ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2006-5739: PHP remote file inclusion vulnerability in cpadmin/cpa_index.php in Leicestershire communityPortals 1.0_2005-10-18_12-31-18 allows remote attackers to execute arbitrary PHP code via a URL in the cp_root_path parameter, a different vector than CVE-2006-5280.
CVSS v2.0: 7.5
CVE-2021-0522: In ConnectionHandler::SdpCb of connection_handler.cc, there is a possible out of bounds read due to a use after free. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-9 Android-10Android ID: A-174182139
CVSS v3.1: 7.5
CVSS v2.0: 5
GHSA-h69r-4pjw-g22q: psi/ztoken.c in Artifex Ghostscript 9.21 mishandles references to the scanner state structure, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PostScript document, related to an out-of-bounds read in the igc_reloc_struct_ptr function in psi/igc.c.
CVSS v3.0: 7.8
GHSA-xjmr-f49m-496p: A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0945, CVE-2019-0946.
CVSS v3.0: 7.8
CVE-2017-3239: Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Administration). Supported versions that are affected are 3.0.1 and 3.1.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle GlassFish Server executes to compromise Oracle GlassFish Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle GlassFish Server accessible data. CVSS v3.0 Base Score 3.3 (Confidentiality impacts).
CVSS v3.0: 3.3
CVSS v2.0: 2.1
GHSA-p3ww-q6x5-94x9: Cross-site scripting vulnerability AOL Instant Messenger (AIM) 4.5 and 4.7 for MacOS and Windows allows remote attackers to conduct unauthorized activities, such as adding buddies and groups to a user's buddy list, via a URL with a META HTTP-EQUIV="refresh" tag to an aim: URL.
GHSA-cf72-mxxr-2628: Unspecified vulnerability in Code-Crafters Ability Mail Server before 2.70 allows remote attackers to cause a denial of service (daemon crash) via an IMAP4 FETCH command.
GHSA-h8hf-xhcx-q243: Orange Station 1.0 was discovered to contain a SQL injection vulnerability via the username parameter.
CVSS v3.1: 9.8
GHSA-ph92-pwf6-mvmj: Several stack-based buffer overflow vulnerabilities exist in the DetranCLI command parsing functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted network packet can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger these vulnerabilities.This buffer overflow is in the function that manages the 'vpn pptp advanced name WORD dns (yes|no) mtu <128-16384> mru <128-16384> mppe (on|off) stateful (on|off)' command template.
CVSS v3.1: 7.2
CVE-2023-6640: Silicon Labs PC Controller v5.54.0 and Earlier Denial of Service Vulnerability
Malformed S2 Nonce Get Command Class packets can be sent to crash PC Controller v5.54.0 and earlier.
CVSS v3.1: 6.5
CVE-2001-0113: statsconfig.pl in OmniHTTPd 2.07 allows remote attackers to execute arbitrary commands via the mostbrowsers parameter, whose value is used as part of a generated Perl script.
CVSS v2.0: 10
CVE-2014-3583: The handle_headers function in mod_proxy_fcgi.c in the mod_proxy_fcgi module in the Apache HTTP Server 2.4.10 allows remote FastCGI servers to cause a denial of service (buffer over-read and daemon crash) via long response headers.
CVSS v2.0: 5
GHSA-w7mw-fjhg-xrq2: A flaw was found in ImageMagick in coders/txt.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type `unsigned long long`. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. This flaw affects ImageMagick versions prior to 7.0.8-68.
