ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2019-10444: Jenkins Bumblebee HP ALM Plugin 4.1.3 and earlier unconditionally disabled SSL/TLS and hostname verification for connections to HP ALM.
CVSS v3.1: 6.5
CVSS v2.0: 6.4
GHSA-v32r-ffrj-5hp3: The Coolpad N3C Android device with a build fingerprint of Coolpad/N3C/N3C:8.1.0/O11019/1538236809:user/release-keys contains a pre-installed app with a package name of com.mediatek.wfo.impl app (versionCode=27, versionName=8.1.0) that allows any app co-located on the device to modify a system property through an exported interface without proper authorization.
CVE-2024-39292: um: Add winch to winch_handlers before registering winch IRQ
In the Linux kernel, the following vulnerability has been resolved:

um: Add winch to winch_handlers before registering winch IRQ

Registering a winch IRQ is racy, an interrupt may occur before the winch is
added to the winch_handlers list.

If that happens, register_winch_irq() adds to that list a winch that is
scheduled to be (or has already been) freed, causing a panic later in
winch_cleanup().

Avoid the race by adding the winch to the winch_handlers list before
registering the IRQ, and rolling back if um_request_irq() fails.
CVSS v3.1: 5.5
CVE-2023-20905: In Mfc_Transceive of phNxpExtns_MifareStd.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-241387741
CVSS v3.1: 7.8
GHSA-wpp5-gj35-j435: The Ultimate Blocks – WordPress Blocks Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'buttonTextColor’ parameter in all versions up to, and including, 3.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
GHSA-gmvv-r8vc-f93q: A vulnerability has been found in SourceCodester Online Student Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file edit-student-detail.php. The manipulation of the argument notmsg leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-248377 was assigned to this vulnerability.
CVSS v3.1: 2.4
ICSA-24-345-04: National Instruments LabVIEW
An out-of-bounds read exists in the HeapObjMapImpl function, which may allow an attacker to disclose information or execute arbitrary code. An out-of-bounds read exists when loading the font table, which may allow an attacker to disclose information or execute arbitrary code. An out-of-bounds read exists in BuildFontMap function, which may allow an attacker to disclose information or execute arbitrary code.
CVSS v3.1: 7.8
GHSA-46jj-rq32-r93h: An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. When creating a trial account, it is possible to inject XSS in the Alias field, allowing the attacker to retrieve the admin's cookie and take over the account.
CVSS v3.0: 6.1
CVE-2018-1999027: An exposure of sensitive information vulnerability exists in Jenkins SaltStack Plugin 3.1.6 and earlier in SaltAPIBuilder.java, SaltAPIStep.java that allows attackers to capture credentials with a known credentials ID stored in Jenkins.
CVSS v3.0: 7.5
CVSS v2.0: 6.8
GHSA-8x5p-qjg7-wv4q: Windows DVD Maker in Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, and Windows Vista SP2 does not properly parse crafted .msdvd files, which allows attackers to obtain information to compromise a target system, aka "Windows DVD Maker Cross-Site Request Forgery Vulnerability."
CVSS v3.0: 5.5
CVE-2023-51296: PHPJabbers Event Booking Calendar v4.0 is vulnerable to Cross-Site Scripting (XSS) in the "name, plugin_sms_api_key, plugin_sms_country_code, title, plugin_sms_api_key" parameters which allows attackers to execute arbitrary code
CVSS v3.1: 6.1
CVE-2024-54173: IBM MQ information disclosure
IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD reveals potentially sensitive information in trace files that could be read by a local user when webconsole trace is enabled.
CVSS v3.1: 4.7
CVE-2015-4426: SQL injection vulnerability in pimcore before build 3473 allows remote attackers to execute arbitrary SQL commands via the filter parameter to admin/asset/grid-proxy.
CVSS v2.0: 7.5
CVE-2020-36871: ESCAM QD-900 Unauthenticated Configuration Disclosure
ESCAM QD-900 WIFI HD cameras contain an unauthenticated configuration disclosure vulnerability in the /web/cgi-bin/hi3510/backup.cgi endpoint. The endpoint allows remote download of a compressed configuration backup without requiring authentication or authorization. The exposed backup can include administrative credentials and other sensitive device settings, enabling an unauthenticated remote attacker to obtain information that may facilitate further compromise of the camera or connected network.
CVSS v4.0: 8.7
CVE-2005-4205: Cross-site scripting (XSS) vulnerability in searchdb.asp in LocazoList 1.03c and earlier allows remote attackers to inject arbitrary web script or HTML via the q parameter.
