" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVSS v3.0: 8
CVE-2017-11463: In Ivanti Service Desk (formerly LANDESK Management Suite) versions between 2016.3 and 2017.3, an Unrestricted Direct Object Reference leads to referencing/updating objects belonging to other users. In other words, a normal user can send requests to a specific URI with the target user's username in an HTTP payload in order to retrieve a key/token and use it to access/update objects belonging to other users. Such objects could be user profiles, tickets, incidents, etc.
CVSS v3.0: 8.8
CVSS v2.0: 6.5
CVE-2013-4855: D-Link DIR-865L has SMB Symlink Traversal due to misconfiguration in the SMB service allowing symbolic links to be created to locations outside of the Samba share.
CVSS v3.1: 8.8
CVSS v2.0: 7.9
RHSA-2026:19370: Red Hat Security Advisory: firefox security update
firefox: thunderbird: Information disclosure due to incorrect boundary conditions in the Audio/Video component firefox: thunderbird: webrtc: Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component firefox: thunderbird: Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1 firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.10.1 and Firefox 150.0.1
CVSS v3.1: 7.5
GHSA-2hgg-g6cr-365f: Samsung Internet for Galaxy Watch version 5.0.9, available up until Samsung Galaxy Watch 3, does not properly validate TLS certificates, allowing for an attacker to impersonate any and all websites visited by the user. This is a critical misconfiguration in the way the browser validates the identity of the server. It negates the use of HTTPS as a secure channel, allowing for Man-in-the-Middle attacks, stealing sensitive information or modifying incoming and outgoing traffic. NOTE: This vulnerability is in an end-of-life product that is no longer maintained by the vendor.
CVSS v3.1: 5.9
RHSA-2023:3309: Red Hat Security Advisory: OpenShift Container Platform 4.11.42 bug fix and security update
dns: Denial of Service (DoS)
CVSS v3.1: 7.5
RHSA-2024:6309: Red Hat Security Advisory: fence-agents security update
pypa/setuptools: Remote code execution via download functions in the package_index module in pypa/setuptools urllib3: proxy-authorization request header is not stripped during cross-origin redirects
CVSS v3.1: 4.4
CVE-2007-5572: Multiple cross-site request forgery (CSRF) vulnerabilities in Simple PHP Blog (SPHPBlog) 0.4.9 allow remote attackers to perform delete actions as administrators via (1) the block_id parameter to add_block.php or (2) the link_id parameter to add_link.php.
CVSS v2.0: 4.3
CVE-2015-2558: Use-after-free vulnerability in Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, Excel Viewer, Office Compatibility Pack SP3, and Excel Services on SharePoint Server 2007 SP3, 2010 SP2, and 2013 SP1 allows remote attackers to execute arbitrary code via a long fileVersion element in an Office document, aka "Microsoft Office Memory Corruption Vulnerability."
CVSS v2.0: 9.3
GHSA-98vm-jhgm-gp59: Password Management Issue in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.
CVSS v3.0: 9.8
CVE-2023-0581: PrivateContent  <= 8.4.3 - Protection Mechanism Bypass
The PrivateContent plugin for WordPress is vulnerable to protection mechanism bypass due to the use of client side validation in versions up to, and including, 8.4.3. This is due to the plugin checking if an IP had been blocklist via client-side scripts rather than server-side. This makes it possible for unauthenticated attackers to bypass any login restrictions  that may prevent a brute force attack.
CVSS v3.1: 5.3
CVE-2022-47862: Lead Management System v1.0 is vulnerable to SQL Injection via the customer_id parameter in ajax_represent.php.
CVSS v3.1: 9.8
CVE-2025-15559: Unauthenticated OS Command Injection in NesterSoft WorkTime
An unauthenticated attacker can inject OS commands when calling a server API endpoint in NesterSoft WorkTime. The server API call to generate and download the WorkTime client from the WorkTime server is vulnerable in the “guid” parameter. This allows an attacker to execute arbitrary commands on the WorkTime server as NT Authority\SYSTEM with the highest privileges. Attackers are able to access or manipulate sensitive data and take over the whole server.
CVSS v3.1: 9.8
CVE-2026-24436: Tenda W30E V2 Lacks Rate Limiting on Authentication
Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) do not enforce rate limiting or account lockout mechanisms on authentication endpoints. This allows attackers to perform unrestricted brute-force attempts against administrative credentials.
CVSS v4.0: 9.2
GHSA-7r3r-j3vr-c4w6: Server-side request forgery (ssrf) in Microsoft Entra ID Entitlement Management allows an unauthorized attacker to perform spoofing over a network.
CVSS v3.1: 10
CVE-2018-20966: The woocommerce-jetpack plugin before 3.8.0 for WordPress has XSS in the Products Per Page feature.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
CVE-2020-7253: Improper access control vulnerability in McAfee Agent
Improper access control vulnerability in masvc.exe in McAfee Agent (MA) prior to 5.6.4 allows local users with administrator privileges to disable self-protection via a McAfee supplied command-line utility.
CVSS v3.1: 5.7
CVE-2025-69368: WordPress SOHO - Photography WordPress Theme theme <= 3.0.3 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GT3themes SOHO - Photography WordPress Theme soho allows DOM-Based XSS.This issue affects SOHO - Photography WordPress Theme: from n/a through <= 3.0.3.
