ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2025-61662: Grub2: missing unregister call for gettext command may lead to use-after-free
A Use-After-Free vulnerability has been discovered in GRUB's gettext module. This flaw stems from a programming error where the gettext command remains registered in memory after its module is unloaded. An attacker can exploit this condition by invoking the orphaned command, causing the application to access a memory location that is no longer valid. An attacker could exploit this vulnerability to cause grub to crash, leading to a Denial of Service. Possible data integrity or confidentiality compromise is not discarded.
CVSS v3.1: 7.8
GHSA-rqq5-gcp2-265q: Double free vulnerability in Microsoft Silverlight 4 before 4.1.10329 on Windows allows remote attackers to execute arbitrary code via vectors involving crafted XAML glyphs, aka "Silverlight Double-Free Vulnerability."
GHSA-jj93-39pf-7mcf: bsock uses weak hashing algorithms
An issue was discovered in the bsock component of bcoin-org bcoin that allows remote attackers to obtain sensitive information via weak hashing algorithms in the component `\vendor\faye-websocket.js`.
CVSS v3.1: 9.1
CVE-2023-33168: Remote Procedure Call Runtime Denial of Service Vulnerability
Remote Procedure Call Runtime Denial of Service Vulnerability
CVSS v3.1: 6.5
GHSA-g7g5-m39g-mq22: Cross-site scripting (XSS) vulnerability in magpie_debug.php in the Twitter Feed plugin (wp-twitter-feed) 0.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the url parameter.
GHSA-4j2c-2fj7-7484: The device management command line interface (CLI) in Palo Alto Networks PAN-OS before 5.0.18, 5.1.x before 5.1.11, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5H2 allows remote authenticated administrators to execute arbitrary OS commands via an SSH command parameter.
CVSS v3.0: 7.2
GHSA-qgv2-2pw8-fjr2: Linux kernel 2.6.x up to 2.6.18 and possibly other versions, when SELinux hooks are enabled, allows local users to cause a denial of service (crash) via a malformed file stream that triggers a NULL pointer dereference in the superblock_doinit function, as demonstrated using an HFS filesystem image.
GHSA-hp83-c299-g76q: Microsoft Office Visio Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2023-21736, CVE-2023-21737.
CVSS v3.1: 7.1
GHSA-6hc4-3gwh-58rx: DesignMasterEvents Conference management 1.0.0 allows SQL Injection via the username field on the administrator login page.
GHSA-266w-wvvg-f3wv: A path traversal vulnerability exists in the ZIP extraction API of Zdir Pro 4.x. When a crafted ZIP archive is processed by the backend at /api/extract, files may be written outside the intended directory, leading to arbitrary file overwrite and potentially remote code execution
CVSS v3.1: 9.1
RHSA-2025:1663: Red Hat Security Advisory: kpatch-patch-4_18_0-305_120_1, kpatch-patch-4_18_0-305_138_1, and kpatch-patch-4_18_0-305_145_1 security update
kernel: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format
CVSS v3.1: 7.3
GHSA-5fmr-qwxj-xjcc: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Soflyy WP Dynamic Links allows Reflected XSS. This issue affects WP Dynamic Links: from n/a through 1.0.1.
CVSS v3.1: 7.1
GHSA-c29g-q3h3-mwcf: xxl-rpc deserialization vulnerability
xxl-rpc v1.7.0 was discovered to contain a deserialization vulnerability via the component `com.xxl.rpc.core.remoting.net.impl.netty.codec.NettyDecode#decode`.
CVSS v3.1: 9.8
GHSA-q7m5-gr49-2535: Tenda i12 V1.0.0.10(3805) was discovered to contain a buffer overflow via the list parameter in the formwrlSSIDset function.
CVSS v3.1: 9.8
GHSA-j2qh-h5rr-gq8f: The Nespresso (aka com.nespresso.activities) application 2.4.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2026-29516: Buffalo TeraStation TS5400R Excessive File Permissions Information Disclosure
Buffalo TeraStation NAS TS5400R firmware version 4.02-0.06 and prior contain an excessive file permissions vulnerability that allows authenticated attackers to read the /etc/shadow file by uploading and executing a PHP file through the webserver. Attackers can exploit world-readable permissions on /etc/shadow to retrieve hashed passwords for all configured accounts including root.
CVSS v4.0: 6.9
CVSS v3.1: 4.9
CVE-2025-40908: YAML-LibYAML prior to 0.903.0 for Perl uses 2-args open, allowing existing files to be modified
YAML-LibYAML prior to 0.903.0 for Perl uses 2-args open, allowing existing files to be modified
CVSS v3.1: 9.1
CVE-2017-10129: Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is Prior to 5.1.24. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
CVSS v3.0: 8.8
CVSS v2.0: 4.6
