ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2007-1337: The virtual machine process (VMX) in VMware Workstation before 5.5.4 does not properly read state information when moving from the ACPI sleep state to the run state, which allows attackers to cause a denial of service (virtual machine reboot) via unknown vectors.
CVSS v2.0: 7.8
GHSA-p7gr-f84w-hqg5: OpenClaw's sandboxed sessions_spawn now enforces sandbox inheritance for cross-agent spawns
SummaryA sandboxed session could use cross-agent `sessions_spawn` to create a child under an agent configured with `sandbox.mode="off"`, downgrading runtime confinement.ImpactIn mixed-agent setups that allow cross-agent spawning, a sandboxed requester could escape into an unsandboxed child runtime.FixSpawn-time sandbox inheritance is now enforced: if the requester is sandboxed and the resolved child runtime would be unsandboxed, spawn is rejected.Affected and Patched VersionsAffected: `<= 2026.2.26`Patched: `2026.3.1`
CVSS v4.0: 6.9
CVE-2020-28387: A vulnerability has been identified in Solid Edge SE2020 (All Versions < SE2020MP13), Solid Edge SE2021 (All Versions < SE2021MP3). When opening a specially crafted SEECTCXML file, the application could disclose arbitrary files to remote attackers. This is because of the passing of specially crafted content to the underlying XML parser without taking proper restrictions such as prohibiting an external dtd. (ZDI-CAN-11923)
CVSS v3.1: 5.5
CVSS v2.0: 4.3
GHSA-6g4x-g72v-hmxh: The WP Dream Carousel WordPress plugin through 1.0.1b does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS v3.1: 6.1
GHSA-hr9v-r8r2-hg7j: Shopper: Multiple data integrity and disclosure issues in admin Livewire components
ImpactThree related defects on admin Livewire components allowed data tampering, sensitive data disclosure, and stored XSS:**IDOR via unlocked properties.** Several Livewire components in the admin panel exposed Eloquent model identifiers as public properties without the `#[Locked]` attribute. An authenticated user could rewrite the wire payload from the browser to target any record id, bypassing the implicit scoping enforced by the page routing.**Sensitive data echoed back through Hidden form field.** `Customers/Create::store()` re-passed a `Hidden` `_password` form field straight into the create payload. The plaintext password was rendered into the HTML and transported through the Livewire snapshot in clear text, exposing credentials in the page DOM and in any logging that captures Livewire payloads.**Stored XSS on product barcode.** The product barcode field was rendered through `DNS1DFacade::getBarcodeHTML()` with `{!! !!}`. An attacker with `edit_products` permission could persist malicious payload in the barcode field that would execute in the browser of any admin user viewing that product, enabling session theft and privileged-action chaining.PatchesFixed in `v2.8.0`:All vulnerable Livewire model identifiers are now marked `#[Locked]`.`Customers/Create` no longer round-trips the password through a Hidden form field; the plaintext password is hashed at action boundary and never returned to the client.The product barcode rendering now escapes the value before passing it to the barcode generator and the output is wrapped in an `<svg>` context that does not interpret event handlers.Upgrade via:WorkaroundsNone. Upgrade to `v2.8.0`.
CVSS v3.1: 8.7
CVE-2020-13496: An exploitable vulnerability exists in the way Pixar OpenUSD 20.05 handles parses certain encoded types. A specially crafted malformed file can trigger an arbitrary out of bounds memory access in TfToken Type Index. This vulnerability could be used to bypass mitigations and aid further exploitation. To trigger this vulnerability, the victim needs to access an attacker-provided malformed file.
CVSS v3.0: 4.3
GHSA-p3xm-9632-5464: Tenda AC500 V2.0.1.9(1307) firmware contains a command injection vulnerablility in the formexeCommand function via the cmdinput parameter.
CVSS v3.1: 3.8
CVE-2020-12861: A heap buffer overflow in SANE Backends before 1.0.30 allows a malicious device connected to the same local network as the victim to execute arbitrary code, aka GHSL-2020-080.
CVSS v3.1: 8.8
CVSS v2.0: 7.9
CVE-2021-1343: Cisco Small Business RV Series Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly. These vulnerabilities are due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a denial of service (DoS) condition. To exploit these vulnerabilities, an attacker would need to have valid administrator credentials on the affected device.
CVSS v3.1: 7.2
CVE-2007-1058: SQL injection vulnerability in user_pages/page.asp in Online Web Building 2.0 allows remote attackers to execute arbitrary SQL commands via the art_id parameter.
