ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2021-22932: An issue has been identified in the CTX269106 mitigation tool for Citrix ShareFile storage zones controller which causes the ShareFile file encryption option to become disabled if it had previously been enabled. Customers are only affected by this issue if they previously selected “Enable Encryption” in the ShareFile configuration page and did not re-select this setting after running the CTX269106 mitigation tool. ShareFile customers who have not run the CTX269106 mitigation tool or who re-selected “Enable Encryption” immediately after running the tool are unaffected by this issue.
CVSS v3.1: 7.5
CVSS v2.0: 5
CVE-2020-9843: An input validation issue was addressed with improved input validation. This issue is fixed in iOS 13.5 and iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, iCloud for Windows 7.19. Processing maliciously crafted web content may lead to a cross site scripting attack.
CVSS v3.1: 7.1
CVSS v2.0: 5.8
CVE-2022-39133: In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.
CVSS v3.1: 5.5
GHSA-4w9w-3v73-2rh7: A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot application could allow an unauthenticated, remote attacker to perform a server-side request forgery (SSRF) attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web interface. A successful exploit could allow the attacker to obtain confidential information from the BroadWorks server and other device on the network. {{value}} ["%7b%7bvalue%7d%7d"])}]]
CVSS v3.1: 8.8
CVE-2001-0345: Microsoft Windows 2000 telnet service allows attackers to prevent idle Telnet sessions from timing out, causing a denial of service by creating a large number of idle sessions.
CVSS v2.0: 5
GHSA-m3pc-rgm4-56jw: OpenImageIO v3.1.0.0dev was discovered to contain a heap overflow via the component OpenImageIO_v3_1_0::farmhash::inlined::Fetch64(char const*).
CVSS v3.1: 9.8
GHSA-v25j-wqcw-fvhj: wger has an Uncontrolled Resource Consumption issue
SummaryAny authenticated user can create a routine spanning an arbitrarily long date range (e.g. 100 years) and then trigger the `date_sequence` computation via any of the routine detail endpoints. The server iterates once per day in an unbounded `while` loop with no maximum duration validation, causing a single HTTP request to consume multiple seconds of server CPU and return a response containing tens of thousands of entries. Repeated requests can exhaust all worker threads and deny service to other users.DetailsThe `Routine` model (file: `wger/manager/models/routine.py`) has `start` and `end` date fields with only one validation -- `start` must not be after `end`:The `RoutineSerializer` (file: `wger/manager/api/serializers.py`, line 43) likewise performs no validation on the delta between `start` and `end`.The `date_sequence` property (line 256) uses an unbounded loop:A routine with `start=2000-01-01` and `end=2099-12-31` produces **36,525 iterations**, each performing O(slots x entries x configs) work. Five endpoints trigger this computation:`GET /api/v2/routine/<id>/date-sequence-display/``GET /api/v2/routine/<id>/date-sequence-gym/``GET /api/v2/routine/<id>/structure/``GET /api/v2/routine/<id>/logs/``GET /api/v2/routine/<id>/stats/`PoCPrerequisitesOne authenticated user accountNo special permissions requiredAttack Steps**Expected:** HTTP 400 (routine duration exceeds maximum)
**Actual:** HTTP 200 with 36,525 entries after several seconds of server CPU timeProof of Concept ScriptProof of Concept OutputImpact**Worker Thread Exhaustion:** Each malicious request ties up a server worker for 3+ seconds (more with populated slots/configs). A handful of concurrent requests can saturate all available workers, making the application unresponsive for legitimate users.**Amplification with Slots:** The 3-second figure is for a routine with a single empty day. Adding exercises, slot entries, and progression configs multiplies the per-day cost. A fully populated 100-year routine could take minutes per request.**No Authentication Barrier Beyond Login:** Any registered user can perform this attack. No elevated permissions are required.**Cache Bypass:** The first request for each routine (or after `ROUTINE_CACHE_TTL` expires) always runs the full computation. An attacker can create new routines to avoid cache hits.**Five Affected Endpoints:** `date-sequence-display`, `date-sequence-gym`, `structure`, `logs`, and `stats` all trigger the same unbounded loop.Fix1. Add maximum duration validation in the model2. Add the same validation in the serializer3. Add a safety cap in date_sequence (defence-in-depth)
CVSS v3.1: 6.5
CVE-2017-3430: Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle One-to-One Fulfillment. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle One-to-One Fulfillment, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle One-to-One Fulfillment accessible data as well as unauthorized update, insert or delete access to some of Oracle One-to-One Fulfillment accessible data. CVSS v3.0 Base Score 8.2 (Confidentiality and Integrity impacts).
