ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-7p8h-xj83-qmvw: Improper input validation was discovered in UsbCoreDxe in Insyde InsydeH2O kernel 5.4 before 05.47.01, 5.5 before 05.55.01, 5.6 before 05.62.01, and 5.7 before 05.71.01. The SMM module has an SMM call out vulnerability which can be used to write arbitrary memory inside SMRAM and execute arbitrary code at SMM level.
CVSS v3.1: 7.5
GHSA-rwc6-qv5w-3mrv: In the Linux kernel, the following vulnerability has been resolved:net: xilinx: axienet: Add error handling for RX metadata pointer retrievalAdd proper error checking for dmaengine_desc_get_metadata_ptr() which
can return an error pointer and lead to potential crashes or undefined
behaviour if the pointer retrieval fails.Properly handle the error by unmapping DMA buffer, freeing the skb and
returning early to prevent further processing with invalid data.
CVSS v3.1: 5.5
GHSA-j86f-mjmg-qphc: Multiple cross-site scripting (XSS) vulnerabilities in IlohaMail 0.8.14 and earlier allow remote attackers to inject arbitrary web script or HTML via the e-mail (1) body, (2) filename, or (3) MIME type.
GHSA-9jg7-rcr6-x7vx: Avahi before 0.6.10 allows local users to cause a denial of service (mDNS/DNS-SD service disconnect) via unspecified mDNS name conflicts.
CVE-2023-34372: WordPress Download SpamReferrerBlock Plugin <= 2.22 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Didier Sampaolo SpamReferrerBlock plugin <= 2.22 versions.
CVSS v3.1: 5.9
GHSA-j857-hxgm-cvxf: The Events Calendar for GeoDirectory plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 2.3.28. This is due to the ajax_ayi_action() handler  only applying strip_tags(esc_sql()) — with no allow-list — to the attacker-controlled $_POST['type'] and $_POST['postid'] values before forwarding them to update_ayi_data(), which calls update_user_meta($current_user->ID, $rsvp_args['type'], $posts). By passing type=wp_capabilities and postid=administrator, an attacker writes ['subscriber'=>true,'administrator'=>'administrator'] into their own wp_capabilities user meta; WP_User::get_role_caps() then treats the 'administrator' array key as an active role on the next request. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to Administrator.
CVSS v3.1: 8.8
GHSA-2mc2-q5q3-gf79: Use After Free in GitHub repository gpac/gpac prior to v2.1.0-DEV.
CVSS v3.1: 9.8
GHSA-2mp7-7vgg-f35r: A vulnerability was detected in code-projects Online Shoe Store 1.0. Affected is an unknown function of the file /admin/admin_running.php. Performing a manipulation of the argument product_name results in cross site scripting. It is possible to initiate the attack remotely. The exploit is now public and may be used.
CVSS v4.0: 1.9
CVSS v3.1: 2.4
RHSA-2021:4839: Red Hat Security Advisory: mailman:2.1 security update
mailman: CSRF token derived from admin password allows offline brute-force attack mailman: CSRF token bypass allows to perform CSRF attacks and account takeover
CVSS v3.1: 8
CVE-2005-1402: Integer signedness error in certain older versions of the NeL library, as used in Mtp-Target 1.2.2 and earlier, and possibly other products, allows remote attackers to cause a denial of service (memory consumption or server crash) via a negative value in a STLport call, which is not caught by a signed comparison.
CVSS v2.0: 5
GHSA-j36w-rcvv-vqmx: Multiple untrusted search path vulnerabilities in the installer in Synology Cloud Station Drive before 4.2.5-4396 on Windows allow local attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse (1) shfolder.dll, (2) ntmarta.dll, (3) secur32.dll or (4) dwmapi.dll file in the current working directory.
CVSS v3.0: 7.8
CVE-2024-10635: Enterprise Protection S/MIME Opaque Signature Attachment Scanning Bypass
Enterprise Protection contains an improper input validation vulnerability in attachment defense that allows an unauthenticated remote attacker to bypass attachment scanning security policy by sending a malicious S/MIME attachment with an opaque signature. When opened by a recipient in a downstream email client, the malicious attachment could cause partial loss of integrity and confidentiality to their system.
