ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2026-45757: Rocket.Chat: users.deactivateIdle` deactivates accounts without revoking existing login tokens
Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12, Rocket.Chat allows users deactivated through users.deactivateIdle to keep using already-issued login tokens. A user that an administrator has marked inactive for idleness can still access authenticated REST endpoints with the old token. This vulnerability is fixed in 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12.
CVSS v4.0: 2.3
CVE-2023-52984: net: phy: dp83822: Fix null pointer access on DP83825/DP83826 devices
In the Linux kernel, the following vulnerability has been resolved:

net: phy: dp83822: Fix null pointer access on DP83825/DP83826 devices

The probe() function is only used for the DP83822 PHY, leaving the
private data pointer uninitialized for the smaller DP83825/26 models.
While all uses of the private data structure are hidden in 82822 specific
callbacks, configuring the interrupt is shared across all models.
This causes a NULL pointer dereference on the smaller PHYs as it accesses
the private data unchecked. Verifying the pointer avoids that.
CVSS v3.1: 5.5
GHSA-vrhm-gvg7-fpcf: Memory exhaustion in SvelteKit remote form deserialization (experimental only)
Versions of `@sveltejs/kit` prior to 2.52.2 with remote functions enabled can be vulnerable to memory exhaustion. Malformed form data can cause the server process to crash due to excessive memory allocation, resulting in denial of service.Only applications using both `experimental.remoteFunctions` and `form` are vulnerable.
CVSS v4.0: 4.6
CVE-2026-8367: aria2c Improper Certificate Validation
aria2c accepts a server certificate with incorrect Extended Key Usage (EKU). If the attackers compromise a certificate (with the associated private key) issued for a different purpose, they may be able to reuse it for TLS server authentication.
CVSS v3.1: 4.8
GHSA-p2h5-37jh-59fx: A Cross-Site Scripting (XSS) vulnerability was identified in the repository transfer feature of GitHub Enterprise Server, which allows attackers to steal sensitive user information via social engineering. This vulnerability affected all versions of GitHub Enterprise Server and was fixed in version 3.10.17, 3.11.15, 3.12.9, 3.13.4, and 3.14.1. This vulnerability was reported via the GitHub Bug Bounty program.
CVSS v4.0: 5.8
CVSS v3.1: 6.1
CVE-2023-3405: Denial of service condition in M-Files Server
Unchecked parameter value in M-Files Server in versions before 23.6.12695.3 (excluding 23.2 SR2 and newer) allows anonymous user to cause denial of service
CVSS v3.1: 7.5
GHSA-ghx2-6v4g-9wmm: usememos/memos makes Incorrect Use of Privileged APIs
In usememos/memos 0.9.0 and prior, a user with login permission can delete all notes of the whole application via `API DELETE https://demo.usememos.com/api/memo/$idnote`. The vulnerability will lose all user notes data throughout the system, causing damage to user data.
CVSS v3.1: 8.1
GHSA-7hvx-jg8h-g4xx: Heartland Payment Systems Payment Gateway PHP SDK hps/heartland-php v2.8.17 is vulnerable to a reflected XSS in examples/consumer-authentication/cruise.php via the URI, as demonstrated by the cavv parameter.
CVSS v3.0: 6.1
GHSA-m929-7fr6-cvjg: Spring Data Commons, used in combination with XMLBeam, contains a property binder vulnerability caused by improper restriction of XML external entity references
Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, contains a property binder vulnerability caused by improper restriction of XML external entity references as underlying library XMLBeam does not restrict external reference expansion. An unauthenticated remote malicious user can supply specially crafted request parameters against Spring Data's projection-based request payload binding to access arbitrary files on the system.
