ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-w362-42cv-6j7v: An insecure sensitive key storage issue was found in MyASUS. potentially allowing unauthorized actor to obtain a token that could be used to communicate with certain services.Refer to the 'Security Update for for MyASUS' section on the ASUS Security Advisory for more information.
CVSS v4.0: 7.7
GHSA-97jv-c342-5xhc: FurqanSoftware/node-whois vulnerable to Prototype Pollution
A vulnerability classified as critical has been found in Furqan node-whois. Affected is an unknown function of the file `index.coffee`. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). It is possible to launch the attack remotely. The name of the patch is 46ccc2aee8d063c7b6b4dee2c2834113b7286076. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216252.
CVSS v3.1: 9.8
CVE-2025-11807: Mixlr Shortcode <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The Mixlr Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mixlr' shortcode in all versions up to, and including, 1.0.1. This is due to insufficient input sanitization and output escaping on the 'url' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
GHSA-x5x6-gpfm-cpm4: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aviplugins.com Custom Post Type Attachment custom-post-type-pdf-attachment allows Stored XSS.This issue affects Custom Post Type Attachment: from n/a through <= 3.4.6.
CVSS v3.1: 5.4
CVE-2018-9958: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Text Annotations. When setting the point attribute, the process does not properly validate the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5620.
CVSS v3.0: 8.8
CVSS v2.0: 6.8
RHSA-2023:2097: Red Hat Security Advisory: Satellite 6.13 Release
jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode SnakeYaml: Constructor Deserialization Remote Code Execution rubygem-actionpack: Possible cross-site scripting vulnerability in Action Pack rubygem-loofah: inefficient regular expression leading to denial of service rubygem-loofah: Improper neutralization of data URIs leading to Cross Site Scripting rubygem-loofah: Uncontrolled Recursion leading to denial of service rubygem-rails-html-sanitizer: Inefficient Regular Expression leading to denial of service rubygem-rails-html-sanitizer: Improper neutralization of data URIs leading to Cross site scripting rubygem-rails-html-sanitizer: Cross site scripting vulnerability with certain configurations rubygem-rails-html-sanitizer: Cross site scripting vulnerability with certain configurations snakeyaml: Denial of Service due to missing nested depth limitation for collections tfm-rubygem-actionview: Possible cross-site scripting vulnerability in Action View tag helpers rubygem-tzinfo: arbitrary code execution activerecord: Possible RCE escalation bug with Serialized Columns in Active Record apache-commons-configuration: Apache Commons Configuration insecure interpolation defaults snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match snakeyaml: Uncaught exception in java.base/java.util.ArrayList.hashCode python-django: Potential denial-of-service vulnerability in internationalized URLs postgresql-jdbc: Information leak of prepared statement data due to insecure temporary file permissions jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS jackson-databind: use of deeply nested arrays apache-commons-text: variable interpolation RCE python-django: Potential denial-of-service via Accept-Language headers python-django: Potential denial-of-service vulnerability in file uploads
CVSS v3.1: 7.5
GHSA-pf36-m74w-73jx: Multi-thread race condition vulnerability in the camera framework module. Impact: Successful exploitation of this vulnerability may affect availability.
CVSS v3.1: 5.1
CVE-2009-3452: WebCoreModule.ashx in RADactive I-Load before 2008.2.5.0 allows remote attackers to obtain sensitive information via unspecified requests that trigger responses containing the saved-image folder pathname.
CVSS v2.0: 5
GHSA-cm49-6pc4-f8jg: lharc.c in lha does not securely create temporary files, which might allow local users to read or write files by creating a file before LHA is invoked.
