ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2026-0960: Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark
HTTP3 protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.2 allows denial of service
CVSS v3.1: 4.7
GHSA-765c-w3w5-9cgw: EDIMAX BR-6288ACL v1.12 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the pppUserName parameter.
CVSS v3.1: 8.8
GHSA-3r49-gcgv-9gw5: Server Side Request Forgery vulnerability found in Deskpro Support Desk v2021.21.6 allows attackers to execute arbitrary code via a crafted URL.
CVSS v3.1: 7.2
GHSA-m2r5-w7hg-5233: The ReadGIFImage function in coders/gif.c in ImageMagick before 6.7.8-8 allows remote attackers to cause a denial of service (memory corruption and application crash) via a crafted comment in a GIF image.
CVE-2022-31767: IBM CICS TX Standard and Advanced 11.1 could allow a remote attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 227980.
CVSS v3.0: 9.8
GHSA-g3qx-2527-xc65: Cross-site scripting (XSS) vulnerability in the IP Address Lookup functionality in BSQ Sitestats (component for Joomla) 1.8.0, and possibly other versions before 2.2.1, allows remote attackers to inject arbitrary web script and HTML via the ip parameter.
CVE-2023-47694: WordPress Mini Cart Drawer For WooCommerce plugin <= 4.0.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in appsbd Mini Cart Drawer For WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mini Cart Drawer For WooCommerce: from n/a through 4.0.0.
CVSS v3.1: 5.4
GHSA-2vg7-q8hg-5f79: A potential vulnerability in the SMI callback function used in the EEPROM driver in some Lenovo Desktops and ThinkStation models may allow arbitrary code execution
CVE-2015-5040: Buffer overflow in IBM Domino 8.5.1 through 8.5.3 before 8.5.3 FP6 IF10 and 9.x before 9.0.1 FP4 IF3 allows remote attackers to execute arbitrary code or cause a denial of service (SMTP daemon crash) via a crafted GIF image, aka SPRs KLYH9ZDKRE and KLYH9ZTLEZ, a different vulnerability than CVE-2015-4994.
CVSS v2.0: 7.5
CVE-2012-5060: Unspecified vulnerability in the Server component in Oracle MySQL 5.1.65 and earlier and 5.5.27 and earlier allows remote authenticated users to affect availability, related to GIS Extension.
CVSS v2.0: 6.8
CVE-2006-2966: Cross-site scripting (XSS) vulnerability in Particle Soft Particle Wiki 1.0.2 allows remote attackers to inject arbitrary web script or HTML via a BR element with an extraneous IMG tag and a STYLE attribute that contains "/**/" comment sequences, which bypasses the XSS protection scheme.
CVSS v2.0: 4.3
CVE-2023-28745: Uncontrolled search path in Intel(R) QSFP+ Configuration Utility software, all versions, may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS v3.1: 6.7
CVE-2015-1401: Improper Authentication vulnerability in the "LDAP / SSO Authentication" (ig_ldap_sso_auth) extension 2.0.0 for TYPO3.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
CVE-2024-57881: mm/page_alloc: don't call pfn_to_page() on possibly non-existent PFN in split_large_buddy()
In the Linux kernel, the following vulnerability has been resolved:

mm/page_alloc: don't call pfn_to_page() on possibly non-existent PFN in split_large_buddy()

In split_large_buddy(), we might call pfn_to_page() on a PFN that might
not exist.  In corner cases, such as when freeing the highest pageblock in
the last memory section, this could result with CONFIG_SPARSEMEM &&
!CONFIG_SPARSEMEM_EXTREME in __pfn_to_section() returning NULL and and
__section_mem_map_addr() dereferencing that NULL pointer.

Let's fix it, and avoid doing a pfn_to_page() call for the first
iteration, where we already have the page.

So far this was found by code inspection, but let's just CC stable as the
fix is easy.
