ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2026-40062: A path Traversal vulnerability exists in Ziostation2 v2.9.8.7 and earlier. A remote unauthenticated attacker may get sensitive information on the operating system.
CVSS v4.0: 8.7
CVSS v3.0: 7.5
CVE-2026-41278: Flowise: Public chatflow endpoints return unsanitized flowData including plaintext API keys, passwords, and credential IDs
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the GET /api/v1/public-chatflows/:id endpoint returns the full chatflow object without sanitization for public chatflows. Docker validation revealed this is worse than initially assessed: the sanitizeFlowDataForPublicEndpoint function does NOT exist in the released v3.0.13 Docker image. Both public-chatflows AND public-chatbotConfig return completely raw flowData including credential IDs, plaintext API keys, and password-type fields. This vulnerability is fixed in 3.1.0.
CVSS v4.0: 8.7
CVE-2023-23906: Missing authentication for critical function exists in SkyBridge MB-A100/110 firmware Ver. 4.2.0 and earlier, which may allow a remote unauthenticated attacker to execute some critical functions without authentication, e.g., rebooting the product.
CVSS v3.1: 7.5
CVE-2021-47289: ACPI: fix NULL pointer dereference
In the Linux kernel, the following vulnerability has been resolved:

ACPI: fix NULL pointer dereference

Commit 71f642833284 ("ACPI: utils: Fix reference counting in
for_each_acpi_dev_match()") started doing "acpi_dev_put()" on a pointer
that was possibly NULL.  That fails miserably, because that helper
inline function is not set up to handle that case.

Just make acpi_dev_put() silently accept a NULL pointer, rather than
calling down to put_device() with an invalid offset off that NULL
pointer.
CVSS v3.1: 5.5
GHSA-428c-jvg5-r285: In the Linux kernel, the following vulnerability has been resolved:batman-adv: fix tp_meter counter underflow during shutdownbatadv_tp_sender_shutdown() unconditionally decrements the "sending"
atomic counter. If multiple paths (e.g. timeout, user cancel, and
normal finish) call this function, the counter can underflow to -1.Since the sender logic treats any non-zero value as "still sending",
a negative value causes the sender kthread to loop indefinitely.
This leads to a use-after-free when the interface is removed while
the zombie thread is still active.Fix this by using atomic_xchg() to ensure the counter only transitions
from 1 to 0 once.[sven: added missing change in batadv_tp_send]
CVSS v3.1: 7.8
GHSA-7g22-749p-gwv4: Heap-based buffer overflow in the jpc_dec_decodepkt function in jpc_t2dec.c in JasPer 2.0.10 allows remote attackers to have unspecified impact via a crafted image.
CVSS v3.0: 7.8
CVE-2014-7553: The GET NYCE Lightworks (aka com.wGETNYCE) application 0.84.13506.98953 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0: 5.4
CVE-2024-36956: thermal/debugfs: Free all thermal zone debug memory on zone removal
In the Linux kernel, the following vulnerability has been resolved:

thermal/debugfs: Free all thermal zone debug memory on zone removal

Because thermal_debug_tz_remove() does not free all memory allocated for
thermal zone diagnostics, some of that memory becomes unreachable after
freeing the thermal zone's struct thermal_debugfs object.

Address this by making thermal_debug_tz_remove() free all of the memory
in question.

