ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2022-41808: Improper buffer restriction in software for the Intel QAT Driver for Linux before version 1.7.l.4.12 may allow an authenticated user to potentially enable denial of service via local access.
CVSS v3.1: 3.3
RHSA-2026:6053: Red Hat Security Advisory: kernel security update
kernel: Linux kernel (qla2xxx): Double free vulnerability leads to denial of service and potential privilege escalation. kernel: kernel: Privilege escalation or denial of service via use-after-free in nf_tables_addchain()
CVSS v3.1: 7.5
CVE-2024-41043: netfilter: nfnetlink_queue: drop bogus WARN_ON
In the Linux kernel, the following vulnerability has been resolved:

netfilter: nfnetlink_queue: drop bogus WARN_ON

Happens when rules get flushed/deleted while packet is out, so remove
this WARN_ON.

This WARN exists in one form or another since v4.14, no need to backport
this to older releases, hence use a more recent fixes tag.
CVSS v3.1: 5.5
CVE-2008-3446: Directory traversal vulnerability in inc/wysiwyg.php in LetterIt 2 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the language parameter.
CVSS v2.0: 6.8
RHSA-2008:0500: Red Hat Security Advisory: rhpki-common security update
System: incorrect handling of Extensions in CSRs (cs71)
CVE-2014-5650: The Traffic Jam Free (aka com.jiuzhangtech.rushhour) application 1.7.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0: 5.4
CVE-1999-0403: A bug in Cyrix CPUs on Linux allows local users to perform a denial of service.
CVSS v2.0: 5
GHSA-j7c4-w5pq-7cg7: In the Linux kernel, the following vulnerability has been resolved:drm/tests: shmem: Hold reservation lock around madviseAcquire and release the GEM object's reservation lock around calls
to the object's madvide operation. The tests use
drm_gem_shmem_madvise_locked(), which led to errors such as show below.[   58.339389] WARNING: CPU: 1 PID: 1352 at drivers/gpu/drm/drm_gem_shmem_helper.c:499 drm_gem_shmem_madvise_locked+0xde/0x140Only export the new helper drm_gem_shmem_madvise() for Kunit tests.
This is not an interface for regular drivers.
CVSS v3.1: 5.5
CVE-2022-20290: In Midi, there is a possible way to learn about private midi devices due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-203549963
CVSS v3.1: 5.5
GHSA-m8mc-m2cv-v6hr: NVIDIA GPU Display Driver contains a vulnerability in the kernel mode layer handler where improper access controls could allow unprivileged users to cause a denial of service.
CVSS v3.0: 5.5
CVE-2006-3946: WebCore in Apple Mac OS X 10.3.9 and 10.4 through 10.4.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted HTML that triggers a "memory management error" in WebKit, possibly due to a buffer overflow, as originally reported for the KHTMLParser::popOneBlock function in Apple Safari 2.0.4 using Javascript that changes document.body.innerHTML within a DIV tag.
CVSS v2.0: 7.5
CVE-2024-37377: A heap-based buffer overflow in IPsec of Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to cause a denial of service.
CVSS v3.0: 7.5
GHSA-vmv3-v549-j8qc: The Novell Netware client running on Windows 95 allows local users to bypass the login and open arbitrary files via the "What is this?" help feature, which can be launched from the Novell Netware login screen.
GHSA-gx25-hxv6-h79m: A security vulnerability in HPE Unified Data Management (UDM) could allow the local disclosure of privileged information (CWE-321: Use of Hard-coded Cryptographic Key in a product). HPE has provided updates to versions 1.2009.0 and 1.2101.0 of HPE Unified Data Management (UDM). Version 1.2103.0 of HPE Unified Data Management (UDM) removes all hard-coded cryptographic keys.
CVSS v3.1: 5.5
CVE-2002-0526: Vulnerability in (1) inews or (2) rnews for INN 2.2.3 and earlier, related to insecure open() calls.
