ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-3qwx-85qr-mvqm: Cross-site scripting (XSS) vulnerability in OcoMon 1.20, and possibly earlier versions, allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors.
GHSA-pwg2-rh4x-6xr7: The Website LLMs.txt plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 8.2.6. This is due to the use of filter_input() without a sanitization filter and insufficient output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrator into performing an action such as clicking on a link.
CVSS v3.1: 6.1
GHSA-xh3c-fg2p-f6rr: ownCloud owncloud/core before 10.10.0 Improperly Removes Sensitive Information Before Storage or Transfer.
CVSS v3.1: 7.5
GHSA-q48r-xg9h-78m8: Concrete CMS vulnerable to XML External Entity
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to XXE based DNS requests leading to IP disclosure.
CVSS v3.1: 5.3
CVE-2007-5121: Cross-site scripting (XSS) vulnerability in JSPWiki 2.5.139-beta allows remote attackers to inject arbitrary web script or HTML via the redirect parameter to wiki-3/Login.jsp and unspecified other components.
CVSS v2.0: 4.3
RHSA-2024:3308: Red Hat Security Advisory: tomcat security and bug fix update
Tomcat: WebSocket DoS with incomplete closing handshake Tomcat: HTTP/2 header handling DoS
CVSS v3.1: 7.5
CVE-2026-13837: Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: High)
CVE-2010-2665: Cross-site scripting (XSS) vulnerability in Opera before 10.54 on Windows and Mac OS X, and before 10.11 on UNIX platforms, allows remote attackers to inject arbitrary web script or HTML via a data: URI, related to incorrect detection of the "opening site."
CVSS v2.0: 4.3
CVE-2019-20775: An issue was discovered on LG mobile devices with Android OS 9.0 (Qualcomm SDM450, SDM845, SM6150, and SM8150 chipsets) software. Weak encryption leads to local information disclosure. The LG ID is LVE-SMP-190010 (August 2019).
CVSS v3.1: 5.5
CVSS v2.0: 2.1
CVE-2023-2362: Multiple Plugins from Wow-Company - Reflected XSS
The Float menu WordPress plugin before 5.0.2, Bubble Menu WordPress plugin before 3.0.4, Button Generator WordPress plugin before 2.3.5, Calculator Builder WordPress plugin before 1.5.1, Counter Box WordPress plugin before 1.2.2, Floating Button WordPress plugin before 5.3.1, Herd Effects WordPress plugin before 5.2.2, Popup Box WordPress plugin before 2.2.2, Side Menu Lite WordPress plugin before 4.0.2, Sticky Buttons WordPress plugin before 3.1.1, Wow Skype Buttons WordPress plugin before 4.0.2, WP Coder WordPress plugin before 2.5.6 do not escape the page parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS v3.1: 6.1
ICSA-26-132-06: ABB WebPro SNMP Card PowerValue Multiple Vulnerabilities
ABB became aware of multiple internally discovered vulnerabilities in the WebPro SNMP card PowerValue for the product versions listed as affected in the advisory. 

Depending upon the vulnerability, an attacker with access to local network who successfully exploited this vulnerability could have
- Unauthorized access
- Insufficient Session Expiration leading to resource unavailability
- Uncontrolled Resource Consumption leading to DOS attack

ABB strongly advises customers to update the latest firmware of affected products.
CVSS v3.1: 6.5
CVE-2024-4428: Sensetive Data Exposure in Menulux Managment Portal
Missing Authentication for Critical Function, Missing Authorization vulnerability in Menulux Information Technologies Managment Portal allows Collect Data as Provided by Users.

This issue affects Managment Portal: through 21.05.2024.
CVSS v4.0: 6.9
GHSA-h4mw-xf9h-686j: The Web manager (aka Commander) on Korenix JetPort 5601 and 5601f devices has Persistent XSS via the Port Alias field under Serial Setting.
CVSS v3.0: 6.1
CVE-2021-45593: Certain NETGEAR devices are affected by command injection by an authenticated user. This affects RBR20 before 2.7.3.22, RBR40 before 2.7.3.22, RBR50 before 2.7.2.102, RBS20 before 2.7.3.22, RBS40 before 2.7.3.22, RBR50 before 2.7.2.102, RBK20 before 2.7.3.22, RBK40 before 2.7.3.22, and RBK50 before 2.7.2.102.
