ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2020-9556: Adobe Bridge versions 10.0.1 and earlier version have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .
CVSS v3.1: 7.8
CVSS v2.0: 9.3
GHSA-hv59-hh7h-7h9r: In the Linux kernel, the following vulnerability has been resolved:drm/amdgpu/userq: Fix fence reference leak on queue teardown v2The user mode queue keeps a pointer to the most recent fence in
userq->last_fence. This pointer holds an extra dma_fence reference.When the queue is destroyed, we free the fence driver and its xarray,
but we forgot to drop the last_fence reference.Because of the missing dma_fence_put(), the last fence object can stay
alive when the driver unloads. This leaves an allocated object in the
amdgpu_userq_fence slab cache and triggersThis is visible during driver unload as:BUG amdgpu_userq_fence: Objects remaining on __kmem_cache_shutdown()
  kmem_cache_destroy amdgpu_userq_fence: Slab cache still has objects
  Call Trace:
    kmem_cache_destroy
    amdgpu_userq_fence_slab_fini
    amdgpu_exit
    __do_sys_delete_moduleFix this by putting userq->last_fence and clearing the pointer during
amdgpu_userq_fence_driver_free().This makes sure the fence reference is released and the slab cache is
empty when the module exits.v2: Update to only release userq->last_fence with dma_fence_put()
    (Christian)(cherry picked from commit 8e051e38a8d45caf6a866d4ff842105b577953bb)
GHSA-77hp-5q78-94cv: The vty layer in Quagga before 0.96.4, and Zebra 0.93b and earlier, does not verify that sub-negotiation is taking place when processing the SE marker, which allows remote attackers to cause a denial of service (crash) via a malformed telnet command to the telnet CLI port, which may trigger a null dereference.
GHSA-7c7v-g484-j4cf: ChakraCore RCE Vulnerability
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-0979, CVE-2018-0980, CVE-2018-0990, CVE-2018-0994, CVE-2018-0995, CVE-2018-1019.
CVSS v3.0: 7.5
CVE-2024-36676: Incorrect access control in BookStack before v24.05.1 allows attackers to confirm existing system users and perform targeted notification email DoS via public facing forms.
CVSS v3.1: 7.5
GHSA-wc7r-64xv-6vgw: A vulnerability was found in Juanpao JPShop up to 1.5.02. It has been rated as critical. Affected by this issue is some unknown functionality of the file /api/controllers/admin/app/AppController.php of the component API. The manipulation of the argument app_pic_url leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-252998 is the identifier assigned to this vulnerability.
CVSS v3.1: 6.3
GHSA-w223-mrpp-5vv6: The socket connection handler in aswArPot.sys in the Avast and AVG Windows Anti Rootkit driver before 22.1 allows local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) due to a double fetch vulnerability at aswArPot+0xc4a3.
CVSS v3.1: 7.8
GHSA-947f-h5gc-f7f5: Microsoft Internet Explorer 8 through 11 allows remote attackers to bypass the XSS filter via a crafted attribute of an element in an HTML document, aka "Internet Explorer XSS Filter Bypass Vulnerability," a different vulnerability than CVE-2014-6365.
CVE-2016-4963: The libxl device-handling in Xen through 4.6.x allows local guest OS users with access to the driver domain to cause a denial of service (management tool confusion) by manipulating information in the backend directories in xenstore.
CVSS v3.0: 4.7
CVSS v2.0: 1.9
RHSA-2025:16407: Red Hat Security Advisory: Streams for Apache Kafka 3.0.1 release and security update
commons-lang/commons-lang: org.apache.commons/commons-lang3: Uncontrolled Recursion vulnerability in Apache Commons Lang netty: netty-codec-http2: Netty MadeYouReset HTTP/2 DDoS Vulnerability
CVSS v3.1: 7.5
GHSA-x4m5-7h4q-f244: An issue in HNAP1/GetMultipleHNAPs of Motorola CX2 router CX 1.0.2 Build 20190508 Rel.97360n allows attackers to access the components GetStationSettings, GetWebsiteFilterSettings and GetNetworkSettings without authentication.
