ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-5rmp-977f-x986: Stack overflow vulnerability in Avast Antivirus when scanning a malformed Office Open XML file may allow Denial-of-Service of the antivirus process.This issue affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for virus definition builds before VPS 25020100.The affected scanning logic is delivered through a shared Gen Digital virus definition update stream. The same stream feeds the consumer antivirus products listed in this advisory and other Gen Digital products that embed the same engine. Mitigation flows through this update channel; installations at or above the listed build are not vulnerable regardless of which product consumes the stream.
CVSS v3.1: 5.5
CVE-2020-27969: Yandex Browser for Android 20.8.4 allows remote attackers to perform SOP bypass and addresss bar spoofing
CVSS v3.1: 7.3
CVSS v2.0: 7.5
GHSA-p768-9j7f-q2v5: Stack-based buffer overflow in VCDGear 3.55 and 3.56 BETA allows user-assisted remote attackers to execute arbitrary code via a long FILE argument in a CUE file.
GHSA-747x-5m58-mq97: svix vulnerable to Authentication Bypass
Versions of the package svix before 1.17.0 are vulnerable to Authentication Bypass due to an issue in the verify function where signatures of different lengths are incorrectly compared. An attacker can bypass signature verification by providing a shorter signature that matches the beginning of the actual signature.**Note:**The attacker would need to know a victim uses the Rust library for verification,no easy way to automatically check that; and uses webhooks by a service that uses Svix, and then figure out a way to craft a malicious payload that will actually include all of the correct identifiers needed to trick the receivers to cause actual issues.
CVSS v3.1: 6.8
CVE-2018-6412: In the function sbusfb_ioctl_helper() in drivers/video/fbdev/sbuslib.c in the Linux kernel through 4.15, an integer signedness error allows arbitrary information leakage for the FBIOPUTCMAP_SPARC and FBIOGETCMAP_SPARC commands.
CVSS v3.0: 7.5
CVSS v2.0: 5
CVE-2025-2184: Cortex XDR Broker VM: Secrets Shared Across Multiple Broker VM Images
A credential management flaw in Palo Alto Networks Cortex XDR® Broker VM causes different Broker VM images to share identical default credentials for internal services. Users knowing these default credentials could access internal services on other Broker VM installations.

The attacker must have network access to the Broker VM to exploit this issue.
CVSS v4.0: 5.3
GHSA-r458-gcmr-cw5r: OpenLDAP 1.2.11 and earlier improperly installs the ud binary with group write permissions, which could allow any user in that group to replace the binary with a Trojan horse.
CVE-2026-0700: code-projects Intern Membership Management System check_admin.php sql injection
A vulnerability was determined in code-projects Intern Membership Management System 1.0. Affected is an unknown function of the file /intern/admin/check_admin.php. Executing a manipulation of the argument Username can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.
CVSS v4.0: 6.9
CVSS v3.1: 7.3
CVSS v3.0: 7.3
CVSS v2.0: 7.5
GHSA-vf2g-hrph-mrjc: , aka 'Microsoft Excel Security Feature Bypass Vulnerability'.
CVSS v3.1: 6.5
CVE-2020-10146: Microsoft Teams displayName stored cross-site scripting vulnerability
The Microsoft Teams online service contains a stored cross-site scripting vulnerability in the displayName parameter that can be exploited on Teams clients to obtain sensitive information such as authentication tokens and to possibly execute arbitrary commands. This vulnerability was fixed for all Teams users in the online service on or around October 2020.
CVSS v3.1: 5.7
CVE-2025-3063: Shopper Approved Reviews 2.0 - 2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
The Shopper Approved Reviews plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the ajax_callback_update_sa_option() function in versions 2.0 to 2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
CVSS v3.1: 8.8
GHSA-fxq3-4vfx-993f: Improper neutralization of argument delimiters in a command ('Argument Injection') vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS version ’05.65.00.BD’ and earlier, GT1450-QMBDE CoreOS version ’05.65.00.BD’ and earlier, GT1450-QLBDE CoreOS version ’05.65.00.BD’ and earlier, GT1455HS-QTBDE CoreOS version ’05.65.00.BD’ and earlier, and GT1450HS-QMBDE CoreOS version ’05.65.00.BD’ and earlier) allows unauthenticated attackers on adjacent network to stop the network functions of the products via a specially crafted packet.