CVSS v2.0: 7.5
GHSA-8c6h-67j6-4ffm: SMTP service in MailEnable Standard, Professional, and Enterprise before ME-10014 (20060904) allows remote attackers to cause a denial of service via an SPF lookup for a domain with a large number of records, which triggers a null pointer exception.
CVE-2018-20712: A heap-based buffer over-read exists in the function d_expression_1 in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31.1. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by c++filt.
CVSS v3.0: 6.5
CVSS v2.0: 4.3
CVE-2020-19752: The find_color_or_error function in gifsicle 1.92 contains a NULL pointer dereference.
CVSS v3.1: 7.5
CVSS v2.0: 5
CVE-2009-1228: Cross-site scripting (XSS) vulnerability in register.php in Arcadwy Arcade Script CMS allows remote attackers to inject arbitrary web script or HTML via the username field (user_name parameter).
CVSS v2.0: 4.3
CVE-2025-43323: This issue was addressed with additional entitlement checks. This issue is fixed in iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. An app may be able to fingerprint the user.
CVSS v3.1: 8.1
CVE-2017-14612: "Shpock Boot Sale & Classifieds" app before 3.17.0 -- aka shpock-boot-sale-classifieds/id557153158 -- for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v3.0: 5.9
CVSS v2.0: 4.3
CVE-2007-1961: PHP remote file inclusion vulnerability in mutant_functions.php in the Mutant 0.9.2 portal for phpBB 2.2 allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
CVSS v2.0: 7.5
GHSA-p2wj-9vfc-2xj7: NULL Pointer Dereference in mrb_vm_exec with super in GitHub repository mruby/mruby prior to 3.2. This vulnerability is capable of making the mruby interpreter crash, thus affecting the availability of the system.
CVSS v3.1: 6.5
GHSA-hfx3-365h-vfrv: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.0 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions, could have allowed an authenticated user to perform server-side request forgery against internal services by bypassing protections in the Git repository import functionality.
CVSS v3.1: 4.3
CVE-2025-32919: Privilege Escalation in Windows License plugin for Checkmk Windows Agent
Use of an insecure temporary directory in the Windows License plugin for the Checkmk Windows Agent allows Privilege Escalation. This issue affects Checkmk: from 2.4.0 before 2.4.0p13, from 2.3.0 before 2.3.0p38, from 2.2.0 before 2.2.0p46, and all versions of 2.1.0 (EOL).
CVSS v4.0: 8.8
RHSA-2019:1477: Red Hat Security Advisory: chromium-browser security update
chromium-browser: Use after free in ServiceWorker chromium-browser: Use after free in Download Manager chromium-browser: Incorrectly credentialed requests in CORS chromium-browser: Incorrect map processing in V8 chromium-browser: Incorrect CORS handling in XHR chromium-browser: Inconsistent security UI placement chromium-browser: Out of bounds read in Swiftshader chromium-browser: Heap buffer overflow in Angle chromium-browser: Cross-origin resources size disclosure in Appcache chromium-browser: Overly permissive tab access in Extensions chromium-browser: Incorrect handling of certain code points in Blink chromium-browser: Popup blocker bypass
CVSS v3.0: 4.3
GHSA-3v8h-mfmh-c8vc: Substance3D - Modeler versions 1.22.5 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 5.5
GHSA-vp84-p7v4-wj2g: Deserialization of Untrusted Data vulnerability in Arraytics Eventin wp-event-solution allows Object Injection.This issue affects Eventin: from n/a through <= 4.1.1.
CVSS v3.1: 8.8
GHSA-cpfh-q3v8-wj73: A denial-of-service (DoS) vulnerability in the Advanced DNS Security (ADNS) feature of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker to initiate system reboots using a maliciously crafted packet. Repeated attempts to initiate a reboot causes the firewall to enter maintenance mode.Cloud NGFW and Prisma Access® are not impacted by this vulnerability.
CVSS v4.0: 6.6
GHSA-hx2j-xhcm-gv72: The 
iSherlock developed by HGiga  has an OS Command Injection vulnerability, allowing unauthenticated local attackers to inject arbitrary OS commands and execute them on the server.
CVSS v4.0: 10
CVSS v3.1: 9.8
GHSA-24c9-7g9h-vmm8: Multiple stack-based buffer overflows in EpicDJSoftware EpicVJ 1.2.8.0 and 1.3.1.2 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long string in a (1) .m3u or (2) .mpl playlist file.
