ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-5g34-x2rf-m7v6: SVG's <code>&lt;use&gt;</code> element could have been used to load unexpected content that could have executed script in certain circumstances. While the specification seems to allow this, other browsers do not, and web developers relied on this property for script security so gecko's implementation was aligned with theirs. This vulnerability affects Firefox < 99.
CVSS v3.1: 8.8
CVE-2018-6924: In FreeBSD before 11.1-STABLE, 11.2-RELEASE-p3, 11.1-RELEASE-p14, 10.4-STABLE, and 10.4-RELEASE-p12, insufficient validation in the ELF header parser could allow a malicious ELF binary to cause a kernel crash or disclose kernel memory.
CVSS v3.0: 7.1
CVSS v2.0: 5.6
RHSA-2026:6192: Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.27.0 Release.
lodash: prototype pollution in _.unset and _.omit functions traefik: Traefik's Client Plugin is Vulnerable to Path Traversal, Arbitrary File Overwrites and Remote Code Execution golang: net/url: Memory exhaustion in query parameter parsing in net/url golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate glob: glob: Command Injection Vulnerability via Malicious Filenames crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption ajv: ReDoS via $data reference io.vertx/vertx-core: static handler component cache can be manipulated to deny the access to static files traefik: Traefik: Denial of Service via ACME TLS-ALPN fast path resource exhaustion node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition wheel: wheel: Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check Fastify: Fastify: Validation bypass due to malformed Content-Type header leading to integrity impact axios: Axios affected by Denial of Service via __proto__ Key in mergeConfig github.com/traefik/traefik: Traefik: Denial of Service via stalled STARTTLS requests node-tar: node-tar: Arbitrary file read/write via malicious archive hardlink creation minimatch: minimatch: Denial of Service via specially crafted glob patterns
CVSS v3.1: 6.5
GHSA-hmr9-g4qv-c693: SQL injection vulnerability in the device registration component in wsf/webservice.php in CoSoSys Endpoint Protector 4 4.3.0.4 and 4.4.0.2 allows remote attackers to execute arbitrary SQL commands via unspecified parameters.
GHSA-f5q4-jqjv-rhr8: SQL injection vulnerability in Joomla BSQ Sitestats 1.8.0 and 2.2.1 allows remote attackers to execute arbitrary SQL commands via the query string, possibly PHP_SELF.
RHSA-2010:0829: Red Hat Security Advisory: flash-plugin security update
flash-plugin: security bulletin APSB10-26 flash-plugin: security bulletin APSB10-26 flash-plugin: security bulletin APSB10-26 flash-plugin: security bulletin APSB10-26 flash-plugin: security bulletin APSB10-26 flash-plugin: security bulletin APSB10-26 flash-plugin: security bulletin APSB10-26 flash-plugin: security bulletin APSB10-26 flash-plugin: security bulletin APSB10-26 flash-plugin: security bulletin APSB10-26 flash-plugin: security bulletin APSB10-26 flash-plugin: security bulletin APSB10-26 flash-plugin: security bulletin APSB10-26 flash-plugin: security bulletin APSB10-26 acroread/flash-plugin: critical vulnerablility (APSA10-05, APSB10-26)
GHSA-prwp-rh6x-cr5m: CWE-119: Buffer errors vulnerability exists in Modicon M580 with firmware prior to V2.50, Modicon M340 with firmware prior to V3.01, BMxCRA312xx with firmware prior to V2.40, All firmware versions of Modicon Premium and 140CRA312xxx when sending a specially crafted Modbus packet, which could cause a denial of service to the device that would force a restart to restore availability.
CVSS v3.1: 6.5
CVE-2024-39740: IBM Datacap Navigator information disclosure
IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 displays version information in HTTP requests that could allow an attacker to gather information for future attacks against the system.  IBM X-Force ID:  296009.
CVSS v3.1: 4.3
GHSA-xwxw-c548-rmpj: A logic issue was addressed with improved file handling. This issue is fixed in macOS Tahoe 26.5. A maliciously crafted ZIP archive may bypass Gatekeeper checks.
CVSS v3.1: 5.5
GHSA-c49q-5f86-4hxc: A path traversal vulnerability in the DxWebEngine component of DH2i DxEnterprise and DxOdyssey for Windows, version 19.5 through 20.x before 20.0.219.0, allows an attacker to read any file on the host file system via an HTTP request.
CVE-2020-10602: In OSIsoft PI System multiple products and versions, an authenticated remote attacker could crash PI Network Manager due to a race condition. This can result in blocking connections and queries to PI Data Archive.
CVSS v3.1: 5.3
CVSS v2.0: 3.5
GHSA-7qgj-w9qg-w6qf: XnView Classic for Windows Version 2.40 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file, related to a "Read Access Violation starting at jbig2dec+0x0000000000005956."
CVSS v3.0: 7.8
CVE-2023-40537: Multi-blade VIPRION Configuration utility session cookie vulnerability