CVE-2009-2882: Multiple cross-site scripting (XSS) vulnerabilities in PG MatchMaking allow remote attackers to inject arbitrary web script or HTML via the show parameter to (1) browse_ladies.php and (2) browse_men.php, the (3) gender parameter to search.php, and the (4) id parameter to services.php.
CVSS v2.0: 4.3
CVE-2025-22818: WordPress S3Player plugin <= 4.2.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in S3Bubble S3Player – WooCommerce & Elementor Integration drm-protected-video-streaming allows Stored XSS.This issue affects S3Player – WooCommerce & Elementor Integration: from n/a through <= 4.2.1.
CVSS v3.1: 6.5
GHSA-j56h-v988-6xx4: An issue was discovered in swftools through 20200710. A heap-buffer-overflow exists in the function swf_DumpActions() located in swfaction.c. It allows an attacker to cause code Execution.
ICSA-26-111-11: Siemens Industrial Edge Management
Affected management systems do not properly enforce user authentication on remote connections to devices.
This could facilitate an unauthenticated remote attacker to circumvent authentication and impersonate a legitimate user.
Successful exploitation requires that the attacker has identified the header and port used for remote connections to devices and that the remote connection feature is enabled for the device.

Exploitation allows the attacker to tunnel to the device. Security features on this device itself (e.g. app specific authentication) are not affected.
CVSS v3.1: 7.1
GHSA-vv37-5fmc-w362: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore Core et-core-plugin allows DOM-Based XSS.This issue affects XStore Core: from n/a through < 5.7.
CVSS v3.1: 6.5
GHSA-c6f5-vg46-h8r2: D-Link DI-8300 v16.07.26A1 is vulnerable to command injection via the upgrade_filter_asp function.
CVSS v3.1: 9.8
cisco-sa-vmanage-file-Y2JSRNRb: Cisco SD-WAN vManage Software Arbitrary File Creation Vulnerability
A vulnerability in the application data endpoints of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to write arbitrary files to an affected system.

The vulnerability is due to improper validation of requests to APIs. An attacker could exploit this vulnerability by sending malicious requests to an API within the affected application. A successful exploit could allow the attacker to conduct directory traversal attacks and write files to an arbitrary location on the targeted system.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanage-file-Y2JSRNRb ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanage-file-Y2JSRNRb"]
CVSS v3.1: 6.5
GHSA-pphr-vx2j-3836: An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. Heap-based buffer overflow in the addMultirowsForm function in w3m allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted HTML page.
CVSS v3.0: 8.8
GHSA-cm8f-h6j3-p25c: Pion DTLS Header reconstruction method can be thrown into an infinite loop
ImpactAn attacker can send packets that will send Pion DTLS into an infinite loop when processing.PatchesUpgrade to Pion DTLS v2.1.4WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.4ReferencesThank you to [Juho Nurminen](https://github.com/jupenur) and the Mattermost team for discovering and reporting this.For more informationIf you have any questions or comments about this advisory:Open an issue in [Pion DTLS](http://github.com/pion/dtls)Email us at [team@pion.ly](mailto:team@pion.ly)
CVSS v3.1: 7.5
CVE-2026-55069: Kestra BasicAuth Password Stored as SHA-512 Enables Offline Brute-Force Attack
Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, this vulnerability exists in the BasicAuth authentication component of the Kestra OSS workflow orchestration platform. An attacker who gains read access to the PostgreSQL database can exploit SHA-512's high computation speed to recover the administrator password offline. In Kubernetes deployments, a successful crack further enables reading of the cluster ServiceAccount Token and all K8s Secrets, achieving vertical privilege escalation. This vulnerability is fixed in 1.3.24.