GHSA-4j3v-h4q8-j269: Tenda AX3 v16.03.12.11 was discovered to contain a remote code execution (RCE) vulnerability via the list parameter at /goform/SetNetControlList.
CVSS v3.1: 9.8
GHSA-r27j-r277-j56h: CSS-based exfiltration of the content from partially encrypted emails when allowing remote content. This vulnerability affects Thunderbird < 147.0.1 and Thunderbird < 140.7.1.
CVSS v3.1: 4.3
GHSA-3mg6-92v8-8wgc: Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite 7.4.1 allows remote attackers to inject arbitrary web script or HTML via the title in a mail filter rule.
CVE-2025-15310: Tanium addressed a local privilege escalation vulnerability in Patch Endpoint Tools.
Tanium addressed a local privilege escalation vulnerability in Patch Endpoint Tools.
CVSS v3.1: 7.8
CVE-2023-1175: Incorrect Calculation of Buffer Size in vim/vim
Incorrect Calculation of Buffer Size in GitHub repository vim/vim prior to 9.0.1378.
CVSS v3.0: 7.3
CVE-2025-8399: Mmm Unity Loader <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via attributes Parameter
The Mmm Unity Loader plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘attributes’ parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
GHSA-fr3w-2p22-6w7p: URL Redirection to Untrusted Site in OAuth2/OpenID in directus
SummaryThe authentication API has a `redirect` parameter that can be exploited as an open redirect vulnerability as the user tries to log in via the API URL https://docs.directus.io/reference/authentication.html#login-using-sso-providers /auth/login/google?redirect for example.DetailsThere's a redirect that is done after successful login via the Auth API GET request to `directus/auth/login/google?redirect=http://malicious-fishing-site.com`, which I think is here: https://github.com/directus/directus/blob/main/api/src/auth/drivers/oauth2.ts#L394. While credentials don't seem to be passed to the attacker site, the user can be phished into clicking a legitimate directus site and be taken to a malicious site made to look like a an error message "Your password needs to be updated" to phish out the current password.PoCTurn on any auth provider in Directus instance. Form a link to `directus-instance/auth/login/:provider_id?redirect=http://malicious-fishing-site.com`, login and get taken to malicious-site. Tested on the `ory` OAuth2 integration.ImpactUsers who login via OAuth2 into Directus.
CVSS v3.1: 5.4
GHSA-x732-6j76-qmhm: Better Auth's rou3 Dependency has Double-Slash Path Normalization which can Bypass disabledPaths Config and Rate Limits
SummaryAn issue in the underlying router library **rou3** can cause `/path` and `//path` to be treated as identical routes. If your environment does **not** normalize incoming URLs (e.g., by collapsing multiple slashes), this can allow bypasses of `disabledPaths` and path-based rate limits.DetailsBetter Auth uses **better-call**, which internally relies on **rou3** for routing. Affected versions of rou3 normalize paths by removing empty segments. As a result:`/sign-in/email``//sign-in/email``///sign-in/email`…all resolve to the same route.Some production setups *automatically* collapse multiple slashes. This includes:Vercel with Nextjs (default)Cloudflare - when normalize to urls origin is enabled (https://developers.cloudflare.com/rules/normalization/settings/#normalize-urls-to-origin)In these environments and other configurations where `//path` reach Better Auth as `/path`, the issue does not apply.FixUpdating rou3 to the latest version resolves the issue:better-call previously depended on `"rou3": "^0.5.1"`The fix was introduced after that version
(commit: [https://github.com/h3js/rou3/commit/f60b43fa648399534507c9ac7db36d705b8874c3](https://github.com/h3js/rou3/commit/f60b43fa648399534507c9ac7db36d705b8874c3))Better Auth recommends:**Upgrading to Better Auth v1.4.5 or later**, which includes the updated rou3.Ensuring the proxy normalizes URLs.If project maintainers cannot upgrade yet, they can protect their app by normalizing url before it reaches better-auth handler. See example below:ImpactBypass `disabledPaths`Bypass path-based rate limitsThe impact of bypassing disabled paths could vary based on a project's configuration.
CVSS v3.1: 8.6
RHSA-2010:0528: Red Hat Security Advisory: avahi security update
avahi: remote DoS via legacy unicast mDNS queries avahi: assertion failure after receiving a packet with corrupted checksum
CVE-2015-2005: IBM Security QRadar SIEM 7.1.x before 7.1 MR2 Patch 12 and 7.2.x before 7.2.5 Patch 6 does not properly expire sessions, which allows remote attackers to obtain sensitive information by leveraging an unattended workstation.
