ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-w8wv-vfpc-hw2w: NiceGUI: Upload filename sanitization bypass via backslashes allows path traversal on Windows
SummaryThe upload filename sanitization introduced in GHSA-9ffm-fxg3-xrhh uses `PurePosixPath(filename).name` to strip path components. Since `PurePosixPath` only recognizes forward slashes (`/`) as path separators, an attacker can bypass this sanitization on Windows by using backslashes (`\`) in the upload filename.Applications that construct file paths using `file.name` (a pattern demonstrated in NiceGUI's bundled examples) are vulnerable to arbitrary file write on Windows.DetailsThe sanitization in `nicegui/elements/upload_files.py` uses:`PurePosixPath` treats backslashes as literal characters, not path separators:When this filename is used in a path operation on Windows (e.g., `Path('uploads') / file.name`), Windows `Path` interprets backslashes as directory separators, resolving the path outside the intended directory.ImpactOn Windows deployments of NiceGUI applications that use `file.name` in path construction:**Arbitrary file write** outside the intended upload directory**Potential remote code execution** through overwriting application files or placing executables in known locations**Data integrity loss** through overwriting existing filesLinux and macOS are not affected, as they treat backslashes as literal filename characters.
CVSS v3.1: 5.9
GHSA-cxhj-rm5g-2586: Unspecified vulnerability in the Bluesoil Bluetooth stack has unknown impact and attack vectors.
CVE-2026-7202: Totolink A8000RU CGI cstecgi.cgi setWiFiWpsStart os command injection
A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setWiFiWpsStart of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument wscDisabled leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 9.3
CVSS v3.1: 9.8
CVSS v3.0: 9.8
CVSS v2.0: 10
CVE-2014-6134: IBM Rational ClearCase 8.0.0 before 8.0.0.14 and 8.0.1 before 8.0.1.7, when Installation Manager before 1.8.2 is used, retains cleartext server passwords in process memory throughout the installation procedure, which might allow local users to obtain sensitive information by leveraging access to the installation account.
CVSS v2.0: 1.2
GHSA-8437-r9r7-pr3c: Missing Authorization vulnerability in EXEIdeas International WP AutoKeyword allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP AutoKeyword: from n/a through 1.0.
CVSS v3.1: 5.3
CVE-2010-1638: The IMP plugin in Horde allows remote attackers to bypass firewall restrictions and use Horde as a proxy to scan internal networks via a crafted request to an unspecified test script.  NOTE: this is only a vulnerability when the administrator does not follow recommendations in the product's installation documentation.
CVSS v2.0: 5
GHSA-jwvj-pwww-3mj5: laravel framework Unexpected database bindings via requests
This is a follow-up to the security advisory https://github.com/laravel/framework/security/advisories/GHSA-3p32-j457-pg5x which addresses a few additional edge cases.If a request is crafted where a field that is normally a non-array value is an array, and that input is not validated or cast to its expected type before being passed to the query builder, an unexpected number of query bindings can be added to the query. In some situations, this will simply lead to no results being returned by the query builder; however, it is possible certain queries could be affected in a way that causes the query to return unexpected results.
CVE-2025-8540: Portabilis i-Educar public_municipio_cad.php cross site scripting
A vulnerability was found in Portabilis i-Educar 2.10. It has been classified as problematic. This affects an unknown part of the file /intranet/public_municipio_cad.php. The manipulation of the argument nome leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 4.8
CVSS v3.1: 2.4
CVSS v3.0: 2.4
CVSS v2.0: 3.3
CVE-2023-40575: Out-Of-Bounds Read in FreeRDP
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Read in the `general_YUV444ToRGB_8u_P3AC4R_BGRX` function. This issue is likely down to insufficient data for the `pSrc` variable and results in crashes. This issue has been addressed in version 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS v3.1: 5.3
RHSA-2022:1796: Red Hat Security Advisory: qt5-qtbase security update
qt: out-of-bounds write in QOutlineMapper::convertPath called from QRasterPaintEngine::fill and QPaintEngineEx::stroke
CVSS v3.1: 7.5
CVE-2020-12755: fishProtocol::establishConnection in fish/fish.cpp in KDE kio-extras through 20.04.0 makes a cacheAuthentication call even if the user had not set the keepPassword option. This may lead to unintended KWallet storage of a password.
