ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-p976-h52c-26p6: Rancher vulnerable to Privilege Escalation via manipulation of Secrets
ImpactA vulnerability has been identified which enables [Standard users](https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions) or above to elevate their permissions to Administrator in the `local` cluster.The `local` cluster means the cluster where Rancher is installed. It is named `local` inside the list of clusters in the Rancher UI.Standard users could leverage their existing permissions to manipulate Kubernetes secrets in the `local` cluster, resulting in the secret being deleted, but their read-level permissions to the secret being preserved. When this operation was followed-up by other specially crafted commands, it could result in the user gaining access to tokens belonging to service accounts in the `local` cluster.Users that have custom global roles which grant `create` and `delete` permissions on `secrets` would also be able to exploit this vulnerability.Users with [audit logs enabled](https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/enable-api-audit-log#enabling-api-audit-log) in Rancher can try to identify possible abuses of this issue by going through the logs. To sieve through the data filter by `kind: Secret` with `type: provisioning.cattle.io/cloud-credential`, then investigate all log entries that affect that specific resource. A secondary check would be to filter by all operations with `Opaque` Secrets within the `cattle-global-data` namespace.After patching, it is recommended that users review access methods to Rancher (including RBAC policies, tokens, and host-level node access), to ensure that no changes were made to persist access to users who have leveraged this vulnerability.PatchesPatched versions include releases `2.6.13`, `2.7.4` and later versions.WorkaroundsThere is no direct mitigation besides updating Rancher to a patched version.For more informationIf you have any questions or comments about this advisory:Reach out to the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.Open an issue in the [Rancher](https://github.com/rancher/rancher/issues/new/choose) repository.Verify with our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/).
CVSS v4.0: 9.4
CVSS v3.1: 9.9
GHSA-xf96-32q2-9rw2: Rails ActiveRecord gem vulnerable to SQL injection
Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) `:limit` and (2) `:offset` parameters, related to ActiveRecord, ActiveSupport, ActiveResource, ActionPack, and ActionMailer.
GHSA-64cx-r798-x2v6: Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.2 and earlier allows remote code execution via unspecified vectors, a different vulnerability than CVE-2017-2181 and CVE-2017-2182.
CVSS v3.0: 8.8
GHSA-qrf2-8jcf-fv7v: In the Linux kernel, the following vulnerability has been resolved:i3c: mipi-i3c-hci: Mask ring interrupts before ring stop requestBus cleanup path in DMA mode may trigger a RING_OP_STAT interrupt when
the ring is being stopped. Depending on timing between ring stop request
completion, interrupt handler removal and code execution this may lead
to a NULL pointer dereference in hci_dma_irq_handler() if it gets to run
after the io_data pointer is set to NULL in hci_dma_cleanup().Prevent this my masking the ring interrupts before ring stop request.
CVSS v3.1: 5.5
CVE-2022-35712: Adobe ColdFusion ODBC Agent Heap-based Buffer Overflow Remote Code Execution Vulnerability
Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, the vulnerability is triggered when a crafted network packet is sent to the server.
CVSS v3.1: 9.8
CVE-2023-5837: AlexanderLivanov FotosCMS2 Cookie profile.php cross site scripting
A vulnerability classified as problematic was found in AlexanderLivanov FotosCMS2 up to 2.4.3. This vulnerability affects unknown code of the file profile.php of the component Cookie Handler. The manipulation of the argument username leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-243802 is the identifier assigned to this vulnerability.
CVSS v3.1: 3.5
CVSS v3.0: 3.5
CVSS v2.0: 4
GHSA-655c-g9rr-96vv: Cross-Site Request Forgery (CSRF) vulnerability in WPGraphQL allows Cross Site Request Forgery.This issue affects WPGraphQL: from n/a through 2.5.3.
CVSS v3.1: 5.4
CVE-2006-6363: Cross-site scripting (XSS) vulnerability in admin.pl in BlueSocket Secure Controller (BSC) before 5.2, or without 5.1.1-BluePatch, allows remote attackers to inject arbitrary web script or HTML via the ad_name parameter.
