ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-5372-pcfg-3593: IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0could allow an authenticated user to modify restricted content due to incorrect authorization checks.
CVSS v3.1: 6.5
GHSA-h9cg-xhj3-mjmj: Unspecified vulnerability in the Change Data Capture component of Oracle Database server 9.2.0.7, 10.1.0.5, and 10.2.0.1 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB02.  NOTE: details are unavailable from Oracle, but they have not publicly disputed a claim by a reliable independent researcher that states that the problem is SQL injection in the CDC_ALLOCATE_LOCK function of the DBMS_CDC_UTILITY package.
GHSA-65gm-xvw4-p9c2: SQL injection vulnerability in FME Modules quickproducttable module for PrestaShop v.1.2.1 and before, allows a remote attacker to escalate privileges and obtain information via the readCsv(), displayAjaxProductChangeAttr, displayAjaxProductAddToCart, getSearchProducts, and displayAjaxProductSku methods.
CVSS v3.1: 9.8
CVE-2019-20592: An issue was discovered on Samsung mobile devices with N(7.x), O(8.x), and P(9.0) software. There is local SQL injection in the Story Video Editor Content Provider. The Samsung ID is SVE-2019-14062 (July 2019).
CVSS v3.1: 7.8
CVSS v2.0: 4.6
GHSA-55h6-xcvg-4r99: A vulnerability was found in the avahi library. This flaw allows an unprivileged user to make a dbus call, causing the avahi daemon to crash.
CVSS v3.1: 5.5
CVE-2006-1128: Directory traversal vulnerability in the session handling class (GallerySession.class) in Gallery 2 up to 2.0.2 allows remote attackers to access and delete files by specifying the session in a cookie, which is used in constructing file paths before the session value is sanitized.
CVSS v2.0: 6.4
GHSA-9gqj-5w7c-vx47: Anthropic Sandbox Runtime Incorrectly Implemented Network Sandboxing
Due to a bug in sandboxing logic, `sandbox-runtime` did not properly enforce a network sandbox if the sandbox policy did not configure any allowed domains. This could allow sandboxed code to make network requests outside of the sandbox. A patch for this was released in v0.0.16.Thank you to https://github.com/bendrucker for reporting this issue!
CVSS v4.0: 1.8
CVE-2025-57999: WordPress WPKoi Templates for Elementor Plugin <= 3.4.3 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpkoithemes WPKoi Templates for Elementor wpkoi-templates-for-elementor allows DOM-Based XSS.This issue affects WPKoi Templates for Elementor: from n/a through <= 3.4.3.
CVSS v3.1: 6.5
GHSA-rmx2-6f87-q3j9: Unspecified vulnerability in the Oracle iStore component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.2, and 12.2.3 allows remote authenticated users to affect integrity via unknown vectors.
GHSA-x2hx-2frv-429m: OpenTTD before 1.1.5 contains a Denial of Service (slow read attack) that prevents users from joining the server.
GHSA-w6ww-fmfx-2x22: Misconfigured IP address field in ROA leads to OctoRPKI crash
If the ROA that a repository returns contains too many bits for the IP address then OctoRPKI will crash.PatchesFor more informationIf you have any questions or comments about this advisory email us at security@cloudflare.com
CVSS v3.1: 4.2
GHSA-39v5-jf84-wf9c: SAP FI Manager Self-Service has a hard-coded user name, which makes it easier for remote attackers to obtain access via unspecified vectors.
CVE-2026-34862: Race condition vulnerability in the power consumption statistics module.
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS v3.1: 6.3
GHSA-gq6w-g8w8-jh8j: Under certain conditions, access to service libraries is granted to account they should not have access to.
CVSS v3.1: 6.7
CVE-2017-13015: The EAP parser in tcpdump before 4.9.2 has a buffer over-read in print-eap.c:eap_print().
CVSS v3.1: 9.8
CVSS v3.0: 9.8
CVSS v2.0: 7.5
CVE-2005-3851: Cross-site scripting (XSS) vulnerability in search.asp in Online Attendance System (OASYS) Lite 1.0 allows remote attackers to inject arbitrary web script or HTML via certain search parameters, possibly the keyword parameter.
