ansulev/circl-vulnerability-scores huggingface dataset:
RHSA-2015:1086: Red Hat Security Advisory: flash-plugin security update
flash-plugin: cross-site request forgery against JSONP endpoints fixed in APSB15-11 (incomplete fix for CVE-2014-5333) flash-plugin: same-origin-policy bypass fixed in APSB15-11 flash-plugin: same-origin-policy bypass fixed in APSB15-11 flash-plugin: multiple code execution issues fixed in APSB15-11 flash-plugin: same-origin-policy bypass fixed in APSB15-11 flash-plugin: multiple code execution issues fixed in APSB15-11 flash-plugin: multiple code execution issues fixed in APSB15-11 flash-plugin: multiple code execution issues fixed in APSB15-11 flash-plugin: multiple code execution issues fixed in APSB15-11 flash-plugin: multiple code execution issues fixed in APSB15-11 flash-plugin: information leak leading to ASLR bypass (APSB15-11)
CVE-2018-17499: Envoy Passport for Android and Envoy Passport for iPhone could allow a local attacker to obtain sensitive information, caused by the storing of unencrypted data in logs. An attacker could exploit this vulnerability to obtain two API keys, a token and other sensitive information.
CVSS v3.0: 2.9
GHSA-wr53-w4qg-726h: Directory traversal vulnerability in kgcall.php in KGB 1.87 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the engine parameter, as demonstrated by uploading a file containing PHP code with an image/jpeg content type, and then referencing this file through the engine parameter.
CVE-2017-13225: In libMtkOmxVdec.so there is a possible heap buffer overflow. This could lead to a remote elevation of privilege enabling code execution as a privileged process with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-38308024. References: M-ALPS03495789.
CVSS v3.0: 7.8
CVSS v2.0: 9.3
GHSA-9jh5-qf84-x6pr: Contao: Possible cookie sharing with external domains while checking protected pages for broken links
ImpactIf the crawler is set to crawl protected pages, it sends the cookie header to externals URLs.PatchesUpdate to Contao 4.13.40 or 5.3.4.WorkaroundsDisable crawling protected pages.Referenceshttps://contao.org/en/security-advisories/session-cookie-disclosure-in-the-crawlerFor more informationIf you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).
CVSS v3.1: 8.3
GHSA-rggv-c4w4-cvm6: An issue was discovered in Castle Rock SNMPc Online 12.10.10 before 2020-01-28. There are multiple persistent (stored) and reflected XSS vulnerabilities.
RHSA-2016:0540: Red Hat Security Advisory: Red Hat JBoss BRMS 6.2.2 update
bsh2: remote code execution via deserialization
CVSS v3.0: 7.4
GHSA-r8jx-rgwf-cw4w: Buffer overflow in krshd in Kerberos 5 allows remote attackers to gain root privileges.
CVE-2025-49696: Microsoft Office Remote Code Execution Vulnerability
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally.
CVSS v3.1: 8.4
CVE-2026-33422: Discourse exposes ip_address of flagged user
Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the  `ip_address` of a flagged user is exposed to any user who can access the review queue, including users who should not be able to see IP addresses. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.
CVSS v3.1: 3.5
GHSA-p52f-9xgh-mjcf: Versions of VASA Provider for Clustered Data ONTAP prior to 7.0P1 contain a web server that accepts plain text authentication. This could allow an unauthenticated attacker to obtain authentication credentials.
CVSS v3.0: 8.1
CVE-2018-7312: SQL Injection exists in the Alexandria Book Library 3.1.2 component for Joomla! via the letter parameter.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
CVE-2000-0786: GNU userv 1.0.0 and earlier does not properly perform file descriptor swapping, which can corrupt the USERV_GROUPS and USERV_GIDS environmental variables and allow local users to bypass some access restrictions.
CVSS v2.0: 4.6
GHSA-vm5r-597x-rgvg: Mikrotik RouterOs before stable 6.47 suffers from an uncontrolled resource consumption in the sshd process. An authenticated remote attacker can cause a Denial of Service due to overloading the systems CPU.
CVSS v3.1: 6.5
CVE-2019-10329: Jenkins InfluxDB Plugin 1.21 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
CVSS v3.1: 8.8
CVSS v2.0: 4
CVE-2011-0593: Adobe Reader and Acrobat 10.x before 10.0.1, 9.x before 9.4.2, and 8.x before 8.2.6 on Windows and Mac OS X allow remote attackers to execute arbitrary code via a crafted Universal 3D (U3D) file that triggers a buffer overflow during decompression, a different vulnerability than CVE-2011-0590, CVE-2011-0591, CVE-2011-0592, CVE-2011-0595, and CVE-2011-0600.
CVSS v2.0: 9.3
GHSA-76qf-f82q-h3c3: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShapedPlugin LLC Real Testimonials allows Stored XSS. This issue affects Real Testimonials: from n/a through 3.1.6.