GHSA-2ff4-xfpr-m32r: `Slip10Like` derivation method instantiated with certain curves may allow attacker to find derivation path which results into very long derivation (possible DoS)
Impact**Impacted are the only ones who use [`hd_wallet::Slip10Like`](https://docs.rs/hd-wallet/0.5.1/hd_wallet/struct.Slip10Like.html) or [`slip_10`](https://docs.rs/slip-10/latest/slip_10/) derivation method instantiated with curves other than secp256k1 and secp256r1.**`hd_wallet` crate used to provide `Slip10Like` derivation method, which is also provided in `slip-10` crate as a default derivation method. It's based on [slip10](https://github.com/satoshilabs/slips/blob/master/slip-0010.md) method that searches for a valid child key in an infinite loop until it's found.Theoretically, this could be exploited by an attacker by finding a derivation path that would force someone to execute a lot of iterations of this loop to find a valid child key. This attack, however, requires the probability of getting an invalid scalar from random 32 bytes to be high. Slip10 is protected from this attack as it's only defined on secp256k1 and secp256r1 curves, for which such probability is very low:For secp256k1, probability is $< 2^{-127}$. This means that a loop with 2 or more iterations is vanishingly impossible.For secp256r1, probability is $< 2^{-32}$. This means that a loop with 5 or more iterations is vanishingly impossible.While standard curves are safe to use with slip10, we used to allow slip10-like derivation which can be instantiated with any curve. For instance, one could instantiate it with ed25519 or stark curves, for which probability of getting invalid scalar from random 32 bytes is >90%, so theoretically, attacker could try to DoS such construction.Patches`hd_wallet v0.6.0` has been patched by removing slip10-like derivation from public API.If you need HD derivation on other curves than secp256k1 and secp256r1, we suggest you to use:[`hd_wallet::Edwards`](https://docs.rs/hd-wallet/latest/hd_wallet/edwards/struct.Edwards.html) derivation method available for ed25519 curve[`hd_wallet::Stark`](https://docs.rs/hd-wallet/latest/hd_wallet/stark/struct.Stark.html) derivation method available for stark curveBoth derivation methods are non-standard, but secure and efficient.**If you're still using `slip_10`** and would like to migrate to patched version, please migrate to `hd_wallet v0.6`. You may first migrate from `slip_10 v0.4` to `hd_wallet v0.5` by following migration instructions available [in the docs](https://docs.rs/slip-10/latest/slip_10/), and then upgrade from `hd_wallet v0.5` to `hd_wallet v0.6`.WorkaroundsTechnically, you don't need to upgrade if you don't use slip10-like derivation instantiated with other curves than secp256k1 or secp256r1.However, if you do, migrating to other derivation method might be required.Reach out to us in DiscordIf you want to reach out to us, feel free to write to [`#lockness` room in Discord](https://discordapp.com/channels/905194001349627914/1294284489635139585)CreditsThanks to Alessio Marziali <alessio.marziali@metaco.com> for discovering and flagging this issue
GHSA-42c5-x389-m7vp: Eval injection vulnerability in the Digest module before 1.17 for Perl allows context-dependent attackers to execute arbitrary commands via the new constructor.
GHSA-3788-fmr6-h469: Integer signedness error in the DCCP support in the do_dccp_getsockopt function in net/dccp/proto.c in Linux kernel 2.6.20 and later allows local users to read kernel memory or cause a denial of service (oops) via a negative optlen value.
GHSA-4q5q-cfpq-3h3j: Transient DOS may occur while parsing extended IE in beacon.
CVSS v3.1: 7.5
CVE-2007-6123: Unspecified vulnerability in IRC Services 5.1.8 has unknown impact and attack vectors.
CVSS v2.0: 10
CVE-2024-21632: omniauth-microsoft_graph vulnerable to account takeover (nOAuth)
omniauth-microsoft_graph provides an Omniauth strategy for the Microsoft Graph API. Prior to versions 2.0.0, the implementation did not validate the legitimacy of the `email` attribute of the user nor did it give/document an option to do so, making it susceptible to nOAuth misconfiguration in cases when the `email` is used as a trusted user identifier. This could lead to account takeover. Version 2.0.0 contains a fix for this issue.

