ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-4fmc-cp96-m69h: AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the year parameter. Attackers can send GET requests to year.php with crafted SQL payloads in the year parameter to extract sensitive database information including usernames, database names, and version details.
CVSS v4.0: 8.8
CVSS v3.1: 8.2
CVE-2012-3802: Unspecified vulnerability in the Post Affiliate Pro (PAP) module for Drupal allows remote authenticated users to read the commissions of other users via unknown attack vectors.
CVSS v2.0: 4
RHSA-2024:3043: Red Hat Security Advisory: ansible-core bug fix, enhancement, and security update
ansible-core: possible information leak in tasks that ignore ANSIBLE_NO_LOG configuration
CVSS v3.1: 5
GHSA-g589-q56x-4rhp: Integer overflow in exif.cpp in exiv2 library allows context-dependent attackers to execute arbitrary code via a crafted EXIF file that triggers a heap-based buffer overflow.
GHSA-2rr5-8q37-2w7h: Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby
SeverityThe Nokogiri maintainers have evaluated this as [**High Severity** 7.5 (CVSS3.0)](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H/RL:O/RC:C/MAV:N/MAC:L) for JRuby users. (This security advisory does not apply to CRuby users.)ImpactIn Nokogiri v1.12.4 and earlier, **on JRuby only**, the SAX parser resolves external entities by default.Users of Nokogiri on JRuby who parse untrusted documents using any of these classes are affected:Nokogiri::XML::SAX::ParserNokogiri::HTML4::SAX::Parser or its alias Nokogiri::HTML::SAX::ParserNokogiri::XML::SAX::PushParserNokogiri::HTML4::SAX::PushParser or its alias Nokogiri::HTML::SAX::PushParserMitigationJRuby users should upgrade to Nokogiri v1.12.5 or later. There are no workarounds available for v1.12.4 or earlier.CRuby users are not affected.
CVSS v3.0: 7.5
RHSA-2022:4924: Red Hat Security Advisory: kernel security and bug fix update
kernel: buffer overflow in IPsec ESP transformation code
CVSS v3.1: 7.8
GHSA-fhx8-5c23-x7x5: Cross Site Scripting vulnerability in Contribsys Sidekiq
Cross Site Scripting vulnerability in Contribsys Sidekiq v.6.5.8 allows a remote attacker to obtain sensitive information via a crafted URL to the filter functions.
CVSS v4.0: 5.1
CVSS v3.1: 6.1
CVE-2024-41700: Barix – CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Barix – CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CVSS v3.1: 7.5
CVE-2012-0117: Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.x allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than CVE-2012-0486, CVE-2012-0487, CVE-2012-0488, CVE-2012-0489, CVE-2012-0491, CVE-2012-0493, and CVE-2012-0495.
CVSS v2.0: 3.5
GHSA-mhg7-666j-cqg4: Claude Code Vulnerable to Command Injection via Piped sed Command Bypasses File Write Restrictions
Claude Code failed to properly validate commands using piped sed operations with the echo command, allowing attackers to bypass file write restrictions. This vulnerability enabled writing to sensitive directories like the .claude folder and paths outside the project scope. Exploiting this required the ability to execute commands through Claude Code with the "accept edits" feature enabled.Users on standard Claude Code auto-update received this fix automatically. Users performing manual updates are advised to update to the latest version.Claude Code thanks hackerone.com/nil221 for reporting this issue!
CVSS v4.0: 7.7
GHSA-mrq3-x9xw-5cqm: A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may lead to memory corruption.
CVSS v3.1: 8.8
CVE-2022-23525: Helm vulnerable to Denial of service via NULL Pointer Dereference
Helm is a tool for managing Charts, pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to NULL Pointer Dereference in the _repo_package. The _repo_ package contains a handler that processes the index file of a repository. For example, the Helm client adds references to chart repositories where charts are managed. The _repo_ package parses the index file of the repository and loads it into structures Go can work with. Some index files can cause array data structures to be created causing a memory violation. Applications that use the _repo_ package in the Helm SDK to parse an index file can suffer a Denial of Service when that input causes a panic that cannot be recovered from. The Helm Client will panic with an index file that causes a memory violation panic. Helm is not a long running service so the panic will not affect future uses of the Helm client. This issue has been patched in 3.10.3. SDK users can validate index files that are correctly formatted before passing them to the _repo_ functions.