CVSS v3.0: 8.2
CVSS v2.0: 5.8
CVE-2016-7458: VMware vSphere Client 5.5 before U3e and 6.0 before U2a allows remote vCenter Server and ESXi instances to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS v3.0: 5.8
CVSS v2.0: 5
GHSA-wj4h-397w-w967: The x25_negotiate_facilities function in net/x25/x25_facilities.c in the Linux kernel before 4.5.5 does not properly initialize a certain data structure, which allows attackers to obtain sensitive information from kernel stack memory via an X.25 Call Request.
CVSS v3.0: 7.5
CVE-2022-31134: Zulip Server public data export contains attachments that are non-public
Zulip is an open-source team collaboration tool. Zulip Server versions 2.1.0 above have a user interface tool, accessible only to server owners and server administrators, which provides a way to download a "public data" export. While this export is only accessible to administrators, in many configurations server administrators are not expected to have access to private messages and private streams. However, the "public data" export which administrators could generate contained the attachment contents for all attachments, even those from private messages and streams. Zulip Server version 5.4 contains a patch for this issue.
CVSS v3.1: 4.9
CVE-2022-4816: A denial-of-service vulnerability has been identified in Lenovo Safecenter that could allow a local user to crash the application.
CVSS v3.1: 6.2
GHSA-qf2g-q4mc-w7rr: Cross-site Scripting in Fork CMS
Fork CMS prior to 5.11.1 is vulnerable to stored cross-site scripting. When uploading a new module, the description of the module can contain JavaScript code. The JavaScript code may be executed after uploading the new module and looking at the `Details` page.
CVSS v3.1: 5.4
GHSA-wh9p-qc46-94pw: Delta Electronics ISPSoft version 3.20 is vulnerable to a Stack-Based buffer overflow vulnerability that could allow an attacker to execute arbitrary code when parsing DVP file.
CVSS v3.1: 7.8
PYSEC-2022-43095: The d8s-ip-addresses package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-csv package. The affected version is 0.1.0.
CVSS v3.1: 9.8
CVE-2024-41645: Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a crafted script to the nav2__amcl.
CVSS v3.1: 9.8
CVE-2022-30750: Improper access control vulnerability in updateLastConnectedClientInfo function of SemWifiApClient prior to SMR Jul-2022 Release 1 allows attacker to access wifi ap client mac address that connected.
CVSS v3.1: 3.3
GHSA-mh87-4cjg-xvmr: An exploitable information vulnerability exists in the XCF image rendering functionality of Simple DirectMedia Layer SDL2_image-2.0.2. A specially crafted XCF image can cause an out-of-bounds read on the heap, resulting in information disclosure. An attacker can display a specially crafted image to trigger this vulnerability.
CVSS v3.0: 6.5
CVE-2024-56337: Apache Tomcat: RCE due to TOCTOU issue in JSP compilation - CVE-2024-50379 mitigation was incomplete
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97.
The following versions were EOL at the time the CVE was created but are 
known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions 
may also be affected.


The mitigation for CVE-2024-50379 was incomplete.

Users running Tomcat on a case insensitive file system with the default servlet write enabled (readonly initialisation 
parameter set to the non-default value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which version of Java they are using with Tomcat:
- running on Java 8 or Java 11: the system property sun.io.useCanonCaches must be explicitly set to false (it defaults to true)
- running on Java 17: the system property sun.io.useCanonCaches, if set, must be set to false (it defaults to false)
- running on Java 21 onwards: no further configuration is required (the system property and the problematic cache have been removed)

Tomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks that sun.io.useCanonCaches is set appropriately before allowing the default servlet to be write enabled on a case insensitive file system. Tomcat will also set sun.io.useCanonCaches to false by default where it can.
