ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-wcjc-hfgv-f5wc: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema).  Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and  9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
CVSS v3.1: 4.3
GHSA-gpf9-rcg2-w95g: A vulnerability has been found in code-projects Farmacia 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /pagamento.php. The manipulation of the argument total leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 5.3
CVSS v3.1: 3.5
CVE-2025-9267: In Seagate Toolkit on Windows a vulnerability exists in the Toolkit Installer prior to versions 2.35.0.6 where it attempts to load DLLs from the current working directory without validating their origin or integrity. This behavior can be exploited by placing a malicious DLL in the same directory as the installer executable, leading to arbitrary code execution with the privileges of the user running the installer. The issue stems from the use of insecure DLL loading practices, such as relying on relative paths or failing to specify fully qualified paths when invoking system libraries.
CVSS v4.0: 7
GHSA-j45q-g2vj-3f3r: A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions). Affected devices do not properly validate an offset value which can be defined in TCP packets when calling a method. This could allow an attacker to retrieve parts of the content of the memory.
CVSS v3.1: 5.3
GHSA-7635-mr68-26j6: The IP Based Login WordPress plugin before 2.4.1 does not have CSRF checks in some places, which could allow attackers to make logged in users delete all logs via a CSRF attack
CVSS v3.1: 4.3
GHSA-93wm-q8ph-8hr3: In keyinstall, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07589148; Issue ID: ALPS07589148.
CVSS v3.1: 4.4
GHSA-956r-q88m-f6fg: A vulnerability was found in IBOS OA 4.5.5 and classified as critical. This issue affects some unknown processing of the file ?r=dashboard/user/export&uid=X. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-238631. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v3.0: 6.3
CVE-2024-58093: PCI/ASPM: Fix link state exit during switch upstream function removal
In the Linux kernel, the following vulnerability has been resolved:

PCI/ASPM: Fix link state exit during switch upstream function removal

Before 456d8aa37d0f ("PCI/ASPM: Disable ASPM on MFD function removal to
avoid use-after-free"), we would free the ASPM link only after the last
function on the bus pertaining to the given link was removed.

That was too late. If function 0 is removed before sibling function,
link->downstream would point to free'd memory after.

After above change, we freed the ASPM parent link state upon any function
removal on the bus pertaining to a given link.

That is too early. If the link is to a PCIe switch with MFD on the upstream
port, then removing functions other than 0 first would free a link which
still remains parent_link to the remaining downstream ports.

The resulting GPFs are especially frequent during hot-unplug, because
pciehp removes devices on the link bus in reverse order.

On that switch, function 0 is the virtual P2P bridge to the internal bus.
Free exactly when function 0 is removed -- before the parent link is
obsolete, but after all subordinate links are gone.

[kwilczynski: commit log]
CVSS v3.1: 7.8
RHSA-2022:0513: Red Hat Security Advisory: firefox security update
Mozilla: Extensions could have bypassed permission confirmation during update Mozilla: Drag and dropping an image could have resulted in the dropped object being an executable Mozilla: Sandboxed iframes could have executed script if the parent appended elements Mozilla: Cross-Origin responses could be distinguished between script and non-script content-types Mozilla: frame-ancestors Content Security Policy directive was not enforced for framed extension pages Mozilla: Script Execution during invalid object state Mozilla: Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6
CVSS v3.1: 8.8
GHSA-x3xx-356w-2wvf: In Advanced SystemCare Ultimate 11.0.1.58, the driver file (Monitor_win10_x64.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9c4060c4.
CVSS v3.0: 7.8
CVE-2021-47777: Build Smart ERP 21.0817 - 'eidValue' SQL Injection (Unauthenticated)
Build Smart ERP 21.0817 contains an unauthenticated SQL injection vulnerability in the 'eidValue' parameter of the login validation endpoint. Attackers can inject stacked SQL queries using payloads like ';WAITFOR DELAY '0:0:3'-- to manipulate database queries and potentially extract or modify database information.
CVSS v4.0: 8.8
CVSS v3.1: 8.2
GHSA-4cqx-cgrq-mp79: An issue was discovered in Tigergraph Enterprise 3.7.0. The GSQL query language provides users with the ability to write data to files on a remote TigerGraph server. The locations that a query is allowed to write to are configurable via the GSQL.FileOutputPolicy configuration setting. GSQL queries that contain UDFs can bypass this configuration setting and, as a consequence, can write to any file location to which the administrative user has access.
CVSS v3.1: 8.8
GHSA-vf6r-mmhc-3xcm: Exposure of Sensitive Information to an Unauthorized Actor in Undertow
An information leak vulnerability was found in Undertow. If all headers are not written out in the first write() call then the code that handles flushing the buffer will always write out the full contents of the writevBuffer buffer, which may contain data from previous requests.
CVSS v3.1: 5.3
GHSA-jg83-3336-7m7m: SQL injection vulnerability in paidbanner.php in LM Starmail Paidmail 2.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter.
GHSA-j5px-9g9w-fvp5: Portainer before 1.22.1 has Incorrect Access Control (issue 4 of 4).
CVSS v3.1: 8.8
CVE-2012-5613: MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other versions, when configured to assign the FILE privilege to users who should not have administrative privileges, allows remote authenticated users to gain privileges by leveraging the FILE privilege to create files as the MySQL administrator. NOTE: the vendor disputes this issue, stating that this is only a vulnerability when the administrator does not follow recommendations in the product's installation documentation. NOTE: it could be argued that this should not be included in CVE because it is a configuration issue.
CVSS v2.0: 6
CVE-2025-58379: Password Exposure in Brocade Fabric OS
Brocade Fabric OS before 9.2.1 has a vulnerability that could allow a local authenticated attacker to reveal command line passwords using commands that may expose higher privilege sensitive information by a lower privileged user.
CVSS v4.0: 6
CVE-2023-32468: 

