ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-3hwv-x5p9-3h2h: In Bluetooth, there is a possible way to pair a display only device without PIN confirmation due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-222289114
CVSS v3.1: 3.3
CVE-2021-28436: Windows Speech Runtime Elevation of Privilege Vulnerability
Windows Speech Runtime Elevation of Privilege Vulnerability
CVSS v3.1: 7.8
GHSA-88qr-cjgj-jggp: Crash in the pcapng file parser in Wireshark 3.6.0 allows denial of service via crafted capture file
CVSS v3.1: 5.5
CVE-2021-20269: A flaw was found in the permissions of a log file created by kexec-tools. This flaw allows a local unprivileged user to read this file and leak kernel internal information from a previous panic. The highest threat from this vulnerability is to confidentiality. This flaw affects kexec-tools shipped by Fedora versions prior to 2.0.21-8 and RHEL versions prior to 2.0.20-47.
CVSS v3.1: 5.5
CVSS v2.0: 2.1
GHSA-8j8g-6gw9-rjrf: NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may lead to remote code execution across the enterprise because PhysicalDiscovery has cleartext credentials).
CVSS v3.1: 8.6
GHSA-983r-2hc3-66xw: Multiple stack-based buffer overflows in the nvd_exec function in HP Radia Notify Daemon 3.1.2.0 (formerly by Novadigm), and other versions including 2.x, 3.x, and 4.x, allows remote attackers to execute arbitrary code via a command with crafted parameters to a RADEXECD process.
GHSA-r35w-45w2-c732: Use after free in Microsoft Office Visio allows an unauthorized attacker to execute code locally.
CVSS v3.1: 7.8
GHSA-2wj4-5wq5-7h63: SQL injection vulnerability in forum.php in Prozilla Forum allows remote attackers to execute arbitrary SQL commands via the forum parameter.
GHSA-rf42-mr6f-fxjw: Unrestricted Upload of File with Dangerous Type vulnerability in Themify Shopo allows Upload a Web Shell to a Web Server.This issue affects Shopo: from n/a through 1.1.4.
CVSS v3.1: 9.9
CVE-2022-1601: User Access Manager < 2.2.18 - IP Spoofing
The User Access Manager WordPress plugin before 2.2.18 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible for attackers to access restricted content in certain situations.
CVSS v3.1: 5.3
CVE-2006-3274: Directory traversal vulnerability in Webmin before 1.280, when run on Windows, allows remote attackers to read arbitrary files via \ (backslash) characters in the URL to certain directories under the web root, such as the image directory.
CVSS v2.0: 5
GHSA-8pwj-3gh6-824j: The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919 Confidential attribute disclosure vi LDAP filters was insufficient and an attacker may be able to obtain confidential BitLocker recovery keys from a Samba AD DC.
CVSS v3.1: 6.5
GHSA-p4c6-vgj5-cp35: There is a misconfiguration vulnerability inside the Infotainment ECU manufactured by BOSCH. The vulnerability happens during the startup phase of a specific systemd service, and as a result, the following developer features will be activated: the disabled firewall and the launched SSH server.First identified on Nissan Leaf ZE1 manufactured in 2020.
CVSS v3.1: 6.8
GHSA-2w8p-mpf2-3mcq: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bamboo Mcr Bamboo Columns allows Stored XSS.This issue affects Bamboo Columns: from n/a through 1.6.1.
CVSS v3.1: 6.5
GHSA-6v85-wr92-q4p7: Denial of Service (DoS) Vulnerability Due to Unsafe Array Modification in Multi-threaded Environment
SummaryAn attacker can exploit a critical flaw in the application to initiate a Denial of Service (DoS) attack, rendering the application inoperable and affecting all users. The issue arises from unsafe manipulation of an array in a multi-threaded environment.DetailsThe vulnerability is rooted in the application's code, where an array is being modified while it is being iterated over. This is a classic programming error but becomes critically unsafe when executed in a multi-threaded environment. When two threads interact with the same array simultaneously, the application crashes.The core issue is located in [expireOldFailedAttempts](https://github.com/argoproj/argo-cd/blob/54601c8fd30b86a4c4b7eb449956264372c8bde0/util/session/sessionmanager.go#L302-L311) function:The function modifies the array while iterating it which means the code will cause an error and crash the application pod, inspecting the logs just before the crash we can confirm:PoCTo reproduce the vulnerability, you can use the following steps:Launch the application.Trigger the code path that results in the `expireOldFailedAttempts()` function being called in multiple threads.In the attached PoC script we are restarting the server in a while loop, causing the application to be unresponsive at all.ImpactThis is a Denial of Service (DoS) vulnerability. Any attacker can crash the application continuously, making it impossible for legitimate users to access the service. The issue is exacerbated because it does not require authentication, widening the pool of potential attackers.
CVSS v3.1: 7.5
CVE-2021-31941: Microsoft Office Graphics Remote Code Execution Vulnerability
Microsoft Office Graphics Remote Code Execution Vulnerability
CVSS v3.1: 7.8
GHSA-8j9h-w9v6-cwxj: Cross-site scripting (XSS) vulnerability in system/class_link.php in the System module (module_system) in Kajona before 4.5 allows remote attackers to inject arbitrary web script or HTML via the systemid parameter in a mediaFolder action to index.php.
CVE-2022-44039: Franklin Fueling System FFS Colibri 1.9.22.8925 is affected by: File system overwrite. The impact is: File system rewrite (remote). ¶¶ An attacker can overwrite system files like [system.conf] and [passwd], this occurs because the insecure usage of "fopen" system function with the mode "wb" which allows overwriting file if exists. Overwriting files such as passwd, allows an attacker to escalate his privileges by planting backdoor user with root privilege or change root password.
CVSS v3.1: 9.8
CVE-2005-2672: pwmconfig in LM_sensors before 2.9.1 creates temporary files insecurely, which allows local users to overwrite arbitrary files via a symlink attack on the fancontrol temporary file.
CVSS v2.0: 2.1
RHSA-2014:0285: Red Hat Security Advisory: kernel security, bug fix, and enhancement update
kernel: exec/ptrace: get_dumpable() incorrect tests kernel: ipc: ipc_rcu_putref refcount races kernel: xen: hypercalls exposed to privilege rings 1 and 2 of HVM guests Kernel: qeth: buffer overflow in snmp ioctl Kernel: AACRAID Driver compat IOCTL missing capability check hw: AMD CPU erratum may cause core hang Kernel: net: leakage of uninitialized memory to user-space via recv syscalls
CVE-2025-11778: Stack-based buffer overflow vulnreability in Circutor SGE-PLC1000/SGE-PLC50
Stack-based buffer overflow in Circutor SGE-PLC1000/SGE-PLC50 v0.9.2. This vulnerability allows an attacker to remotely exploit memory corruption through the 'read_packet()' function of the TACACSPLUS implementation.
CVSS v4.0: 10
GHSA-97gj-q9fx-vc88: In the Linux kernel, the following vulnerability has been resolved:kfence: fix memory leak when cat kfence objectsHulk robot reported a kmemleak problem:I find that we can easily reproduce this problem with the following
commands:The leaked memory is allocated in the stack below:And it should have been released in the following process:However, the release function corresponding to file_operations is not
implemented in kfence.  As a result, a memory leak occurs.  Therefore,
the solution to this problem is to implement the corresponding release
function.
CVSS v3.1: 3.3
GHSA-fpv6-vj3v-hf55: In bta_hl_sdp_query_results of bta_hl_main.cc, there is a possible use-after-free due to a race condition. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-116222069.
CVSS v3.0: 7.5
CVE-2025-68169: netpoll: Fix deadlock in memory allocation under spinlock
In the Linux kernel, the following vulnerability has been resolved:

netpoll: Fix deadlock in memory allocation under spinlock

Fix a AA deadlock in refill_skbs() where memory allocation while holding
skb_pool->lock can trigger a recursive lock acquisition attempt.

The deadlock scenario occurs when the system is under severe memory
pressure:

1. refill_skbs() acquires skb_pool->lock (spinlock)
2. alloc_skb() is called while holding the lock
3. Memory allocator fails and calls slab_out_of_memory()
4. This triggers printk() for the OOM warning
5. The console output path calls netpoll_send_udp()
6. netpoll_send_udp() attempts to acquire the same skb_pool->lock
7. Deadlock: the lock is already held by the same CPU

Call stack:
  refill_skbs()
    spin_lock_irqsave(&skb_pool->lock)    <- lock acquired
    __alloc_skb()
      kmem_cache_alloc_node_noprof()
        slab_out_of_memory()
          printk()
            console_flush_all()
              netpoll_send_udp()
                skb_dequeue()
                  spin_lock_irqsave(&skb_pool->lock)     <- deadlock attempt

This bug was exposed by commit 248f6571fd4c51 ("netpoll: Optimize skb
refilling on critical path") which removed refill_skbs() from the
critical path (where nested printk was being deferred), letting nested
printk being called from inside refill_skbs()

Refactor refill_skbs() to never allocate memory while holding
the spinlock.

