ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-5m9v-h8pg-4xv6: In the Linux kernel, the following vulnerability has been resolved:rcu/nocb: Fix rcuog wake-up from offline softirqAfter a CPU has set itself offline and before it eventually calls
rcutree_report_cpu_dead(), there are still opportunities for callbacks
to be enqueued, for example from a softirq. When that happens on NOCB,
the rcuog wake-up is deferred through an IPI to an online CPU in order
not to call into the scheduler and risk arming the RT-bandwidth after
hrtimers have been migrated out and disabled.But performing a synchronized IPI from a softirq is buggy as reported in
the following scenario:Fix this with forcing deferred rcuog wake up through the NOCB timer when
the CPU is offline. The actual wake up will happen from
rcutree_report_cpu_dead().
CVSS v3.1: 5.5
GHSA-4532-5878-vcc3: SQL injection vulnerability in modules/arcade/index.php in PHP MySpace Gold Edition 8.0 and 8.10 allows remote attackers to execute arbitrary SQL commands via the gid parameter in a show_stats action.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVE-2022-31077: Malicious response from KubeEdge can crash CSI Driver controller server
KubeEdge is built upon Kubernetes and extends native containerized application orchestration and device management to hosts at the Edge. In affected versions a malicious message response from KubeEdge can crash the CSI Driver controller server by triggering a nil-pointer dereference panic. As a consequence, the CSI Driver controller will be in denial of service. This bug has been fixed in Kubeedge 1.11.0, 1.10.1, and 1.9.3. Users should update to these versions to resolve the issue. At the time of writing, no workaround exists.
CVSS v3.1: 4
GHSA-p4xx-m758-3hpx: TYPO3 CMS Webhooks Server Side Request Forgery
ProblemWebhooks are inherently vulnerable to Server-Side Request Forgery (SSRF), which can be exploited by adversaries to target internal resources (e.g., _localhost_ or other services on the local network). While this is not a vulnerability in TYPO3 itself, it may enable attackers to blindly access systems that would otherwise be inaccessible. An administrator-level backend user account is required to exploit this vulnerability.SolutionUpdate to TYPO3 versions 12.4.31 LTS, 13.4.12 LTS that fix the problem described.[!IMPORTANT]**Manual actions required**To mitigate potential SSRF risks via webhooks, it is recommended to explicitly allow access only to trusted hosts. This can be achieved by configuring the allowlist in `$GLOBALS['TYPO3_CONF_VARS']['HTTP']['allowed_hosts']['webhooks']`.If the allowlist is not defined or set to `null`, all requests will be allowed.
If the allowlist is an empty `array`, all requests will be blocked.By default, the factory setting allows all requests. This prevents existing webhooks from failing after upgrading to the affected TYPO3 versions. Administrators must configure this setting manually to enforce restrictions.CreditsThanks to the National Cyber Security Center (NCSC) of Switzerland for reporting this issue, and to TYPO3 core & security team member Benjamin Franzke for fixing it.
CVSS v3.1: 3.3
CVE-2021-22332: There is a pointer double free vulnerability in some versions of CloudEngine 5800, CloudEngine 6800, CloudEngine 7800 and CloudEngine 12800. When a function is called, the same memory pointer is copied to two functional modules. Attackers can exploit this vulnerability by performing a malicious operation to cause the pointer double free. This may lead to module crash, compromising normal service.
CVSS v3.1: 7.5
CVSS v2.0: 5
GHSA-cfwh-77j4-h2hh: A vulnerability was found in code-projects Simple Admin Panel 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file addSizeController.php. The manipulation of the argument size leads to cross site scripting. The attack can be launched remotely.
CVSS v4.0: 5.3
CVSS v3.1: 3.5
GHSA-4m2r-xvj2-h94m: Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 suffers from Multiple Stored Cross-Site Scripting (XSS) vulnerabilities via Shop Beat Control Panel found at www.shopbeat.co.za controlpanel.shopbeat.co.za.