CVSS v3.1: 8.7
RHSA-2024:0337: Red Hat Security Advisory: RHACS 4.2 security update
postgresql: Memory disclosure in aggregate function calls postgresql: Buffer overrun from integer overflow in array modification postgresql: Role pg_signal_backend can signal certain superuser processes. postgresql: extension script @substitutions@ within quoting allow SQL injection
CVSS v3.1: 7.5
GHSA-gc74-7wpx-43ch: Accellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header in a request to document_root.html. The fixed version is FTA_9_12_380 and later.
CVSS v3.1: 9.8
ICSA-21-350-08: Siemens JTTK and JT Utilities
JTTK library in affected products contains an out of bounds write past the end of an allocated structure while parsing specially crafted JT files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-14828, ZDI-CAN-14898) JTTK library in affected products contains a use-after-free vulnerability that could be triggered while parsing specially crafted JT files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-14911) JTTK library in affected products is vulnerable to an out of bounds read past the end of an allocated buffer when parsing JT files. An attacker could leverage this vulnerability to leak information in the context of the current process. (ZDI-CAN-14843, ZDI-CAN-15051)
CVSS v3.1: 3.3
CVE-2006-5184: SQL injection vulnerability in PKR Internet Taskjitsu before 2.0.6 allows remote attackers to execute arbitrary SQL commands via the key parameter, when the limit query parameter is set to customerid.
CVSS v2.0: 7.5
GHSA-cx54-wxpv-wvvj: The DCTStream::readHuffSym function in Stream.cc in the DCT decoder in xpdf before 4.00 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted JPEG data.
CVSS v3.0: 7.8
CVE-2025-14581: HAPPY – Helpdesk Support Ticket System <= 1.0.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Ticket Reply
The HAPPY – Helpdesk Support Ticket System plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the 'submit_form_reply' AJAX action in all versions up to, and including, 1.0.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to submit replies to arbitrary support tickets by manipulating the 'happy_topic_id' parameter, regardless of whether they are the ticket owner or have been assigned to the ticket.
CVSS v3.1: 4.3
GHSA-3m9m-24vh-39wx: Server-Side Request Forgery (SSRF) in Craft CMS with Asset Uploads Mutations
Required PermissionsThe exploitation requires a few permissions to be enabled in the used GraphQL schema:"Edit assets in the <VolumeName> volume""Create assets in the <VolumeName> volume"DetailsThe implementation fails to restrict the URL Scheme. While the application is intended to "upload assets", there is no whitelist forcing `http` or `https`. This allows attackers to use the Gopher protocol to wrap raw TCP commands.**Impact:** Combined with the DWORD bypass, an attacker can hit internal services without triggering any "127.0.0.1" string-matching filters.**Example Payload:** gopher://2130706433:6379/_FLUSHALL (Targets local Redis via DWORD).**Remediation Strategy**To prevent mathematical IP obfuscation, the application must normalize the hostname before validation.
CVSS v4.0: 5.5
CVE-2020-14189: The execute function in in the Atlassian gajira-comment GitHub Action before version 2.0.2 allows remote attackers to execute arbitrary code in the context of a GitHub runner by creating a specially crafted GitHub issue comment.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2016-9966: Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L(5.0/5.1), M(6.0), and N(7.0) software allows attackers to crash the system easily resulting in a possible DoS attack, or possibly gain privileges. The Samsung ID is SVE-2016-7120.
CVSS v3.0: 9.8
CVSS v2.0: 10
CVE-2009-3901: Multiple cross-site scripting (XSS) vulnerabilities in e-Courier CMS allow remote attackers to inject arbitrary web script or HTML via the UserGUID parameter to home/index.asp and other unspecified vectors.
CVSS v2.0: 4.3
GHSA-r2pw-9cxh-m8mr: Improper access control in the ticketing integration settings in Devolutions Server allows an authenticated low-privileged user to obtain cleartext credentials for configured ticketing integrations via a crafted API request.This issue affects :Devolutions Server 2026.2.4.0Devolutions Server 2026.1.20.0 and earlier
CVSS v3.1: 6.5
GHSA-3wqh-cc4x-r6p5: The PDF Flipbook, 3D Flipbook—DearFlip plugin for WordPress is vulnerable to Stored Cross-Site Scripting via outline settings in all versions up to 2.3.52 due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
CVE-2022-35473: OTFCC v0.10.4 was discovered to contain a segmentation violation via /release-x64/otfccdump+0x4fe9a7.