CVSS v3.1: 3.3
CVSS v2.0: 2.1
CVE-2018-17088: The ProcessGpsInfo function of the gpsinfo.c file of jhead 3.00 may allow a remote attacker to cause a denial-of-service attack or unspecified other impact via a malicious JPEG file, because there is an integer overflow during a check for whether a location exceeds the EXIF data length. This is analogous to the CVE-2016-3822 integer overflow in exif.c. This gpsinfo.c vulnerability is unrelated to the CVE-2018-16554 gpsinfo.c vulnerability.
CVSS v3.0: 7.8
CVSS v2.0: 6.8
RHSA-2024:10869: Red Hat Security Advisory: redis:7 security update
redis: Redis SORT_RO may bypass ACL configuration redis: possible bypass of Unix socket permissions on startup redis: Denial-of-service due to malformed ACL selectors in Redis redis: Denial-of-service due to unbounded pattern matching in Redis redis: Lua library commands may lead to stack overflow and RCE in Redis
CVSS v3.1: 7
GHSA-w9v5-63v9-9qvj: In the Linux kernel, the following vulnerability has been resolved:ksmbd: fix use-after-free in SMB request handlingA race condition exists between SMB request handling in
`ksmbd_conn_handler_loop()` and the freeing of `ksmbd_conn` in the
workqueue handler `handle_ksmbd_work()`. This leads to a UAF.KASAN: slab-use-after-free Read in handle_ksmbd_workKASAN: slab-use-after-free in rtlock_slowlock_lockedThis race condition arises as follows:`ksmbd_conn_handler_loop()` waits for `conn->r_count` to reach zero:
`wait_event(conn->r_count_q, atomic_read(&conn->r_count) == 0);`Meanwhile, `handle_ksmbd_work()` decrements `conn->r_count` using
`atomic_dec_return(&conn->r_count)`, and if it reaches zero, calls
`ksmbd_conn_free()`, which frees `conn`.However, after `handle_ksmbd_work()` decrements `conn->r_count`,
it may still access `conn->r_count_q` in the following line:
`waitqueue_active(&conn->r_count_q)` or `wake_up(&conn->r_count_q)`
This results in a UAF, as `conn` has already been freed.The discovery of this UAF can be referenced in the following PR for
syzkaller's support for SMB requests.
CVSS v3.1: 7
GHSA-556w-726h-xmc3: A vulnerability was found in PHPGurukul Online Shopping Portal 2.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/assets/plugins/DataTables/media/unit_testing/templates/complex_header_2.php. The manipulation of the argument scripts leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 5.3
CVSS v3.1: 3.5
GHSA-xg8w-g5cc-8wvr: Tenda O4 V3.0 V1.0.0.10(2936) is vulnerable to Buffer Overflow in the function SafeSetMacFilter of the file /goform/setMacFilterList via the argument remark/type/time.
CVSS v3.1: 9.8
CVE-2017-15946: In the com_tag component 1.7.6 for Joomla!, a SQL injection vulnerability is located in the `tag` parameter to index.php. The request method to execute is GET.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
GHSA-x6r5-h6rv-j7r3: Multiple cross-site scripting (XSS) vulnerabilities in the administrative web interface in Cisco Unified Operations Manager allow remote attackers to inject arbitrary web script or HTML, and obtain improperly secured cookies, via unspecified vectors, aka Bug ID CSCud80186.
CVE-2020-0891: This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.An authenticated attacker could exploit this vulnerability by sending a specially crafted request to an affected SharePoint server, aka 'Microsoft SharePoint Reflective XSS Vulnerability'. This CVE ID is unique from CVE-2020-0795.