CVSS v2.0: 4.3
GHSA-rprf-7696-jjrj: An improper input validation vulnerability in the SGI Image Codec of QNX SDP version(s) 6.6, 7.0, and 7.1 could allow an attacker to potentially cause a denial-of-service condition or execute code in the context of the image processing process.
CVSS v3.1: 9
GHSA-mg9w-gjgf-qggr: In tmu_set_control_temp_step of tmu.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1: 7.7
GHSA-mw79-5rwv-q2vf: PHP remote file inclusion vulnerability in affichearticles.php3 in MySQLNewsEngine allows remote attackers to execute arbitrary PHP code via a URL in the newsenginedir parameter.
GHSA-7vcw-f2gc-3g39: In the Linux kernel, the following vulnerability has been resolved:drm/amdgpu/pm: Fix the null pointer dereference in apply_state_adjust_rulesCheck the pointer value to fix potential null pointer
dereference
CVSS v3.1: 5.5
GHSA-7hj8-jhx6-3q6v: Vulnerability in the Oracle User Management product of Oracle E-Business Suite (component: Proxy User Delegation).  Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle User Management.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle User Management accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
CVSS v3.1: 4.3
CVE-2021-0487: In onCreate of CalendarDebugActivity.java, there is a possible way to export calendar data to the sdcard without user consent due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-174046397
CVSS v3.1: 7.8
CVSS v2.0: 7.2
CVE-2026-40313: PraisonAI: ArtiPACKED Vulnerability via GitHub Actions Credential Persistence
PraisonAI is a multi-agent teams system. In versions 4.5.139 and below, the GitHub Actions workflows are vulnerable to ArtiPACKED attack, a known credential leakage vector caused by using actions/checkout without setting persist-credentials: false. By default, actions/checkout writes the GITHUB_TOKEN (and sometimes ACTIONS_RUNTIME_TOKEN) into the .git/config file for persistence, and if any subsequent workflow step uploads artifacts (build outputs, logs, test results, etc.), these tokens can be inadvertently included. Since PraisonAI is a public repository, any user with read access can download these artifacts and extract the leaked tokens, potentially enabling an attacker to push malicious code, poison releases and PyPI/Docker packages, steal repository secrets, and execute a full supply chain compromise affecting all downstream users. The issue spans numerous workflow and action files across .github/workflows/ and .github/actions/. This issue has been fixed in version 4.5.140.
CVSS v3.1: 9.1
CVE-2007-0663: SQL injection vulnerability in index.php in Eclectic Designs CascadianFAQ 4.1 and earlier allows remote attackers to execute arbitrary SQL commands via the qid parameter, a different vector than CVE-2007-0631.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS v2.0: 7.5
GHSA-76rr-q8xf-r868: VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Foundation Operations.
CVSS v3.1: 8
CVE-2023-22298: Open redirect vulnerability in pgAdmin 4 versions prior to v6.14 allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having a user to access a specially crafted URL.
CVSS v3.1: 6.1
GHSA-gq65-23cc-h5wp: The vulnerability is to theft of arbitrary files with system privilege in the LockScreenSettings ("com.lge.lockscreensettings") app in the "com/lge/lockscreensettings/dynamicwallpaper/MyCategoryGuideActivity.java" file. The main problem is that the app launches implicit intents that can be intercepted by third-party apps installed on the same device. They also can return arbitrary data that will be passed to the "onActivityResult()" method. The LockScreenSettings app copies the received file to the "/data/shared/dw/mycategory/wallpaper_01.png" path and then changes the file access mode to world-readable and world-writable.
CVSS v3.1: 6.1
GHSA-qx47-rwwf-w92p: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Slider by 10Web allows Reflected XSS.This issue affects Slider by 10Web: from n/a through 1.2.54.
CVSS v3.1: 7.1
GHSA-rhhj-pvqv-ph67: An issue was discovered in Nagios XI before 5.5.8. The url parameter of rss_dashlet/magpierss/scripts/magpie_simple.php is not filtered, resulting in an XSS vulnerability.
