ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-r9x3-v3cq-9vm6: The Code Signing feature in Apple OS X before 10.10 does not properly handle incomplete resource envelopes in signed bundles, which allows remote attackers to bypass intended app-author restrictions by omitting an execution-related resource.
GHSA-q8q4-fh2x-97q3: IBM Security Access Manager for Web stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referer header or browser history.
CVSS v3.0: 3.7
RHSA-2026:25127: Red Hat Security Advisory: Submariner v0.21 security fixes and container updates
github.com/containerd/containerd: containerd local privilege escalation golang: net/url: Memory exhaustion in query parameter parsing in net/url golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption github.com/coredns/coredns/core/dnsserver: CoreDNS DoS via unbounded connections and oversized messages urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) net/url: Incorrect parsing of IPv6 host literals in net/url github.com/coredns/coredns: CoreDNS: DNS access control bypass due to plugin execution order flaw github.com/coredns/coredns: CoreDNS: Denial of Service vulnerability due to predictable pseudo-random number generation crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building github.com/coredns/coredns: CoreDNS: Denial of Service via oversized DNS-over-HTTPS GET requests google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object github.com/coredns/coredns: CoreDNS: Authentication bypass allows unauthorized access to TSIG-protected functionalities
CVSS v3.1: 7.5
CVE-2021-39890: It was possible to bypass 2FA for LDAP users and access some specific pages with Basic Authentication in GitLab 14.1.1 and above.
CVSS v3.1: 3.1
GHSA-hhgm-j3w3-6p82: PHP remote file inclusion vulnerability in src/browser/resource/categories/resource_categories_view.php in Open Digital Assets Repository System (ODARS) 1.0.2, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the CLASSES_ROOT parameter.
GHSA-38cq-vhgw-c99f: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vadim Bogaiskov Bg Church Memos allows DOM-Based XSS. This issue affects Bg Church Memos: from n/a through 1.1.
CVSS v3.1: 6.5
GHSA-x448-v69g-qrm7: Unspecified vulnerability in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors, aka ZDI-CAN-2008.
CVE-2024-27028: spi: spi-mt65xx: Fix NULL pointer access in interrupt handler
In the Linux kernel, the following vulnerability has been resolved:

spi: spi-mt65xx: Fix NULL pointer access in interrupt handler

The TX buffer in spi_transfer can be a NULL pointer, so the interrupt
handler may end up writing to the invalid memory and cause crashes.

Add a check to trans->tx_buf before using it.
CVSS v3.1: 6.5
CVE-2011-4086: The journal_unmap_buffer function in fs/jbd2/transaction.c in the Linux kernel before 3.3.1 does not properly handle the _Delay and _Unwritten buffer head states, which allows local users to cause a denial of service (system crash) by leveraging the presence of an ext4 filesystem that was mounted with a journal.
CVSS v2.0: 4.9
GHSA-6954-ggjw-f22g: The ConnectWise Automate Agent does not fully verify the authenticity of files downloaded from the server, such as updates, dependencies, and integrations. This creates a risk where an on-path attacker could perform a man-in-the-middle attack and substitute malicious files for legitimate ones by impersonating a legitimate server. This risk is mitigated when HTTPS is enforced and is related to CVE-2025-11492.
CVSS v3.1: 8.8
GHSA-ggq8-68rx-f2hp: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BestiaDurmiente Visit Counter allows Stored XSS. This issue affects Visit Counter: from n/a through 1.0.
CVSS v3.1: 7.1
GHSA-7whm-p3g6-xq8q: Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, allows remote authenticated users to cause a denial of service (memory consumption) via a large size in an image request.
CVE-2007-2456: Multiple PHP remote file inclusion vulnerabilities in FireFly 1.1.01 allow remote attackers to execute arbitrary PHP code via a URL in the doc_root parameter to (1) localize.php or (2) config.php in modules/admin/include/.
CVSS v2.0: 7.5
GHSA-w37p-9fqc-g3gp: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP 2FA allows Reflected XSS.This issue affects WP 2FA: from n/a through 2.6.2.
CVSS v3.1: 7.1
CVE-2020-3174: Cisco NX-OS Software Anycast Gateway Invalid ARP Vulnerability
A vulnerability in the anycast gateway feature of Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a device to learn invalid Address Resolution Protocol (ARP) entries. The ARP entries are for nonlocal IP addresses for the subnet. The vulnerability is due to improper validation of a received gratuitous ARP (GARP) request. An attacker could exploit this vulnerability by sending a malicious GARP packet on the local subnet to cause the ARP table on the device to become corrupted. A successful exploit could allow the attacker to populate the ARP table with incorrect entries, which could lead to traffic disruptions.