CVSS v3.1: 6.1
GHSA-34gp-5c7w-p6jr: A security vulnerability has been detected in SourceCodester Ship Ferry Ticket Reservation System 1.0. Impacted is an unknown function of the file /admin/?page=user/manage_user. The manipulation of the argument Username leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
CVSS v4.0: 1.9
CVSS v3.1: 2.4
GHSA-p84p-mg49-xwvx: A vulnerability in the ISDN subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient input validation when the ISDN Q.931 messages are processed. An attacker could exploit this vulnerability by sending a malicious ISDN Q.931 message to an affected device. A successful exploit could allow the attacker to cause the process to crash, resulting in a reload of the affected device.
CVSS v3.1: 7.4
CVE-2013-1243: The IP stack in Cisco Intrusion Prevention System (IPS) Software in ASA 5500-X IPS-SSP software and hardware modules before 7.1(5)E4, IPS 4500 sensors before 7.1(6)E4, and IPS 4300 sensors before 7.1(5)E4 allows remote attackers to cause a denial of service (MainApp process hang) via malformed IPv4 packets, aka Bug ID CSCtx18596.
CVSS v2.0: 7.8
CVE-2023-21501: Improper input validation vulnerability in mPOS fiserve trustlet prior to SMR May-2023 Release 1 allows local attackers to execute arbitrary code.
CVSS v3.1: 8.2
GHSA-5jxc-hmqf-3f73: Cross-Site Scripting in grav
grav prior to version 1.7.24 is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
CVSS v3.0: 6.3
GHSA-g4xj-vxvq-mqxr: Use after free in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)
CVSS v3.1: 9.6
CVE-2021-40608: The gf_hinter_track_finalize function in GPAC 1.0.1 allows attackers to cause a denial of service via a crafted file in the MP4Box command.
CVSS v3.1: 5.5
CVSS v2.0: 4.3
GHSA-vx52-c9mf-f5q6: A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0979.
CVE-2009-0017: csregprinter in the Printing component in Apple Mac OS X 10.4.11 and 10.5.6 does not properly handle error conditions, which allows local users to execute arbitrary code via unknown vectors that trigger a heap-based buffer overflow.
CVSS v2.0: 7.2
GHSA-r58h-mh9m-crp8: The bdecode_recursive function in include/libtorrent/bencode.hpp in Rasterbar Software libtorrent before 0.12.1, as used in Deluge before 0.5.8.3 and other products, allows context-dependent attackers to cause a denial of service (stack exhaustion and crash) via a crafted bencoded message.
GHSA-6xqp-ghrr-4p4f: NETGEAR R7000 devices before 1.0.9.88 are affected by stored XSS.
CVE-2025-8896: User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr_communication_preferences[]' parameter in all versions up to, and including, 3.14.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when the GDPR Communication Preferences module is enabled and at least one GDPR Communication Preferences field has been added to the edit profile form.
CVSS v3.1: 6.4
GHSA-mg4m-v9fc-9hcc: WPGlobus plugin Stored XSS & CSRF security vulnerability
The WPGlobus plugin 1.9.6 for WordPress has XSS via the `wpglobus_option[selector_wp_list_pages][show_selector]` parameter to `wp-admin/options.php`.
CVSS v3.0: 4.8
CVE-2022-39947: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiADC version 7.0.0 through 7.0.2, FortiADC version 6.2.0 through 6.2.3, FortiADC version version 6.1.0 through 6.1.6, FortiADC version 6.0.0 through 6.0.4, FortiADC version 5.4.0 through 5.4.5 may allow an attacker to execute unauthorized code or commands via specifically crafted HTTP requests.
CVSS v3.1: 8.6
GHSA-cwwg-wc3x-x7gv: A vulnerability was found in SourceCodester School Fees Payment System 1.0. It has been classified as critical. Affected is an unknown function of the file /receipt.php. The manipulation of the argument ef_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-272580.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVE-2017-18661: An issue was discovered on Samsung mobile devices with M(6.0) and N(7.x) software. There is a buffer overflow in process_cipher_tdea. The Samsung ID is SVE-2017-8973 (July 2017).