CVSS v3.1: 6.5
CVE-2022-22478: IBM Spectrum Protect Client 8.1.0.0 through 8.1.14.0 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 225886.
CVSS v3.0: 6.2
CVE-2025-54167: Notification Center
A cross-site scripting (XSS) vulnerability has been reported to affect Notification Center. If a remote attacker gains an administrator account, they can then exploit the vulnerability to bypass security mechanisms or read application data.

We have already fixed the vulnerability in the following versions:
Notification Center 2.1.0.3443 and later
Notification Center 1.9.2.3163 and later
Notification Center 3.0.0.3466 and later
CVSS v4.0: 7.2
CVE-2023-40367: IBM QRadar SIEM cross-site scripting
IBM QRadar SIEM 7.5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  263376.
CVSS v3.1: 5.4
CVE-2016-1045: Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1046, CVE-2016-1047, CVE-2016-1048, CVE-2016-1049, CVE-2016-1050, CVE-2016-1051, CVE-2016-1052, CVE-2016-1053, CVE-2016-1054, CVE-2016-1055, CVE-2016-1056, CVE-2016-1057, CVE-2016-1058, CVE-2016-1059, CVE-2016-1060, CVE-2016-1061, CVE-2016-1065, CVE-2016-1066, CVE-2016-1067, CVE-2016-1068, CVE-2016-1069, CVE-2016-1070, CVE-2016-1075, CVE-2016-1094, CVE-2016-1121, CVE-2016-1122, CVE-2016-4102, and CVE-2016-4107.
CVSS v3.0: 9.8
CVSS v2.0: 10
GHSA-h6xj-m6v2-x4v6: Tenda AC9 V15.03.05.19 was discovered to contain a stack overflow via the deviceList parameter at /goform/setMacFilterCfg.
CVSS v3.1: 8.8
GHSA-mm2w-vmg6-v772: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H).
CVSS v3.0: 5.5
GHSA-c95f-chrx-p6r4: Multiple cross-site scripting (XSS) vulnerabilities in the Varnish module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.0-beta2 for Drupal allow remote attackers to inject arbitrary web script or HTML via crafted a (1) Watchdog message or (2) admin setting.
CVE-2024-32930: In plugin_ipc_handler of slc_plugin.c, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure of 4 bytes of stack memory with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1: 5.5
GHSA-67xc-v9f5-rp5h: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.4.1.16828. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the deleteItemAt method when processing AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8295.
CVSS v3.1: 7.8
CVE-2015-3052: Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-9161, CVE-2015-3046, CVE-2015-3049, CVE-2015-3050, CVE-2015-3051, CVE-2015-3056, CVE-2015-3057, CVE-2015-3070, and CVE-2015-3076.
CVSS v2.0: 10
GHSA-rmq9-mr3c-m5p6: An MS-MPC or MS-MIC Service PIC may crash when large fragmented packets are passed through an Application Layer Gateway (ALG). Repeated crashes of the Service PC can result in an extended denial of service condition. The issue can be seen only if NAT or stateful-firewall rules are configured with ALGs enabled. This issue was caused by the code change for PR 1182910 in Junos OS 14.1X55-D30, 14.1X55-D35, 14.2R7, 15.1R5, and 16.1R2. No other versions of Junos OS and no other Juniper Networks products or platforms are affected by this issue. Affected releases are Juniper Networks Junos OS on MX platforms running: 14.1X55 from 14.1X55-D30 to releases prior to 14.1X55-D35; 14.2R from 14.2R7 to releases prior to 14.2R7-S4, 14.2R8; 15.1R from 15.1R5 to releases prior to 15.1R5-S2, 15.1R6; 16.1R from 16.1R2 to releases prior to 16.1R3-S2, 16.1R4.
