ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2007-1508: Cross-site scripting (XSS) vulnerability in CMD_USER_STATS in DirectAdmin allows remote attackers to inject arbitrary web script or HTML via the RESULT parameter, a different vector than CVE-2006-5983.
CVSS v2.0: 4.3
GHSA-p3v8-fm5p-v84h: Keycloak has an Improper Verification of Cryptographic Signature issue
A flaw was found in Keycloak. When a JSON Web Encryption (JWE) encrypted request object is submitted, Keycloak may incorrectly process unsigned claims if the decrypted content is raw JSON, bypassing the configured signature policy. This allows a remote attacker to submit unauthorized claims, leading to a compromise of data integrity within the OpenID Connect (OIDC) authorization flow. While a redirect URI allowlist acts as a compensating control, this vulnerability violates OIDC Core and Financial-grade API (FAPI) signing requirements.
CVSS v3.1: 5.9
CVE-2024-25984: In dumpBatteryDefend of dump_power.cpp, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1: 6.2
CVE-2021-20032: SonicWall Analytics 2.5 On-Prem is vulnerable to Java Debug Wire Protocol (JDWP) interface security misconfiguration vulnerability which potentially leads to Remote Code Execution. This vulnerability impacts Analytics On-Prem 2.5.2518 and earlier.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
GHSA-852r-57vg-pf7g: WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1289, CVE-2014-1290, CVE-2014-1291, CVE-2014-1293, and CVE-2014-1294.
CVE-2016-6743: An elevation of privilege vulnerability in the Synaptics touchscreen driver in Android before 2016-11-05 could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Android ID: A-30937462.
CVSS v3.0: 7.8
CVSS v2.0: 9.3
CVE-2015-7568: SQL injection vulnerability in the password recovery feature in Yeager CMS 1.2.1 allows remote attackers to change the account credentials of known users via the "userEmail" parameter.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
GHSA-26rr-whcg-5f4g: The ssl_Do1stHandshake function in sslsecur.c in libssl in Mozilla Network Security Services (NSS) before 3.15.4, when the TLS False Start feature is enabled, allows man-in-the-middle attackers to spoof SSL servers by using an arbitrary X.509 certificate during certain handshake traffic.
GHSA-8cxh-wxvq-9jgw: Laravel v11.x was discovered to contain an XML External Entity (XXE) vulnerability.
CVSS v3.1: 4.3
CVE-2026-32048: OpenClaw < 2026.3.1 - Sandbox Escape via Cross-Agent sessions_spawn
OpenClaw versions prior to 2026.3.1 fail to enforce sandbox inheritance during cross-agent sessions_spawn operations, allowing sandboxed sessions to create child processes under unsandboxed agents. An attacker with a sandboxed session can exploit this to spawn child runtimes with sandbox.mode set to off, bypassing runtime confinement restrictions.
CVSS v4.0: 7.7
CVSS v3.1: 7.5
GHSA-r83q-365j-j54p: Cross-site scripting (XSS) vulnerability in index.php in Hiox Guestbook 3.1 allows remote attackers to inject arbitrary web script or HTML via the input forms for signing the guestbook.
CVE-2026-21892: Parsl Monitoring Visualization Vulnerable to SQL Injection
Parsl is a Python parallel scripting library. A SQL Injection vulnerability exists in the parsl-visualize component of versions prior to 2026.01.05. The application constructs SQL queries using unsafe string formatting (Python % operator) with user-supplied input (workflow_id) directly from URL routes. This allows an unauthenticated attacker with access to the visualization dashboard to inject arbitrary SQL commands, potentially leading to data exfiltration or denial of service against the monitoring database. Version 2026.01.05 fixes the issue.
CVSS v3.1: 5.3
CVE-2025-3039: code-projects Payroll Management System add_employee.php sql injection
A vulnerability was found in code-projects Payroll Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /add_employee.php. The manipulation of the argument lname/fname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
GHSA-9j4h-8wwv-xw8q: The Checkbox plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'wp_ajax_nopriv_checkbox_clean_log' AJAX endpoint in all versions up to, and including, 2.8.10. This makes it possible for unauthenticated attackers to clear log files.