CVSS v3.1: 6.5
CVE-2021-37601: muc.lib.lua in Prosody 0.11.0 through 0.11.9 allows remote attackers to obtain sensitive information (list of admins, members, owners, and banned entities of a Multi-User chat room) in some common configurations.
CVSS v3.1: 7.5
GHSA-p4r9-85jf-w9fm: A use after free vulnerability [CWE-416] in FortiOS version 7.2.0 through 7.2.4 and version 7.0.0 through 7.0.10 and FortiProxy version 7.2.0 through 7.2.2 and version 7.0.0 through 7.0.8 may allow an unauthenticated remote attacker to crash the WAD process via multiple crafted packets reaching proxy policies or firewall policies with proxy mode alongside SSL deep packet inspection.
CVSS v3.1: 5.3
CVE-2026-6109: FoundationAgents MetaGPT Mineflayer HTTP API index.js evaluateCode cross-site request forgery
A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.1. The impacted element is the function evaluateCode of the file metagpt/environment/minecraft/mineflayer/index.js of the component Mineflayer HTTP API. Executing a manipulation can lead to cross-site request forgery. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
CVSS v4.0: 5.3
CVSS v3.1: 4.3
CVSS v3.0: 4.3
CVSS v2.0: 5
CVE-2024-8126: Advanced File Manager <= 5.2.8 - Authenticated (Subscriber+) Arbitrary File Upload
The Advanced File Manager plugin for WordPress is vulnerable to arbitrary file uploads via the 'class_fma_connector.php' file in all versions up to, and including, 5.2.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an Administrator, to upload a new .htaccess file allowing them to subsequently upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS v3.1: 7.5
RHSA-2026:8845: Red Hat Security Advisory: grafana-pcp security update
net/url: Incorrect parsing of IPv6 host literals in net/url
CVSS v3.1: 7.5
CVE-2025-53347: WordPress Kalium Theme <= 3.18.3 - Cross Site Request Forgery (CSRF) Vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Laborator Kalium kalium allows Cross Site Request Forgery.This issue affects Kalium: from n/a through <= 3.18.3.
CVSS v3.1: 4.3
CVE-2022-0754: SQL Injection in salesagility/suitecrm
SQL Injection in GitHub repository salesagility/suitecrm prior to 7.12.5.
CVSS v3.0: 7.1
GHSA-34v3-w4c4-qr24: In Totolink A3100R V5.9c.4577, "test.asp" contains an API-like function, which is not authenticated. Using this function, an attacker can configure multiple settings without authentication.
CVSS v3.1: 6.5
CVE-2022-0451: Auth bypass in Dark SDK
Dart SDK contains the HTTPClient in dart:io library whcih includes authorization headers when handling cross origin redirects. These headers may be explicitly set and contain sensitive information. By default, HttpClient handles redirection logic. If a request is sent to example.com with authorization header and it redirects to an attackers site, they might not expect attacker site to receive authorization header. We recommend updating the Dart SDK to version 2.16.0 or beyond.
CVSS v3.1: 6.5
CVE-2009-2261: PeaZIP 2.6.1, 2.5.1, and earlier on Windows allows user-assisted remote attackers to execute arbitrary commands via a .zip archive with a .txt file whose name contains | (pipe) characters and a command.
CVSS v2.0: 9.3
GHSA-mp7h-693f-hwvj: A vulnerability was found in PCMan FTP Server 2.0.7. It has been rated as critical. Affected by this issue is some unknown functionality of the component LIST Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 6.9
CVSS v3.1: 7.3
GHSA-wmq2-h8g3-fgwr: Cross-site scripting (XSS) vulnerability in the MediaFront module 6.x-1.x before 6.x-1.6, 7.x-1.x before 7.x-1.6, and 7.x-2.x before 7.x-2.1 for Drupal allows remote authenticated users with the "administer mediafront" permission to inject arbitrary web script or HTML via the preset settings.
CVE-2016-1111: Double free vulnerability in Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allows attackers to execute arbitrary code via a crafted Graphics State dictionary.
CVSS v3.0: 8.8
CVSS v2.0: 6.8
GHSA-6c7f-4xgm-82xq: Buffer overflow in elogd.c in elog before 2.5.7 r1558-4 allows attackers to execute code via unspecified variables, when writing to the log file.
CVE-2020-12718: In administration/comments.php in PHP-Fusion 9.03.50, an authenticated attacker can take advantage of a stored XSS vulnerability in the Preview Comment feature. The protection mechanism can be bypassed by using HTML event handlers such as ontoggle.
CVSS v3.1: 5.4
CVSS v2.0: 3.5
CVE-2019-5827: Integer overflow in SQLite via WebSQL in Google Chrome prior to 74.0.3729.131 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS v3.1: 8.8
CVSS v2.0: 6.8
CVE-2025-39910: mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc()
In the Linux kernel, the following vulnerability has been resolved:

mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc()

kasan_populate_vmalloc() and its helpers ignore the caller's gfp_mask and
always allocate memory using the hardcoded GFP_KERNEL flag.  This makes
them inconsistent with vmalloc(), which was recently extended to support
GFP_NOFS and GFP_NOIO allocations.

Page table allocations performed during shadow population also ignore the
external gfp_mask.  To preserve the intended semantics of GFP_NOFS and
GFP_NOIO, wrap the apply_to_page_range() calls into the appropriate
memalloc scope.

xfs calls vmalloc with GFP_NOFS, so this bug could lead to deadlock.

There was a report here
https://lkml.kernel.org/r/686ea951.050a0220.385921.0016.GAE@google.com

This patch:
 - Extends kasan_populate_vmalloc() and helpers to take gfp_mask;
 - Passes gfp_mask down to alloc_pages_bulk() and __get_free_page();
 - Enforces GFP_NOFS/NOIO semantics with memalloc_*_save()/restore()
   around apply_to_page_range();
 - Updates vmalloc.c and percpu allocator call sites accordingly.
CVSS v3.1: 5.5
GHSA-frr3-95g2-cm9h: Soldat game server 1.4.2 and earlier, and dedicated server 2.6.2 and earlier, allows remote attackers to cause a client denial of service (crash) via (1) a long string to the file transfer port or (2) a long chat message, or (3) a server denial of service (continuous beep and slowdown) via a string containing many 0x07 or other control characters to the file transfer port.
GHSA-vf3v-3g7g-88rm: D-Link DIR-890L FW1.10 A1 is vulnerable to Authentication bypass.
CVSS v3.1: 7.5
GHSA-h3v8-m8w2-rqjj: A Cross-Site Request Forgery (CSRF) in Pluck CMS v4.7.15 allows attackers to change the password of any given user by exploiting this feature leading to account takeover.
CVSS v3.1: 8.8
GHSA-5h7f-c7rw-mrcq: Input validation vulnerability in the USB service module
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS v3.1: 5.5
CVE-2025-12673: Flex QR Code Generator <= 1.2.7 - Unauthenticated Arbitrary File Upload
The Flex QR Code Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the update_qr_code() function in all versions up to, and including, 1.2.7. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS v3.1: 9.8
CVE-2024-27459: The interactive service in OpenVPN 2.6.9 and earlier allows an attacker to send data causing a stack overflow which can be used to execute arbitrary code with more privileges.
CVSS v3.1: 7.2
GHSA-rwrh-x97c-rfp7: An issue was discovered in ONAP Portal through Dublin. By executing a call to ONAPPORTAL/portalApi/loggedinUser, an attacker who possesses a user's cookie may retrieve that user's password from the database. All Portal setups are affected.
CVE-2015-2504: Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, and 4.6 improperly counts objects before performing an array copy, which allows remote attackers to (1) execute arbitrary code via a crafted XAML browser application (XBAP) or (2) bypass Code Access Security restrictions via a crafted .NET Framework application, aka ".NET Elevation of Privilege Vulnerability."
CVSS v2.0: 9.3
GHSA-cjw2-gq5v-g28j: Tungsten Automation Power PDF JP2 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tungsten Automation Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of JP2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24468.
CVSS v3.0: 7.8
CVE-2024-26692: smb: Fix regression in writes when non-standard maximum write size negotiated
In the Linux kernel, the following vulnerability has been resolved:

smb: Fix regression in writes when non-standard maximum write size negotiated

The conversion to netfs in the 6.3 kernel caused a regression when
maximum write size is set by the server to an unexpected value which is
not a multiple of 4096 (similarly if the user overrides the maximum
write size by setting mount parm "wsize", but sets it to a value that
is not a multiple of 4096).  When negotiated write size is not a
multiple of 4096 the netfs code can skip the end of the final
page when doing large sequential writes, causing data corruption.

