ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-4crj-f4f5-7mhf: A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 HF1). Affected applications are vulnerable to command injection due to missing server side input sanitation when loading VxLAN configurations. This could allow an authenticated attacker to execute arbitrary code with root privileges.
CVSS v4.0: 8.7
CVSS v3.1: 8.8
GHSA-2r55-58m5-vgxw: MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not perform proper authorization checks on multiple API functions. An attacker may gain access to these functions and achieve remote code execution, create a denial-of-service condition, and obtain sensitive information.
GHSA-rfmm-g5c2-8j5v: In Bluetooth, there is a possible out of bounds read due to uninitialized data. This could lead to remote information disclosure, with no additional privileges required. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-112917952
GHSA-c7m2-p727-p675: In HDF5 1.10.1, there is an out of bounds write vulnerability in the function H5G__ent_decode_vec in H5Gcache.c in libhdf5.a. For example, h5dump would crash or possibly have unspecified other impact someone opens a crafted hdf5 file.
CVSS v3.0: 8.8
GHSA-v57f-x3f4-782f: Incorrect handling of stylesheets leading to a use after free in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS v3.0: 8.8
GHSA-w2q8-6j3f-ccxf: A PHP injection vulnerability in Spip before v3.2.8 allows attackers to execute arbitrary PHP code via the _oups parameter at /ecrire.
CVSS v3.1: 8.8
CVE-2019-11451: whatsns 4.0 allows index.php?inform/add.html qid SQL injection.
CVSS v3.0: 7.2
CVSS v2.0: 6.5
CVE-2024-6968: SourceCodester Clinics Patient Management System print_patients_visits.php sql injection
A vulnerability was found in SourceCodester Clinics Patient Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /print_patients_visits.php. The manipulation of the argument from/to leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-272122 is the identifier assigned to this vulnerability.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
CVE-2018-20027: The yaml_parse.load method in Pylearn2 allows code injection.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
CVE-2019-25364: Win10 MailCarrier 2.51 - 'POP3 User' Remote Buffer Overflow
MailCarrier 2.51 contains a buffer overflow vulnerability in the POP3 USER command that allows remote attackers to execute arbitrary code. Attackers can send a crafted oversized buffer to the POP3 service, overwriting memory and potentially gaining remote system access.
CVSS v4.0: 9.3
CVSS v3.1: 9.8
CVE-2021-36809: A local attacker can overwrite arbitrary files on the system with VPN client logs using administrator privileges, potentially resulting in a denial of service and data loss, in all versions of Sophos SSL VPN client.
CVSS v3.1: 6.1
GHSA-2h2w-vccm-6fx5: Vulnerability that cards can call unauthorized APIs in the FRS process
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS v3.1: 4.4
GHSA-5hjj-v36v-jxwp: In SumCompoundHorizontalTaps of convolve_neon.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-147491773
GHSA-pgg7-9g7g-jg57: In the Linux kernel, the following vulnerability has been resolved:net: lan743x: Fix memleak issue when GSO enabledAlways map the `skb` to the LS descriptor. Previously skb was
mapped to EXT descriptor when the number of fragments is zero with
GSO enabled. Mapping the skb to EXT descriptor prevents it from
being freed, leading to a memory leak
CVSS v3.1: 5.5
CVE-2023-6660: NFS client data corruption and kernel memory disclosure
When a program running on an affected system appends data to a file via an NFS client mount, the bug can cause the NFS client to fail to copy in the data to be written but proceed as though the copy operation had succeeded.  This means that the data to be written is instead replaced with whatever data had been in the packet buffer previously.  Thus, an unprivileged user with access to an affected system may abuse the bug to trigger disclosure of sensitive information.  In particular, the leak is limited to data previously stored in mbufs, which are used for network transmission and reception, and for certain types of inter-process communication.

The bug can also be triggered unintentionally by system applications, in which case the data written by the application to an NFS mount may be corrupted.  Corrupted data is written over the network to the NFS server, and thus also susceptible to being snooped by other hosts on the network.

Note that the bug exists only in the NFS client; the version and implementation of the server has no effect on whether a given system is affected by the problem.