CVSS v3.1: 3.3
GHSA-j87q-m356-rhxh: SQL injection vulnerability in EveryBlog 5.x and 6.x, a module for Drupal, allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
GHSA-555p-m4v6-cqxv: ASA-2024-004: Default configuration param for Evidence may limit window of validity
ASA-2024-004: Default configuration param for Evidence may limit window of validity**Component**: CometBFT
**Criticality**: Low
**Affected versions**: All
**Affected users**: Validators, Chain Builders + MaintainersSummaryA default configuration in CometBFT has been found to be small for common use cases, and may prevent the slashing mechanism from working in specific cases.  The default values for `EvidenceParams.MaxAgeNumBlocks` and `EvidenceParams.MaxAgeDuration` consensus parameters may not be sufficient for common use cases to provide coverage for the entire unbonding period for a chain (`Staking.UnbondingTime`). If the conditions of both of these parameters are exceeded, evidence may be prematurely expired and considered no longer valid, potentially allowing for unpunished Byzantine behavior if evidence is discovered outside of that window.Next Steps for Chains and ValidatorsIt is recommended that chain ecosystems and their maintainers set the consensus parameters `EvidenceParams.MaxAgeNumBlocks` and `EvidenceParams.MaxAgeDuration` to values appropriate for their use case:`EvidenceParams.MaxAgeDuration` (set in nanoseconds) should exceed the duration of the chain’s unbonding period`EvidenceParams.MaxAgeNumBlocks` should exceed the number of estimated blocks that will be produced by your chain throughout the unbonding periodFor more information about evidence in CometBFT, please see: https://docs.cometbft.com/v0.37/spec/consensus/evidence.For more information about the cosmos-sdk  `x/staking` and `x/slashing` modules, and `UnbondingTime` parameter, please see: https://docs.cosmos.network/v0.50/build/modules/staking and https://docs.cosmos.network/v0.50/build/modules/slashing.CometBFT is designed to be configurable by chains, and implements many different configuration variables and parameters to allow chain developers, validators, node operators, and chain participants to customize it best to their use case.As more chains adopt the Interchain Stack for new and cutting-edge use cases, the CometBFT team recommends that all chains regularly evaluate their consensus parameters and configurations to ensure they meet the needs of their ecosystem as their networks mature.A Github Security Advisory for this issue is available in the [CometBFT repository](https://github.com/cometbft/cometbft/security/advisories/GHSA-555p-m4v6-cqxv). For more information about CometBFT, see https://docs.cometbft.com/.This issue was reported to the Cosmos Bug Bounty Program on HackerOne on February 15, 2024. If you believe you have found a bug in the Interchain Stack or would like to contribute to the program by reporting a bug, please see https://hackerone.com/cosmos.
GHSA-pxr7-r9vh-7q86: SQL injection vulnerability in cgi/cgilua.exe/sys/start.htm in Publique! 2.3 allows remote attackers to execute arbitrary SQL commands via the sid parameter.
GHSA-g25q-jw4h-pppq: Path Traversal issue in M-Files Classic Web versions below 23.6.12695.3 and LTS Service Release Versions before 23.2 LTS SR3 allows authenticated user to read some restricted files on the web server
CVSS v3.1: 7.7
GHSA-j2gj-g3p9-7mrr: Account TakeOver Due to Improper Handling of JWT Tokens in usememos/memos
Improper Access Control in GitHub repository usememos/memos prior to 0.13.2. As of commit `c9aa2eeb9` access tokens which fail validation are rejected.
CVSS v3.0: 9.8
GHSA-p44p-wgq8-46qm: Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a `Handover Request Ack` message missing a required `MME_UE_S1AP_ID` field to repeatedly crash the MME, resulting in denial of service.
CVSS v3.1: 5.3
GHSA-fvwr-q9h4-788c: Triangle MicroWorks SCADA Data Gateway Event Log Directory Traversal Arbitrary File Creation Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of Triangle MicroWorks SCADA Data Gateway. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.The specific flaw exists within the creation of event logs. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-20534.
CVSS v3.0: 7.2
CVE-2016-4226: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-4173, CVE-2016-4174, CVE-2016-4222, CVE-2016-4227, CVE-2016-4228, CVE-2016-4229, CVE-2016-4230, CVE-2016-4231, and CVE-2016-4248.
CVSS v3.1: 8.8
CVSS v2.0: 9.3
RHSA-2020:4162: Red Hat Security Advisory: qemu-kvm-ma security update
QEMU: usb: out-of-bounds r/w access issue while processing usb packets
CVSS v3.1: 5
GHSA-vc7h-x557-3c32: admin.php in Frax.dk Php Recommend 1.3 and earlier does not require authentication when the user password is changed, which allows remote attackers to gain administrative privileges via modified form_admin_user and form_admin_pass parameters.