This section of code is being rewritten/removed due to a large
netfs change, but until that point (ie for the 6.3 kernel until now)
we can not support non-standard maximum write sizes.

Add a warning if a user specifies a wsize on mount that is not
a multiple of 4096 (and round down), also add a change where we
round down the maximum write size if the server negotiates a value
that is not a multiple of 4096 (we also have to check to make sure that
we do not round it down to zero).
CVSS v3.1: 5.5
CVE-2023-31290: Trust Wallet Core before 3.1.1, as used in the Trust Wallet browser extension before 0.0.183, allows theft of funds because the entropy is 32 bits, as exploited in the wild in December 2022 and March 2023. This occurs because the mt19937 Mersenne Twister takes a single 32-bit value as an input seed, resulting in only four billion possible mnemonics. The affected versions of the browser extension are 0.0.172 through 0.0.182. To steal funds efficiently, an attacker can identify all Ethereum addresses created since the 0.0.172 release, and check whether they are Ethereum addresses that could have been created by this extension. To respond to the risk, affected users need to upgrade the product version and also move funds to a new wallet address.
CVSS v3.1: 5.9
CVE-2006-4875: Unrestricted file upload vulnerability in modules/galleryuploadfunction.php in Jupiter CMS allows remote attackers to upload picture files, and possibly files with arbitrary extensions, to gallery/albums/public.
CVSS v2.0: 5
CVE-2018-20532: There is a NULL pointer dereference at ext/testcase.c (function testcase_read) in libsolvext.a in libsolv through 0.7.2 that will cause a denial of service.
CVSS v3.0: 6.5
CVSS v2.0: 4.3
GHSA-3gp8-h4vv-c8w9: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in THEMELOGI Navian navian allows PHP Local File Inclusion.This issue affects Navian: from n/a through <= 1.5.4.
CVSS v3.1: 9.8
CVE-2021-27817: A remote command execution vulnerability in shopxo 1.9.3 allows an attacker to upload malicious code generated by phar where the suffix is JPG, which is uploaded after modifying the phar suffix.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2010-1842: Buffer overflow in AppKit in Apple Mac OS X 10.6.x before 10.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a bidirectional text string with ellipsis truncation.
CVSS v2.0: 9.3
CVE-2020-10562: An issue was discovered in DEVOME GRR before 3.4.1c. admin_edit_room.php mishandles file uploads.
CVSS v3.1: 7.2
CVSS v2.0: 6.5
CVE-2010-3812: Integer overflow in the Text::wholeText method in dom/Text.cpp in WebKit, as used in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4; webkitgtk before 1.2.6; and possibly other products allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving Text objects.
CVSS v2.0: 9.3
RHSA-2016:0560: Red Hat Security Advisory: Red Hat Enterprise Linux 4 Extended Life Cycle Support One-year Notice
This is the one-year notification for the retirement of Red Hat Enterprise
Linux 4 Extended Life Cycle Support (ELS). This notice applies only to
those customers subscribed to the Extended Life Cycle Support (ELS) channel
for Red Hat Enterprise Linux 4 in the Customer Portal.
GHSA-xxqj-m8p7-rjq7: The sized_string_cmp function in libyara/sizedstr.c in YARA 3.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted rule.
CVSS v3.0: 7.5
CVE-2019-4055: IBM MQ 8.0.0.0 through 8.0.0.10, 9.0.0.0 through 9.0.0.5, and 9.1.0.0 through 9.1.1 is vulnerable to a denial of service attack within the TLS key renegotiation function. IBM X-Force ID: 156564.
CVSS v3.0: 7.5
RHSA-2017:2603: Red Hat Security Advisory: docker-distribution security, bug fix, and enhancement update
docker-distribution: Does not properly restrict the amount of content accepted from a user
CVSS v3.0: 5.3
CVE-2022-40279: An issue was discovered in Samsung TizenRT through 3.0_GBM (and 3.1_PRE). l2_packet_receive_timeout in wpa_supplicant/src/l2_packet/l2_packet_pcap.c has a missing check on the return value of pcap_dispatch, leading to a denial of service (malfunction).
CVSS v3.1: 7.5