CVSS v3.1: 9.8
CVSS v2.0: 7.5
GHSA-6rcg-qvr5-p3c5: Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution.
CVE-2023-4341: Broadcom RAID Controller is vulnerable to Privilege escalation to root due to creation of insecure folders by Web GUI
Broadcom RAID Controller is vulnerable to Privilege escalation to root due to creation of insecure folders by Web GUI
CVSS v3.1: 9.8
GHSA-7j49-g4cp-8h6j: Unspecified vulnerability in IBM Cognos 8 Business Intelligence before 8.4.1 FP1 has unknown impact and attack vectors.
CVE-2019-25536: Netartmedia PHP Real Estate Agency 4.0 SQL Injection via features parameter
Netartmedia PHP Real Estate Agency 4.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the features[] parameter. Attackers can send POST requests to index.php with crafted SQL payloads in the features[] parameter to extract sensitive database information or manipulate database queries.
CVSS v4.0: 8.8
CVSS v3.1: 8.2
RHBA-2025:1600: Red Hat Bug Fix Advisory: Red Hat Quay v3.10.9 bug fix release
jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods
CVSS v3.1: 6.1
GHSA-3mpj-92q9-pvw2: Unknown vulnerability in the PKINIT Protocol for Microsoft Windows 2000, Windows XP, and Windows Server 2003 could allow a local user to obtain information and spoof a server via a man-in-the-middle (MITM) attack between a client and a domain controller when PKINIT smart card authentication is being used.
GHSA-58v5-wj5r-7vmx: NVIDIA Display Driver for Windows and Linux contains a vulnerability where an attacker might cause an improper index validation by issuing a call with crafted parameters. A successful exploit of this vulnerability might lead to data tampering  or denial of service.
CVSS v3.1: 7.1
GHSA-x78g-cfg5-7fhx: An issue was discovered in Tiny C Compiler (aka TinyCC or TCC) 0.9.27. Compiling a crafted source file leads to an 8 byte out of bounds write in the asm_parse_directive function in tccasm.c.
CVSS v3.0: 5.5
CVE-2023-20787: In thermal, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07648734; Issue ID: ALPS07648734.
CVSS v3.1: 6.4
GHSA-278m-rc9v-hf3c: Cross-Site Request Forgery (CSRF) vulnerability in Advanced Flamingo.This issue affects Advanced Flamingo: from n/a through 1.0.
CVSS v3.1: 4.3
GHSA-fp5r-v3w9-4333: JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.
CVSS v3.1: 7.5
RHSA-2025:21281: Red Hat Security Advisory: firefox security update
firefox: thunderbird: Race condition in the Graphics component firefox: thunderbird: Mitigation bypass in the DOM: Core & HTML component firefox: thunderbird: Use-after-free in the Audio/Video component firefox: thunderbird: Spoofing issue in Firefox firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component firefox: thunderbird: Same-origin policy bypass in the DOM: Notifications component firefox: thunderbird: Mitigation bypass in the DOM: Security component firefox: thunderbird: Same-origin policy bypass in the DOM: Workers component firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component
CVSS v3.1: 6.1
CVE-2025-30417: Out of Bounds Write in Library!DecodeBase64() in NI Circuit Design Suite
There is a memory corruption vulnerability due to an out of bounds write in Library!DecodeBase64() when using the SymbolEditor in NI Circuit Design Suite.  This vulnerability may result in information disclosure or arbitrary code execution.  Successful exploitation requires an attacker to get a user to open a specially crafted .sym file. This vulnerability affects NI Circuit Design Suite 14.3.0 and prior versions.
CVSS v4.0: 8.5
CVSS v3.1: 7.8
GHSA-g474-2q34-4cpq: The CRC32C feature in the Btrfs implementation in the Linux kernel before 3.8-rc1 allows local users to cause a denial of service (extended runtime of kernel code) by creating many different files whose names are associated with the same CRC32C hash value.
CVE-1999-0117: AIX passwd allows local users to gain root access.
CVSS v2.0: 7.2
GHSA-2mjm-r2vj-c5c6: Unspecified vulnerability in the camera application in HP Palm webOS 1.4.1 allows local users to overwrite arbitrary files via unknown vectors.