CVSS v3.0: 4.7
GHSA-62cp-mf64-qf99: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal AppExperts appexperts allows SQL Injection.This issue affects AppExperts: from n/a through <= 1.4.5.
CVSS v3.1: 8.5
GHSA-fc6j-w9hx-r5xv: A lack of rate limiting in pjActionAJaxSend in Availability Booking Calendar 5.0 allows attackers to cause resource exhaustion.
CVSS v3.1: 7.5
CVE-2005-2923: The IMAP server in IMail Server 8.20 in Ipswitch Collaboration Suite (ICS) before 2.02 allows remote attackers to cause a denial of service (crash) via a long argument to the LIST command, which causes IMail Server to reference invalid memory.
CVSS v2.0: 4
GHSA-2m9g-77jc-r67p: Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1772, CVE-2014-1780, CVE-2014-1794, CVE-2014-1802, CVE-2014-2756, CVE-2014-2763, CVE-2014-2764, CVE-2014-2769, and CVE-2014-2771.
CVE-2018-14885: Incorrect access control in the database manager component in Odoo Community 10.0 and 11.0 and Odoo Enterprise 10.0 and 11.0 allows a remote attacker to restore a database dump without knowing the super-admin password. An arbitrary password succeeds.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
GHSA-grmv-p9vf-x5xx: Gesior-AAC before 2019-05-01 allows serviceID SQL injection in accountmanagement.php.
CVSS v3.0: 9.8
GHSA-2hv5-gqgx-ppf5: IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2.5 through 2.5.0.9 and 2.4 through 2.4.0.5 could allow a local user to obtain sensitive information from SessionManagement cookies. IBM X-Force ID: 162259.
RHSA-2024:8617: Red Hat Security Advisory: kernel security update
kernel: tty: Fix out-of-bound vmalloc access in imageblit kernel: ext4: turn quotas off if mount failed after enabling quotas hw: cpu: intel: Native Branch History Injection (BHI) kernel: tcp: add sanity checks to rx zerocopy kernel: mptcp: fix data re-injection from stale subflow kernel: af_unix: Fix garbage collector racing against connect() kernel: scsi: core: Fix unremoved procfs host directory regression kernel: mac802154: fix llsec key resources release in mac802154_llsec_key_del kernel: net/sched: taprio: extend minimum interval restriction to entire cycle too kernel: xfs: fix log recovery buffer allocation for the legacy h_size fixup kernel: netfilter: nft_inner: validate mandatory meta and payload kernel: USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages kernel: mptcp: ensure snd_una is properly initialized on connect kernel: ipv6: prevent possible NULL dereference in rt6_probe() kernel: ext4: do not create EA inode under buffer lock kernel: wifi: mt76: mt7921s: fix potential hung tasks during chip recovery kernel: net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() kernel: ext4: fix uninitialized ratelimit_state-&gt;lock access in __ext4_fill_super() kernel: netpoll: Fix race condition in netpoll_owner_active kernel: xfs: don&#39;t walk off the end of a directory data block kernel: xfs: add bounds checking to xlog_recover_process_data kernel: block: initialize integrity buffer to zero before writing it to media kernel: netfilter: flowtable: initialise extack before use
CVSS v3.1: 5.5
CVE-2025-1731: An incorrect permission assignment vulnerability in the PostgreSQL commands of the Zyxel USG FLEX H series uOS firmware versions from V1.20 through V1.31 could allow an authenticated local attacker with low privileges to gain access to the Linux shell and escalate their privileges by crafting malicious scripts or modifying system configurations with administrator-level access through a stolen token. Modifying the system configuration is only possible if the administrator has not logged out and the token remains valid.
CVSS v3.1: 7.8
CVE-2025-42875: Missing Authentication check in SAP NetWeaver Internet Communication Framework
The SAP Internet Communication Framework does not conduct any authentication checks for features that need user identification allowing an attacker to reuse authorization tokens, violating secure authentication practices causing low impact on Confidentiality, Integrity and Availability of the application.