Dell ECS Streamer, versions prior to 2.0.7.1, contain an insertion of sensitive information in log files vulnerability. A remote malicious high-privileged user could potentially exploit this vulnerability leading to exposure of this sensitive data.


CVSS v3.1: 5.8
GHSA-99j5-xj2q-86w3: An issue in the sql_trans_copy_key component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS v3.1: 7.5
GHSA-xvv7-wqpf-2qrv: The Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.4. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to invoke those functions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS v3.1: 4.3
CVE-2012-4278: Multiple cross-site scripting (XSS) vulnerabilities in Free Realty 3.1-0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) notes parameter to (a) admin/agenteditor.php; (2) title, (3) previewdesc, (4) fulldesc, or (5) notes parameter (b) to agentadmin.php or (c) in an addlisting action to agentadmin.php; or unspecified vectors to (d) admin/adminfeatures.php.
CVSS v2.0: 4.3
GHSA-cg8j-jfqg-q55w: Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site Scripting (XSS) vulnerability. An attacker could send malicious content to an authenticated user and steal information from their session due to insufficient validation of user input in  '/server_options?sid=', affecting the 'tasks_logs_dir', 'errors_logs_dir', 'error_notifications_address', 'status_notifications_address', and 'status_reports_address' parameters.
CVSS v4.0: 5.1
CVSS v3.1: 5.4
CVE-2021-26964: A remote authentication restriction bypass vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. A vulnerability in the AirWave web-based management interface could allow an authenticated remote attacker to improperly access and modify devices and management user details. A successful exploit would consist of an attacker using a lower privileged account to change management user or device details. This could allow the attacker to escalate privileges and/or change network details that they should not have access to.
CVSS v3.1: 7.1
CVSS v2.0: 5.5
GHSA-pr3h-vf2g-qqff: The IRC protocol plugin in libpurple in Pidgin before 2.10.8 does not validate argument counts, which allows remote IRC servers to cause a denial of service (application crash) via a crafted message.
GHSA-gmxg-5w57-j63q: In uriparser before 1.0.2, there is pointer difference truncation to int in various places.
CVSS v3.1: 2.9
GHSA-m6w8-x5rf-59xw: Adobe Dimension versions 3.4.7 (and earlier) is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 7.8
CVE-2024-13559: TemplatesNext ToolKit <= 3.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The TemplatesNext ToolKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tx_woo_wishlist_table' shortcode in all versions up to, and including, 3.2.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
CVE-2016-9630: An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-33. w3m allows remote attackers to cause a denial of service (global buffer overflow and crash) via a crafted HTML page.
CVSS v3.0: 6.5
CVSS v2.0: 4.3
GHSA-wh52-hfmg-7h2q: PHP remote file inclusion vulnerability in gmapfactory/params.php in MapLab 2.2.1, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the gszAppPath parameter.
GHSA-j5cw-ghxr-f273: Buffer over-read while parsing RPS due to lack of check of input validation on values received from user side. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
GHSA-8jm2-6grj-98mq: SQL injection vulnerability in view_album.php in SelectaPix 1.4 allows remote attackers to execute arbitrary SQL commands via unknown vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party sources.
GHSA-g7x3-mjgq-3ff7: The List Pages Shortcode WordPress plugin before 1.7.6 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CVSS v3.1: 5.4
RHSA-2026:3358: Red Hat Security Advisory: kernel-rt security update