Cc :6.8+ <stable@vger.kernel.org> # 6.8+
CVSS v3.1: 5.5
GHSA-xg7c-hpj9-r697: Recovery Mode in Apple iPhone OS 1.0 through 3.1.2, and iPhone OS for iPod touch 1.1 through 3.1.2, allows physically proximate attackers to bypass device locking, and read or modify arbitrary data, via a USB control message that triggers memory corruption.
GHSA-j8pp-q5m4-fqpf: Stored XSS in TIBCO ActiveMatrix Administrator allows malicious data to appear to be part of the website and run within user's browser under the privileges of the web application.
CVSS v4.0: 7
GHSA-f993-f86j-2hw6: The Unify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'init' action in all versions up to, and including, 3.4.9. This makes it possible for unauthenticated attackers to delete specific plugin options via the 'unify_plugin_downgrade' parameter.
CVSS v3.1: 5.3
GHSA-qqmj-3x2j-j469: Cross-site scripting (XSS) vulnerability in Aruba Networks ClearPass Policy Manager (CPPM) before 6.4.5 allows remote attackers to inject arbitrary web script or HTML via the username parameter to tips/tipsLoginSubmit.action.
GHSA-g8r4-p96j-xfxc: Grav's Twig processing allowing dangerous PHP functions by default
ImpactTwig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. 
As the Twig processor runs unsandboxed, this behavior can be used to gain arbitrary code execution and elevate privileges on the instance.PatchesThe issue was addressed by preventing dangerous functions from being called in Twig templates. A configuration option has been added to manually allow arbitrary PHP functions (`system.twig.safe_functions`) and filters (`system.twig.safe_filters`).Futures major versions of Grav may disable this functionality by default.WorkaroundsBlocking access to the `/admin` path from untrusted sources will reduce the probability of exploitation.Referenceshttps://portswigger.net/research/server-side-template-injectionhttps://blog.sonarsource.com/grav-cms-code-execution-vulnerabilitiesFor more informationIf you have any questions or comments about this advisory, you can contact:The original reporters, by sending an email to vulnerability.research [at] sonarsource.com;The maintainers, by opening an issue on this repository.
CVSS v3.1: 8.4
GHSA-mc4x-r58f-6h93: Unsanitized user-input in Calibre <= 7.15.0 allow users with permissions to perform full-text searches to achieve SQL injection on the SQLite database.
CVSS v3.1: 4.2
GHSA-388c-p23g-jwxp: Cross-Site Request Forgery (CSRF) vulnerability in Mediavine Mediavine Control Panel plugin <= 2.10.2 versions.
CVSS v3.1: 4.3
RHSA-2026:14162: Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.9.3 release
libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file() systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages github.com/apache/thrift: Apache Thrift: Integer Overflow in TFramedTransport Go implementation
CVSS v3.1: 7.5
RHSA-2022:5050: Red Hat Security Advisory: .NET 6.0 security and bugfix update
dotnet: NuGet Credential leak due to loss of control of third party symbol server domain
CVSS v3.1: 5
CVE-2012-5569: Multiple cross-site scripting (XSS) vulnerabilities in the Basic webmail module 6.x-1.x before 6.x-1.2 for Drupal allow remote attackers to inject arbitrary web script or HTML via a (1) page title or (2) crafted email message.
CVSS v2.0: 4.3
CVE-2023-7234: Integration Objects OPC UA Server Toolkit Improper Output Neutralization for Logs

OPCUAServerToolkit will write a log message once an OPC UA client has successfully connected containing the client's self-defined description field.