CVSS v3.0: 5.3
CVSS v2.0: 5
RHSA-2022:5057: Red Hat Security Advisory: cups security update
cups: authorization bypass when using "local" authorization
CVSS v3.1: 6.7
RHSA-2020:2792: Red Hat Security Advisory: OpenShift Container Platform 4.4.11 grafana-container security update
grafana: SSRF incorrect access control vulnerability allows unauthenticated users to make grafana send HTTP requests to any URL
CVSS v3.1: 8.2
CVE-2019-13220: Use of uninitialized stack variables in the start_decoder function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of service or disclose sensitive information by opening a crafted Ogg Vorbis file.
CVSS v3.1: 7.1
CVSS v2.0: 5.8
RHSA-2026:9836: Red Hat Security Advisory: kernel security update
kernel: macvlan: fix possible UAF in macvlan_forward_source() kernel: net/sched: cls_u32: use skb_header_pointer_careful() kernel: kernel: Privilege escalation or denial of service via use-after-free in nf_tables_addchain()
CVSS v3.1: 7.5
GHSA-mvfx-pprq-hjfm: A vulnerability was found in FFmpeg 2.0. It has been declared as problematic. Affected by this vulnerability is the function truemotion1_decode_header of the component Truemotion1 Handler. The manipulation leads to memory corruption. The attack can be launched remotely. It is recommended to apply a patch to fix this issue.
CVSS v3.1: 5.5
CVE-2024-31442: Redon-Hub has incorrect permissions on all admin related commands
Redon Hub is a Roblox Product Delivery Bot, also known as a Hub. In all hubs before version 1.0.2, all commands are capable of being ran by all users, including admin commands. This allows users to receive products for free and delete/create/update products/tags/etc. The only non-affected command is `/products admin clear` as this was already programmed for bot owners only. All users should upgrade to version 1.0.2 to receive a patch.
CVSS v3.1: 8.8
CVE-2022-4747: Post Category Image With Grid and Slider < 1.4.8 - Contributor+ Stored XSS via Shortcode
The Post Category Image With Grid and Slider WordPress plugin before 1.4.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CVSS v3.1: 5.4
GHSA-f8w3-m58c-6w36: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Noah Hearle, Design Extreme We’re Open! plugin <= 1.46 versions.
CVSS v3.1: 5.9
GHSA-22rx-39m3-hr5w: bsdtar in libarchive before 3.2.0 returns a success code without filling the entry when the header is a "split file in multivolume RAR," which allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted rar file.
CVSS v3.0: 6.5
CVE-2000-0012: Buffer overflow in w3-msql CGI program in miniSQL package allows remote attackers to execute commands.
CVSS v2.0: 10
CVE-2022-43477: Incomplete cleanup for some Intel Unison software may allow an authenticated user to potentially enable information disclosure via local access.
CVSS v3.1: 3.3
CVE-2024-0163: Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain a TOCTOU race condition vulnerability. A local low privileged attacker could potentially exploit this vulnerability to gain access to otherwise unauthorized resources.
CVSS v3.1: 5.3
GHSA-hhhp-jpjm-pg9w: ccnl-ext-mgmt.c in CCN-lite before 2.00 allows context-dependent attackers to have unspecified impact by leveraging missing NULL pointer checks after ccnl_malloc.
CVSS v3.0: 9.8
CVE-2025-53238: WordPress Toast Mobile Menu plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Toast Plugins Toast Mobile Menu toast-responsive-menu allows Stored XSS.This issue affects Toast Mobile Menu: from n/a through <= 1.0.8.
CVSS v3.1: 7.1
GHSA-w7jw-mp2h-ch44: Missing Authorization vulnerability in WP iCal Availability WP iCal Availability allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP iCal Availability: from n/a through 1.0.3.
CVSS v3.1: 5.4
CVE-2023-52306: FPE in paddle.lerp
FPE in paddle.lerp in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.




CVSS v3.1: 4.7
GHSA-28qh-fm59-ff8g: The HTTP server in Linksys SPA-921 VoIP Desktop Phone allows remote attackers to cause a denial of service (reboot) via (1) a long URL, or a long (2) username or (3) password during Basic Authentication.