CVSS v3.1: 5.3
CVE-2022-33711: Improper validation of integrity check vulnerability in Samsung USB Driver Windows Installer for Mobile Phones prior to version 1.7.56.0 allows local attackers to delete arbitrary directory using directory junction.
CVSS v3.1: 5.5
CVSS v2.0: 2.1
GHSA-g977-h85w-h2xj: MetaGPT has an Injection issue
A vulnerability was detected in FoundationAgents MetaGPT up to 0.8.1. This affects the function check_solution of the component HumanEvalBenchmark/MBPPBenchmark. Performing a manipulation results in code injection. The attack may be initiated remotely. The exploit is now public and may be used. The project was informed of the problem early through a pull request but has not reacted yet.
CVSS v4.0: 5.5
CVSS v3.1: 7.3
CVE-2015-4917: Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 allows remote authenticated users to affect integrity via unknown vectors related to Security, a different vulnerability than CVE-2015-4892.
CVSS v2.0: 3.5
GHSA-mv67-rrhp-pr8r: An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the "Sandbox" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVSS v3.0: 7.8
GHSA-r272-2vh9-q99x: The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request.
CVSS v3.1: 9.8
CVE-2018-10735: A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/commandline.php cname parameter.
CVSS v3.0: 7.2
CVSS v2.0: 6.5
GHSA-4wm9-pwwj-frwq: A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can lead to denial of service. An attacker can send a sequence of requests to trigger this vulnerability.The `/action/import_nodejs_app/` API is affected by command injection vulnerability.
CVSS v3.1: 7.5
CVE-2023-48623: Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)
Adobe Experience Manager versions 6.5.18 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS v3.1: 5.4
GHSA-64mc-xq24-56f8: A vulnerability was found in SourceCodester Canteen Management System 1.0. It has been declared as critical. This vulnerability affects the function query of the file createCategories.php. The manipulation of the argument categoriesStatus leads to sql injection. The attack can be initiated remotely. VDB-223306 is the identifier assigned to this vulnerability.
CVSS v3.1: 9.8
CVE-2018-5689: Cross-site scripting (XSS) vulnerability in admin/auth.php in Dotclear 2.12.1 allows remote authenticated users to inject arbitrary web script or HTML via the malicious user's email.
CVSS v3.0: 5.4
CVSS v2.0: 3.5
CVE-2024-36188: Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS v3.1: 5.4
CVE-2020-27402: The HK1 Box S905X3 TV Box contains a vulnerability that allows a local unprivileged user to escalate to root using the /system/xbin/su binary via a serial port (UART) connection or using adb.
CVSS v3.1: 7.8
CVSS v2.0: 7.2
CVE-2025-46857: Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)
Adobe Experience Manager versions 6.5.22 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS v3.1: 5.4
GHSA-9m5p-c77c-f9j7: DoS in Cilium agent DNS proxy from crafted DNS responses
ImpactIn a Kubernetes cluster where Cilium is configured to proxy DNS traffic, an attacker can crash Cilium agents by sending a crafted DNS response to workloads from outside the cluster.For traffic that is allowed but without using DNS-based policy, the dataplane will continue to pass traffic as configured at the time of the DoS. For workloads that have DNS-based policy configured, existing connections may continue to operate, and new connections made without relying on DNS resolution may continue to be established, but new connections which rely on DNS resolution may be disrupted. Any configuration changes that affect the impacted agent may not be applied until the agent is able to  restart.PatchesThis issue affects:Cilium v1.14 between v1.14.0 and v1.14.17 inclusiveCilium v1.15 between v1.15.0 and v1.15.11 inclusiveCilium v1.16 between v1.16.0 and v1.16.4 inclusiveThis issue is fixed in:Cilium v1.14.18Cilium v1.15.12Cilium v1.16.5WorkaroundsThere are no known workarounds to this issue.AcknowledgementsThe Cilium community has worked together with members of Isovalent and the Cisco Advanced Security Initiatives Group (ASIG) to prepare these mitigations. Special thanks to @kokelley-cisco for reporting this issue and @bimmlerd for the fix.For more informationIf you have any questions or comments about this advisory, please reach out on [Slack](https://docs.cilium.io/en/latest/community/community/#slack).If you think you have found a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at [security@cilium.io](mailto:security@cilium.io). This is a private mailing list for the Cilium security team, and your report will be treated as top priority.