GHSA-5gjc-grvm-m88j: OpenClaw: Memory dreaming config persistence was reachable from operator.write commands
SummaryMemory dreaming config persistence was reachable from operator.write commands.Affected Packages / VersionsPackage: `openclaw`Ecosystem: npmAffected versions: `>= 2026.4.5 < 2026.4.10`Patched versions: `>= 2026.4.10`ImpactA write-scoped gateway path could toggle persistent memory dreaming settings through `/dreaming`, crossing into an admin-class configuration mutation.Technical DetailsThe fix requires admin scope for persistent dreaming gateway toggles.FixThe issue was fixed in #63872. The first stable tag containing the fix is `v2026.4.10`, and `openclaw@2026.4.14` includes the fix.Fix Commit(s)`6af17b39e11f5f35e23b7e5a5f71a7d0aa3c7310`PR: #63872Release Process NoteUsers should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix.CreditsThanks to @zpbrent and @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.
CVSS v4.0: 4.9
GHSA-j43x-42f5-5825: directory.php in AJchat 0.10 allows remote attackers to bypass input validation and conduct SQL injection attacks via a numeric parameter with a value matching the s parameter's hash value, which prevents the associated $_GET["s"] variable from being unset.  NOTE: it could be argued that this vulnerability is due to a bug in the unset PHP command (CVE-2006-3017) and the proper fix should be in PHP; if so, then this should not be treated as a vulnerability in AJChat.
CVE-2019-6669: On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.1-11.6.5.1, undisclosed traffic flow may cause TMM to restart under some circumstances.
CVSS v3.1: 7.5
CVSS v2.0: 5
GHSA-3wvf-vrwq-272g: Certain NETGEAR devices are affected by command injection by an authenticated user. This affects CBR40 before 2.5.0.24, CBR750 before 4.6.3.6, RBK852 before 3.2.17.12, RBR850 before 3.2.17.12, and RBS850 before 3.2.17.12.
CVE-2024-37148: GLPI allows account takeover via SQL Injection in AJAX scripts
GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can exploit a SQL injection vulnerability in some AJAX scripts to alter another user account data and take control of it. Upgrade to 10.0.16.
CVSS v3.1: 8.1
GHSA-hff5-rpfp-7hc7: Open Redirect vulnerability in Hitachi Ops Center Administrator.This issue affects Hitachi Ops Center Administrator: from 10.2.0 before 11.0.8.
CVSS v3.1: 4.3
GHSA-qvhq-cv88-v6v3: Use after free in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally.
CVSS v3.1: 7.8
CVE-2026-29041: Chamilo: Authenticated Remote Code Execution via Unrestricted File Upload
Chamilo is a learning management system. Prior to version 1.11.34, Chamilo LMS is affected by an authenticated remote code execution vulnerability caused by improper validation of uploaded files. The application relies solely on MIME-type verification when handling file uploads and does not adequately validate file extensions or enforce safe server-side storage restrictions. As a result, an authenticated low-privileged user can upload a crafted file containing executable code and subsequently execute arbitrary commands on the server. This issue has been patched in version 1.11.34.
CVSS v3.1: 8.8
CVE-2021-21415: Visual Studio Code Prisma Extension Remote Code Execution Vulnerability
Prisma VS Code a VSCode extension for Prisma schema files. This is a Remote Code Execution Vulnerability that affects all versions of the Prisma VS Code extension older than 2.20.0. If a custom binary path for the Prisma format binary is set in VS Code Settings, for example by downloading a project that has a .vscode/settings.json file that sets a value for "prismaFmtBinPath". That custom binary is executed when auto-formatting is triggered by VS Code or when validation checks are triggered after each keypress on a *.prisma file. Fixed in versions 2.20.0 and 20.0.27. As a workaround users can either edit or delete the `.vscode/settings.json` file or check if the binary is malicious and delete it.
