ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-vrw4-w73r-6mm8: TimelockController vulnerability in OpenZeppelin Contracts
ImpactA vulnerability in `TimelockController` allowed an actor with the executor role to take immediate control of the timelock, by resetting the delay to 0 and escalating privileges, thus gaining unrestricted access to assets held in the contract. Instances with the executor role set to "open" allow anyone to use the executor role, thus leaving the timelock at risk of being taken over by an attacker.PatchesA fix is included in the following releases of `@openzeppelin/contracts` and `@openzeppelin/contracts-upgradeable`:4.3.13.4.23.4.2-solc-0.7Deployed instances of `TimelockController` should be replaced with a fixed version by migrating all assets, ownership, and roles.WorkaroundsRevoke the executor role from accounts not strictly under the team's control. We recommend revoking all executors that are not also proposers. When applying this mitigation, ensure there is at least one proposer and executor remaining.References[Post-mortem](https://forum.openzeppelin.com/t/timelockcontroller-vulnerability-postmortem/14958).CreditsThe issue was identified by an anonymous white hat hacker through [Immunefi](https://immunefi.com/).For more informationIf you have any questions or comments about this advisory, or need assistance executing the mitigation, email us at security@openzeppelin.com.
CVSS v3.1: 10
CVE-2018-1549: IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a split response, once the URL is clicked. This would allow the attacker to perform further attacks, such as Web cache poisoning, cross-site scripting, and possibly obtain sensitive information. IBM X-Force ID: 142658.
CVSS v3.0: 5.4
RHSA-2022:5062: Red Hat Security Advisory: .NET Core 3.1 on RHEL 7 security and bugfix update
dotnet: NuGet Credential leak due to loss of control of third party symbol server domain
CVSS v3.1: 5
GHSA-27xw-w55h-qcr4: In ih264e_fmt_conv_422i_to_420sp of ih264e_fmt_conv.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-172908358
GHSA-882j-m7wv-38p6: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS v3.0: 9.8
CVE-2019-10208: A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before 9.6.15, 10.x before 10.10 and 11.x before 11.5 where arbitrary SQL statements can be executed given a suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can execute arbitrary SQL as the owner of the function.
CVSS v3.0: 7.5
GHSA-vxc2-qxc2-pw67: Animate versions 24.0.7, 23.0.10 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 7.8
GHSA-w8f3-pvx4-4c3h: Prototype Pollution in arr-flatten-unflatten
All versions of package arr-flatten-unflatten up to and including version 1.1.4 are vulnerable to Prototype Pollution via the constructor.
CVSS v3.1: 9.8
CVE-2005-1319: Cross-site scripting (XSS) vulnerability in Horde IMP Webmail client before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via the parent's frame page title.
CVSS v2.0: 4.3
GHSA-9853-5hc8-wh7r: Hospital Management System 4 is vulnerable to a SQL injection in /Hospital-Management-System-master/func.php via the password2 parameter.
CVSS v3.1: 6.5
CVE-2023-41190: D-Link DAP-1325 HNAP SetAPLanSettings IPAddr Command Injection Remote Code Execution Vulnerability
D-Link DAP-1325 HNAP SetAPLanSettings IPAddr Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of a request parameter provided to the HNAP1 SOAP endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-18810.
CVSS v3.0: 8.8
CVE-2026-24218: NVIDIA DGX OS contains a vulnerability in the factory provisioning process, where  the cloning of a base image causes identical SSH host keys to be deployed across multiple systems. The sharing of cryptographic identifiers across all similarly provisioned systems enables host impersonation or attacker-in-the-middle attacks. A successful exploit of this vulnerability might lead to code execution, data tampering, escalation of privileges, information disclosure, and denial of service.
CVSS v3.1: 8.1
CVE-2019-8003: Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
CVSS v3.1: 9.8
CVSS v2.0: 7.5
GHSA-xm78-4m3g-7wm7: Improper Authentication in Apache Kafka
In Apache Kafka 0.10.0.0 to 0.10.2.1 and 0.11.0.0 to 0.11.0.1, authenticated Kafka clients may use impersonation via a manually crafted protocol message with SASL/PLAIN or SASL/SCRAM authentication when using the built-in PLAIN or SCRAM server implementations in Apache Kafka.
