ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-4x56-gm9r-89mg: In the Linux kernel, the following vulnerability has been resolved:x86/kexec: Fix bug with call depth trackingThe call to cc_platform_has() triggers a fault and system crash if call depth
tracking is active because the GS segment has been reset by load_segments() and
GS_BASE is now 0 but call depth tracking uses per-CPU variables to operate.Call cc_platform_has() earlier in the function when GS is still valid.[ bp: Massage. ]
CVSS v3.1: 5.5
CVE-2018-13309: Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's password.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
CVE-2025-58711: WordPress Blog Designer PRO plugin <= 3.4.8 - Broken Access Control vulnerability
Missing Authorization vulnerability in solwin Blog Designer PRO blog-designer-pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Blog Designer PRO: from n/a through <= 3.4.8.
CVSS v3.1: 5.3
CVE-2019-13458: An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.8, and Community Edition 5.0.x through 5.0.36 and 6.0.x through 6.0.19. An attacker who is logged into OTRS as an agent user with appropriate permissions can leverage OTRS notification tags in templates in order to disclose hashed user passwords.
CVSS v3.0: 2.7
GHSA-j3j2-mcvq-8p35: Certain NETGEAR devices are affected by denial of service. This affects M4300-28G before 12.0.2.15, M4300-52G before 12.0.2.15, M4300-28G-POE+ before 12.0.2.15, M4300-52G-POE+ before 12.0.2.15, M4300-8X8F before 12.0.2.15, M4300-12X12F before 12.0.2.15, M4300-24X24F before 12.0.2.15, M4300-24X before 12.0.2.15, M4300-48X before 12.0.2.15, and M4200 before 12.0.2.15.
GHSA-w9wg-637c-7r93: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme Evon allows PHP Local File Inclusion. This issue affects Evon: from n/a through 3.4.
CVSS v3.1: 8.1
CVE-2008-5214: Cross-site scripting (XSS) vulnerability in service/calendrier.php in ClanLite 2.2006.05.20 allows remote attackers to inject arbitrary web script or HTML via the annee parameter.
CVSS v2.0: 4.3
CVE-2005-1317: Cross-site scripting (XSS) vulnerability in Horde Chora module before 1.2.3 allows remote attackers to inject arbitrary web script or HTML via the parent's frame page title.
CVSS v2.0: 6.8
CVE-2015-3100: Stack-based buffer overflow in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allows attackers to execute arbitrary code via unspecified vectors.
CVSS v2.0: 10
GHSA-4fc2-cghp-wc59: The Community Events plugin for WordPress is vulnerable to SQL Injection via the ‘event_venue’ parameter in all versions up to, and including, 1.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS v3.1: 9.8
GHSA-h2pj-2gpr-72vh: Deserialization of Untrusted Data vulnerability in GoodLayers Goodlayers Hotel allows Object Injection. This issue affects Goodlayers Hotel: from n/a through 3.1.4.
CVSS v3.1: 9.8
CVE-2015-0412: Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAX-WS.
CVSS v2.0: 7.2
GHSA-8fh2-hm78-4frg: A vulnerability was detected in mickasmt next-saas-stripe-starter 1.0.0. Affected by this vulnerability is the function updateUserrole of the file actions/update-user-role.ts. The manipulation of the argument userId/role results in improper authorization. The attack may be launched remotely.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
GHSA-xgq4-gwmr-jvcm: Tftpd32 SE 4.60 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevated privileges. Attackers can exploit the unquoted path in the service configuration to inject malicious executables that will be run with system-level permissions.