CVSS v3.1: 5.4
CVSS v2.0: 3.5
CVE-2004-1668: Multiple SQL injection vulnerabilities in index.php in Subjects 2.0 Postnuke module allow remote attackers to execute arbitrary SQL commands via the (1) pageid, (2) subid, or (3) catid parameters.
CVSS v2.0: 7.5
GHSA-9c8h-crr5-vfcm: Cross Site Request Forgery (CSRF) vulnerability in flusity-CMS v.2.33, allows remote attackers to execute arbitrary code via the add_menu.php component.
CVSS v3.1: 8.8
GHSA-6mwp-ccwj-v24g: The default configuration of the New Atlanta BlueDragon administrative interface in MediaCAST 8 and earlier enables external TCP connections to port 10000, instead of connections only from 127.0.0.1, which makes it easier for remote attackers to have an unspecified impact via a TCP session.
GHSA-4c9x-rrqj-4c82: Online Pizza Ordering System 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/manage_user.php.
CVSS v3.1: 9.8
CVE-2007-5994: PHP remote file inclusion vulnerability in check_noimage.php in Fritz Berger yet another php photo album - next generation (yappa-ng) 2.3.2 allows remote attackers to execute arbitrary PHP code via a URL in the config[path_src_include] parameter.
CVSS v2.0: 6.8
GHSA-q33m-rrqm-6xhw: Windows Encrypting File System (EFS) Remote Code Execution Vulnerability
CVSS v3.1: 9.8
GHSA-2xgc-784m-6j64: Unauthenticated Insecure Direct Object References (IDOR) in VikRentCar <= 1.4.5 versions.
CVSS v3.1: 7.5
GHSA-9mj7-g6p8-v73f: Heap-based buffer overflow in the dkim_exim_query_dns_txt function in dkim.c in Exim 4.70 through 4.80, when DKIM support is enabled and acl_smtp_connect and acl_smtp_rcpt are not set to "warn control = dkim_disable_verify," allows remote attackers to execute arbitrary code via an email from a malicious DNS server.
GHSA-3g9c-8hqm-qp82: The issue was addressed with improved bounds checks. This issue is fixed in macOS Ventura 13.3. An app may be able to cause unexpected system termination or write kernel memory.
CVSS v3.1: 7.1
GHSA-66cc-p4ch-5mw6: Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability
CVSS v3.1: 7.8
GHSA-5prc-43fj-m4f2: A hard-link created from log file archive of Check Point ZoneAlarm up to 15.4.062 or Check Point Endpoint Security client for Windows before E80.96 to any file on the system will get its permission changed so that all users can access that linked file. Doing this on files with limited access gains the local attacker higher privileges to the file.
GHSA-h63p-39p8-cjc7: A malicious actor having access to the exported configuration file may obtain the stored credentials and thereby gain access to the protected resource. If the same passwords were used for other resources, further such assets may be compromised.
CVSS v3.1: 6.5
CVE-2025-54115: Windows Hyper-V Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
CVSS v3.1: 7
GHSA-v762-vr2v-9263: In the Linux kernel, the following vulnerability has been resolved:ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSEFSCTL_SET_SPARSE in fsctl_set_sparse() modifies the file's sparse
attribute and saves it through xattr without any permission checks.This exposes two issues:A client on a read-only share can change the sparse attribute
on files it opened, even though the share is read-only.
Other FSCTL write operations already check
test_tree_conn_flag(work->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE),
but FSCTL_SET_SPARSE does not.Even on writable shares, clients without FILE_WRITE_DATA or
FILE_WRITE_ATTRIBUTES access should not modify the sparse
attribute. Similar handle-level checks exist in other functions
but are missing here.Add both share-level writable check and per-handle access check.
Use goto out on error to avoid leaking file references.