CVSS v3.1: 5.3
GHSA-f5v5-ccqc-6w36: async-nats vulnerable to TLS certificate common name validation bypass
The NATS official Rust clients are vulnerable to MitM when using TLS.The common name of the server's TLS certificate is validated against the `host`name provided by the server's plaintext `INFO` message during the initial connection setup phase. A MitM proxy can tamper with the `host` field's value by substituting it with the common name of a valid certificate it controls, fooling the client into accepting it.Reproduction stepsThe NATS Rust client tries to establish a new connectionThe connection is intercepted by a MitM proxyThe proxy makes a separate connection to the NATS serverThe NATS server replies with an `INFO` messageThe proxy reads the `INFO`, alters the `host` JSON field and passes the tampered `INFO` back to the clientThe proxy upgrades the client connection to TLS, presenting a certificate issued by a certificate authority present in the client's keychain. In the previous step the `host` was set to the common name of said certificate`rustls` accepts the certificate, having verified that the common name matches the attacker-controlled value it was givenThe client has been fooled by the MitM proxy into accepting the attacker-controlled certificate
GHSA-639f-hxcv-84mc: rdiffweb Open Redirect vulnerability
rdiffweb prior to version 2.5.4 has an Open Redirect vulnerability.
CVSS v4.0: 5.3
CVSS v3.1: 6.1
CVE-2003-1260: Buffer overflow in CuteFTP 5.0 allows remote attackers to execute arbitrary code via a long response to a LIST command.
CVSS v2.0: 7.6
CVE-2024-45571: Use After Free in WLAN Host Communication
Memory corruption may occour occur when stopping the WLAN interface after processing a WMI command from the interface.
CVSS v3.1: 7.8
CVE-2018-10105: tcpdump before 4.9.3 mishandles the printing of SMB data (issue 2 of 2).
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2025-57788: Unauthorized API Access Risk
A vulnerability in a known login mechanism allows unauthenticated attackers to execute API calls without requiring user credentials. RBAC helps limit the exposure but does not eliminate risk.
CVSS v4.0: 6.9
GHSA-gr3m-3w4f-5p6g: Session fixation vulnerability in Macromedia JRun 4.0 allows remote attackers to hijack user sessions by pre-setting the user session ID information used by the session server.
GHSA-g737-hc9q-f5p5: The process-management implementation in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 allows local users to gain privileges by terminating a firestarter.py supervised process and then triggering the restart of a process by the root account, aka Bug ID CSCuv12272.
CVE-2023-29337: NuGet Client Remote Code Execution Vulnerability
NuGet Client Remote Code Execution Vulnerability
CVSS v3.1: 7.1
CVE-2005-0723: Cross-site scripting (XSS) vulnerability in the jumpmenu function in functions.php for paFileDB 3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the URL parameters, which is not properly cleansed in the $pageurl variable, as demonstrated using pafiledb.php.
CVSS v2.0: 4.3
GHSA-9cpr-x683-7qc6: Stack Buffer Overflow in AMD Graphics Driver for Windows 10 may lead to escalation of privilege or denial of service.
GHSA-h983-438c-387c: A vulnerability was detected in D-Link DI-8400 up to 16.07.26A1. This affects an unknown function of the file /dbsrv.asp. Performing a manipulation of the argument str results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is now public and may be used. The initial researcher advisory mentions contradicting parameter names to be affected.
CVSS v4.0: 7.4
CVSS v3.1: 8.8
GHSA-2v5g-963j-h7hv: Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Citrix Secure Access Client for Windows
CVSS v4.0: 8.6
CVSS v3.1: 7.8
GHSA-pcx7-hvg4-wg56: Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability
CVSS v3.1: 7.8
GHSA-28c2-q6pw-9mqq: A vulnerability was found in SourceCodester Tourist Reservation System 1.0. It has been declared as critical. This vulnerability affects the function ad_writedata of the file System.cpp. The manipulation of the argument ad_code leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-256282 is the identifier assigned to this vulnerability.