CVSS v4.0: 8.5
CVSS v3.1: 8.4
GHSA-63m5-974w-448v: Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment
SummaryA vulnerability in Fleet’s Windows MDM enrollment flow could allow an attacker to submit forged authentication tokens that are not properly validated. Because JWT signatures were not verified, Fleet could accept attacker-controlled identity claims, enabling enrollment of unauthorized devices under arbitrary Azure AD user identities.ImpactIf Windows MDM is enabled, an attacker can enroll rogue devices by submitting a forged JWT containing arbitrary identity claims. Due to missing JWT signature verification, Fleet accepts these claims without validating that the token was issued by Azure AD, allowing enrollment under any Azure AD user identity.Patches4.78.34.77.14.76.24.75.24.53.3WorkaroundsIf an immediate upgrade is not possible, affected Fleet users should temporarily disable Windows MDM.For more informationIf you have any questions or comments about this advisory:Email us at [security@fleetdm.com](mailto:security@fleetdm.com)
Join #fleet in [osquery Slack](https://join.slack.com/t/osquery/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw)CreditsWe thank @secfox-ai for responsibly reporting this issue.
CVSS v4.0: 9.3
GHSA-fggm-83vw-5vwq: Sander Bos discovered a time of check to time of use (TOCTTOU) vulnerability in apport that allowed a user to cause core files to be written in arbitrary directories.
CVSS v3.1: 4.7
CVE-2007-5235: Cross-site scripting (XSS) vulnerability in index.php in Uebimiau 2.7.2 through 2.7.10 allows remote attackers to inject arbitrary web script or HTML via the f_email parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS v2.0: 4.3
GHSA-f67x-qhc2-9243: An issue was discovered in GamerPolls 0.4.6, related to config/environments/all.js and config/initializers/02_passport.js. An attacker can edit the Passport.js contents of the session cookie to contain the ID number of the account they wish to take over, and re-sign it using the hard coded secret.
CVSS v3.0: 7.3
GHSA-h3rc-229h-wgjg: Improper buffer restrictions in some Intel(R) VPL software before version 24.1.4 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS v4.0: 1
CVSS v3.1: 4.2
CVE-2021-29030: A cross-site scripting (XSS) vulnerability in Bitweaver version 3.1.0 allows remote attackers to inject JavaScript via the /users/admin/index.php URI.
CVSS v3.1: 4.8
CVSS v2.0: 3.5
CVE-2021-45491: 3CX System through 2022-03-17 stores cleartext passwords in a database.
CVSS v3.1: 6.5
CVSS v2.0: 4
GHSA-r7wr-9x9m-j4mf: An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is affected. iTunes before 12.6.2 on Windows is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
CVSS v3.0: 8.8
GHSA-wwwq-67r3-g4qj: In the video_ioctl2() function in the camera driver in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-09-16, an untrusted pointer dereference may potentially occur.
CVSS v3.0: 7.8
GHSA-fpcr-g545-m542: WAGO 750-8212 PFC200 G2 2ETH RS Firmware version 03.05.10(17) is affected by a privilege escalation vulnerability. Improper handling of user cookies leads to escalating privileges to administrative account of the router.
GHSA-28pf-wwvx-8jx3: IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x before 7.0.0.2 CF27, and 8.0.0.x before 8.0.0.1 CF10, when the wcm.path.traversal.security setting is enabled, allows remote attackers to bypass intended read restrictions on an item by accessing that item within search results.
GHSA-8x9c-m5v9-8766: sink.c in fetchmail before 6.3.9 allows context-dependent attackers to cause a denial of service (NULL dereference and application crash) by refusing certain warning messages that are sent over SMTP.
CVE-2024-5125: XSS and Open Redirect via SVG File Upload in parisneo/lollms-webui
parisneo/lollms-webui version 9.6 is vulnerable to Cross-Site Scripting (XSS) and Open Redirect due to inadequate input validation and processing of SVG files during the upload process. The XSS vulnerability allows attackers to embed malicious JavaScript code within SVG files, which is executed upon rendering, leading to potential credential theft and unauthorized data access. The Open Redirect vulnerability arises from insufficient URL validation within SVG files, enabling attackers to redirect users to malicious websites, thereby exposing them to phishing attacks, malware distribution, and reputation damage. These vulnerabilities are present in the application's functionality to send files to the AI module.
CVSS v3.0: 7.3
GHSA-48ww-j4fc-435p: Command injection in nodemailer
This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transport for sending mails.
CVSS v3.1: 9.8
CVE-2021-29714: IBM Content Navigator 3.0.CD could allow a malicious user to cause a denial of service due to improper input validation. IBM X-Force ID: 200968.