Another possible solution to fix this problem is protecting the
refill_skbs() from nested printks, basically calling
printk_deferred_{enter,exit}() in refill_skbs(), then, any nested
pr_warn() would be deferred.

I prefer this approach, given I _think_ it might be a good idea to move
the alloc_skb() from GFP_ATOMIC to GFP_KERNEL in the future, so, having
the alloc_skb() outside of the lock will be necessary step.

There is a possible TOCTOU issue when checking for the pool length, and
queueing the new allocated skb, but, this is not an issue, given that
an extra SKB in the pool is harmless and it will be eventually used.
GHSA-j57f-4436-x29r: Multiple SQL injection vulnerabilities in index.php in phPhotoGallery 0.92 allow remote attackers to execute arbitrary SQL commands via the (1) Username and (2) Password fields.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVE-2017-12623: An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity (XXE) attack. The fix to properly handle XML External Entities was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the appropriate release.
CVSS v3.0: 6.5
CVSS v2.0: 4
CVE-2025-49719: Microsoft SQL Server Information Disclosure Vulnerability
Improper input validation in SQL Server allows an unauthorized attacker to disclose information over a network.
CVSS v3.1: 7.5
GHSA-wv3w-mmpc-4v7x: The llcp_sock_recvmsg function in net/nfc/llcp/sock.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable and a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
CVE-2012-3699: WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-09-12-1.
CVSS v2.0: 6.8
GHSA-8m6g-88w4-cv35: An issue has been discovered in ROS2 Iron Irwini ROS_VERSION 2 and ROS_PYTHON_VERSION 3, where the system transmits messages in plaintext. This flaw exposes sensitive information, making it vulnerable to man-in-the-middle (MitM) attacks, and allowing attackers to intercept and access this data.
CVE-2025-53964: GoldenDict 1.5.0 and 1.5.1 has an exposed dangerous method that allows reading and modifying files when a user adds a crafted dictionary and then searches for any term included in that dictionary.
CVSS v3.1: 9.6
CVE-2015-3116: Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow remote attackers to bypass the Same Origin Policy via unspecified vectors, a different vulnerability than CVE-2014-0578, CVE-2015-3115, CVE-2015-3125, and CVE-2015-5116.
CVSS v2.0: 5
GHSA-44g7-cc5h-5758: A buffer overflow issue was discovered in the HMI3 Control Panel contained within the Swisslog Healthcare Nexus Panel, operated by released versions of software before Nexus Software 7.2.5.7. A buffer overflow allows an attacker to overwrite an internal queue data structure and can lead to remote code execution.
RHSA-2020:0851: Red Hat Security Advisory: python-virtualenv security update
python-requests: Redirect from HTTPS to HTTP does not remove Authorization header python-urllib3: Cross-host redirect does not remove Authorization header allow for credential exposure python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on internal service
CVSS v3.0: 6.5
CVE-2022-35450: OTFCC v0.10.4 was discovered to contain a heap-buffer overflow via /release-x64/otfccdump+0x6b84b1.
CVSS v3.1: 6.5
GHSA-mcvh-v2vq-2ch7: The MKDQUOTESAFE function in the Fan-out driver scripts in Fan-Out Platform Services in Novell Identity Manager (aka IDM) 4.0.2 allows local users to execute arbitrary commands by leveraging eDirectory POSIX attribute changes to insert shell metacharacters.
CVE-2026-23842: ChatterBot has Denial of Service via Database Connection Pool Exhaustion
ChatterBot is a machine learning, conversational dialog engine for creating chat bots. ChatterBot versions up to 1.2.10 are vulnerable to a denial-of-service condition caused by improper database session and connection pool management. Concurrent invocations of the get_response() method can exhaust the underlying SQLAlchemy connection pool, resulting in persistent service unavailability and requiring a manual restart to recover. Version 1.2.11 fixes the issue.
CVSS v3.1: 7.5