CVSS v2.0: 4.3
CVE-2025-46350: Yeswiki Vulnerable to Authenticated Reflected Cross-site Scripting
YesWiki is a wiki system written in PHP. Prior to version 4.5.4, an attacker can use a reflected cross-site scripting attack to steal cookies from an authenticated user by having them click on a malicious link. Stolen cookies allow the attacker to take over the user’s session. This vulnerability may also allow attackers to deface the website or embed malicious content. This issue has been patched in version 4.5.4.
CVSS v3.1: 3.5
GHSA-ccj6-79j6-cq5q: WeKnora Vulnerable to Broken Access Control in Tenant Management
SummaryAn authorization bypass in tenant management endpoints of WeKnora application allows any authenticated user to read, modify, or delete any tenant by ID. Since account registration is open to the public, this vulnerability allows any unauthenticated attacker to register an account and subsequently exploit the system. This enables cross-tenant account takeover and destruction, making the impact critical.DetailsThe tenant management handlers do not validate that the caller owns the tenant or has cross-tenant privileges. The handlers parse the tenant ID from the path and directly call the service layer with that ID, returning or mutating the tenant without authorization checks.Affected handlers:`GET /api/v1/tenants` lists all tenants without ownership checks`GET /api/v1/tenants/{id}` reads any tenant by ID without ownership checks`PUT /api/v1/tenants/{id}` allows updating any tenant by ID without ownership checks`DELETE /api/v1/tenants/{id}` allows deleting any tenant by ID without ownership checksThese endpoints do not enforce cross-tenant permissions or deny-by-default behavior, unlike `ListAllTenants` and `SearchTenants`.PoCRegister a new account as a user in Tenant 10025 and obtain a bearer token or API key.Read details of other tenants:Request that uses API key via the `X-API-Key` header:Response (truncated for brevity):With API keys, we can do anything on the victim account's behalf, including reading sensitive data (LLM API keys, knowledge bases), modifying configurations, etc.Requests to perform modification and deletion of another tenant.Modify the victim tenant:Request:Method: `PUT`URL: `http://localhost:8088/api/v1/tenants/10001`Header: `Authorization: Bearer <ATTACKER_TOKEN>`Body: `{ "name": "HACKED by tenant 10025" }`Expected response:`200 OK` with the updated tenant object.Delete the victim tenant:Request:Method: `DELETE`URL: `http://localhost:8088/api/v1/tenants/10001`Header: `Authorization: Bearer <ATTACKER_TOKEN>`Expected response:`200 OK` and the tenant is deleted.ImpactThis is a Broken Access Control (BOLA/IDOR) vulnerability in tenant management of WeKnora. Any user can access, modify, or delete tenants belonging to other customers, resulting in cross-tenant data exposure, account takeover, and destructive actions against other tenants. Moreover, when the account is taken over, attacker can read configured models to unauthorizedly extract sensitive data such as API keys of LLM services.
CVSS v3.1: 9.8
CVE-2018-20101: The codection "Import users from CSV with meta" plugin before 1.12.1 for WordPress allows XSS via the value of a cell.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
CVE-2020-36886: SpinetiX Fusion Digital Signage 3.4.8 Cross-Site Request Forgery via User Creation
SpinetiX Fusion Digital Signage 3.4.8 contains a cross-site request forgery vulnerability that allows attackers to create administrative user accounts without proper request validation. Attackers can craft a malicious web page that automatically submits a form to create a new admin user with full system privileges when a logged-in user visits the page.
CVSS v4.0: 6.9
CVE-2026-27928: Windows Hello Security Feature Bypass Vulnerability
Improper input validation in Windows Hello allows an unauthorized attacker to bypass a security feature over a network.
CVSS v3.1: 8.7
CVE-2008-6832: Cross-site request forgery (CSRF) vulnerability in Atlassian JIRA Enterprise Edition 3.13 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS v2.0: 6.8
CVE-2022-21985: Windows Remote Access Connection Manager Information Disclosure Vulnerability
Windows Remote Access Connection Manager Information Disclosure Vulnerability
CVSS v3.1: 5.5
RHSA-2023:3431: Red Hat Security Advisory: kpatch-patch security update
kernel: use-after-free caused by l2cap_reassemble_sdu() in net/bluetooth/l2cap_core.c kernel: stack overflow in do_proc_dointvec and proc_skip_spaces
CVSS v3.1: 7.8