CVSS v3.1: 9.8
GHSA-5j4r-qj38-wg6g: Docker Desktop Community before 2.5.0.0 on macOS mishandles certificate checking, leading to local privilege escalation.
CVSS v3.1: 7.8
GHSA-4jj9-cgqc-x9h5: NeuVector OpenID Connect is vulnerable to man-in-the-middle (MITM)
ImpactNeuVector supports login authentication through OpenID Connect. However, the TLS verification (which verifies the remote server's authenticity and integrity) for OpenID Connect is not enforced by default. As a result this may expose the system to man-in-the-middle (MITM) attacks.
Starting from version 5.4.0, NeuVector supports TLS verification for following connection types:Registry ConnectionsAuth Server Connections (SAML, LDAP and OIDC)Webhook ConnectionsBy default, TLS verification remains disabled, and its configuration is located under **Settings > Configuration in the NeuVector UI**.In the patched version, the new NeuVector deployment enables TLS verification by default. 
For rolling upgrades, NeuVector does not automatically change this setting to prevent disruptions.**Note:** When "TLS verification" is enabled, it affects all connections to:Registry serversAuth servers (SAML, LDAP and OIDC)Webhook serversPatchesPatched versions include release v5.4.8 and above.WorkaroundsTo manually enable TLS verification:Open the NeuVector UI.Navigate to **Settings > Configuration**.In the **TLS Self-Signed Certificate Configuration** section, select **Enable TLS verification**.(Optional) Upload or paste the **TLS self-signed certificate**.ReferencesIf you have any questions or comments about this advisory:Reach out to the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.Open an issue in the [NeuVector](https://github.com/neuvector/neuvector/issues/new/choose) repository.Verify with our [support matrix](https://www.suse.com/suse-neuvector/support-matrix/all-supported-versions/neuvector-v-all-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/#suse-security).
CVSS v3.1: 8.8
CVE-2025-69164: WordPress Skyward theme <= 1.10 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Skyward <= 1.10 versions.
CVSS v3.1: 8.1
GHSA-44fp-8j32-x3x6: TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the sPort/ePort parameter in the setIpPortFilterRules function.
CVSS v3.1: 8.8
GHSA-8x4h-qw2g-55rm: In all Android releases from CAF using the Linux kernel, a vulnerability exists in the access control settings of modem memory.
CVSS v3.0: 7.8
GHSA-mq5j-fjgv-p7px: Stack-based buffer overflow in the ServerNetworking::incoming_client_data function in servnet.cpp in Outgun 1.0.3 bot 2 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a data_file_request command with a long (1) type or (2) name string.
GHSA-rrgj-83v9-hxjp: An out-of-bounds read and write flaw was found in the way SIPcrack 0.2 processed SIP traffic, because 0x00 termination of a payload array was mishandled. A remote attacker could potentially use this flaw to crash the sipdump process by generating specially crafted SIP traffic.
CVSS v3.0: 5.9
CVE-2025-61962: In fetchmail before 6.5.6, the SMTP client can crash when authenticating upon receiving a 334 status code in a malformed context.
