ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-vjvw-m37j-pxh3: Heimdall Data Database Proxy Cross-Site Scripting Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Heimdall Data Database Proxy. Minimal user interaction is required to exploit this vulnerability.The specific flaw exists within the handling of the database event logs. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of arbitrary script. An attacker can leverage this vulnerability to interact with the application in the context of the target user. Was ZDI-CAN-24755.
CVSS v3.0: 8.8
GHSA-pwq3-3mqr-rh4q: A vulnerability was determined in code-projects Online Event Judging System 1.0. This impacts an unknown function of the file /edit_criteria.php. Executing manipulation of the argument crit_id can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
CVSS v4.0: 2.1
CVSS v3.1: 6.3
GHSA-vw6h-3mr6-jprc: Missing Authorization vulnerability in QuanticaLabs Chauffeur Taxi Booking System for WordPress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Chauffeur Taxi Booking System for WordPress: from n/a through 6.9.
CVSS v3.1: 8.2
GHSA-f6pq-354j-4f2p: Dell Command Update versions prior to 3.1 contain an Arbitrary File Deletion Vulnerability. A local authenticated malicious user with low privileges potentially could exploit this vulnerability to delete arbitrary files by creating a symlink from the "Temp\ICProgress\Dell_InventoryCollector_Progress.xml" to any targeted file. This issue occurs because permissions on the Temp directory were set incorrectly.
GHSA-pvmm-x2wc-97cp: A security vulnerability has been detected in code-projects Real State Services 1.0. This issue affects some unknown processing of the file /pay.php. Such manipulation of the argument Bankname leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.
CVSS v4.0: 5.5
CVSS v3.1: 7.3
GHSA-j2jq-4c5g-fp4h: Null Pointer Dereference in the IdentifyImage function in MagickCore/identify.c in ImageMagick through 7.0.6-10 allows an attacker to perform denial of service by sending a crafted image file.
CVSS v3.1: 6.5
RHSA-2023:3363: Red Hat Security Advisory: OpenShift Container Platform 4.10.61 bug fix and security update
dns: Denial of Service (DoS)
CVSS v3.1: 7.5
GHSA-qgc4-q259-hqvf: Memory leak in Netscape Collabra Server 3.5.4 and earlier allows a remote attacker to cause a denial of service (memory exhaustion) by repeatedly sending approximately 5K of data to TCP port 5238.
CVE-2026-41303: OpenClaw < 2026.3.28 - Authorization Bypass in Discord Text Approval Commands
OpenClaw before 2026.3.28 contains an authorization bypass vulnerability in Discord text approval commands that allows non-approvers to resolve pending exec approvals. Attackers can send Discord text commands to bypass the channels.discord.execApprovals.approvers allowlist and approve pending host execution requests.
CVSS v4.0: 8.7
CVSS v3.1: 8.8
RHSA-2020:4289: Red Hat Security Advisory: kernel-rt security and bug fix update
kernel: net: bluetooth: type confusion while processing AMP packets kernel: net: bluetooth: information leak when processing certain AMP packets kernel: kernel: buffer over write in vgacon_scroll kernel: metadata validator in XFS may cause an inode with a valid, user-creatable extended attribute to be flagged as corrupt kernel: memory corruption in net/packet/af_packet.c leads to elevation of privilege
CVSS v3.1: 7.8
CVE-2019-16540: A path traversal vulnerability in Jenkins Support Core Plugin 2.63 and earlier allows attackers with Overall/Read permission to delete arbitrary files on the Jenkins master.
CVSS v3.1: 6.5
CVSS v2.0: 5.5
GHSA-m8rw-rcpq-2vp2: Improper Privilege Management in github.com/sap/cloud-security-client-go