CVSS v3.1: 5.5
GHSA-6xgq-qqh9-3v8g: Use after free in extensions in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially perform a sandbox escape via a crafted Chrome Extension.
CVE-2024-31481: Unauthenticated Denial of Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected service.
CVSS v3.1: 5.3
RHSA-2016:0651: Red Hat Security Advisory: java-1.8.0-openjdk security update
OpenJDK: insufficient thread consistency checks in ObjectInputStream (Serialization, 8129952) OpenJDK: insufficient byte type checks (Hotspot, 8132051) OpenJDK: insufficient DSA key parameters checks (Security, 8138593) OpenJDK: incorrect handling of surrogate pairs in XML attribute values (JAXP, 8143167) OpenJDK: non-constant time GCM authentication tag comparison (JCE, 8143945) OpenJDK: unrestricted deserialization of authentication credentials (JMX, 8144430)
GHSA-c3gg-vqm5-638v: Cross-Site Request Forgery (CSRF) vulnerability in DarkMySite DarkMySite – Advanced Dark Mode Plugin for WordPress darkmysite allows Cross Site Request Forgery.This issue affects DarkMySite – Advanced Dark Mode Plugin for WordPress: from n/a through 1.2.8.
CVSS v3.1: 4.3
CVE-2022-27226: A CSRF issue in /api/crontab on iRZ Mobile Routers through 2022-03-16 allows a threat actor to create a crontab entry in the router administration panel. The cronjob will consequently execute the entry on the threat actor's defined interval, leading to remote code execution, allowing the threat actor to gain filesystem access. In addition, if the router's default credentials aren't rotated or a threat actor discovers valid credentials, remote code execution can be achieved without user interaction.
CVSS v3.1: 8.8
CVSS v2.0: 9.3
CVE-2025-39694: s390/sclp: Fix SCCB present check
In the Linux kernel, the following vulnerability has been resolved:

s390/sclp: Fix SCCB present check

Tracing code called by the SCLP interrupt handler contains early exits
if the SCCB address associated with an interrupt is NULL. This check is
performed after physical to virtual address translation.

If the kernel identity mapping does not start at address zero, the
resulting virtual address is never zero, so that the NULL checks won't
work. Subsequently this may result in incorrect accesses to the first
page of the identity mapping.

Fix this by introducing a function that handles the NULL case before
address translation.
CVSS v3.1: 5.5
CVE-2016-9872: EMC Documentum D2 version 4.5 and EMC Documentum D2 version 4.6 has Reflected Cross-Site Scripting Vulnerabilities that could potentially be exploited by malicious users to compromise the affected system.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
GHSA-j77w-w4mp-8h58: Missing Authorization vulnerability in Dynamic.ooo Dynamic Visibility for Elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dynamic Visibility for Elementor: from n/a through 5.0.5.