An authenticated user's session cookie may remain valid for a limited time after logging out from the BIG-IP Configuration utility on a multi-blade VIPRION platform. 

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.




CVSS v3.1: 8.1
CVE-2014-2119: The End User Safelist/Blocklist (aka SLBL) service in Cisco AsyncOS Software for Email Security Appliance (ESA) before 7.6.3-023 and 8.x before 8.0.1-023 and Cisco Content Security Management Appliance (SMA) before 7.9.1-110 and 8.x before 8.1.1-013 allows remote authenticated users to execute arbitrary code with root privileges via an FTP session that uploads a modified SLBL database file, aka Bug IDs CSCug79377 and CSCug80118.
CVSS v2.0: 8.5
GHSA-vrpr-p6w2-crwx: In System UI, there is a possible bypass of user's consent for access to sensor data due to a race condition. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10Android ID: A-119041698
GHSA-g49q-m8rg-qhw4: OpenAsset Digital Asset Management (DAM) through 12.0.19 does not correctly determine the HTTP request's originating IP address, allowing attackers to spoof it using X-Forwarded-For in the header, by supplying localhost address such as 127.0.0.1, effectively bypassing all IP address based access controls.
CVSS v3.1: 7.5
RHSA-2024:6018: Red Hat Security Advisory: postgresql:13 security update
postgresql: PostgreSQL relation replacement during pg_dump executes arbitrary SQL
CVSS v3.1: 7.5
CVE-2014-4161: Cross-site scripting (XSS) vulnerability in la/umTestSSO.jsp in SAP Supplier Relationship Management (SRM) allows remote attackers to inject arbitrary web script or HTML via the url parameter.
CVSS v2.0: 4.3
GHSA-9xwh-vjwg-jqf3: The installer of the macOS Sensor for VMware Carbon Black Cloud prior to 3.5.1 handles certain files in an insecure way. A malicious actor who has local access to the endpoint on which a macOS sensor is going to be installed, may overwrite a limited number of files with output from the sensor installation.
CVSS v3.1: 7.1
CVE-2015-0812: Mozilla Firefox before 37.0 does not require an HTTPS session for lightweight theme add-on installations, which allows man-in-the-middle attackers to bypass an intended user-confirmation requirement by deploying a crafted web site and conducting a DNS spoofing attack against a mozilla.org subdomain.
CVSS v2.0: 4.3
GHSA-vgh7-9mhq-v768: Transient DOS in Data Modem during DTLS handshake.
CVSS v3.1: 7.5
GHSA-w9hr-5jf6-whgw: A vulnerability was detected in D-Link DIR-823x up to 250416. The affected element is an unknown function of the file /goform/diag_ping. Performing manipulation of the argument target_addr results in command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.
CVSS v4.0: 2.1
CVSS v3.1: 6.3
GHSA-m497-hq5x-6jcv: Mattermost Server allows attackers to create buttons that can launch API requests
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows an attacker to create a button that, when pressed by a user, launches an API request.
CVSS v3.1: 4.3
GHSA-g9j4-wcw8-q372: The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the search feature in class-cubewp-search-ajax-hooks.php due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.
CVSS v3.1: 4.3
GHSA-2252-vj3q-cf9p: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sureshdsk Bootstrap collapse allows Stored XSS. This issue affects Bootstrap collapse: from n/a through 1.0.4.
CVSS v3.1: 7.1
CVE-2020-25219: url::recvline in url.cpp in libproxy 0.4.x through 0.4.15 allows a remote HTTP server to trigger uncontrolled recursion via a response composed of an infinite stream that lacks a newline character. This leads to stack exhaustion.
CVSS v3.1: 7.5
CVSS v2.0: 5
GHSA-w6v8-c5v8-cqhh: The multi-screen interaction module has a vulnerability in permission management. Successful exploitation of this vulnerability may cause exceptions of the device services.
CVSS v3.1: 7.5
CVE-2025-46157: An issue in EfroTech Time Trax v.1.0 allows a remote attacker to execute arbitrary code via the file attachment function in the leave request form
CVSS v3.1: 9.9
CVE-2026-22796: ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function
Issue summary: A type confusion vulnerability exists in the signature
verification of signed PKCS#7 data where an ASN1_TYPE union member is
accessed without first validating the type, causing an invalid or NULL
pointer dereference when processing malformed PKCS#7 data.