ImpactSAP BTP Security Services Integration Library ([Golang] github.com/sap/cloud-security-client-go) allows under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.PatchesUpgrade to patched version >= 0.17.0
We always recommend to upgrade to the latest released version.WorkaroundsNo workaroundsReferenceshttps://www.cve.org/CVERecord?id=CVE-2023-50424
CVSS v4.0: 9.3
CVSS v3.1: 9.1
CVE-2018-15706: WADashboard API in Advantech WebAccess 8.3.1 and 8.3.2 allows remote authenticated attackers to read any file on the filesystem due to a directory traversal vulnerability in the readFile API.
CVSS v3.0: 6.5
CVSS v2.0: 6.8
GHSA-6gch-63wp-4v5f: Apache Linkis Spark EngineConn: Commons Lang's RandomStringUtils Random string security vulnerability
In Apache Linkis <= 1.5.0, a Random string security vulnerability in Spark EngineConn, random string generated by the Token when starting Py4j uses the Commons Lang's RandomStringUtils.
Users are recommended to upgrade to version 1.6.0, which fixes this issue.
CVSS v4.0: 8.7
CVSS v3.1: 7.5
CVE-2025-23995: WordPress Tantyyellow theme <= 1.0.0.5 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ta2g Tantyyellow allows Reflected XSS.This issue affects Tantyyellow: from n/a through 1.0.0.5.
CVSS v3.1: 7.1
CVE-2021-37231: A stack-buffer-overflow occurs in Atomicparsley 20210124.204813.840499f through APar_readX() in src/util.cpp while parsing a crafted mp4 file because of the missing boundary check.
CVSS v3.1: 5.5
CVSS v2.0: 4.3
CVE-2023-23600: Notification permissions persisted between Normal and Private Browsing on Android
Per origin notification permissions were being stored in a way that didn't take into account what browsing context the permission was granted in. This lead to the possibility of notifications to be displayed during different browsing sessions.
*This bug only affects Firefox for Android. Other operating systems are unaffected.* This vulnerability affects Firefox < 109.
CVSS v3.1: 6.5
CVE-2010-4983: SQL injection vulnerability in profile.php in iScripts CyberMatch 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS v2.0: 7.5
GHSA-6257-v6vg-94g2: Cross-Site Request Forgery (CSRF) vulnerability in MERGADO Mergado Pack allows Stored XSS. This issue affects Mergado Pack: from n/a through 4.1.1.
CVSS v3.1: 7.1
CVE-2025-10573: Stored XSS in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary JavaScript in the context of an administrator session. User interaction is required.
CVSS v3.1: 9.6
GHSA-gmg7-qgc5-8mvp: anlgform.pl in Analog before 5.23 does not restrict access to the PROGRESSFREQ progress update command, which allows remote attackers to cause a denial of service (disk consumption) by using the command to report updates more frequently and fill the web server error log.
CVE-2025-21099: Uncontrolled search path for some Intel(R) Graphics software may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS v4.0: 5.4
CVSS v3.1: 6.7
CVE-2025-64187: OctoPrint is vulnerable to XSS through Action Command Notifications and Prompts
OctoPrint provides a web interface for controlling consumer 3D printers. Versions 1.11.3 and below are affected by a vulnerability that allows injection of arbitrary HTML and JavaScript into Action Command notifications and prompts popups generated by the printer. An attacker who successfully convinces a victim to print a specially crafted file could exploit this issue to disrupt ongoing prints, extract information (including sensitive configuration settings, if the targeted user has the necessary permissions for that), or perform other actions on behalf of the targeted user within the OctoPrint instance. This issue is fixed in version 1.11.4.
CVSS v4.0: 4.6
CVE-2024-56556: binder: fix node UAF in binder_add_freeze_work()
In the Linux kernel, the following vulnerability has been resolved:

binder: fix node UAF in binder_add_freeze_work()

In binder_add_freeze_work() we iterate over the proc->nodes with the
proc->inner_lock held. However, this lock is temporarily dropped in
order to acquire the node->lock first (lock nesting order). This can
race with binder_node_release() and trigger a use-after-free:

  ==================================================================
  BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x19c
  Write of size 4 at addr ffff53c04c29dd04 by task freeze/640

  CPU: 5 UID: 0 PID: 640 Comm: freeze Not tainted 6.11.0-07343-ga727812a8d45 #17
  Hardware name: linux,dummy-virt (DT)
  Call trace:
   _raw_spin_lock+0xe4/0x19c
   binder_add_freeze_work+0x148/0x478
   binder_ioctl+0x1e70/0x25ac
   __arm64_sys_ioctl+0x124/0x190

  Allocated by task 637:
   __kmalloc_cache_noprof+0x12c/0x27c
   binder_new_node+0x50/0x700
   binder_transaction+0x35ac/0x6f74
   binder_thread_write+0xfb8/0x42a0
   binder_ioctl+0x18f0/0x25ac
   __arm64_sys_ioctl+0x124/0x190

  Freed by task 637:
   kfree+0xf0/0x330
   binder_thread_read+0x1e88/0x3a68
   binder_ioctl+0x16d8/0x25ac
   __arm64_sys_ioctl+0x124/0x190
  ==================================================================

Fix the race by taking a temporary reference on the node before
releasing the proc->inner lock. This ensures the node remains alive
while in use.
CVSS v3.1: 7.8
GHSA-hpwf-8g29-85qm: Nest Affected by DoS via Recursive handleData in JsonSocket (TCP Transport)
ImpactAttacker sends many small, valid JSON messages in one TCP frame
 → handleData() recurses once per message; buffer shrinks each call
 → maxBufferSize is never reached; call stack overflows instead
 → A ~47 KB payload is sufficient to trigger RangeErrorPatchesFixed in `@nestjs/microservices@11.1.19`ReferencesDiscovered by https://github.com/hwpark6804-gif
CVSS v3.1: 7.5
GHSA-3cp7-292h-7cm6: The mintToken function of a smart contract implementation for EXGROUP, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS v3.0: 7.5
GHSA-xrp2-fhq4-4q3w: Segfault if `tf.histogram_fixed_width` is called with NaN values in TensorFlow
ImpactThe implementation of [`tf.histogram_fixed_width`](https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/histogram_op.cc) is vulnerable to a crash when the values array contain `NaN` elements:The [implementation](https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/histogram_op.cc#L35-L74) assumes that all floating point operations are defined and then converts a floating point result to an integer index:If `values` contains `NaN` then the result of the division is still `NaN` and the cast to `int32` would result in a crash.This only occurs on the CPU implementation.PatchesWe have patched the issue in GitHub commit [e57fd691c7b0fd00ea3bfe43444f30c1969748b5](https://github.com/tensorflow/tensorflow/commit/e57fd691c7b0fd00ea3bfe43444f30c1969748b5).The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.For more informationPlease consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.AttributionThis vulnerability has been reported externally via a [GitHub issue](https://github.com/tensorflow/tensorflow/issues/45770).
CVSS v3.1: 5.5
GHSA-q34p-wrjp-g6wh: Flash Player versions 31.0.0.122 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS v3.0: 7.5
CVE-2026-35401: Saleor has a resource exhaustion vulnerability in GraphQL queries
Saleor is an e-commerce platform. From 2.0.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, a malicious actor can include many GraphQL mutations or queries in a single API call using aliases or chaining multiple mutations, resulting in resource exhaustion. This vulnerability is fixed in 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118.
CVSS v3.1: 7.5
CVE-2023-34311: Ashlar-Vellum Cobalt Untrusted Pointer Dereference Remote Code Execution Vulnerability
Ashlar-Vellum Cobalt Untrusted Pointer Dereference Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of CO files. The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. An attacker can leverage this vulnerability to execute code in the context of the current process.
. Was ZDI-CAN-19879.
CVSS v3.0: 7.8
CVE-2024-38108: Azure Stack Hub Spoofing Vulnerability
Azure Stack Hub Spoofing Vulnerability
CVSS v3.1: 9.3