CVSS v3.0: 6.1
CVE-2022-29204: Missing validation causes denial of service in TensorFlow via `Conv3DBackpropFilterV2`
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.UnsortedSegmentJoin` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. The code assumes `num_segments` is a positive scalar but there is no validation. Since this value is used to allocate the output tensor, a negative value would result in a `CHECK`-failure (assertion failure), as per TFSA-2021-198. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
CVSS v3.1: 5.5
GHSA-cf5r-3pvm-w64w: typo3-appointments vulnerable to Cross-site Scripting
A vulnerability, which was classified as problematic, was found in innologi appointments Extension up to 2.0.5. This affects an unknown part of the component Appointment Handler. The manipulation of the argument formfield leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 2.0.6 is able to address this issue. The name of the patch is 986d3cb34e5e086c6f04e061f600ffc5837abe7f. It is recommended to upgrade the affected component. The identifier VDB-217353 was assigned to this vulnerability.
CVSS v3.1: 6.1
GHSA-2795-hprj-q9m8: Multiple vulnerabilities in the web UI of Cisco IoT Field Network Director (FND) could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against users on an affected system. The vulnerabilities are due to insufficient validation of user-supplied input that is processed by the web UI. An attacker could exploit these vulnerabilities by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information on an affected system.
GHSA-cpfh-q4c3-vm6p: A vulnerability, which was classified as critical, was found in SourceCodester Computer Parts Sales and Inventory System 1.0. This affects an unknown part of the file processlogin. The manipulation of the argument user leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-222105 was assigned to this vulnerability.
CVSS v3.1: 9.8
GHSA-h5qv-432c-96q7: Input validation vulnerability in Qualifio's Wheel of Fortune. This vulnerability allows an attacker to modify an email to contain the ‘+’ symbol to access the application and win prizes as many times as wanted.
CVSS v3.1: 5.3
CVE-2026-39579: WordPress B Blocks plugin <= 2.0.31 - Privilege Escalation vulnerability
Contributor Privilege Escalation in B Blocks <= 2.0.31 versions.
CVSS v3.1: 8.8
GHSA-2rfc-g399-fff5: The Essential Real Estate WordPress plugin before 3.9.6 does not sanitize and escapes some parameters, which could allow users with a role as low as Admin to perform Cross-Site Scripting attacks.
CVSS v3.1: 5.4
GHSA-p5wh-m4gj-x2mr: An issue was discovered in USBGuard before 1.1.0. On systems with the usbguard-dbus daemon running, an unprivileged user could make USBGuard allow all USB devices to be connected in the future.
CVSS v3.1: 7.8
GHSA-7mwp-xg8f-75pg: aEnrich Technology a+HRD has a vulnerability of Deserialization of Untrusted Data within its MSMQ asynchronized message process. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary system commands to perform arbitrary system operation or disrupt service.
CVSS v3.1: 9.8
GHSA-p785-479c-32q6: The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Ventura 13.5, watchOS 9.6, Safari 16.6. Processing web content may lead to arbitrary code execution.
CVSS v3.1: 8.8
CVE-2025-27208: A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Revive Adserver version 5.5.2. An attacker could trick a user with access to the user interface of a Revive Adserver instance into clicking on a specifically crafted URL and execute injected JavaScript code in the context of the victim's browser.  The session cookie cannot be accessed, but a number of other operations could be performed.

The vulnerability is present in the admin-search.php file and can be exploited via the compact parameter.
CVSS v3.0: 6.3
CVE-2024-51922: WordPress VP Sitemap plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Maruf Arafat VP Sitemap vp-sitemap allows Stored XSS.This issue affects VP Sitemap: from n/a through <= 1.0.
CVSS v3.1: 6.5
CVE-2021-34728: Cisco IOS XR Software Authenticated User Privilege Escalation Vulnerabilities
Multiple vulnerabilities in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker with a low-privileged account to elevate privileges on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS v3.1: 7.8
GHSA-hcjf-mh94-fp2w: In ioquake3 before 2017-03-14, the auto-downloading feature has insufficient content restrictions. This also affects Quake III Arena, OpenArena, OpenJK, iortcw, and other id Tech 3 (aka Quake 3 engine) forks. A malicious auto-downloaded file can trigger loading of crafted auto-downloaded files as native code DLLs. A malicious auto-downloaded file can contain configuration defaults that override the user's. Executable bytecode in a malicious auto-downloaded file can set configuration variables to values that will result in unwanted native code DLLs being loaded, resulting in sandbox escape.
