ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-6c2x-gcp3-gp73: Open WebUI vulnerable to Global Knowledge Base Enumeration via knowledge-bases Meta-Collection
Global Knowledge Base Enumeration via knowledge-bases Meta-CollectionAffected ComponentRetrieval collection access validation:`backend/open_webui/routers/retrieval.py` (lines 2330-2355, `_validate_collection_access`)`backend/open_webui/routers/retrieval.py` (query endpoints, e.g. `POST /query/doc`)Affected VersionsCurrent main branch (commit `6fdd19bf1`) and likely all versions with the knowledge base subsystem.DescriptionThe `_validate_collection_access` function uses an incomplete allowlist that only enforces ownership checks for collections matching `user-memory-*` and `file-*` patterns. All other collection names pass through unchecked — including the system-level `knowledge-bases` meta-collection, which stores the IDs, names, and descriptions of every knowledge base on the instance.Any authenticated user can query this meta-collection directly via the retrieval query endpoints to obtain a global index of all knowledge bases across all users.This finding is the enabler for the KB destruction (`process/web`), KB content injection (`process/file`), and RAG vector search access bypass findings — all of which require knowing a target KB's UUID. Without this enumeration, UUIDs are random and practically unguessable; with it, UUIDs across the entire instance are trivially obtained.CVSS 3.1 Breakdown| Metric | Value | Rationale |
|--------|-------|-----------|
| Attack Vector | Network (N) | Exploited remotely via API call |
| Attack Complexity | Low (L) | Single API call |
| Privileges Required | Low (L) | Requires any authenticated user account |
| User Interaction | None (N) | No victim interaction required |
| Scope | Unchanged (U) | Impact within the knowledge base boundary |
| Confidentiality | Low (L) | Discloses KB metadata (IDs, names, descriptions) across all users |
| Integrity | None (N) | No direct data modification |
| Availability | None (N) | No denial of service |Attack ScenarioAttacker (any authenticated user) sends:`_validate_collection_access` does not recognize the `knowledge-bases` prefix and lets the request pass.The vector search returns the most relevant documents from the meta-collection — knowledge base records including their UUIDs, names, and descriptions — across all users on the instance.Attacker varies the query to enumerate more KBs: `"project"`, `"internal"`, `"private"`, etc.Attacker now has a full target list for subsequent attacks (destruction, poisoning, content extraction).Impact**Information disclosure:** KB names and descriptions may reveal sensitive project names, internal initiatives, or user activities**Enabler for other attacks:** Unlocks the following findings by supplying the required target UUIDs:KB destruction/poisoning via `process/web`Cross-user content injection via `process/file`RAG vector search access bypass in `retrieval/utils.py`Transforms these from theoretical (requires UUID guessing) to trivially exploitable (UUIDs enumerable)PreconditionsAttacker must have a valid user account
CVSS v3.1: 4.3
GHSA-vx22-h4xx-gch4: Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS v3.1: 5.4
CVE-2021-25479: A possible heap-based buffer overflow vulnerability in Exynos CP Chipset prior to SMR Oct-2021 Release 1 allows arbitrary memory write and code execution.
CVSS v3.1: 7.2
CVE-2026-20943: Microsoft Office Click-To-Run Remote Code Execution Vulnerability
Untrusted search path in Microsoft Office allows an unauthorized attacker to execute code locally.
CVSS v3.1: 7
CVE-2019-2443: Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: XML Publisher). Supported versions that are affected are 8.55, 8.56 and 8.57. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.0 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
CVSS v3.0: 7.2
CVSS v2.0: 6.5
GHSA-fhww-mg2m-x83m: Heap-based buffer overflow in Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and Acrobat and Acrobat Reader DC Continuous before 15.020.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-6994.
CVSS v3.0: 9.8
CVE-2026-22320: Stack-Based Buffer Overflow in TFTP File-Transfer Command Handling over CLI
A stack-based buffer overflow in the CLI's TFTP file‑transfer command handling allows a low-privileged attacker with Telnet/SSH access to trigger memory corruption by supplying unexpected or oversized filename input. Exploitation results in the corruption of the internal buffer, causing the CLI and web dashboard to become unavailable and leading to a denial of service.
CVSS v3.1: 6.5
GHSA-g5fr-p479-cq2p: Windows Push Notifications Apps Elevation of Privilege Vulnerability.
CVSS v3.1: 7
RHSA-2025:1849: Red Hat Security Advisory: RHTAS 1.1.1 - Red Hat Trusted Artifact Signer Release
golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto
CVSS v3.1: 8.2
GHSA-83mm-r262-4333: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themefic Ultimate Addons for Contact Form 7.This issue affects Ultimate Addons for Contact Form 7: from n/a through 3.1.23.