CVSS v3.1: 8.4
CVE-2001-0147: Buffer overflow in Windows 2000 event viewer snap-in allows attackers to execute arbitrary commands via a malformed field that is improperly handled during the detailed view of event records.
CVSS v2.0: 10
CVE-2025-71321: picklescan - Arbitrary File Writing via distutils Module Bypass
picklescan before 0.0.33 contains an arbitrary file writing vulnerability that allows attackers to bypass the dangerous blocklist by using distutils.file_util.write_file. Attackers can construct malicious pickle objects to overwrite critical system files and achieve denial of service or remote code execution.
CVSS v4.0: 9.3
CVSS v3.1: 9.8
CVE-2025-10558: Stored Cross-site Scripting (XSS) vulnerability affecting 3DSearch in 3DSwymer on Release 3DEXPERIENCE R2025x
A stored Cross-site Scripting (XSS) vulnerability affecting 3DSearch in 3DSwymer on Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.
CVSS v3.1: 8.7
CVE-2024-0689: Custom Field Suite <= 2.6.4 - Authenticated (Admin+) Stored Cross-Site Scripting
The Custom Field Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a meta import in all versions up to, and including, 2.6.4 due to insufficient input sanitization and output escaping on the meta values. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS v3.1: 4.4
RHSA-2026:1652: Red Hat Security Advisory: Red Hat Ceph Storage
python: Invalid value for OpenSSL API may cause Buffer over-read when NPN is used systemd-coredump: race condition that allows a local attacker to crash a SUID program and gain read access to the resulting core dump cpython: Python HTMLParser quadratic complexity python: Quadratic complexity in os.path.expandvars() with user-controlled template sqlite: Integer Truncation in SQLite cpython: python: Python zipfile End of Central Directory (EOCD) Locator record offset not checked openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap libxslt: libxml2: Inifinite recursion at exsltDynMapFunction function in libexslt/dynamic.c glib: Integer overflow in in g_escape_uri_string() tar: Tar path traversal firefox: thunderbird: expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing openssh: OpenSSH: Control characters in usernames can lead to code execution via ProxyCommand openssh: OpenSSH: Null character in ssh:// URI can lead to code execution via ProxyCommand urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion urllib3: urllib3 Streaming API improperly handles highly compressed data GnuPG: GnuPG: Information disclosure and potential arbitrary code execution via out-of-bounds write urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)
CVSS v3.1: 7.5
GHSA-r346-6vhr-2jfx: JavaScript in Internet Explorer 3.x and 4.x, and Netscape 2.x, 3.x and 4.x, allows remote attackers to monitor a user's web activities, aka the Bell Labs vulnerability.
GHSA-ch7p-v47m-9422: The Open ISES Project 3.30A contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the p1 parameter. Attackers can send GET requests to inc_types_graph.php with crafted SQL payloads to extract sensitive database information including schema names and other data.
CVSS v4.0: 8.8
CVSS v3.1: 8.2
GHSA-q3h4-3x6h-4m52: Incorrect Authorization vulnerability in virtual gateway component in Devolutions Server allows attackers to bypass deny IP rules.This issue affects Server: from 2025.3.1 through 2025.3.12.
CVSS v3.1: 7.6
GHSA-gpwg-23hq-8pmc: Google Chrome before 5.0.375.127 does not properly implement file dialogs, which allows attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
CVE-2024-3772: Regular expression denial of service in Pydantic < 2.4.0
Regular expression denial of service in Pydanic < 2.4.0, < 1.10.13 allows remote attackers to cause denial of service via a crafted email string.
CVSS v3.1: 5.9
CVE-2022-49568: KVM: Don't null dereference ops->destroy
In the Linux kernel, the following vulnerability has been resolved:

KVM: Don't null dereference ops->destroy

A KVM device cleanup happens in either of two callbacks:
1) destroy() which is called when the VM is being destroyed;
2) release() which is called when a device fd is closed.

Most KVM devices use 1) but Book3s's interrupt controller KVM devices
(XICS, XIVE, XIVE-native) use 2) as they need to close and reopen during
the machine execution. The error handling in kvm_ioctl_create_device()
assumes destroy() is always defined which leads to NULL dereference as
discovered by Syzkaller.