CVSS v2.0: 6.8
CVE-2012-3700: WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-09-12-1.
CVSS v2.0: 6.8
CVE-2017-12232: A vulnerability in the implementation of a protocol in Cisco Integrated Services Routers Generation 2 (ISR G2) Routers running Cisco IOS 15.0 through 15.6 could allow an unauthenticated, adjacent attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to a misclassification of Ethernet frames. An attacker could exploit this vulnerability by sending a crafted Ethernet frame to an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Cisco Bug IDs: CSCvc03809.
CVSS v3.1: 6.5
CVSS v2.0: 6.1
GHSA-mfh8-885w-h39j: A security vulnerability has been detected in SourceCodester Online Student File Management System 1.0. This impacts an unknown function of the file /remove_file.php. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
CVSS v4.0: 2.1
CVSS v3.1: 6.3
GHSA-x5f7-m6j9-3793: TCMAN GIM is vulnerable to a lack of authorization in all available webservice methods listed in /PC/WebService.asmx. The exploitation of this vulnerability might allow a remote attacker to obtain information.
GHSA-7ph5-f3jm-j978: Subrion CMS 4.2.1 allows _core/en/contacts/ XSS via the name, email, or phone parameter.
CVSS v3.0: 6.1
CVE-2020-13802: Rebar3 versions 3.0.0-beta.3 to 3.13.2 are vulnerable to OS command injection via URL parameter of dependency specification.
CVSS v3.1: 9.8
CVSS v2.0: 10
CVE-2022-38277: JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/folderrollpicture/list.
CVSS v3.1: 7.2
GHSA-g8hm-3653-6gm8: IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .pdf file, related to a "Read Access Violation starting at PDF!xmlParserInputRead+0x0000000000132e19."
CVSS v3.0: 7.8
GHSA-hg2r-4969-58rf: SQL injection in Ivanti Avalanche before version 6.4.8.8008 allows a remote authenticated attacker with admin privileges to execute arbitrary SQL queries. In certain conditions, this can also lead to remote code execution
CVSS v3.1: 7.2
GHSA-92c9-98gg-94f4: A vulnerability was found in yzcheng90 X-SpringBoot up to 5.0 and classified as critical. Affected by this issue is the function uploadApk of the file /sys/oss/upload/apk of the component APK File Handler. The manipulation of the argument File leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 2.1
CVSS v3.1: 6.3
GHSA-mr82-8j83-vxmv: Pydantic regular expression denial of service
Regular expression denial of service in Pydantic < 2.4.0, < 1.10.13 allows remote attackers to cause denial of service via a crafted email string.
CVSS v3.1: 5.9
RHSA-2007:0892: Red Hat Security Advisory: krb5 security update
krb5 incomplete fix for CVE-2007-3999
PYSEC-2026-132: SimpleEval is a library for adding evaluatable expressions into python projects. Prior to 1.0.5, objects (including modules) can leak dangerous modules through to direct access inside the sandbox. If the objects you've passed in as names to SimpleEval have modules or other disallowed / dangerous objects available as attrs. Additionally, dangerous functions or modules could be accessed by passing them as callbacks to other safe functions to call. The latest version 1.0.5 has this issue fixed. This vulnerability is fixed in 1.0.5.
CVSS v3.1: 9.8
GHSA-4hch-v4cq-frwf: In some cases the MCPD binary cache in F5 BIG-IP devices may allow a user with Advanced Shell access, or privileges to generate a qkview, to temporarily obtain normally unrecoverable information.
CVSS v3.0: 5.5
GHSA-g4wf-pjgv-xrc5: Failed login response could be different depending on whether the username was local or central.