GHSA-hc9m-j5rq-cphm: Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Server-Side Request Forgery: Elatec V-2023-014.
CVSS v3.1: 9.8
CVE-2026-58289: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVSS v3.1: 9
CVE-2022-48724: iommu/vt-d: Fix potential memory leak in intel_setup_irq_remapping()
In the Linux kernel, the following vulnerability has been resolved:

iommu/vt-d: Fix potential memory leak in intel_setup_irq_remapping()

After commit e3beca48a45b ("irqdomain/treewide: Keep firmware node
unconditionally allocated"). For tear down scenario, fn is only freed
after fail to allocate ir_domain, though it also should be freed in case
dmar_enable_qi returns error.

Besides free fn, irq_domain and ir_msi_domain need to be removed as well
if intel_setup_irq_remapping fails to enable queued invalidation.

Improve the rewinding path by add out_free_ir_domain and out_free_fwnode
lables per Baolu's suggestion.
CVSS v3.1: 5.5
GHSA-qf4q-pcx7-r6cj: Multiple cross-site request forgery (CSRF) vulnerabilities in FreePBX 2.5.1, and other 2.4.x, 2.5.x, and pre-release 2.6.x versions, allow remote attackers to hijack the authentication of admins for requests that create a new admin account or have unspecified other impact.
GHSA-c4qg-278v-p8ch: SWAT 4 1.1 and earlier allows remote attackers to cause a denial of service (daemon crash) via a (1) VERIFYCONTENT or (2) GAMECONFIG command sent to the server before user session initialization, which triggers a NULL pointer dereference; or (3) a GAMESPYRESPONSE command followed by a long RS string.
GHSA-rg26-mjfp-w32q: IBM Spectrum Scale 4.1.1 before 4.1.1.4, and 4.2.0.0, allows remote authenticated users to discover object-storage admin passwords via unspecified vectors.
CVSS v3.0: 6.5
CVE-2024-45828: i3c: mipi-i3c-hci: Mask ring interrupts before ring stop request
In the Linux kernel, the following vulnerability has been resolved:

i3c: mipi-i3c-hci: Mask ring interrupts before ring stop request

Bus cleanup path in DMA mode may trigger a RING_OP_STAT interrupt when
the ring is being stopped. Depending on timing between ring stop request
completion, interrupt handler removal and code execution this may lead
to a NULL pointer dereference in hci_dma_irq_handler() if it gets to run
after the io_data pointer is set to NULL in hci_dma_cleanup().

Prevent this my masking the ring interrupts before ring stop request.
CVSS v3.1: 5.5
CVE-2021-38875: IBM MQ 8.0, 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.1 CD, and 9.2 CD is vulnerable to a denial of service attack caused by an error processing messages. IBM X-Force ID: 208398.
CVSS v3.0: 6.5
GHSA-mr5h-jvqg-8jg8: KEPServerEX v6.0 to v6.9, ThingWorx Kepware Server v6.8 and v6.9, ThingWorx Industrial Connectivity (all versions), OPC-Aggregator (all versions), Rockwell Automation KEPServer Enterprise, GE Digital Industrial Gateway Server v7.68.804 and v7.66, and Software Toolbox TOP Server all 6.x versions, are vulnerable to a heap-based buffer overflow. Opening a specifically crafted OPC UA message could allow an attacker to crash the server and potentially leak data.
CVE-2024-8955: SSRF in composiohq/composio
A Server-Side Request Forgery (SSRF) vulnerability exists in composiohq/composio version v0.4.4. This vulnerability allows an attacker to read the contents of any file in the system by exploiting the BROWSERTOOL_GOTO_PAGE and BROWSERTOOL_GET_PAGE_DETAILS actions.
CVSS v3.0: 6.8
PYSEC-2018-87: Mercurial version 4.5 and earlier contains a Incorrect Access Control (CWE-285) vulnerability in Protocol server that can result in Unauthorized data access. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in 4.5.1.
CVE-2008-2881: Relative Real Estate Systems 3.0 and earlier stores passwords in cleartext in a MySQL database, which allows context-dependent attackers to obtain sensitive information.
CVSS v2.0: 5
CVE-2016-9332: An issue was discovered in Moxa SoftCMS versions prior to Version 1.6. Moxa SoftCMS Webserver does not properly validate input. An attacker could provide unexpected values and cause the program to crash or excessive consumption of resources could result in a denial-of-service condition.
CVSS v3.0: 7.5
CVSS v2.0: 7.8