CVSS v3.0: 6.8
GHSA-vxw3-96f4-67xp: u'Possible out of bound write in DSP driver code due to lack of check of data received from user' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MSM8909W
GHSA-cvx3-8832-cq9f: Multiple unspecified vulnerabilities in Camera Life before 2.6 allow attackers to cause a denial of service via unknown vectors.
RHSA-2026:3444: Red Hat Security Advisory: Red Hat OpenShift API for Data Protection
urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion urllib3: urllib3 Streaming API improperly handles highly compressed data urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)
CVSS v3.1: 7.5
CVE-2021-34476: Bowser.sys Denial of Service Vulnerability
Bowser.sys Denial of Service Vulnerability
CVSS v3.1: 7.5
GHSA-mx8m-v8qm-xwr8: Mattermost is vulnerable to DoS due to infinite re-renders on API errors
Mattermost versions 10.11.x <= 10.11.8, 11.1.x <= 11.1.1, 11.0.x <= 11.0.6 fail to prevent infinite re-renders on API errors which allows authenticated users to cause application-level DoS via triggering unbounded component re-render loops.
CVSS v3.1: 6.8
CVE-2015-8851: node-uuid before 1.4.4 uses insufficiently random data to create a GUID, which could make it easier for attackers to have unspecified impact via brute force guessing.
CVSS v3.1: 7.5
CVSS v2.0: 5
CVE-2021-33092: Incorrect default permissions in the installer for the Intel(R) NUC M15 Laptop Kit HID Event Filter driver pack before version 2.2.1.383 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS v3.1: 7.8
CVSS v2.0: 7.2
GHSA-x5g8-4m4m-8jgf: Vulnerability in WBSAirback 21.02.04, which involves improper neutralisation of Server-Side Includes (SSI), through Device Synchronizations (/admin/DeviceReplication). Exploitation of this vulnerability could allow a remote user to execute arbitrary code.
CVSS v3.1: 6.6
CVE-2010-0080: Unspecified vulnerability in the PeopleSoft Enterprise HCM - eProfile component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.9 Bundle, #21 and 9.0 Bundle #11 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.
CVSS v2.0: 4.9
GHSA-jmp8-6f34-cgjc: Adobe Illustrator versions 24.0.2 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution .
GHSA-rcgh-h6mp-4g9q: GNU gdb All versions is affected by: Buffer Overflow - Out of bound memory access. The impact is: Deny of Service, Memory Disclosure, and Possible Code Execution. The component is: The main gdb module. The attack vector is: Open an ELF for debugging. The fixed version is: Not fixed yet.
CVSS v3.1: 7.8
GHSA-x6f2-cjqr-r5qr: Tenda W9 V1.0.0.7(4456)_CN was discovered to contain a command injection vulnerability via the function formSetDiagnoseInfo .
CVSS v3.1: 9.8
GHSA-8366-xqph-v5cf: In Irssi before 1.0.3, when receiving a DCC message without source nick/host, it attempts to dereference a NULL pointer. Thus, remote IRC servers can cause a crash.
CVSS v3.0: 7.5
GHSA-wpw9-595f-g34r: The PostmagThemes Demo Import WordPress plugin through 1.0.7 does not validate the imported file, allowing high-privilege users such as admin to upload arbitrary files (such as PHP) leading to RCE.
CVSS v3.1: 7.2
CVE-2023-22716: WordPress OOPSpam Anti-Spam Plugin <= 1.1.35 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Cross-Site Scripting vulnerability in OOPSpam OOPSpam Anti-Spam plugin <= 1.1.35 versions.
CVSS v3.1: 5.9
GHSA-hqm6-wfjh-9325: A Command Injection vulnerability in Edimax Wireless Router N300 Firmware BR-6428NS_v4 allows attacker to execute arbitrary code via the formAccept function in /bin/webs without any limitations.