CVSS v3.1: 7.8
GHSA-827c-j6w2-8fg4: Asterisk Open Source 1.2.x before 1.2.35, 1.4.x before 1.4.26.3, 1.6.0.x before 1.6.0.17, and 1.6.1.x before 1.6.1.9; Business Edition A.x.x, B.x.x before B.2.5.12, C.2.x.x before C.2.4.5, and C.3.x.x before C.3.2.2; AsteriskNOW 1.5; and s800i 1.3.x before 1.3.0.5 generate different error messages depending on whether a SIP username is valid, which allows remote attackers to enumerate valid usernames via multiple crafted REGISTER messages with inconsistent usernames in the URI in the To header and the Digest in the Authorization header.
CVE-2021-46659: MariaDB before 10.7.2 allows an application crash because it does not recognize that SELECT_LEX::nest_level is local to each VIEW.
CVSS v3.1: 5.5
CVSS v2.0: 2.1
CVE-2024-56509: changedetection.io has Improper Input Validation Leading to LFR/Path Traversal
changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification service. Improper input validation in the application can allow attackers to perform local file read (LFR) or path traversal attacks. These vulnerabilities occur when user input is used to construct file paths without adequate sanitization or validation. For example, using file:../../../etc/passwd or file: ///etc/passwd can bypass weak validations and allow unauthorized access to sensitive files. Even though this has been addressed in previous patch, it is still insufficient. This vulnerability is fixed in 0.48.05.
CVSS v3.1: 8.6
GHSA-ghmv-6mj4-m43m: MiR robot controllers (central computation unit) makes use of Ubuntu 16.04.2 an operating system, Thought for desktop uses, this operating system presents insecure defaults for robots. These insecurities include a way for users to escalate their access beyond what they were granted via file creation, access race conditions, insecure home directory configurations and defaults that facilitate Denial of Service (DoS) attacks.
CVSS v3.1: 9.8
GHSA-crh8-6485-fxq6: In the Linux kernel, the following vulnerability has been resolved:erofs: fix incorrect early exits in volume label handlingCrafted EROFS images containing valid volume labels can trigger
incorrect early returns, leading to folio reference leaks.However, this does not cause system crashes or other severe issues.
CVSS v3.1: 5.5
CVE-2025-32678: WordPress WP Show Stats plugin <= 1.5 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Ashish Ajani WP Show Stats wp-show-stats allows Cross Site Request Forgery.This issue affects WP Show Stats: from n/a through <= 1.5.
CVSS v3.1: 4.3
CVE-2021-46963: scsi: qla2xxx: Fix crash in qla2xxx_mqueuecommand()
In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Fix crash in qla2xxx_mqueuecommand()

    RIP: 0010:kmem_cache_free+0xfa/0x1b0
    Call Trace:
       qla2xxx_mqueuecommand+0x2b5/0x2c0 [qla2xxx]
       scsi_queue_rq+0x5e2/0xa40
       __blk_mq_try_issue_directly+0x128/0x1d0
       blk_mq_request_issue_directly+0x4e/0xb0

Fix incorrect call to free srb in qla2xxx_mqueuecommand(), as srb is now
allocated by upper layers. This fixes smatch warning of srb unintended
free.
CVSS v3.1: 5.5
GHSA-xq3g-xr36-vwhx: Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWANType_Wizard5.
CVSS v3.1: 9.8
RHSA-2018:0352: Red Hat Security Advisory: java-1.8.0-ibm security update
JDK: J9 JVM allows untrusted code running under a security manager to elevate its privileges OpenJDK: unsynchronized access to encryption key data (Libraries, 8172525) OpenJDK: insufficient validation of the invokeinterface instruction (Hotspot, 8174962) OpenJDK: LdapLoginModule insufficient username encoding in LDAP query (LDAP, 8178449) OpenJDK: DnsClient missing source port randomization (JNDI, 8182125) OpenJDK: loading of classes from untrusted locations (I18n, 8182601) OpenJDK: DerValue unbounded memory allocation (Libraries, 8182387) OpenJDK: insufficient strength of key agreement (JCE, 8185292) OpenJDK: LDAPCertStore insecure handling of LDAP referrals (JNDI, 8186606) OpenJDK: use of global credentials for HTTP/SPNEGO (JGSS, 8186600) OpenJDK: SingleEntryRegistry incorrect setup of deserialization filter (JMX, 8186998) JDK: unspecified vulnerability fixed in 8u161 and 9.0.4 (Deployment) JDK: unspecified vulnerability fixed in 8u161 and 9.0.4 (Deployment) OpenJDK: GTK library loading use-after-free (AWT, 8185325) OpenJDK: ArrayBlockingQueue deserialization to an inconsistent state (Libraries, 8189284) OpenJDK: unbounded memory allocation during deserialization (AWT, 8190289) OpenJDK: unbounded memory allocation in BasicAttributes deserialization (JNDI, 8191142)
CVSS v3.0: 4.3
GHSA-3mcf-jx37-9qjf: Microsoft Access 2007 SP3, 2010 SP1 and SP2, and 2013 in Microsoft Office allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Access file, aka "Access File Format Memory Corruption Vulnerability."