CVE-2008-6970: SQL injection vulnerability in dosearch.inc.php in UBB.threads 7.3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the Forum[] array parameter.
CVSS v2.0: 7.5
GHSA-j425-whc4-4jgc: OpenClaw's `system.run` env override filtering allowed dangerous helper-command pivots
Summary`system.run` env override sanitization allowed dangerous override-only helper-command pivots to reach subprocesses. A caller who could invoke `system.run` with `env` overrides could bypass allowlist/approval intent by steering an allowlisted tool through helper-command or config-loading environment variables such as `GIT_SSH_COMMAND`, editor/pager hooks, and `GIT_CONFIG_*` / `NPM_CONFIG_*`.Affected Packages / VersionsPackage: `openclaw` (npm)Latest published vulnerable version: `2026.3.2`Affected range: `<= 2026.3.2`Patched in: `2026.3.7`DetailsBefore the fix, `src/infra/host-env-security.ts` blocked only a narrow set of override-only environment variables. Dangerous request-scoped overrides such as `GIT_SSH_COMMAND` and prefix families such as `GIT_CONFIG_*` and `NPM_CONFIG_*` could still survive `sanitizeSystemRunEnvOverrides(...)` / `sanitizeHostExecEnv(...)` and reach the spawned process.That mattered for `system.run` allowlist and approval flows because approval evaluation was tied to the reviewed binary/argv, while the launched process could still inherit attacker-controlled env overrides that changed helper-command execution or config resolution. For allowlisted tools such as `git`, this allowed behavior outside the reviewed command semantics.The fix extends the shared TypeScript and macOS policy to block dangerous override-only exact keys and prefixes while preserving trusted inherited base-environment behavior.ImpactThis is a real protection-bypass issue, but exploitation requires an already tool-enabled caller who can invoke `system.run` and supply `env` overrides. In affected deployments, that caller could bypass allowlist/approval intent and trigger helper-command execution or config-loading behavior that is not represented by the approved command line. Maintainer severity is set to medium because the bug still requires that existing execution capability; the vulnerability is the mismatch between reviewed command semantics and the actual spawned-process behavior.Fix Commit(s)`e27bbe4982439da6864160fd1b66445058f74801`Release Process Notenpm `2026.3.7` was published on March 8, 2026. This advisory is fixed in the released package.Thanks @tdjackey and @SnailSploit for reporting.
CVSS v3.1: 6.3
CVE-2018-3230: Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). The supported version that is affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology and unauthorized read access to a subset of Oracle Outside In Technology accessible data. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H).
CVSS v3.0: 7.1
CVSS v2.0: 5.8
GHSA-rfpv-q7vr-v94r: In the Linux kernel, the following vulnerability has been resolved:drm/meson: fix shutdown crash when component not probedWhen main component is not probed, by example when the dw-hdmi module is
not loaded yet or in probe defer, the following crash appears on shutdown:Unable to handle kernel NULL pointer dereference at virtual address 0000000000000038
...
pc : meson_drv_shutdown+0x24/0x50
lr : platform_drv_shutdown+0x20/0x30
...
Call trace:
meson_drv_shutdown+0x24/0x50
platform_drv_shutdown+0x20/0x30
device_shutdown+0x158/0x360
kernel_restart_prepare+0x38/0x48
kernel_restart+0x18/0x68
__do_sys_reboot+0x224/0x250
__arm64_sys_reboot+0x24/0x30
...Simply check if the priv struct has been allocated before using it.
CVSS v3.1: 5.5
CVE-2022-31195: Path traversal vulnerability in Simple Archive Format package import in DSpace
DSpace open source software is a repository application which provides durable access to digital resources. In affected versions the ItemImportServiceImpl is vulnerable to a path traversal vulnerability. This means a malicious SAF (simple archive format) package could cause a file/directory to be created anywhere the Tomcat/DSpace user can write to on the server. However, this path traversal vulnerability is only possible by a user with special privileges (either Administrators or someone with command-line access to the server). This vulnerability impacts the XMLUI, JSPUI and command-line. Users are advised to upgrade. As a basic workaround, users may block all access to the following URL paths: If you are using the XMLUI, block all access to /admin/batchimport path (this is the URL of the Admin Batch Import tool). Keep in mind, if your site uses the path "/xmlui", then you'd need to block access to /xmlui/admin/batchimport. If you are using the JSPUI, block all access to /dspace-admin/batchimport path (this is the URL of the Admin Batch Import tool). Keep in mind, if your site uses the path "/jspui", then you'd need to block access to /jspui/dspace-admin/batchimport. Keep in mind, only an Administrative user or a user with command-line access to the server is able to import/upload SAF packages. Therefore, assuming those users do not blindly upload untrusted SAF packages, then it is unlikely your site could be impacted by this vulnerability.