CVSS v3.0: 6.5
GHSA-36mh-7278-8282: Multiple cross-site scripting (XSS) vulnerabilities in mpweb/scripts/mpx.dll in Cisco Unified MeetingPlace 5.4 and earlier and 6.0 allow remote attackers to inject arbitrary web script or HTML via the (1) FirstName and (2) LastName parameters.
GHSA-83r7-f4pp-52x2: Untrusted search path vulnerability in (1) hvdisp and (2) rcvm in ReliantHA 1.1.4 in SCO UnixWare 7.1.4 allows local users to gain root privileges by modifying the RELIANT_PATH environment variable to point to a malicious bin/hvenv program.
GHSA-jvcm-pc6m-g646: A vulnerability was found in Campcodes Online Laundry Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /manage_user.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-263894 is the identifier assigned to this vulnerability.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVE-2022-29337: C-DATA FD702XW-X-R430 v2.1.13_X001 was discovered to contain a command injection vulnerability via the va_cmd parameter in formlanipv6. This vulnerability allows attackers to execute arbitrary commands via a crafted HTTP request.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
GHSA-4638-h2rx-8qf2: Cross-Site Request Forgery (CSRF) vulnerability in Brave Brave Popup Builder.This issue affects Brave Popup Builder: from n/a through 0.7.0.
CVSS v3.1: 4.3
CVE-2022-1084: SourceCodester One Church Management System Session userregister.php improper authentication
A vulnerability classified as critical was found in SourceCodester One Church Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /one_church/userregister.php. The manipulation leads to authentication bypass. The attack can be launched remotely.
CVSS v3.1: 7.3
GHSA-4rjw-m2mm-7r9g: Cross-site scripting (XSS) vulnerability in index.php in Buttercup web file manager (BWFM) May 2007 allows remote attackers to inject arbitrary web script or HTML via the title parameter.
GHSA-wh9v-j636-4j6p: Memory leak in queue-manager agents in IBM WebSphere MQ 8.x before 8.0.0.5 allows remote attackers to cause a denial of service (heap memory consumption) by triggering many errors.
CVSS v3.0: 7.5
GHSA-phx8-4x5v-wgc8: A vulnerability in Cisco Industrial Network Director could allow an authenticated, remote attacker to conduct stored cross-site scripting (XSS) attacks. The vulnerability is due to improper validation of content submitted to the affected application. An attacker could exploit this vulnerability by sending requests containing malicious values to the affected system. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
CVSS v3.1: 5.4
GHSA-29f9-wqmc-g6q2: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 is vulnerable to a denial of service as the server may crash when an authenticated user creates a specially crafted query.
CVSS v3.1: 6.5
CVE-2022-35059: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6c0414.
CVSS v3.1: 6.5
RHSA-2017:1842: Red Hat Security Advisory: kernel security, bug fix, and enhancement update
Kernel: fs: VFS denial of service Kernel: fs: umount denial of service kernel: ext4 filesystem page fault race condition with fallocate call. kernel: crypto: GPF in lrw_crypt caused by null-deref kernel: Overflowing kernel mount table using shared bind mount kernel: Stack corruption while reading /proc/keys when gcc stack protector is enabled kernel: Setting a POSIX ACL via setxattr doesn't clear the setgid bit kernel: a BUG() statement can be hit in net/ipv4/tcp_input.c kernel: Use after free in SCSI generic device interface Kernel: kvm: nVMX: uncaught software exceptions in L1 guest leads to DoS kernel: security: The built-in keyrings for security tokens can be joined as a session and then modified by the root user kernel: Memory leaks in xfs_attr_list.c error paths kernel: netlink: double-free in netlink_dump kernel: Use after free in SCSI generic device interface (CVE-2016-9576 regression) kernel: Kernel crash by spawning mcrypt(alg) with incompatible algorithm kernel: l2tp: Race condition in the L2TPv3 IP encapsulation feature kernel: race condition between direct and memory-mapped I/O in fs/xfs/xfs_aops.c Kernel: kvm: use after free in