CVSS v3.1: 5.9
RHSA-2023:0544: Red Hat Security Advisory: Red Hat Camel for Spring Boot 3.14.5 Patch 1 release and security update
jettison: parser crash by stackoverflow jettison: If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError which may lead to dos CXF: directory listing / code exfiltration CXF: SSRF Vulnerability
CVSS v3.1: 9.8
GHSA-4cm8-xpfv-jv6f: ZeptoClaw: Email Sender Spoofing to bypass Header-Only From Allowlist Validation
SummaryThe email channel authorizes senders based on the parsed `From` header identity only. If upstream email authentication/enforcement is weak (for example, relaxed SPF/DKIM/DMARC handling), an attacker can spoof an allowlisted sender address and have the message treated as trusted input.DetailsRelevant code paths:`src/channels/email_channel.rs:311` extracts sender identity from parsed message headers:`let from = parsed.from() ... a.address() ...``src/channels/email_channel.rs:328` authorizes using that `from` value:`if !self.is_sender_allowed(&from) { ... }``src/channels/email_channel.rs:87` onward (`is_sender_allowed`) performs allowlist/domain matching against the same header-derived value.There is no in-channel validation of sender authenticity indicators such as SPF/DKIM/DMARC results before allowlist trust decisions.Result:Trust decision is based on a potentially spoofable header field unless mailbox/provider-side anti-spoofing controls are strong and enforced.PoCConfigure email channel with strict sender allowlist:`channels.email.enabled = true``channels.email.allowed_senders = ["ceo@example.com"]``channels.email.deny_by_default = true`Ensure the monitored mailbox accepts or forwards a spoofed message (for testing, use a local SMTP path that does not enforce sender authentication strongly).Send an email to the monitored inbox with forged header identity:Wait for IMAP fetch/IDLE processing.Observe the message is accepted as allowlisted sender `ceo@example.com` and published as inbound channel input.ImpactVulnerability type: sender identity spoofing risk due to header-based authorization.Affected deployments: those using email channel allowlists where upstream anti-spoof controls are weak, misconfigured, or bypassed.Security effect:Spoofed `From` headers may bypass logical sender allowlist.Malicious content can enter trusted automation/agent flows as if sent by authorized identities.Risk is reduced in environments with strict SPF/DKIM/DMARC enforcement and strong inbound mail hygiene, but not eliminated at application layer.Patch RecommendationAdd a sender-authentication gate in `src/channels/email_channel.rs` immediately after parsing `from` (`src/channels/email_channel.rs:311`) and before allowlist enforcement (`src/channels/email_channel.rs:328`). The gate should require trusted SPF/DKIM/DMARC evidence with domain alignment (for example, `DMARC=pass`, or aligned SPF/DKIM pass) before `is_sender_allowed` is evaluated. For backward compatibility, add a configurable mode in `EmailConfig` (for example, `sender_verification_mode`), but recommend hardened settings in production: `dmarc_aligned`, exact-address allowlists, and `deny_by_default=true`.
CVSS v3.1: 6.5
GHSA-6m3c-qm8q-jf8f: The default configuration in the standalone controller quickstack manifest in openstack-foreman-installer, as used in Red Hat Enterprise Linux OpenStack Platform 4.0, disables authentication for Qpid, which allows remote attackers to gain access by connecting to Qpid.
RHSA-2024:11242: Red Hat Security Advisory: mpg123:1.32.9 security update
mpg123: Buffer overflow when writing decoded PCM samples
CVSS v3.1: 6.7
GHSA-9hmj-hrww-2599: Memory corruption may occur while processing voice call registration with user.
CVSS v3.1: 6.6
CVE-2026-7119: Tenda HG3 formCountrystr os command injection
A vulnerability was detected in Tenda HG3 2.0. The impacted element is an unknown function of the file /boaform/formCountrystr. The manipulation of the argument countrystr results in os command injection. The attack may be performed from remote. The exploit is now public and may be used.
CVSS v4.0: 8.7
CVSS v3.1: 8.8
CVSS v3.0: 8.8
CVSS v2.0: 9
CVE-2011-5186: Cross-site scripting (XSS) vulnerability in jbshop.php in the jbShop plugin for e107 7 allows remote attackers to inject arbitrary web script or HTML via the item_id parameter.
CVSS v2.0: 4.3
CVE-2016-5860: In an audio driver in all Qualcomm products with Android for MSM, Firefox OS for MSM, or QRD Android, if a function is called with a very large length, an integer overflow could occur followed by a heap buffer overflow.
CVSS v3.0: 7
CVSS v2.0: 7.6
CVE-2006-6779: Cross-site scripting (XSS) vulnerability in Jelsoft vBulletin allows remote attackers to inject arbitrary web script or HTML via an SWF file that uses ActionScript to trigger execution of JavaScript.
CVSS v2.0: 6.8
CVE-2025-65220: Tenda AC21 V16.03.08.16 is vulnerable to Buffer Overflow in: /goform/SetVirtualServerCfg via the list parameter.
CVSS v3.1: 4.3
GHSA-jvq4-qh39-564c: An issue was discovered in Logpoint before 7.6.0. When creating reports, attackers can create custom Jinja templates that chained built-in filter functions to generate XSS payloads. These payloads can be rendered by the Logpoint Report Template engine, making it vulnerable to cross-site scripting (XSS) attacks.