CVSS v3.1: 7.2
GHSA-f2wx-gx4j-3mvc: The pie-register plugin before 3.1.2 for WordPress has SQL injection, a different issue than CVE-2018-10969.
CVSS v3.0: 9.8
GHSA-6845-xw22-ffxv: Vyper sha3 codegen bug
SummaryThere is an error in the stack management when compiling the `IR` for `sha3_64`. Concretely, the `height` variable is miscalculated.
The vulnerability can't be triggered without writing the `IR` by hand. That is, it cannot be triggered from regular vyper code, it can only be triggered by using the `fang` binary directly (this binary used to be called `vyper-ir` prior to v0.3.4).DetailsTo compile `sha3_64`, the `arg[0]` and `arg[1]` have to be compiled:
https://github.com/vyperlang/vyper/blob/c150fc49ee9375a930d177044559b83cb95f7963/vyper/ir/compile_ir.py#L585-L586As can be seen, after compiling the 0th arg, the `height` variable isn't increased. If new `withargs` are defined in the inner scope, they are manipulated correctly, because both their `height` is off and also the global `height` is off and thus their placement on the stack is computed correctly.`sha3_64` is used for retrieval in mappings. No flow that would cache the `key` was found, the issue shouldn't be possible to trigger when compiling the compiler-generated `IR`.PoCSuppose the following hand-written IR:after compilation:It can be seen that the second `DUP` will dup the item on the top of the stack which is incorrect.PatchesPatched in https://github.com/vyperlang/vyper/pull/4063.ImpactVersions v0.2.0-v0.3.10 were evaluated, and access of the variable with the invalid height is not reachable from IR generated by the vyper front-end. Because the issue isn't triggered during normal compilation of vyper code, the impact is considered low.
CVSS v3.1: 3.7
GHSA-3vc4-p4vg-f376: Squid 2.5, when processing the configuration file, parses empty Access Control Lists (ACLs), including proxy_auth ACLs without defined auth schemes, in a way that effectively removes arguments, which could allow remote attackers to bypass intended ACLs if the administrator ignores the parser warnings.
CVE-2026-3495: Unescaped variables during error page composition
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to escape some variables that could contain malicious content during error page composition which allows an attacker with access to edit some site configuration to execute some malicious code via injecting some JS as part of those values.. Mattermost Advisory ID: MMSA-2026-00622
CVSS v3.1: 3.8
GHSA-xx8x-hq3h-f37h: HVM guest I/O port accesses are subject to either emulation or at least
translation.  Translations are managed by the device model (via
XEN_DOMCTL_ioport_mapping), and hence the linked list used may changed
at any time.  Traversal of those lists (while handling guest I/O port
accesses) therefore needs synchronizing with updates, which was missing
so far.
CVSS v3.1: 7.9
GHSA-46p4-p677-cfjc: Subscriber PHP Object Injection in Entrepreneur - Booking for Small Businesses WordPress Theme <= 3.1.3 versions.
CVSS v3.1: 8.8
CVE-2026-22365: WordPress Soleng theme <= 1.0.5 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Soleng soleng allows PHP Local File Inclusion.This issue affects Soleng: from n/a through <= 1.0.5.
CVSS v3.1: 8.1
GHSA-9224-3c6r-p6p8: IBM DB2 for Linux, UNIX and Windows 9.7, 10,1, 10.5, and 11.1 (includes DB2 Connect Server) could allow a local user to obtain elevated privilege and overwrite DB2 files. IBM X-Force ID: 128180.
CVSS v3.0: 7.8
GHSA-7m3r-9jw9-j2rw: Microsoft Outlook Information Disclosure Vulnerability
CVSS v3.1: 6.5
GHSA-3rq3-6pw2-f97f: A buffer copy without checking size of input ('classic buffer overflow') in Fortinet  FortiMail webmail and administrative interface version 6.4.0 through 6.4.4 and before 6.2.6 and FortiNDR administrative interface version 7.2.0 and before 7.1.0 allows an authenticated attacker with regular webmail access to trigger a buffer overflow and to possibly execute unauthorized code or commands via specifically crafted HTTP requests.
CVSS v3.1: 4.7
CVE-2021-47018: powerpc/64: Fix the definition of the fixmap area
In the Linux kernel, the following vulnerability has been resolved:

powerpc/64: Fix the definition of the fixmap area

At the time being, the fixmap area is defined at the top of
the address space or just below KASAN.

This definition is not valid for PPC64.

For PPC64, use the top of the I/O space.

Because of circular dependencies, it is not possible to include
asm/fixmap.h in asm/book3s/64/pgtable.h , so define a fixed size
AREA at the top of the I/O space for fixmap and ensure during
build that the size is big enough.
CVSS v3.1: 5.5
CVE-2016-1979: Use-after-free vulnerability in the PK11_ImportDERPrivateKeyInfoAndReturnKey function in Mozilla Network Security Services (NSS) before 3.21.1, as used in Mozilla Firefox before 45.0, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted key data with DER encoding.
CVSS v3.0: 8.8
CVSS v2.0: 6.8
CVE-2023-43739: Online Book Store Project v1.0 - Unauthenticated SQL Injection (SQLi)
The 'bookisbn' parameter of the cart.php resource

does not validate the characters received and they

are sent unfiltered to the database.




CVSS v3.1: 9.8
CVE-2025-12518: Stored XSS in beefree.io
beefree.io SDK is vulnerable to Stored XSS in Social Media icon URL parameter in email builder functionality. Malicious attacker can inject arbitrary HTML and JS into template, which will be rendered/executed when visiting preview page. However due to beefree's Content Security Policy not all payloads will execute successfully.












