CVSS v3.1: 3.7
GHSA-8547-8823-m279: In HDP Server versions below 4.6.2.2978 on Linux, unauthorized access could occur via IP spoofing using the X-Forwarded-For header.Since XFF is a client-controlled header, it could be spoofed, allowing unauthorized access if the spoofed IP matched a whitelisted range.This vulnerability could be exploited to bypass IP restrictions, though valid user credentials would still be required for resource access.
CVSS v3.1: 8.4
GHSA-x88h-4vmv-82q6: A vulnerability in the processing of traffic matching a firewall filter containing a syslog action in Juniper Networks Junos OS on MX Series with MPC10/MPC11 cards installed, PTX10003 and PTX10008 Series devices, will cause the line card to crash and restart, creating a Denial of Service (DoS). Continued receipt and processing of packets matching the firewall filter can create a sustained Denial of Service (DoS) condition. When traffic hits the firewall filter, configured on lo0 or any physical interface on the line card, containing a term with a syslog action (e.g. 'term <name> then syslog'), the affected line card will crash and restart, impacting traffic processing through the ports of the line card. This issue only affects MX Series routers with MPC10 or MPC11 line cards, and PTX10003 or PTX10008 Series packet transport routers. No other platforms or models of line cards are affected by this issue. Note: This issue has also been identified and described in technical service bulletin TSB17931 (login required). This issue affects: Juniper Networks Junos OS on MX Series: 19.3 versions prior to 19.3R3-S2; 19.4 versions prior to 19.4R3-S2; 20.1 versions prior to 20.1R3; 20.2 versions prior to 20.2R2-S2, 20.2R3; 20.3 versions prior to 20.3R3; 20.4 versions prior to 20.4R2. Juniper Networks Junos OS Evolved on PTX10003, PTX10008: All versions prior to 20.4R2-EVO. This issue does not affect Juniper Networks Junos OS versions prior to 19.3R1.
RHSA-2026:23264: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping net/textproto: golang: Golang net/textproto: Misleading error messages via input injection golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation
CVSS v3.1: 7.1
GHSA-c34r-h49j-vq6w: A vulnerability in a subset of REST APIs of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow an authenticated, low-privileged, remote attacker to conduct a blind SQL injection attack.This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to an affected API. A successful exploit could allow the attacker to view data in some database tables on an affected device.
CVSS v3.1: 4.3
GHSA-fghm-wqfv-q8ch: The WP HTML Mail plugin for WordPress is vulnerable to HTML injection in versions up to, and including, 2.2.10 due to insufficient input sanitization. This makes it possible for unauthenticated attackers to inject arbitrary HTML in pages that execute if they can successfully trick a administrator into performing an action such as clicking on a link.
CVSS v3.1: 5.4
GHSA-332p-2wcc-qg7j: Buffer overflow in AIX writesrv command allows local users to obtain root access.
GHSA-rjx7-v6g9-8g3m: An unauthenticated remote attacker can modify configurations to perform a remote code execution due to a missing authentication for a critical function.
CVSS v3.1: 9.8
GHSA-r4xp-gcm2-3943: The Avada (Fusion) Builder plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.11.12 via the handle_clone_post() function and the 'fusion_blog' shortcode and due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to.
CVSS v3.1: 4.3
GHSA-6hvh-jp5m-5p5j: The Logo Slider  WordPress plugin before 3.6.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS v3.1: 4.8
CVE-2025-57601: AiKaan Cloud Controller uses a single hardcoded SSH private key and the username `proxyuser` for remote terminal access to all managed IoT/edge devices. When an administrator initiates "Open Remote Terminal" from the AiKaan dashboard, the controller sends this same static private key to the target device. The device then uses it to establish a reverse SSH tunnel to a remote access server, enabling browser-based SSH access for the administrator. Because the same `proxyuser` account and SSH key are reused across all customer environments: - An attacker who obtains the key (e.g., by intercepting it in transit, extracting it from the remote access server, or from a compromised admin account) can impersonate any managed device. - They can establish unauthorized reverse SSH tunnels and interact with devices without the owner's consent. This is a design flaw in the authentication model: compromise of a single key compromises the trust boundary between the controller and devices.