CVSS v3.1: 6.3
GHSA-m7r9-q69w-q556: An issue was discovered in libjpeg 9a and 9d. The alloc_sarray function in jmemmgr.c allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted file.
CVSS v3.0: 6.5
RHSA-2018:0406: Red Hat Security Advisory: php security update
php: Buffer over-read from unitialized data in gdImageCreateFromGifCtx function
CVSS v3.0: 5.5
RHSA-2016:0304: Red Hat Security Advisory: openssl security update
openssl: assertion failure in SSLv2 servers OpenSSL: SSLv2 doesn't block disabled ciphers openssl: Divide-and-conquer session key recovery in SSLv2 openssl: SSLv2 Bleichenbacher protection overwrites wrong bytes for export ciphers SSL/TLS: Cross-protocol attack on TLS using SSLv2 (DROWN)
GHSA-q4jp-rmff-g56p: "IBM Robotic Process Automation for Cloud Pak 21.0.1, 21.0.2, 21.0.3, 21.0.4, and 21.0.5 is vulnerable to exposure of the first tenant owner e-mail address to users with access to the container platform. IBM X-Force ID: 238214."
CVSS v3.1: 3.3
CVE-2013-4626: Cross-site scripting (XSS) vulnerability in the BackWPup plugin before 3.0.13 for WordPress allows remote attackers to inject arbitrary web script or HTML via the tab parameter to wp-admin/admin.php.
CVSS v2.0: 4.3
CVE-2020-35778: Certain NETGEAR devices are affected by CSRF. This affects GS716Tv3 before 6.3.1.36 and GS724Tv4 before 6.3.1.36.
CVSS v3.1: 4.3
CVE-2023-46382: LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) use cleartext HTTP for login.
CVSS v3.1: 7.5
CVE-2021-45099: The addon.stdin service in addon-ssh (aka Home Assistant Community Add-on: SSH & Web Terminal) before 10.0.0 has an attack surface that requires social engineering. NOTE: the vendor does not agree that this is a vulnerability; however, addon.stdin was removed as a defense-in-depth measure against complex social engineering situations
CVSS v3.1: 8.8
CVSS v2.0: 6.8
GHSA-xxmc-92m2-3hhc: Microsoft Edge in Windows 10 1709 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0758, CVE-2018-0762, CVE-2018-0768, CVE-2018-0769, CVE-2018-0770, CVE-2018-0772, CVE-2018-0774, CVE-2018-0775, CVE-2018-0776, CVE-2018-0777, CVE-2018-0778, and CVE-2018-0781.
CVSS v3.0: 7.5
GHSA-g76c-vghc-f9r5: The avi_read_nikon function in libavformat/avidec.c in FFmpeg before 3.1.4 is vulnerable to infinite loop when it decodes an AVI file that has a crafted 'nctg' structure.
CVSS v3.0: 5.5
CVE-2026-26143: Microsoft PowerShell Security Feature Bypass Vulnerability
Improper input validation in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature locally.
CVSS v3.1: 7.8
RHSA-2012:0107: Red Hat Security Advisory: kernel security and bug fix update
kernel: ext4: ext4_ext_insert_extent() kernel oops kernel: jbd2: unmapped buffer with _Unwritten or _Delay flags set can lead to DoS kernel: possible privilege escalation via SG_IO ioctl kernel: futex: clear robust_list on execve kernel: igmp: Avoid zero delay when receiving odd mixture of IGMP queries
CVE-2020-7724: Prototype Pollution
All versions of package tiny-conf are vulnerable to Prototype Pollution via the set function.
CVSS v3.1: 9.8
CVE-2023-28983: Junos OS Evolved: Shell Injection vulnerability in the gNOI server
An OS Command Injection vulnerability in gRPC Network Operations Interface (gNOI) server module of Juniper Networks Junos OS Evolved allows an authenticated, low privileged, network based attacker to inject shell commands and execute code. This issue affects Juniper Networks Junos OS Evolved 21.4 version 21.4R1-EVO and later versions prior to 22.1R1-EVO.