CVSS v3.1: 6.6
CVE-2017-11894: ChakraCore, and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and and Internet Explorer adn Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to gain the same user rights as the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11886, CVE-2017-11889, CVE-2017-11890, CVE-2017-11893, CVE-2017-11895, CVE-2017-11901, CVE-2017-11903, CVE-2017-11905, CVE-2017-11907, CVE-2017-11908, CVE-2017-11909, CVE-2017-11910, CVE-2017-11911, CVE-2017-11912, CVE-2017-11913, CVE-2017-11914, CVE-2017-11916, CVE-2017-11918, and CVE-2017-11930.
CVSS v3.0: 7.5
CVSS v2.0: 7.6
GHSA-2cph-6c7j-7mmc: The jar protocol handler in Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 retrieves the inner URL regardless of its MIME type, and considers HTML documents within a jar archive to have the same origin as the inner URL, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a jar: URI.
CVE-2007-6736: Multiple directory traversal vulnerabilities in FTPServer.py in pyftpdlib before 0.2.0 allow remote authenticated users to access arbitrary files and directories via a .. (dot dot) in a (1) LIST, (2) STOR, or (3) RETR command.
CVSS v2.0: 6.5
GHSA-j3xh-c39x-qghw: Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specific project files. This could result in multiple out-of-bounds write instances. An attacker could leverage this vulnerability to execute code in the context of the current process.
CVSS v3.1: 7.8
CVE-2005-3688: Cross-site scripting (XSS) vulnerability in members.php in XMB 1.9.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the "Your Current Mood" field in the registration page.
CVSS v2.0: 4.3
CVE-2026-6022: Uncontrolled Resource Consumption Vulnerability in Telerik UI for ASP.NET AJAX
In Progress® Telerik® UI for AJAX prior to 2026.1.421, RadAsyncUpload contains an uncontrolled resource consumption vulnerability that allows file uploads to exceed the configured maximum size due to missing cumulative size enforcement during chunk reassembly, leading to disk space exhaustion.
CVSS v3.1: 7.5
GHSA-qxc6-6fhg-q3v6: The Data Dynamics ActiveBar ActiveX control (actbar3.ocx) 3.2 and earlier allows remote attackers to create or overwrite files via a full pathname in (1) the second argument to the Save method, or the first argument to the (2) SaveLayoutChanges or (3) SaveMenuUsageData method.
GHSA-q93r-m2rg-69pq: The Brisbane & Queensland Alert (aka com.queensland.alert) application 2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
GHSA-mpmg-7xg8-32q9: Auth. SQL Injection (SQLi) vulnerability in Quiz And Survey Master plugin <= 7.3.4 on WordPress.
CVSS v3.1: 7.2
CVE-2022-36221: Nokia Fastmile 3tg00118abad52 is affected by an authenticated path traversal vulnerability which allows attackers to read any named pipe file on the system.
CVSS v3.1: 6.5
GHSA-v93h-jxx8-f2rh: IBM DB2 8.x before 8.1 FixPak 15 and 9.1 before Fix Pack 2 does not properly terminate certain input strings, which allows local users to execute arbitrary code via unspecified environment variables that trigger a heap-based buffer overflow.
CVE-2016-0029: Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability," a different vulnerability than CVE-2016-0031.
CVSS v3.1: 6.1
CVSS v2.0: 4.3
CVE-2014-4808: Unspecified vulnerability in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF28, 8.0 through 8.0.0.1 CF14, and 8.5.0 before CF03 allows remote authenticated users to execute arbitrary code via unknown vectors.
CVSS v2.0: 6.5
ICSA-23-348-13: Siemens SICAM Q100 Devices
The web interface of the affected devices are vulnerable to Cross-Site Request Forgery attacks. By tricking an authenticated victim user to click a malicious link, an attacker could perform arbitrary actions on the device on behalf of the victim user. Affected devices are missing cookie protection flags when using the default settings. An attacker who gains access to a session token can use it to impersonate a legitimate application user.
CVSS v3.1: 5.5
GHSA-f6pf-4gjx-c94r: OpenClaw: Media Parsing Path Traversal Leads to Arbitrary File Read
SummaryOpenClaw <= 2026.3.24 Media Parsing Path Traversal to Arbitrary File ReadAffected Packages / VersionsPackage: `openclaw` (npm)Latest published npm version: `2026.3.31`Vulnerable version range: `<=2026.3.24`Patched versions: `>= 2026.3.28`First stable tag containing the fix: `v2026.3.28`Fix Commit(s)`4797bbc5b96e2cca5532e43b58915c051746fe37` — 2026-03-25T13:35:16-06:00Release Process NoteThe fix is already present in released version `2026.3.28`.
