ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2021-29629: In FreeBSD 13.0-STABLE before n245765-bec0d2c9c841, 12.2-STABLE before r369859, 11.4-STABLE before r369866, 13.0-RELEASE before p1, 12.2-RELEASE before p7, and 11.4-RELEASE before p10, missing message validation in libradius(3) could allow malicious clients or servers to trigger denial of service in vulnerable servers or clients respectively.
CVSS v3.1: 7.5
CVSS v2.0: 5
CVE-2023-2142: Nunjucks autoescape bypass leads to cross site scripting
In Nunjucks versions prior to version 3.2.4, it was 
possible to bypass the restrictions which are provided by the autoescape
 functionality. If there are two user-controlled parameters on the same 
line used in the views, it was possible to inject cross site scripting 
payloads using the backslash \ character.
CVSS v3.1: 6.1
CVE-2023-43233: A stored cross-site scripting (XSS) vulnerability in the cms/content/edit component of YZNCMS v1.3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the title parameter.
CVSS v3.1: 6.1
cisco-sa-nxos-x509v3-unsupportedconfig-ScRtAbUk: Cisco NX-OS Software SSH X.509v3 Certificate Authentication with Unsupported Remote Authorization Method Privilege Escalation Issues
For certain products that are running Cisco NX-OS Software and are configured for SSH authentication with an X.509 version 3 (X.509v3) certificate, two remote authorization methods are unsupported and could allow for privilege escalation: TACACS+ and certain configurations of Lightweight Directory Access Protocol (LDAP).

TACACS+ does not properly validate the distinguished name (DN) of the X.509v3 certificate due to a logic error with authentication, authorization, and accounting (AAA).
LDAP does not properly validate the DN of the X.509v3 certificate if the enable cert-dn-match configuration command is not present. The enable cert-dn-match configuration command is required for username validation of the DN of the X.509v3 certificate.

Both unsupported configurations could allow a user who is authenticating to the device to elevate their privilege level to Administrator because the DN programmed username on the X.509v3 certificate was not validated and therefore did not have to match the username being authenticated.

Cisco has released software updates that address the TACACS+ and LDAP authorization issues, along with updates to the documentation for Cisco NX-OS Software. See Details ["#details"] for information about configuration changes that can address these security issues.
CVE-2024-56174: In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed in users' browsers under specific conditions: XSS from client-side template injection in search history.
CVSS v3.1: 8.1
GHSA-c9gc-7q9m-2crj: PhpTpoint Mailing Server Using File Handling 1.0 suffers from multiple Arbitrary File Read vulnerabilities in different sections that allow an attacker to read sensitive files on the system via directory traversal, bypassing the login page, as demonstrated by the Mailserver_filesystem/home.php coninb, consent, contrsh, condrft, or conspam parameter.
CVSS v3.0: 7.5
GHSA-cj67-x3pw-qjqp: In the Linux kernel, the following vulnerability has been resolved:riscv/mm: Add handling for VM_FAULT_SIGSEGV in mm_fault_error()Handle VM_FAULT_SIGSEGV in the page fault path so that we correctly
kill the process and we don't BUG() the kernel.
CVSS v3.1: 5.5
GHSA-hmc4-96f7-qm5f: Multiple directory traversal vulnerabilities in PHP iCalendar 2.0.1, 2.1, and 2.2 allow remote attackers to include arbitrary files via the (1) getdate and possibly other parameters used in the replace_files function in search.php and (2) $file variable as used in the parse function in functions/template.php.
GHSA-cc3v-3rj7-x9cm: A flaw has been found in itsourcecode Construction Management System 1.0. This affects an unknown function of the file /borrowedtool.php. Executing a manipulation of the argument code can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used.
CVSS v4.0: 2.1
CVSS v3.1: 6.3
CVE-2021-30728: An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Update 2021-004 Mojave. A malicious application may be able to execute arbitrary code with kernel privileges.
CVSS v3.1: 7.8
CVSS v2.0: 9.3
CVE-2026-27850: Improper verification in Linksys MR9600, Linksys MX4200
Due to an improperly configured firewall rule, the router will accept any connection on the WAN port with the source port 5222, exposing all services which are normally only accessible through the local network.
This issue affects MR9600: 1.0.4.205530; MX4200: 1.0.13.210200.
CVSS v3.1: 7.5
GHSA-9768-hprv-crj5: Jenkins Credentials Binding Plugin vulnerability can expose sensitive information in logger messages
Jenkins Credentials Binding Plugin 687.v619cb_15e923f and earlier does not properly mask (i.e., replace with asterisks) credentials present in exception error messages that are written to the build log.Credentials Binding Plugin 687.689.v1a_f775332fc9 rethrows exceptions that contain credentials, masking those credentials in the error messages.
