ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-vqvr-9cjv-m5wg: A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA20) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA30) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA20) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA30) (All versions < V3.0.1.1). The affected application assigns incorrect permissions to a user management component. This could allow a privileged attacker to escalate their privileges from the Administrators group to the Systemadministrator group.
CVSS v3.1: 9.1
CVE-2020-4171: IBM Security Guardium Insights 2.0.1 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 174407.
CVSS v3.0: 4.3
CVE-2026-8200: Schema validation log messages may not redact user data
When schema validation is enabled on a collection and an update or insert would violate the collection's schema, the local server log message generated may not have all user data redacted. 


This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.
CVSS v4.0: 4.8
CVSS v3.1: 2.7
CVE-2021-38504: When interacting with an HTML input element's file picker dialog with webkitdirectory set, a use-after-free could have resulted, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3.
CVSS v3.1: 8.8
CVSS v2.0: 6.8
CVE-2025-66217: AIS-catcher Integer Underflow in MQTT Packet Parsing leading to Heap Buffer Overflow
AIS-catcher is a multi-platform AIS receiver. Prior to version 0.64, an integer underflow vulnerability exists in the MQTT parsing logic of AIS-catcher. This vulnerability allows an attacker to trigger a massive Heap Buffer Overflow by sending a malformed MQTT packet with a manipulated Topic Length field. This leads to an immediate Denial of Service (DoS) and, when used as a library, severe Memory Corruption that can be leveraged for Remote Code Execution (RCE). This issue has been patched in version 0.64.
CVSS v4.0: 8.8
CVE-2008-1673: The asn1 implementation in (a) the Linux kernel 2.4 before 2.4.36.6 and 2.6 before 2.6.25.5, as used in the cifs and ip_nat_snmp_basic modules; and (b) the gxsnmp package; does not properly validate length values during decoding of ASN.1 BER data, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via (1) a length greater than the working buffer, which can lead to an unspecified overflow; (2) an oid length of zero, which can lead to an off-by-one error; or (3) an indefinite length for a primitive encoding.
CVSS v2.0: 10
GHSA-w47c-78m2-3c96: Multiple stack-based buffer overflows in SonicDVDDashVRNav.dll in Roxio CinePlayer 3.2 allow remote attackers to execute arbitrary code via (1) unspecified long property values to SonicMediaPlayer.dll or (2) long arguments to unspecified methods in SonicMediaPlayer.dll.
GHSA-2wqg-w33r-qx37: The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.120.46. This is due to missing or incorrect nonce validation on the peachpay_stripe_handle_admin_actions function. This makes it possible for unauthenticated attackers to permanently delete all stored Stripe credentials — including publishable keys, secret keys, webhook secrets, and Apple Pay configuration — from the WordPress database, disabling Stripe payment processing for the store via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS v3.1: 4.3
GHSA-7c2w-vvj3-f9wr: Elvin 1.2.0 allows remote attackers to read the PHP source code of (1) login.ei, (2) jump_bug.ei, or (3) create_account.ei in inc/ via a direct request.
GHSA-mvx6-xfx7-r23g: A Path Traversal (Local File Inclusion) vulnerability in "BinaryFileRedirector.ashx" in CADClick v1.11.0 and before allows remote attackers to retrieve arbitrary local files via the "path" parameter.
CVSS v3.1: 3.9
GHSA-g275-7gx9-r8ww: Cross-Site Request Forgery (CSRF) vulnerability in Boone Gorges Anthologize allows Cross Site Request Forgery. This issue affects Anthologize: from n/a through 0.8.3.
CVSS v3.1: 4.3
GHSA-gjf6-wjw2-rf6g: Multiple buffer overflows in WebEx Downloader ActiveX Control, possibly in versions before November 2005, allow remote attackers to execute arbitrary code via unspecified vectors.
CVE-2005-0888: Multiple cross-site scripting (XSS) vulnerabilities in functions.inc.php for Double Choco Latte 0.9.4.3 allow remote attackers to inject arbitrary web script or HTML via the (1) class or (2) method name.
CVSS v2.0: 4.3
RHSA-2018:1640: Red Hat Security Advisory: kernel security update
hw: cpu: speculative store bypass
CVSS v3.0: 5.6
GHSA-h793-prqc-9r54: A stack overflow in the src/main.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecting a crafted input into the filename parameter.