CVSS v4.0: 7.1
CVE-2019-3806: An issue has been found in PowerDNS Recursor versions after 4.1.3 before 4.1.9 where Lua hooks are not properly applied to queries received over TCP in some specific combination of settings, possibly bypassing security policies enforced using Lua.
CVSS v3.0: 5.4
CVE-2007-5350: Unspecified vulnerability in the Windows Advanced Local Procedure Call (ALPC) in the kernel in Microsoft Windows Vista allows local users to gain privileges via unspecified vectors involving "legacy reply paths."
CVSS v2.0: 7.2
CVE-2024-10404: Clear text password seen in switch-asset-collectors-mw in Brocade SANnav supportsave
CalInvocationHandler in Brocade 
SANnav before 2.3.1b logs sensitive information in clear text. The 
vulnerability could allow an authenticated, local attacker to view 
Brocade Fabric OS switch sensitive information in clear text. An 
attacker with administrative privileges could retrieve sensitive 
information including passwords; SNMP responses that contain AuthSecret 
and PrivSecret after collecting a “supportsave” or getting access to an 
already collected “supportsave”. NOTE: this issue exists because of an incomplete fix for CVE-2024-29952
CVSS v3.1: 5.5
CVE-2026-24368: WordPress The Grid plugin < 2.8.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in Theme-one The Grid the-grid allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Grid: from n/a through < 2.8.0.
CVSS v3.1: 5.3
GHSA-9772-pwrh-m696: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themesflat Themesflat Addons For Elementor allows Stored XSS. This issue affects Themesflat Addons For Elementor: from n/a through 2.2.5.
CVSS v3.1: 6.5
GHSA-hwf6-x4hq-wmc3: Multiple cross-site scripting (XSS) vulnerabilities in cPanel 10 allow remote attackers to inject arbitrary web script or HTML via the (1) dir parameter in dohtaccess.html, or the (2) file parameter in (a) editit.html or (b) showfile.html.
CVE-2026-26009: Catalyst Affected by Remote Code Execution as Root via Containerized Install Script Execution
Catalyst is a platform built for enterprise game server hosts, game communities, and billing panel integrations. Install scripts defined in server templates execute directly on the host operating system as root via bash -c, with no sandboxing or containerization. Any user with template.create or template.update permission can define arbitrary shell commands that achieve full root-level remote code execution on every node machine in the cluster. This vulnerability is fixed in commit 11980aaf3f46315b02777f325ba02c56b110165d.
CVSS v3.1: 10
CVE-2021-31987: A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to bypass blocked network recipients.
CVSS v3.1: 7.5
CVSS v2.0: 5.1
CVE-2026-25386: WordPress Ally plugin <= 4.0.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in Elementor Ally pojo-accessibility allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ally: from n/a through <= 4.0.2.
CVSS v3.1: 5.3
GHSA-pmvq-4gg6-p4px: Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 13 via the comment field when adding a new status comment.
CVSS v3.1: 6.1
CVE-2017-17665: In Octopus Deploy before 4.1.3, the machine update process doesn't check that the user has access to all environments. This allows an access-control bypass because the set of environments to which a machine is scoped may include environments in which the user lacks access.
CVSS v3.0: 8.8
CVSS v2.0: 6.5
GHSA-rx69-fxfm-2mhw: Google Chrome before 28.0.1500.71 allows remote attackers to cause a denial of service (out-of-bounds read) via vectors related to the handling of text.
GHSA-qr9q-g9r2-5x7c: Cleartext transmission of sensitive information in the management console of Ivanti Workspace Control version 10.18.0.0 and below allows a local authenticated attacker to obtain OS credentials.
CVSS v3.1: 8.2
CVE-2004-0309: Stack-based buffer overflow in the SMTP service support in vsmon.exe in Zone Labs ZoneAlarm before 4.5.538.001, ZoneLabs Integrity client 4.0 before 4.0.146.046, and 4.5 before 4.5.085, allows remote attackers to execute arbitrary code via a long RCPT TO argument.
CVSS v2.0: 10
GHSA-xq2x-gx2h-74r3: src/unit_test.c in gpsdrive (aka gpsdrive-scripts) 2.10~pre4 might allow local users to overwrite arbitrary files via a symlink attack on the /tmp/gpsdrive-unit-test/proc temporary file, a different vector than CVE-2008-4959 and CVE-2008-5380.
