ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-wxmm-5qph-24v9: A segmentation violaton in the gf_hevc_read_sps_bs_internal function (media_tools/av_parsers.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying crafted HEVC SPS data.
CVSS v3.1: 7.5
GHSA-763c-c4vj-rprx: In TBD of TBD, there is a possible out of bounds write due to improper locking. This could lead to local escalation of privilege in the kernel with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-171315276References: N/A
CVE-2020-26825: SAP Fiori Launchpad (News tile Application), versions - 750,751,752,753,754,755, allows an unauthorized attacker to use SAP Fiori Launchpad News tile Application to send malicious code, to a different end user (victim), because News tile does not sufficiently encode user controlled inputs, resulting in Reflected Cross-Site Scripting (XSS) vulnerability. Information maintained in the victim's web browser can be read, modified, and sent to the attacker. The malicious code cannot significantly impact the victim's browser and the victim can easily close the browser tab to terminate it.
CVSS v3.0: 6.1
RHSA-2003:027: Red Hat Security Advisory: netscape security update
security flaw security flaw
GHSA-vmq4-8rg7-c56c: IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .pdf file, related to a "Read Access Violation starting at PDF!xmlGetGlobalState+0x000000000007dfa5."
CVSS v3.0: 7.8
CVE-2023-53132: scsi: mpi3mr: Fix mpi3mr_hba_port memory leak in mpi3mr_remove()
In the Linux kernel, the following vulnerability has been resolved:

scsi: mpi3mr: Fix mpi3mr_hba_port memory leak in mpi3mr_remove()

Free mpi3mr_hba_port at .remove.
CVSS v3.1: 5.5
GHSA-pfq9-gmxf-fp7r: In sdpu_find_most_specific_service_uuid of sdp_utils.cc, there is a possible way to crash Bluetooth due to a missing null check. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-227203684
CVSS v3.1: 5
CVE-2025-8447: Incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed read-only access
An improper access control vulnerability was identified in GitHub Enterprise Server that allowed users with access to any repository to retrieve limited code content from another repository by creating a diff between the repositories. To exploit this vulnerability, an attacker needed to know the name of a private repository along with its branches, tags, or commit SHAs that they could use to trigger compare/diff functionality and retrieve limited code without proper authorization. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.18, and was fixed in versions 3.14.17, 3.15.12, 3.16.8 and 3.17.5. This vulnerability was reported via the GitHub Bug Bounty program.
CVSS v4.0: 7
CVE-2021-30990: A logic issue was addressed with improved validation. This issue is fixed in macOS Monterey 12.1, Security Update 2021-008 Catalina, macOS Big Sur 11.6.2. A malicious application may bypass Gatekeeper checks.
CVSS v3.1: 5.5
CVSS v2.0: 4.3
GHSA-f25p-chr4-q25h: Huawei Mate 9 and Mate 9 pro smart phones with software the versions before MHA-AL00B 8.0.0.334(C00); the versions before LON-AL00B 8.0.0.334(C00) have a information leak vulnerability in the date service proxy implementation. An attacker may trick a user into installing a malicious application and application can exploit the vulnerability to get kernel date which may cause sensitive information leak.
CVSS v3.0: 5.5
GHSA-5pg8-f89x-wjcx: Credentials transmitted in plain text by Jenkins Logstash Plugin
Logstash Plugin stores credentials in its global configuration file `jenkins.plugins.logstash.LogstashConfiguration.xml` on the Jenkins controller as part of its configuration.While the credentials are stored encrypted on disk, they are transmitted in plain text as part of the configuration form by Logstash Plugin 2.3.1 and earlier. This can result in exposure of the credential through browser extensions, cross-site scripting vulnerabilities, and similar situations.Logstash Plugin 2.3.2 transmits the credentials in its global configuration encrypted.
CVSS v3.1: 3.1
GHSA-j4fm-3rjg-fhgc: A cross-site scripting (XSS) vulnerability in Assembly Software Trialworks v11.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the asset src parameter.
CVSS v3.1: 6.1
CVE-2025-1042: Files or Directories Accessible to External Parties in GitLab
An insecure direct object reference vulnerability in GitLab EE affecting all versions from 15.7 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to view repositories in an unauthorized way.
CVSS v3.1: 4.9
GHSA-9c95-pjg5-cj3r: A vulnerability in Cisco Ultra Services Framework Element Manager could allow an authenticated, remote attacker with access to the management network to log in to the affected device using default credentials present on the system, aka an Insecure Default Password Vulnerability. More Information: CSCvc76695. Known Affected Releases: 21.0.0.