CVSS v3.1: 6.5
GHSA-f89j-4hpj-5qjm: An issue was discovered in Zimbra Collaboration (ZCS) 9.0.0 before Patch 43, 10.0.x before 10.0.12, 10.1.x before 10.1.4, and 8.8.15 before Patch 47. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI allows attackers to execute arbitrary JavaScript within the victim's session, potentially leading to unauthorized access to sensitive information. This issue arises from insufficient sanitization of HTML content, including malformed <img> tags with embedded JavaScript. The vulnerability is triggered when the victim views a specially crafted email in the Classic UI, causing the malicious script to execute. No further user interaction is required beyond viewing the email.
CVSS v3.1: 6.1
GHSA-x5px-6hfx-3338: The Jumio SDK before 1.5.0 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function.
CVSS v3.0: 9.8
GHSA-h73q-hjm3-vwgm: Integer overflow in Adobe Flash Player before 10.3.181.14 on Windows, Mac OS X, Linux, and Solaris and before 10.3.185.21 on Android allows attackers to execute arbitrary code via unspecified vectors.
GHSA-gv42-v83p-3gw3: An attacker may obtain the user credentials from the communication between the PLC and the software. As a result, the PLC user program may be uploaded, altered, and/or downloaded.
GHSA-29gh-3cpv-qpjp: Check Point Endpoint Security Client E83 through E86 before E86.50 does not protect against a specific registry modification, and thus allows a local administrator to disable endpoint protection.
CVSS v3.1: 2.3
GHSA-2mfg-cc43-9pcj: LangChain4j: SQL injection via metadata filters in langchain4j-mariadb and langchain4j-pgvector
SummaryThe MariaDB and pgvector embedding stores build metadata-filter SQL by string-concatenating
filter **keys** (and, in MariaDB, string **values**) directly into the query without adequate
escaping. A crafted metadata key in `EmbeddingSearchRequest.filter()` can break out of its SQL
context and inject arbitrary SQL into the statements executed by the stores' search and
`removeAll(Filter)` operations.Details**pgvector — JSON mode (default, `COMBINED_JSON` / `COMBINED_JSONB`).** `JSONFilterMapper`
places the key inside a single-quoted SQL literal (the JSON key of the `->>` operator) with no
escaping:A key containing a single quote breaks out, e.g.
`metadataKey("')::text IS NOT NULL OR pg_sleep(1) IS NOT NULL --")` injects a live `pg_sleep(1)`
(observable as a delay; exploitable for blind data extraction).**pgvector — column mode (`COLUMN_PER_KEY`).** `ColumnFilterMapper` used the key as a bare,
unquoted, unvalidated SQL identifier (`<key>::<type>`), so a key such as `1=1 OR true --`
injects directly.**MariaDB — JSON mode (default).** `JSONFilterMapper` placed the key inside the JSON path literal
`'$.<key>'` unescaped (same break-out mechanism). Additionally, `MariaDbFilterMapper.formatValue()`
escaped `'` but not `\`; because MariaDB treats backslash as an escape character by default, a
string value ending in a backslash could also break out of its literal.**MariaDB — column mode (`COLUMN_PER_KEY`).** `ColumnFilterMapper` fell back to the raw,
unescaped key when the driver could not quote it as an identifier (e.g. a
character).The filter key is the runtime injection surface; both stores' `search()` (including pgvector's
HYBRID mode) and `removeAll(Filter)` are affected. Add/upsert operations a
parameterized and not affected.ImpactApplications that allow attacker-influenced metadata filter keys (e.g. use
LLM-generated filters) to reach these stores are exposed to SQL injection: blind data
exfiltration, denial of service via sleep functions, and — through `remove
deletion of arbitrary rows. Applications using only hard-coded, developer-defined filter keys
are not reachable.PatchesFixed in `langchain4j-mariadb` and `langchain4j-pgvector` 1.16.3-beta26:JSON filter keys are escaped before being embedded in the SQL string lit
quotes doubled, correct for PostgreSQL `standard_conforming_strings = on`; MariaDB: backslash
and single quote).MariaDB string values escape both `\` and `'`.Column-mode keys are validated/quoted as identifiers and rejected when u
concatenated as raw SQL.WorkaroundsDo not pass untrusted input as metadata filter keys.Restrict filter keys to a known allow-list at the application layer.Referencespgvector: `JSONFilterMapper`, `ColumnFilterMapper`MariaDB: `JSONFilterMapper`, `MariaDbFilterMapper`, `ColumnFilterMapper`
CVSS v3.1: 7.6
CVE-2015-6771: js/array.js in Google V8, as used in Google Chrome before 47.0.2526.73, improperly implements certain map and filter operations for arrays, which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via crafted JavaScript code.