CVSS v3.1: 9.8
GHSA-c36x-h252-g9x2: OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808
SummaryOpenBao users with access to the `sys/leases/revoke/:lease_id` endpoint in any namespace can revoke leases in any other namespace as long as the lease identifier is known to them, bypassing ACLs that should apply for cross-namespace revocations.ImpactOpenBao's namespaces provide multi-tenant separation. A tenant who intentionally leaks lease identifiers can have their lease and underlying credential revoked by a user in another tenant.PatchThis will be fixed in OpenBao v2.5.5.ReferencesThis vulnerability is similar to but distinct from:CVE-2026-45808 / GHSA-v8v8-cm84-m686CVE-2026-40264 / GHSA-p49j-v9wc-wg57
CVSS v4.0: 2.1
GHSA-qf48-7w9h-8xf4: Unspecified vulnerability in Cisco IOS before 15.3(2)T on AS5400 devices allows remote authenticated users to cause a denial of service (spurious errors) via unknown vectors, aka Bug ID CSCub61009.
CVE-2021-46996: netfilter: nftables: Fix a memleak from userdata error path in new objects
In the Linux kernel, the following vulnerability has been resolved:

netfilter: nftables: Fix a memleak from userdata error path in new objects

Release object name if userdata allocation fails.
CVSS v3.1: 5.5
GHSA-m825-v286-93rf: A Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability in HCL AION.This issue affects AION: 2.0.
CVSS v3.1: 6.5
GHSA-p562-m5vc-8p56: A vulnerability has been found in TOTOLINK WA1200 5.9c.2914. The impacted element is an unknown function of the file cstecgi.cgi of the component HTTP Request Handler. The manipulation leads to null pointer dereference. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 5.5
CVSS v3.1: 5.3
GHSA-chgx-7ppx-v6gh: The sctp_do_peeloff function in net/sctp/socket.c in the Linux kernel before 4.14 does not check whether the intended netns is used in a peel-off action, which allows local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via crafted system calls.
CVSS v3.0: 7.8
GHSA-26g9-59f6-jrc2: SQL injection vulnerability in topicler.php in phPortal 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2026-27308: ColdFusion | Uncontrolled Resource Consumption (CWE-400)
ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. A high-privileged attacker could exploit this vulnerability and exhaust system resources, reducing application speed. Exploitation of this issue does not require user interaction.
CVSS v3.1: 2.4
GHSA-rw4j-5fjh-7xjp: A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect through 9.6.2304.102 could allow an unauthenticated attacker to perform a Cross Site Request Forgery (CSRF) attack due to insufficient request validation. A successful exploit could allow an attacker to provide a modified URL, potentially enabling them to modify system configuration settings.
CVSS v3.1: 4.3
RHSA-2025:0144: Red Hat Security Advisory: firefox security update
firefox: thunderbird: WebChannel APIs susceptible to confused deputy attack firefox: thunderbird: Use-after-free when breaking lines in text firefox: Alt-Svc ALPN validation failure when redirected firefox: Compartment mismatch when parsing JavaScript JSON module firefox: Memory corruption when using JavaScript Text Segmentation firefox: thunderbird: Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6 firefox: thunderbird: Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6
CVSS v3.1: 7.5
GHSA-245c-fpfx-q2mm: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Livemesh Livemesh Addons for Elementor.This issue affects Livemesh Addons for Elementor: from n/a through 8.3.7.
CVSS v3.1: 6.5
CVE-2023-33629: H3C Magic R300 version R300-2100MV100R004 was discovered to contain a stack overflow via the DeltriggerList interface at /goform/aspForm.
CVSS v3.1: 7.2
CVE-2022-23835: The Visual Voice Mail (VVM) application through 2022-02-24 for Android allows persistent access if an attacker temporarily controls an application that has the READ_SMS permission, and reads an IMAP credentialing message that is (by design) not displayed to the victim within the AOSP SMS/MMS messaging application. (Often, the IMAP credentials are usable to listen to voice mail messages sent before the vulnerability was exploited, in addition to new ones.) NOTE: some vendors characterize this as not a "concrete and exploitable risk.
CVSS v3.1: 8.1
CVSS v2.0: 4.3
GHSA-cc6f-j84g-6gmr: Generated Support Bundles contains private S/MIME and PGP keys if containing folder is not hidden. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.28 and prior versions; 8.0.x version 8.0.15 and prior versions.