GHSA-8645-p2v4-73r2: wisp has Allocation of Resources Without Limits or Throttling
SummaryA multipart form parsing bug allows any unauthenticated user to bypass configured request size limits and trigger a denial of service by exhausting server memory or disk.DetailsThe issue is in the multipart parsing logic, specifically in `multipart_body` and `multipart_headers`.When parsing multipart data, the implementation distinguishes between:chunks where a boundary is foundchunks where more data is requiredIn the normal case (boundary found), the parser correctly accounts for consumed bytes by calling `decrement_quota`.However, in the `MoreRequiredForBody` branch, the parser appends incoming data to the output but recurses without decrementing the quota. This means that any chunk that does not contain the multipart boundary is effectively “free” from a quota perspective. Only the final chunk, the one containing the boundary, is counted.The same pattern exists in `multipart_headers`, where `MoreRequiredForHeaders` also recurses without decrementing the quota.As a result, an attacker can send arbitrarily large multipart bodies split across many chunks that avoid the boundary. The parser will accumulate the data (in memory for form fields, on disk for file uploads) without enforcing `max_body_size` or `max_files_size`.ImpactThis is a denial of service vulnerability caused by uncontrolled resource consumption.Any application using `require_form` or `require_multipart_form` on user-controlled input is affected. An unauthenticated attacker can send large multipart requests that bypass configured limits and cause:memory exhaustion (for form fields accumulated in memory)disk exhaustion (for file uploads written to temporary storage)In both cases, the application may become unavailable or be terminated by the operating system.WorkaroundDeploy a reverse proxy (such as nginx or HAProxy) in front of the application and enforce request body size limits there. This ensures large multipart requests are rejected before they reach the vulnerable parser.ResourcesIntroducing commit: https://github.com/gleam-wisp/wisp/commit/d8e722e22ccb42bda9d0b6248658d37ab4e9b376Fix commit: https://github.com/gleam-wisp/wisp/commit/7a978748e12ab29db232c222254465890e1a4a90
CVSS v4.0: 8.7
RHSA-2023:0709: Red Hat Security Advisory: Release of OpenShift Serverless 1.27.0
golang: archive/tar: github.com/vbatts/tar-split: unbounded memory consumption when reading headers golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters golang: net/http: handle server errors after sending GOAWAY golang: regexp/syntax: limit memory used by parsing regexps
CVSS v3.1: 6.5
CVE-2024-10474: Focus was incorrectly allowing internal links to utilize the app scheme used for deeplinking, which could result in links potentially circumventing some URL safety checks This vulnerability affects Focus for iOS < 132.
CVSS v3.1: 9.1
GHSA-g6fq-45x6-cmh4: The sapi_header_op function in main/SAPI.c in PHP before 5.3.11 and 5.4.x before 5.4.0RC2 does not check for %0D sequences (aka carriage return characters), which allows remote attackers to bypass an HTTP response-splitting protection mechanism via a crafted URL, related to improper interaction between the PHP header function and certain browsers, as demonstrated by Internet Explorer and Google Chrome.
GHSA-h63h-h767-62m3: The WritePICONImage function in coders/xpm.c in ImageMagick 7.0.6-4 allows remote attackers to cause a denial of service (memory leak) via a crafted file that is mishandled in an AcquireSemaphoreInfo call.
CVSS v3.0: 6.5
PYSEC-2022-43035: The d8s-urls package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-csv package. The affected version is 0.1.0.
GHSA-7h7c-cpx6-6cg3: Dell EMC Streaming Data Platform versions before 1.3 contain a SQL Injection Vulnerability. A remote malicious user may potentially exploit this vulnerability to execute SQL commands to perform unauthorized actions and retrieve sensitive information from the database.
CVE-2023-41612: Victure PC420 1.1.39 was discovered to use a weak encryption key for the file enabled_telnet.dat on the Micro SD card.