CVSS v3.1: 8.8
CVE-2024-31802: DESIGNA ABACUS v.18 and before allows an attacker to bypass the payment process via a crafted QR code.
CVSS v3.1: 6.3
CVE-2025-52740: WordPress Boldermail Plugin <= 2.4.0 - PHP Object Injection Vulnerability
Deserialization of Untrusted Data vulnerability in Hernan Villanueva Boldermail boldermail allows Object Injection.This issue affects Boldermail: from n/a through <= 2.4.0.
CVSS v3.1: 8.8
CVE-2004-1856: devices_update_printer_fw_upload.hts in HP Web JetAdmin 7.5.2546, when no password is set, allows remote attackers to upload arbitrary files to the printer directory.
CVSS v2.0: 5
GHSA-wfjv-29vm-jrfq: TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the bandstr parameter in the formMapDelDevice interface.
CVSS v3.1: 6.5
GHSA-742q-fvx3-9vh3: An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devices. The username and password setup for the web interface does not require entering the existing password. A malicious user can change the username and password of the interface.
CVSS v3.1: 6.5
CVE-2025-30589: WordPress Flickr set slideshows plugin <= 0.9 - SQL Injection Vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Dourou Flickr set slideshows flickr-set-slideshows allows SQL Injection.This issue affects Flickr set slideshows: from n/a through <= 0.9.
CVSS v3.1: 8.5
GHSA-98f5-7jq3-jhgq: IBM Sterling B2B Integrator and and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_1, 6.2.1.0 through 6.2.1.1_1, and 6.2.2.0 could allow an unauthenticated attacker to send a specially crafted request that causes the application to crash.
CVSS v3.1: 7.5
CVE-2020-13844: Arm Armv8-A core implementations utilizing speculative execution past unconditional changes in control flow may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka "straight-line speculation."
CVSS v3.1: 5.5
CVSS v2.0: 2.1
GHSA-5hww-6xpq-wrqw: The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.12.8. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS v3.1: 6.1
CVE-2021-44470: Incorrect default permissions for the Intel(R) Connect M Android application before version 1.7.4 may allow an authenticated user to potentially enable information disclosure via local access.
CVSS v3.1: 5.5
GHSA-cc99-whm5-mmq3: Openstack Keystone Incorrect Authorization vulnerability
A flaw was found in openstack-keystone, only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity which administrators may be counting on. The highest threat from this vulnerability is to data confidentiality and integrity. A [patch](https://opendev.org/openstack/keystone/commit/7859ed26003858ebfd9a5e866b43f1a6a9e83dca) is available.
CVSS v3.1: 9.1
CVE-2013-1006: WebKit, as used in Apple iTunes before 11.0.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-05-16-1.
CVSS v2.0: 9.3
CVE-2024-54523: The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, tvOS 18.2, watchOS 11.2. An app may be able to corrupt coprocessor memory.
CVSS v3.1: 9.1
CVE-2014-8520: McAfee Network Data Loss Prevention (NDLP) before 9.3 allows remote attackers to obtain sensitive information via vectors related to open network ports.
CVSS v2.0: 5
CVE-2022-44647: An Out-of-bounds read vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to disclose sensitive information on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

This is similar to, but not the same as CVE-2022-44648.
CVSS v3.1: 5.5
GHSA-76f9-42qx-mfmx: Vulnerability of improper criterion security check in the call module.
Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.
CVSS v3.1: 7.3
CVE-2025-26064: A cross-site scripting (XSS) vulnerability in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the name of a connnected device.
CVSS v3.1: 7.3
RHSA-2009:1648: Red Hat Security Advisory: ntp security update
ntpd: DoS with mode 7 packets (VU#568372)
GHSA-4w34-678c-q5hp: Improper authorization in some Zoom clients may allow an authorized user to conduct an escalation of privilege via network access.
CVSS v3.1: 5.5