CVSS v4.0: 5.3
CVSS v3.1: 4.3
GHSA-jgqv-93w3-r233: The Microsoft Office Spotlight Importer in Spotlight in Apple Mac OS X 10.4.11 and 10.5 before 10.5.7 does not properly validate Microsoft Office files, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a file that triggers memory corruption.
GHSA-x742-88jj-7hv9: Duplicate Advisory: allowlist exec-guard bypass via env -S
Duplicate AdvisoryThis advisory has been withdrawn because it is a duplicate of GHSA-48wf-g7cp-gr3m. This link is maintained to preserve external references.Original DescriptionOpenClaw versions prior to 2026.2.23 contain an allowlist bypass vulnerability in system.run guardrails that allows authenticated operators to execute unintended commands. When /usr/bin/env is allowlisted, attackers can use env -S to bypass policy analysis and execute shell wrapper payloads at runtime.
CVSS v4.0: 7.1
CVSS v3.1: 7.1
CVE-2024-9075: Stirling-Tools Stirling-PDF Markdown-to-PDF cross site scripting
A vulnerability was found in Stirling-Tools Stirling-PDF up to 0.28.3. It has been declared as problematic. This vulnerability affects unknown code of the component Markdown-to-PDF. The manipulation leads to cross site scripting. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 0.29.0 is able to address this issue. It is recommended to upgrade the affected component. The vendor explains that "this functionality was removed in 0.29.0 already" and "we plan to re-add at later date with issue resolved".
CVSS v4.0: 2.3
CVSS v3.1: 2.6
CVSS v3.0: 2.6
CVSS v2.0: 2.1
CVE-2024-9148: Flowise Stored Cross-Site Scripting
Flowise < 2.1.1 suffers from a Stored Cross-Site vulnerability due to a lack of input sanitization in Flowise Chat Embed < 2.0.0.
CVSS v3.1: 9.6
CVE-2007-5527: Multiple unspecified vulnerabilities in Oracle E-Business Suite 11.5.10.2 have unknown impact and remote attack vectors, related to (1) Application Object Library component (APP01), (2) Contracts Integration (APP02), (3) Applications Manager (APP04), (4) Marketing component (APP05), and (5) Exchange component (APP07).
CVSS v2.0: 7.5
CVE-2020-37023: Koken CMS 0.22.24 - Arbitrary File Upload
Koken CMS 0.22.24 contains a file upload vulnerability that allows authenticated attackers to bypass file extension restrictions by renaming malicious PHP files. Attackers can upload PHP files with system command execution capabilities by manipulating the file upload request through a web proxy and changing the file extension.
CVSS v4.0: 8.7
CVSS v3.1: 8.8
CVE-2019-2154: In libxaac, there is a possible out of bounds read due to a missing bounds check. This could lead to information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-117610057
CVSS v3.1: 6.5
CVSS v2.0: 4.3
CVE-2024-1586: Schema & Structured Data for WP & AMP <= 1.26 - Authenticated (Custom) Stored Cross-Site Scripting
The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom schema in all versions up to, and including, 1.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default the required authentication level is admin, but administrators have the ability to assign role based access to users as low as subscriber.
CVSS v3.1: 6.4
GHSA-jgxp-xmqg-vmcx: A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1198, CVE-2020-1227, CVE-2020-1345, CVE-2020-1482, CVE-2020-1575.