CVSS v2.0: 7.2
RHSA-2020:3462: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.2 security update
hibernate: SQL injection issue in Hibernate ORM EAP: field-name is not parsed in accordance to RFC7230 Wildfly: Improper authorization issue in WildFlySecurityManager when using alternative protection domain jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution dom4j: XML External Entity vulnerability in default SAX parser Undertow: Incomplete fix for CVE-2017-2666 due to permitting invalid characters in HTTP requests hibernate-validator: Improper input validation in the interpolation of constraint error messages wildfly-elytron: session fixation when using FORM authentication wildfly: exposed setting of TCCL via the EmbeddedManagedProcess API wildfly: unsafe deserialization in Wildfly Enterprise Java Beans netty: compression/decompression codecs don't enforce limits on buffer allocation sizes wildfly: Some EJB transaction objects may get accumulated causing Denial of Service wildfly: EJB SessionOpenInvocations may not be removed properly after a response is received causing Denial of Service
CVSS v3.1: 6.5
CVSS v3.0: 4.8
CVE-2021-24544: Responsive WordPress Slider <= 2.2.0 - Subscriber+ Stored Cross-Site Scripting
The Responsive WordPress Slider WordPress plugin through 2.2.0 does not sanitise and escape some of the Slider options, allowing Cross-Site Scripting payloads to be set in them. Furthermore, as by default any authenticated user is allowed to create Sliders (https://wordpress.org/support/topic/slider-can-be-changed-from-any-user-even-subscriber/, such settings can be changed in the plugin's settings), this would allow user with a role as low as subscriber to perform Cross-Site Scripting attacks against logged in admins viewing the slider list and could lead to privilege escalation by creating a rogue admin account for example.
CVSS v3.1: 5.4
CVSS v2.0: 3.5
GHSA-995g-hx4g-8h72: The AdRotate WordPress plugin before 5.8.22 does not sanitise and escape the adrotate_action before using it in a SQL statement via the adrotate_request_action function available to admins, leading to a SQL injection
CVSS v3.1: 7.2
GHSA-hh5m-fj6m-hwjp: Artifex MuPDF 1.11 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file, related to "Data from Faulting Address controls Branch Selection starting at mupdf+0x000000000016aa61" on Windows. This occurs because xps_load_links_in_glyphs in xps/xps-link.c does not verify that an xps font could be loaded.
CVSS v3.0: 7.8
GHSA-vmrm-3gr2-66vg: Multiple SQL injection vulnerabilities in main.php in the WassUp plugin 1.4 through 1.4.3 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) from_date or (2) to_date parameter to spy.php.
RHSA-2009:0336: Red Hat Security Advisory: glib2 security update
glib2: integer overflows in the base64 handling functions (oCERT-2008-015)
CVE-2016-10498: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9635M, MDM9645, MDM9650, MDM9655, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 810, SDM630, SDM636, SDM660, and Snapdragon_High_Med_2016, stopping of the DTR prematurely causes micro kernel to be stuck. This can be triggered with a timing change injectable in RACH procedure.
CVSS v3.0: 9.8
CVSS v2.0: 10
CVE-2017-1000228: nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function
CVSS v3.0: 9.8
CVSS v2.0: 10
GHSA-hr9q-fc36-qcfj: The default configuration in a sudoers file in the Red Hat openstack-neutron package before 2014.1.2-4, as used in Red Hat Enterprise Linux Open Stack Platform 5.0 for Red Hat Enterprise Linux 6, allows remote attackers to gain privileges via a crafted configuration file.  NOTE: this vulnerability exists because of a CVE-2013-6433 regression.
GHSA-62gg-g3mg-cmc5: Kaspersky Lab Antivirus Engine version before 04.apr.2019 has a heap-based buffer overflow vulnerability that potentially allow arbitrary code execution
CVSS v3.0: 8.8
GHSA-h9gw-q7wq-vrfv: The Enable Media Replace WordPress plugin before 4.1.3 unserializes user input via the Remove Background feature, which could allow Author+ users to perform PHP Object Injection when a suitable gadget is present on the blog
CVSS v3.1: 8.8
GHSA-jx9x-cr8x-3c92: Uapplication Ublog Reload stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for mdb-database/blog.mdb (aka mdb-database/blog.msb).