CVSS v3.1: 9.8
CVE-2022-23161: Dell PowerScale OneFS versions 8.2.x - 9.3.0.x contain a denial-of-service vulnerability in SmartConnect. An unprivileged network attacker may potentially exploit this vulnerability, leading to denial-of-service.
CVSS v3.1: 7.5
CVE-2026-54360: MISP sharing group creation mass assignment allows unauthorized takeover of existing sharing groups
A mass assignment vulnerability exists in MISP’s sharing group creation endpoint. When creating a new sharing group, the controller did not remove a user-supplied id field before saving the submitted data. In CakePHP, supplying a primary key in the save data can cause a create() followed by save() operation to update an existing record instead of creating a new one.

An authenticated user with permission to add sharing groups could therefore submit the identifier of an existing sharing group and modify that sharing group without passing the normal edit access-control checks. This may allow the attacker to take over or alter sharing groups they do not otherwise have access to, potentially affecting the confidentiality and integrity of information shared through those groups.

Affected component:
app/Controller/SharingGroupsController.php, add() action
CVSS v4.0: 8.4
RHSA-2021:0299: Red Hat Security Advisory: thunderbird security update
Mozilla: IMAP Response Injection when using STARTTLS Mozilla: HTTPS pages could have been intercepted by a registered service worker when they should not have been Mozilla: Cross-origin information leakage via redirected PDF requests Mozilla: Type confusion when using logical assignment operators in JavaScript switch statements Mozilla: Use-after-poison for incorrectly redeclared JavaScript variables during GC Mozilla: Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7
CVSS v3.1: 8.8
CVSS v3.0: 6.1
CVE-2026-25003: WordPress Client Portal plugin <= 1.2.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in madalin.ungureanu Client Portal client-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Portal: from n/a through <= 1.2.1.
CVSS v3.1: 4.3
GHSA-6hwj-35vc-w7c7: There is an improper permission management vulnerability in the Wallet apps. Successful exploitation of this vulnerability may affect service confidentiality.
CVSS v3.1: 5.5
GHSA-95m4-5hjq-cmvv: In the Linux kernel, the following vulnerability has been resolved:PCI: use generic driver_override infrastructureWhen a driver is probed through __driver_attach(), the bus' match()
callback is called without the device lock held, thus accessing the
driver_override field without a lock, which can cause a UAF.Fix this by using the driver-core driver_override infrastructure taking
care of proper locking internally.Note that calling match() from __driver_attach() without the device lock
held is intentional. [1]
CVE-2022-43556: Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to XSS in the text input field since the result dashboard page output is not sanitized. The Concrete CMS security team has ranked this 4.2 with CVSS v3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N Thanks @_akbar_jafarli_ for reporting. Remediate by updating to Concrete CMS 8.5.10 and Concrete CMS 9.1.3.
CVSS v3.1: 6.1
CVE-2008-1747: Unspecified vulnerability in Cisco Unified Communications Manager 4.1 before 4.1(3)SR6, 4.2 before 4.2(3)SR3, 4.3 before 4.3(2), 5.x before 5.1(3), and 6.x before 6.1(1) allows remote attackers to cause a denial of service (CCM service restart) via an unspecified SIP INVITE message, aka Bug ID CSCsk46944.
CVSS v2.0: 7.8
GHSA-r9x8-r5r4-mq7c: The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.6.3, macOS Sonoma 14.2, macOS Monterey 12.7.2. A process may gain admin privileges without proper authentication.