This issue has been fixed in version 3.47.0.
CVSS v4.0: 5.3
RHSA-2013:0511: Red Hat Security Advisory: pki-core security, bug fix and enhancement update
System: Multiple cross-site scripting flaws by displaying CRL or processing profile
CVE-2018-19894: ThinkCMF X2.2.2 has SQL Injection via the functions check() and delete() in CommentadminController.class.php and is exploitable with the manager privilege via the ids[] parameter in a commentadmin action.
CVSS v3.0: 7.2
CVSS v2.0: 6.5
CVE-2026-10560: Unauthenticated Access to Private Flow Build Events and Cancellation in Langflow OSS
IBM Langflow OSS 1.0.0 through 1.9.6 contains a missing authentication vulnerability in /api/v1/build_public_tmp/ endpoints that allows an unauthenticated attacker to read build event data or cancel jobs using a valid job identifier, resulting in information disclosure and denial of service.
CVSS v3.1: 8.2
CVE-2024-25443: An issue in the HuginBase::ImageVariable<double>::linkWith function of Hugin v2022.0.0 allows attackers to cause a heap-use-after-free via parsing a crafted image.
CVSS v3.1: 7.8
GHSA-2w9c-67cj-fxpp: IBM Sterling Partner Engagement Manager 6.1.2, 6.2.0, and 6.2.2 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  262174.
CVSS v3.1: 6.4
CVE-2016-7219: The Crypto driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows local users to obtain sensitive information via a crafted application, aka "Windows Crypto Driver Information Disclosure Vulnerability."
CVSS v3.0: 5.5
CVSS v2.0: 2.1
GHSA-2mgx-6c3j-cxmq: MUTE 0.4 allows remote attackers to cause a denial of service (messages not forwarded) and obtain sensitive information about a target by filling a client's mWebCache cache with malicious "zombie" nodes.
GHSA-hw3m-77jf-6j9f: The ThinkPal (aka com.mythinkpalapp) application 1.6.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
GHSA-2j7g-cpcm-93qx: In JetBrains TeamCity before 2023.11.3 path traversal allowed reading data within JAR archives
CVSS v3.1: 5.3
GHSA-h3r2-qmh3-6432: In the module "Import/Update Bulk Product from any Csv/Excel File Pro" (ba_importer) up to version 1.1.28 from Buy Addons for PrestaShop, a guest can perform SQL injection in affected versions.
CVSS v3.1: 9.8
CVE-2024-4102: Pricing Table <= 2.0.1 - Missing Authorization
The Pricing Table plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajax() function in all versions up to, and including, 2.0.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform unauthorized actions like editing pricing tables.
CVSS v3.1: 5.4
GHSA-2gcx-5j95-fccj: The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 4.0.26 via the proxy_image() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
CVSS v3.1: 7.5
GHSA-wmq5-p9j9-jfgx: Exposure of sensitive information to an unauthorized actor in Windows Snipping Tool allows an unauthorized attacker to perform spoofing over a network.
CVSS v3.1: 4.3
CVE-2006-3141: Cross-site scripting (XSS) vulnerability in details.cfm in Tradingeye Shop R4 and earlier allows remote attackers to inject arbitrary web script or HTML via the image parameter.
CVSS v2.0: 4.3
GHSA-4fcw-pq4r-f4q7: Server-Side Request Forgery in Spinnaker Orca
The Spinnaker template resolution functionality is vulnerable to Server-Side Request Forgery (SSRF), which allows an attacker to send requests on behalf of Spinnaker potentially leading to sensitive data disclosure.
CVSS v3.1: 7.5
GHSA-9p3j-8vjx-24pq: Unauthenticated Insecure Direct Object References (IDOR) in Payment Gateway Based Fees and Discounts for WooCommerce <= 3.0.0 versions.
CVSS v3.1: 6.5
CVE-2026-27286: InDesign Desktop | Heap-based Buffer Overflow (CWE-122)
InDesign Desktop versions 20.5.2, 21.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 5.5
CVE-2023-2177: A null pointer dereference issue was found in the sctp network protocol in net/sctp/stream_sched.c in Linux Kernel. If stream_in allocation is failed, stream_out is freed which would further be accessed. A local user could use this flaw to crash the system or potentially cause a denial of service.
CVSS v3.1: 5.5
GHSA-q65w-fc7h-2r6w: VMware vRealize Log Insight in versions prior to 8.8.2 contain a stored cross-site scripting vulnerability due to improper input sanitization in configurations.
CVSS v3.1: 5.4
GHSA-h4pm-64vv-f6qq: Vulnerability in the Oracle iLearning product of Oracle iLearning (component: Learner Pages). The supported version that is affected is 6.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iLearning. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle iLearning, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle iLearning accessible data. CVSS 3.0 Base Score 4.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N).
CVSS v3.1: 4.7
RHSA-2006:0602: Red Hat Security Advisory: wireshark security update (was ethereal)
security flaw security flaw security flaw security flaw security flaw security flaw
GHSA-8j6x-r8x6-r4vg: The issue was addressed with improved memory handling. This issue is fixed in tvOS 16.1, iOS 15.7.1 and iPadOS 15.7.1, macOS Ventura 13, watchOS 9.1, iOS 16.1 and iPadOS 16, macOS Monterey 12.6.1, macOS Big Sur 11.7.1. Parsing a maliciously crafted audio file may lead to disclosure of user information.
CVSS v3.1: 5.5
CVE-2003-0554: NeoModus Direct Connect 1.0 build 9, and possibly other versions, allows remote attackers to cause a denial of service (connection and possibly memory exhaustion) via a flood of ConnectToMe requests containing arbitrary IP addresses and ports.
CVSS v2.0: 5
CVE-2022-46829: In JetBrains JetBrains Gateway before 2022.3 a client could connect without a valid token if the host consented.
CVSS v3.1: 7.1