CVE-2017-18909: An issue was discovered in Mattermost Server before 3.9.0 when SAML is used. Encryption and signature verification are not mandatory.
CVSS v3.1: 7.5
CVSS v2.0: 4.3
CVE-2020-7549: A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in the Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules (see security notification for affected versions), that could cause denial of HTTP and FTP services when a series of specially crafted requests is sent to the controller over HTTP.
CVSS v3.1: 7.5
CVSS v2.0: 5
RHSA-2020:5396: Red Hat Security Advisory: libexif security update
libexif: out of bounds write due to an integer overflow in exif-entry.c
CVSS v3.1: 9.8
CVE-2017-17553: The Dolphin Browser for Android 12.0.2 suffers from an insecure parsing implementation of the Intent URI scheme. This vulnerability could allow attackers to abuse this implementation through a malicious Intent URI, in order to invoke private Activities within the Dolphin Browser.
CVSS v3.0: 5.3
CVSS v2.0: 5
CVE-2024-26148: Querybook's Stored Cross-Site Scripting vulnerability allows Privilege Elevation
Querybook is a user interface for querying big data. Prior to version 3.31.1, there is a vulnerability in Querybook's rich text editor that enables users to input arbitrary URLs without undergoing necessary validation. This particular security flaw allows the use of `javascript:` protocol which can potentially trigger arbitrary client-side execution. The most extreme exploit of this flaw could occur when an admin user unknowingly clicks on a cross-site scripting URL, thereby unintentionally compromising admin role access to the attacker. A patch to rectify this issue has been introduced in Querybook version `3.31.1`. The fix is backward compatible and automatically fixes existing DataDocs. There are no known workarounds for this issue, except for manually checking each URL prior to clicking on them.
CVSS v3.1: 6.1
GHSA-425v-6qh8-hmjx: Missing Authorization vulnerability in cedcommerce Ship Per Product allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Ship Per Product: from n/a through 2.1.0.
CVSS v3.1: 5.3
GHSA-pqx7-vfw2-98vh: The mobi_pk1_decrypt function in encryption.c in Libmobi 0.3 allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted mobi file.
CVSS v3.0: 8.8
CVE-2013-0321: Cross-site scripting (XSS) vulnerability in Views in the Ubercart Views (uc_views) module 6.x before 6.x-3.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via the full name field.
CVSS v2.0: 4.3
GHSA-5q9h-wgw4-vw3p: Cross-site scripting (XSS) vulnerability in install.php in C-News.fr C-News 1.0.1 allows remote attackers to inject arbitrary web script or HTML via the etape parameter.
GHSA-cj34-qf96-c4gj: NVIDIA SHIELD TV, all versions prior to 8.2.2, contains a vulnerability in the implementation of the RPMB command status, in which an attacker can write to the Write Protect Configuration Block, which may lead to denial of service or escalation of privileges.
RHSA-2025:20922: Red Hat Security Advisory: webkit2gtk3 security update
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash webkitgtk: A website may be able to access sensor information without user consent webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash
CVSS v3.1: 8.8
CVE-2022-2398: WP Comments Fields < 4.1 - Admin+ Stored Cross-Site Scripting
The WordPress Comments Fields WordPress plugin before 4.1 does not escape Field Error Message, which could allow high-privileged users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
CVSS v3.1: 4.8
CVE-2022-31556: The rusyasoft/TrainEnergyServer repository through 2017-08-03 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVSS v3.1: 9.3
CVSS v2.0: 6.4
CVE-2023-25671: TensorFlow has segmentation fault in tfg-translate 
TensorFlow is an open source platform for machine learning. There is out-of-bounds access due to mismatched integer type sizes. A fix is included in TensorFlow version 2.12.0 and version 2.11.1.

CVSS v3.1: 7.5
GHSA-5px9-63j7-5f27: The E-Mail autoconfiguration feature in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 places a password in a GET request, which allows remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history.