CVSS v3.1: 5.4
RHSA-2021:4918: Red Hat Security Advisory: Red Hat Integration Camel-K 1.6 release and security update
velocity: arbitrary code execution when attacker is able to modify templates RESTEasy: Caching routes in RootNode may result in DoS jackson-dataformat-cbor: Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError exception mongo-java-driver: client-side field level encryption not verifying KMS host name XStream: allow a remote attacker to cause DoS only by manipulating the processed input stream XStream: SSRF via crafted input stream XStream: arbitrary file deletion on the local host via crafted input stream XStream: Unsafe deserizaliation of javax.sql.rowset.BaseRowSet XStream: Unsafe deserizaliation of com.sun.corba.se.impl.activation.ServerTableEntry XStream: Unsafe deserizaliation of sun.swing.SwingLazyValue XStream: Unsafe deserizaliation of com.sun.tools.javac.processing.JavacProcessingEnvironment NameProcessIterator XStream: ReDoS vulnerability XStream: Unsafe deserizaliation of com.sun.org.apache.bcel.internal.util.ClassLoader XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream spring-web: (re)creating the temporary storage directory could result in  a privilege escalation within WebFlux application json-smart: uncaught exception may lead to crash or information disclosure XStream: remote command execution attack by manipulating the processed input stream pdfbox: infinite loop while loading a crafted PDF file xstream: Arbitrary code execution via unsafe deserialization of Xalan xsltc.trax.TemplatesImpl xstream: Infinite loop DoS via unsafe deserialization of sun.reflect.annotation.AnnotationInvocationHandler xstream: Arbitrary code execution via unsafe deserialization of com.sun.xml.internal.ws.client.sei.* xstream: Arbitrary code execution via unsafe deserialization of sun.tracing.* xstream: Arbitrary code execution via unsafe deserialization of com.sun.jndi.ldap.LdapBindingEnumeration xstream: Arbitrary code execution via unsafe deserialization of javax.swing.UIDefaults$ProxyLazyValue xstream: Arbitrary code execution via unsafe deserialization of com.sun.jndi.ldap.LdapSearchEnumeration xstream: Arbitrary code execution via unsafe deserialization of com.sun.jndi.toolkit.dir.ContextEnumerator xstream: Arbitrary code execution via unsafe deserialization of com.sun.corba.* xstream: Server-side request forgery (SSRF) via unsafe deserialization of com.sun.xml.internal.ws.client.sei.* xstream: Arbitrary code execution via unsafe deserialization of com.sun.jndi.ldap.LdapBindingEnumeration xstream: Server-side request forgery (SSRF) via unsafe deserialization of jdk.nashorn.internal.runtime.Source$URLData xstream: Arbitrary code execution via unsafe deserialization of Xalan xsltc.trax.TemplatesImpl xstream: Arbitrary code execution via unsafe deserialization of javax.swing.UIDefaults$ProxyLazyValue
CVSS v3.1: 8.5
CVE-2026-42743: WordPress Masteriyo - LMS plugin <= 2.1.8 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in Masteriyo - LMS <= 2.1.8 versions.
CVSS v3.1: 6.5
GHSA-x22q-3h7c-4hgh: In the Linux kernel, the following vulnerability has been resolved:dm cache: fix write hang in passthrough modeThe invalidate_remove() function has incomplete logic for handling write
hit bios after cache invalidation. It sets up the remapping for the
overwrite_bio but then drops it immediately without submission, causing
write operations to hang.Fix by adding a new invalidate_committed() continuation that submits
the remapped writes to the cache origin after metadata commit completes,
while using the overwrite_endio hook to ensure proper completion
sequencing. This maintains existing coherency. Also improve error
handling in invalidate_complete() to preserve the original error status
instead of using bio_io_error() unconditionally.
CVE-2020-5812: Nessus AMI versions 8.12.0 and earlier were found to either not validate, or incorrectly validate, a certificate which could allow an attacker to spoof a trusted entity by using a man-in-the-middle (MITM) attack.
CVSS v3.1: 5.9
CVSS v2.0: 4.3
GHSA-wv56-vjrw-54p2: CDE dtlogin in Caldera UnixWare 7.1.0, and possibly other operating systems, allows local users to gain privileges via a symlink attack on /var/dt/Xerrors since /var/dt is world-writable.
CVE-2014-4928: SQL injection vulnerability in Invision Power Board (aka IPB or IP.Board) before 3.4.6 allows remote attackers to execute arbitrary SQL commands via the cId parameter.
CVSS v3.0: 8.8
CVSS v2.0: 6.5
GHSA-qmqw-8gfv-6p78: Pixie 1.0.4 allows an admin/index.php s=login&m= XSS attack.
CVSS v3.0: 6.1
CVE-2022-26820: Windows DNS Server Remote Code Execution Vulnerability
Windows DNS Server Remote Code Execution Vulnerability
CVSS v3.1: 6.6
CVE-2021-0389: In setNightModeActivated of UiModeManagerService.java, there is a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-168039904
CVSS v3.1: 7.8
CVSS v2.0: 4.6
GHSA-x83h-v9j2-vj3h: Buffer overflow in the permitted function of GNOME gtop daemon (libgtop_daemon) in libgtop 1.0.13 and earlier may allow remote attackers to execute arbitrary code via long authentication data.
CVE-2024-54197: Server-Side Request Forgery in SAP NetWeaver Administrator (System Overview)
SAP NetWeaver Administrator(System Overview) allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by specially crafting HTTP requests. On successful exploitation this can result in Server-Side Request Forgery (SSRF) which could have a low impact on integrity and confidentiality of data. It has no impact on availability of the application.