Impact summary: An application performing signature verification of PKCS#7
data or calling directly the PKCS7_digest_from_attributes() function can be
caused to dereference an invalid or NULL pointer when reading, resulting in
a Denial of Service.

The function PKCS7_digest_from_attributes() accesses the message digest attribute
value without validating its type. When the type is not V_ASN1_OCTET_STRING,
this results in accessing invalid memory through the ASN1_TYPE union, causing
a crash.

Exploiting this vulnerability requires an attacker to provide a malformed
signed PKCS#7 to an application that verifies it. The impact of the
exploit is just a Denial of Service, the PKCS7 API is legacy and applications
should be using the CMS API instead. For these reasons the issue was
assessed as Low severity.

The FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,
as the PKCS#7 parsing implementation is outside the OpenSSL FIPS module
boundary.

OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.
CVSS v3.1: 5.3
CVE-2008-3240: SQL injection vulnerability in index.php in AlstraSoft Affiliate Network Pro allows remote attackers to execute arbitrary SQL commands via the pgm parameter in a directory action.
CVSS v2.0: 7.5
GHSA-6vr3-46c6-3mg3: Uncontrolled search path for the Intel(R) Trace Analyzer and Collector software all verions may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS v4.0: 5.4
CVSS v3.1: 6.7
GHSA-pqrq-q9c7-wrj4: Integer overflow in the amap_alloc1 function in OpenBSD 5.8 and 5.9 allows local users to execute arbitrary code with kernel privileges via a large size value.
CVSS v3.0: 7.8
CVE-2026-33468: Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)` usage or similar methods that append string literal values into the compiled SQL strings
Kysely is a type-safe TypeScript SQL query builder. Prior to version 0.28.14, Kysely's `DefaultQueryCompiler.sanitizeStringLiteral()` only escapes single quotes by doubling them (`'` → `''`) but does not escape backslashes. When used with the MySQL dialect (where `NO_BACKSLASH_ESCAPES` is OFF by default), an attacker can use a backslash to escape the trailing quote of a string literal, breaking out of the string context and injecting arbitrary SQL. This affects any code path that uses `ImmediateValueTransformer` to inline values — specifically `CreateIndexBuilder.where()` and `CreateViewBuilder.as()`. Version 0.28.14 contains a fix.
CVSS v3.1: 8.1
CVE-2025-61930: Emlog Pro has CSRF issue that Enables Admin Password Reset
Emlog is an open source website building system. Emlog Pro versions 2.5.19 and earlier are vulnerable to Cross‑Site Request Forgery (CSRF) on the password change endpoint. An attacker can trick a logged‑in administrator into submitting a crafted POST request to change the admin password without consent. Impact is account takeover of privileged users. Severity: High. As of time of publication, no known patched versions exist.
CVSS v3.1: 8.1
CVE-2021-37563: MediaTek microchips, as used in NETGEAR devices through 2021-11-11 and other devices, mishandle the WPS (Wi-Fi Protected Setup) protocol. (Affected Chipsets MT7603E, MT7610, MT7612, MT7613, MT7615, MT7620, MT7622, MT7628, MT7629, MT7915; Affected Software Versions 7.4.0.0; Out-of-bounds write).
CVSS v3.1: 8.2
GHSA-r9w3-57w2-gch2: Ory Hydra has a SQL injection via forged pagination tokens
DescriptionFollowing Admin APIs in Ory Hydra are vulnerable to SQL injection due to flaws in its pagination implementation:listOAuth2ClientslistOAuth2ConsentSessionslistTrustedOAuth2JwtGrantIssuersPagination tokens are encrypted using the secret configured in `secrets.pagination`. If this value is not set, Hydra falls back to using `secrets.system`. An attacker who knows this secret can craft their own tokens, including malicious tokens that lead to SQL injection.PreconditionsThis issue can be exploited when the following conditions are met:One or more **admin APIs** listed above are directly or indirectly accessible to the attackerThe attacker can pass a raw pagination token to the affected APIThe configuration value `secrets.pagination` is set and known to the attacker, or `secrets.pagination` is not set and `secrets.system` is known to the attackerImpactAn attacker can execute arbitrary SQL queries through forged pagination tokens.MitigationAs a first line of defense, immediately configure a custom value for `secrets.pagination` by generating a cryptographically secure random secret, for example:Next, upgrade **Hydra** to the fixed version **as soon as possible**.
CVSS v3.1: 7.2
GHSA-g7hc-x6qw-m35g: SD-330AC and AMC Manager provided by silex technology, Inc. contain an issue with a sensitive information in resource not removed before reuse.  An attacker may login to the device without knowing the password by sending a crafted packet.
CVSS v4.0: 7.1
CVSS v3.1: 6.5
CVE-2022-50728: s390/lcs: Fix return type of lcs_start_xmit()
In the Linux kernel, the following vulnerability has been resolved:

s390/lcs: Fix return type of lcs_start_xmit()

With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG),
indirect call targets are validated against the expected function
pointer prototype to make sure the call target is valid to help mitigate
ROP attacks. If they are not identical, there is a failure at run time,
which manifests as either a kernel panic or thread getting killed. A
proposed warning in clang aims to catch these at compile time, which
reveals:

  drivers/s390/net/lcs.c:2090:21: error: incompatible function pointer types initializing 'netdev_tx_t (*)(struct sk_buff *, struct net_device *)' (aka 'enum netdev_tx (*)(struct sk_buff *, struct net_device *)') with an expression of type 'int (struct sk_buff *, struct net_device *)' [-Werror,-Wincompatible-function-pointer-types-strict]
          .ndo_start_xmit         = lcs_start_xmit,
                                    ^~~~~~~~~~~~~~
  drivers/s390/net/lcs.c:2097:21: error: incompatible function pointer types initializing 'netdev_tx_t (*)(struct sk_buff *, struct net_device *)' (aka 'enum netdev_tx (*)(struct sk_buff *, struct net_device *)') with an expression of type 'int (struct sk_buff *, struct net_device *)' [-Werror,-Wincompatible-function-pointer-types-strict]
          .ndo_start_xmit         = lcs_start_xmit,
                                    ^~~~~~~~~~~~~~