CVE-2026-21431: Emlog vulnerable to stored Cross-site Scripting via image name
Emlog is an open source website building system. Version 2.5.23 has a stored cross-site scripting vulnerability in the `Resource media library ` function while publishing an article. As of time of publication, no known patched versions are available.
CVSS v4.0: 2
CVE-2021-39684: In target_init of gs101/abl/target/slider/target.c, there is a possible allocation of RWX memory due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-203250788References: N/A
CVSS v3.1: 7.8
CVSS v2.0: 7.2
GHSA-pxf8-wrh8-w3jv: The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/add-template.php by adding a question mark (?) followed by the payload.
CVSS v3.1: 4.8
CVE-2007-1160: webSPELL 4.0, and possibly later versions, allows remote attackers to bypass authentication via a ws_auth cookie, a different vulnerability than CVE-2006-4782.
CVSS v2.0: 10
CVE-2022-47444: WordPress ProfilePress Plugin <= 4.4.1 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin <= 4.5.3 versions.
CVSS v3.1: 7.1
GHSA-ghcq-pgwv-hvxp: fontd in Apple Type Services (ATS) in Apple OS X before 10.10.3 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-1131, CVE-2015-1132, CVE-2015-1133, and CVE-2015-1135.
CVE-2026-6005: code-projects Patient Record Management System hematology_print.php sql injection
A flaw has been found in code-projects Patient Record Management System 1.0. The affected element is an unknown function of the file /hematology_print.php. Executing a manipulation of the argument hem_id can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
GHSA-v6vj-m59r-f4gf: The ActivityPub WordPress plugin before 8.0.2 does not properly filter posts to be displayed, allowed unauthenticated users to access drafts/scheduled/pending posts
CVSS v3.1: 7.5
CVE-2023-28892: Malwarebytes AdwCleaner 8.4.0 runs as Administrator and performs an insecure file delete operation on C:\AdwCleaner\Logs\AdwCleaner_Debug.log in which the target location is user-controllable, allowing a non-admin user to escalate privileges to SYSTEM via a symbolic link.
CVSS v3.1: 7.8
CVE-2017-15013: OpenText Documentum Content Server (formerly EMC Documentum Content Server) through 7.3 contains the following design gap, which allows an authenticated user to gain superuser privileges: Content Server stores information about uploaded files in dmr_content objects, which are queryable and "editable" (before release 7.2P02, any authenticated user was able to edit dmr_content objects; now any authenticated user may delete a dmr_content object and then create a new one with the old identifier) by authenticated users; this allows any authenticated user to replace the content of security-sensitive dmr_content objects (for example, dmr_content related to dm_method objects) and gain superuser privileges.
CVSS v3.0: 8.8
CVSS v2.0: 6.5
RHSA-2026:4482: Red Hat Security Advisory: OpenShift Container Platform 4.16.58 bug fix and security update
database/sql: Postgres Scan Race Condition golang: archive/tar: Unbounded allocation when parsing GNU sparse map github.com/sirupsen/logrus: github.com/sirupsen/logrus: Denial-of-Service due to large single-line payload
CVSS v3.1: 7.5
CVE-2026-31489: spi: meson-spicc: Fix double-put in remove path
In the Linux kernel, the following vulnerability has been resolved:

spi: meson-spicc: Fix double-put in remove path

meson_spicc_probe() registers the controller with
devm_spi_register_controller(), so teardown already drops the
controller reference via devm cleanup.