CVSS v3.1: 5.3
GHSA-3m2v-4569-gxqh: The NFS parser in tcpdump before 4.9.2 has a buffer over-read in print-nfs.c:interp_reply().
CVSS v3.0: 9.8
GHSA-xxm4-m7f5-mqxf: Deserialization of Untrusted Data vulnerability in ThemeMakers ThemeMakers Visual Content Composer allows Object Injection. This issue affects ThemeMakers Visual Content Composer: from n/a through 1.5.8.
CVSS v3.1: 9.8
CVE-2025-58308: Vulnerability of improper criterion security check in the call module.
Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.
CVSS v3.1: 7.3
GHSA-2532-vm9m-g275: A vulnerability, which was classified as critical, was found in Tenda AC10U 15.03.06.49_multi_TDE01. This affects the function formSetPPTPServer. The manipulation of the argument startIp leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252129 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v3.1: 4.7
GHSA-h6v4-9c8c-hxcj: Smart eVision has an improper privilege management vulnerability. A remote attacker with general user privilege can exploit this vulnerability to escalate to administrator privilege, and then perform arbitrary system command or disrupt service.
CVSS v3.1: 8.8
CVE-2008-5136: tkusr in tkusr 0.82 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/tkusr.pgm temporary file.
CVSS v2.0: 6.9
CVE-2012-2428: Integer overflow in the server in xArrow before 3.4.1 allows remote attackers to execute arbitrary code via a crafted packet that triggers an out-of-bounds read operation.
CVSS v2.0: 10
GHSA-m2rr-g8pf-8wrj: IEC 60870-5-104 used in bidirectional mode is vulnerable
for a NULL pointer dereferencing, if a specially crafted
sequence of messages is sent for a certain time, causing
Denial of Service impact.
Product is only affected if IEC 60870-5-104 functionality in
bidirectional mode (BCI) is configured.
CVSS v4.0: 6.9
CVE-2025-11114: CodeAstro Online Leave Application leaveAplicationForm.php sql injection
A flaw has been found in CodeAstro Online Leave Application 1.0. Affected by this vulnerability is an unknown functionality of the file /leaveAplicationForm.php. Executing manipulation of the argument absence[] can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
RHSA-2025:8196: Red Hat Security Advisory: thunderbird security update
thunderbird: Sender Spoofing via Malformed From Header in Thunderbird thunderbird: JavaScript Execution via Spoofed PDF Attachment and file:/// Link thunderbird: Tracking Links in Attachments Bypassed Remote Content Blocking
CVSS v3.1: 6.5
GHSA-rgrq-pg8h-w7h3: Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS v3.1: 5.4
GHSA-6h26-gx4c-3ghh: Simple User Management System with PHP-MySQL v1.0 is vulnerable to Cross-Site Scripting (XSS) via the Profile Section. The system fails to properly sanitize user input, allowing attackers to inject and execute arbitrary JavaScript when the input is displayed in the browser
CVSS v3.1: 4.6
CVE-2024-28570: Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) via the processMakerNote() function when reading images in JPEG format.
CVSS v3.1: 5.5
GHSA-7cfv-jg3m-5vqg: Multiple unspecified vulnerabilities in IBM WebSphere Application Server (WAS) before Fix Pack 21 (6.0.2.21) have unknown impact and attack vectors, aka (1) PK33799, or (2) a "Potential security exposure" in the Samples component (PK40213).
CVE-2007-0683: PHP remote file inclusion vulnerability in includes/functions.php in Omegaboard 1.0beta4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
CVSS v2.0: 7.5
RHSA-2025:7732: Red Hat Security Advisory: kernel-rt security update
kernel: netfilter: ipset: add missing range check in bitmap_ip_uadt
CVSS v3.1: 7
GHSA-8h56-mx2q-hr97: CesarFTP 0.98b and earlier stores usernames and passwords in plaintext in the settings.ini file, which allows attackers to gain privileges.
CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd
In the Linux kernel, the following vulnerability has been resolved:

NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd

The /proc/fs/nfs/exports proc entry is created at module init
and persists for the module's lifetime. exports_proc_open()
captures the caller's current network namespace and stores
its svc_export_cache in seq->private, but takes no reference
on the namespace. If the namespace is subsequently torn down
(e.g. container destruction after the opener does setns() to a
different namespace), nfsd_net_exit() calls nfsd_export_shutdown()
which frees the cache. Subsequent reads on the still-open fd
dereference the freed cache_detail, walking a freed hash table.