CVE-2016-7016: Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and Acrobat and Acrobat Reader DC Continuous before 15.020.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-6940, CVE-2016-6941, CVE-2016-6942, CVE-2016-6943, CVE-2016-6947, CVE-2016-6948, CVE-2016-6950, CVE-2016-6951, CVE-2016-6954, CVE-2016-6955, CVE-2016-6956, CVE-2016-6959, CVE-2016-6960, CVE-2016-6966, CVE-2016-6970, CVE-2016-6972, CVE-2016-6973, CVE-2016-6974, CVE-2016-6975, CVE-2016-6976, CVE-2016-6977, CVE-2016-6978, CVE-2016-6995, CVE-2016-6996, CVE-2016-6997, CVE-2016-6998, CVE-2016-7000, CVE-2016-7001, CVE-2016-7002, CVE-2016-7003, CVE-2016-7004, CVE-2016-7005, CVE-2016-7006, CVE-2016-7007, CVE-2016-7008, CVE-2016-7009, CVE-2016-7010, CVE-2016-7011, CVE-2016-7012, CVE-2016-7013, CVE-2016-7014, CVE-2016-7015, CVE-2016-7017, CVE-2016-7018, and CVE-2016-7019.
CVSS v3.0: 9.8
CVSS v2.0: 10
GHSA-cxfp-vwqp-ghxf: An issue has been discovered in GitLab EE affecting all versions starting from 14.2 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. Lack of verification on RelayState parameter allowed a maliciously crafted URL to obtain access tokens granted for 3rd party Group SAML SSO logins. This feature isn't enabled by default.
CVSS v3.1: 6.8
CVE-2021-45980: Foxit PDF Reader and PDF Editor before 11.1 on macOS allow remote attackers to execute arbitrary code via getURL in the JavaScript API.
CVSS v3.1: 7.8
CVSS v2.0: 6.8
GHSA-g45q-xh8v-2xr4: An issue was discovered in WSO2 Identity Server through 5.10.0 and WSO2 IS as Key Manager through 5.10.0. An open redirect exists.
CVSS v3.1: 6.1
GHSA-p995-58rj-543m: internal/advanced_comment_system/index.php and internal/advanced_comment_system/admin.php in Advanced Comment System, version 1.0, contain a reflected cross-site scripting vulnerability via ACS_path. A remote unauthenticated attacker could potentially exploit this vulnerability to supply malicious HTML or JavaScript code to a vulnerable web application, which is then reflected back to the victim and executed by the web browser. The product is discontinued.
CVSS v3.0: 6.1
GHSA-p7jp-59qp-fjf3: Anviz CX2 Lite and CX7 are vulnerable to unauthenticated access that discloses debug 
configuration details (e.g., SSH/RTTY status), assisting attackers in 
reconnaissance against the device.
CVSS v3.1: 5.3
CVE-2022-1052: Heap Buffer Overflow in iterate_chained_fixups in radareorg/radare2
Heap Buffer Overflow in iterate_chained_fixups in GitHub repository radareorg/radare2 prior to 5.6.6.
CVSS v3.0: 7.3
GHSA-5h8j-gg7x-xm7c: drivers/video/msm/mdss/mdss_mdp_overlay.c in the Qualcomm video driver in Android before 2016-10-05 on Nexus 5X, Nexus 6, Nexus 6P, and Android One devices allows attackers to gain privileges via a crafted application, aka Android internal bug 30019716 and Qualcomm internal bug CR 1049232.
CVSS v3.0: 7.8
CVE-2016-9268: Unrestricted file upload vulnerability in the Blog appearance in the "Install or upgrade manually" module in Dotclear through 2.10.4 allows remote authenticated super-administrators to execute arbitrary code by uploading a theme file with an zip extension, and then accessing it via unspecified vectors.
CVSS v3.0: 7.2
CVSS v2.0: 9
CVE-2006-3161: SQL injection vulnerability in misc.php in SaphpLesson 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the action parameter.
CVSS v2.0: 7.5
CVE-2018-17107: In Tgstation tgstation-server 3.2.4.0 through 3.2.1.0 (fixed in 3.2.5.0), active logins would be cached, allowing subsequent logins to succeed with any username or password.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
GHSA-g736-3qxc-3xmm: Potential security vulnerabilities have been identified in the HP One 
Agent for certain HP PC products, which might allow
               for escalation of privilege and/or denial of service. HP 
is releasing software updates to mitigate these potential 
vulnerabilities.
CVSS v4.0: 8.5
CVE-2015-3198: The Undertow module of WildFly 9.x before 9.0.0.CR2 and 10.x before 10.0.0.Alpha1 allows remote attackers to obtain the source code of a JSP page via a "/" at the end of a URL.
CVSS v3.0: 7.5
CVSS v2.0: 5
GHSA-rchp-hw9h-rrcc: The Advanced Blocks Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS v3.1: 6.4
CVE-2021-38156: In Nagios XI before 5.8.6, XSS exists in the dashboard page (/dashboards/#) when administrative users attempt to edit a dashboard.
CVSS v3.1: 5.4
CVSS v2.0: 3.5
CVE-2025-61651: i18n XSS through Special:CheckUser CheckUser helper
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files modules/ext.CheckUser/checkuser/checkUserHelper/buildUserElement.Js.