CVSS v3.1: 6.2
RHSA-2024:9729: Red Hat Security Advisory: squid security update
squid: Denial of Service processing ESI response content
CVSS v3.1: 7.5
CVE-2012-2408: The AAC SDK in RealNetworks RealPlayer before 15.0.6.14, RealPlayer SP 1.0 through 1.1.5, and Mac RealPlayer before 12.0.1.1750 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a crafted AAC file that is not properly handled during decoding.
CVSS v2.0: 6.8
RHSA-2025:17129: Red Hat Security Advisory: idm:DL1 security update
FreeIPA: idm: Privilege escalation from host to domain admin in FreeIPA
CVSS v3.1: 9.1
CVE-2023-23477: IBM WebSphere Application Server code execution
IBM WebSphere Application Server 8.5 and 9.0 traditional could allow a remote attacker to execute arbitrary code on the system with a specially crafted sequence of serialized objects.  IBM X-Force ID:  245513.
CVSS v3.1: 8.1
CVE-2019-0828: A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'.
CVSS v3.0: 7.8
CVSS v2.0: 9.3
GHSA-645m-2pcv-99m7: An issue was discovered in 42Gears SureMDM before 2018-11-27. By visiting the page found at /console/ConsolePage/Master.html, an attacker is able to see the markup that would be presented to an authenticated user. This is caused by the session validation occurring after the initial markup is loaded. This results in a list of unprotected API endpoints that disclose call logs, SMS logs, and user-account data.
CVSS v3.0: 7.5
GHSA-mv3p-7p89-wq9p: Connect CMS has Stored Cross-site Scripting (XSS) in the File Field of its Form Plugin
Security Advisory — Form Plugin (Stored XSS)SummaryA Stored Cross-site Scripting (XSS) issue exists in the file field of the Form Plugin.Affected Versions1.x series: <= 1.41.02.x series: <= 2.41.0Patched Versions1.41.12.41.1DescriptionIn the file field of the Form Plugin, Stored Cross-site Scripting (XSS) could occur. If exploited, arbitrary script could run in an administrator's browser, which may lead to unauthorized actions or information theft. Users affected by this vulnerability should update to a fixed version.SolutionUpdate to the fixed version.
For the 1.x series, update to 1.41.1 or later.
For the 2.x series, update to 2.41.1 or later.CreditsOpenSource WorkShop thanks **Sho Odagiri** (小田切 祥) of **GMO Cybersecurity by Ierae, Inc.** for reporting this vulnerability.
CVSS v3.1: 8.2
GHSA-m9fj-g263-c8f3: Novell Internet Messaging System (NIMS) 2.6 and 3.0, and NetMail 3.1 and 3.5, is installed with a default NMAP authentication credential, which allows remote attackers to read and write mail store data if the administrator does not change the credential by using the NMAP Credential Generator.
CVE-2026-24964: WordPress Contest Gallery plugin <= 28.1.2.1 - Server Side Request Forgery (SSRF) vulnerability
Server-Side Request Forgery (SSRF) vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Server Side Request Forgery.This issue affects Contest Gallery: from n/a through <= 28.1.2.1.
CVSS v3.1: 6.4
GHSA-m56x-jmq4-9m4w: Improper access control vulnerability in sendDHCPACKBroadcast function of SemWifiApClient prior to SMR Jul-2022 Release 1 allows attacker to access wifi ap client mac address that connected by using WIFI_AP_STA_STATE_CHANGED action.
CVSS v3.1: 3.3
CVE-2025-4653: Remote Code Execution leads to Command Injection
Improper Neutralization of Special Elements in the backup name field may allow OS command injection. This issue affects Pandora ITSM 5.0.105.
CVSS v4.0: 7
RHSA-2026:8458: Red Hat Security Advisory: freerdp security update
FreeRDP: FreeRDP: Denial of Service via specially crafted Remote Desktop Protocol messages FreeRDP: FreeRDP: Heap buffer overflow allows arbitrary code execution via crafted pixel data
CVSS v3.1: 7.5
CVE-2021-39741: In Keymaster, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-173567719
CVSS v3.1: 7.8
CVSS v2.0: 4.6
GHSA-jp5j-q2jw-fhpf: CAI Content Credentials versions c2pa-web@0.7.1, c2pa-v0.80.1 and earlier are affected by an Uncontrolled Resource Consumption vulnerability. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.