CVSS v3.1: 7.2
CVE-2023-50121: Autel EVO NANO drone flight control firmware version 1.6.5 is vulnerable to denial of service (DoS).
CVSS v3.1: 5.7
GHSA-v5j6-9mr9-qwhr: TOTOlink A3600R v5.9c.4959 contains a buffer overflow vulnerability in the setAppEasyWizardConfig interface of /lib/cste_modules/app.so. The vulnerability occurs because the rootSsid parameter is not properly validated for length, allowing remote attackers to trigger a buffer overflow, potentially leading to arbitrary code execution or denial of service.
CVSS v3.1: 9.8
CVE-2023-7136: code-projects Record Management System Document Type doctype.php cross site scripting
A vulnerability classified as problematic was found in code-projects Record Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /main/doctype.php of the component Document Type Handler. The manipulation of the argument docname with the input "><script src="https://js.rip/b23tmbxf49"></script> leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249139.
CVSS v3.1: 2.4
CVSS v3.0: 2.4
CVSS v2.0: 3.3
GHSA-9wmc-988h-2mv2: TeamPass privileges issue
TeamPass before 3.1.3.1 does not properly prevent a user from acting with the privileges of a different user_id.
CVSS v4.0: 9.3
CVSS v3.1: 5.4
CVE-2018-4045: An exploitable privilege escalation vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to improper input validation. An attacker with local access could exploit this vulnerability to modify the file system as root.
CVSS v3.0: 7.1
RHSA-2014:1284: Red Hat Security Advisory: Red Hat JBoss Data Virtualization 6.0.0 security update
Teiid: XML eXternal Entity (XXE) flaw in SQL/XML parsing
GHSA-465p-v3ff-mc33: The HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.1 allows remote attackers to cause a denial of service (out-of-bounds access and daemon crash) or possibly execute arbitrary code via vectors related to the (1) frame_handlers array or (2) set_dynamic_table_size function.
CVSS v3.0: 9.8
CVE-2003-1459: Multiple PHP remote file inclusion vulnerabilities in ttCMS 2.2 and ttForum allow remote attackers to execute arbitrary PHP code via the (1) template parameter in News.php or (2) installdir parameter in install.php.
CVSS v2.0: 6.8
CVE-2007-1119: Unspecified vulnerability in Novell ZENworks 7 Desktop Management Support Pack 1 before Hot patch 3 (ZDM7SP1HP3) allows remote attackers to upload images to certain folders that were not configured in the "Only allow uploads to the following directories" setting via unspecified vectors.
CVSS v2.0: 6.4
GHSA-fxgw-f44q-85m6: An unauthenticated XSS vulnerability with FortiMail 5.0.0 - 5.2.9 and 5.3.0 - 5.3.8 could allow an attacker to execute arbitrary scripts in the security context of the browser of a victim logged in FortiMail, assuming the victim is social engineered into clicking an URL crafted by the attacker.
CVSS v3.0: 6.1
CVE-2025-5154: PhonePe App SQLite Database databases cleartext storage in a file or on disk
A vulnerability, which was classified as problematic, was found in PhonePe App 25.03.21.0 on Android. Affected is an unknown function of the file /data/data/com.phonepe.app/databases/ of the component SQLite Database. The manipulation leads to cleartext storage in a file or on disk. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 4.6
CVSS v3.1: 2.3
CVSS v3.0: 2.3
CVSS v2.0: 1.4
GHSA-hp2h-7f94-5q5v: Cross-site scripting (XSS) vulnerability in the Self-Service Console in EMC RSA Authentication Manager 7.1 before SP4 P32 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to a "cross frame scripting" issue.
CVE-2024-7755: HMS Networks EWON FLEXY 202 Insufficiently Protected Credentials
The EWON FLEXY 202 transmits credentials using a weak encoding method base64. An attacker who is present in the network can sniff the traffic and decode the credentials.
CVSS v4.0: 7.1
CVSS v3.1: 8.2
GHSA-xh5x-q49r-r9w4: curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.
CVSS v3.1: 7.5
GHSA-4p8j-843q-8hfp: Open redirect vulnerability in the Node Invite module before 6.x-2.5 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the destination parameter.
GHSA-5hq8-wjj7-762c: The web interface of the Vertiv Avocent UMG-4000 version 4.2.1.19 is vulnerable to stored XSS. A remote attacker authenticated with an administrator account could store a maliciously named file within the web application that would execute each time a user browsed to the page.