CVSS v3.0: 5.9
CVE-2021-20844: Improper neutralization of HTTP request headers for scripting syntax vulnerability in the Web GUI of RTX830 Rev.15.02.17 and earlier, NVR510 Rev.15.01.18 and earlier, NVR700W Rev.15.00.19 and earlier, and RTX1210 Rev.14.01.38 and earlier allows a remote authenticated attacker to obtain sensitive information via a specially crafted web page.
CVSS v3.1: 5.7
CVSS v2.0: 3.5
CVE-2012-1181: fcgid_spawn_ctl.c in the mod_fcgid module 2.3.6 for the Apache HTTP Server does not recognize the FcgidMaxProcessesPerClass directive for a virtual host, which makes it easier for remote attackers to cause a denial of service (memory consumption) via a series of HTTP requests that triggers a process count higher than the intended limit.
CVSS v2.0: 5
GHSA-2m67-cxxq-c3h8: ZeptoClaw: Path boundary checks bypass via symlink, TOCTOU, and hardlink
SummaryWorkspace boundary enforcement currently has three related bypass risks. This issue tracks fixing all three in one pull request.DetailsR1 - Dangling Symlink Component BypassWhat happens: Path validation can miss dangling symlink components during traversal checks.Why it matters: A symlink that is unresolved at validation time can later resolve to an external location.Impact: Read and write operations may escape workspace boundaries.Affected area: src/security/path.rs (check_symlink_escape).R2 - TOCTOU Between Validation and UseWhat happens: The path is validated first, then used later for filesystem operations.Why it matters: A concurrent filesystem change can swap path components after validation but before open/write.Impact: Race-based workspace escape is possible.Affected area: Filesystem and file-consuming tools that call validate_path_in_workspace before I/O.R3 - Hardlink Alias BypassWhat happens: A file inside workspace can be a hardlink to an inode outside the intended workspace trust boundary.Why it matters: Prefix and symlink checks can pass while data access still mutates or reads external content.Impact: Policy bypass for read/write operations.Affected area: Any tool that reads or writes via validated paths.Risk Matrix| ID | Risk | Severity | Likelihood | Impact |
|---|---|---|---|---|
| R1 | Dangling symlink component bypass | High | Medium | Workspace boundary escape for read/write |
| R2 | Validate/use TOCTOU race | High | Medium | Race-based boundary escape during file I/O |
| R3 | Hardlink alias bypass | Medium | Low-Medium | External inode read/write through in-workspace path |PoCR1 - Dangling symlink component bypassCreate a symlink inside workspace pointing to a missing target.Validate a path traversing that symlink.Create the target directory outside workspace after validation.Perform file operation and observe potential boundary escape if not fail-closed.R2 - TOCTOU between validation and useValidate a candidate in-workspace path.Before open/write, replace an intermediate component with a link to external location.Continue with the file operation.Observe boundary escape if operation trusts only stale validation result.R3 - Hardlink alias bypassPlace a hardlink inside workspace that points to an external inode.Validate the in-workspace hardlink path.Read or write through this path.Observe external inode access through a path that appears in-scope.ImpactsUnauthorized cross path boundaryCredit[@zpbrent](https://github.com/zpbrent)Patch[f50c17e11ae3e2d40c96730abac41974ef2ee2a8](https://github.com/qhkm/zeptoclaw/commit/f50c17e11ae3e2d40c96730abac41974ef2ee2a8)
CVSS v4.0: 8.8
GHSA-88v7-949m-r8f8: Uncontrolled search path in some Intel(R) oneAPI Toolkit and component software installers before version 4.3.1.493 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS v3.1: 6.7
GHSA-c4m9-5h6p-hwwg: Yordam Library Information Document Automation product before version 19.02 has an unauthenticated reflected XSS vulnerability.
CVSS v3.1: 6.1
CVE-2014-0812: Cross-site scripting (XSS) vulnerability in KENT-WEB Joyful Note 2.8 and earlier, when Internet Explorer 7 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS v2.0: 4.3