GHSA-j9pp-495j-qm96: In Wireshark 2.2.0 to 2.2.1, the Profinet I/O dissector could loop excessively, triggered by network traffic or a capture file. This was addressed in plugins/profinet/packet-pn-rtc-one.c by rejecting input with too many I/O objects.
CVSS v3.0: 5.9
CVE-2019-1215: An elevation of privilege vulnerability exists in the way that ws2ifsl.sys (Winsock) handles objects in memory, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1253, CVE-2019-1278, CVE-2019-1303.
CVSS v3.1: 7.8
CVSS v2.0: 7.2
CVE-2025-8148: CVE-2025-8148 Improper Access Control in SFTP service of GoAnywhere MFT
An Improper Access Control in the SFTP service in Fortra's GoAnywhere MFT prior to version 7.9.0 allows Web Users with an Authentication Alias and a valid SSH key but limited to Password authentication for SFTP to still login using their SSH key.
CVSS v3.1: 4.2
GHSA-fxch-9pjc-28rh: A vulnerability was found in Campcodes Grocery Sales and Inventory System 1.0. The impacted element is an unknown function of the file /ajax.php?action=save_customer. Performing manipulation of the argument ID results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.
CVSS v4.0: 5.5
CVSS v3.1: 7.3
CVE-2021-1748: A validation issue was addressed with improved input sanitization. This issue is fixed in tvOS 14.4, watchOS 7.3, iOS 14.4 and iPadOS 14.4. Processing a maliciously crafted URL may lead to arbitrary javascript code execution.
CVSS v3.1: 8.8
CVSS v2.0: 6.8
GHSA-rvm7-rc5g-c98q: A flaw was found in dogtag-pki and pki-core. The token authentication scheme can be bypassed with a LDAP injection. By passing the query string parameter sessionID=*, an attacker can authenticate with an existing session saved in the LDAP directory server, which may lead to escalation of privilege.
CVSS v3.1: 7.5
GHSA-hg4v-86x5-g9ch: I, Librarian version 4.9 and earlier contains an Incorrect Access Control vulnerability in ajaxdiscussion.php that can result in any users gaining unauthorized access (read, write and delete) to project discussions.
CVSS v3.0: 9.1
GHSA-vpjc-4jcv-jc29: NATS nats-server allows directory traversal via unintended path to a management action
NATS nats-server 2.2.0 through 2.7.4 allows directory traversal because of an unintended path to a management action from a management account.
CVSS v3.1: 9.8
GHSA-5rvw-257c-fpq2: Check Point Endpoint Security Client for Windows, with Anti-Bot or Threat Emulation blades installed, before version E83.20, tries to load a non-existent DLL during a query for the Domain Name. An attacker with administrator privileges can leverage this to gain code execution within a Check Point Software Technologies signed binary, where under certain circumstances may cause the client to terminate.
CVE-2018-1347: NetIQ iManager, versions prior to 3.1,  reflected XSS issue
The administrative web interface in NetIQ iManager, versions prior to 3.1, are vulnerable to reflected cross site scripting.
CVSS v3.0: 5.3
CVE-2026-10852: Websphere Application Server is Affected By a Denial of Service in IBM WebSphere Application Server Liberty
IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to denial of service in the WebSphere WebServer Plug-in component when an attacker can pass crafted requests to the web server.
CVSS v3.1: 5.9
RHSA-2024:7457: Red Hat Security Advisory: mod_jk bug fix update
mod_jk: information Disclosure / DoS
CVSS v3.1: 5.9
CVE-2020-9643: Adobe Experience Manager versions 6.5 and earlier have a server-side request forgery (ssrf) vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVSS v3.1: 7.5
CVSS v2.0: 5
CVE-2025-12154: Auto Thumbnailer <= 1.0 - Authenticated (Contributor+) Arbitrary File Upload
The Auto Thumbnailer plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadThumb() function in all versions up to, and including, 1.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS v3.1: 8.8
CVE-2022-34666: NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a local user with basic capabilities can cause a null-pointer dereference, which may lead to denial of service.
CVSS v3.1: 6.5
CVE-2021-33033: The Linux kernel before 5.11.14 has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd. This leads to writing an arbitrary value.
CVSS v3.1: 7.8
CVSS v2.0: 4.6