CVSS v3.0: 8.8
GHSA-4v3j-q36m-pfpg: Windows Kerberos Elevation of Privilege Vulnerability.
CVSS v3.1: 8.8
CVE-2024-28886: OS command injection vulnerability exists in UTAU versions prior to v0.4.19. If a user of the product opens a crafted UTAU project file (.ust file), an arbitrary OS command may be executed.
CVSS v3.1: 8.4
GHSA-cfg9-hj54-h2q5: Hitachi Web Server 01-00 through 03-00-01, as used by certain Cosminexus products, does not properly validate SSL client certificates, which might allow remote attackers to spoof authentication via a client certificate with a forged signature.
CVE-2003-0324: Buffer overflows in EPIC IRC Client (EPIC4) 1.0.1 allows remote malicious IRC servers to cause a denial of service (crash) and possibly execute arbitrary code via long replies that are not properly handled by the (1) userhost_cmd_returned function, or (2) Statusbar capability.
CVSS v2.0: 7.5
CVE-2023-42438: An inconsistent user interface issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14.1. Visiting a malicious website may lead to user interface spoofing.
CVSS v3.1: 4.3
CVE-2023-28658: Insecure inherited permissions in some Intel(R) oneMKL software before version 2022.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS v3.1: 6.7
GHSA-j5jp-qgcc-m868: When a specific component is loaded a local attacker and is able to send a specially crafted request to this component, the attacker could gain elevated privileges on the affected system.
CVSS v3.0: 8.8
GHSA-xf28-8cq4-qppx: Sngrep v1.6.0 was discovered to contain a heap buffer overflow via the function capture_packet_reasm_ip at /src/capture.c.
CVSS v3.1: 7.8
CVE-2005-3082: SQL injection vulnerability in admin.php in SEO-Board 1.0.2 allows remote attackers to execute arbitrary SQL commands via the user_pass_sha1 value in a cookie.
CVSS v2.0: 7.5
GHSA-8v9x-9xqg-r8mr: Prototype pollution in json8-merge-patch
Prototype pollution vulnerability in json8-merge-patch npm package < 1.0.3 may allow attackers to inject or modify methods and properties of the global object constructor.
CVSS v3.1: 7.5
RHSA-2026:19354: Red Hat Security Advisory: PackageKit security update
PackageKit: race condition vulnerability leads to arbitrary package installation as root
CVSS v3.1: 8.8
CVE-2007-2681: Directory traversal vulnerability in blogs/index.php in b2evolution 1.6 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the core_subdir parameter.
CVSS v2.0: 7.5
CVE-2020-25613: An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack.
CVSS v3.1: 7.5
CVSS v2.0: 5
CVE-2021-23176: Improper access control in reporting engine of l10n_fr_fec module in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote authenticated users to extract accounting information via crafted RPC packets.
CVSS v3.0: 6.5
GHSA-fxxw-25rf-p8p4: Cross-site Scripting (XSS) in GitHub repository contao/contao prior to 4.13.3. Attacker can execute Malicious JS in Application :)
CVSS v3.1: 6.1
CVE-2014-4593: Cross-site scripting (XSS) vulnerability in wp-plugins-net/index.php in the WP Plugin Manager (wppm) plugin 1.6.4.b and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filter parameter.
CVSS v2.0: 4.3
CVE-2022-3984: Flowplayer Video Player < 1.0.5 - Contributor+ Stored XSS
The Flowplayer Video Player WordPress plugin before 1.0.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
CVSS v3.1: 5.4
CVE-2024-1019: WAF bypass of the ModSecurity v3 release line
ModSecurity / libModSecurity 3.0.0 to 3.0.11 is affected by a WAF bypass for path-based payloads submitted via specially crafted request URLs. ModSecurity v3 decodes percent-encoded characters present in request URLs before it separates the URL path component from the optional query string component. This results in an impedance mismatch versus RFC compliant back-end applications. The vulnerability hides an attack payload in the path component of the URL from WAF rules inspecting it. A back-end may be vulnerable if it uses the path component of request URLs to construct queries. Integrators and users are advised to upgrade to 3.0.12. The ModSecurity v2 release line is not affected by this vulnerability.