CVSS v2.0: 7.5
GHSA-hqvj-xwvm-6vr9: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Josh Kohlbach WooCommerce Store Toolkit woocommerce-store-toolkit allows PHP Local File Inclusion.This issue affects WooCommerce Store Toolkit: from n/a through <= 2.4.3.
CVSS v3.1: 7.5
GHSA-hm8q-7f3q-5f36: Hono has improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()
SummaryImproper validation of the JWT NumericDate claims `exp`, `nbf`, and `iat` in `hono/utils/jwt` allows tokens with non-spec-compliant claim values to silently bypass time-based checks. This issue is not exploitable by an anonymous attacker; it only manifests when a malformed claim value reaches `verify()` — typically when the application itself issues such tokens, or when the signing key is otherwise under attacker control.DetailsThe validation routine combined option, presence, and threshold checks in a single short-circuiting expression, so several classes of malformed values were silently skipped instead of rejected:A falsy numeric value short-circuited the presence check.A non-finite numeric value compared as never-after-now and never-expired.A non-numeric type produced NaN comparisons that evaluated false.This deviates from RFC 7519 §4.1.4, which defines NumericDate as a finite JSON numeric value.ImpactAn actor able to issue tokens accepted by the application may craft tokens whose `exp`, `nbf`, or `iat` claims silently bypass time-based enforcement. This may lead to:Tokens treated as never expiring even with `exp` configured on the verifier.Tokens with a future `nbf` accepted as currently valid.Tokens with a future `iat` accepted as legitimately issued.Deployments using a well-formed token issuer and protecting the signing key are not affected.
CVSS v3.1: 3.8
CVE-2025-63563: Summer Pearl Group Vacation Rental Management Platform prior to v1.0.2 does not properly invalidate active user sessions after a password change. This allows an attacker with a valid session token to maintain access to the account even after the legitimate user changes their password.
CVSS v3.1: 6.5
GHSA-r77c-2cmr-7p47: OpenClaw: Delivery queue recovery could lose group tool-policy context for media replay
SummaryDelivery queue recovery could lose group tool-policy context for media replay.Affected Packages / VersionsPackage: `openclaw`Ecosystem: npmAffected versions: `>= 2026.4.10 < 2026.4.14`Patched versions: `>= 2026.4.14`ImpactRecovered queued outbound media could be replayed without the original session context needed to enforce group tool policy, weakening channel media restrictions after restart/recovery.Technical DetailsThe fix persists and replays the relevant session context with delivery queue entries so recovered media dispatch goes through the same policy checks.FixThe issue was fixed in #66025. The first stable tag containing the fix is `v2026.4.14`, and `openclaw@2026.4.14` includes the fix.Fix Commit(s)`48aae82bbc19ba8b0741e61a08063eb0d1df464e`PR: #66025Release Process NoteUsers should upgrade to `openclaw` 2026.4.14 or newer. The latest npm release, `2026.4.14`, already includes the fix.CreditsThanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.
CVSS v4.0: 2.3
CVE-2025-31895: WordPress ABC Notation Plugin <= 6.1.3 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in paulrosen ABC Notation abc-notation allows Stored XSS.This issue affects ABC Notation: from n/a through <= 6.1.3.
CVSS v3.1: 6.5
GHSA-v825-xf9m-8r5w: A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/power-ports/add/.
CVSS v3.1: 6.1
CVE-2025-11511: code-projects E-Commerce Website supplier_add.php sql injection
A flaw has been found in code-projects E-Commerce Website 1.0. Affected is an unknown function of the file /pages/supplier_add.php. Executing manipulation of the argument supp_email can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
CVE-2004-1967: Cross-site request forgery (CSRF) vulnerabilities in (1) cp_forums.php, (2) cp_usergroup.php, (3) cp_ipbans.php, (4) myhome.php, (5) post.php, or (6) moderator.php in Open Bulletin Board (OpenBB) 1.0.6 and earlier allow remote attackers to execute arbitrary code by including the code in an image tag or a link.
