ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-wc5v-r48v-g4vh: Cilium host policy bypass in endpoint-routes mode with dual-stack
ImpactThis vulnerability allows bypassing host policies for IPv6 traffic coming from a Cilium-managed pod and destined to the host-network namespace (e.g., to a host-network pod). Host policy enforcement on IPv4 or for traffic coming from outside the node is not affected.Cilium is only affected by this vulnerability if IPv4, IPv6, endpoint routes, and the host firewall are enabled. Note that endpoint routes are typically only enabled in GKE, EKS, AKS, and OpenShift; in those environments, IPv6 is typically disabled. Host firewall is disabled by default.PatchesThe bug is fixed in versions v1.10.13 and v1.11.7 of Cilium.WorkaroundsFor affected users who can't upgrade, one potential workaround is to ensure all pods have network policies that prevent sending arbitrary traffic to the local node.ReferencesCommit fixing the vulnerability: https://github.com/cilium/cilium/commit/c758da7e9d19cd19b96dc90424c0b5ec7409cd0a.For more informationIf you have any questions or comments about this advisory, please reach out on [Slack](https://docs.cilium.io/en/latest/community/community/#slack).As usual, if you think you found a related vulnerability, we strongly encourage you to report security vulnerabilities to our private security mailing list: [security@cilium.io](mailto:security@cilium.io)—first, before disclosing them in any public forums. This is a private mailing list where only members of the Cilium internal security team are subscribed to, and is treated as top priority.
CVSS v3.1: 3.3
GHSA-f72m-6mmm-c2wj: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. Crafted data in a JT file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15384.
CVE-2019-7594: Metasys use of hardcoded RC2 key
Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a hardcoded RC2 key for certain encryption operations involving the Site Management Portal (SMP).
CVSS v3.0: 6.8
GHSA-2x9x-c2fx-m574: Adobe Flash Player versions 29.0.0.171 and earlier have an Integer Overflow vulnerability. Successful exploitation could lead to information disclosure.
CVSS v3.0: 6.5
RHSA-2025:7067: Red Hat Security Advisory: krb5 security update
krb5: overflow when calculating ulog block size
CVSS v3.1: 6.5
PYSEC-2023-39: OpenZeppelin Contracts for Cairo is a library for secure smart contract development written in Cairo for StarkNet, a decentralized ZK Rollup. `is_valid_eth_signature` is missing a call to `finalize_keccak` after calling `verify_eth_signature`. As a result, any contract using `is_valid_eth_signature` from the account library (such as the `EthAccount` preset) is vulnerable to a malicious sequencer. Specifically, the malicious sequencer would be able to bypass signature validation to impersonate an instance of these accounts. The issue has been patched in 0.6.1.
CVE-2020-11452: Microstrategy Web 10.4 includes functionality to allow users to import files or data from external resources such as URLs or databases. By providing an external URL under attacker control, it's possible to send requests to external resources (aka SSRF) or leak files from the local system using the file:// stream wrapper.
CVSS v3.1: 4.3
CVSS v2.0: 4
CVE-2024-36488: Improper Access Control in some Intel(R) DSA before version 24.3.26.8 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS v4.0: 5.4
CVSS v3.1: 7.3
GHSA-964m-5c8q-r3w3: Multiple SQL injection vulnerabilities in tplSoccerSite 1.0 allow remote attackers to execute arbitrary SQL commands via (1) the opp parameter to tampereunited/opponent.php; or the id parameter to (2) index.php, (3) player.php, (4) matchdetails.php, or (5) additionalpage.php in tampereunited/.
CVE-2019-1782: Cisco FXOS and NX-OS Software Command Injection Vulnerability
A vulnerability in the CLI of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of arguments passed to certain CLI commands. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with elevated privileges. An attacker would need administrator credentials to exploit this vulnerability.
CVSS v3.0: 6.7
CVE-2023-29060: Lack of USB Whitelisting
The FACSChorus workstation operating system does not restrict what devices can interact with its USB ports. If exploited, a threat actor with physical access to the workstation could gain access to system information and potentially exfiltrate data.
CVSS v3.1: 5.4
CVE-2002-2177: BEA WebLogic Server and Express 6.1 through 7.0.0.1 buffers HTTP requests in a way that can cause BEA to send the same response for two different HTTP requests, which could allow remote attackers to obtain sensitive information that was intended for other users.