This adds a checks for destroy!=NULL and adds a missing release().

This is not changing kvm_destroy_devices() as devices with defined
release() should have been removed from the KVM devices list by then.
CVSS v3.1: 5.5
CVE-2024-12386: WP Abstracts <= 2.7.3 - Cross-Site Request Forgery to Arbitrary Account Deletion
The WP Abstracts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.3. This is due to missing nonce validation on multiple functions. This makes it possible for unauthenticated attackers to delete arbitrary accounts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS v3.1: 8.1
CVE-2017-14771: Skybox Manager Client Application prior to 8.5.501 is prone to an arbitrary file upload vulnerability due to insufficient input validation of user-supplied files path when uploading files via the application. During a debugger-pause state, a local authenticated attacker can upload an arbitrary file and overwrite existing files within the scope of the affected application.
CVSS v3.0: 5.5
CVSS v2.0: 3.6
GHSA-xh59-6r4f-rjxg: hsolinkcontrol in hsolink 1.0.118 allows local users to gain privileges via shell metacharacters in command-line arguments, as demonstrated by the second argument in a down action.
CVE-2023-45268: WordPress Hitsteps Web Analytics Plugin <= 5.86 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in Hitsteps Hitsteps Web Analytics plugin <= 5.86 versions.
CVSS v3.1: 4.3
CVE-2025-26910: WordPress WPBookit plugin <= 1.0.1 - Cross Site Request Forgery (CSRF) Vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Iqonic Design WPBookit wpbookit allows Stored XSS.This issue affects WPBookit: from n/a through <= 1.0.1.
CVSS v3.1: 7.1
GHSA-q44w-9xjg-492g: An authenticated Zabbix Super Admin can exploit the oauth.authorize action to read arbitrary files from the webserver leading to potential confidentiality loss.
CVSS v4.0: 6.8
CVSS v3.1: 4.9
CVE-2022-3311: Use after free in import in Google Chrome prior to 106.0.5249.62 allowed a remote attacker who had compromised a WebUI process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVSS v3.1: 6.5
GHSA-wrq6-7947-r2fc: Zulip Desktop before 5.0.0 allows attackers to perform recording via the webcam and microphone due to a missing permission request handler.
CVE-2025-4677: Idle session timeout is not configured for multiple open ports
Insufficient Session Expiration vulnerability in ABB WebPro SNMP Card PowerValue, ABB WebPro SNMP Card PowerValue UL.This issue affects WebPro SNMP Card PowerValue: through 1.1.8.K; WebPro SNMP Card PowerValue UL: through 1.1.8.K.
CVSS v4.0: 7.1
CVSS v3.1: 6.5
CVE-2015-6494: Cross-site scripting (XSS) vulnerability in Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS v2.0: 3.5
CVE-2023-27479: Improper Neutralization of Directives in Dynamically Evaluated Code in org.xwiki.platform:xwiki-platform-panels-ui
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with view rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of UIX parameters. A proof of concept exploit is to log in, add an `XWiki.UIExtensionClass` xobject to the user profile page, with an Extension Parameters content containing `label={{/html}} {{async async="true" cached="false" context="doc.reference"}}{{groovy}}println("Hello " + "from groovy!"){{/groovy}}{{/async}}`. Then, navigating to `PanelsCode.ApplicationsPanelConfigurationSheet` (i.e., `<xwiki-host>/xwiki/bin/view/PanelsCode/ApplicationsPanelConfigurationSheet` where `<xwiki-host>` is the URL of your XWiki installation) should not execute the Groovy script. If it does, you will see `Hello from groovy!` displayed on the screen. This vulnerability has been patched in XWiki 13.10.11, 14.4.7 and 14.10-rc-1. Users are advised to upgrade. For users unable to upgrade the issue can be fixed by editing the `PanelsCode.ApplicationsPanelConfigurationSheet` wiki page and making the same modifications  as shown in commit `6de5442f3c`.
CVSS v3.1: 10
GHSA-5r6j-4xvp-4m98: A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause unexpected application termination or arbitrary code execution.