complete_emulated_mmio Kernel: kvm: page reference leakage in handle_vmon kernel: Null pointer dereference in search_keyring kernel: ping socket / AF_LLC connect() sin_family race kernel: S_ISGD is not cleared when setting posix ACLs in tmpfs (CVE-2016-7097 incomplete fix) kernel: ipv4: Invalid IP options could cause skb->dst drop kernel: Race condition between multiple sys_perf_event_open() calls kernel: NULL pointer dereference in keyring_search_aux function kernel: scsi: Stack-based buffer overflow in sg_ioctl function kernel: ext4: power failure during write(2) causes on-disk information leak kernel: Incorrect error handling in the set_mempolicy and mbind compat syscalls in mm/mempolicy.c kernel: mm subsystem does not properly enforce the CONFIG_STRICT_DEVMEM protection mechanism kernel: NFSv4 server does not properly validate layout type when processing NFSv4 pNFS LAYOUTGET operand kernel: Double free in the inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c kernel: net: IPv6 fragmentation implementation of nexthdr field may be associated with an invalid option kernel: net: sctp_v6_create_accept_sk function mishandles inheritance kernel: net: IPv6 DCCP implementation mishandles inheritance kernel: net: tcp_v6_syn_recv_sock function mishandles inheritance kernel: Incorrect overwrite check in __ip6_append_data() kernel: load_elf_ binary() does not take account of the need to allocate sufficient space for the entire binary kernel: Incorrectly mapped contents of PIE executable
CVSS v3.0: 2.9
GHSA-g494-wr54-xx2g: Use after free in CSS in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVSS v3.1: 8.8
GHSA-mp7m-vrr7-g6gw: Microsoft SharePoint Server Remote Code Execution Vulnerability
CVSS v3.1: 7.2
GHSA-vwxq-9j7w-7vmv: Medical Informatics Engineering Enterprise Health has a stored cross site scripting vulnerability that allows an authenticated attacker to add arbitrary content in the 'Demographic Information' page. This content will be rendered and executed when a victim accesses it. This issue is fixed as of 2025-03-14.
CVSS v4.0: 4.8
CVSS v3.1: 3.5
CVE-2026-41673: xmldom: Denial of service via uncontrolled recursion in XML serialization
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, seven recursive traversals in lib/dom.js operate without a depth limit. A sufficiently deeply nested DOM tree causes a RangeError: Maximum call stack size exceeded, crashing the application. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.
CVSS v4.0: 8.7
CVE-2004-1799: PF in certain OpenBSD versions, when stateful filtering is enabled, does not limit packets for a session to the original interface, which allows remote attackers to bypass intended packet filters via spoofed packets to other interfaces.
CVSS v2.0: 7.5
CVE-2013-6227: Unrestricted file upload vulnerability in plugins/editor.zoho/agent/save_zoho.php in the Zoho plugin in Pydio (formerly AjaXplorer) before 5.0.4 allows remote attackers to execute arbitrary code by uploading an executable file, and then accessing this file at a location specified by the format parameter of a move operation.
CVSS v2.0: 7.5
CVE-2021-3739: A NULL pointer dereference flaw was found in the btrfs_rm_device function in fs/btrfs/volumes.c in the Linux Kernel, where triggering the bug requires ‘CAP_SYS_ADMIN’. This flaw allows a local attacker to crash the system or leak kernel internal information. The highest threat from this vulnerability is to system availability.
CVSS v3.1: 7.1
CVSS v2.0: 3.6
CVE-2024-47014: Android before 2024-10-05 on Google Pixel devices allows privilege escalation in the ABL component, A-330537292.
CVSS v3.1: 8.8
GHSA-7fwm-92mv-mh6q: Multiple stack-based buffer overflows in Novell eDirectory 8.8.x before 8.8.1 FTF1, and 8.x up to 8.7.3.8, and Novell NetMail before 3.52e FTF2, allow remote attackers to execute arbitrary code via (1) a long HTTP Host header, which triggers an overflow in the BuildRedirectURL function; or vectors related to a username containing a . (dot) character in the (2) SMTP, (3) POP, (4) IMAP, (5) HTTP, or (6) Networked Messaging Application Protocol (NMAP) Netmail services.