CVSS v2.0: 2.6
CVE-2024-54272: WordPress Radius Blocks plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RadiusTheme Radius Blocks radius-blocks allows Stored XSS.This issue affects Radius Blocks: from n/a through <= 2.1.2.
CVSS v3.1: 6.5
CVE-2026-34720: Zammad has an origin validation error in SSO mechanism
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the SSO mechanism in Zammad was not verifying the header originates from a trusted SSO proxy/gateway before applying further actions on it. This vulnerability is fixed in 7.0.1 and 6.5.4.
CVSS v4.0: 2.3
GHSA-fh6w-c9cf-q94h: External control of file name or path in Confidential Azure Container Instances allows an authorized attacker to elevate privileges locally.
CVSS v3.1: 8.2
GHSA-2vgj-j756-9gpx: ipa-kra-install in FreeIPA before 4.2.2 puts the CA agent certificate and private key in /etc/httpd/alias/kra-agent.pem, which is world readable.
CVSS v3.0: 9.8
GHSA-88rv-c8gv-rfv7: In the Linux kernel, the following vulnerability has been resolved:netfilter: ctnetlink: ensure safe access to master conntrackHolding reference on the expectation is not sufficient, the master
conntrack object can just go away, making exp->master invalid.To access exp->master safely:Grab the nf_conntrack_expect_lock, this gets serialized with
clean_from_lists() which also holds this lock when the master
conntrack goes away.Hold reference on master conntrack via nf_conntrack_find_get().
Not so easy since the master tuple to look up for the master conntrack
is not available in the existing problematic paths.This patch goes for extending the nf_conntrack_expect_lock section
to address this issue for simplicity, in the cases that are described
below this is just slightly extending the lock section.The add expectation command already holds a reference to the master
conntrack from ctnetlink_create_expect().However, the delete expectation command needs to grab the spinlock
before looking up for the expectation. Expand the existing spinlock
section to address this to cover the expectation lookup. Note that,
the nf_ct_expect_iterate_net() calls already grabs the spinlock while
iterating over the expectation table, which is correct.The get expectation command needs to grab the spinlock to ensure master
conntrack does not go away. This also expands the existing spinlock
section to cover the expectation lookup too. I needed to move the
netlink skb allocation out of the spinlock to keep it GFP_KERNEL.For the expectation events, the IPEXP_DESTROY event is already delivered
under the spinlock, just move the delivery of IPEXP_NEW under the
spinlock too because the master conntrack event cache is reached through
exp->master.While at it, add lockdep notations to help identify what codepaths need
to grab the spinlock.
CVSS v3.1: 7.8
CVE-2026-6985: Cesanta Mongoose TCP Option net_builtin.c handle_opt infinite loop
A weakness has been identified in Cesanta Mongoose up to 7.20. This vulnerability affects the function handle_opt of the file /src/net_builtin.c of the component TCP Option Handler. This manipulation of the argument optlen causes infinite loop. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 7.21 is able to resolve this issue. Upgrading the affected component is advised. VulDB has contacted the vendor early and they confirmed quickly, that this issue got fixed already.
CVSS v4.0: 6.9
CVSS v3.1: 5.3
CVSS v3.0: 5.3
CVSS v2.0: 5
GHSA-3w97-9v6v-7c57: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability in Brocade Fabric OS versions v7.4.1b and v7.3.1d could allow local users to conduct privileged directory transversal. Brocade Fabric OS versions v7.4.1.x and v7.3.x have reached end of life. Brocade Fabric OS Users should upgrade to supported versions as described in the Product End-of-Life Publish report.
CVSS v3.1: 5.5
CVE-2022-1673: WooCommerce Green Wallet Gateway < 1.0.2 - Reflected Cross Site Scripting in checkout page
The WooCommerce Green Wallet Gateway WordPress plugin before 1.0.2 does not escape the error_envision query parameter before outputting it to the page, leading to a Reflected Cross-Site Scripting vulnerability.
CVSS v3.1: 6.1
CVSS v2.0: 4.3
CVE-2006-0413: Multiple SQL injection vulnerabilities in index.php in NewsPHP allow remote attackers to execute arbitrary SQL commands via the (1) discuss, (2) tim, (3) id, (4) last, and (5) limit parameter.