kernel: ext4: fix use-after-free in ext4_orphan_cleanup kernel: Linux kernel: Out-of-bounds write in VXLAN due to incorrect nexthop hash size leading to denial of service kernel: Linux kernel Bluetooth: Denial of Service due to use-after-free in connection handling kernel: ip6_vti: fix slab-use-after-free in decode_session6 kernel: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue kernel: Linux kernel: xHCI driver isochronous event handling race condition leading to data loss or UAF kernel: Linux kernel: Memory corruption in Squashfs due to incorrect block size calculation kernel: Linux kernel: Denial of Service via out-of-bounds read in USB configuration parsing kernel: smb: client: let recv_done verify data_offset, data_length and remaining_data_length kernel: Linux kernel ALSA USB audio driver: Buffer overflow leading to information disclosure and denial of service kernel: Linux kernel: Use-after-free in proc_readdir_de() can lead to privilege escalation or denial of service. kernel: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid
CVSS v3.1: 7.5
GHSA-hr7w-h544-36m8: Improper Neutralization of Special Elements used in an N1QL Command ('N1QL Injection') vulnerability in PlexTrac  allows N1QL Injection.This issue affects PlexTrac: from 1.61.3 before 2.8.1.
CVSS v4.0: 8.6
CVSS v3.1: 9.8
PYSEC-2021-812: TensorFlow is an open source platform for machine learning. In affected versions during TensorFlow's Grappler optimizer phase, constant folding might attempt to deep copy a resource tensor. This results in a segfault, as these tensors are supposed to not change. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
GHSA-xc97-r49q-cxgc: phpMyAdmin Local file inclusion through transformation feature
An attacker can exploit phpMyAdmin before 4.8.4 to leak the contents of a local file because of an error in the transformation feature. The attacker must have access to the phpMyAdmin Configuration Storage tables, although these can easily be created in any database to which the attacker has access. An attacker must have valid credentials to log in to phpMyAdmin; this vulnerability does not allow an attacker to circumvent the login system.
CVSS v3.0: 6.5
GHSA-2phg-qgmm-r638: Sliver has Potential Zip Bomb Denial of Service in GzipEncoder
SummaryGzipEncoder does not limit output size when processing compressed data. This allows unauthenticated remote attackers to crash sliver server by sending a http request with highly compressed gzip data (aka zip bomb).DetailsIn `util/encoders/gzip.go`, `Decode()` method decompresses given data by reading the entire gzip buffer at once without limiting output size.PoCImpactUnauthenticated remote attackers can exhaust memory and cpu resource of sliver server and crash it when they have GzipEncoderID, which can be easily retrived from implant's http traffic, or by brute-forcing.A fixed version is available at https://github.com/BishopFox/sliver/releases/tag/v1.7.2.
CVSS v4.0: 7.7
CVE-2024-23299: The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7.4, macOS Sonoma 14.4, macOS Ventura 13.6.5. An app may be able to break out of its sandbox.
CVSS v3.1: 8.6
RHSA-2024:8449: Red Hat Security Advisory: edk2 security update
edk2: Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise message
CVSS v3.1: 8.8
CVE-2024-13120: ProfilePress < 4.15.20 - Admin+ Stored XSS
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content  WordPress plugin before 4.15.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS v3.1: 4.8
PYSEC-2023-63: in-toto is a framework to protect supply chain integrity. The in-toto configuration is read from various directories and allows users to configure the behavior of the framework. The files are from directories following the XDG base directory specification. In versions 1.4.0 and prior, among the files read is `.in_totorc` which is a hidden file in the directory in which in-toto is run. If an attacker controls the inputs to a supply chain step, they can mask their activities by also passing in an `.in_totorc` file that includes the necessary exclude patterns and settings. RC files are widely used in other systems and security issues have been discovered in their implementations as well. Maintainers found in their conversations with in-toto adopters that `in_totorc` is not their preferred way to configure in-toto. As none of the options supported in `in_totorc` is unique, and can be set elsewhere using API parameters or CLI arguments, the maintainers decided to drop support for `in_totorc`. in-toto's `user_settings` module has been dropped altogether in commit 3a21d84f40811b7d191fa7bd17265c1f99599afd. Users may also sandbox functionary code as a security measure.