CVSS v3.1: 6.2
CVE-2020-7467: In FreeBSD 12.2-STABLE before r365767, 11.4-STABLE before r365769, 12.1-RELEASE before p10, 11.4-RELEASE before p4 and 11.3-RELEASE before p14 a number of AMD virtualization instructions operate on host physical addresses, are not subject to nested page table translation, and guest use of these instructions was not trapped.
CVSS v3.1: 7.6
CVSS v2.0: 7.2
GHSA-hrmw-qprp-wgmc: PhpSpreadsheet has XSS via number format code with @ text placeholder bypasses htmlspecialchars in HTML writer
It was discovered that there is a way to bypass HTML escaping in the HTML writer using custom number format codes.The ProblemIn `Writer/Html.php` around line 1592, the code checks if the formatted cell data equals the original data to decide whether to apply `htmlspecialchars()`:When a cell has a custom number format containing `@` (text placeholder) with any additional literal characters, the formatter replaces `@` with the cell value and adds the extra characters. This makes `$cellData !== $origData`, so `htmlspecialchars()` is **skipped entirely**.Even a single trailing space in the format (`@ `) is enough to bypass the escape.Proof of ConceptThe generated HTML contains:The XSS payload is **completely unescaped**.Tested Bypass Formats| Format Code | Result | Escaped? |
|---|---|---|
| `General` (default) | Original value | YES (safe) |
| `. @` | `. ` + value | **NO (XSS!)** |
| `@ ` (trailing space) | value + ` ` | **NO (XSS!)** |
| `x@` | `x` + value | **NO (XSS!)** |This was tested with PhpSpreadsheet 4.5.0 and confirmed the XSS executes in the browser.ImpactAny application that:Accepts uploaded XLSX files from usersConverts them to HTML using PhpSpreadsheet's HTML writerDisplays the HTML to other users...is vulnerable to stored XSS. The attacker embeds the payload in a cell value and sets a custom number format in the XLSX file's `xl/styles.xml`.Suggested FixAlways apply `htmlspecialchars()` regardless of whether formatting changed the value:Or escape AFTER formatting, not conditionally based on equality.ReporterKeyvan Hardani
CVSS v3.1: 5.4
RHSA-2008:0988: Red Hat Security Advisory: libxml2 security update
libxml2: integer overflow leading to infinite loop in xmlBufferResize libxml2: integer overflow leading to memory corruption in  xmlSAX2Characters
GHSA-m6c3-p3rg-chxv: Format string vulnerability in the AbstractCommand::onAbort function in src/AbstractCommand.cc in aria2 before 1.6.2, when logging is enabled, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via format string specifiers in a download URI.  NOTE: some of these details are obtained from third party information.
GHSA-m44q-pcg2-44fv: Persistent Accelerite Radia Client Automation (formerly HP Client Automation) 7.9 through 9.1 before 2015-02-19 improperly implements the Role Based Access Control feature, which might allow remote attackers to modify an account's role assignments via unspecified vectors.
GHSA-2565-9vww-cf73: phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/admin/widgets/edit.php
CVSS v3.1: 7.1
GHSA-r55x-5rqx-xv6c: Use after free in Tab Strip in Google Chrome prior to 90.0.4430.212 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.
GHSA-9fqq-crr9-9q96: Unknown vulnerability in ColdFusion Server 2.0 through 4.5.1 SP2 allows remote attackers to overwrite templates with zero byte files via unknown attack vectors.
CVE-2025-5848: Tenda AC15 HTTP POST Request setPptpUserList formSetPPTPUserList buffer overflow
A vulnerability was found in Tenda AC15 15.03.05.19_multi and classified as critical. Affected by this issue is the function formSetPPTPUserList of the file /goform/setPptpUserList of the component HTTP POST Request Handler. The manipulation of the argument list leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 8.7
CVSS v3.1: 8.8
CVSS v3.0: 8.8
CVSS v2.0: 9
CVE-2022-45169: An issue was discovered in LIVEBOX Collaboration vDesk through v031. A URL Redirection to an Untrusted Site (Open Redirect) can occur under the /api/v1/notification/createnotification endpoint, allowing an authenticated user to send an arbitrary push notification to any other user of the system. This push notification can include an (invisible) clickable link.