GHSA-q4v9-gx3p-c65m: Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.4, Firefox < 82, and Thunderbird < 78.4.
CVSS v3.1: 9.8
RHSA-2023:0445: Red Hat Security Advisory: go-toolset-1.18 security update
golang: archive/tar: github.com/vbatts/tar-split: unbounded memory consumption when reading headers golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters golang: regexp/syntax: limit memory used by parsing regexps
CVSS v3.1: 6.5
CVE-2020-4283: IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, 1.0.2, 1.0.3, and 1.0.4 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 176206.
CVSS v3.0: 6.8
GHSA-93hj-5v8r-h26w: Multiple heap out-of-bounds reads in the Spotlight RPC unmarshalling code in Netatalk 3.1.0 through 4.4.2 allow a remote authenticated attacker to obtain sensitive information or cause a minor service disruption.
CVSS v3.1: 7.1
GHSA-7mcc-6vvm-m53x: The administrative interface on the PolyVision RoomWizard with firmware 3.2.3 places the Sync Connector Active Directory (AD) credentials in a web form that is accessed over HTTP on port 80, which allows remote attackers to obtain sensitive information by reading the HTML source code corresponding to the /admin/sign/DeviceSynch URI.
CVE-2010-3155: Untrusted search path vulnerability in Adobe ExtendScript Toolkit (ESTK) CS5 3.5.0.52 allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the same folder as a .jsx file.
CVSS v2.0: 9.3
GHSA-497c-8qgw-xqvj: The NFSv4 implementation in the Linux kernel before 3.2.2 does not properly handle bitmap sizes in GETACL replies, which allows remote NFS servers to cause a denial of service (OOPS) by sending an excessive number of bitmap words.
CVE-2018-6241: NVIDIA Tegra Gralloc module contains a vulnerability in driver in which it does not validate input parameter of the registerbuffer API, which may lead to arbitrary code execution, denial of service, or escalation of privileges. Android ID: A-62540032 Severity Rating: High Version: N/A.
CVSS v3.0: 7.8
CVSS v2.0: 7.2
GHSA-vx6q-ffvw-7c86: The ThreadX-based firmware on Marvell Avastar Wi-Fi devices, models 88W8787, 88W8797, 88W8801, 88W8897, and 88W8997, allows remote attackers to execute arbitrary code or cause a denial of service (block pool overflow) via malformed Wi-Fi packets during identification of available Wi-Fi networks. Exploitation of the Wi-Fi device can lead to exploitation of the host application processor in some cases, but this depends on several factors including host OS hardening and the availability of DMA.
CVSS v3.0: 8.8
GHSA-98h4-j493-jm73: An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader, version 9.2.0.9297. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
CVSS v3.0: 7.8
CVE-2004-1351: Unknown vulnerability in the rwho daemon (in.rwhod) for Solaris 7 through 9 allows remote attackers to execute arbitrary code.
CVSS v2.0: 10
GHSA-43c6-24rr-4553: Sql injection vulnerability found in Rail Pass Management System v.1.0 allows a remote attacker to execute arbitrary code via the viewid parameter of the view-pass-detail.php file.
CVSS v3.1: 7.2
CVE-2005-3079: PunBB before 1.2.8 allows remote attackers to perform "code inclusion" via the user language selection.
CVSS v2.0: 4.6
GHSA-qpq5-2xw2-697g: Missing Authorization vulnerability in opicron Image Cleanup image-cleanup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Cleanup: from n/a through <= 1.9.2.
CVSS v3.1: 4.3
CVE-2021-31489: This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DWF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-12717.
CVSS v3.0: 7.8
CVE-2026-22453: WordPress Pets Club theme <= 2.3 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ThemeREX Pets Club petclub allows Object Injection.This issue affects Pets Club: from n/a through <= 2.3.
CVSS v3.1: 9.8
GHSA-hx5g-796f-2xrq: NETGEAR RAX40 devices before 1.0.3.64 are affected by denial of service.