GHSA-964p-hcfc-cv9h: IBM Spectrum Protect Plus 10.1.0 through 10.1.4 uses insecure file permissions on restored files and directories in Windows which could allow a local user to obtain sensitive information or perform unauthorized actions. IBM X-Force ID: 170963.
GHSA-4chg-642f-qr6p: The vRealize Operations Manager API (8.x prior to 8.5) contains a Server Side Request Forgery in an end point. An unauthenticated malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack leading to information disclosure.
GHSA-5356-6vfv-g9cf: The Popup box WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS v3.1: 4.8
CVE-2023-36425: Windows Distributed File System (DFS) Remote Code Execution Vulnerability
Windows Distributed File System (DFS) Remote Code Execution Vulnerability
CVSS v3.1: 8
CVE-2020-3610: Possibility of double free of the drawobj that is added to the drawqueue array of the context during IOCTL commands as there is no refcount taken for this object in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8053, APQ8096AU, APQ8098, MSM8909W, MSM8917, MSM8953, MSM8996AU, Nicobar, QCS405, QCS605, QM215, Rennell, SA415M, Saipan, SC8180X, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR2130
CVSS v3.1: 7.8
CVSS v2.0: 4.6
GHSA-h8jh-4qq4-8fx6: Vulnerability in Drupal Owl Carousel 2.This issue affects Owl Carousel 2: *.*.
CVSS v3.1: 5.3
GHSA-29cx-mrrh-g7pc: This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the EnterpriseServer service. The issue results from the lack of proper locking when performing operations during authentication. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-15528.
CVSS v3.1: 8.1
GHSA-w9r3-fw4f-w35f: In the Linux kernel, the following vulnerability has been resolved:samples/landlock: Fix path_list memory leakClang static analysis reports this errorsandboxer.c:134:8: warning: Potential leak of memory
  pointed to by 'path_list'
        ret = 0;
              ^
path_list is allocated in parse_path() but never freed.
CVSS v3.1: 5.5
CVE-2026-24630: WordPress Stylish Cost Calculator plugin <= 8.2.9 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Design Stylish Cost Calculator stylish-cost-calculator allows Stored XSS.This issue affects Stylish Cost Calculator: from n/a through <= 8.2.9.
CVSS v3.1: 6.5
CVE-2006-5138: Groupee UBB.threads 6.5.1.1 allows remote attackers to obtain sensitive information via a direct request for cron/php/subscriptions.php, which reveals the path in an error message.
CVSS v2.0: 5
CVE-2021-40008: There is a memory leak vulnerability in CloudEngine 12800 V200R019C00SPC800, CloudEngine 5800 V200R019C00SPC800, CloudEngine 6800 V200R019C00SPC800 and CloudEngine 7800 V200R019C00SPC800. The software does not sufficiently track and release allocated memory while parse a series of crafted binary messages, which could consume remaining memory. Successful exploit could cause memory exhaust.
CVSS v3.1: 7.5
CVSS v2.0: 5
GHSA-xw74-7c4m-397f: This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18658.
CVSS v3.1: 5.5
GHSA-w56v-4m7h-jhq8: wp-includes/capabilities.php in WordPress before 3.0.2, when a Multisite configuration is used, does not require the Super Admin role for the delete_users capability, which allows remote authenticated administrators to bypass intended access restrictions via a delete action.
GHSA-p8r8-5r9f-56w7: IBM Robotic Process Automation with Automation Anywhere 11 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 161411.
CVSS v3.1: 9.8
RHSA-2023:5460: Red Hat Security Advisory: bind9.16 security update
bind: stack exhaustion in control channel code may lead to DoS
CVSS v3.1: 7.5
GHSA-556g-c348-r956: In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, epan/dissectors/packet-rpki-rtr.c had an infinite loop that was addressed by validating a length field.
CVSS v3.0: 7.5
CVE-2024-9252: Foxit PDF Reader AcroForm Use-After-Free Information Disclosure Vulnerability
Foxit PDF Reader AcroForm Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24491.