GHSA-vw25-h68c-8mm4: Improper input validation in Retail Mode prior to version 5.59.11 allows self attackers to execute privileged commands on their own devices.
CVSS v3.1: 6.6
RHSA-2022:8973: Red Hat Security Advisory: kernel security and bug fix update
kernel: KVM: cmpxchg_gpte can write to pfns outside the userspace region kernel: openvswitch: integer underflow leads to out-of-bounds write in reserve_sfa_size() kernel: watch queue race condition can lead to privilege escalation hw: cpu: incomplete clean-up of multi-core shared buffers (aka SBDR) hw: cpu: incomplete clean-up of microarchitectural fill buffers (aka SBDS) hw: cpu: incomplete clean-up in specific special register write operations (aka DRPW) hw: cpu: AMD: RetBleed Arbitrary Speculative Code Execution with Return Instructions hw: cpu: AMD: Branch Type Confusion (non-retbleed) hw: cpu: Intel: Post-barrier Return Stack Buffer Predictions hw: cpu: Intel: information disclosure via local access hw: cpu: AMD: RetBleed Arbitrary Speculative Code Execution with Return Instructions hw: cpu: Intel: RetBleed Arbitrary Speculative Code Execution with Return Instructions kernel: nfsd buffer overflow by RPC message over TCP with garbage data kernel: net: openvswitch: fix leak of nested actions kernel: KVM: VMX: Prevent RSB underflow before vmenter kernel: x86/speculation: Fill RSB on vmexit for IBRS
CVSS v3.1: 5.5
GHSA-g2cw-p5wq-3jh2: An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. It allows an authenticated user to refresh any materialized view, regardless of that user's permissions.
CVSS v3.1: 4.3
GHSA-g5m9-q65c-x6m4: A host whitelist parser issue in the proxy service implemented in the GravityZone Update Server allows an attacker to cause a server-side request forgery. This issue only affects GravityZone Console versions before 6.38.1-2 that are running only on premise.
CVSS v3.1: 8.1
GHSA-53p3-63h7-2wf4: The custom menu item options page in SolarWinds Orion Platform before 2020.2.5 allows Reverse Tabnabbing in the context of an administrator account.
GHSA-2322-wmrw-5cf3: Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3145.
GHSA-h8p9-2q3j-5c34: In XS 9.0.0 in Moddable SDK OS180329, there is a heap-based buffer overflow in fxBeginHost in xsAPI.c when called from fxRunDefine in xsRun.c, as demonstrated by crafted JavaScript code to xst.
GHSA-9hhf-2vg4-4xpx: adm-photo.php in PhotoPost PHP 5.0 RC3 does not properly verify administrative privileges before manipulating photos, which could allow remote attackers to manipulate other users' photos.
CVE-2017-9450: The Amazon Web Services (AWS) CloudFormation bootstrap tools package (aka aws-cfn-bootstrap) before 1.4-19.10 allows local users to execute arbitrary code with root privileges by leveraging the ability to create files in an unspecified directory.
CVSS v3.0: 7.8
CVSS v2.0: 7.2
CVE-2017-12992: The RIPng parser in tcpdump before 4.9.2 has a buffer over-read in print-ripng.c:ripng_print().
CVSS v3.1: 9.8
CVSS v3.0: 9.8
CVSS v2.0: 7.5
GHSA-g58c-cr2p-rwrf: Cross-site request forgery (CSRF) vulnerability in ELECOM WRC-300FEBK-A allows remote attackers to hijack the authentication of administrators and execute an arbitrary request via unspecified vector. As a result, the device settings may be altered and/or telnet daemon may be started.
GHSA-cq94-qf6q-mf2h: Pysaml2 improperly initializes encryption vector
Python package pysaml2 version 4.5.0 and earlier reuses the initialization vector across encryptions in the IDP server, resulting in weak encryption of data.
CVSS v4.0: 6.3
CVSS v3.0: 5.3
GHSA-x48p-m2p4-gh79: A Stored Cross-Site Scripting (XSS) vulnerability in SourceCodester FAQ Management System 1.0 allows an authenticated attacker to inject malicious JavaScript into the 'question' and 'answer' fields via the update-faq.php endpoint.
CVSS v3.1: 6.1