CVSS v3.1: 8.6
GHSA-7hmq-wrv2-vwrw: services/core/java/com/android/server/pm/PackageManagerService.java in the framework APIs in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 allows attackers to increase intent-filter priority via a crafted application, aka internal bug 27450489.
CVSS v3.0: 7.3
GHSA-p8wh-q5vm-8xgr: Inappropriate implementation in cache in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS v3.1: 6.5
CVE-2025-20728: In wlan STA driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00447115; Issue ID: MSV-4276.
CVSS v3.1: 7.8
GHSA-qgv4-x6mv-vh78: Swissphone DiCal-RED 4009 devices allow a remote attacker to gain a root shell via TELNET without authentication.
CVSS v3.1: 9.8
CVE-2013-3530: SQL injection vulnerability in playlist.php in the Spiffy XSPF Player plugin 0.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the playlist_id parameter.
CVSS v2.0: 7.5
GHSA-hh6f-jfvj-jmpj: A vulnerability has been found in giantspatula SewKinect up to 7fd963ceb3385af3706af02b8a128a13399dffb1. This affects the function pickle.loads of the file /calculate of the component Endpoint. Such manipulation of the argument body_parts/point_cloud leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases.
CVSS v4.0: 2.1
CVSS v3.1: 6.3
CVE-2023-20572: An observable timing discrepancy in the ASP could allow a privileged attacker to perform a brute-force attack against the hash message authentication code, allowing the input of an arbitrary message, potentially leading to a loss of data integrity.
CVSS v4.0: 5.6
GHSA-5prc-xg5r-wf38: Directory traversal vulnerability in PWebServer 0.3.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the URL.
CVE-2018-18392: Privilege Escalation via Broken Access Control in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.
CVSS v3.0: 8.8
CVSS v2.0: 6.5
GHSA-53gq-qw8x-rqhq: The default configuration of the CCAgent option before 9.0.8.4 in the management server (aka TSA) component in Alcatel-Lucent OmniTouch Contact Center Standard Edition enables maintenance access, which allows remote attackers to monitor or reconfigure Contact Center operations via vectors involving TSA_maintenance.exe.
CVE-2020-9888: An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8. Processing a maliciously crafted audio file may lead to arbitrary code execution.
CVSS v3.1: 7.8
CVSS v2.0: 6.8
CVE-2025-32402: An Out-of-bounds Write in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to induce a crash in IO devices that use the library by sending a malicious RPC packet.
CVSS v3.1: 7.5
CVE-2015-8078: Integer overflow in the index_urlfetch function in imap/index.c in Cyrus IMAP 2.3.19, 2.4.18, and 2.5.6 allows remote attackers to have unspecified impact via vectors related to urlfetch range checks and the section_offset variable.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8076.
CVSS v2.0: 7.5
CVE-2022-48435: In JetBrains PhpStorm before 2023.1 source code could be logged in the local idea.log file
CVSS v3.1: 3.3
CVE-2026-45391: Local privilege escalation in Cribl Edge for Linux
A command injection vulnerability in Cribl Edge for Linux versions 3.2.0 through 4.17.0 allows a local unprivileged user to execute arbitrary commands in the context of the Cribl Edge service account.
CVSS v4.0: 8.5
CVSS v3.1: 7.8
CVE-2024-34664: Improper check for exception conditions in Knox Guard prior to SMR Oct-2024 Release 1 allows physical attackers to bypass Knox Guard in a multi-user environment.
CVSS v3.1: 4.1
GHSA-2whw-f8x7-c37x: Certain unspecified Kyocera printers have a default "admin" account with a blank password, which allows remote attackers to access an administrative menu via a telnet session.
CVE-2017-8810: MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2, when a private wiki is configured, provides different error messages for failed login attempts depending on whether the username exists, which allows remote attackers to enumerate account names and conduct brute-force attacks via a series of requests.