CVSS v3.1: 8.5
GHSA-g34c-fgmm-m32p: cleanhtml.pl 1.129 in LiveJournal CVS before Dec 13 2005 allows remote attackers to inject scripting languages via the XSL namespace in XML, via vectors such as customview.cgi.
RHSA-2014:0827: Red Hat Security Advisory: tomcat security update
Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs Tomcat/JBossWeb: Request smuggling via malicious content length header
GHSA-fcxw-hhxq-48wx: Insecure temporary file usage in Jenkins Git Client Plugin
Jenkins Git Client Plugin 2.4.2 and earlier creates temporary file with insecure permissions resulting in information disclosure
CVSS v3.0: 3.3
RHSA-2013:0670: Red Hat Security Advisory: Django security update
Django: Data leakage via admin history log Django: Formset denial-of-service bindings: Internal entity expansion in Python XML libraries inflicts DoS vulnerabilities bindings: External entity expansion in Python XML libraries inflicts potential security flaws and DoS vulnerabilities
RHSA-2018:2092: Red Hat Security Advisory: patch security update
patch: Malicious patch files cause ed to execute arbitrary commands
CVSS v3.0: 7.8
CVE-2025-1274: RCS File Parsing Out-of-Bounds Write Vulnerability
A maliciously crafted RCS file, when parsed through Autodesk Revit, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
CVSS v3.1: 7.8
CVE-2024-49609: WordPress Author Discussion plugin <= 0.2.2 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Brandon White Author Discussion author-discussion allows Blind SQL Injection.This issue affects Author Discussion: from n/a through <= 0.2.2.
CVSS v3.1: 8.5
GHSA-3mwh-xgcp-8q55: An Arbitrary File Upload in the Upload Image component in Sourcecodester Online Bike Rental v1.0 allows authenticated administrator to conduct remote code execution.
CVE-2017-12194: A flaw was found in the way spice-client processed certain messages sent from the server. An attacker, having control of malicious spice-server, could use this flaw to crash the client or execute arbitrary code with permissions of the user running the client. spice-gtk versions through 0.34 are believed to be vulnerable.
CVSS v3.0: 9.8
CVSS v2.0: 10
CVE-2022-41304: An Out-Of-Bounds Write Vulnerability in Autodesk FBX SDK 2020 version and prior may lead to code execution through maliciously crafted FBX files or information disclosure.
CVSS v3.1: 7.8
CVE-2026-52190: Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_448384 component
CVE-2014-4786: IBM Initiate Master Data Service 9.5 before 9.5.093013, 9.7 before 9.7.093013, 10.0 before 10.0.093013, and 10.1 before 10.1.093013 does not properly restrict use of FRAME elements, which allows remote authenticated users to conduct phishing attacks, and bypass intended access restrictions or obtain sensitive information, via a crafted web site, related to a "frame injection" issue.
CVSS v2.0: 4.9
CVE-2026-2021: Slideshow Gallery LITE <= 1.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'alwaysauto' Shortcode Attribute
The Slideshow Gallery LITE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'alwaysauto' shortcode attribute in all versions up to, and including, 1.8.5. This is due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
GHSA-2833-c767-j26x: Missing Authorization vulnerability in Brainstorm Force Spectra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spectra: from n/a through 2.13.7.
CVSS v3.1: 4.3
GHSA-pr2x-8w9v-pj52: A vulnerability, which was classified as critical, has been found in PCMan FTP Server 2.0.7. This issue affects some unknown processing of the component REST Command Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 6.9
CVSS v3.1: 7.3
GHSA-c4xx-wp4h-934r: Unspecified vulnerability in the SQL logging facility in PAM-MySQL 0.6.x before 0.6.2 and 0.7.x before 0.7pre3 allows remote attackers to cause a denial of service (segmentation fault) via unspecified vectors, probably involving the pam_mysql_sql_log function when being used in vsftpd, which does not include the IP address argument to an sprintf call.
GHSA-vrqq-866h-hhcv: Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Actions). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Business Intelligence Enterprise Edition. CVSS 3.0 Base Score 7.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
CVSS v3.1: 7.1
CVE-2017-15307: Huawei Honor 8 smartphone with software versions earlier than FRD-L04C567B389 and earlier than FRD-L14C567B389 have a permission control vulnerability due to improper authorization configuration on specific device information.
CVSS v3.0: 2.3
CVSS v2.0: 1.9
CVE-2025-64247: WordPress Read More & Accordion plugin <= 3.5.5.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in edmon.parker Read More & Accordion expand-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Read More & Accordion: from n/a through <= 3.5.5.1.
CVSS v3.1: 4.3
CVE-2011-0782: Google Chrome before 9.0.597.84 on Mac OS X does not properly mitigate an unspecified flaw in the Mac OS X 10.5 SSL libraries, which allows remote attackers to cause a denial of service (application crash) via unknown vectors.