CVSS v3.1: 5.4
GHSA-9g84-39mm-q4p3: The geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug. sanitizeTextPanelContent() runs on the raw template string before getTemplateSrv().replace() substitutes the variable value, which uses the glob format with no HTML escaping. The result is passed to OpenLayers via element.innerHTML. An Editor can set a textbox variable's default value to an XSS payload that executes for every user who opens the dashboard. This is a bypass of the CVE-2023-0507 fix
CVSS v3.1: 7.3
CVE-2013-0174: The external node classifier (ENC) API in Foreman before 1.1 allows remote attackers to obtain the hashed root password via an API request.
CVSS v2.0: 5
GHSA-rv57-679m-c549: IBM Lotus Notes Traveler before 8.5.0.2 does not properly handle a "* *" argument sequence for a certain tell command, which allows remote authenticated users to obtain access to other users' data via a sync operation, related to storage of the data of multiple users within the same thread.
GHSA-wp9w-299c-wjxj: A stored cross-site scripting (XSS) vulnerability in the component /admin/search-vehicle.php of Phpgurukul Vehicle Record Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Search parameter.
CVSS v3.1: 6.1
CVE-2022-38595: Church Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/edit_user.php.
CVSS v3.1: 7.2
CVE-2013-7274: Cross-site scripting (XSS) vulnerability in Wallpaper Script 3.5.0082 allows remote authenticated users to inject arbitrary web script or HTML via the title field in a wallpaper file upload.
CVSS v2.0: 3.5
GHSA-p7xg-g9wj-p83p: Usermin before 1.600 allows remote attackers to execute arbitrary operating-system commands via unspecified vectors related to a user action.
CVE-2003-1204: Multiple cross-site scripting (XSS) vulnerabilities in Mambo Site Server 4.0.12 BETA and earlier allow remote attackers to execute script on other clients via (1) the link parameter in sectionswindow.php, the directory parameter in (2) gallery.php, (3) navigation.php, or (4) uploadimage.php, the path parameter in (5) view.php, (6) the choice parameter in upload.php, (7) the sitename parameter in mambosimple.php, (8) the type parameter in upload.php, or the id parameter in (9) emailarticle.php, (10) emailfaq.php, or (11) emailnews.php.
CVSS v2.0: 6.8
RHSA-2025:15847: Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.23.0 Release.
hashicorp/consul: consul: Consul L7 Intentions Vulnerable To URL Path Bypass hashicorp/consul: consul: Consul L7 Intentions Vulnerable To Headers Bypass quic-go: memory exhaustion attack against QUIC's connection ID mechanism golang: archive/zip: Incorrect handling of certain ZIP files traefik: denial of service traefik: Bypassing IP allow-lists via HTTP/3 early data requests in QUIC 0-RTT handshakes golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html cipher-base: Cipher-base hash manipulation sha.js: Missing type checks leading to hash rewind and passing on crafted data git: Git arbitrary file writes tar-fs: tar-fs has issue where extract can write outside the specified dir with a specific tarball com.fasterxml.jackson.core/jackson-core: jackson-core Potential StackoverflowError
CVSS v3.1: 7.5
GHSA-888h-wmgg-wjc5: Alldata V0.4.6 is vulnerable to Incorrect Access Control. A total of many modules interface documents have been leaked.For example, the /api/system/v2/api-docs module.
CVSS v3.1: 9.1
CVE-2018-5877: In the device programmer target-side code for firehose, a string may not be properly NULL terminated can lead to a incorrect buffer size in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear in versions MDM9206, MDM9607, MDM9640, MDM9650, MDM9655, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 600, SD 820, SD 820A, SD 835, SDA660, SDX20.
CVSS v3.0: 7.8
CVSS v2.0: 7.2
GHSA-r5r6-4ghv-87gp: Multiple PHP remote file inclusion vulnerabilities in Softnews Media Group DataLife Engine allow remote attackers to execute arbitrary PHP code via a URL in the root_dir parameter to (1) init.php and (2) Ajax/editnews.php.  NOTE: some of these details are obtained from third party information.
CVE-2017-5835: libplist allows attackers to cause a denial of service (large memory allocation and crash) via vectors involving an offset size of zero.