CVSS v3.1: 5.3
CVE-2026-20701: An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to connect to a network share without user consent.
CVSS v3.1: 7.5
GHSA-4429-qgp7-2cwq: The SMTP for Sendinblue – YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 7.2
GHSA-mqfj-275x-jhp4: A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists in Andover Continuum (All versions), which could cause files on the application server filesystem to be viewable when an attacker interferes with an application's processing of XML data.
GHSA-cgpj-vcc9-76qx: A missing address check in the callers of the show_opcodes() in the Linux kernel allows an attacker to dump the kernel memory at an arbitrary kernel address into the dmesg log.
CVSS v3.0: 5.5
CVE-2021-32801: Exceptions may have logged Encryption-at-Rest key content in Nextcloud server
Nextcloud server is an open source, self hosted personal cloud. In affected versions logging of exceptions may have resulted in logging potentially sensitive key material for the Nextcloud Encryption-at-Rest functionality. It is recommended that the Nextcloud Server is upgraded to 20.0.12, 21.0.4 or 22.1.0. If upgrading is not an option users are advised to disable system logging to resolve this issue until such time that an upgrade can be performed Note that ff you do not use the Encryption-at-Rest functionality of Nextcloud you are not affected by this bug.
CVSS v3.1: 5.5
GHSA-3pgc-xqg9-cfr6: FacturaScripts Vulnerable to Remote Code Execution (RCE) via Zip Slip in Plugin Upload Mechanism
SummaryA Critical vulnerability exists in the `Plugins::add()` function. The system fails to properly validate the file paths within uploaded ZIP archives. This allows an attacker to perform a Zip Slip attack, leading to Arbitrary File Write and Remote Code Execution (RCE) by overwriting sensitive .php files outside the designated plugins directory.DetailsThe vulnerability is located in Plugins.php. While the `testZipFile` function attempts to validate that the ZIP contains only one root folder, it does not sanitize or validate the individual file paths within that folder.An attacker can bypass this check by naming a file `ValidPluginName/../../shell.php`. The explode function will see ValidPluginName as the root folder, satisfying the `count($folders) != 1` check. However, during extraction, the `../../` sequence triggers a path traversal, allowing the file to be written anywhere the web server has permissions the root directory.PoCPrepare Malicious ZIP: Use a tool (like evilarc) or a script to create a ZIP file where one of the entries is named: `MyPlugin/../../rce.php`
Inject Payload: Inside rce.php, put a simple shell: `<?php system($_GET['cmd']); ?>`
Upload: Navigate to the "Add Plugin" section in FacturaScripts and upload the malicious ZIP.
Execution: Access the shell via https://target.com/rce.php?cmd=whoami.ImpactConfidentiality: High (Attacker can read all database configs and files).
Integrity: High (Attacker can modify any file on the server).
Availability: High (Attacker can delete the entire installation).https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-27891.md
CVSS v3.1: 7.2
GHSA-vcr7-q7v7-v84f: RPC Endpoint Mapper Service Elevation of Privilege Vulnerability
CVSS v3.1: 7.8
GHSA-rfhr-9452-8362: An issue was discovered in Subsonic 6.1.1. The radio settings are affected by three stored cross-site scripting vulnerabilities in the name[x], streamUrl[x], homepageUrl[x] parameters (where x is an integer) to internetRadioSettings.view that could be used to steal session information of a victim.
CVSS v3.0: 6.1
cisco-sa-onprem-fmc-authbypass-5JPp45V2: Cisco Secure Firewall Management Center Software Authentication Bypass  Vulnerability
A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.

This vulnerability is due to an improper system process that is created at boot time. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute a variety of scripts and commands that allow root access to the device.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.



This advisory is part of the March 2026 release of the Cisco Secure Firewall ASA, Secure FMC, and Secure FTD Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: March 2026 Semiannual Cisco Secure Firewall ASA, Secure FMC, and Secure FTD Software Security Advisory Bundled Publication ["https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75736"].
CVSS v3.1: 10
GHSA-hqfx-22r8-m3gq: A vulnerability has been identified in JT2Go (All versions < V13.2), Solid Edge SE2021 (All Versions < SE2021MP5), Teamcenter Visualization (All versions < V13.2). The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13427)
CVSS v3.1: 7.8
CVE-2026-42565: @workos/authkit-session: Open Redirect via state-derived redirect target
@workos/authkit-session is a toolkit for building WorkOS AuthKit framework integrations. Prior to 0.5.1, an open redirect vulnerability exists in AuthService.handleCallback due to insufficient validation of the returnPathname value derived from the OAuth state parameter. The state parameter is round-tripped through the identity provider (IdP) and can be influenced by an attacker. The handleCallback function decodes and returns returnPathname without enforcing restrictions on origin or scheme. As a result, attacker-controlled values may be returned to the application. If this value is used directly in a redirect, it may cause the user to be redirected to an external, attacker-controlled site. This vulnerability is fixed in 0.5.1.
CVSS v3.1: 4.3
CVE-2025-38695: scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure
In the Linux kernel, the following vulnerability has been resolved:

scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure

If a call to lpfc_sli4_read_rev() from lpfc_sli4_hba_setup() fails, the
resultant cleanup routine lpfc_sli4_vport_delete_fcp_xri_aborted() may
occur before sli4_hba.hdwqs are allocated.  This may result in a null
pointer dereference when attempting to take the abts_io_buf_list_lock for
the first hardware queue.  Fix by adding a null ptr check on
phba->sli4_hba.hdwq and early return because this situation means there
must have been an error during port initialization.
CVSS v3.1: 5.5
CVE-2020-12714: An issue was discovered in CipherMail Community Gateway Virtual Appliances and Professional/Enterprise Gateway Virtual Appliances versions 1.0.1 through 4.7.1-0 and CipherMail Webmail Messenger Virtual Appliances 1.1.1 through 3.1.1-0. A Diffie-Hellman parameter of insufficient size could allow man-in-the-middle compromise of communications between CipherMail products and external SMTP clients.
CVSS v3.1: 5.9
CVSS v2.0: 4.3
CVE-2022-35482: OTFCC v0.10.4 was discovered to contain a segmentation violation via /release-x64/otfccdump+0x65f724.
CVSS v3.1: 6.5
CVE-2004-1364: Directory traversal vulnerability in extproc in Oracle 9i and 10g allows remote attackers to access arbitrary libraries outside of the $ORACLE_HOME\bin directory.
CVSS v2.0: 8.5
CVE-2021-39982: Phone Manager application has a Improper Privilege Management vulnerability.Successful exploitation of this vulnerability may read and write arbitrary files by tampering with Phone Manager notifications.
CVSS v3.1: 9.1
CVSS v2.0: 6.4
GHSA-g37q-26qx-8v2m: Denial of service in Apache OpenMeetings
Attackers can use public NetTest web service of Apache OpenMeetings 4.0.0-5.0.0 to organize denial of service attack.
CVSS v3.1: 7.5
CVE-2022-21151: Processor optimization removal or modification of security-critical code for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
CVSS v3.1: 5.5
CVSS v2.0: 2.1
GHSA-wxh8-r72r-87rc: A security vulnerability has been detected in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. This affects the function Query of the file /MemoryState.do?Action=Query. The manipulation of the argument orderField leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 2.1
CVSS v3.1: 6.3
GHSA-7vcc-qhc2-h2xw: ShowMojo MojoBox Digital Lockbox 1.4 is vulnerable to Authentication Bypass. The implementation of the lock opening mechanism via Bluetooth Low Energy (BLE) is vulnerable to replay attacks. A malicious user is able to intercept BLE requests and replicate them to open the lock at any time. Alternatively, an attacker with physical access to the device on which the Android app is installed, can obtain the latest BLE messages via the app logs and use them for opening the lock.
CVSS v3.1: 8.1
GHSA-5mvv-g3g9-g2pc: There is an XML External Entity (XXE) Processing Vulnerability in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3.
CVSS v3.0: 9.8
GHSA-7m6v-2369-j7f2: This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of URLs. The issue results from the lack of proper routing of URLs. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-9618.
CVSS v3.1: 6.5
CVE-2023-48707: Cleartext Storage of Sensitive Information in codeigniter4/shield
CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4. The `secretKey` value is an important key for HMAC SHA256 authentication and in affected versions was stored in the database in cleartext form. If a malicious person somehow had access to the data in the database, they could use the key and secretKey for HMAC SHA256 authentication to send requests impersonating that corresponding user. This issue has been addressed in version 1.0.0-beta.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS v3.1: 5
CVE-2017-1357: IBM Maximo Asset Management 7.5 and 7.6 could allow an authenticated user to manipulate work orders to forge emails which could be used to conduct further advanced attacks. IBM X-Force ID: 126684.
CVSS v3.0: 4.3
CVSS v2.0: 4
GHSA-p83q-cg3p-77f9: Mozilla Firefox before 3.6 Beta 3 does not properly handle overlong UTF-8 encoding, which makes it easier for remote attackers to bypass cross-site scripting (XSS) protection mechanisms via a crafted string, a different vulnerability than CVE-2010-1210.