Hold a reference on the struct net for the lifetime of the open
file descriptor. This prevents nfsd_net_exit() from running --
and thus prevents nfsd_export_shutdown() from freeing the cache
-- while any exports fd is open. cache_detail already stores
its net pointer (cd->net, set by cache_create_net()), so
exports_release() can retrieve it without additional per-file
storage.
CVSS v3.1: 7.8
GHSA-xh7m-p996-h2f6: NVIDIA Transformers4Rec for Linux contains a vulnerability where an attacker could cause improper deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
CVSS v3.1: 7.8
CVE-2017-14228: In Netwide Assembler (NASM) 2.14rc0, there is an illegal address access in the function paste_tokens() in preproc.c, aka a NULL pointer dereference. It will lead to remote denial of service.
CVSS v3.0: 5.5
CVSS v2.0: 4.3
GHSA-3g93-3q7r-642f: Incorrect default permissions in some Intel(R) Advanced Link Analyzer Standard Edition software installers before version 22.1 .1 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS v3.1: 6.7
GHSA-rvcv-5hfg-2hqr: Remote Process Explorer 1.0.0.16 contains a local buffer overflow vulnerability that allows attackers to cause a denial of service by sending a crafted payload to the Add Computer dialog. Attackers can paste a malicious string into the computer name textbox and trigger a crash by connecting to the added computer, overwriting the SEH chain and corrupting exception handlers.
CVSS v4.0: 6.9
CVSS v3.1: 6.2
GHSA-r498-8rcj-p67x: Inappropriate implementation in Fenced Frames in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to obtain potentially sensitive information from the system via a crafted HTML page. (Chromium security severity: Medium)
CVSS v3.1: 6.5
RHSA-2010:0053: Red Hat Security Advisory: kernel security and bug fix update
kernel: ipv6_hop_jumbo remote system crash kernel: e1000 issue reported at 26c3 kernel: r8169 issue reported at 26c3 kernel: e1000e frame fragment issue
GHSA-xcqm-rr3v-jgg5: libjxl 0.6.1 has an assertion failure in LowMemoryRenderPipeline::Init() in render_pipeline/low_memory_render_pipeline.cc.
CVSS v3.1: 6.5
GHSA-f32p-m7r9-7673: Multiple interpretation error in unspecified versions of Symantec Antivirus allows remote attackers to bypass virus detection via a malicious executable in a specially crafted RAR file with malformed central and local headers, which can still be opened by products such as Winrar and PowerZip, even though they are rejected as corrupted by Winzip and BitZipper.
CVE-2002-1987: Directory traversal vulnerability in view_source.jsp in Resin 2.1.2 allows remote attackers to read arbitrary files via a "\.." (backslash dot dot).
CVSS v2.0: 5
GHSA-m5wq-7q8v-49f5: ISS BlackIce 3.6, as used in multiple products including BlackICE PC Protection, Server Protection, Agent for Server, and RealSecure Desktop 3.6 and 7.0, does not drop privileges before launching help from the "More Info" button in the "Application Protection" dialog, which allows local users to execute arbitrary programs as SYSTEM.
GHSA-q4fx-wrwr-cfpx: HP-UX B.11.00, B.11.04, B.11.11, and B.11.23 allows remote attackers to cause a denial of service via a "Rose Attack" that involves sending a subset of small IP fragments that do not form a complete, larger packet.
GHSA-44x3-wp7c-822v: Multiple SQL injection vulnerabilities in DevelopItEasy Photo Gallery 1.2 allow remote attackers to execute arbitrary SQL commands via the (1) cat_id parameter to gallery_category.php, (2) photo_id parameter to gallery_photo.php, and the (3) user_name and (4) user_pass parameters to admin/index.php.  NOTE: some of these details are obtained from third party information.
GHSA-ffhq-jq7m-75qw: Multiple cross-site scripting (XSS) vulnerabilities in editprofile.php in Viscacha 0.8 Gold allow remote authenticated users to inject arbitrary web script or HTML via the (1) skype, (2) yahoo, (3) aol, (4) msn, or (5) jabber parameter in a profile2 action.  NOTE: some of these details are obtained from third party information.