->ndo_start_xmit() in 'struct net_device_ops' expects a return type of
'netdev_tx_t', not 'int'. Adjust the return type of lcs_start_xmit() to
match the prototype's to resolve the warning and potential CFI failure,
should s390 select ARCH_SUPPORTS_CFI_CLANG in the future.
CVE-2020-27755: in SetImageExtent() of /MagickCore/image.c, an incorrect image depth size can cause a memory leak because the code which checks for the proper image depth size does not reset the size in the event there is an invalid size. The patch resets the depth to a proper size before throwing an exception. The memory leak can be triggered by a crafted input file that is processed by ImageMagick and could cause an impact to application reliability, such as denial of service. This flaw affects ImageMagick versions prior to 7.0.9-0.
CVSS v3.1: 3.3
CVSS v2.0: 4.3
GHSA-2w33-vxph-6jr3: Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070 multifunction printers with software releases before 101.00x.099.28200 allow an attacker to execute an unwanted binary during a exploited clone install. This requires creating a clone file and signing that file with a compromised private key.
CVE-2005-4528: SQL injection vulnerability in the Chatspot 2.0.0a7 module for phpBB allows remote attackers to execute arbitrary SQL commands via unknown vectors.
CVSS v2.0: 7.5
RHSA-2020:2906: Red Hat Security Advisory: thunderbird security update
Mozilla: Memory corruption due to missing sign-extension for ValueTags on ARM64 Mozilla: Information disclosure due to manipulated URL object Mozilla: Use-after-free in nsGlobalWindowInner Mozilla: Use-After-Free when trying to connect to a STUN server Mozilla: Add-On updates did not respect the same certificate trust rules as software updates Mozilla: Automatic account setup leaks Microsoft Exchange login credentials
CVSS v3.1: 5.9
CVSS v3.0: 6.1
GHSA-4vw8-pffj-q9x7: Write what were condition within AMD CPUs may allow an admin-privileged attacker to modify the configuration of the CPU pipeline potentially resulting in the corruption of the stack pointer inside an SEV-SNP guest.
CVSS v4.0: 4.6
CVE-2024-4905: Kashipara College Management System view_students_each_detail.php sql injection
A vulnerability classified as critical has been found in Kashipara College Management System 1.0. Affected is an unknown function of the file view_students_each_detail.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-264438 is the identifier assigned to this vulnerability.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
CVE-2013-4789: SQL injection vulnerability in modules/rss/rss.php in Cotonti before 0.9.14 allows remote attackers to execute arbitrary SQL commands via the "c" parameter to index.php.
CVSS v2.0: 7.5
GHSA-3qjg-973r-4w6w: Microsoft Internet Explorer 6, 6 SP1, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka "Uninitialized Memory Corruption Vulnerability," a different vulnerability than CVE-2009-2530 and CVE-2009-2531.
GHSA-h9wr-4rpj-pqr5: PHP remote file inclusion vulnerability in index.php in KnowledgeBuilder, referred to as KnowledgeBase, allows remote attackers to execute arbitrary PHP code by modifying the page parameter to reference a URL on a remote web server that contains the code.
CVE-2024-32340: A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the WEBSITE TITLE parameter under the Menu module.
CVSS v3.1: 9.6
CVE-2023-50775: A cross-site request forgery (CSRF) vulnerability in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers to copy jobs.
CVSS v3.1: 4.3
CVE-2012-5819: FilesAnywhere does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS v3.1: 7.4
CVSS v2.0: 5.8
GHSA-6f22-c225-fcxm: Three os command injection vulnerabilities exist in the boa formWsc functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP requests can lead to arbitrary command execution. An attacker can send a series of HTTP requests to trigger these vulnerabilities.This command injection is related to the `localPin` request's parameter.
CVSS v3.1: 7.2
CVE-2015-2113: Unspecified vulnerability in HP Easy Deploy, as distributed standalone and in HP Easy Tools before 3.0.1.1650, on HP Thin Client t5540, t5740, and t5740e devices and HP Flexible Thin Client t510, t520, t610, t620, and t820 devices allows remote attackers to execute arbitrary code via unknown vectors.
CVSS v2.0: 10
GHSA-q99r-f9j3-2wg8: In phNciNfc_RecvMfResp of phNxpExtns_MifareStd.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-126204073
CVE-2024-6676: witmy my-springsecurity-plus user sql injection
A vulnerability has been found in witmy my-springsecurity-plus up to 2024-07-03 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /api/user. The manipulation of the argument params.dataScope leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The associated identifier of this vulnerability is VDB-271111.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
GHSA-99m8-724v-vh9j: On Windows endpoints, the SecureConnector agent must run under the local SYSTEM account or another administrator account in order to enable full functionality of the agent. The typical configuration is for the agent to run as a Windows service under the local SYSTEM account. The SecureConnector agent runs various plugin scripts and executables on the endpoint in order to gather and report information about the host to the CounterACT management appliance. The SecureConnector agent downloads these scripts and executables as needed from the CounterACT management appliance and runs them on the endpoint. The SecureConnector agent fails to set any permissions on downloaded file objects. This allows a malicious user to take ownership of any of these files and make modifications to it, regardless of where the files are saved. These files are then executed under SYSTEM privileges. A malicious unprivileged user can overwrite these executable files with malicious code before the SecureConnector agent executes them, causing the malicious code to be run under the SYSTEM account.
CVSS v3.0: 7.8
GHSA-34v4-wfhj-fm69: The Bouncy Bill Monster Smasher ed (aka mominis.Generic_Android.Bouncy_Bill_Monster_Smasher_Edition) application 1.0.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.