CVSS v3.1: 8.6
GHSA-jvg7-fwfr-45v2: Stack-based buffer overflow in swnet.dll in YaSoft Switch Off 2.3 and earlier allows remote authenticated users to execute arbitrary code via a long message parameter in a SendMsg action to action.htm.
GHSA-r2rp-7qxc-5hp6: SQL injection vulnerability in the zak_store_management extension 1.0.0 and earlier TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
GHSA-x2vc-c3wq-5j89: The Estatik Real Estate Plugin WordPress plugin before 4.1.1 does not sanitise and escape various parameters and generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS v3.1: 6.1
GHSA-8w65-8rxm-3qv7: Free Photo & Video Vault 0.0.2 contains a directory traversal web vulnerability that allows remote attackers to manipulate application path requests and access sensitive system files. Attackers can exploit the vulnerability without privileges to retrieve environment variables and access unauthorized system paths.
CVSS v4.0: 7.1
CVSS v3.1: 6.5
CVE-2008-0051: Integer overflow in CoreFoundation in Apple Mac OS X 10.4.11 might allow local users to execute arbitrary code via crafted time zone data.
CVSS v2.0: 6.9
CVE-2025-36082: IBM OpenPages information disclosure
IBM OpenPages 9.0 and 9.1 allows web page cache to be stored locally which can be read by another user on the system.
CVSS v3.1: 4
CVE-2017-1434: IBM DB2 for Linux, UNIX and Windows 11.1 (includes DB2 Connect Server) under unusual circumstances, could expose highly sensitive information in the error log to a local user.
CVSS v3.0: 4.7
CVSS v2.0: 2.1
CVE-2026-23810: Cross-BSSID GTK Re-encryption and Traffic Injection
A vulnerability in the packet processing logic may allow an authenticated attacker to craft and transmit a malicious Wi-Fi frame that causes an Access Point (AP) to classify the frame as group-addressed traffic and re-encrypt it using the Group Temporal Key (GTK) associated with the victim's BSSID. Successful exploitation may enable GTK-independent traffic injection and, when combined with a port-stealing technique, allows an attacker to redirect intercepted traffic to facilitate machine-in-the-middle (MitM) attacks across BSSID boundaries.
CVSS v3.1: 4.3
GHSA-g4v2-7mm9-mc58: An integer overflow in the RTPS protocol implementation of OpenDDS DDS before v3.33.0 allows attackers to cause a Denial of Service (DoS) via a crafted message.
CVSS v3.1: 7.5
CVE-2007-4620: Multiple stack-based buffer overflows in Computer Associates (CA) Alert Notification Service (Alert.exe) 8.1.586.0, 8.0.450.0, and 7.1.758.0, as used in multiple CA products including Anti-Virus for the Enterprise 7.1 through r11.1 and Threat Manager for the Enterprise 8.1 and r8, allow remote authenticated users to execute arbitrary code via crafted RPC requests.
CVSS v2.0: 9
GHSA-hq2j-69vq-qghc: A vulnerability was identified in CodeAstro Student Grading System 1.0. This issue affects some unknown processing of the file /adminLogin.php. Such manipulation of the argument staffId leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used.
CVSS v4.0: 5.5
CVSS v3.1: 7.3
GHSA-vqhp-cxgc-6wmm: regular expression denial-of-service (ReDoS) in Bleach
Impact`bleach.clean` behavior parsing style attributes could result in a regular expression denial of service (ReDoS).Calls to ``bleach.clean`` with an allowed tag with an allowed ``style`` attribute are vulnerable to ReDoS. For example, ``bleach.clean(..., attributes={'a': ['style']})``.Patches3.1.4Workaroundsdo not whitelist the style attribute in `bleach.clean` callslimit input string lengthReferenceshttps://bugzilla.mozilla.org/show_bug.cgi?id=1623633https://www.regular-expressions.info/redos.htmlhttps://blog.r2c.dev/posts/finding-python-redos-bugs-at-scale-using-dlint-and-r2c/https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6817CreditsReported by schwag09 of r2cFor more informationIf you have any questions or comments about this advisory:Open an issue at https://github.com/mozilla/bleach/issuesEmail us at security@mozilla.org
CVSS v4.0: 8.7
CVSS v3.1: 7.5
CVE-2025-62802: DNN CKEditor Provider allows unauthenticated upload out-of-the-box
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 10.1.1, the out-of-box experience for HTML editing allows unauthenticated users to upload files. This opens a potential vector to other security issues and is not needed on most implementations. This vulnerability is fixed in 10.1.1.