CVSS v3.1: 5.4
RHSA-2013:1508: Red Hat Security Advisory: java-1.6.0-ibm security update
OpenJDK: java.util.TimeZone does not restrict setting of default time zone (Libraries, 8001029) JDK: unspecified sandbox bypass (JVM) JDK: XML4J xml entity expansion excessive memory use (XML) JDK: unspecified sandbox bypass (XML) JDK: unspecified sandbox bypass (ORB) OpenJDK: insufficient html escaping in jhat (jhat, 8011081) OpenJDK: Inet6Address class IPv6 address processing errors (Libraries, 8015743) JDK: unspecified vulnerability fixed in 7u45 (Deployment) OpenJDK: image conversion out of bounds read (2D, 8014102) OpenJDK: key data leak via toString() methods (Libraries, 8011071) OpenJDK: Incorrect awt_getPixelByte/awt_getPixelShort/awt_setPixelByte/awt_setPixelShort image raster checks (2D, 8014093) OpenJDK: JTable not properly performing certain access checks (Swing, 8013744) OpenJDK: insufficient InterfaceImplementor security checks (Scripting, 8017299) JDK: unspecified vulnerability fixed in 7u45 (Deployment) JDK: unspecified vulnerability fixed in 7u45 (Deployment) OpenJDK: insufficient escaping of window title string (Javadoc, 8016675) JDK: unspecified vulnerability fixed in 7u45 (2D) OpenJDK: javax.xml.transform.TransformerFactory does not properly honor XMLConstants.FEATURE_SECURE_PROCESSING (JAXP, 8012425) OpenJDK: insufficient checks of KDC replies (JGSS, 8014341) OpenJDK: javac does not ignore certain ignorable characters (Javadoc, 8016653) OpenJDK: JPEGImageReader and JPEGImageWriter missing band size checks (2D, 8013510) JDK: unspecified vulnerability fixed in 7u45 (Deployment) OpenJDK: RMIConnection stub missing permission check (CORBA, 8011157) OpenJDK: VersionHelper12 does not honor modifyThreadGroup restriction (JNDI, 8013739) JDK: unspecified vulnerability fixed in 7u45 (Deployment) JDK: unspecified vulnerability fixed in 7u45 (Deployment) OpenJDK: insufficient security checks (JAXWS, 8017505) OpenJDK: com.sun.org.apache.xml.internal.security.utils.UnsyncByteArrayOutputStream Denial of Service (Security, 8021290) JDK: unspecified vulnerability fixed in 7u45 (Deployment) OpenJDK: XML parsing Denial of Service (JAXP, 8014530) OpenJDK: Java2d Disposer security bypass (2D, 8017287) OpenJDK: checkPackageAccess missing security check (Libraries, 8017291) JDK: unspecified vulnerability fixed in 7u45 (Deployment) JDK: unspecified vulnerability fixed in 7u45 (Deployment) OpenJDK: getDeclaringClass() information leak (Libraries, 8014349) OpenJDK: ObjectInputStream/ObjectOutputStream missing checks (Libraries, 8014987) JDK: unspecified vulnerability fixed in 7u45 (2D) JDK: unspecified vulnerability fixed in 7u45 (Deployment) OpenJDK: insufficient DataFlavor security checks (AWT, 8012277) OpenJDK: Missing CORBA security checks (Libraries, 8017196) OpenJDK: XML stream factory finder information leak (JAXP, 8013502)
GHSA-3v58-c97h-7mc9: The wpbakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Author tag attribute in all versions up to, and including, 7.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
CVE-2011-1381: Unspecified vulnerability in IBM OpenPages GRC Platform 6.1.0.1 before IF4 allows remote attackers to bypass intended access restrictions via unknown vectors.
CVSS v2.0: 6.4
GHSA-636v-fj74-g872: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Silicon Labs Ember ZNet allows Overflow Buffers.
CVSS v3.1: 9.8
GHSA-gh2m-8w4p-v28f: An elevation of privilege vulnerability exists in Hackolade versions prior 4.2.0 on Windows has an issue in specific deployment scenarios that could allow local users to gain elevated privileges during an uninstall of the application.
GHSA-gmr7-jhwx-3h3j: McAfee Total Protection prior to version 16.0.49 contains an uncontrolled search path element vulnerability due to the use of a variable pointing to a subdirectory that may be controllable by an unprivileged user. This may have allowed the unprivileged user to execute arbitrary code with system privileges.
CVSS v3.1: 7.8
CVE-2011-0903: Multiple directory traversal vulnerabilities in AR Web Content Manager (AWCM) 2.2 allow remote attackers to read arbitrary files and possibly have other unspecified impact via a .. (dot dot) in the (1) awcm_theme or (2) awcm_lang cookie to (a) index.php or (b) header.php.
CVSS v2.0: 6.8
CVE-2024-4868: Extensions for Elementor <= 2.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via EE Events and EE Flipbox Widget
The Extensions for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's EE Events and EE Flipbox widgets in all versions up to, and including, 2.0.32 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
CVE-2025-21022: Improper access control in Galaxy Wearable prior to version 2.2.63.25042861 allows local attackers to access sensitive information.
