ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-c99w-7r7q-cgcx: IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 236586.
CVSS v3.1: 5.4
CVE-2026-6375: Authorization bypass through User-Controlled key in SpiceJet Online Booking System
A vulnerability in SpiceJet’s booking API allows unauthenticated users to query passenger name records (PNRs) without any access controls. Because PNR identifiers follow a predictable pattern, an attacker could systematically enumerate valid records and obtain associated passenger names. This flaw stems from missing authorization checks on an endpoint intended for authenticated profile access.
CVSS v4.0: 8.7
CVE-2021-20649: ELECOM WRC-300FEBK-S contains an improper certificate validation vulnerability. Via a man-in-the-middle attack, an attacker may alter the communication response. As a result, an arbitrary OS command may be executed on the affected device.
CVSS v3.1: 4.8
CVSS v2.0: 5.8
CVE-2022-27894: The Foundry Blobster service was found to have a cross-site scripting (XSS) vulnerability.
The Foundry Blobster service was found to have a cross-site scripting (XSS) vulnerability that could have allowed an attacker with access to Foundry to launch attacks against other users. This vulnerability is resolved in Blobster 3.228.0.
CVSS v3.1: 4.8
CVE-2015-7510: Stack-based buffer overflow in the getpwnam and getgrnam functions of the NSS module nss-mymachines in systemd.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
CVE-2020-7945: Local registry credentials were included directly in the CD4PE deployment definition, which could expose these credentials to users who should not have access to them. This is resolved in Continuous Delivery for Puppet Enterprise 4.0.1.
CVSS v3.1: 5.5
CVSS v2.0: 2.1
CVE-2017-18853: Certain NETGEAR devices are affected by password recovery and file access. This affects D8500 1.0.3.27 and earlier, DGN2200v4 1.0.0.82 and earlier, R6300v2 1.0.4.06 and earlier, R6400 1.0.1.20 and earlier, R6400v2 1.0.2.18 and earlier, R6700 1.0.1.22 and earlier, R6900 1.0.1.20 and earlier, R7000 1.0.7.10 and earlier, R7000P 1.0.0.58 and earlier, R7100LG 1.0.0.28 and earlier, R7300DST 1.0.0.52 and earlier, R7900 1.0.1.12 and earlier, R8000 1.0.3.46 and earlier, R8300 1.0.2.86 and earlier, R8500 1.0.2.86 and earlier, WNDR3400v3 1.0.1.8 and earlier, and WNDR4500v2 1.0.0.62 and earlier.
CVSS v3.0: 9.6
GHSA-c5r2-g4vp-wg2f: A remote multiple multiple cross-site vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1.
CVSS v3.0: 5.4
GHSA-j7jw-28jm-whr6: lakeFS allows an authenticated user to cause a crash by exhausting server memory
ImpactAn authenticated user can crash lakeFS by exhausting server memory.  This is an authenticated denial-of-service issue.PatchesThis problem has been patched and exists in versions 1.49.1 and belowWorkaroundsOn S3 backends, configureor set environment variable `LAKEFS_BLOCKSTORE_S3_DISABLE_PRE_SIGNED_MULTIPART` to `true`.References_Are there any links users can visit to find out more?_
CVSS v3.1: 6.5
CVE-1999-0874: Buffer overflow in IIS 4.0 allows remote attackers to cause a denial of service via a malformed request for files with .HTR, .IDC, or .STM extensions.
CVSS v2.0: 10
CVE-2026-10533: Openshift: openshift: non-admin user can bypass resourcequota and flood etcd with events causing cluster-wide api degradation
A flaw was found in OpenShift Container Platform. Completed pods with restartPolicy: Never do not count toward ResourceQuota pod limits, and Kubernetes events are not quota-scoped. A non-privileged user who can create pods in a namespace can exploit this to generate a large volume of events that accumulate in etcd, causing API server performance degradation across the cluster.
CVSS v3.1: 5
GHSA-74fj-8xgp-r644: In libstagefright, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-117661116
CVSS v3.1: 6.5
CVE-2023-40461: Cross-site scripting vulnerability in ACEManager










The ACEManager
component of ALEOS 4.16 and earlier allows an



authenticated user
with Administrator privileges to access a file



upload field which
does not fully validate the file name, creating a



Stored Cross-Site
Scripting condition.