CVE-2022-22845: QXIP SIPCAPTURE homer-app before 1.4.28 for HOMER 7.x has the same 167f0db2-f83e-4baa-9736-d56064a5b415 JWT secret key across different customers' installations.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
GHSA-6797-3vc4-x4hv: Cross-site scripting (XSS) vulnerability in index.php in Aardvark Topsites PHP 5.2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the q parameter in a search action. NOTE: it was later reported that 5.2.1 is also affected.
CVE-2010-4114: Cross-site scripting (XSS) vulnerability in HP Discovery & Dependency Mapping Inventory (DDMI) 2.5x, 7.5x, and 7.6x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS v2.0: 4.3
GHSA-v3v8-cv78-pwpq: An HTTP Packet Processing vulnerability in the Web Bridge interface of the Cisco Meeting Server (CMS), formerly Acano Conferencing Server, could allow an authenticated, remote attacker to retrieve memory contents, which could lead to the disclosure of confidential information. In addition, the attacker could potentially cause the application to crash unexpectedly, resulting in a denial of service (DoS) condition. The attacker would need to be authenticated and have a valid session with the Web Bridge. Affected Products: This vulnerability affects Cisco Meeting Server software releases prior to 2.1.2. This product was previously known as Acano Conferencing Server. More Information: CSCvc89551. Known Affected Releases: 2.0 2.0.7 2.1. Known Fixed Releases: 2.1.2.
CVSS v3.0: 8.1
CVE-2026-8991: Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'drag_n_drop_text' and 'drag_n_drop_browse_text' Settings
The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'drag_n_drop_text' and 'drag_n_drop_browse_text' Settings in all versions up to, and including, 1.3.9.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 4.4
GHSA-28q4-fvwg-fpr2: A vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63581671.
CVSS v3.0: 7.5
GHSA-9cj3-p33g-x9hg: The Magick_png_malloc function in coders/png.c in GraphicsMagick 6.7.8-6 does not use the proper variable type for the allocation size, which might allow remote attackers to cause a denial of service (crash) via a crafted PNG file that triggers incorrect memory allocation.
CVE-2023-27783: An issue found in TCPreplay tcprewrite v.4.4.3 allows a remote attacker to cause a denial of service via the tcpedit_dlt_cleanup function at plugins/dlt_plugins.c.
CVSS v3.1: 7.5
GHSA-mvhp-p3f4-phmx: Delta Electronics InfraSuite Device Master versions 00.00.01a and prior lack proper authentication for functions that create and modify user groups. An attacker could provide malicious serialized objects that could run these functions without authentication to create a new user and add them to the administrator group.
CVSS v3.1: 7.5
CVE-2012-5616: Apache CloudStack 4.0.0-incubating and Citrix CloudPlatform (formerly Citrix CloudStack) before 3.0.6 stores sensitive information in the log4j.conf log file, which allows local users to obtain (1) the SSH private key as recorded by the createSSHKeyPair API, (2) the password of an added host as recorded by the AddHost API, or the password of an added VM as recorded by the (3) DeployVM or (4) ResetPasswordForVM API.
CVSS v2.0: 1.5
GHSA-v545-vv44-hr8j: The Hello Kitty Cafe (aka com.sd.google.helloKittyCafe) application 1.4.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
GHSA-jc7g-x28f-3v3h: listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user
SummaryThe `env` and `expandenv` template functions which is enabled by default in [Sprig](https://masterminds.github.io/sprig/) enables capturing of env variables on the host. While this may not be a problem on single-user (super admin) installations, on multi-user installations, this allows non-super-admin users with campaign or template permissions to use the `{{ env }}` template expression to capture sensitive environment variables.**Upgrade to [v5.0.2](https://github.com/knadh/listmonk/releases/tag/v5.0.2)** to mitigate.DemonstrationDescriptionA critical template injection vulnerability exists in Listmonk's campaign preview functionality that allows authenticated users with minimal privileges (campaigns:get & campaigns:get_all) to extract sensitive system data, including database credentials, SMTP passwords, and admin credentials due to some dangerous function being allowed.Proof of ConceptCreate a user and give him `campaigns:get` and `campaigns:get_all` privileges![image](https://github.com/user-attachments/assets/05333695-14d9-498e-9f73-2137d6eca55b)Now login with that user, go to any campaign, go the Content section and here lies the vulnerability, we're able to execute template content which allows us to get environment variables, execute Sprig functions...Now in the text field you can input the following and press Preview:![image](https://github.com/user-attachments/assets/ac963f54-5982-47d4-99d0-59030917f548)Preview:![image](https://github.com/user-attachments/assets/99558ca4-81c6-4e1a-bd0d-6bc57830f4d0)I had the AWS_KEY variable set like that to confirm the vulnerability:![image](https://github.com/user-attachments/assets/16382998-2402-436a-9bb0-db09fb13dd79)ImpactThrough these environment variables the attacker can access, they can fully compromise the database, cloud accounts, admin credentials, and more depending on what was setup leading to total system takeover and data breach.Suggested FixBlacklist some function for templates like env, expandEnv and fail as they can be used to leak environment variables which leads to a full takeover.