CVSS v2.0: 7.5
CVE-2025-13373: Advantech iView SQL Injection
Advantech iView versions 5.7.05.7057 and prior do not properly sanitize SNMP v1 trap (Port 162) requests, which could allow an attacker to inject SQL commands.
CVSS v4.0: 8.7
CVSS v3.1: 7.5
PYSEC-2023-298: isInList in the safeurl-python package before 1.2 for Python has an insufficiently restrictive regular expression for external domains, leading to SSRF.
CVSS v3.1: 5.3
GHSA-769x-rww2-6j8v: Cross-Site Request Forgery (CSRF) in GitHub repository squidex/squidex prior to 7.4.0.
CVSS v3.1: 6.5
CVE-2009-3732: Format string vulnerability in vmware-vmrc.exe build 158248 in VMware Remote Console (aka VMrc) allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS v2.0: 10
CVE-2019-19772: Various Lexmark products have reflected XSS in the embedded web server used in older generation Lexmark devices. Affected products are available in http://support.lexmark.com/index?page=content&id=TE935&locale=en&userlocale=EN_US.
CVSS v3.1: 5.4
CVSS v2.0: 3.5
CVE-2025-68760: iommu/amd: Fix potential out-of-bounds read in iommu_mmio_show
In the Linux kernel, the following vulnerability has been resolved:

iommu/amd: Fix potential out-of-bounds read in iommu_mmio_show

In iommu_mmio_write(), it validates the user-provided offset with the
check: `iommu->dbg_mmio_offset > iommu->mmio_phys_end - 4`.
This assumes a 4-byte access. However, the corresponding
show handler, iommu_mmio_show(), uses readq() to perform an 8-byte
(64-bit) read.

If a user provides an offset equal to `mmio_phys_end - 4`, the check
passes, and will lead to a 4-byte out-of-bounds read.

Fix this by adjusting the boundary check to use sizeof(u64), which
corresponds to the size of the readq() operation.
GHSA-xpcw-jp98-6h3c: Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when the device retrieves updates scripts from the internet.
RHSA-2015:0816: Red Hat Security Advisory: chromium-browser security update
chromium-browser: Cross-origin-bypass in HTML parser chromium-browser: Cross-origin-bypass in Blink chromium-browser: Use-after-free in IPC chromium-browser: Out-of-bounds write in Skia chromium-browser: Out-of-bounds read in WebGL chromium-browser: tap-jacking vulnerability chromium-browser: Type confusion in V8 chromium-browser: HSTS bypass in WebSockets chromium-browser: Use-after-free in PDFium chromium-browser: Out-of-bounds read in Blink chromium-browser: Scheme issues in OpenSearch chromium-browser: SafeBrowsing bypass chromium-browser: Various fixes from internal audits, fuzzing and other initiatives
GHSA-g92g-j4pf-frg7: Garage Management System 1.0 is vulnerable to Stored Cross Site Scripting (XSS) on several parameters. The vulnerabilities exist during creating or editing the parts under parameters. Using the XSS payload, the Stored XSS triggered and can be used for further attack vector.
CVSS v3.1: 5.4
CVE-2017-7719: SQL injection in the Spider Event Calendar (aka spider-event-calendar) plugin before 1.5.52 for WordPress is exploitable with the order_by parameter to calendar_functions.php or widget_Theme_functions.php, related to front_end/frontend_functions.php.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
RHSA-2002:192: Red Hat Security Advisory: : Updated Mozilla packages fix security vulnerabilities
security flaw security flaw security flaw security flaw
CVE-2015-8416: Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-8045, CVE-2015-8047, CVE-2015-8060, CVE-2015-8408, CVE-2015-8417, CVE-2015-8418, CVE-2015-8419, CVE-2015-8443, CVE-2015-8444, CVE-2015-8451, and CVE-2015-8455.
CVSS v2.0: 10
GHSA-77jc-hjx4-qm2r: A vulnerability in the Veriexec subsystem of Juniper Networks Junos OS allowing an attacker to fully compromise the host system. A local authenticated user can elevate privileges to gain full control of the system even if they are specifically denied access to perform certain actions. This issue affects: Juniper Networks Junos OS: 12.3X48 versions prior to 12.3X48-D80 on SRX Series.