GHSA-fj23-324q-fvx7: ** DISPUTED **  NOTE: this issue has been disputed by the vendor.  Buffer overflow in the PKI Web Service in Check Point Firewall-1 PKI Web Service allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long (1) Authorization or (2) Referer HTTP header to TCP port 18624.  NOTE: the vendor has disputed this issue, stating "Check Point Security Alert Team has analyzed this report. We've tried to reproduce the attack on all VPN-1 versions from NG FP2 and above with and without HFAs. The issue was not reproduced. We have conducted a thorough analysis of the relevant code and verified that we are secure against this attack. We consider this attack to pose no risk to Check Point customers."  In addition, the original researcher, whose reliability is unknown as of 20090407, also states that the issue "was discovered during a pen-test where the client would not allow further analysis."
CVE-2014-9135: The PackageInstaller module in Huawei P7-L10 smartphones before V100R001C00B136 allows remote attackers to spoof the origin website and bypass the website whitelist protection mechanism via a crafted package.
CVSS v2.0: 4.3
GHSA-pgmw-x2p2-4698: A flaw has been found in Fabian Ros/SourceCodester Simple E-Banking System 1.0. This affects an unknown part. This manipulation causes cross-site request forgery. The attack may be initiated remotely. The exploit has been published and may be used.
CVSS v4.0: 2.1
CVSS v3.1: 4.3
CVE-2023-33056: NULL Pointer dereference in WLAN Firmware
Transient DOS in WLAN Firmware when firmware receives beacon including T2LM IE.
CVSS v3.1: 7.5
GHSA-3x56-fp32-hw97: If the Remote Debugging via USB feature was enabled in Firefox for Android on an Android version prior to Android 6.0, untrusted apps could have connected to the feature and operated with the privileges of the browser to read and interact with web content. The feature was implemented as a unix domain socket, protected by the Android SELinux policy; however, SELinux was not enforced for versions prior to 6.0. This was fixed by removing the Remote Debugging via USB feature from affected devices. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 83.
GHSA-9m2m-729g-q827: Unapproved TrustZone applications can be loaded and executed in Snapdragon Mobile in version SD 845, SD 850
CVSS v3.0: 7.8
GHSA-m8rm-pc2x-rqv9: In the Linux kernel, the following vulnerability has been resolved:net/mlx5: Fix error path in multi-packet WQE transmitRemove the erroneous unmap in case no DMA mapping was establishedThe multi-packet WQE transmit code attempts to obtain a DMA mapping for
the skb. This could fail, e.g. under memory pressure, when the IOMMU
driver just can't allocate more memory for page tables. While the code
tries to handle this in the path below the err_unmap label it erroneously
unmaps one entry from the sq's FIFO list of active mappings. Since the
current map attempt failed this unmap is removing some random DMA mapping
that might still be required. If the PCI function now presents that IOVA,
the IOMMU may assumes a rogue DMA access and e.g. on s390 puts the PCI
function in error state.The erroneous behavior was seen in a stress-test environment that created
memory pressure.
CVSS v3.1: 5.5
CVE-2014-4219: Unspecified vulnerability in Oracle Java SE 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.
CVSS v2.0: 9.3
CVE-2025-58576: Cross-site request forgery vulnerability exists in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession ZION prior to ver5.3.2. If a user accesses a malicious page while logged in, unintended operations may be performed.
CVSS v4.0: 5.1
CVSS v3.0: 4.3
GHSA-4gm7-r4jp-2xqg: GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user with developer-role permissions to modify protected environment settings due to improper authorization checks in the API.
CVSS v3.1: 4.3
GHSA-8phj-c26v-2jj9: SchedMD Slurm before 24.05.4 has Incorrect Authorization. A mistake in authentication handling in stepmgr could permit an attacker to execute processes under other users' jobs. This is limited to jobs explicitly running with --stepmgr, or on systems that have globally enabled stepmgr via SlurmctldParameters=enable_stepmgr in their configuration.
CVSS v3.1: 5
CVE-2021-33509: Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script.
CVSS v3.1: 9.9
CVSS v2.0: 8.5
GHSA-9jx5-6pgf-crrp: Withdrawn: scipy memory leak vulnerability