CVSS v3.0: 7.5
CVE-2020-23449: newbee-mall all versions are affected by incorrect access control to remotely gain privileges through NewBeeMallIndexConfigServiceImpl.java. Unauthorized changes can be made to any user information through the userID.
CVSS v3.1: 7.5
CVSS v2.0: 5
RHSA-2014:0229: Red Hat Security Advisory: openstack-glance security and bug fix update
openstack-glance: Glance Swift store backend password leak
CVE-2019-13503: mq_parse_http in mongoose.c in Mongoose 6.15 has a heap-based buffer over-read.
CVSS v3.1: 7.5
CVSS v2.0: 5
RHSA-2021:4932: Red Hat Security Advisory: nss security update
nss: Memory corruption in decodeECorDsaSignature with DSA signatures (and RSA-PSS)
CVSS v3.1: 9.8
CVE-2012-0318: Multiple cross-site scripting (XSS) vulnerabilities in Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13 allow remote attackers to inject arbitrary web script or HTML via vectors involving templates, a different issue than CVE-2012-1262.
CVSS v2.0: 4.3
GHSA-qp6c-p26q-wjqf: A NULL pointer dereference vulnerability exists in the function PdfTranslator::setTarget() in pdftranslator.cpp of PoDoFo 0.9.6, while creating the PdfXObject, as demonstrated by podofoimpose. It allows an attacker to cause Denial of Service.
CVSS v3.0: 8.8
CVE-2024-24783: Verify panics on certificates with an unknown public key algorithm in crypto/x509
Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for TLS servers to not verify client certificates.
CVSS v3.1: 5.9
GHSA-rv55-37hq-r98j: A Username Enumeration via Error Message issue was discovered in NiceHash Miner before 2.0.3.0 because an "EMAIL DOES NOT EXIST" error message occurs whenever a submitted email address is incorrect, but there is a different error message for invalid credentials with a correct email address.
GHSA-9969-ch68-9vj9: Buffer overflow in search.cgi in mnoGoSearch 3.1.19 and earlier allows remote attackers to execute arbitrary code via a long query (q) parameter.
RHSA-2020:5249: Red Hat Security Advisory: security update - Red Hat Ansible Tower 3.7.4-1 - RHEL7 Container
python-psutil: Double free because of refcount mishandling nodejs-angular: XSS due to regex-based HTML replacement nodejs-node-forge: prototype pollution via the util.setPath function mathjs: prototype pollution via the deepExtend function that runs upon configuration updates jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods
CVSS v3.1: 6.1
CVSS v3.0: 7
CVE-2003-0241: FrontRange GoldMine mail agent 5.70 and 6.00 before 30503 directly sends HTML to the default browser without setting its security zone or otherwise labeling it untrusted, which allows remote attackers to execute arbitrary code via a message that is rendered in IE using a less secure zone.
CVSS v2.0: 7.5
CVE-2018-1000628: Battelle V2I Hub 2.5.1 could allow a remote attacker to bypass security restrictions, caused by the direct checking of the API key against a user-supplied value in PHP's GET global variable array using PHP's strcmp() function. By adding "[]" to the end of "key" in the URL when accessing API functions, an attacker could exploit this vulnerability to execute API functions.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
GHSA-jw82-xjgr-g6f8: Withdrawn Advisory: kubernetes-nmstate Insecure Privilege Management
Withdrawn AdvisoryThis advisory has been withdrawn. This link is maintained to preserve external references.Original DescriptionAn insecure modification vulnerability flaw was found in containers using nmstate/kubernetes-nmstate-handler. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges. Versions before kubernetes-nmstate-handler-container-v2.3.0-30 are affected.
CVSS v3.1: 7
CVE-2026-31447: ext4: reject mount if bigalloc with s_first_data_block != 0
In the Linux kernel, the following vulnerability has been resolved:

ext4: reject mount if bigalloc with s_first_data_block != 0

bigalloc with s_first_data_block != 0 is not supported, reject mounting
it.
CVSS v3.1: 7.8
CVE-2023-41261: An issue was discovered in /fcgi/scrut_fcgi.fcgi in Plixer Scrutinizer before 19.3.1. The csvExportReport endpoint action generateCSV does not require authentication and allows an unauthenticated user to export a report and access the results.
CVSS v3.1: 5.3
GHSA-7wgh-f3wv-prq6: Multiple cross-site request forgery (CSRF) vulnerabilities in diafan.CMS before 5.1 allow remote attackers to hijack the authentication of administrators for requests that (1) modify articles via a save_post action to admin/news/saveNEWS_ID/, (2) modify settings via a save_post action to admin/site/save2/, or (3) modify credentials via a save_post action to admin/usersite/save2/.
GHSA-5w7m-5jqr-58r7: Missing Authorization vulnerability in PublisherDesk The Publisher Desk ads.txt the-publisher-desk-ads-txt allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Publisher Desk ads.txt: from n/a through <= 1.5.0.
CVSS v3.1: 5.3
GHSA-grgq-p9q4-xvmm: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and  9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS v3.1: 4.9
GHSA-rqw2-hhrf-7936: OpenStack Keystone does not check signature TTL of the EC2 credential auth method
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The EC2 API doesn't have a signature TTL check for AWS Signature V4. An attacker can sniff the Authorization header, and then use it to reissue an OpenStack token an unlimited number of times.
CVSS v4.0: 5.3
CVSS v3.1: 5.4
CVE-2020-25824: Telegram Desktop through 2.4.3 does not require passcode entry upon pushing the Export key within the Export Telegram Data wizard. The threat model is a victim who has voluntarily opened Export Wizard but is then distracted. An attacker then approaches the unattended desktop and pushes the Export key. This attacker may consequently gain access to all chat conversation and media files.
CVSS v3.1: 2.4
CVSS v2.0: 2.1
CVE-2023-2569: 

A CWE-787: Out-of-Bounds Write vulnerability exists that could cause local denial-of-service,
elevation of privilege, and potentially kernel execution when a malicious actor with local user
access crafts a script/program using an IOCTL call in the Foxboro.sys driver.


CVSS v3.1: 7.8
CVE-2025-21681: openvswitch: fix lockup on tx to unregistering netdev with carrier
In the Linux kernel, the following vulnerability has been resolved:

openvswitch: fix lockup on tx to unregistering netdev with carrier

Commit in a fixes tag attempted to fix the issue in the following
sequence of calls:

    do_output
    -> ovs_vport_send
       -> dev_queue_xmit
          -> __dev_queue_xmit
             -> netdev_core_pick_tx
                -> skb_tx_hash

When device is unregistering, the 'dev->real_num_tx_queues' goes to
zero and the 'while (unlikely(hash >= qcount))' loop inside the
'skb_tx_hash' becomes infinite, locking up the core forever.

But unfortunately, checking just the carrier status is not enough to
fix the issue, because some devices may still be in unregistering
state while reporting carrier status OK.

One example of such device is a net/dummy.  It sets carrier ON
on start, but it doesn't implement .ndo_stop to set the carrier off.
And it makes sense, because dummy doesn't really have a carrier.
Therefore, while this device is unregistering, it's still easy to hit
the infinite loop in the skb_tx_hash() from the OVS datapath.  There
might be other drivers that do the same, but dummy by itself is
important for the OVS ecosystem, because it is frequently used as a
packet sink for tcpdump while debugging OVS deployments.  And when the
issue is hit, the only way to recover is to reboot.

Fix that by also checking if the device is running.  The running
state is handled by the net core during unregistering, so it covers
unregistering case better, and we don't really need to send packets
to devices that are not running anyway.