CVSS v3.1: 8.8
CVSS v2.0: 7.5
GHSA-fwc5-p288-h6cv: An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in tvOS 15.4, iOS 15.4 and iPadOS 15.4, macOS Big Sur 11.6.5, Security Update 2022-003 Catalina, watchOS 8.5, macOS Monterey 12.3. An application may be able to execute arbitrary code with kernel privileges.
CVSS v3.1: 7.8
CVE-2026-58457: Shenzhen Aitemi M300 MT02 Unauthenticated OS Command Injection via protocol.csp
Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) contains an unauthenticated OS command injection vulnerability that allows network-adjacent attackers to execute arbitrary shell commands by injecting unsanitized input through the smacfilter_conf handler in the commuos web backend. Attackers can append semicolon-delimited payloads to the name, enable, or mac GET parameters, which are passed without sanitization into sprintf() to build uci shell commands executed via doSystemCmdComlib(), granting full root-level control of the device.
CVSS v4.0: 9.3
CVSS v3.1: 9.8
GHSA-crcr-jcjm-54w8: During URL parsing, a maliciously crafted URL can cause a potentially exploitable crash. This vulnerability affects Firefox < 50.
CVSS v3.0: 6.5
CVE-2022-24931: Improper access control vulnerability in dynamic receiver in ApkInstaller prior to SMR MAR-2022 Release allows unauthorized attackers to execute arbitrary activity without a proper permission
CVSS v3.1: 7.9
GHSA-2hr5-6qwp-r4jj: vBulletin before 5.5.4 allows clickjacking.
CVSS v3.1: 4.3
GHSA-jj9h-68w9-rr33: Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyGetAppEdition race condition that can cause a stack-based buffer overflow or an out-of-bounds read.
CVE-2022-3768: WPSmartContracts < 1.3.12 - Author+ SQLi
The WPSmartContracts WordPress plugin before 1.3.12 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as author
CVSS v3.1: 8.8
GHSA-f6mq-9vj5-5r82: Accessing, modifying, or executing executable files vulnerability in Microsoft Windows client in McAfee Application and Change Control (MACC) 8.0.0 Hotfix 4 and earlier allows authenticated users to execute arbitrary code via file transfer from external system.
CVSS v3.0: 7.1
CVE-2026-31940: Session Fixation in Chamilo LMS
Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, in main/lp/aicc_hacp.php, user-controlled request parameters are directly used to set the PHP session ID before loading global bootstrap. This leads to session fixation. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.
CVSS v3.1: 7.5
CVE-2026-8976: RSS Aggregator by Feedzy <= 5.1.7 - Missing Authorization to Authenticated (Contributor+) Import Job Creation, Execution, Purge, Log Clearing, and Information Disclosure via Multiple AJAX Sub-Actions
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.1.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to create and execute RSS import jobs, purge (force-delete) all posts associated with any import job, clear import error logs, and enumerate taxonomy terms and post meta_key names. The nonce required to reach these sub-handlers is leaked to any user with the edit_posts capability via the feedzyjs localized script injected into the block editor, meaning no privileged nonce theft or separate exploit step is required for Contributor-level users.
CVSS v3.1: 4.3
RHSA-2023:5198: Red Hat Security Advisory: firefox security update
libwebp: Heap buffer overflow in WebP Codec libwebp: out-of-bounds write with a specially crafted WebP lossless file
CVSS v3.1: 0
CVE-2024-53755: WordPress  Third Party Cookie Eraser plugin <= 1.0.2 - CSRF to Cross Site Scripting (XSS) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Andrea Pernici Third Party Cookie Eraser third-party-cookie-eraser allows Stored XSS.This issue affects Third Party Cookie Eraser: from n/a through <= 1.0.2.