CVSS v3.1: 7.1
GHSA-4rm3-87xm-9h89: An issue in the qi_inst_state_free component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS v3.1: 7.5
RHSA-2023:0389: Red Hat Security Advisory: OpenJDK 17.0.6 Security Update for Portable Linux Builds
OpenJDK: handshake DoS attack against DTLS connections (JSSE, 8287411) OpenJDK: soundbank URL remote loading (Sound, 8293742)
CVSS v3.1: 3.7
CVE-2016-20093: Wise Care 365 4.27 and Wise Disk Cleaner 9.29 Unquoted Service Path Privilege Escalation
Wise Care 365 4.27 and Wise Disk Cleaner 9.29 contain unquoted service path vulnerabilities in the WiseBootAssistant and SpyHunter 4 Service respectively, allowing local users to execute arbitrary code with SYSTEM privileges. Attackers can insert malicious executables in the system root path that execute during service startup or system reboot with elevated privileges.
CVSS v4.0: 8.5
CVSS v3.1: 7.8
GHSA-hrf3-6c7v-5628: A flaw was found in Libsoup. The server-side digest authentication implementation in the SoupAuthDomainDigest class does not properly track issued nonces or enforce the required incrementing nonce-count (nc) attribute. This vulnerability allows a remote attacker to capture a single valid authentication header and replay it repeatedly. Consequently, the attacker can bypass authentication and gain unauthorized access to protected resources, impersonating the legitimate user.
CVSS v3.1: 5.8
GHSA-mr95-v55h-pp97: Tiny Server 1.1 allows remote attackers to cause a denial of service (crash) via malformed HTTP requests such as (1) a GET request without the HTTP version (HTTP/1.1), or (2) a request without GET or the HTTP version.
CVE-2024-5481: Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.23 - Authenticated (Contributor+) Path Traversal via esc_dir Function
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.8.23 via the esc_dir function. This makes it possible for authenticated attackers to cut and paste (copy) the contents of arbitrary files on the server, which can contain sensitive information, and to cut (delete) arbitrary directories, including the root WordPress directory. By default this can be exploited by administrators only. In the premium version of the plugin, administrators can give gallery edit permissions to lower level users, which might make this exploitable by users as low as contributors.
CVSS v3.1: 6.8
GHSA-c29w-qq4m-2gcv: goshs has an empty-username SFTP password authentication bypass
Summarygoshs contains an SFTP authentication bypass when the documented empty-username basic-auth syntax is used. If the server is started with `-b ':pass'` together with `-sftp`, goshs accepts that configuration but does not install any SFTP password handler. As a result, an unauthenticated network attacker can connect to the SFTP service and access files without a password. I reproduced this on the latest release `v2.0.0-beta.5`.DetailsThe help text explicitly documents empty usernames as valid authentication input:`options/options.go:264-266` says `Use basic authentication (user:pass - user can be empty)`The SFTP sanity check only requires that either `-b` or `--sftp-keyfile` is present:That parsing logic then splits `-b ':pass'` into an empty username and a non-empty password:But the SFTP server only installs a password handler if both the username and password are non-empty:With `-b ':pass'`, that condition is false, so no password authentication is enforced for SFTP sessions.Relevant source locations:`options/options.go:264-266``sanity/checks.go:82-85``sanity/checks.go:102-109``sftpserver/sftpserver.go:82-85`PoCI manually verified the issue on `v2.0.0-beta.5`. The server was started with the documented empty-user auth syntax `-b ':pass'`, but an SFTP client still downloaded a file without supplying any key or password.Manual verification commands used:`Terminal 1``Terminal 2`Expected result:the SFTP session succeeds without a keythere is no password prompt`cat /tmp/authless_sftp.txt` prints `root file`PoC Video 1:https://github.com/user-attachments/assets/1ef1539d-bf29-419b-a26e-46aa405effb4Single-script verification:`gosh_poc2` script content:PoC Video 2:https://github.com/user-attachments/assets/b8f632b7-20f4-49f1-b207-b2502af49b77ImpactThis is an authentication bypass in the SFTP service. An external attacker does not need valid credentials to access the exposed SFTP root when the operator follows the documented `-b ':pass'` syntax. That enables unauthenticated reading, uploading, renaming, and deleting of files within the configured SFTP root, depending on server mode and filesystem permissions.RemediationSuggested fixes:Install the SFTP password handler whenever a password is configured, even if the username is an empty string.If empty usernames are not intended for SFTP, reject `-b ':pass'` during option validation whenever `-sftp` is enabled.Add an integration test that starts SFTP with `-b ':pass'` and verifies that unauthenticated sessions are rejected.
CVSS v3.1: 9.8
GHSA-543v-vjvp-j3g9: Early free of object in use in IndexDB in Google Chrome prior to 67.0.3396.62 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
CVSS v3.0: 9.6
GHSA-jpj5-hg26-6jgc: Cross-site Scripting in Alist
Alist versions 2.0.10 through 2.1.0 were discovered to contain a cross-site scripting (XSS) vulnerability via /i/:data/ipa.plist. This issue was fixed in version 2.1.1.
CVSS v3.1: 6.1
CVE-2021-27277: This vulnerability allows local attackers to escalate privileges on affected installations of SolarWinds Orion Virtual Infrastructure Monitor 2020.2. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the OneTimeJobSchedulerEventsService WCF service. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-11955.
CVSS v3.0: 7.8
GHSA-58vq-p2p8-x98r: Unspecified vulnerability in the tab editor for Personal .NET Portal before 2.0.0 has unknown impact and attack vectors related to a "Security leak."