GHSA-c33g-4mp4-9vx4: The SportsPress – Sports Club & League Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the settings_save() function in all versions up to, and including, 2.7.17. This makes it possible for unauthenticated attackers to update the permalink structure for the clubs
CVSS v3.1: 5.3
CVE-2012-2389: hostapd 0.7.3, and possibly other versions before 1.0, uses 0644 permissions for /etc/hostapd/hostapd.conf, which might allow local users to obtain sensitive information such as credentials.
CVSS v2.0: 2.1
GHSA-jgj3-r8hr-9pjw: Open WebUI's Improper Authorization in Standard Channels Allows Message Updates with Read Permission
Vulnerability DescriptionIn standard channels (i.e., channels whose `channel.type` is neither `group` nor `dm`), the endpoint`POST /api/v1/channels/{channel_id}/messages/{message_id}/update` can be accessed with **read permission only**.When `access_control` is set to `None`, the authorization check `has_access(..., type="read")` evaluates to `True`, allowing users who are **not the message owner** to update messages.As a result, unauthorized modification of other users’ messages is possible.Attack PrerequisitesThe attacker is an authenticated user (role `user` or higher)The target channel is a standard channel (i.e., not `group` or `dm`)`access_control` is `None` or allows `read` accessThe attacker can obtain the target `message_id` (e.g., via the channel’s message list)Attack ScenarioThe attacker (User B) retrieves another user’s `message_id` from the message list in a standard channelThe attacker sends a request to`POST /api/v1/channels/{channel_id}/messages/{message_id}/update`The message authored by another user (User A) is successfully updatedPotential ImpactUnauthorized modification of other users’ messages (violation of data integrity)Steps to ReproduceLog in as an administratorCreate User ACreate User BLog in as User ALog in as User BAs the administrator, create a new channelAs User A, post a new message in the channelAs User B, edit User A’s messageConfirm that User A’s message has been modified without authorizationAffected Files and Line Numbers`backend/open_webui/routers/channels.py:1417–1460`The authorization check in `update_message_by_id` allows access with **read** permission`backend/open_webui/utils/access_control.py:124–135`When `access_control=None` and `strict=True`, **read** access is permitted`backend/open_webui/models/messages.py:341–358`The update logic does not enforce any message ownership checkRecommended MitigationUpdate the condition in`backend/open_webui/routers/channels.py:1451–1456`by changing the permission check from **`read`** to **`write`**, so that only administrators, message owners, or users with write permission can update messages.Proposed ChangesFor standard channels, change the update permission requirement from`has_access(..., type="read")` to `has_access(..., type="write")`Preserve the existing ownership check (`message.user_id == user.id`)**AI Usage**Translation from Japanese to EnglishCWE classification and assessmentAffected Files and Line Numbers
CVSS v3.1: 6.5
GHSA-wgwv-6x26-xh66: The Translate WordPress â€“ Google Language Translator WordPress plugin before 6.0.12 does not sanitise and escape some of its settings before outputting it in various pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVE-2013-5132: Apple AirPort Base Station Firmware before 7.6.4 does not properly handle incorrect frame lengths, which allows remote attackers to cause a denial of service (device crash) by associating with the access point and then sending a short frame.
CVSS v2.0: 5.4
RHSA-2024:5432: Red Hat Security Advisory: OpenShift Container Platform 4.14.35 security update
ssh: Prefix truncation attack on Binary Packet Protocol (BPP)
CVSS v3.1: 5.9
GHSA-6ghv-cm9w-9m65: A maliciously crafted DWF file, when parsed through Autodesk Navisworks, can force an Out-of-Bounds Write vulnerability. A malicious actor can leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
CVSS v3.1: 7.8
GHSA-gf3h-q37j-xmm8: FISCO-BCOS release-3.0.0-rc2 was discovered to contain an issue where a malicious node, via a malicious viewchange packet, will cause normal nodes to change view excessively and stop generating blocks.
CVSS v3.1: 7.5
CVE-2010-4810: Multiple PHP remote file inclusion vulnerabilities in AR Web Content Manager (AWCM) 2.1 final allow remote attackers to execute arbitrary PHP code via a URL in the theme_file parameter to (1) includes/window_top.php and (2) header.php, and the (3) lang_file parameter to control/common.php.
CVSS v2.0: 7.5
GHSA-m9q7-h3j2-7cq3: Auth. (editor+) Reflected Cross-Site Scripting (XSS) vulnerability in ExpressTech Quiz And Survey Master plugin <= 7.3.4 on WordPress.