CVE-2018-1000150: An exposure of sensitive information vulnerability exists in Jenkins Reverse Proxy Auth Plugin 1.5 and older in ReverseProxySecurityRealm#authContext that allows attackers with local file system access to obtain a list of authorities for logged in users.
CVSS v3.0: 3.3
CVSS v2.0: 2.1
GHSA-8477-pj67-v6wm: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UpdateTraceLevelSettings' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on.
CVSS v4.0: 8.7
CVSS v3.1: 8.8
CVE-2024-35661: WordPress Upload Fields for WPForms plugin <= 1.0.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in SoftLab Upload Fields for WPForms.This issue affects Upload Fields for WPForms: from n/a through 1.0.2.
CVSS v3.1: 5.3
CVE-2024-53290: Dell ThinOS version 2408 contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Command execution
CVSS v3.1: 8.4
GHSA-2fjp-fr4m-265h: The escape_dangerous_chars function in CGI::Lite 2.0 and earlier does not correctly remove special characters including (1) "\" (backslash), (2) "?", (3) "~" (tilde), (4) "^" (carat), (5) newline, or (6) carriage return, which could allow remote attackers to read or write arbitrary files, or execute arbitrary commands, in shell scripts that rely on CGI::Lite to filter such dangerous inputs.
CVE-2024-34315: CmsEasy v7.7.7.9 was discovered to contain a local file inclusion vunerability via the file_get_contents function in the fckedit_action method of /admin/template_admin.php. This vulnerability allows attackers to read arbitrary files.
CVSS v3.1: 7.5
GHSA-8424-jw2w-hvf4: Microsoft Exchange Server Remote Code Execution Vulnerability
CVSS v3.1: 8
CVE-2023-31028: 

NVIDIA nvJPEG2000 Library for Windows and Linux contains a vulnerability where improper input validation might enable an attacker to use a specially crafted input file. A successful exploit of this vulnerability might lead to a partial denial of service.


CVSS v3.1: 2.8
GHSA-7h9g-r6hv-4q98: Microsoft Digest Authentication Remote Code Execution Vulnerability
CVSS v3.1: 8.1
GHSA-x4f6-mqg6-28xx: Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer.This issue affects Apache Answer: through 2.0.0.The server did not sufficiently validate user-supplied image URLs, allowing arbitrary external content to be embedded as profile images, which could expose users to unintended external requests and tracking by third-party servers.
Users are recommended to upgrade to version 2.0.1, which fixes the issue.
CVSS v3.1: 6.5
GHSA-5j9h-62w2-p327: Double free vulnerability in the GSS-API library (lib/gssapi/krb5/k5unseal.c), as used by the Kerberos administration daemon (kadmind) in MIT krb5 before 1.6.1, when used with the authentication method provided by the RPCSEC_GSS RPC library, allows remote authenticated users to execute arbitrary code and modify the Kerberos key database via a message with an "an invalid direction encoding".
GHSA-7gvw-8492-45cx: The Social Share And Social Locker  WordPress plugin before 1.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS v3.1: 4.8
CVE-2026-50635: LimeSurvey Password Reset Host Header Injection Discloses Reset Token
LimeSurvey constructs account password-reset links from the client-supplied HTTP Host header without validating it. The optional allowedHosts allowlist that would constrain this is undefined in the default (and documented) configuration, so LSHttpRequest::checkIsAllowedHost() results in no operation. A remote, unauthenticated attacker who submits a forgotten-password request for a known account (requiring only the target's username and email) with a spoofed Host header causes LimeSurvey to email that account a reset link whose hostname is attacker-controlled while embedding the genuine validation_key. When the recipient or an automated inbound mail-security link scanner dereferences the link, the valid reset token is disclosed to the attacker, who replays it against the legitimate host's newPassword endpoint to set a new password and take over the account.