CVSS v3.1: 7.1
CVE-2024-31464: XWiki Platform: Password hash might be leaked by diff once the xobject holding them is deleted
XWiki Platform is a generic wiki platform. Starting in version 5.0-rc-1 and prior to versions 14.10.19, 15.5.4, and 15.9-rc-1, it is possible to access the hash of a password by using the diff feature of the history whenever the object storing the password is deleted. Using that vulnerability it's possible for an attacker to have access to the hash password of a user if they have rights to edit the users' page.  With the default right scheme in XWiki this vulnerability is normally prevented on user profiles, except by users with Admin rights. Note that this vulnerability also impacts any extensions that might use passwords stored in xobjects: for those usecases it depends on the right of those pages. There is currently no way to be 100% sure that this vulnerability has been exploited, as an attacker with enough privilege could have deleted the revision where the xobject was deleted after rolling-back the deletion. But again, this operation requires high privileges on the target page (Admin right). A page with a user password xobject which have in its history a revision where the object has been deleted should be considered at risk and the password should be changed there. a diff, to ensure it's not coming from a password field. As another mitigation, admins should ensure that the user pages are properly protected: the edit right shouldn't be allowed for other users than Admin and owner of the profile (which is the default right). There is not much workaround possible for a privileged user other than upgrading XWiki.
CVSS v3.1: 6.8
GHSA-35fm-pgcc-7jwh: The DownloadLoop function in main.c for greed 0.81p allows remote attackers to execute arbitrary code via a GRX file containing a filename with shell metacharacters.
GHSA-2jp2-2mm5-5h78: A flaw has been found in Edimax BR-6675nD 1.12. Affected by this issue is the function formPPTPSetup of the file /goform/formPPTPSetup of the component POST Request Handler. Executing a manipulation of the argument pptpUserName can lead to buffer overflow. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 7.4
CVSS v3.1: 8.8
CVE-2025-68919: Fujitsu / Fsas Technologies ETERNUS SF ACM/SC/Express (DX / AF Management Software) before 16.8-16.9.1 PA 2025-12, when collected maintenance data is accessible by a principal/authority other than ETERNUS SF Admin, allows an attacker to potentially affect system confidentiality, integrity, and availability.
CVSS v3.1: 5.6
CVE-2022-31212: An issue was discovered in dbus-broker before 31. It depends on c-uitl/c-shquote to parse the DBus service's Exec line. c-shquote contains a stack-based buffer over-read if a malicious Exec line is supplied.
CVSS v3.1: 7.5
GHSA-h743-8964-67h5: Multiple stack-based buffer overflows in the Cisco WebEx Recording Format (WRF) and Advanced Recording Format (ARF) Players T27LB before SP21 EP3 and T27LC before SP22 allow remote attackers to execute arbitrary code via a crafted (1) .wrf or (2) .arf file, related to use of a function pointer in a callback mechanism.
GHSA-f6hf-q5rw-f57w: The web management console of CheckMK Raw Edition (versions 1.5.0 to 1.6.0) allows a misconfiguration of the web-app Dokuwiki (installed by default), which allows embedded php code. As a result, remote code execution is achieved. Successful exploitation requires access to the web management interface, either with valid credentials or with a hijacked session by a user with the role of administrator.
CVSS v3.1: 8.8
CVE-2023-45687: Authentication bypass via session fixation in Titan MFT and Titan SFTP servers
A session fixation vulnerability in South River Technologies' Titan MFT and Titan SFTP servers on Linux and Windows allows an attacker to bypass the server's authentication if they can trick an administrator into authorizating a session id of their choosing
CVSS v3.1: 8.8
GHSA-g974-hxvm-x689: node-gettext vulnerable to Prototype Pollution
All versions of the package node-gettext are vulnerable to Prototype Pollution via the addTranslations() function in gettext.js due to improper user input sanitization.
CVSS v4.0: 8.2
CVSS v3.1: 5.9
CVE-2026-22477: WordPress Felizia theme <= 1.3.4 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Felizia felizia allows PHP Local File Inclusion.This issue affects Felizia: from n/a through <= 1.3.4.
CVSS v3.1: 8.1
GHSA-8ggf-rh55-625w: Rockliffe MailSite Express before 6.1.22, with the option to save login information enabled, saves user passwords in plaintext in cookies, which allows local users to obtain passwords by reading the cookie file, or remote attackers to obtain the cookies via cross-site scripting (XSS) vulnerabilities.