CVSS v3.1: 3.3
CVE-2011-4510: Cross-site scripting (XSS) vulnerability in the HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008 before SP3; WinCC V11 (aka TIA portal) before SP2 Update 1; the TP, OP, MP, Comfort Panels, and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and WinCC flexible Runtime allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2011-4511.
CVSS v2.0: 4.3
CVE-2026-21877: n8n is vulnerable to Remote Code Execution via Arbitrary File Write
n8n is an open source workflow automation platform. In versions 0.121.2 and below, an authenticated attacker may be able to execute malicious code using the n8n service. This could result in full compromise and can impact both self-hosted and n8n Cloud instances. This issue is fixed in version 1.121.3. Administrators can reduce exposure by disabling the Git node and limiting access for untrusted users, but upgrading to the latest version is recommended.
CVSS v3.1: 10
CVE-2025-5786: TOTOLINK X15 HTTP POST Request formDMZ buffer overflow
A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105. It has been classified as critical. Affected is an unknown function of the file /boafrm/formDMZ of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 8.7
CVSS v3.1: 8.8
CVSS v3.0: 8.8
CVSS v2.0: 9
CVE-2021-1729: Windows Update Stack Setup Elevation of Privilege Vulnerability
Windows Update Stack Setup Elevation of Privilege Vulnerability
CVSS v3.1: 7.1
PYSEC-2021-495: TensorFlow is an end-to-end open source platform for machine learning. Due to lack of validation in `tf.raw_ops.SparseDenseCwiseMul`, an attacker can trigger denial of service via `CHECK`-fails or accesses to outside the bounds of heap allocated data. Since the implementation(https://github.com/tensorflow/tensorflow/blob/38178a2f7a681a7835bb0912702a134bfe3b4d84/tensorflow/core/kernels/sparse_dense_binary_op_shared.cc#L68-L80) only validates the rank of the input arguments but no constraints between dimensions(https://www.tensorflow.org/api_docs/python/tf/raw_ops/SparseDenseCwiseMul), an attacker can abuse them to trigger internal `CHECK` assertions (and cause program termination, denial of service) or to write to memory outside of bounds of heap allocated tensor buffers. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
CVE-2019-8121: An insecure component vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. Magento 2 codebase leveraged outdated versions of JS libraries (Bootstrap, jquery, Knockout) with known security vulnerabilities.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
GHSA-mgj8-8wcp-4jw2: Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how specially crafted web requests are sanitized, aka "Microsoft SharePoint Elevation of Privilege Vulnerability". This CVE is unique from CVE-2018-0909, CVE-2018-0910. CVE-2018-0911, CVE-2018-0913, CVE-2018-0914, CVE-2018-0915, CVE-2018-0916, CVE-2018-0917, CVE-2018-0921, CVE-2018-0923, CVE-2018-0944 and CVE-2018-0947.
CVSS v3.0: 8.8
GHSA-wg77-mr52-g6pm: Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.This issue affects:ProductAffected VersionsLoadMasterFrom 7.2.55.0 to 7.2.60.1 (inclusive)From 7.2.49.0 to 7.2.54.12 (inclusive)7.2.48.12 and all prior versionsECSAll prior versions to 7.2.60.1 (inclusive)
CVSS v3.1: 8.4
GHSA-j8hh-2v2c-wqmv: Insufficient authentication flow in Checkmk before 2.2.0p17, 2.1.0p37 and 2.0.0p39 allows attacker to use locked credentials
CVSS v3.1: 8.8
CVE-1999-0834: Buffer overflow in RSAREF2 via the encryption and decryption functions in the RSAREF library.
CVSS v2.0: 10
GHSA-qcmx-2mgh-jp57: A logic issue was addressed with improved restrictions. This issue is fixed in Safari 13.1.2. A malicious attacker may be able to change the origin of a frame for a download in Safari Reader mode.