CVSS v3.0: 7.5
CVSS v2.0: 5
GHSA-5v4q-qvwr-3pgh: Cisco Unified IP Phones 7900 devices (aka TNP phones) with software before 9.2.1 allow local users to gain privileges via unspecified vectors, aka Bug ID CSCtn65815.
CVE-2022-20066: In atf (hwfde), there is a possible leak of sensitive information due to incorrect error handling. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06171729; Issue ID: ALPS06171729.
CVSS v3.1: 4.4
CVSS v2.0: 2.1
CVE-2025-68262: crypto: zstd - fix double-free in per-CPU stream cleanup
In the Linux kernel, the following vulnerability has been resolved:

crypto: zstd - fix double-free in per-CPU stream cleanup

The crypto/zstd module has a double-free bug that occurs when multiple
tfms are allocated and freed.

The issue happens because zstd_streams (per-CPU contexts) are freed in
zstd_exit() during every tfm destruction, rather than being managed at
the module level.  When multiple tfms exist, each tfm exit attempts to
free the same shared per-CPU streams, resulting in a double-free.

This leads to a stack trace similar to:

  BUG: Bad page state in process kworker/u16:1  pfn:106fd93
  page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106fd93
  flags: 0x17ffffc0000000(node=0|zone=2|lastcpupid=0x1fffff)
  page_type: 0xffffffff()
  raw: 0017ffffc0000000 dead000000000100 dead000000000122 0000000000000000
  raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
  page dumped because: nonzero entire_mapcount
  Modules linked in: ...
  CPU: 3 UID: 0 PID: 2506 Comm: kworker/u16:1 Kdump: loaded Tainted: G    B
  Hardware name: ...
  Workqueue: btrfs-delalloc btrfs_work_helper
  Call Trace:
   <TASK>
   dump_stack_lvl+0x5d/0x80
   bad_page+0x71/0xd0
   free_unref_page_prepare+0x24e/0x490
   free_unref_page+0x60/0x170
   crypto_acomp_free_streams+0x5d/0xc0
   crypto_acomp_exit_tfm+0x23/0x50
   crypto_destroy_tfm+0x60/0xc0
   ...

Change the lifecycle management of zstd_streams to free the streams only
once during module cleanup.
GHSA-7g2r-9q3g-84p3: The default configuration of Apache 1.3.12 in SuSE Linux 6.4 enables WebDAV, which allows remote attackers to list arbitrary directories via the PROPFIND HTTP request method.
GHSA-774w-9x95-733g: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.25 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
GHSA-c324-4x25-3fp3: A vulnerability was determined in D-Link DWR-M960 1.01.07. Impacted is the function sub_453140 of the file /boafrm/formWlAc of the component Wireless Access Control Endpoint. This manipulation of the argument submit-url causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
CVSS v4.0: 7.4
CVSS v3.1: 8.8
CVE-2024-45798: Multiple Poisoned Pipeline Execution (PPE) vulnerabilities
arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. The `arduino-esp32` CI is vulnerable to multiple Poisoned Pipeline Execution (PPE) vulnerabilities. Code injection in `tests_results.yml` workflow (`GHSL-2024-169`) and environment Variable injection (`GHSL-2024-170`). These issue have been addressed but users are advised to verify the contents of the downloaded artifacts.
CVSS v3.1: 10
GHSA-q88j-2hcx-grw4: osTicket before 1.14.3 allows XSS because include/staff/banrule.inc.php has an unvalidated echo $info['notes'] call.
CVE-2006-4938: help.php in Moodle before 1.6.2 does not check the existence of certain help files before including them, which might allow remote authenticated users to obtain the path in an error message.
CVSS v2.0: 4
CVE-2018-25191: Facturation System 1.0 SQL Injection via editar_producto.php
Facturation System 1.0 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'mod_id' parameter. Attackers can send POST requests to the editar_producto.php endpoint with crafted SQL payloads in the mod_id parameter to extract sensitive database information including usernames, database names, and version details.