GHSA-fw84-xgm8-9jmv: Open redirect vulnerability on CMSSecurity relogin screen
An attacker can display a link to a third party website on a login screen by convincing a legitimate content author to follow a specially crafted link.Upgrade to `silverstripe/framework` 4.12.5 or above to remedy the vulnerability.Reporter: Matthew Dekker
CVSS v3.1: 6.1
GHSA-jr42-fxwr-2j4m: content/content.blueprintspages.php in Symphony 2.7.6 has XSS via the pages content page.
CVSS v3.0: 6.1
CVE-2008-3349: Multiple unspecified vulnerabilities in NetApp Data ONTAP, as used on NetApp and IBM eServer platforms, allow remote attackers to execute arbitrary commands, cause a denial of service (system crash), or obtain sensitive information, probably related to insufficient access control for HTTP requests.  NOTE: this may overlap CVE-2008-3160.
CVSS v2.0: 10
CVE-2022-21192: All versions of the package serve-lite are vulnerable to Directory Traversal due to missing input sanitization or other checks and protections employed to the req.url passed as-is to path.join().
CVSS v3.1: 7.5
GHSA-jxp3-gh83-p8qh: UNNO v03.11.00 was discovered to contain access control issue.
CVSS v3.1: 9.8
CVE-2022-27653: A vulnerability has been identified in Simcenter Femap (All versions < V2022.2). The affected application contains an out of bounds write past the end of an allocated structure while parsing specially crafted .NEU files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-15594)
CVSS v3.1: 7.8
CVSS v2.0: 6.8
GHSA-3qgf-pp84-379f: A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend.
Users are recommended to upgrade to version 2.4.68, which fixes this issue.
CVSS v3.1: 7.5
GHSA-7p2q-7f39-m8x7: The MultiLoca - WooCommerce Multi Locations Inventory Management plugin for WordPress is vulnerable to SQL Injection via the 'data-id' parameter in all versions up to, and including, 4.1.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS v3.1: 6.5
GHSA-m34p-hw58-6hwf: All versions of VAMPSET software produced by Schneider Electric, prior to V2.2.189, are susceptible to a memory corruption vulnerability when a corrupted vf2 file is used. This vulnerability causes the software to halt or not start when trying to open the corrupted file. This vulnerability occurs when fill settings are intentionally malformed and is opened in a standalone state, without connection to a protection relay. This attack is not considered to be remotely exploitable. This vulnerability has no effect on the operation of the protection relay to which VAMPSET is connected. As Windows operating system remains operational and VAMPSET responds, it is able to be shut down through its normal closing protocol.
CVSS v3.0: 5.5
GHSA-r798-mxm8-76rv: Atlassian JIRA Server before 7.1.9 has CSRF in auditing/settings.
CVSS v3.0: 8.8
CVE-2022-37803: Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the page parameter in the function fromAddressNat.
CVSS v3.1: 9.8
GHSA-56wg-jgw9-q9vr: Multiple SQL injection vulnerabilities in the advanced search in Wikidforum 2.10 allow remote attackers to execute arbitrary SQL commands via the (1) select_sort or (2) opt_search_select parameters. NOTE: this issue could not be reproduced by third parties.
GHSA-xjjv-53w6-63w7: Adobe Acrobat and Reader versions 2018.009.20050 and earlier, 2017.011.30070 and earlier, 2015.006.30394 and earlier have an exploitable out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVSS v3.1: 9.8
CVE-2017-1000213: WBCE v1.1.11 is vulnerable to reflected XSS via the "begriff" POST parameter in /admin/admintools/tool.php?tool=user_search
CVSS v3.0: 4.8
CVSS v2.0: 3.5
CVE-2022-26910: Skype for Business and Lync Spoofing Vulnerability
Skype for Business and Lync Spoofing Vulnerability
CVSS v3.1: 5.3
CVE-2025-8103: WPeMatico RSS Feed Fetcher <= 2.8.7 - Cross-Site Request Forgery to Plugin Deactivation via handle_feedback_submission Function
The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.7. This is due to missing nonce validation in the handle_feedback_submission() function. This makes it possible for unauthenticated attackers to deactivate the plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS v3.1: 4.3
CVE-2024-48637: D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the VLANID:1/VID parameter in the SetVLANSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POST request.