PYSEC-2013-26: The default configuration for salt-ssh in Salt (aka SaltStack) 0.17.0 does not validate the SSH host key of requests, which allows remote attackers to have unspecified impact via a man-in-the-middle (MITM) attack.
CVE-2017-11413: Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_article/controller/comment_status.php via $_GET['id'].
CVSS v3.0: 9.8
CVSS v2.0: 7.5
CVE-2015-6458: Moxa SoftCMS 1.3 and prior is susceptible to a buffer overflow condition that may crash or allow remote code execution. Moxa released SoftCMS version 1.4 on June 1, 2015, to address the vulnerability.
CVSS v3.0: 8.8
CVSS v2.0: 6.8
GHSA-gv8f-7qqp-f8mr: In multiple locations, there is a possible cross-user image read due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is needed for exploitation.
CVSS v3.1: 5
GHSA-jjvg-p7hw-35xj: A reflected Cross-Site Scripting (XSS) vulnerability exists in /webscan/sqlmap/index.html in QingScan <=v1.8.0. The vulnerability is caused by improper input sanitization of the query parameter, allowing an attacker to inject malicious JavaScript payloads. When a victim accesses a crafted URL containing the malicious input, the script executes in the victim's browser context.
CVSS v3.1: 5.4
CVE-2023-21744: Microsoft SharePoint Server Remote Code Execution Vulnerability
Microsoft SharePoint Server Remote Code Execution Vulnerability
CVSS v3.1: 8.8
GHSA-j9hr-gx6q-5wpj: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Rajesh Thanoch Quick Learn allows Object Injection.This issue affects Quick Learn: from n/a through 1.0.1.
CVSS v3.1: 9.8
CVE-2024-28270: An issue discovered in web-flash v3.0 allows attackers to reset passwords for arbitrary users via crafted POST request to /prod-api/user/resetPassword.
CVSS v3.1: 8.1
CVE-2017-16213: mfrserver is a simple file server. mfrserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.
CVSS v3.0: 7.5
CVSS v2.0: 5
GHSA-mh63-77cm-cvj3: An information disclosure vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Information Disclosure Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet Explorer 10. This CVE ID is unique from CVE-2018-0981, CVE-2018-0987, CVE-2018-0989.
CVSS v3.0: 5.3
GHSA-3jj9-prrv-2wv6: Libde265 v1.0.8 was discovered to contain an unknown crash via ff_hevc_put_hevc_qpel_v_3_8_sse in sse-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.
CVSS v3.1: 6.5
CVE-2022-38742: Rockwell Automation ThinManager Software Vulnerable to Arbitrary Code Execution and Denial-Of-Service Attack
Rockwell Automation ThinManager ThinServer versions 11.0.0 - 13.0.0 is vulnerable to a heap-based buffer overflow. An attacker could send a specifically crafted TFTP or HTTPS request, causing a heap-based buffer overflow that crashes the ThinServer process. If successfully exploited, this could expose the server to arbitrary remote code execution.
CVSS v3.1: 8.1
GHSA-3fjh-3qmq-p25v: A vulnerability in the system resource management of Cisco Elastic Services Controller (ESC) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) to the health monitor API on an affected device.
 The vulnerability is due to inadequate provisioning of kernel parameters for the maximum number of TCP connections and SYN backlog. An attacker could exploit this vulnerability by sending a flood of crafted TCP packets to an affected device. A successful exploit could allow the attacker to block TCP listening ports that are used by the health monitor API. This vulnerability only affects customers who use the health monitor API.
CVE-2018-8795: rdesktop versions up to and including v1.8.3 contain an Integer Overflow that leads to a Heap-Based Buffer Overflow in function process_bitmap_updates() and results in a memory corruption and probably even a remote code execution.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
GHSA-2rqp-mqvp-96gv: S-Lang 2.3.2 was discovered to contain a segmentation fault via the function fixup_tgetstr().
CVSS v3.1: 9.1
GHSA-9v94-8833-hv33: In the Linux kernel, the following vulnerability has been resolved:protect the fetch of ->fd[fd] in do_dup2() from mispredictionsboth callers have verified that fd is not greater than ->max_fds;
however, misprediction might end up with
        tofree = fdt->fd[fd];
being speculatively executed.  That's wrong for the same reasons
why it's wrong in close_fd()/file_close_fd_locked(); the same
solution applies - array_index_nospec(fd, fdt->max_fds) could differ
from fd only in case of speculative execution on mispredicted path.
CVSS v3.1: 5.5
GHSA-hf2p-g3jq-w2mx: In the Linux kernel, the following vulnerability has been resolved:netfilter: ip6t_eui64: reject invalid MAC header for all packets`eui64_mt6()` derives a modified EUI-64 from the Ethernet source address