CVSS v4.0: 8.7
CVSS v3.1: 8.8
CVE-2009-4709: SQL injection vulnerability in the datamints Newsticker (datamints_newsticker) extension before 0.7.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS v2.0: 7.5
cisco-sa-ssl-bypass-O5tGum2n: Cisco Firepower Threat Defense Software SSL/TLS URL Category Bypass Vulnerability
A vulnerability in the Transport Layer Security version 1.3 (TLS 1.3) policy with URL category functionality for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass a configured TLS 1.3 policy to block traffic for a specific URL.

The vulnerability is due to a logic error with Snort handling of the connection with the TLS 1.3 policy and URL category configuration. An attacker could exploit this vulnerability by sending crafted TLS 1.3 connections to an affected device. A successful exploit could allow the attacker to bypass the TLS 1.3 policy and access URLs that are outside the affected device and normally would be dropped.

There are no workarounds that address this vulnerability.

This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ssl-bypass-O5tGum2n ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ssl-bypass-O5tGum2n"]
CVSS v3.0: 5.8
CVE-2022-21622: Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle SOA Suite accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
CVSS v3.1: 7.5
GHSA-xqx7-gx4p-gc46: SQL injection vulnerability in the Help Desk application in Wave EMBASSY Remote Administration Server (ERAS) allows remote attackers to execute arbitrary SQL commands via the ct100$4MainController$TextBoxSearchValue parameter (aka the search field).
GHSA-v48w-7v4g-xgfj: A vulnerability in the CLI of the Cisco StarOS operating system for Cisco ASR 5000 Series Aggregation Services Routers could allow an authenticated, local attacker to perform a command injection attack on an affected system. The vulnerability is due to insufficient validation of commands that are supplied to certain configurations in the CLI of the affected operating system. An attacker could exploit this vulnerability by injecting crafted arguments into a vulnerable CLI command for an affected system. A successful exploit could allow the attacker to insert and execute arbitrary commands in the CLI of the affected system. To exploit this vulnerability, the attacker would need to authenticate to an affected system by using valid administrator credentials. Cisco Bug IDs: CSCvg29441.
CVSS v3.1: 6.7
CVE-2025-0361: During an annual penetration test conducted on behalf of Axis Communications, Truesec discovered a flaw in the VAPIX Device Configuration framework that allowed for unauthenticated username enumeration through the VAPIX Device Configuration SSH Management API.
CVSS v3.1: 4.3
CVE-2014-8498: SQL injection vulnerability in BulkEditSearchResult.cc in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition before 7.1 build 7105 allows remote authenticated users to execute arbitrary SQL commands via the SEARCH_ALL parameter.
CVSS v2.0: 6.5
CVE-2017-2367: An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site.
CVSS v3.0: 6.5
CVSS v2.0: 4.3
CVE-2006-0701: readfolder.php in imageVue 16.1 allows remote attackers to list directories via modified path and ext parameters.
CVSS v2.0: 5
GHSA-4rvm-g2vh-jm4x: Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an improper resource shutdown or release vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to denial of service.
CVSS v3.1: 4.4
CVE-2024-29062: Secure Boot Security Feature Bypass Vulnerability
Secure Boot Security Feature Bypass Vulnerability
CVSS v3.1: 7.1
CVE-2020-8913: Local arbitrary code execution in splitinstall in Android's Play Core
A local, arbitrary code execution vulnerability exists in the SplitCompat.install endpoint in Android's Play Core Library versions prior to 1.7.2. A malicious attacker could create an apk which targets a specific application, and if a victim were to install this apk, the attacker could perform a directory traversal, execute code as the targeted application and access the targeted application's data on the Android device. We recommend all users update Play Core to version 1.7.2 or later.