CVSS v3.1: 8.1
CVE-2022-35223: EasyUse MailHunter Ultimate - Deserialization of Untrusted Data
EasyUse MailHunter Ultimate’s cookie deserialization function has an inadequate validation vulnerability. Deserializing a cookie containing malicious payload will trigger this insecure deserialization vulnerability, allowing an unauthenticated remote attacker to execute arbitrary code, manipulate system command or interrupt service.
CVSS v3.1: 9.8
CVE-2013-4496: Samba 3.x before 3.6.23, 4.0.x before 4.0.16, and 4.1.x before 4.1.6 does not enforce the password-guessing protection mechanism for all interfaces, which makes it easier for remote attackers to obtain access via brute-force ChangePasswordUser2 (1) SAMR or (2) RAP attempts.
CVSS v2.0: 5
CVE-2018-17942: The convert_to_decimal function in vasnprintf.c in Gnulib before 2018-09-23 has a heap-based buffer overflow because memory is not allocated for a trailing '\0' character during %f processing.
CVSS v3.0: 8.8
CVSS v2.0: 6.8
CVE-2026-21963: Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).  Supported versions that are affected are 7.1.14 and  7.2.4. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).
CVSS v3.1: 6
CVE-2018-11646: webkitFaviconDatabaseSetIconForPageURL and webkitFaviconDatabaseSetIconURLForPageURL in UIProcess/API/glib/WebKitFaviconDatabase.cpp in WebKit, as used in WebKitGTK+ through 2.21.3, mishandle an unset pageURL, leading to an application crash.
CVSS v3.0: 7.5
CVSS v2.0: 5
GHSA-4723-922h-c6p3: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPIndeed Debug Assistant plugin <= 1.4 versions.
CVSS v3.1: 5.9
CVE-2012-2289: EMC ApplicationXtender Desktop before 6.5 SP2 and ApplicationXtender Web Access .NET before 6.5 SP2 allow remote attackers to upload files to any location, and possibly execute arbitrary code, via unspecified vectors.
CVSS v2.0: 7.5
GHSA-h684-p7cm-3g45: A security vulnerability has been detected in Iqbolshoh php-business-website up to 10677743a8dfc281f85291a27cf63a0bce043c24. This affects an unknown part of the file /admin/about.php. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.
CVSS v4.0: 2
CVSS v3.1: 4.7
GHSA-fc42-2hhg-7r35: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ashish Ajani WordPress Simple HTML Sitemap plugin <= 2.1 versions.
CVSS v3.1: 6.1
CVE-2003-1207: Crob FTP Server 3.5.1 allows remote authenticated users to cause a denial of service (crash) via a dir command with a large number of "." characters followed by a "/*" string.
CVSS v2.0: 5
GHSA-v359-jj2v-j536: vLLM has SSRF Protection Bypass
SummaryThe SSRF protection fix for https://github.com/vllm-project/vllm/security/advisories/GHSA-qh4c-xf7m-gxfc can be bypassed in the `load_from_url_async` method due to inconsistent URL parsing behavior between the validation layer and the actual HTTP client.Affected Component**File**: `vllm/connections.py`**Function**: `load_from_url_async`Vulnerability DetailsRoot CauseThe SSRF [fix](https://github.com/vllm-project/vllm/pull/32746) uses `urllib3.util.parse_url()` to validate and extract the hostname from user-provided URLs. However, `load_from_url_async` uses `aiohttp` for making the actual HTTP requests, and `aiohttp` internally uses the `yarl` library for URL parsing.These two URL parsers handle backslash characters (`\`) differently:| Parser | Input URL | Parsed Host | Parsed Path | Behavior |
|--------|-----------|-------------|-------------|----------|
| `urllib3.parse_url()` | `https://httpbin.org\@evil.com/` | `httpbin.org` | `/%5C@evil.com/` | URL-encodes `\` as `%5C`, treats `\@evil.com/` as part of the path |
| `yarl` (via aiohttp) | `https://httpbin.org\@evil.com/` | `evil.com` | `/` | Treats `\` as part of userinfo (`user: httpbin.org\`), the `@` acts as the userinfo/host separator |Attack ScenarioWhy This Happens**yarl**: Interprets `httpbin.org\` as the userinfo component, and `@` as the userinfo/host separator, so the URL is parsed as `user=httpbin.org\`, `host=evil.com`, `path=/`**urllib3**: URL-encodes the backslash as `%5C`, so `\@evil.com/` becomes `/%5C@evil.com/` which is treated as part of the path, leaving `host=httpbin.org`This inconsistency allows an attacker to:Bypass the hostname allowlist checkAccess arbitrary internal/external servicesPerform full SSRF attacksFixeshttps://github.com/vllm-project/vllm/pull/34743
CVSS v3.1: 5.4
GHSA-j9ph-gvr9-6c63: An issue was discovered in Eracent EPA Agent through 10.2.26. The agent executable, when installed for non-root operations (scanning), can be used to start external programs with elevated permissions because of an Untrusted Search Path.
CVE-2017-18676: An issue was discovered on Samsung mobile devices with N(7.0) (Qualcomm chipsets) software. There is an RKP kernel protection bypass (in which unwanted memory mappings may occur) because of a lack of MSR trapping. The Samsung ID is SVE-2016-7901 (April 2017).
CVSS v3.1: 7.5