CVE-2022-36569: Tenda AC9 V15.03.05.19 was discovered to contain a stack overflow via the deviceList parameter at /goform/setMacFilterCfg.
CVSS v3.1: 8.8
GHSA-c9pf-5mxh-jhg9: GnuCOBOL 2.2 has a stack-based buffer overflow in cb_encode_program_id in cobc/typeck.c via crafted COBOL source code.
CVE-2024-27798: An authorization issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.7.5, macOS Sonoma 14.5, macOS Ventura 13.6.7. An attacker may be able to elevate privileges.
CVSS v3.1: 7.8
GHSA-7r34-79r5-rcc9: MCP Atlassian has SSRF via unvalidated X-Atlassian-Jira-Url / X-Atlassian-Confluence-Url headers
SummaryAn unauthenticated attacker who can reach the mcp-atlassian HTTP endpoint can force the server process to make outbound HTTP requests to an arbitrary attacker-controlled URL by supplying two custom HTTP headers without an `Authorization` header. No authentication is required. The vulnerability exists in the HTTP middleware and dependency injection layer — not in any MCP tool handler - making it invisible to tool-level code analysis. In cloud deployments, this could enable theft of IAM role credentials via the instance metadata endpoint (`169.254.169.254`). In any HTTP deployment it enables internal network reconnaissance and injection of attacker-controlled content into LLM tool results.DetailsThe server supports a multi-tenant HTTP authentication mode where clients supply per-request Jira/Confluence URLs via custom headers. The middleware (`src/mcp_atlassian/servers/main.py:436–448`) extracts `X-Atlassian-Jira-Url` from the request and stores it in request state with no validation. The dependency provider (`src/mcp_atlassian/servers/dependencies.py:189–217`) then uses this value directly as the `url=` parameter when constructing a `JiraConfig` and `JiraFetcher`. The first method call on the fetcher (`get_current_user_account_id()`) immediately issues a `GET` request to `{header_url}/rest/api/2/myself` — an outbound SSRF call to the attacker-controlled URL.No comparison is made against the server-configured `JIRA_URL` environment variable. No private IP range blocklist is applied. No URL scheme allowlist is enforced.**Trigger conditions — all four must hold:**Server running with `--transport streamable-http` or `--transport sse`Request contains `X-Atlassian-Jira-Url` header (any non-empty value)Request contains `X-Atlassian-Jira-Personal-Token` header (any non-empty value)Request has **no** `Authorization` headerAn identical vulnerability exists for Confluence at `dependencies.py:341–393` via `X-Atlassian-Confluence-Url` +
  `X-Atlassian-Confluence-Personal-Token`.**Root cause - middleware** (`src/mcp_atlassian/servers/main.py:436–448`):
CVSS v3.1: 8.2
RHSA-2026:17567: Red Hat Security Advisory: libpng security update
libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion
CVSS v3.1: 7.6
GHSA-jf2g-fqpf-2mrq: Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through 3.2.1.
CVSS v3.1: 4.3
GHSA-22vq-qxw4-g2qr: The Takeads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.0.13. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete the plugin's configuration options.
CVSS v3.1: 4.3
CVE-2019-4011: IBM BigFix Platform 9.2 and 9.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 155885.
CVSS v3.0: 5.4
GHSA-4r2x-685x-rf8p: Unvalidated input in the Photo Gallery (10Web Photo Gallery) WordPress plugin, versions before 1.5.55, leads to SQL injection via the frontend/models/model.php bwg_search_x parameter.
GHSA-64rw-mj5q-w82v: Argument injection vulnerability in XChat 2.8.7b and earlier on Windows, when Internet Explorer is used, allows remote attackers to execute arbitrary commands via the --command parameter in an ircs:// URI.