CVSS v3.1: 9
CVE-2009-2276: SQL injection vulnerability in voteforus.php in the Vote For Us extension 1.0.1 and earlier for PunBB allows remote attackers to execute arbitrary SQL commands via the out parameter.
CVSS v2.0: 7.5
GHSA-qch7-73vq-h8qh: Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723  and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker to hijack existing HTML5 connections.
CVSS v3.1: 8.9
GHSA-fm9f-7rqx-chvx: An SMI handler input validation vulnerability in the BIOS of some ThinkPad models could allow an attacker with local access and elevated privileges to execute arbitrary code.
CVSS v3.1: 6.7
GHSA-75m2-92fc-x3mj: A vulnerability in the TCP proxy functionality of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a denial of service (DoS) condition. This vulnerability is due to improper handling of TCP flows. An attacker could exploit this vulnerability by sending a crafted stream of TCP traffic through an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.
CVSS v3.1: 7.5
GHSA-7jr7-p2g8-6cfq: RealNetworks RealPlayer 11.0 through 11.1 and RealPlayer SP 1.0 through 1.1.4 on Windows do not properly handle dimensions during YUV420 transformations, which might allow remote attackers to execute arbitrary code via crafted MP4 content.
CVE-2022-32206: curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a "malloc bomb", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors.
CVSS v3.1: 6.5
CVSS v2.0: 4.3
RHSA-2024:5690: Red Hat Security Advisory: 389-ds:1.4 security update
389-ds-base: a heap overflow leading to denail-of-servce while writing a value larger than 256 chars (in log_entry_attr) 389-ds-base: Malformed userPassword may cause crash at do_modify in slapd/modify.c 389-ds-base: potential denial of service via specially crafted kerberos AS-REQ request 389-ds-base: Malformed userPassword hash may cause Denial of Service
CVSS v3.1: 5.7
CVE-2024-55407: An issue in the DeviceloControl function of ITE Tech. Inc ITE IO Access v1.0.0.0 allows attackers to perform arbitrary port read and write actions via supplying crafted IOCTL requests.
CVSS v3.1: 7.8
CVE-2018-13660: The mint function of a smart contract implementation for BillionRewardsToken, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS v3.0: 7.5
CVSS v2.0: 5
CVE-2022-28191: NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (nvidia.ko), where uncontrolled resource consumption can be triggered by an unprivileged regular user, which may lead to denial of service.
CVSS v3.1: 5.5
CVE-2005-4308: index.php in ezUpload Pro 2.2 and earlier allows remote attackers to include files via the mode parameter.
CVSS v2.0: 7.5
CVE-2014-0871: RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics allows remote attackers to obtain potentially sensitive Tomcat stack-trace information via non-printing characters in a cookie to the /classes/ URI, as demonstrated by the \x00 character.
CVSS v2.0: 4.3
GHSA-7q89-h9hg-x89w: The ij_untrusted_url function in JunkBuster 2.0.2-r2, with single-threaded mode enabled, allows remote attackers to overwrite the referrer field via a crafted HTTP request.