GHSA-vx6v-2rg6-865h: Cross-site Scripting in django-js-reverse
django-js-reverse (aka Django JS Reverse) before 0.9.1 has XSS via js_reverse_inline.
CVSS v4.0: 5.3
CVSS v3.0: 6.1
GHSA-v46g-6fx7-cp78: PAX Technology A930 PayDroid_7.1.1_Virgo_V04.5.02_20220722 allows attackers to compile a malicious shared library and use LD_PRELOAD to bypass authorization checks.
CVSS v3.1: 6.7
CVE-2023-41793: Path Traversal and Untrusted Upload File
: Path Traversal vulnerability in Pandora FMS on all allows Path Traversal. This vulnerability allowed changing directories and creating files and downloading them outside the allowed directories. This issue affects Pandora FMS: from 700 through <776.
CVSS v3.1: 6.7
CVE-2025-63694: DzzOffice v2.3.7 and before is vulnerable to SQL Injection in explorer/groupmanage.
CVSS v3.1: 9.8
RHSA-2021:2299: Red Hat Security Advisory: microcode_ctl security, bug fix and enhancement update
hw: vt-d related privilege escalation hw: improper isolation of shared resources in some Intel Processors hw: observable timing discrepancy in some Intel Processors hw: information disclosure on some Intel Atom processors
CVSS v3.1: 5.6
GHSA-6h67-934r-82g7: Bypass of field access control in strapi-plugin-protected-populate
ImpactUsers are able to bypass the field level security. This means fields that they where not allowed to populate could be populated anyway even in the event that they tried to populate something that they don't have access to.PatchesThis issue has been patched in 1.3.4WorkaroundsNone
CVSS v3.1: 5.3
CVE-2020-9590: Adobe DNG Software Development Kit (SDK) 1.5 and earlier versions have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS v3.1: 7.8
CVSS v2.0: 9.3
CVE-2015-2826: WordPress Simple Ads Manager plugin 2.5.94 and 2.5.96 allows remote attackers to obtain sensitive information.
CVSS v3.0: 5.3
CVSS v2.0: 5
GHSA-334j-33qm-fwx4: In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00422399; Issue ID: MSV-3748.
CVSS v3.1: 8.8
CVE-2024-45133: Adobe Commerce | Improper Access Control (CWE-284)
Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Information Exposure vulnerability that could result in a security feature bypass. An admin attacker could leverage this vulnerability to have a low impact on confidentiality which may aid in further attacks. Exploitation of this issue does not require user interaction.
CVSS v3.1: 2.7
GHSA-frh8-9p35-6h5j: Missing Authorization vulnerability in Proxy &amp; VPN Blocker Proxy &amp; VPN Blocker proxy-vpn-blocker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Proxy &amp; VPN Blocker: from n/a through <= 3.5.3.
CVSS v3.1: 5.4
GHSA-w4qj-38rc-3hq9: Grandstream GXP-2000 VoIP Desktop Phone, firmware version 1.1.0.5, allows remote attackers to cause a denial of service (hang or reboot) via a large amount of ASCII data sent to port (1) 5060/UDP, (2) 5062/UDP, (3) 5064/UDP, (4) 5066/UDP, (5) 9876/UDP, or (6) 26789/UDP.
CVE-2024-12833: Paessler PRTG Network Monitor SNMP Cross-Site Scripting Authentication Bypass Vulnerability
Paessler PRTG Network Monitor SNMP Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Paessler PRTG Network Monitor. Some user interaction on the part of an administrator is required to exploit this vulnerability.

The specific flaw exists within the PRTG Network Monitor web interface. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of an arbitrary script. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-23371.
CVSS v3.0: 8
CVE-2024-45240: The TikTok (aka com.zhiliaoapp.musically) application before 34.5.5 for Android allows the takeover of Lynxview JavaScript interfaces via deeplink traversal (in the application's exposed WebView). (On Android 12 and later, this is only exploitable by third-party applications.)