While only checking the running state might be enough, the carrier
check is preserved.  The running and the carrier states seem disjoined
throughout the code and different drivers.  And other core functions
like __dev_direct_xmit() check both before attempting to transmit
a packet.  So, it seems safer to check both flags in OVS as well.
CVSS v3.1: 5.5
CVE-2006-6375: Cross-site scripting (XSS) vulnerability in display.php in Simple Machines Forum (SMF) 1.1 Final and earlier allows remote attackers to inject arbitrary web script or HTML via the contents of a file that is uploaded with the image parameter set, which can be interpreted as script by Internet Explorer's automatic type detection.
CVSS v2.0: 6.8
CVE-2009-1327: Stack-based buffer overflow in Mini-stream WM Downloader 3.0.0.9 allows remote attackers to execute arbitrary code via a long URI in a playlist (.m3u) file.
CVSS v2.0: 9.3
CVE-2026-21411: Authentication bypass issue exists in OpenBlocks series versions prior to FW5.0.8, which may allow an attacker to bypass administrator authentication and change the password.
CVSS v4.0: 8.7
CVSS v3.0: 8.8
CVE-2024-13306: WP Google Map < 1.9.4 - Admin+ Stored XSS
The Maps Plugin using Google Maps for WordPress  WordPress plugin before 1.9.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS v3.1: 4.3
CVE-2026-33214: Weblate has improper access control for the translation memory API
Weblate is a web based localization tool. In versions prior to 5.17, the translation memory API exposed unintended endpoints, which in turn didn't enforce proper access control. This issue has been fixed in version 5.17. If users are unable to update immediately, they can work around this issue by blocking access to /api/memory/ in the HTTP server, which removes access to this feature.
CVSS v3.1: 4.3
GHSA-32wr-m3hg-4r8x: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Leevio Happy Addons for Elementor allows Stored XSS.This issue affects Happy Addons for Elementor: from n/a through 3.10.1.
CVSS v3.1: 6.5
CVE-2024-20253: A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to the improper processing of user-provided data that is being read into memory. An attacker could exploit this vulnerability by sending a crafted message to a listening port of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privileges of the web services user. With access to the underlying operating system, the attacker could also establish root access on the affected device.
CVSS v3.1: 9.9
GHSA-q42v-pp4f-9ff2: TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc parameter in the function FUN_0041880c.
CVSS v3.1: 7.5
GHSA-hfr2-w3w8-234q: A Code Execution vulnerability exists the attachment parameter to index.php in Jcow CMS 4.x to 4.2 and 5.2 to 5.2.
GHSA-59pc-r9mr-h2pv: In the Linux kernel, the following vulnerability has been resolved:net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leakWhen processing Router Advertisements with user options the kernel
builds an RTM_NEWNDUSEROPT netlink message. The nduseroptmsg struct
has three padding fields that are never zeroed and can leak kernel dataThe fix is simple, just zeroes the padding fields.
CVSS v3.1: 7.1
GHSA-8q4g-74hp-8w55: Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: System Monitoring). Supported versions that are affected are 12.1.0.5, 13.2.0.0 and 13.3.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Enterprise Manager Base Platform accessible data as well as unauthorized update, insert or delete access to some of Enterprise Manager Base Platform accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Enterprise Manager Base Platform. CVSS 3.0 Base Score 6.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L).
CVSS v3.1: 6
CVE-2025-30258: In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a "verification DoS."
CVSS v3.1: 2.7
GHSA-x77p-2pm4-6632: Sales Representative Arbitrary File Deletion in Groundhogg <= 4.4 versions.
CVSS v3.1: 7.7
CVE-2018-18982: NUUO CMS All versions 3.3 and prior the web server application allows injection of arbitrary SQL characters, which can be used to inject SQL into an executing statement and allow arbitrary code execution.
CVSS v3.0: 8.8
CVSS v2.0: 6.5
RHSA-2026:24370: Red Hat Security Advisory: frr10 security update
frr: denial of service via crafted FlowSpec component frr: denial of service via crafted BGP UPDATE message
CVSS v3.1: 7.5
GHSA-vq7j-qx4g-8wh5: A vulnerability, which was classified as problematic, has been found in View All Posts Page Plugin up to 0.9.0 on WordPress. This issue affects the function action_admin_notices_activation of the file view-all-posts-pages.php. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 0.9.1 is able to address this issue. The patch is named bf914f3a59063fa4df8fd4925ae18a5d852396d7. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-233363.
CVSS v3.0: 3.5
RHSA-2026:0853: Red Hat Security Advisory: net-snmp security update
net-snmp: buffer overflow via a specially crafted packet can cause a crash in snmptrapd
CVSS v3.1: 9.8