CVSS v3.0: 7.8
RHSA-2017:3442: Red Hat Security Advisory: rh-mysql57-mysql security update
mysql: Server: Pluggable Auth unspecified vulnerability (CPU Oct 2017) mysql: Server: Replication unspecified vulnerability (CPU Oct 2017) mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2017) mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2017) mysql: Server: Replication unspecified vulnerability (CPU Oct 2017) mysql: Server: FTS unspecified vulnerability (CPU Oct 2017) mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2017) mysql: Server: Performance Schema unspecified vulnerability (CPU Oct 2017) mysql: Server: Stored Procedure unspecified vulnerability (CPU Oct 2017) mysql: Server: InnoDB unspecified vulnerability (CPU Oct 2017) mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2017) mysql: Server: DML unspecified vulnerability (CPU Oct 2017) mysql: Server: FTS unspecified vulnerability (CPU Oct 2017) mysql: Group Replication GCS unspecified vulnerability (CPU Oct 2017) mysql: Server: Memcached unspecified vulnerability (CPU Oct 2017) mysql: Server: InnoDB unspecified vulnerability (CPU Oct 2017) mysql: Server: InnoDB unspecified vulnerability (CPU Oct 2017) mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2017) mysql: Client programs unspecified vulnerability (CPU Oct 2017) mysql: Server: DDL unspecified vulnerability (CPU Oct 2017) mysql: Server: Partition unspecified vulnerability (CPU Jan 2018) mysql: Server : Partition unspecified vulnerability (CPU Jan 2018)
CVSS v3.0: 4.9
GHSA-547m-mqmc-2jqg: Cross-site scripting (XSS) vulnerability in Webmail in Sun ONE Messaging Server 6.1 and iPlanet Messaging Server 5.2 before 5.2hf2.02, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via a crafted e-mail message, a different vulnerability than CVE-2005-2022 and CVE-2006-5486.
GHSA-wcmh-67fx-99w6: Cross-site scripting (XSS) vulnerability in D-Link DI-614+ SOHO router running firmware 2.30, and DI-704 SOHO router running firmware 2.60B2, and DI-624, allows remote attackers to inject arbitrary script or HTML via the DHCP HOSTNAME option in a DHCP request.
CVE-2024-51257: DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doCertificate function.
CVSS v3.1: 8.8
GHSA-39hx-hjhc-q6p6: The Internet Printing Protocol (IPP) implementation in CUPS before 1.1.21 allows remote attackers to cause a denial of service (service hang) via a certain UDP packet to the IPP port.
CVE-2019-13413: The Rencontre plugin before 3.1.3 for WordPress allows SQL Injection via inc/rencontre_widget.php.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2015-8580: Multiple use-after-free vulnerabilities in the (1) Print method and (2) App object handling in Foxit Reader before 7.2.2 and Foxit PhantomPDF before 7.2.2 allow remote attackers to execute arbitrary code via a crafted PDF document.
CVSS v2.0: 6.8
GHSA-3962-mh6m-87qj: PCHelpWareV2 1.0.0.5 contains a denial of service vulnerability that allows local attackers to crash the application by supplying a malformed image file. Attackers can trigger the vulnerability through the Create SC feature by selecting a crafted BMP file with an oversized buffer, causing the application to crash.
CVSS v4.0: 6.9
CVSS v3.1: 6.2
CVE-2006-0465: Cross-site scripting (XSS) vulnerability in risultati_ricerca.php in active121 Site Manager allows remote attackers to inject arbitrary web script or HTML via the cerca parameter.
CVSS v2.0: 4.3
RHSA-2025:7201: Red Hat Security Advisory: corosync security update
corosync: Stack buffer overflow from 'orf_token_endian_convert'
CVSS v3.1: 6.6
CVE-2021-21527: Dell PowerScale OneFS 8.1.0-9.1.0 contain an improper neutralization of special elements used in an OS command vulnerability. This vulnerability may allow an authenticated user with ISI_PRIV_LOGIN_SSH or ISI_PRIV_LOGIN_CONSOLE privileges to escalate privileges.
CVSS v3.1: 6
GHSA-whmp-h7x8-7x69: Capgo before 12.128.2 contains an authorization bypass vulnerability in POST /private/role_bindings that fails to verify app_id ownership during app-scoped role binding creation. An attacker with administrative privileges in one organization can create role bindings targeting applications owned by other organizations, enabling unauthorized read and modification of victim applications.