and compares it with the low 64 bits of the IPv6 source address.The existing guard only rejects an invalid MAC header when
`par->fragoff != 0`. For packets with `par->fragoff == 0`, `eui64_mt6()`
can still reach `eth_hdr(skb)` even when the MAC header is not valid.Fix this by removing the `par->fragoff != 0` condition so that packets
with an invalid MAC header are rejected before accessing `eth_hdr(skb)`.
CVSS v3.1: 9.4
GHSA-v8g6-5675-xqp6: PHP remote file inclusion vulnerability in gallery_top.inc.php in PHPQuickGallery 1.9 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the textFile parameter.
CVE-2019-10123: SQL Injection in Advanced InfoData Systems (AIS) ESEL-Server 67 (which is the backend for the AIS logistics mobile app) allows an anonymous attacker to execute arbitrary code in the context of the user of the MSSQL database. The default user for the database is the 'sa' user.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
GHSA-4m4r-j72q-7w52: A vulnerability has been found in GNU Binutils 2.43/2.44 and classified as problematic. Affected by this vulnerability is the function display_info of the file binutils/bucomm.c of the component objdump. The manipulation leads to memory leak. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is named ba6ad3a18cb26b79e0e3b84c39f707535bbc344d. It is recommended to apply a patch to fix this issue.
CVSS v4.0: 4.8
CVSS v3.1: 3.3
CVE-2024-12066: SMSA Shipping(official) <= 2.3 - Authenticated (Subscriber+) Arbitrary File Deletion
The SMSA Shipping(official) plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the smsa_delete_label() function in all versions up to, and including, 2.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). CVE-2024-49249 is likely a duplicate of this issue.
CVSS v3.1: 8.8
CVE-2000-0320: Qpopper 2.53 and 3.0 does not properly identify the \n string which identifies the end of message text, which allows a remote attacker to cause a denial of service or corrupt mailboxes via a message line that is 1023 characters long and ends in \n.
CVSS v2.0: 5
GHSA-cwc2-grvm-9422: The cleanup_journal_tail function in the Journaling Block Device (JBD) functionality in the Linux kernel 2.6 allows local users to cause a denial of service (assertion error and kernel oops) via an ext3 or ext4 image with an "invalid log first block value."
CVE-2011-0904: The rfbSendFramebufferUpdate function in server/libvncserver/rfbserver.c in vino-server in Vino 2.x before 2.28.3, 2.32.x before 2.32.2, 3.0.x before 3.0.2, and 3.1.x before 3.1.1, when raw encoding is used, allows remote authenticated users to cause a denial of service (daemon crash) via a large (1) X position or (2) Y position value in a framebuffer update request that triggers an out-of-bounds memory access, related to the rfbTranslateNone and rfbSendRectEncodingRaw functions.
CVSS v2.0: 3.5
GHSA-vx7x-qwmp-h33c: Authorization bypass in the PAM access request approval mechanism in Devolutions Server 2024.2.10 and earlier allows authenticated users with permissions to approve their own requests, bypassing intended security restrictions, via the PAM access request approval mechanism.
CVSS v3.1: 6.5
CVE-2005-1049: Multiple cross-site scripting vulnerabilities in PostNuke 0.760-RC3 allow remote attackers to inject arbitrary web script or HTML via the (1) module parameter to admin.php or (2) op parameter to user.php. NOTE: the vendor reports that certain issues could not be reproduced for 760 RC3, or for .750.  However, the op/user.php issue exists when the pnAntiCracker setting is disabled.
CVSS v2.0: 2.6
GHSA-85ww-wm3w-c8w6: In the Linux kernel, the following vulnerability has been resolved:fs/ntfs3: Fix OOB read in indx_insert_into_bufferSyzbot reported a OOB read bug:BUG: KASAN: slab-out-of-bounds in indx_insert_into_buffer+0xaa3/0x13b0
fs/ntfs3/index.c:1755
Read of size 17168 at addr ffff8880255e06c0 by task syz-executor308/3630Call Trace:
 <TASK>
 memmove+0x25/0x60 mm/kasan/shadow.c:54
 indx_insert_into_buffer+0xaa3/0x13b0 fs/ntfs3/index.c:1755
 indx_insert_entry+0x446/0x6b0 fs/ntfs3/index.c:1863
 ntfs_create_inode+0x1d3f/0x35c0 fs/ntfs3/inode.c:1548
 ntfs_create+0x3e/0x60 fs/ntfs3/namei.c:100
 lookup_open fs/namei.c:3413 [inline]If the member struct INDEX_BUFFER *index of struct indx_node is
incorrect, that is, the value of __le32 used is greater than the value
of __le32 total in struct INDEX_HDR. Therefore, OOB read occurs when
memmove is called in indx_insert_into_buffer().
Fix this by adding a check in hdr_find_e().
GHSA-x25v-4mjr-m382: The NETM() function of a smart contract implementation for NewIntelTechMedia (NETM), an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function does not check the caller's identity.
CVE-2022-34387: 