This issue affects CheckUser: from * before 1.44.1.
CVSS v4.0: 0
CVE-2013-1787: Cross-site scripting (XSS) vulnerability in the 3 slide gallery in the Simple Corporate theme before 7.x-1.4 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors.
CVSS v2.0: 2.1
CVE-2014-3917: kernel/auditsc.c in the Linux kernel through 3.14.5, when CONFIG_AUDITSYSCALL is enabled with certain syscall rules, allows local users to obtain potentially sensitive single-bit values from kernel memory or cause a denial of service (OOPS) via a large value of a syscall number.
CVSS v2.0: 3.3
cisco-sa-webex-xss-jw3NeQzS: Cisco Webex Meetings Cross-Site Scripting Vulnerability
A vulnerability in the web-based user interface of Cisco Webex Meetings could have allowed an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack. Cisco has addressed this vulnerability in the Webex Meetings service, and no customer action is needed.

This vulnerability existed because of insufficient validation of user input. Prior to this vulnerability being addressed, an attacker could have exploited this vulnerability by persuading a user to follow a malicious link. A successful exploit could have allowed the attacker to execute arbitrary script code in the browser of the targeted user or access sensitive, browser-based information.

As mentioned, Cisco has addressed this vulnerability in the Webex Meetings service, and no customer action is necessary to update on-premises software or devices. There are no workarounds that address this vulnerability.


CVSS v3.1: 6.1
GHSA-hgm9-g82q-236j: In the Linux kernel, the following vulnerability has been resolved:misc: microchip: pci1xxxx: Resolve kernel panic during GPIO IRQ handlingResolve kernel panic caused by improper handling of IRQs while
accessing GPIO values. This is done by replacing generic_handle_irq with
handle_nested_irq.
CVSS v3.1: 5.5
GHSA-r2pp-xf6c-g7rw: In Huawei HiRouter-CD20-10 with the versions before 1.9.6 and WS5200-10 with the versions before 1.9.6, there is a plug-in signature bypass vulnerability due to insufficient plug-in verification. An attacker may tamper with a legitimate plug-in to build a malicious plug-in and trick users into installing it. Successful exploit could allow the attacker to obtain the root permission of the device and take full control over the device.
CVSS v3.0: 7.8
CVE-2004-2618: Cross-site scripting (XSS) vulnerability in Pegasi Web Server (PWS) 0.2.2 allows remote attackers to inject arbitrary web script or HTML via the URI, directly after the initial '/' (slash).
CVSS v2.0: 4.3
CVE-2026-46770: Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: Security Framework).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Development Framework (ADF).  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Application Development Framework (ADF), attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Application Development Framework (ADF) accessible data as well as  unauthorized read access to a subset of Oracle Application Development Framework (ADF) accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
CVSS v3.1: 6.1
CVE-2009-4214: Cross-site scripting (XSS) vulnerability in the strip_tags function in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote attackers to inject arbitrary web script or HTML via vectors involving non-printing ASCII characters, related to HTML::Tokenizer and actionpack/lib/action_controller/vendor/html-scanner/html/node.rb.
CVSS v2.0: 4.3
GHSA-qf75-pqfj-8jc9: An information disclosure vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka 'Microsoft Graphics Components Information Disclosure Vulnerability'.
CVE-2024-2314: If kernel headers need to be extracted, bcc will attempt to load them from a temporary directory. An unprivileged attacker could use this to force bcc to load compromised linux headers. Linux distributions which provide kernel headers by default are not affected by default.
CVSS v3.1: 2.8
CVE-2023-46570: An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32 function of libr/arch/p/nds32/nds32-dis.h.
CVSS v3.1: 9.8
CVE-2020-24444: Blind SSRF in Forms add-on for AEM
AEM Forms SP6 add-on for AEM 6.5.6.0 and Forms add-on package for AEM 6.4 Service Pack 8 Cumulative Fix Pack 2 (6.4.8.2) have a blind Server-Side Request Forgery (SSRF) vulnerability. This vulnerability could be exploited by an unauthenticated attacker to gather information about internal systems that reside on the same network.
CVSS v3.1: 5.8
CVE-2021-44340: David Brackeen ok-file-formats dev version is vulnerable to Buffer Overflow. When the function of the ok-file-formats project is used, a heap-buffer-overflow occurred in function ok_jpg_generate_huffman_table() in "/ok_jpg.c:403".
CVSS v3.1: 7.8
CVSS v2.0: 6.8
GHSA-j4rp-ppmv-7whr: Insufficient policy enforcement in Autofill in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to bypass Autofill restrictions via a crafted HTML page. (Chromium security severity: Low)
CVSS v3.1: 4.3