CVSS v4.0: 8.6
CVSS v3.1: 7.2
CVE-2020-10424: The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/manage-fields.php by adding a question mark (?) followed by the payload.
CVSS v3.1: 4.8
CVSS v2.0: 3.5
CVE-2023-36539: Exposure of information intended to be encrypted by some Zoom clients may lead to disclosure of sensitive information.
CVSS v3.1: 5.3
CVE-2014-1618: Multiple SQL injection vulnerabilities in UAEPD Shopping Cart Script allow remote attackers to execute arbitrary SQL commands via the (1) cat_id or (2) p_id parameter to products.php or id parameter to (3) page.php or (4) news.php.
CVSS v2.0: 7.5
CVE-2013-0141: Directory traversal vulnerability in McAfee ePolicy Orchestrator (ePO) before 4.5.7 and 4.6.x before 4.6.6 allows remote attackers to upload arbitrary files via a crafted request over the Agent-Server communication channel, as demonstrated by writing to the Software/ directory.
CVSS v2.0: 4.3
GHSA-89mp-j99f-xqxm: A vulnerability was detected in Yonyou KSOA 9.0. This affects an unknown part of the file /kmf/user_popedom.jsp of the component HTTP GET Parameter Handler. The manipulation of the argument folderid results in sql injection. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 5.5
CVSS v3.1: 7.3
GHSA-qhgj-87jj-53vh: ERS Data System 1.8.1.0 allows remote attackers to execute arbitrary code, related to "com.branaghgroup.ecers.update.UpdateRequest" object deserialization.
CVSS v3.1: 9.8
GHSA-44w8-g2pc-jwwm: Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the NetConnection class when handling an attached script object. Successful exploitation could lead to arbitrary code execution.
CVSS v3.0: 9.8
CVE-2023-33958: Default `maxSignatureAttempts` in `notation verify` enables an endless data attack in notation
notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry and added a high number of signatures to an artifact can cause denial of service of services on the machine, if a user runs notation verify command on the same machine. The problem has been fixed in the release v1.0.0-rc.6. Users should upgrade their notation packages to v1.0.0-rc.6 or above. Users unable to upgrade may restrict container registries to a set of secure and trusted container registries.
CVSS v3.1: 5.4
CVE-2018-12296: Insufficient access control in /api/external/7.0/system.System.get_infos in Seagate NAS OS version 4.3.15.1 allows attackers to obtain information about the NAS without authentication via empty POST requests.
CVSS v3.0: 7.5
CVSS v2.0: 5
CVE-2016-1057: Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1045, CVE-2016-1046, CVE-2016-1047, CVE-2016-1048, CVE-2016-1049, CVE-2016-1050, CVE-2016-1051, CVE-2016-1052, CVE-2016-1053, CVE-2016-1054, CVE-2016-1055, CVE-2016-1056, CVE-2016-1058, CVE-2016-1059, CVE-2016-1060, CVE-2016-1061, CVE-2016-1065, CVE-2016-1066, CVE-2016-1067, CVE-2016-1068, CVE-2016-1069, CVE-2016-1070, CVE-2016-1075, CVE-2016-1094, CVE-2016-1121, CVE-2016-1122, CVE-2016-4102, and CVE-2016-4107.
CVSS v3.0: 9.8
CVSS v2.0: 10
GHSA-p92w-wpf8-75jj: ** DISPUTED **  PHP remote file inclusion vulnerability in user/turbulence.php in PHP Turbulence 0.0.1 alpha allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[tcore] parameter.  NOTE: this vulnerability is disputed by CVE and a reliable third party because a direct request to user/turbulence.php triggers a fatal error before inclusion.
GHSA-xc58-g4fh-rfxp: An issue in Casa Systems NTC-221 version 2.0.99.0 and before allows a remote attacker to execute arbitrary code via a crafted payload to the /www/cgi-bin/nas.cgi component.
CVSS v3.1: 9
GHSA-67w3-p993-9fx3: The AMC Security- Antivirus, Clean (aka com.iobit.mobilecare) application 4.4.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
PYSEC-2020-176: PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.