Withdrawn AdvisoryThis advisory has been withdrawn because it has been found to not be an issue. Please see the issue [here](https://github.com/scipy/scipy/issues/16235#issuecomment-1625361328) for more information.Original DescriptionA refcounting issue which leads to potential memory leak was discovered in scipy commit 8627df31ab in `Py_FindObjects()` function.
CVSS v3.1: 5.5
GHSA-3qmw-8xgv-p6c8: Multiple PHP remote file inclusion vulnerabilities in X-Cart allow remote attackers to execute arbitrary PHP code via a URL in the xcart_dir parameter to (1) config.php, (2) prepare.php, (3) smarty.php, (4) customer/product.php, (5) provider/auth.php, and (6) admin/auth.php.
GHSA-7g97-7r3c-5cc6: In Quarkus, git credentials could be inadvertently published
A vulnerability was found in Quarkus. In certain conditions related to the CI process, git credentials could be inadvertently published, which could put the git repository at risk.
CVSS v3.1: 3.5
GHSA-rxx7-9cxm-4hfx: Local users can start Sendmail in daemon mode and gain root privileges.
CVE-2017-11299: An issue was discovered in Adobe Digital Editions 4.5.6 and earlier versions. An exploitable memory corruption vulnerability exists, which could lead to disclosure of memory addresses.
CVSS v3.0: 5.3
CVSS v2.0: 5
GHSA-69m2-cj73-p6pp: A vulnerability has been found in Dromara lamp-cloud up to 5.6.2. Impacted is the function GroovyClassLoader.parseClass of the component Message Template Handler. Such manipulation of the argument DefMsgTemplate.content leads to improper neutralization of special elements used in a template engine. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 2.1
CVSS v3.1: 6.3
CVE-2005-4294: Cross-site scripting (XSS) vulnerability in Alkacon OpenCms before 6.0.3 allows remote attackers to inject arbitrary web script or HTML via the username in the login page.
CVSS v2.0: 4.3
GHSA-34g2-p88j-292j: Directory traversal vulnerability in the Arcade Games (com_arcadegames) component 1.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
GHSA-jp4p-4h79-8h9g: Cross-site scripting (XSS) vulnerability in WebcamXP PRO v2.16.468 and earlier allows remote attackers to inject arbitrary web script or HTML via the chat name, as demonstrated by using an IFRAME to redirect users to other sites.
GHSA-wcx3-6934-f759: A router's routing tables can be obtained from arbitrary hosts.
CVE-2008-3233: Cross-site scripting (XSS) vulnerability in WordPress before 2.6, SVN development versions only, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS v2.0: 4.3
GHSA-pxv4-3wmh-64pg: An HTML Injection Vulnerability in iOrder 1.0 allows the remote attacker to execute Malicious HTML codes via the signup form
CVSS v3.1: 5.3
GHSA-c9c6-4cqp-gq48: The Sentinels Randomizer (aka com.mikehipps.sentinelsrandomizer) application 1.1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2020-5279: Improper Access Control for certain legacy controller in PrestaShop
In PrestaShop between versions 1.5.0.0 and 1.7.6.5, there are improper access control since the the version 1.5.0.0 for legacy controllers. - admin-dev/index.php/configure/shop/customer-preferences/ - admin-dev/index.php/improve/international/translations/ - admin-dev/index.php/improve/international/geolocation/ - admin-dev/index.php/improve/international/localization - admin-dev/index.php/configure/advanced/performance - admin-dev/index.php/sell/orders/delivery-slips/ - admin-dev/index.php?controller=AdminStatuses The problem is fixed in 1.7.6.5
CVSS v3.1: 4.1
GHSA-fv4g-gwpj-74gr: Path traversal vulnerability in stripe-cli
ImpactA vulnerability exists in stripe-cli versions 1.11.1 and higher where a plugin package containing a manifest with a malformed plugin shortname installed using the --archive-url or --archive-path flags can overwrite arbitrary files.The update addresses the path traversal vulnerability by removing the ability to install plugins from an archive URL or path.There has been no evidence of exploitation of this vulnerability.RecommendationUpgrade to stripe-cli v1.21.3.AcknowledgementsThank you to [0xacb](https://hackerone.com/0xacb) and [bordiez](https://hackerone.com/bordiez) for reporting this vulnerability.For more informationEmail us at [security@stripe.com](mailto:security@stripe.com)
CVSS v4.0: 2.4
CVSS v3.1: 7.5