Calling spi_controller_put() again in meson_spicc_remove()
causes a double-put.
CVSS v3.1: 7.8
CVE-2022-30053: In Toll Tax Management System 1.0, the id parameter appears to be vulnerable to SQL injection attacks.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2025-55622: Reolink v4.54.0.4.20250526 was discovered to contain a task hijacking vulnerability due to inappropriate taskAffinity settings. NOTE: this is disputed by the Supplier because it is intentional behavior to ensure a predictable user experience.
CVSS v3.1: 6.5
RHSA-2020:5119: Red Hat Security Advisory: OpenShift Container Platform 4.5.20 packages and golang security update
golang: data race in certain net/http servers including ReverseProxy can lead to DoS golang: ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs
CVSS v3.1: 7.5
GHSA-vgr2-xrrq-jr2p: XSS in the DHCP lease-status table in Billion Smart Energy Router SG600R2 Firmware v3.02.rc6 allows an attacker to inject arbitrary HTML/JavaScript code to achieve client-side code execution via crafted DHCP request packets to etc_ro/web/internet/dhcpcliinfo.asp.
GHSA-5gmg-f78p-25w6: Tenda AX1806 v1.0.0.1 was discovered to contain a heap overflow in the function saveParentControlInfo. This vulnerability allows attackers to cause a Denial of Service (DoS) via the urls parameter.
CVSS v3.1: 7.5
GHSA-vjm2-83qq-qqmg: A weakness has been identified in imvks786 student_management_system up to 9599b560ad3c3b83e75d328b76bedcd489ef1f46. Affected is an unknown function of the file /add.php of the component Student Record Handler. Executing a manipulation can lead to improper access controls. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
CVSS v4.0: 2.1
CVSS v3.1: 6.3
GHSA-gvvr-6rwc-2xqj: An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36714882.
CVSS v3.0: 9.8
GHSA-cjph-938c-9p3j: A SQL injection vulnerability in SupplierDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via the parameters such as "searchTxt".
CVSS v3.1: 7.5
GHSA-pcx3-v62r-wwm3: Adobe Flash Player versions 26.0.0.131 and earlier have a security bypass vulnerability related to the Flash API used by Internet Explorer. Successful exploitation could lead to information disclosure.
CVSS v3.1: 7.5
CVE-2023-29030: Rockwell Automation ArmorStart ST Vulnerable to Cross-Site Scripting Attack

A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a malicious user to view and modify sensitive data or make the web page unavailable. User interaction, such as a phishing attack, is required for successful exploitation of this vulnerability.


CVSS v3.1: 7
CVE-2024-58276: Obi08-Enrollment System 1.0 login.php SQL Injection
Obi08/Enrollment System 1.0 contains a SQL injection vulnerability in the keyword parameter of /get_subject.php that allows unauthenticated attackers to execute arbitrary SQL queries. Attackers can use UNION-based injection to extract sensitive information from the users table including usernames and passwords.
CVSS v4.0: 8.7
GHSA-83qc-2j7c-2vjq: The client for CVS before 1.11 allows a remote malicious CVS server to create arbitrary files using certain RCS diff files that use absolute pathnames during checkouts or updates, a different vulnerability than CVE-2004-0405.
GHSA-w95w-74rp-vcx9: Unchecked return value for some Intel(R) QAT software drivers for Windows before version 1.13 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
CVSS v4.0: 4.8
CVSS v3.1: 3.3
CVE-2021-30126: Lightmeter ControlCenter 1.1.0 through 1.5.x before 1.5.1 allows anyone who knows the URL of a publicly available Lightmeter instance to access application settings, possibly including an SMTP password and a Slack access token, via a settings HTTP query.
CVSS v3.1: 6.5
CVSS v2.0: 6.4
CVE-2025-9817: NULL Pointer Dereference in Wireshark
SSH dissector crash in Wireshark 4.4.0 to 4.4.8 allows denial of service
CVSS v3.1: 7.8
GHSA-2xqw-mg48-p4j5: A logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.7.6, macOS Sequoia 15.5, macOS Sonoma 14.7.6. A sandboxed app may be able to access sensitive user data.
CVSS v3.1: 7.1