CVSS v2.0: 5
GHSA-gh2w-wqm3-32m4: compose.php in SquirrelMail 1.4.22 calls unserialize for the $attachments value, which originates from an HTTP POST request.
CVSS v3.1: 8.8
RHSA-2023:1333: Red Hat Security Advisory: firefox security update
Mozilla: Incorrect code generation during JIT compilation Mozilla: Potential out-of-bounds when accessing throttled streams Mozilla: Invalid downcast in Worklets Mozilla: URL being dragged from a removed cross-origin iframe into the same tab triggered navigation Mozilla: Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9
CVSS v3.1: 8.8
RHSA-2026:5512: Red Hat Security Advisory: redhat-ds:11 security update
389-ds-base: 389-ds-base: Remote Code Execution and Denial of Service via heap buffer overflow
CVSS v3.1: 7.2
GHSA-vm34-2mcq-j9q8: Entrust Instant Financial Issuance (On Premise) Software (formerly known as Cardwizard) 6.10.0, 6.9.0, 6.9.1, 6.9.2, and 6.8.x and earlier leaves behind a configuration file (i.e. WebAPI.cfg.xml) after the installation process. This file can be accessed without authentication on HTTP port 80 by guessing the correct IIS webroot path. It includes system configuration parameter names and values with sensitive configuration values encrypted.
CVSS v3.1: 5.9
GHSA-2r99-88xc-7qfg: The Jian Ren (aka cn.sh.scustom.janren) application 1.5.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2021-27475: Rockwell Automation Connected Components Workbench Deserialization of Untrusted Data
Rockwell Automation Connected Components Workbench v12.00.00 and prior does not limit the objects that can be deserialized. This vulnerability allows attackers to craft a malicious serialized object that, if opened by a local user in Connected Components Workbench, may result in remote code execution. This vulnerability requires user interaction to be successfully exploited.
CVSS v3.1: 8.6
CVE-2021-38197: unarr.go in go-unarr (aka Go bindings for unarr) 0.1.1 allows Directory Traversal via ../ in a pathname within a TAR archive.
CVSS v3.1: 9.8
CVSS v2.0: 10
CVE-2021-41608: A file disclosure vulnerability in the UploadedImageDisplay.aspx endpoint of SelectSurvey.NET before 5.052.000 allows a remote, unauthenticated attacker to retrieve survey user submitted data by modifying the value of the ID parameter in sequential order beginning from 1.
CVSS v3.1: 7.5
CVSS v2.0: 5
GHSA-7qw4-78fp-w39m: A vulnerability was found in code-projects Online Guitar Store 1.0. Affected is an unknown function of the file /admin/Create_product.php. Performing manipulation of the argument dre_title results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.
CVSS v4.0: 5.5
CVSS v3.1: 7.3
CVE-2006-3402: SQL injection vulnerability in VirtuaStore 2.0 allows remote attackers to execute arbitrary SQL commands via the password parameter when logging in.
CVSS v2.0: 7.5
GHSA-rqfh-9r24-8c9r: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
An XML External Entity (XXE) vulnerability exists in `org.assertj.core.util.xml.XmlStringPrettyFormatter`: the `toXmlDocument(String)` method initializes `DocumentBuilderFactory` with default settings, without disabling DTDs or external entities. This formatter is used by the `isXmlEqualTo(CharSequence)` assertion for `CharSequence` values.An application is vulnerable only when it uses untrusted XML input with one of the following methods:`isXmlEqualTo(CharSequence)` from `org.assertj.core.api.AbstractCharSequenceAssert``xmlPrettyFormat(String)` from `org.assertj.core.util.xml.XmlStringPrettyFormatter`ImpactIf untrusted XML input is processed by the methods mentioned above (e.g., in test environments handling external fixture files), an attacker could:**Read arbitrary local files** via `file://` URIs (e.g., `/etc/passwd`, application configuration files)**Perform Server-Side Request Forgery (SSRF)** via HTTP/HTTPS URIs**Cause Denial of Service** via "Billion Laughs" entity expansion attacksMitigation`isXmlEqualTo(CharSequence)` has been deprecated in favor of [XMLUnit](https://www.xmlunit.org/) in version 3.18.0 and will be removed in version 4.0. Users of affected versions should, in order of preference:Replace `isXmlEqualTo(CharSequence)` with XMLUnit, orUpgrade to version 3.27.7, orAvoid using `isXmlEqualTo(CharSequence)` or `XmlStringPrettyFormatter` with untrusted input.`XmlStringPrettyFormatter` has historically been considered a utility for `isXmlEqualTo(CharSequence)` rather than a feature for AssertJ users, so it is deprecated in version 3.27.7 and removed in version 4.0, with no replacement.References[CWE-611: Improper Restriction of XML External Entity Reference](https://cwe.mitre.org/data/definitions/611.html)[OWASP XXE Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)
CVSS v4.0: 8.2
CVE-2026-46211: drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata()
In the Linux kernel, the following vulnerability has been resolved:

drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata()

msm_ioctl_gem_info_get_metadata() always returns 0 regardless of
errors. When copy_to_user() fails or the user buffer is too small,
the error code stored in ret is ignored because the function
unconditionally returns 0. This causes userspace to believe the
ioctl succeeded when it did not.

Additionally, kmemdup() can return NULL on allocation failure, but
the return value is not checked. This leads to a NULL pointer
dereference in the subsequent copy_to_user() call.

Add the missing NULL check for kmemdup() and return ret instead of 0.

Note that the SET counterpart (msm_ioctl_gem_info_set_metadata)
correctly returns ret.

Patchwork: https://patchwork.freedesktop.org/patch/714478/
CVSS v3.1: 5.5
RHSA-2016:1140: Red Hat Security Advisory: squid34 security update
squid: buffer overflow in cachemgr.cgi squid: multiple issues in ESI processing squid: multiple issues in ESI processing squid: multiple issues in ESI processing squid: Cache poisoning issue in HTTP Request handling squid: Header Smuggling issue in HTTP Request processing squid: SegFault from ESIInclude::Start squid: SIGSEGV in ESIContext response handling
CVE-2018-14567: libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251.
CVSS v3.0: 6.5
CVSS v2.0: 4.3
CVE-2026-53662: immich: One-click account takeover via XSS in login page continue redirect
immich is a high performance self-hosted photo and video management solution. From commit 4ffa26c9 until 4eb1003, a reflected cross-site scripting (XSS) vulnerability on the /auth/login page allows an attacker to fully compromise any authenticated user's account with a single link click. The continue query parameter is read from the URL and passed to SvelteKit's redirect() without any scheme or origin validation, allowing attacker-controlled JavaScript to execute inside Immich's origin. The payload then uses the victim's existing session to mint an all-permission API key on their account, leading to persistent account takeover. This vulnerability is fixed in commit 4eb1003.
CVSS v3.1: 9.6
GHSA-396v-64fx-m3wv: PHP remote file inclusion vulnerability in show_joined.php in Indiscripts Enthusiast 3.1.4, and possibly earlier, allows remote attackers to execute arbitrary PHP code via a URL in the path parameter.  NOTE: the researcher also points out the analogous directory traversal issue.
CVE-2025-0392: Guangzhou Huayi Intelligent Technology Jeewms graphReportController.do datagridGraph sql injection
A vulnerability, which was classified as critical, was found in Guangzhou Huayi Intelligent Technology Jeewms up to 20241229. Affected is the function datagridGraph of the file /graphReportController.do. The manipulation of the argument store_code leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 20250101 is able to address this issue. It is recommended to upgrade the affected component.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
GHSA-mcp9-hfjj-cpp5: IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 is vulnerable to injection attacks in application logging by not sanitizing user provided data.  IBM X-Force ID:  251463.
CVSS v3.1: 5.3
CVE-2018-9404: In oemCallback of ril.cpp, there is a possible out of bounds write due to an
    integer overflow. This could lead to local escalation of privilege with
    System execution privileges needed. User interaction is not needed for
    exploitation.
CVSS v3.1: 7.8
CVE-2015-1811: XML external entity (XXE) vulnerability in CloudBees Jenkins before 1.600 and LTS before 1.596.1 allows remote attackers to read arbitrary XML files via a crafted XML document.
CVSS v3.1: 7.5
CVSS v2.0: 5
CVE-2022-40280: An issue was discovered in Samsung TizenRT through 3.0_GBM (and 3.1_PRE). createDB in security/provisioning/src/provisioningdatabasemanager.c has a missing sqlite3_close after sqlite3_open_v2, leading to a denial of service.
CVSS v3.1: 7.5