CVSS v3.1: 5.9
CVE-2024-2613: Data was not properly sanitized when decoding a QUIC ACK frame; this could have led to unrestricted memory consumption and a crash. This vulnerability affects Firefox < 124.
CVSS v3.1: 7.5
GHSA-7jqc-2xm3-38rq: Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).  Supported versions that are affected are Prior to 7.0.24 and  prior to 7.1.6. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
CVSS v3.1: 5.5
GHSA-jvpp-hxjj-5ccc: Improper Input Validation and Missing Authentication for Critical Function in Apache ActiveMQ
It was found that the Apache ActiveMQ client before 5.14.5 exposed a remote shutdown command in the ActiveMQConnection class. An attacker logged into a compromised broker could use this flaw to achieve denial of service on a connected client.
CVSS v3.0: 4.9
GHSA-pqqw-6g5g-6pqj: A vulnerability in the web-based management interface of Cisco&nbsp;ECE could allow an unauthenticated, remote attacker to redirect a user to an undesired web page.
This vulnerability is due to improper input validation of the URL parameters in an HTTP request that is sent to an affected system. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to cause the interface to redirect the user to a specific, malicious URL. This type of vulnerability is known as an open redirect and is used in phishing attacks that get users to unknowingly visit malicious sites.Cisco&nbsp;has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
CVSS v3.1: 4.7
CVE-2001-1315: Critical Path (1) InJoin Directory Server or (2) LiveContent Directory allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via malformed BER encodings, as demonstrated by the PROTOS LDAPv3 test suite.
CVSS v2.0: 7.5
GHSA-9cfh-j5rr-38cm: Argument injection vulnerability in Microsoft Internet Explorer, when running on systems with SeaMonkey installed and certain URIs registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a mailto URI, which are inserted into the command line that is created when invoking SeaMonkey.exe, a related issue to CVE-2007-3670.
CVE-2019-9693: In CMS Made Simple (CMSMS) before 2.2.10, an authenticated user can achieve SQL Injection in class.showtime2_data.php via the functions _updateshow (parameter show_id), _inputshow (parameter show_id), _Getshowinfo (parameter show_id), _Getpictureinfo (parameter picture_id), _AdjustNameSeq (parameter shownumber), _Updatepicture (parameter picture_id), and _Deletepicture (parameter picture_id).
CVSS v3.0: 8.8
CVSS v2.0: 6.5
CVE-2025-25740: D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the PSK parameter in the SetQuickVPNSettings module.
CVSS v3.1: 5.5
GHSA-h8m3-2hqh-wxmr: In the Linux kernel, the following vulnerability has been resolved:Bluetooth: hci_event: Fix using rcu_read_(un)lock while iteratingThe usage of rcu_read_(un)lock while inside list_for_each_entry_rcu is
not safe since for the most part entries fetched this way shall be
treated as rcu_dereference:
CVSS v3.1: 5.5
CVE-2000-0130: Buffer overflow in SCO scohelp program allows remote attackers to execute commands.
CVSS v2.0: 7.2
CVE-2005-1481: Multiple SQL injection vulnerabilities in Aaron Outpost ASP Inline Corporate Calendar allow remote attackers to execute arbitrary SQL commands via the Event_ID parameter to (1) defer.asp or (2) details.asp.
CVSS v2.0: 7.5
GHSA-rf4g-89h5-crcr: melange affected by potential host command execution via license-check YAML mode patch pipeline
An attacker who can influence inputs to the patch pipeline could execute arbitrary shell commands on the build host. The patch pipeline in pkg/build/pipelines/patch.yaml embeds input-derived values (series paths, patch filenames, and numeric parameters) into shell scripts without proper quoting or validation, allowing shell metacharacters to break out of their intended context.The vulnerability affects the built-in patch pipeline which can be invoked through melange build and melange license-check operations. An attacker who can control patch-related inputs (e.g., through pull request-driven CI, build-as-a-service, or by influencing melange configurations) can inject shell metacharacters such as backticks, command substitutions  $(…), semicolons, pipes, or redirections to execute arbitrary commands with the privileges of the melange build process.Fix: Fixed in [bd132535](https://github.com/chainguard-dev/melange/commit/bd132535cd9f57d4bd39d9ead0633598941af030) ,  Released in 0.40.3.Acknowledgementsmelange thanks Oleh Konko (@1seal) from 1seal for discovering and reporting this issue.