Dell SupportAssist for Home PCs (version 3.11.4 and prior) and  SupportAssist for Business PCs (version 3.2.0 and prior) contain a privilege escalation vulnerability. A local authenticated malicious user could potentially exploit this vulnerability to elevate privileges and gain total control of the system.








CVSS v3.1: 6.4
GHSA-49c8-cmr9-7c94: AMD Radeon Software may be vulnerable to DLL Hijacking through path variable. An unprivileged user may be able to drop its malicious DLL file in any location which is in path environment variable.
CVE-2025-29215: Tenda AX12 v22.03.01.46_CN was discovered to contain a stack overflow via the sub_43fdcc function at /goform/SetNetControlList.
CVSS v3.1: 6.5
GHSA-r8j4-96mx-rjcc: Improper Restriction of XML External Entity Reference in skylot/jadx
skylot/jadx prior to 1.3.2 is vulnerable to Improper Restriction of XML External Entities when a user is tricked into exporting a malicious APK file (via the -e option) containing a crafted AndroidManifest.xml / strings.xml to gradle, leading to possible local file disclosure.
CVSS v3.0: 5.5
CVE-2025-38386: ACPICA: Refuse to evaluate a method if arguments are missing
In the Linux kernel, the following vulnerability has been resolved:

ACPICA: Refuse to evaluate a method if arguments are missing

As reported in [1], a platform firmware update that increased the number
of method parameters and forgot to update a least one of its callers,
caused ACPICA to crash due to use-after-free.

Since this a result of a clear AML issue that arguably cannot be fixed
up by the interpreter (it cannot produce missing data out of thin air),
address it by making ACPICA refuse to evaluate a method if the caller
attempts to pass fewer arguments than expected to it.
CVSS v3.1: 5.5
GHSA-r4g9-qvhr-m33h: Huawei FusionInsight HD before V100R002C60SPC200 allows local users to gain root privileges via unspecified vectors.
CVSS v3.0: 7.8
CVE-2021-37662: Reference binding to nullptr in boosted trees in TensorFlow
TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can generate undefined behavior via a reference binding to nullptr in `BoostedTreesCalculateBestGainsPerFeature` and similar attack can occur in `BoostedTreesCalculateBestFeatureSplitV2`. The [implementation](https://github.com/tensorflow/tensorflow/blob/84d053187cb80d975ef2b9684d4b61981bca0c41/tensorflow/core/kernels/boosted_trees/stats_ops.cc) does not validate the input values. We have patched the issue in GitHub commit 9c87c32c710d0b5b53dc6fd3bfde4046e1f7a5ad and in commit 429f009d2b2c09028647dd4bb7b3f6f414bbaad7. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
CVSS v3.1: 7.1
CVE-2023-21909: Vulnerability in the Siebel CRM product of Oracle Siebel CRM (component: UI Framework).  Supported versions that are affected are 23.3 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
CVSS v3.1: 6.5
GHSA-9vhv-pwq9-3j8p: A vulnerability was found in CrowdStrike Falcon 6.31.14505.0/6.42.15610. It has been classified as problematic. Affected is the Uninstallation Handler which makes it possible to circumvent and disable the security feature. The manipulation leads to missing authorization. The identifier of this vulnerability is VDB-206880.
CVSS v3.1: 2.7
GHSA-mggj-wcpg-x6cm: In ril service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
CVSS v3.1: 4.4
CVE-2023-5482: Insufficient data validation in USB in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
CVSS v3.1: 8.8