CVSS v3.1: 7.8
RHSA-2021:1279: Red Hat Security Advisory: kernel-rt security and bug fix update
kernel: Use after free via PI futex state kernel: iscsi: unrestricted access to sessions and handles kernel: out-of-bounds read in libiscsi module kernel: heap buffer overflow in the iSCSI subsystem
CVSS v3.1: 7.8
CVE-2026-12189: Moovit Bus & Public Transit App com.tranzmate improper authorization in handler for custom url scheme
A flaw has been found in Moovit Bus & Public Transit App 1.18 on Android. This affects an unknown part of the component com.tranzmate. Executing a manipulation can lead to improper authorization in handler for custom url scheme. The attack can only be executed locally. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 4.8
CVSS v3.1: 5.3
CVSS v3.0: 5.3
CVSS v2.0: 4.3
CVE-2024-3622: Mirror-registry: plain-text default csrf secret key
A flaw was found when using mirror-registry to install Quay. It uses a default secret, which is stored in plain-text format in one of the configuration template files. This issue may lead to all instances of Quay deployed using mirror-registry to have the same secret key. This flaw allows a malicious actor to craft session cookies and as a consequence, it may lead to gaining access to the affected Quay instance.
CVSS v3.1: 8.8
CVE-2009-4294: Unspecified vulnerability in the Authentication Manager (aka utauthd) in Sun Ray Server Software 4.0 and 4.1 allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors.
CVSS v2.0: 10
CVE-2004-0129: Directory traversal vulnerability in export.php in phpMyAdmin 2.5.5 and earlier allows remote attackers to read arbitrary files via .. (dot dot) sequences in the what parameter.
CVSS v2.0: 5
GHSA-c859-hx66-mxc5: In Claws Mail 3.14.1, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended receiver. If the receiver replies to this (benign looking) email, they unknowingly leak the plaintext of the encrypted message part(s) back to the attacker.
CVSS v3.0: 4.3
CVE-2024-27376: An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_nan_subscribe_get_nl_params(), there is no input validation check on hal_req->rx_match_filter_len coming from userspace, which can lead to a heap overwrite.
CVSS v3.1: 6.7
GHSA-p44h-q76r-8467: Java Web Start in Sun JDK and JRE 6 Update 2 and earlier, JDK and JRE 5.0 Update 12 and earlier, and SDK and JRE 1.4.2_15 and earlier does not properly enforce access restrictions for untrusted applications, which allows user-assisted remote attackers to obtain sensitive information (the Java Web Start cache location) via an untrusted application, aka "three vulnerabilities."
CVE-2026-43132: dm-verity: correctly handle dm_bufio_client_create() failure
In the Linux kernel, the following vulnerability has been resolved:

dm-verity: correctly handle dm_bufio_client_create() failure

If either of the calls to dm_bufio_client_create() in verity_fec_ctr()
fails, then dm_bufio_client_destroy() is later called with an ERR_PTR()
argument.  That causes a crash.  Fix this.
CVSS v3.1: 5.5
CVE-2005-1352: Cross-site scripting (XSS) vulnerability in the ad.cgi script allows remote attackers to inject arbitrary web script or HTML via the argument.
CVSS v2.0: 4.3
CVE-2019-4415: IBM Cloud Private 3.1.1 and 3.1.2 could allow a local user to obtain elevated privileges due to improper security context constraints. IBM X-Force ID: 162706.
CVSS v3.0: 4.9
GHSA-jw4h-4rg7-p2p2: An issue in Ocuco Innovation - INVCLIENT.EXE v2.10.24.5 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP packet.
CVSS v3.1: 9.8
GHSA-pfg4-p438-p874: Laravel Framework Deserialization Vulnerability
The Illuminate component of Laravel Framework 5.7.x has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the `__destruct` method of the PendingCommand class in `PendingCommand.php`.
CVSS v3.0: 9.8
GHSA-fjw4-rpc3-849f: Nagios XI versions prior to 5.4.0 are vulnerable to cross-site scripting (XSS) via the jQuery Migrate library. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS v4.0: 5.1
CVSS v3.1: 6.1
CVE-2019-13124: Foxit Reader 9.6.0.25114 and earlier has two unique RecursiveCall bugs involving 3 functions exhausting available stack memory because of Uncontrolled Recursion in the V8 JavaScript engine (issue 2 of 2).
CVSS v3.1: 7.5
CVSS v2.0: 5