CVSS v3.1: 4.3
GHSA-hx2c-xvp4-cgw4: In Wireshark 3.0.x before 3.0.8, the BT ATT dissector could crash. This was addressed in epan/dissectors/packet-btatt.c by validating opcodes.
GHSA-gpq5-r4xp-g48m: WebKit, as used in Apple iOS before 7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-09-18-2.
GHSA-wj7p-rvmc-9w83: Multiple cross-site scripting (XSS) vulnerabilities in Dokeos before 1.6.5 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2017-9880: IrfanView version 4.44 (32bit) with FPX Plugin 4.46 allows attackers to execute arbitrary code or cause a denial of service via a crafted .fpx file, related to "Data from Faulting Address controls Code Flow starting at FPX+0x0000000000007236."
CVSS v3.0: 7.8
CVSS v2.0: 6.8
CVE-2026-0115: In Trusted Execution Environment, there is a possible key leak due to side channel information disclosure. This could lead to physical information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.
CVSS v3.1: 2.1
GHSA-mq2g-mwpw-5386: A vulnerability in the web-based management interface of Cisco Small Business 200 Series Smart Switches, Cisco Small Business 300 Series Managed Switches, and Cisco Small Business 500 Series Stackable Managed Switches could allow an unauthenticated, remote attacker to render the web-based management interface unusable, resulting in a denial of service (DoS) condition. This vulnerability is due to improper validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to cause a permanent invalid redirect for requests sent to the web-based management interface of the device, resulting in a DoS condition.
CVE-2023-5704: CPO Shortcodes <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The CPO Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
CVE-2018-12310: Cross-site scripting in the Login page in ASUSTOR ADM version 3.1.1 allows attackers to execute JavaScript via the System Announcement feature.
CVSS v3.0: 5.4
CVSS v2.0: 3.5
CVE-2016-7169: Directory traversal vulnerability in the File_Upload_Upgrader class in wp-admin/includes/class-file-upload-upgrader.php in the upgrade package uploader in WordPress before 4.6.1 allows remote authenticated users to access arbitrary files via a crafted urlholder parameter.
CVSS v3.0: 6.3
CVSS v2.0: 6.5
GHSA-m5rc-2hfw-9w66: Buffer overflow in the Loader_XM::load_instrument_internal function in loader_xm.cpp for Cheese Tracker 0.9.9 and earlier allows user-assisted attackers to execute arbitrary code via a crafted file with a large amount of extra data.
CVE-2025-58998: WordPress s2Member Plugin <= 250701 - PHP Object Injection Vulnerability
Deserialization of Untrusted Data vulnerability in Cristián Lávaque s2Member s2member allows Object Injection.This issue affects s2Member: from n/a through <= 250701.
CVSS v3.1: 9.8
CVE-2026-21237: Windows Subsystem for Linux Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.
CVSS v3.1: 7
CVE-2025-42598: Multiple SEIKO EPSON printer drivers for Windows OS are configured with an improper access permission settings when installed or used in a language other than English. If a user is directed to place a crafted DLL file in a location of an attacker's choosing, the attacker may execute arbitrary code with SYSTEM privilege on a Windows system on which the printer driver is installed.
CVSS v4.0: 8.4
CVSS v3.1: 7.8
GHSA-335g-mg6r-4m22: The theplus_more_post AJAX action of The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.12 did not properly sanitise some of its fields, leading to a reflected Cross-Site Scripting (exploitable on both unauthenticated and authenticated users)
GHSA-9v2x-grf3-hfq7: The DbgMsg.sys driver in Compuware SoftICE DriverStudio 3.1 and 3.2 allows remote attackers to cause a denial of service (application crash) via an invalid Debug Message pointer.
GHSA-wqgf-h892-f3cp: Format string vulnerability in the LogVHdrMessageVerb function in os/log.c in X.Org X11 1.11 allows attackers to cause a denial of service or possibly execute arbitrary code via format string specifiers in an input device name.
CVE-2026-11057: Uninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
CVSS v3.1: 6.5
CVE-2014-1935: 9base 1:6-6 and 1:6-7 insecurely creates temporary files which results in predictable filenames.