CVSS v4.0: 7.1
CVSS v3.1: 7.1
RHSA-2020:4627: Red Hat Security Advisory: SDL security update
SDL: buffer over-read in IMA_ADPCM_nibble in audio/SDL_wave.c SDL: heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c SDL: heap-based buffer over-read in IMA_ADPCM_decode in audio/SDL_wave.c SDL: heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c SDL: heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c SDL: buffer over-read in SDL_LoadWAV_RW in audio/SDL_wave.c SDL: heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c SDL: heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c SDL: heap-based buffer over-read in SDL_GetRGB in video/SDL_pixels.c SDL: heap-based buffer overflow in SDL_FillRect in video/SDL_surface.c SDL: heap-based buffer over-read in Map1toN in video/SDL_pixels.c
CVSS v3.0: 8.4
CVE-2019-8589: This issue was addressed with improved checks. This issue is fixed in macOS Mojave 10.14.5. A malicious application may bypass Gatekeeper checks.
CVSS v3.1: 5.5
CVSS v2.0: 4.3
CVE-2024-8740: GetResponse Forms by Optin Cat <= 2.5.7 - Reflected Cross-Site Scripting
The GetResponse Forms by Optin Cat plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.5.7. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS v3.1: 6.1
GHSA-g5w2-qwqg-v4vf: Cross-site request forgery (CSRF) vulnerability in the retrospam component in wp-admin/options-discussion.php in WordPress 2.0.11 and earlier allows remote attackers to hijack the authentication of administrators for requests that move comments to the moderation list.
PYSEC-2026-88: Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // (e.g., //../../../secret.txt). The root cause is an inconsistency between two slash-stripping implementations. Any file readable by the process can be returned as rendered template content when an application passes untrusted input directly to TemplateLookup.get_template(). This vulnerability is fixed in 1.3.11.
CVSS v3.1: 7.5
CVE-2025-45987: Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL-X26_DA3 v1.2.7 were discovered to contain multiple command injection vulnerabilities via the dns1 and dns2 parameters in the bs_SetDNSInfo function.
CVSS v3.1: 9.8
CVE-2006-2265: Cross-site scripting vulnerability in admin/main.asp in Ocean12 Calendar Manager Pro 1.00 allows remote attackers to inject arbitrary web script or HTML via the date parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS v2.0: 2.6
GHSA-7p5q-2h9w-7x99: A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'data[Addon][layouts]' and 'data[Addon][layouts_except]' parameters in /apprain/developer/addons/update/commonresource.
CVSS v4.0: 5.1
GHSA-98rg-4fmq-frpj: A vulnerability in the social login configuration option for the guest users of Cisco Business Wireless Access Points (APs) could allow an unauthenticated, adjacent attacker to bypass social login authentication. This vulnerability is due to a logic error with the social login implementation. An attacker could exploit this vulnerability by attempting to authenticate to an affected device. A successful exploit could allow the attacker to access the Guest Portal without authentication.
CVSS v3.0: 4.7
GHSA-mq8r-j55w-fv46: In lunary-ai/lunary before version 1.5.9, the /v1/evaluators/ endpoint allows users to delete evaluators of a project by sending a DELETE request. However, the route lacks proper access control, such as middleware to ensure that only users with appropriate roles can delete evaluator data. This vulnerability allows low-privilege users to delete evaluators data, causing permanent data loss and potentially hindering operations.
CVSS v3.0: 8.1
GHSA-9wh7-fr57-h2j7: A vulnerability, which was classified as problematic, has been found in l2c2technologies Koha up to 20180108. This issue affects some unknown processing of the file /cgi-bin/koha/opac-MARCdetail.pl. The manipulation of the argument biblionumber with the input 2"><TEST> leads to cross site scripting. The attack may be initiated remotely. The identifier of the patch is 950fc8e101886821879066b33e389a47fb0a9782. It is recommended to upgrade the affected component. The identifier VDB-261677 was assigned to this vulnerability.
CVSS v3.1: 3.5