CVSS v3.0: 7.5
CVSS v2.0: 5
CVE-2022-49122: dm ioctl: prevent potential spectre v1 gadget
In the Linux kernel, the following vulnerability has been resolved:

dm ioctl: prevent potential spectre v1 gadget

It appears like cmd could be a Spectre v1 gadget as it's supplied by a
user and used as an array index. Prevent the contents of kernel memory
from being leaked to userspace via speculative execution by using
array_index_nospec.
CVSS v3.1: 5.5
GHSA-2h7q-cwm3-ww93: Cross-site scripting (XSS) vulnerability in Inktomi Traffic-Server 5.5.1 allows remote attackers to insert arbitrary web script or HTML into an error page that appears to come from the domain that the client is visiting, aka "Man-in-the-Middle" XSS.
GHSA-q6p7-fhh6-cwmp: Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to conduct content-spoofing attacks via a crafted URL, aka "Microsoft Browser Spoofing Vulnerability."
CVSS v3.0: 3.1
CVE-2010-2831: Unspecified vulnerability in the NAT for SIP implementation in Cisco IOS 12.1 through 12.4 and 15.0 through 15.1 allows remote attackers to cause a denial of service (device reload) via transit traffic on UDP port 5060, aka Bug ID CSCtf17624.
CVSS v2.0: 7.8
GHSA-h4p3-ffc4-4vw5: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magepeopleteam WpTravelly allows PHP Local File Inclusion. This issue affects WpTravelly: from n/a through 1.8.7.
CVSS v3.1: 8.8
CVE-2025-27638: Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.1002 Application 20.0.2614 allows Hardcoded Password V-2024-013.
CVSS v3.1: 9.8
GHSA-hm4h-jq5c-c933: copy_params in drivers/md/dm-ioctl.c in the Linux kernel through 6.7.1 can attempt to allocate more than INT_MAX bytes, and crash, because of a missing param_kernel->data_size check. This is related to ctl_ioctl.
CVSS v3.1: 5.5
PYSEC-2020-152: In Wagtail before versions 2.8.1 and 2.7.2, a cross-site scripting (XSS) vulnerability exists on the page revision comparison view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could potentially craft a page revision history that, when viewed by a user with higher privileges, could perform actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. Patched versions have been released as Wagtail 2.7.2 (for the LTS 2.7 branch) and Wagtail 2.8.1 (for the current 2.8 branch).
GHSA-3f48-4c9c-grjq: The Tecno Camon iAir 2 Plus Android device with a build fingerprint of TECNO/H622/TECNO-ID3k:8.1.0/O11019/E-180914V83:user/release-keys contains a pre-installed platform app with a package name of com.lovelyfont.defcontainer (versionCode=7, versionName=7.0.11). This app contains an exported service named com.lovelyfont.manager.service.FunctionService that allows any app co-located on the device to supply the file path to a Dalvik Executable (DEX) file which it will dynamically load within its own process and execute in with its own system privileges. This app cannot be disabled by the user and the attack can be performed by a zero-permission app. Executing commands as the system user can allow a third-party app to video record the user's screen, factory reset the device, obtain the user's notifications, read the logcat logs, inject events in the Graphical User Interface (GUI), and obtains the user's text messages, and more. Executing code as the system user can allow a third-party app to factory reset the device, obtain the user's Wi-Fi passwords, obtain the user's notifications, read the logcat logs, inject events in the GUI, change the default Input Method Editor (IME) (e.g., keyboard) with one contained within the attacking app that contains keylogging functionality, and obtains the user's text messages, and more.