CVSS v3.1: 8.8
CVE-2025-64147: Jenkins Curseforge Publisher Plugin 1.0 does not mask API Keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
CVSS v3.1: 4.3
CVE-2022-24510: Microsoft Office Visio Remote Code Execution Vulnerability
Microsoft Office Visio Remote Code Execution Vulnerability
CVSS v3.1: 7.8
CVE-2026-20073: Cisco Secure Firewall Adaptive Security Appliance Software and Cisco Secure Firewall Threat Defense Software Access Control List Bypass Vulnerability
A vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to send traffic that should be denied through an affected device.

This vulnerability is due to improper error handling when an affected device that is joining a cluster runs out of memory while replicating access control rules. An attacker could exploit this vulnerability by sending traffic that should be blocked through the device. A successful exploit could allow the attacker to bypass access controls and reach devices in protected networks.
CVSS v3.1: 5.8
GHSA-mfvg-qwcw-qvc8: baserCMS allows any file to be uploaded
There is a vulnerability that allows uploading any files to baserCMS.This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users.
If you are eligible, please update to the new version as soon as possible.TargetbaserCMS 4.7.3 and earlier versionsVulnerabilityMalicious files may be uploaded in Upload File Management.CountermeasuresUpdate to the latest version of baserCMSPlease refer to the following page to reference for more information.
https://basercms.net/security/JVN_61105618CreditsTaisei Inoue@GMO Cybersecurity by Ierae, Inc.Yusuke Akagi@Mitsui Bussan Secure Directions, Inc.
CVSS v3.1: 9.8
CVE-2025-58834: WordPress short.io Plugin <= 2.4.2 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gugu short.io wp-shortcm allows DOM-Based XSS.This issue affects short.io: from n/a through <= 2.4.2.
CVSS v3.1: 6.5
CVE-2020-37225: Powie's WHOIS Domain Check 0.9.31 Persistent Cross-Site Scripting
Powie's WHOIS Domain Check 0.9.31 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary JavaScript by exploiting unsanitized input fields in plugin settings. Attackers can submit malicious payloads through textarea and input elements in the pwhois_settings.php configuration page to execute JavaScript in the admin context and escalate privileges.
CVSS v4.0: 5.1
CVSS v3.1: 6.4
GHSA-7c6v-g9gw-vx3p: Buffer overflow in named in BIND 4 versions 4.9.10 and earlier, and 8 versions 8.3.3 and earlier, allows remote attackers to execute arbitrary code via a certain DNS server response containing SIG resource records (RR).
CVE-2009-4121: Multiple cross-site request forgery (CSRF) vulnerabilities in Quick.CMS 2.4 and Quick.CMS.Lite 2.4 allow remote attackers to hijack the authentication of the administrator for requests that (1) delete web pages via a p-delete action to admin.php, and possibly (2) delete products or (3) delete orders via unspecified vectors.  NOTE: some of these details are obtained from third party information.
CVSS v2.0: 6.8
CVE-2026-31490: drm/xe/pf: Fix use-after-free in migration restore
In the Linux kernel, the following vulnerability has been resolved:

drm/xe/pf: Fix use-after-free in migration restore

When an error is returned from xe_sriov_pf_migration_restore_produce(),
the data pointer is not set to NULL, which can trigger use-after-free
in subsequent .write() calls.
Set the pointer to NULL upon error to fix the problem.

(cherry picked from commit 4f53d8c6d23527d734fe3531d08e15cb170a0819)
CVSS v3.1: 7.8
CVE-2026-42762: WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.9 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking allows DOM-Based XSS.This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through <= 1.8.9.
CVSS v3.1: 7.1
CVE-2026-5029: RCE in Code Runner MCP Server
A remote code execution vulnerability exists in Code Runner MCP Server when run with the --transport http option, which exposes the /mcp JSON-RPC endpoint without authentication on port 3088. An unauthenticated remote attacker can invoke the run-code MCP tool to supply arbitrary source code and execute it via child_process.exec() using the specified language interpreter. This allows execution of arbitrary code with the privileges of the user running the server. This vulnerability has not been fixed and might affect the project in all versions.
CVSS v4.0: 8.7
GHSA-4ph2-c8x7-g842: D-Link DIR-601 B1 2.00NA devices are vulnerable to authentication bypass. They do not check for authentication at the server side and rely on client-side validation, which is bypassable. NOTE: this is an end-of-life product.