CVSS v3.1: 7.8
RHSA-2024:0093: Red Hat Security Advisory: nss security update
nss: timing attack against RSA decryption
CVSS v3.1: 6.5
GHSA-mj7r-x3h3-7rmr: ApostropheCMS: User Enumeration via Timing Side Channel in Password Reset Endpoint
SummaryThe password reset endpoint (`/api/v1/@apostrophecms/login/reset-request`) exhibits a measurable timing side channel that allows unauthenticated attackers to enumerate valid usernames and email addresses. When a user is not found, the handler returns after a fixed 2-second artificial delay, but when a valid user is found, it performs database writes and SMTP operations with no equivalent delay normalization, producing a distinguishable timing profile.DetailsThe `resetRequest` handler in `modules/@apostrophecms/login/index.js` attempts to obscure the user-not-found path with an artificial delay, but fails to normalize the timing of the user-found path:**User not found — fixed 2000ms delay** (`index.js:309-314`):**User found — variable-duration DB + SMTP operations, no artificial delay** (`index.js:323-355`):The user-found path includes a MongoDB `update()` call and an SMTP `email()` send, which together produce response times that differ measurably from the fixed 2000ms delay. Depending on SMTP server latency, responses for valid users will either be noticeably faster (local/fast SMTP) or slower (remote SMTP) than the constant 2-second delay for invalid users.Additionally, the `getPasswordResetUser` method (`index.js:664-666`) accepts both username and email via an `$or` query, enabling enumeration of both identifiers:There is no rate limiting on the reset endpoint. The `checkLoginAttempts` throttle (`index.js:978`) is only applied to the login flow, allowing unlimited rapid probing of the reset endpoint.PoC**Prerequisites:** An Apostrophe instance with `passwordReset: true` enabled in `@apostrophecms/login` configuration.**Step 1 — Baseline invalid user timing:****Step 2 — Test known valid user:****Step 3 — Statistical comparison:**
The two distributions will show a measurable divergence. With a local mail server, valid-user responses typically complete in <500ms. With a remote SMTP server, valid-user responses may take 3-5+ seconds. Either way, the timing is distinguishable from the fixed 2000ms invalid-user delay.Impact**Account enumeration:** An unauthenticated attacker can determine whether a given username or email address has an account in the Apostrophe instance.**Credential stuffing preparation:** Confirmed valid accounts can be targeted with credential stuffing attacks using breached password databases.**Phishing targeting:** Knowledge of valid accounts enables targeted phishing campaigns against confirmed users.**No rate limiting:** The absence of throttling on the reset endpoint allows high-speed automated enumeration.**Mitigating factor:** The `passwordReset` option defaults to `false` (`index.js:62`), so only instances that explicitly enable password reset are affected.Recommended FixNormalize all code paths to a constant minimum duration, ensuring the response time does not leak whether a user was found:Additionally, consider applying rate limiting to the `reset-request` endpoint to prevent high-speed enumeration attempts.
CVSS v3.1: 3.7
GHSA-7q5j-32q8-c3qg: There is an Out-of-bounds array read vulnerability in the security storage module in smartphones. Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2020-9049: victor Web Client and C•CURE Web Client JSON Web Token (JWT) Vulnerability
A vulnerability in specified versions of American Dynamics victor Web Client and Software House C•CURE Web Client could allow an unauthenticated attacker on the network to create and sign their own JSON Web Token and use it to execute an HTTP API Method without the need for valid authentication/authorization. Under certain circumstances, this could be used by an attacker to impact system availability by conducting a Denial of Service attack.
CVSS v3.1: 7.1
CVE-2026-10295: SourceCodester Customer Review App review_app.py get_all_reviews denial of service
A vulnerability was found in SourceCodester Customer Review App 1.0. Affected by this vulnerability is the function add_review/save_review/get_all_reviews of the file review_app.py. Performing a manipulation of the argument name/comment results in denial of service. The attack requires a local approach. The exploit has been made public and could be used.
CVSS v4.0: 4.8
CVSS v3.1: 3.3
CVSS v3.0: 3.3
CVSS v2.0: 1.7