GHSA-fm29-x3c3-cjxq: Multiple cross-site request forgery (CSRF) vulnerabilities in the Contact Form Generator plugin 2.0.1 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) create a field, (2) update a field, (3) delete a field, (4) create a form, (5) update a form, (6) delete a form, (7) create a template, (8) update a template, (9) delete a template, or (10) conduct cross-site scripting (XSS) attacks via a crafted request to the cfg_forms page in wp-admin/admin.php.
CVE-2019-13069: extenua SilverSHielD 6.x fails to secure its ProgramData folder, leading to a Local Privilege Escalation to SYSTEM. The attacker must replace SilverShield.config.sqlite with a version containing an additional user account, and then use SSH and port forwarding to reach a 127.0.0.1 service.
CVSS v3.0: 7.8
CVSS v2.0: 7.2
GHSA-9j6f-fvm4-55cm: A vulnerability was found in wfh45678 Radar up to 1.0.8 and classified as critical. This issue affects some unknown processing of the component Interface Handler. The manipulation with the input /../ leads to authorization bypass. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This appears not to be a path traversal weakness. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 6.9
CVSS v3.1: 7.3
GHSA-2wh3-v786-vq3m: Tenda AX1806 V1.0.0.1 contains a heap overflow vulnerability in setSchedWifi function, in which the src and v12 are directly obtained from http request parameter schedStartTime and schedEndTime without checking their size.
CVSS v3.1: 9.1
GHSA-hjph-f4mc-wx4c: Duplicate Advisory: Mistune has a ReDoS in LINK_TITLE_RE that allows denial of service via crafted Markdown input
Duplicate AdvisoryThis advisory has been withdrawn because it is a duplicate of GHSA-8mp2-v27r-99xp. This link is maintained to preserve external references.Original DescriptionSummary**Denial-of-Service (DoS)** vulnerability in the Mistune Markdown parser. The issue occurs when processing specially crafted reference links, which can cause excessive parsing and CPU consumption, leading to application hangs.**Function affected:** parse_link_title() in helpers.py
**Issue:** Malformed reference links cause excessive backtracking and parsing loops.
**Impact:** Remote attackers can submit malicious Markdown to hang processes, causing service unavailability.DetailsPoCReproduce steps:Simply execute above python script it will hang & increase cpu utilization to 100%**Fuzzer Output (libFuzzer):****Stack Trace (Excerpt):**IMAGE POC:Impact:Denial-of-Service (DoS)
High CPU usage and application hang
Potential for service unavailability in web apps or APIs processing untrusted MarkdownSuggested Mitigations:Implement parsing depth and iteration limits.
Limit reference-link title length.
Detects excessive escape character sequences.
Add defensive checks in parse_link_title.
Add fuzz regression tests using the provided PoC.This vulnerability was discovered using coverage-guided fuzzing and is reproducible consistently.
CVSS v4.0: 7.7
CVE-2026-35679: Zcash zcashd before 6.12.0 allows invalid transactions to be accepted under certain conditions, which potentially could have resulted in the draining of user funds from the Sprout pool. It was sometimes not verifying Sprout proofs.
CVSS v3.1: 3.5
GHSA-7mcp-rfrm-7r66: IBM Lotus Notes Traveler before 8.5.1.2 allows remote authenticated users to cause a denial of service (resource consumption and sync outage) by syncing a large volume of data.
GHSA-8fgg-5v78-6g76: Deserializing an array can free uninitialized memory in byte_struct
Byte_struct stack and unpack structure as raw bytes with packed or bit field layout. An issue was discovered in the byte_struct crate before 0.6.1 for Rust. There can be a drop of uninitialized memory if a certain deserialization method panics.
CVSS v3.1: 9.8
GHSA-4wj3-7p36-wmrw: An improper certificate validation vulnerability exists in BIG-IP Next Central Manager and may allow an attacker to impersonate an Instance Provider system. A successful exploit of this vulnerability can allow the attacker to cross a security boundary.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS v3.1: 6.8
CVE-2023-25179: Uncontrolled resource consumption in the Intel(R) Unite(R) android application before Release 17 may allow an authenticated user to potentially enable denial of service via local access.
CVSS v3.1: 5
GHSA-8947-25cx-hm93: Unspecified vulnerability in the Oracle Agile PLM Framework component in Oracle Supply Chain Products Suite 9.3.3 allows remote attackers to affect confidentiality via unknown vectors related to Security.
CVE-2024-8161: SQL injection vulnerability in CIGESv2 system
SQL injection vulnerability in ATISolutions CIGES affecting versions lower than 2.15.5. This vulnerability allows a remote attacker to send a specially crafted SQL query to the /modules/ajaxServiciosCentro.php point in the idCentro parameter and retrieve all the information stored in the database.
CVSS v3.1: 9.8
CVE-2018-4417: A validation issue was addressed with improved input sanitization. This issue affected versions prior to macOS Mojave 10.14.
CVSS v3.0: 5.5
CVSS v2.0: 4.3