CVSS v2.0: 5
CVE-2002-1107: Cisco Virtual Private Network (VPN) Client software 2.x.x, and 3.x before 3.5.2B, does not generate sufficiently random numbers, which may make it vulnerable to certain attacks such as spoofing.
CVSS v2.0: 7.5
GHSA-35vr-x655-89wj: A Cryptographic Issue vulnerability has been found on IBERMATICA RPS, affecting version 2019. By firstly downloading the log file, an attacker could retrieve the SQL query sent to the application in plaint text. This log file contains the password hashes coded with AES-CBC-128 bits algorithm, which can be decrypted with a .NET function, obtaining the username's password in plain text.
CVSS v3.1: 8.2
GHSA-3p9p-84c4-78r8: Heap-based buffer underflow in the cryptojs_interpret_key_gen_type function in Mozilla Firefox before 23.0 and SeaMonkey before 2.20 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Certificate Request Message Format (CRMF) request.
CVE-2016-5955: Cross-site scripting (XSS) vulnerability in IBM Rational DOORS Next Generation 6.0.2 before iFix004 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS v3.0: 5.4
CVSS v2.0: 3.5
CVE-2025-2800: WP Event Manager <= 3.1.50 - Unauthenticated Stored Cross-Site Scripting via 'organizer_name'
The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘organizer_name' parameter in all versions up to, and including, 3.1.50 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 7.2
GHSA-7x76-cw6q-rm95: In the Linux kernel, the following vulnerability has been resolved:thermal: core: Fix thermal zone governor cleanup issuesIf thermal_zone_device_register_with_trips() fails after adding
a thermal governor to the thermal zone being registered, the
governor is not removed from it as appropriate which may lead to
a memory leak.In turn, thermal_zone_device_unregister() calls thermal_set_governor()
without acquiring the thermal zone lock beforehand which may race with
a governor update via sysfs and may lead to a use-after-free in that
case.Address these issues by adding two thermal_set_governor() calls, one to
thermal_release() to remove the governor from the given thermal zone,
and one to the thermal zone registration error path to cover failures
preceding the thermal zone device registration.
CVSS v3.1: 5.5
CVE-2026-50260: Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in freecounter()
A use-after-free flaw was found in the X.Org X server and Xwayland in FreeCounter(). A client that sets up multiple SyncCounters and awaits on those triggers can trigger a use-after-free when destroying those counters via a second client connection. This may be used to crash the server, or for privilege escalation if the X server runs as root.
CVSS v3.1: 7.8
GHSA-mhrj-hwc3-pwvq: In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.
CVSS v3.1: 5.5
GHSA-wc6j-4h3g-8crj: In Earcms Ear Music through 4.1 build 20170710, remote authenticated users can execute arbitrary PHP code by changing the allowable music-upload extensions to include .php in addition to .mp3 and .m4a in admin.php?iframe=config_upload, and then using user.php/music/add/ to upload the code.
CVSS v3.0: 7
GHSA-x98r-27wr-8583: Buffer overflow in the IPsec component in Apple iOS before 6 allows remote attackers to execute arbitrary code via a crafted racoon configuration file.
CVE-2024-42759: An issue in Ellevo v.6.2.0.38160 allows a remote attacker to escalate privileges via the /api/usuario/cadastrodesuplente endpoint.
CVSS v3.1: 6.3
GHSA-gmmh-w4w2-6cqc: Missing Authorization vulnerability in Cozy Vision SMS Alert Order Notifications sms-alert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMS Alert Order Notifications: from n/a through <= 3.9.0.
CVSS v3.1: 5.4
CVE-2014-7980: Multiple cross-site scripting (XSS) vulnerabilities in template.php in Zen theme 7.x-3.x before 7.x-3.3 and 7.x-5.x before 7.x-5.5 for Drupal allow remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via the skip_link_text setting and unspecified other theme settings.
CVSS v2.0: 3.5
CVE-2021-3796: Use After Free in vim/vim
vim is vulnerable to Use After Free
CVSS v3.0: 8.2
CVE-2021-33660: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated FLI file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
CVSS v3.0: 4.3
GHSA-87v4-c5h4-88xg: Incorrect access control in laskBlog v2.6.1 allows attackers to arbitrarily delete user accounts via a crafted request.
CVSS v3.1: 6.4
GHSA-vp7h-g9mh-c77g: Gifsicle gifview 1.89 and older is vulnerable to a use-after-free in the read_gif function resulting potential code execution
CVSS v3.0: 9.8
GHSA-fpxf-4mqp-7qw8: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPBits WPBITS Addons For Elementor Page Builder allows Stored XSS.This issue affects WPBITS Addons For Elementor Page Builder: from n/a through 1.5.
CVSS v3.1: 6.5
GHSA-gwj7-2h66-px64: IBM Cognos TM1 10.2 and 10.2.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 129617.