GHSA-jj8c-mmj3-mmgv: Authlib: Cross-site request forging when using cache
SummaryThere is no CSRF protection on the cache feature on most integrations clients.DetailsIn `authlib.integrations.starlette_client.OAuth`, no CSRF protection is set up when using the cache parameter. When _not_ using the cache parameter, the use of SessionMiddleware ties the client to the auth state, preventing CSRF attacks. With the cache, there is no such mechanism. Other integratons have the same issue, it's not just starlette.The state parameter is taken from the callback URL and the state is fetched from the cache without checking that it is the same client calling the redirect endpoint as was the one that initiated the auth flow.This issue is documented in RFC 6749 section 10.12:
https://datatracker.ietf.org/doc/html/rfc6749#section-10.12PoCSet up a Starlette integration with a cacheThe attacker starts the auth flow up until before the callback URL is followed.The attacked sends the redirect URL to the victimThe victim now completes the authorisationImpactThis impacts all users that use the cache to store auth state.All users will be vulnerable to CSRF attacks and may have an attacker's account tied to their own.
CVSS v3.1: 5.4
GHSA-4283-grg4-9j23: A Stack-based Buffer Overflow issue was discovered in WECON LEVI Studio HMI Editor v1.8.1 and prior. Multiple stack-based buffer overflow vulnerabilities have been identified in which the application does not verify string size before copying to memory; the attacker may then be able to crash the application or run arbitrary code.
CVSS v3.0: 9.8
CVE-2014-0613: The XNM command processor in Juniper Junos 10.4 before 10.4R16, 11.4 before 11.4R10, 12.1R before 12.1R8-S2, 12.1X44 before 12.1X44-D30, 12.1X45 before 12.1X45-D20, 12.1X46 before 12.1X46-D10, 12.2 before 12.2R7, 12.3 before 12.3R5, 13.1 before 13.1R3-S1, 13.2 before 13.2R2-S2, and 13.3 before 13.3R1, when xnm-ssl or xnm-clear-text is enabled, allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors.
CVSS v2.0: 7.1
GHSA-phj3-hcm2-mjhc: Nitro PDF Pro for Windows 14.41.1.4 contains a heap use-after-free vulnerability in the implementation of the JavaScript method this.mailDoc(). During execution, an internal XID object is allocated and then freed prematurely, after which the freed pointer is still passed into UI and logging helper functions. Because the freed memory region may contain unpredictable heap data or remnants of attacker-controlled JavaScript strings, downstream routines such as wcscmp() may process invalid or stale pointers. This can result in access violations and non-deterministic crashes.
CVSS v3.1: 8.4
CVE-2013-3658: Directory traversal vulnerability in VMware ESXi 4.0 through 5.0, and ESX 4.0 and 4.1, allows remote attackers to delete arbitrary host OS files via unspecified vectors.
CVSS v2.0: 9.4
CVE-2024-41236: A SQL injection vulnerability in /smsa/admin_login.php in Kashipara Responsive School Management System v3.2.0 allows an attacker to execute arbitrary SQL commands via the "username" parameter of the Admin Login Page
CVSS v3.1: 5.4
CVE-2020-11931: Ubuntu modifications to pulseaudio to provide snap security enforcement could be unloaded
An Ubuntu-specific modification to Pulseaudio to provide security mediation for Snap-packaged applications was found to have a bypass of intended access restriction for snaps which plugs any of pulseaudio, audio-playback or audio-record via unloading the pulseaudio snap policy module. This issue affects: pulseaudio 1:8.0 versions prior to 1:8.0-0ubuntu3.12; 1:11.1 versions prior to 1:11.1-1ubuntu7.7; 1:13.0 versions prior to 1:13.0-1ubuntu1.2; 1:13.99.1 versions prior to 1:13.99.1-1ubuntu3.2;
CVSS v3.1: 3.3
RHSA-2023:3644: Red Hat Security Advisory: Red Hat OpenShift Service Mesh Containers for 2.4.0
golang: html/template: improper handling of JavaScript whitespace
CVSS v3.1: 8.1
CVE-2020-12025: Rockwell Automation Logix Designer Studio 5000 Versions 32.00, 32.01, and 32.02 vulnerable to an xml external entity (XXE) vulnerability, which may allow an attacker to view hostnames or other resources from the program.
CVSS v3.1: 3.3
CVSS v2.0: 4.3
CVE-2023-32298: WordPress Simple User Listing Plugin <= 1.9.2 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Kathy Darling Simple User Listing plugin <= 1.9.2 versions.
CVSS v3.1: 7.1