CVSS v3.0: 3.3
CVE-2007-6233: Directory traversal vulnerability in index.php in FTP Admin 0.1.0 allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in the page parameter.  NOTE: in some environments, this can be leveraged for remote file inclusion by using a UNC share pathname or an ftp, ftps, or ssh2.sftp URL.
CVSS v2.0: 4.9
CVE-2021-47934: MyBB Timeline Plugin 1.0 Cross-Site Scripting and CSRF
MyBB Timeline Plugin 1.0 contains cross-site scripting vulnerabilities that allow attackers to inject malicious scripts through thread titles, post content, and user profile fields like Location and Bio. Attackers can also exploit a cross-site request forgery vulnerability in the timeline.php profile action to change a user's cover picture by crafting malicious forms that execute when victims visit affected profiles.
CVSS v4.0: 6.9
CVSS v3.1: 5.3
CVE-2019-4140: IBM Tivoli Storage Manager Server (IBM Spectrum Protect 7.1 and 8.1) could allow a local user to replace existing databases by restoring old data. IBM X-Force ID: 158336.
CVSS v3.0: 6.3
CVE-2026-30236: OpenProject users that are not project members can be used to calculate Labor Budget, leaking their global hourly rate
OpenProject is an open-source, web-based project management software. Prior to 17.2.0, when editing a project budget and planning the labor cost, it was not checked that the user that was planned in the budget is actually a project member. This exposed the user's default rate (if one was set up) to users that should only see that information for project members. Also, the endpoint that handles the pre-calculation for the frontend to display a preview of the costs, while it was being entered, did not properly validate the membership of the user as well. This also allowed to calculate costs with the default rate of non-members. This vulnerability is fixed in 17.2.0.
CVSS v3.1: 4.3
RHSA-2020:2047: Red Hat Security Advisory: thunderbird security update
usrsctp: Buffer overflow in AUTH chunk input validation Mozilla: Use-after-free during worker shutdown Mozilla: Arbitrary local file access with 'Copy as cURL' Mozilla: Memory safety bugs fixed in Firefox 76 and Firefox ESR 68.8 Mozilla: Sender Email Address Spoofing using encoded Unicode characters
CVSS v3.1: 4.3
CVSS v3.0: 6.1
RHSA-2024:10879: Red Hat Security Advisory: postgresql:13 security update
postgresql: PostgreSQL PL/Perl environment variable changes execute arbitrary code
CVSS v3.1: 8.8
RHSA-2025:15724: Red Hat Security Advisory: python3.9 security update
cpython: Cpython infinite loop when parsing a tarfile
CVSS v3.1: 7.5
CVE-2019-2474: Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). Supported versions that are affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
CVSS v3.0: 7.5
CVSS v2.0: 5
GHSA-p9gr-qppx-mjcg: wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability in the getFollowsPage() function that allows attackers to trigger unauthorized actions without nonce validation. Attackers can craft malicious requests to enumerate follow relationships and manipulate user follow data by exploiting the missing CSRF protection in the follows page handler.
CVSS v4.0: 5.3
CVSS v3.1: 4.3
CVE-2009-2773: PHP remote file inclusion vulnerability in home.php in PHP Paid 4 Mail Script allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.
CVSS v2.0: 7.5
GHSA-f397-5vjw-v2c2: OpenClaw: Shell inline-command parsing could miss an allowlist check
SummaryShell inline-command parsing could miss an allowlist check. In affected versions, a command request using shell inline-command forms could route an inline command through a parser case that did not receive the expected allowlist decision.This advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.ImpactWhen the affected feature is enabled and reachable, this could run shell content without the intended approval or allowlist prompt. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.Patched VersionsThe first stable patched version is `2026.5.12`.Mitigationsrequire approval for shell inline-command forms until patched. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.
CVSS v4.0: 7.6
CVSS v3.1: 8.1