GHSA-qq9r-63f6-v542: PraisonAIAgents: SSRF via unvalidated URL in `web_crawl` httpx fallback
| Field | Value |
|---|---|
| Severity | High |
| Type | SSRF -- unvalidated URL in `web_crawl` httpx fallback allows internal network access |
| Affected | `src/praisonai-agents/praisonaiagents/tools/web_crawl_tools.py:133-180` |Summary`web_crawl`'s httpx fallback path passes user-supplied URLs directly to `httpx.AsyncClient.get()` with `follow_redirects=True` and no host validation. An LLM agent tricked into crawling an internal URL can reach cloud metadata endpoints (`169.254.169.254`), internal services, and localhost. The response content is returned to the agent and may appear in output visible to the attacker.This fallback is the default crawl path on a fresh PraisonAI installation (no Tavily key, no Crawl4AI installed).DetailsThe vulnerable code is in `tools/web_crawl_tools.py:148-155`:No scheme restriction, no hostname resolution, no private/link-local IP check. `follow_redirects=True` also means an attacker can use an open redirect on a public URL to bounce the request into internal networks.`download_file` in `file_tools.py:295-318`, by contrast, validates URLs before requesting:`web_crawl` has none of this.PoCDirect agent interaction:Indirect prompt injection -- hidden instruction on a crawled page:Impact| Tool | Internal network blocked? |
|------|---------------------------|
| `download_file("http://169.254.169.254/...")` | Yes |
| `web_crawl("http://169.254.169.254/...")` | No |On cloud infrastructure with IMDSv1, this gets you IAM credentials from the metadata service. On any deployment, it exposes whatever internal services the host can reach. No authentication is needed -- the attacker just needs the agent to process input that triggers a `web_crawl` call to an internal address.Conditions for exploitabilityThe httpx fallback is active when:`TAVILY_API_KEY` is not set, **and**`crawl4ai` package is not installedThis is the default state after `pip install praisonai`. Production deployments with Tavily or Crawl4AI configured are not affected through this path.RemediationAdd URL validation before the httpx request. The private-IP check from `file_tools.py` can be extracted into a shared utility:Affected paths`src/praisonai-agents/praisonaiagents/tools/web_crawl_tools.py:133-180` -- `_crawl_with_httpx()` requests URLs without validation
CVSS v4.0: 7.1
CVE-2021-21687: Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create symbolic links when unarchiving a symbolic link in FilePath#untar.
CVSS v3.1: 9.1
CVSS v2.0: 6.4
CVE-2026-8452: Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of Service
Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server
CVSS v4.0: 8.8
CVE-2025-58432: ZimaOS  Privilege Escalation using localhost calls to File API Upload
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.4.1 and all prior versions, the /v2_1/files/file/uploadV2 endpoint allows file upload from ANY USER who has access to localhost. File uploads are performed AS ROOT.
CVSS v4.0: 5.2
GHSA-782x-9xpx-3gm4: A vulnerability was found in Viessmann Vitogate 300 up to 2.1.3.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /cgi-bin/. The manipulation leads to direct request. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-243140. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v3.0: 4.3
RHSA-2020:3286: Red Hat Security Advisory: postgresql-jdbc security update
postgresql-jdbc: XML external entity (XXE) vulnerability in PgSQLXML
CVSS v3.1: 7.7
CVE-2012-2147: munin-cgi-graph in Munin 2.0 rc4 allows remote attackers to cause a denial of service (disk or memory consumption) via many image requests with large values in the (1) size_x or (2) size_y parameters.
CVSS v2.0: 5
CVE-2007-0027: Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, 2004 for Mac, and v.X for Mac allows remote attackers to execute arbitrary code via malformed IMDATA records that trigger memory corruption.
CVSS v2.0: 9.3
CVE-2023-7137: code-projects Client Details System HTTP POST Request sql injection
A vulnerability, which was classified as critical, has been found in code-projects Client Details System 1.0. Affected by this issue is some unknown functionality of the component HTTP POST Request Handler. The manipulation of the argument uemail leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249140.
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 5.8
CVE-2016-4700: AppleUUC in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-4699.
CVSS v3.0: 7.8
CVSS v2.0: 9.3
CVE-2025-24714: WordPress Bubble Menu  Plugin <= 4.0.2 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Bubble Menu – circle floating menu bubble-menu allows Cross Site Request Forgery.This issue affects Bubble Menu – circle floating menu: from n/a through <= 4.0.2.
CVSS v3.1: 5.4
RHSA-2026:1805: Red Hat Security Advisory: resource-agents security update
urllib3: urllib3 Streaming API improperly handles highly compressed data urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)
CVSS v3.1: 7.5
GHSA-fr8m-vw66-8v9r: tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC DCC commands in EMU_IRC. This can cause a heap-based buffer overflow or other out-of-bounds access which can lead to a DoS or potential execute arbitrary code.