CVE-2017-17698: Zoho ManageEngine Password Manager Pro 9 before 9.4 (9400) has reflected XSS in SearchResult.ec and BulkAccessControlView.ec.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
CVE-2024-2757: PHP mb_encode_mimeheader runs endlessly for some inputs
In PHP 8.3.* before 8.3.5, function mb_encode_mimeheader() runs endlessly for some inputs that contain long strings of non-space characters followed by a space. This could lead to a potential DoS attack if a hostile user sends data to an application that uses this function.
CVSS v3.1: 7.5
CVE-2024-50482: WordPress Woocommerce Product Design plugin <= 1.0.0 - Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in Chetan Khandla Woocommerce Product Design woo-product-design allows Upload a Web Shell to a Web Server.This issue affects Woocommerce Product Design: from n/a through <= 1.0.0.
CVSS v3.1: 10
GHSA-fh8g-8q9x-xp22: Certain NETGEAR devices are affected by command injection by an unauthenticated attacker via the vulnerable /sqfs/lib/libsal.so.0.0 library used by a CGI application, as demonstrated by setup.cgi?token=';$HTTP_USER_AGENT;' with an OS command in the User-Agent field. This affects GC108P before 1.0.7.3, GC108PP before 1.0.7.3, GS108Tv3 before 7.0.6.3, GS110TPPv1 before 7.0.6.3, GS110TPv3 before 7.0.6.3, GS110TUPv1 before 1.0.4.3, GS710TUPv1 before 1.0.4.3, GS716TP before 1.0.2.3, GS716TPP before 1.0.2.3, GS724TPPv1 before 2.0.4.3, GS724TPv2 before 2.0.4.3, GS728TPPv2 before 6.0.6.3, GS728TPv2 before 6.0.6.3, GS752TPPv1 before 6.0.6.3, GS752TPv2 before 6.0.6.3, MS510TXM before 1.0.2.3, and MS510TXUP before 1.0.2.3.
CVE-2020-36213: An issue was discovered in the abi_stable crate before 0.9.1 for Rust. A retain call can create an invalid UTF-8 string, violating soundness.
CVSS v3.1: 7.5
CVSS v2.0: 5
GHSA-5mh4-7gw5-hc9f: WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 firewall.cgi has no filtering on parameter add_mac, which leads to command injection in page /cli_black_list.shtml.
CVSS v3.1: 9.8
GHSA-5wwr-98rp-48m6: Insertion of Sensitive Information into Log File vulnerability in Hitachi Ops Center Administrator allows local users to gain sensitive information.This issue affects Hitachi Ops Center Administrator: before 11.0.1.
CVSS v3.1: 4.4
GHSA-4xgg-2822-f2cq: Cross-Site Request Forgery (CSRF) vulnerability in Hometory Mang Board WP plugin <= 1.7.6 versions.
CVSS v3.1: 4.3
CVE-2018-1229: Pivotal Spring Batch Admin, all versions, contains a stored XSS vulnerability in the file upload feature. An unauthenticated malicious user with network access to Spring Batch Admin could store an arbitrary web script that would be executed by other users. This issue has not been patched because Spring Batch Admin has reached end of life.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
CVE-2024-30210: IOSIX IO-1020 Micro ELD Use of Default Credentials
IO-1020 Micro ELD uses a default WIFI password that could allow an adjacent attacker to connect to the device.


CVSS v3.1: 7.4
GHSA-jgpv-x984-755x: Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the domain parameter to /manage/smtpscan/domainrouting/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.
CVSS v4.0: 5.1
CVSS v3.1: 6.4
CVE-2016-6710: An information disclosure vulnerability in the download manager in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-11-01, and 7.0 before 2016-11-01 could enable a local malicious application to bypass operating system protections that isolate application data from other applications. This issue is rated as High because it could be used to gain access to data that the application does not have access to. Android ID: A-30537115.
CVSS v3.0: 5.5
CVSS v2.0: 4.3
GHSA-hv4c-v8j8-54cw: Cross-Site Request Forgery in JFinalCMS via /admin/nav/save
JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/nav/save.
CVSS v3.1: 8.8
GHSA-hg46-3v5v-rp73: Unspecified vulnerability in Microsoft Register Server (REGSVR) allows attackers to cause a denial of service via a crafted DLL library.