CVE-2024-45761: Dell OpenManage Server Administrator, versions 11.0.1.0 and prior, contains an improper input validation vulnerability. A remote low-privileged malicious user could potentially exploit this vulnerability to load any web plugins or Java class leading to the possibility of altering the behavior of certain apps/OS or Denial of Service.
CVSS v3.1: 5.4
GHSA-976w-rfcm-5cfg: A race condition was addressed with improved locking. This issue is fixed in macOS Ventura 13.7, iOS 17.7 and iPadOS 17.7, visionOS 2, iOS 18 and iPadOS 18, macOS Sonoma 14.7, macOS Sequoia 15. Unpacking a maliciously crafted archive may allow an attacker to write arbitrary files.
CVSS v3.1: 8.1
CVE-2008-0386: Xdg-utils 1.0.2 and earlier allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a URL argument to (1) xdg-open or (2) xdg-email.
CVSS v2.0: 6.8
CVE-2025-9038: S1 Agile Privilege Escalation
Improper Privilege Management vulnerability in GE Vernova S1 Agile Configuration Software on Windows allows Privilege Escalation.This issue affects S1 Agile Configuration Software: 3.1 and previous version.
CVSS v4.0: 7.5
CVE-2018-4858: A vulnerability has been identified in IEC 61850 system configurator (All versions < V5.80), DIGSI 5 (affected as IEC 61850 system configurator is incorporated) (All versions < V7.80), DIGSI 4 (All versions < V4.93), SICAM PAS/PQS (All versions < V8.11), SICAM PQ Analyzer (All versions < V3.11), SICAM SCC (All versions < V9.02 HF3). A service of the affected products listening on all of the host's network interfaces on either port 4884/TCP, 5885/TCP, or port 5886/TCP could allow an attacker to either exfiltrate limited data from the system or to execute code with Microsoft Windows user permissions. Successful exploitation requires an attacker to be able to send a specially crafted network request to the vulnerable service and a user interacting with the service's client application on the host. In order to execute arbitrary code with Microsoft Windows user permissions, an attacker must be able to plant the code in advance on the host by other means. The vulnerability has limited impact to confidentiality and integrity of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known. Siemens confirms the security vulnerability and provides mitigations to resolve the security issue.
CVSS v3.1: 7.8
CVSS v2.0: 9.3
CVE-2021-46544: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via /usr/lib/x86_64-linux-gnu/libasan.so.4+0x59e19. This vulnerability can lead to a Denial of Service (DoS).
CVSS v3.1: 5.5
CVSS v2.0: 4.3
GHSA-pv55-r6j3-wp94: Malicious Package in eslint-config-eslint
Version 5.0.2 of `eslint-config-eslint` was published without authorization and was found to contain malicious code. This code would read the users `.npmrc` file and send any found authentication tokens to a remote server.RecommendationThe best course of action if you found this package installed in your environment is to revoke all your npm tokens. You can find instructions on how to do that here. https://docs.npmjs.com/getting-started/working_with_tokens#how-to-revoke-tokensUsers may consider downgrading to version 5.0.1
RHSA-2004:139: Red Hat Security Advisory: apache, openssl security update for Stronghold
security flaw security flaw security flaw security flaw
CVE-2005-2255: Directory traversal vulnerability in PhpAuction 2.5 allows remote attackers to read arbitrary files, include local PHP files, or obtain sensitive path information via ".."  sequences in the lan parameter to (1) index.php or (2) admin/index.php.
CVSS v2.0: 6.4
GHSA-64qh-q5qg-p2h5: The HTTP proxy in Symantec Gateway Security 5000 Series 2.0.1 and 3.0, and Enterprise Firewall 8.0, when NAT is being used, allows remote attackers to determine internal IP addresses by using malformed HTTP requests, as demonstrated using a get request without a space separating the URI.
CVE-2021-47423: drm/nouveau/debugfs: fix file release memory leak
In the Linux kernel, the following vulnerability has been resolved:

drm/nouveau/debugfs: fix file release memory leak

When using single_open() for opening, single_release() should be
called, otherwise the 'op' allocated in single_open() will be leaked.
CVSS v3.1: 5.5