CVSS v3.1: 4.9
CVE-2024-56940: An issue in the profile image upload function of LearnDash v6.7.1 allows attackers to cause a Denial of Service (DoS) via excessive file uploads.
CVSS v3.1: 7.5
GHSA-2vq9-xxfq-v5cf: An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. Processing a maliciously crafted image may lead to arbitrary code execution.
CVSS v3.1: 7.8
GHSA-hmgx-5p26-ccf2: The Email Encoder  WordPress plugin before 2.4.7 does not escape email addresses retrieved via user input, allowing unauthenticated attackers to perform Stored XSS attacks
GHSA-35r6-q59h-rp4f: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme Avaz allows PHP Local File Inclusion. This issue affects Avaz: from n/a through 2.8.
CVSS v3.1: 8.1
CVE-2025-50003: WordPress Amuli theme <= 2.3.0 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Amuli amuli allows PHP Local File Inclusion.This issue affects Amuli: from n/a through <= 2.3.0.
CVSS v3.1: 8.1
GHSA-g9f6-9775-hffm: Nhost Storage Affected by MIME Type Spoofing via Trusted Client Content-Type Header in Storage Upload
SummaryThe storage service's file upload handler trusts the client-provided `Content-Type` header without performing server-side MIME type detection. This allows an attacker to upload files with an arbitrary MIME type, bypassing any MIME-type-based restrictions configured on storage buckets.Affected Component**Service**: `services/storage`**File**: `services/storage/controller/upload_files.go`**Function**: `getMultipartFile` (lines 48-70)Root CauseIn `getMultipartFile`, if the client provides a non-empty `Content-Type` header that isn't `application/octet-stream`, the function returns it as-is without performing content-based detection:Impact**Incorrect MIME type in file metadata.** The MIME type stored in file metadata reflects what the client claims rather than what the file actually contains. Any system consuming this metadata (browsers, CDNs, applications) may handle the file incorrectly based on the spoofed type.Suggested FixAlways detect MIME type from file content using `mimetype.DetectReader`, ignoring the client-provided `Content-Type` header entirely.
CVSS v4.0: 2.1
CVSS v3.1: 5.3
CVE-2024-40035: idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userLevel_deal.php?mudi=add.
CVSS v3.1: 5.9
CVE-2020-7592: A vulnerability has been identified in SIMATIC HMI Basic Panels 1st Generation (incl. SIPLUS variants) (All versions), SIMATIC HMI Basic Panels 2nd Generation (incl. SIPLUS variants) (All versions), SIMATIC HMI Comfort Panels (incl. SIPLUS variants) (All versions), SIMATIC HMI KTP700F Mobile Arctic (All versions), SIMATIC HMI Mobile Panels 2nd Generation (All versions), SIMATIC WinCC Runtime Advanced (All versions). Unencrypted communication between the configuration software and the respective device could allow an attacker to capture potential plain text communication and have access to sensitive information.
CVSS v3.1: 6.5
CVSS v2.0: 3.3
GHSA-f287-2xwg-rrg8: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in msmitley WP Cookie Consent allows Stored XSS. This issue affects WP Cookie Consent: from n/a through 1.0.
CVSS v3.1: 5.9
GHSA-6v73-jj37-xggm: Three vulnerabilities in the CLI of Cisco TelePresence CE and RoomOS could allow an authenticated, local attacker to overwrite arbitrary files on the local file system of an affected device.These vulnerabilities are due to improper access controls on files that are on the local file system. An attacker could exploit these vulnerabilities by placing a symbolic link in a specific location on the local file system of an affected device. A successful exploit could allow the attacker to overwrite arbitrary files on the affected device. To exploit these vulnerabilities, an attacker would need to have a remote support user account.
Note: CVE-2023-20092 does not affect Cisco DX70, DX80, TelePresence MX Series, or TelePresence SX Series devices.
Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.
CVSS v3.1: 4.4
GHSA-8qmm-qw2g-45gx: Buffer overflow in QuakeWorld 2.10 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary commands via a long initial connect packet.
CVE-2025-61974: BIG-IP SSL/TLS vulnerability
When a client SSL profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS v4.0: 8.7
CVSS v3.1: 7.5