CVSS v3.1: 5.3
CVSS v2.0: 5
GHSA-6v6r-j7gc-grxj: Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-2799, CVE-2014-4059, CVE-2014-4065, CVE-2014-4079, CVE-2014-4081, CVE-2014-4083, CVE-2014-4085, CVE-2014-4088, CVE-2014-4090, CVE-2014-4094, CVE-2014-4097, CVE-2014-4100, CVE-2014-4103, CVE-2014-4104, CVE-2014-4105, CVE-2014-4106, CVE-2014-4107, CVE-2014-4109, CVE-2014-4110, and CVE-2014-4111.
GHSA-f74w-272x-mqcv: NocoDB: Refresh Token Cookie Set Without `secure` and `sameSite` Flags
SummaryThe refresh-token cookie was set with `httpOnly: true` but missing both the `secure` flag and the `sameSite` attribute. Over plain HTTP the cookie could be intercepted on the network; without `sameSite`, browsers attached it to cross-site POSTs, enabling CSRF against the token-refresh endpoint.DetailsIn `packages/nocodb/src/services/users/helpers.ts`, `setTokenCookie` produced the cookie with only `httpOnly`, an `expires` date, and an optional `domain` from `NC_BASE_HOST_NAME` — no `secure`, no `sameSite`. The refresh endpoint `POST /api/v2/auth/token/refresh` (`auth.controller.ts`) read the cookie unconditionally and returned a new JWT, with no CSRF token.The fix sets `httpOnly: true`, `sameSite: 'lax'`, and conditional `secure: req.ncSiteUrl.startsWith('https')` so the flag is active under HTTPS while still functional on plain-HTTP localhost development.This is distinct from GHSA-x4vh-j75g-268g (refresh-token lifecycle on password reset) — different root cause, different attack vector.ImpactCookie interception on plain HTTP networks (no `secure`).Cross-site refresh: malicious cross-origin pages could trigger token refresh and, combined with any same-origin XSS or open-redirect on the NocoDB domain, capture the new JWT.Refresh tokens have multi-day expiry (`NC_REFRESH_TOKEN_EXP_IN_DAYS`), so the exposure window is long.CreditThis issue was reported by [@ik0z](https://github.com/ik0z).
CVSS v3.1: 5.4
GHSA-98c9-6pp5-rhr8: Automated Logic Corporation (ALC) WebCTRL System 6.5 and prior allows remote attackers to execute any JavaScript code via a XSS payload for the first parameter in a GET request.
CVE-2013-1956: The create_user_ns function in kernel/user_namespace.c in the Linux kernel before 3.8.6 does not check whether a chroot directory exists that differs from the namespace root directory, which allows local users to bypass intended filesystem restrictions via a crafted clone system call.
CVSS v2.0: 2.1
CVE-2017-0207: Microsoft Outlook for Mac 2011 allows remote attackers to spoof web content via a crafted email with specific HTML tags, aka "Microsoft Browser Spoofing Vulnerability."
CVSS v3.0: 6.5
CVSS v2.0: 4.3
GHSA-4rvm-66vq-v2f2: Whale browser before 3.12.129.18 allowed extensions to replace JavaScript files of the HWP viewer website which could access to local HWP files. When the HWP files were opened, the replaced script could read the files.
CVSS v3.1: 6.5
RHSA-2020:1512: Red Hat Security Advisory: java-1.8.0-openjdk security update
OpenJDK: Misplaced regular expression syntax error check in RegExpScanner (Scripting, 8223898) OpenJDK: Incorrect handling of empty string nodes in regular expression Parser (Scripting, 8223904) OpenJDK: Incorrect handling of references to uninitialized class descriptors during deserialization (Serialization, 8224541) OpenJDK: Uncaught InstantiationError exception in ObjectStreamClass (Serialization, 8224549) OpenJDK: Unexpected exceptions raised by DOMKeyInfoFactory and DOMXMLSignatureFactory (Security, 8231415) OpenJDK: Re-use of single TLS session for new connections (JSSE, 8234408) OpenJDK: CRLF injection into HTTP headers in HttpServer (Lightweight HTTP Server, 8234825) OpenJDK: Incorrect bounds checks in NIO Buffers (Libraries, 8234841) OpenJDK: Incorrect type checks in MethodType.readObject() (Libraries, 8235274) OpenJDK: Regular expression DoS in Scanner (Concurrency, 8236201)
CVSS v3.1: 5.3
CVE-2022-26640: TP-LINK TL-WR840N(ES)_V6.20 was discovered to contain a buffer overflow via the minAddress parameter.
CVSS v3.1: 7.2
CVSS v2.0: 6.5