CVSS v3.1: 7.4
CVE-2021-38116: Possible Command injection Vulnerability in OpenText iManager
Possible Elevation of Privilege Vulnerability

in iManager has been discovered in
OpenText™ iManager. This impacts all versions before 3.2.5
CVSS v3.1: 8.8
GHSA-rjp6-gjq7-25v6: In the Linux kernel, the following vulnerability has been resolved:vhost/vsock: always initialize seqpacket_allowThere are two issues around seqpacket_allow:seqpacket_allow is not initialized when socket is
created. Thus if features are never set, it will be
read uninitialized.if VIRTIO_VSOCK_F_SEQPACKET is set and then cleared,
then seqpacket_allow will not be cleared appropriately
(existing apps I know about don't usually do this but
 it's legal and there's no way to be sure no one relies
 on this).To fix:
	- initialize seqpacket_allow after allocation
	- set it unconditionally in set_features
CVSS v3.1: 7.8
CVE-2015-0602: The mobility extension on Cisco Unified IP 9900 phones with firmware 9.4(.1) and earlier allows remote attackers to obtain sensitive information by sniffing the network, aka Bug ID CSCuq12117.
CVSS v2.0: 5
CVE-2025-14120: URL Image Importer <= 1.0.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
The URL Image Importer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.7 due to insufficient sanitization of SVG files. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS v3.1: 6.4
RHSA-2011:1440: Red Hat Security Advisory: seamonkey security update
Mozilla: Universal XSS likely with MultiByte charset (MFSA 2011-47)
GHSA-g5rr-p69h-7v3g: Insufficient type validation in pocketmine/pocketmine-mp
ImpactWhen an inventory interaction is performed (e.g. moving an item around an inventory), the client sends a serialized version of the itemstack to the server, which the server then deserializes and compares against its own copy. If the copies don't match, the transaction is invalid.This involves deserializing item NBT from the client, which allows for bogus data to be provided. Usually, this is harmless, but in this particular case, it could result in crashes on certain types of bad data (e.g. incorrect ListTag type provided for the `CanDestroy` tag).PatchesThis is fixed in 4.2.9 by commit 5a98b08ee8dc8ff14862cd83d2e4af9d212fefc2.WorkaroundsIt's non-trivial to workaround this, but can be done by handling `InventoryTransactionPacket` and `PlayerAuthInputPacket` to scrub inbound transaction data of bogus NBT that would cause these crashes.For more informationEmail us at [team@pmmp.io](mailto:team@pmmp.io)
CVSS v3.1: 7.5
CVE-2006-0396: Buffer overflow in Mail in Apple Mac OS X 10.4 up to 10.4.5, when patched with Security Update 2006-001, allows remote attackers to execute arbitrary code via a long Real Name value in an e-mail attachment sent in AppleDouble format, which triggers the overflow when the user double-clicks on an attachment.
CVSS v2.0: 5.1
CVE-2008-3826: Unspecified vulnerability in Condor before 7.0.5 allows attackers to execute jobs as other users via unknown vectors.
CVSS v2.0: 4.6
GHSA-xprp-4qjc-gqwc: Security keys are logged when any WCDMA call is configured or reconfigured in snapdragon automobile, snapdragon mobile and snapdragon wear in versions MDM9607, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SDA660, SDX20, SXR1130
CVSS v3.0: 5.5
CVE-2024-26036: Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS v3.1: 5.4
GHSA-g988-pqhg-r7m5: Cross Site Scripting vulnerability in WPEVEREST Everest Forms before 3.0.9 allows an attacker to execute arbitrary code via a file upload.
CVSS v3.1: 6.1
CVE-2012-3005: Untrusted search path vulnerability in Invensys Wonderware InTouch 2012 and earlier, as used in Wonderware Application Server, Wonderware Information Server, Foxboro Control Software, InFusion CE/FE/SCADA, InBatch, and Wonderware Historian, allows local users to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS v2.0: 6.9
GHSA-483f-3c23-9fjm: SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to SQL Injection in the file /scheduler/admin/appointments/view_details.php.
CVSS v3.1: 2.7
CVE-2018-1000144: A cross site scripting vulnerability exists in Jenkins Cucumber Living Documentation Plugin 1.0.12 and older in CukedoctorBaseAction#doDynamic that disables the Content-Security-Policy protection for archived artifacts and workspace files, allowing attackers able to control the content of these files to attack Jenkins users.
CVSS v3.0: 6.1
CVSS v2.0: 4.3