GHSA-66pq-m7px-mqjx: Adobe Flash Player versions 25.0.0.171 and earlier have an exploitable memory corruption vulnerability in the LocaleID class. Successful exploitation could lead to arbitrary code execution.
CVSS v3.0: 9.8
CVE-2006-2416: SQL injection vulnerability in class2.php in e107 0.7.2 and earlier allows remote attackers to execute arbitrary SQL commands via a cookie as defined in $pref['cookie_name'].
CVSS v2.0: 5.1
CVE-2023-4124: Missing Authorization in answerdev/answer
Missing Authorization in GitHub repository answerdev/answer prior to v1.1.1.
CVSS v3.0: 8.1
CVE-2024-47519: Backup uploads to ETM subject to man-in-the-middle interception
Backup uploads to ETM subject to man-in-the-middle interception
CVSS v3.1: 8.3
GHSA-q467-67pv-7pmf: A use of externally-controlled format string in Fortinet FortiProxy versions 7.2.0 through 7.2.5, 7.0.0 through 7.0.11, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6 FortiPAM versions 1.1.0, 1.0.0 through 1.0.3 FortiOS versions 7.4.0, 7.2.0 through 7.2.5, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15 FortiSwitchManager versions 7.2.0 through 7.2.2, 7.0.0 through 7.0.2 allows attacker to execute unauthorized code or commands via specially crafted cli commands and http requests.
CVSS v3.1: 6.7
GHSA-hm55-gqww-x3wj: An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 8.3.2.25013. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.
CVSS v3.0: 8.8
GHSA-6xjv-wjcc-hfh7: Splunk Enterprise 6.2.x before 6.2.14, 6.3.x before 6.3.10, 6.4.x before 6.4.7, and 6.5.x before 6.5.3; and Splunk Light before 6.6.0 allow remote attackers to cause a denial of service via a crafted HTTP request.
CVSS v3.0: 7.5
CVE-2023-0721: Metform Elementor Contact Form Builder <= 3.3.0 - Unauthenticated CSV Injection
The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to CSV injection in versions up to, and including, 3.3.0. This allows unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.
CVSS v3.1: 8.3
CVE-2014-6465: Unspecified vulnerability in the Oracle Communications Session Border Controller component in Oracle Communications Applications SCX640m5 allows remote authenticated users to affect availability via unknown vectors related to Lawful Intercept.
CVSS v2.0: 6.3
GHSA-qf6p-prwp-r624: The NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME M600, LANTIME M400, LANTIME M300, LANTIME M200, LANTIME M100, SyncFire 1100, and LCES devices with firmware before 6.20.004 allows remote authenticated users to obtain root privileges for writing to unspecified scripts, and consequently obtain sensitive information or modify data, by leveraging access to the nobody account.
CVSS v3.0: 8.1
CVE-2025-55079: Missing check for thread priority
In Eclipse ThreadX before version 6.4.3, the thread module has a setting of maximum priority. In some cases the check of that maximum priority wasn't performed, allowing, as a result, to obtain a thread with higher priority than expected and causing a possible denial of service.
CVSS v4.0: 5.7
GHSA-7366-3322-xm88: Vulnerability in the Primavera Unifier component of Oracle Construction and Engineering Suite (subcomponent: Core). The supported version that is affected is 16.x. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Primavera Unifier accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
CVSS v3.0: 4.3
CVE-2024-23462: ZCC Mac validinstaller file integrity check missing
An Improper Validation of Integrity Check Value vulnerability in Zscaler Client Connector on MacOS allows a denial of service of the Client Connector binary and thus removing client functionality.This issue affects Client Connector on MacOS: before 3.4.


CVSS v3.1: 3.3
CVE-2023-20145: Cisco Small Business RV016, RV042, RV042G,  RV082 , RV320, and RV325 Routers Cross-Site Scripting Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface. These vulnerabilities are due to insufficient input validation by the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device and then persuading a user to visit specific web pages that include malicious payloads. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. Cisco has not released software updates that address these vulnerabilities.
CVSS v3.1: 6.1