CVSS v3.1: 8
GHSA-8xmq-wjw5-pxrq: Cells Blog 3.5 has SQL Injection via the pub_readpost.php ptid parameter.
CVSS v3.0: 8.8
CVE-2023-5719: Red Lion Crimson Improper Neutralization of Null Byte or NUL Character

The Crimson 3.2 Windows-based configuration tool allows users with administrative access to define new passwords for users and to download the resulting security configuration to a device. If such a password contains the percent (%) character, invalid values will be included, potentially truncating the string if a NUL is encountered. If the simplified password is not detected by the administrator, the device might be left in a vulnerable state as a result of more-easily compromised credentials. Note that passwords entered via the Crimson system web server do not suffer from this vulnerability.


CVSS v3.1: 8.8
CVE-2013-1461: The ExecuteSoapAction function in the SOAPAction handler in the HTTP service in MiniUPnP MiniUPnPd 1.0 allows remote attackers to cause a denial of service (NULL pointer dereference and service crash) via a SOAPAction header that lacks a # (pound sign) character, a different vulnerability than CVE-2013-0230.
CVSS v2.0: 7.8
GHSA-gvrm-xh5g-w8v6: In the Linux kernel, the following vulnerability has been resolved:net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failureIn the XSK branch of mlx5e_xmit_xdp_buff(), when sq->xmit_xdp_frame()
returns false (e.g. XDPSQ is full), the function returns without
unmapping the DMA address or freeing the xdp_frame allocated by
xdp_convert_zc_to_xdp_frame(). The xdpi_fifo push only happens on
success, so the completion path cannot recover these entries.With CONFIG_DMA_API_DEBUG=y, the leak surfaces on driver unbind:DMA-API: pci 0000:08:00.0: device driver has pending DMA
  allocations while released from device [count=1116]
  One of leaked entries details: [device address=0x000000010ffd7028]
  [size=1534 bytes] [mapped with DMA_TO_DEVICE] [mapped as phy]
  WARNING: kernel/dma/debug.c:881 at dma_debug_device_change+0x127/0x180
  ...
  DMA-API: Mapped at:
   debug_dma_map_phys+0x4b/0xd0
   dma_map_phys+0xfd/0x2d0
   mlx5e_xdp_handle+0x5ae/0xac0 [mlx5_core]
   mlx5e_xsk_skb_from_cqe_mpwrq_linear+0xc4/0x170 [mlx5_core]
   mlx5e_handle_rx_cqe_mpwrq+0xc1/0x290 [mlx5_core]Add the missing unmap + xdp_return_frame, matching the cleanup already
done in mlx5e_xdp_xmit(). has_frags is rejected earlier in this branch,
so no per-frag unmap is needed.
CVSS v3.1: 7.5
GHSA-fv66-9v8q-g76r: React Server Components are Vulnerable to RCE
ImpactThere is an unauthenticated remote code execution vulnerability in React Server Components.We recommend upgrading immediately.The vulnerability is present in versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 of:[react-server-dom-webpack](https://www.npmjs.com/package/react-server-dom-webpack)[react-server-dom-parcel](https://www.npmjs.com/package/react-server-dom-parcel)[react-server-dom-turbopack](https://www.npmjs.com/package/react-server-dom-turbopack?activeTab=readme)PatchesA fix was introduced in versions [19.0.1](https://github.com/facebook/react/releases/tag/v19.0.1), [19.1.2](https://github.com/facebook/react/releases/tag/v19.1.2), and [19.2.1](https://github.com/facebook/react/releases/tag/v19.2.1). If you are using any of the above packages please upgrade to any of the fixed versions immediately.If your app’s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability.ReferencesSee the [blog post](https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components) for more information and upgrade instructions.
CVSS v3.1: 10
GHSA-pmg6-hpcj-x4m9: An issue found in Peacexie Imcat v5.4 allows attackers to execute arbitrary code via the incomplete filtering function.
CVSS v3.1: 9.8