CVE-2020-3150: Cisco Small Business RV110W and RV215W Series Routers Information Disclosure Vulnerability
A vulnerability in the web-based management interface of Cisco Small Business RV110W and RV215W Series Routers could allow an unauthenticated, remote attacker to download sensitive information from the device, which could include the device configuration. The vulnerability is due to improper authorization of an HTTP request. An attacker could exploit this vulnerability by accessing a specific URI on the web-based management interface of the router, but only after any valid user has opened a specific file on the device since the last reboot. A successful exploit would allow the attacker to view sensitive information, which should be restricted.
CVSS v3.0: 5.9
GHSA-vxw6-rgvr-442h: An issue was discovered on LG GAMP-7100, GAPM-7200, and GAPM-8000 routers. An unauthenticated user can read a log file via an HTTP request containing its full pathname, such as http://192.168.0.1/var/gapm7100_${today's_date}.log for reading a filename such as gapm7100_190101.log.
CVSS v3.0: 7.5
GHSA-p49j-v9wc-wg57: OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation
ImpactOpenBao's namespaces provide multi-tenant separation. A tenant who leaks token accessors can have their token revoked or renewed by a privileged administrator in another tenant.PatchesThis was addressed in v2.5.3.
CVSS v4.0: 2
GHSA-pmf5-8vqq-p5xq: OpenSource Moddable v10.5.0 was discovered to contain a heap buffer overflow in the fx_ArrayBuffer function at /moddable/xs/sources/xsDataView.c.
GHSA-m3g8-6477-6hqh: Adobe Acrobat Reader versions 11.0.19 and earlier, 15.006.30280 and earlier, 15.023.20070 and earlier have an exploitable memory corruption vulnerability in the JPEG 2000 engine, related to image scaling. Successful exploitation could lead to arbitrary code execution.
CVSS v3.0: 7.8
GHSA-7mcc-hw35-pqwf: A NULL pointer dereference in TIFFClose() is caused by a failure to open an output file (non-existent path or a path that requires permissions like /dev/null) while specifying zones.
CVSS v3.1: 5.9
GHSA-cp8j-3rj5-xc54: A missing authentication for critical function vulnerability in the client application of Soar Cloud HRD Human Resource Management System through version 7.3.2025.0408 allows remote attackers to bypass authentication and access application functions.
CVSS v4.0: 9.3
CVSS v3.1: 7.5
CVE-2023-22385: Buffer Over-read in Data Modem
Memory Corruption in Data Modem while making a MO call or MT VOLTE call.
CVSS v3.1: 8.2
CVE-2024-1959: Social Sharing Plugin – Social Warfare <= 4.4.6.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
The Social Sharing Plugin – Social Warfare plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'socialWarfare' shortcode in all versions up to, and including, 4.4.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
GHSA-6vj2-4wv8-fm3g: Multiple eval injection vulnerabilities in phpScheduleIt before 1.2.11 allow remote attackers to execute arbitrary code via (1) the end_date parameter to reserve.php and (2) the start_date and end_date parameters to check.php.  NOTE: the start_date/reserve.php vector is already covered by CVE-2008-6132.
CVE-2024-52449: WordPress WordPress Bootscraper plugin <= 2.1.0 - Local File Inclusion vulnerability
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Navneil Naicer Bootscraper allows PHP Local File Inclusion.This issue affects Bootscraper: from n/a through 2.1.0.
CVSS v3.1: 7.5
CVE-2023-28871: Support Assistant in NCP Secure Enterprise Client before 12.22 allows attackers to read registry information of the operating system by creating a symbolic link.
CVSS v3.1: 4.3
CVE-2024-38744: WordPress Plum: Spin Wheel & Email Pop-up plugin <= 2.0 - Broken Access Control to Unauth Stored XSS vulnerability
Missing Authorization vulnerability in Upqode Plum: Spin Wheel & Email Pop-up allows Accessing Functionality Not Properly Constrained by ACLs, Stored XSS.This issue affects Plum: Spin Wheel & Email Pop-up: from n/a through 2.0.
CVSS v3.1: 8.3
CVE-2025-26977: WordPress FileBird plugin <= 6.4.2.1 - Insecure Direct Object References (IDOR) vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in Ninja Team Filebird filebird allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Filebird: from n/a through <= 6.4.2.1.