CVSS v3.0: 6.1
GHSA-ppx4-jjmr-85w2: The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby' parameter in all versions up to, and including, 4.9.9.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS v3.1: 6.5
RHSA-2008:0261: Red Hat Security Advisory: Red Hat Network Satellite Server security update
mod_ssl SSLCipherSuite bypass libxpm buffer overflow tomcat multiple content-length header poisioning tomcat DoS openmotif libUil buffer overflows tomcat manager example DoS tomcat examples XSS perl-Crypt-CBC weaker encryption with some ciphers jabberd SASL DoS tomcat directory listing issue httpd mod_status XSS tomcat XSS in example webapps tomcat XSS in example webapps mod_jk chunk too long java-jre: GIF buffer overflow tomcat directory traversal mod_perl PerlRun denial of service tomcat XSS in samples tomcat accept-language xss flaw mod_jk sends decoded URL to tomcat javaws vulnerabilities tomcat examples jsp XSS tomcat host manager XSS Integer overflow in the embedded ICC profile image parser in Sun Java Development Kit BMP image parser vulnerability httpd scoreboard lack of PID protection tomcat handling of cookies tomcat handling of cookie values mod_autoindex XSS httpd: mod_imagemap XSS Absolute path traversal Apache Tomcat WEBDAV RHN XSS flaw JFreeChart: XSS vulnerabilities in the image map feature apache mod_status cross-site scripting tomcat5 SSO cookie login information disclosure
CVE-2024-7402: Netskope Client Configuration Tampering with Local MITM
Netskope has identified a potential gap in its agent (Netskope Client) in which a malicious insider can potentially tamper the Netskope Client configuration by performing MITM (Man-in-the-Middle) activity on the Netskope Client communication channel. A successful exploitation would require administrative privileges on the machine, and could result in temporarily altering the configuration of Netskope Client or permanently disabling or removing the agent from the machine.
CVSS v4.0: 7
GHSA-3c8w-jch7-843r: Multiple unspecified vulnerabilities in FreeBSD 6 before 6.4-STABLE, 6.3 before 6.3-RELEASE-p7, 6.4 before 6.4-RELEASE-p1, 7.0 before 7.0-RELEASE-p7, 7.1 before 7.1-RC2, and 7 before 7.1-PRERELEASE allow local users to gain privileges via unknown attack vectors related to function pointers that are "not properly initialized" for (1) netgraph sockets and (2) bluetooth sockets.
GHSA-8824-wwwh-pg6h: IBM Tivoli Storage Manager FastBack installer could allow a remote attacker to execute arbitrary code on the system. By placing a specially-crafted DLL in the victim's path, an attacker could exploit this vulnerability when the installer is executed to run arbitrary code on the system with privileges of the victim.
CVSS v3.0: 7.3
CVE-2024-36416: SuiteCRM v4 API Excessive log data DOS
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a deprecated v4 API example with no log rotation allows denial of service by logging excessive data. Versions 7.14.4 and 8.6.1 contain a fix for this issue.
CVSS v3.1: 8.6
GHSA-g4w4-j7c8-4xwx: Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "MSEARCH_HIGHLIGHT_ENABLE_TITLE[1]" parameter,
potentially leading to unauthorized execution of scripts within a user's web browser.
CVSS v3.1: 8.8
GHSA-2vfp-x8jm-58cj: Untrusted Java serialization in Soffid IAM console before 1.7.5 allows remote attackers to achieve arbitrary remote code execution via a crafted authentication request.
CVSS v3.0: 9.8
RHSA-2023:6738: Red Hat Security Advisory: java-21-openjdk security and bug fix update
OpenJDK: memory corruption issue on x86_64 with AVX-512 (8317121) OpenJDK: certificate path validation issue during client authentication (8309966)
CVSS v3.1: 5.3
ICSA-24-347-03: Siemens RUGGEDCOM ROX II 
The CLI feature in the web interface of affected devices is vulnerable to 
cross-site request forgery (CSRF).

This could allow an attacker to read or modify the device configuration
by tricking an authenticated legitimate user into accessing a malicious link.
CVSS v3.1: 8.8
GHSA-vh49-8mpg-38x4: Directory traversal vulnerability in filemanager/filemanager.php in SWsoft Plesk 7.5 Reload and Plesk 7.6 for Microsoft Windows allows remote attackers to list arbitrary directories via a ../ (dot dot slash) in the file parameter in a chdir action.
GHSA-rxmx-2mhf-x3fq: IrfanView JPM File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of JPM files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24010.
CVSS v3.0: 7.8
GHSA-759r-c5hw-qm9q: A potential improper initialization vulnerability was reported in the BIOS of some ThinkPads that could allow a local privileged user to modify data and execute arbitrary code.
CVSS v4.0: 8.4
CVSS v3.1: 6.7