CVSS v3.1: 8.8
RHSA-2021:4994: Red Hat Security Advisory: nss security update
nss: Memory corruption in decodeECorDsaSignature with DSA signatures (and RSA-PSS)
CVSS v3.1: 9.8
CVE-2017-18548: The note-press plugin before 0.1.2 for WordPress has SQL injection.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
CVE-2023-22641: A url redirection to untrusted site ('open redirect') in Fortinet FortiOS version 7.2.0 through 7.2.3, FortiOS version 7.0.0 through 7.0.9, FortiOS versions 6.4.0 through 6.4.12, FortiOS all versions 6.2, FortiOS all versions 6.0, FortiProxy version 7.2.0 through 7.2.2, FortiProxy version 7.0.0 through 7.0.8, FortiProxy all versions 2.0, FortiProxy all versions 1.2, FortiProxy all versions 1.1, FortiProxy all versions 1.0 allows an authenticated attacker to execute unauthorized code or commands via specially crafted requests.
CVSS v3.1: 4.1
CVE-2024-39901: OpenSearch Observability does not properly restrict access to private tenant resources
OpenSearch Observability is collection of plugins and applications that visualize data-driven events. An issue in the OpenSearch observability plugins allows unintended access to private tenant resources like notebooks. The system did not properly check if the user was the resource author when accessing resources in a private tenant, leading to potential data being revealed. The patches are included in OpenSearch 2.14.
CVSS v3.1: 4.2
GHSA-5h5w-vq2m-cxf3: PHP 4.0 with cURL functions allows remote attackers to bypass the open_basedir setting and read arbitrary files via a file: URL argument to the curl_init function.
GHSA-r6h2-5gqq-v5v6: OpenClaw: Reject symlinks in local skill packaging script
Vulnerability`skills/skill-creator/scripts/package_skill.py` (a local helper script used when authors package skills) previously followed symlinks while building `.skill` archives.If an author runs this script on a crafted local skill directory containing symlinks to files outside the skill root, the resulting archive can include unintended file contents.Severity and Exposure**Severity: Low****Execution context:** local/manual workflow only (skill author packaging step)**No remote trigger:** this is not reachable via normal OpenClaw gateway/chat runtime paths**No extraction Zip Slip in this finding:** this issue is limited to packaging-time symlink followingImpactPotential unintentional disclosure of local files from the packaging machine into a generated `.skill` artifact.Requires local execution of the packaging script on attacker-controlled skill contents.Affected Components`skills/skill-creator/scripts/package_skill.py`Affected Packages / VersionsPackage: `openclaw` (npm)Latest published version during triage: `2026.2.17`Vulnerable version range: `<= 2026.2.17`Planned patched version (next release): `2026.2.18`RemediationReject symlinks during skill packaging.Add regression tests for symlink file and symlink directory cases.Update packaging guidance to document the symlink restriction.Fix Commit(s)`c275932aa4230fb7a8212fe1b9d2a18424874b3f``ee1d6427b544ccadd73e02b1630ea5c29ba9a9f0`Related PRhttps://github.com/openclaw/openclaw/pull/20796Release Process Note`patched_versions` is pre-set to the planned next release (`2026.2.18`). Once npm `openclaw@2026.2.18` is published, this advisory is ready to publish without additional edits.Thanks @aether-ai-agent for reporting.
CVSS v4.0: 4.6
GHSA-wj3q-4vgj-mfw8: In the Zephyr Project MQTT code, improper bounds checking can result in memory corruption and possibly remote code execution. NCC-ZEP-031 This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions.
GHSA-qx8g-xvp8-5cmp: The ExactMetrics – Google Analytics Dashboard for WordPress plugin is vulnerable to Improper Privilege Management in versions 7.1.0 through 9.0.2. This is due to the `update_settings()` function accepting arbitrary plugin setting names without a whitelist of allowed settings. This makes it possible for authenticated attackers with the `exactmetrics_save_settings` capability to modify any plugin setting, including the `save_settings` option that controls which user roles have access to plugin functionality. The admin intended to delegate configuration access to a trusted user, not enable that user to delegate access to everyone. By setting `save_settings` to include `subscriber`, an attacker can grant plugin administrative access to all subscribers on the site.
CVSS v3.1: 8.8
GHSA-xjfj-m5rc-8ffm: Improper access control in permissions component in Devolutions Server 2025.1.10.0 and earlier allows an authenticated user to bypass the "Edit permission" permission by bypassing the client side validation.
CVSS v3.1: 5