CVSS v3.1: 3.8
CVE-2018-0976: A denial of service vulnerability exists in Remote Desktop Protocol (RDP) when an attacker connects to the target system using RDP and sends specially crafted requests, aka "Windows Remote Desktop Protocol (RDP) Denial of Service Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
CVSS v3.0: 5.3
CVSS v2.0: 3.5
GHSA-p649-67j6-57xj: In several functions of libhevc, NEON registers are not preserved. This could lead to remote code execution as a privileged process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-68320413.
CVSS v3.0: 9.8
CVE-2008-0303: The FTP print feature in multiple Canon printers, including imageRUNNER and imagePRESS, allow remote attackers to use the server as an inadvertent proxy via a modified PORT command, aka FTP bounce.
CVSS v2.0: 6.4
GHSA-3rrh-rx2j-x9xj: CryptoPro CSP through 5.0.0.10004 on 64-bit platforms allows local users with the SeChangeNotifyPrivilege right to cause denial of service because user-mode input is mishandled during process creation.
GHSA-4r55-xrfw-ffx7: A race between command submission and destroying the context can cause an invalid context being added to the list leads to use after free issue. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVE-2016-8367: An issue was discovered in Schneider Electric Magelis HMI Magelis GTO Advanced Optimum Panels, all versions, Magelis GTU Universal Panel, all versions, Magelis STO5xx and STU Small panels, all versions, Magelis XBT GH Advanced Hand-held Panels, all versions, Magelis XBT GK Advanced Touchscreen Panels with Keyboard, all versions, Magelis XBT GT Advanced Touchscreen Panels, all versions, and Magelis XBT GTW Advanced Open Touchscreen Panels (Windows XPe). An attacker can open multiple connections to a targeted web server and keep connections open preventing new connections from being made, rendering the web server unavailable during an attack.
CVSS v3.1: 5.3
CVSS v2.0: 5
CVE-2026-4610: ProfileGrid <= 5.9.9.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Message Content
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pm_author_message' parameter in the pm_send_message_to_author function in all versions up to, and including, 5.9.9.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 5.9.8.5.
CVSS v3.1: 6.4
CVE-2014-9513: Insecure use of temporary files in xbindkeys-config 0.1.3-2 allows remote attackers to execute arbitrary code.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
GHSA-5v72-37vr-whgx: Gemalto DS3 Authentication Server 2.6.1-SP01 has Broken Access Control.
CVSS v3.0: 5.7
GHSA-3q63-vj3h-7j3f: A potential vulnerability in some Lenovo ThinkPads may allow an attacker to execute arbitrary code under SMM under certain circumstances.
CVE-2025-47214: QTS
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following versions:
QTS 5.2.6.3195 build 20250715 and later
  and later
CVSS v4.0: 5.1
RHSA-2010:0586: Red Hat Security Advisory: java-1.4.2-ibm-sap security update
OpenJDK Policy/PolicyFile leak dynamic ProtectionDomains. (6633872) OpenJDK File TOCTOU deserialization vulnerability (6736390) JDK unspecified vulnerability in JWS/Plugin component OpenJDK Inflater/Deflater clone issues (6745393) JDK unspecified vulnerability in JavaWS/Plugin component OpenJDK Unsigned applet can retrieve the dragged information before drop action occurs(6887703) OpenJDK Subclasses of InetAddress may incorrectly interpret network addresses (6893954) JDK multiple unspecified vulnerabilities OpenJDK Applet Trusted Methods Chaining Privilege Escalation Vulnerability (6904691) OpenJDK JPEGImageReader stepX Integer Overflow Vulnerability (6909597) JDK multiple unspecified vulnerabilities JDK multiple unspecified vulnerabilities JDK multiple unspecified vulnerabilities JDK unspecified vulnerability in ImageIO component OpenJDK ImagingLib arbitrary code execution vulnerability (6914866) OpenJDK AWT Library Invalid Index Vulnerability (6914823) JDK unspecified vulnerability in Java2D component
CVE-2025-57949: WordPress Ongkoskirim.id Plugin <= 1.0.6 - Broken Access Control Vulnerability
Missing Authorization vulnerability in oggix Ongkoskirim.id ongkoskirim-id allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ongkoskirim.id: from n/a through <= 1.0.6.
CVSS v3.1: 5.4