CVSS v3.1: 5.4
GHSA-24vq-qfc5-qrmj: A heap-buffer-overflow vulnerability exists in wolfSSL's wolfSSL_d2i_SSL_SESSION() function. When deserializing session data with SESSION_CERTS enabled, certificate and session id lengths are read from an untrusted input without bounds validation, allowing an attacker to overflow fixed-size buffers and corrupt heap memory. A maliciously crafted session would need to be loaded from an external source to trigger this vulnerability. Internal sessions were not vulnerable.
CVSS v4.0: 5
CVSS v3.1: 8.1
CVE-2024-25157: Authentication bypass in GoAnywhere MFT prior to 7.6.0
An authentication bypass vulnerability in GoAnywhere MFT prior to 7.6.0 allows Admin Users with access to the Agent Console to circumvent some permission checks when attempting to visit other pages. This could lead to unauthorized information disclosure or modification.
CVSS v3.1: 6.5
GHSA-6jjr-vcqj-wfcm: ui/editor/tooltip/Rdf.js in Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07 allows HTML injection in tooltips for entities.
CVSS v3.1: 6.1
GHSA-3c64-pg4p-f5fw: wu-ftpd 2.4 FTP server does not properly drop privileges when an ABOR (abort file transfer) command is executed during a file transfer, which causes a signal to be handled incorrectly and allows local and possibly remote attackers to read arbitrary files.
CVE-2011-1755: jabberd2 before 2.2.14 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.
CVSS v3.1: 7.5
CVSS v2.0: 5
CVE-2021-31601: An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. They implement a series of web services using the SOAP protocol to allow scripting interaction with the backend server. An authenticated user (regardless of privileges) can list all databases connection details and credentials.
CVSS v3.1: 7.1
RHSA-2013:0701: Red Hat Security Advisory: ruby193-ruby, rubygem-json and rubygem-rdoc security update
rubygem-rdoc: Cross-site scripting in the documentation created by Darkfish Rdoc HTML generator / template rubygem-json: Denial of Service and SQL Injection
CVSS v3.1: 5.4
GHSA-w73f-r889-xrx8: AFP Server in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon restart) via crafted reconnect authentication packets.
GHSA-32fq-m2q5-h83g: XWiki-Platform vulnerable to stored Cross-site Scripting via the HTML displayer in Live Data
ImpactA user without script rights can introduce a stored XSS by using the Live Data macro.For instance:PatchesThis has been patched in XWiki 14.9, 14.4.7, and 13.10.10.WorkaroundsNo known workaround.Referenceshttps://jira.xwiki.org/browse/XWIKI-20143For more informationIf you have any questions or comments about this advisory:Open an issue in [Jira](http://jira.xwiki.org/)Email us at [Security ML](mailto:security@xwiki.org)
CVSS v3.1: 8.9
CVE-2026-26027: GLPI has an Unauthenticated Stored XSS via inventory
GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, an unauthenticated user can store an XSS payload through the inventory endpoint. This vulnerability is fixed in 11.0.6.
CVSS v3.1: 7.5
GHSA-rqfv-g8fm-xg4w: Argument injection vulnerability in the Linden Lab Second Life secondlife:// protocol handler, as used in Internet Explorer and possibly Firefox, allows remote attackers to obtain sensitive information via a '" ' (double-quote space) sequence followed by the -autologin and -loginuri arguments, which cause the handler to post login credentials and software installation details to an arbitrary URL.
GHSA-pgfc-hgqj-gfc4: IPFire 2.21 Core Update 127 contains multiple cross-site scripting vulnerabilities in the ovpnmain.cgi script that allow attackers to inject malicious scripts through VPN configuration parameters. Attackers can submit POST requests with script payloads in parameters like VPN_IP, DMTU, ccdname, ccdsubnet, DOVPN_SUBNET, DHCP_DOMAIN, DHCP_DNS, DHCP_WINS, ROUTES_PUSH, FRAGMENT, KEEPALIVE_1, and KEEPALIVE_2 to execute arbitrary JavaScript in administrator browsers.
CVSS v4.0: 5.1
CVSS v3.1: 6.1
GHSA-4h8p-ggf3-fpxx: The dissect_version_5_and_6_primary_header function in epan/dissectors/packet-dtn.c in the DTN dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 accesses an inappropriate pointer, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.
CVE-2023-51013: TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the lanNetmask parameter’ of the setLanConfig interface of the cstecgi .cgi.
CVSS v3.1: 9.8