CVE-2023-50304: IBM Engineering Requirements Management DOORS XML external entity injection
IBM Engineering Requirements Management DOORS Web Access 9.7.2.8 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.  IBM X-Force ID:  273335.
CVSS v3.1: 7.1
CVE-2023-3833: Bug Finder Montage Ticket create cross site scripting
A vulnerability was found in Bug Finder Montage 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /user/ticket/create of the component Ticket Handler. The manipulation of the argument message leads to cross site scripting. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-235159. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v3.1: 3.5
CVSS v3.0: 3.5
CVSS v2.0: 4
GHSA-h56g-gq9v-vc8r: jupyter-server errors include tracebacks with path information
ImpactUnhandled errors in API requests include traceback information, which can include path information. There is no known mechanism by which to trigger these errors without authentication, so the paths revealed are not considered particularly sensitive, given that the requesting user has arbitrary execution permissions already in the same environment.Patchesjupyter-server PATCHED_VERSION no longer includes traceback information in JSON error responses. For compatibility, the traceback field is present, but always empty.WorkaroundsNone
CVSS v3.1: 4.3
GHSA-v554-ffg4-x8gc: The SVGPlus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS v3.1: 6.4
CVE-2013-6448: The InterfaceGenerator handler in JBoss Seam Remoting in JBoss Seam 2 framework 2.3.1 and earlier, as used in JBoss Web Framework Kit, allows remote attackers to bypass the WebRemote annotation restriction and obtain information about arbitrary classes and methods on the server classpath via unspecified vectors.
CVSS v2.0: 5
GHSA-hhj8-hj4j-7q6w: WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php.
CVE-2022-21904: Windows GDI Information Disclosure Vulnerability
Windows GDI Information Disclosure Vulnerability
CVSS v3.1: 7.5
CVE-2007-3989: Multiple cross-site scripting (XSS) vulnerabilities in default.asp in Dora Emlak 1.0, when the goster parameter is set to iletisim, allow remote attackers to inject arbitrary web script or HTML via the (1) Adiniz and (2) Soyadiniz parameters; and possibly other unspecified vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS v2.0: 4.3
GHSA-x2jm-xff2-34w4: The Contact Form 7 reCAPTCHA WordPress plugin through 1.2.0 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers.
CVSS v3.1: 5.8
CVE-2026-6491: libvips nip2 vips7compat.c im_minpos_vec heap-based overflow
A security vulnerability has been detected in libvips up to 8.18.2. The affected element is the function im_minpos_vec of the file libvips/deprecated/vips7compat.c of the component nip2 Handler. Such manipulation of the argument n leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. The vendor confirms that they will "be removing the deprecated area in libvips 8.19".
CVSS v4.0: 4.8
CVSS v3.1: 5.3
CVSS v3.0: 5.3
CVSS v2.0: 4.3
CVE-2023-23398: Microsoft Excel Spoofing Vulnerability
Microsoft Excel Spoofing Vulnerability
CVSS v3.1: 7.1
GHSA-vff9-63h6-hvvr: Race condition in Sun Solaris 10 allows attackers to cause a denial of service (system panic) via unspecified vectors related to ifconfig and either netstat or SNMP queries.
CVE-2007-4346: The Job Engine (bengine.exe) service in Symantec Backup Exec for Windows Servers (BEWS) 11d build 11.0.7170 and 11.0.6.6235 allows remote attackers to cause a denial of service (NULL dereference and service crash) via a crafted packet to port 5633/tcp.
CVSS v2.0: 5
CVE-2024-37568: lepture Authlib before 1.3.1 has algorithm confusion with asymmetric public keys. Unless an algorithm is specified in a jwt.decode call, HMAC verification is allowed with any asymmetric public key. (This is similar to CVE-2022-29217 and CVE-2024-33663.)
CVSS v3.1: 7.5
GHSA-86wv-7cjw-r9ch: BEA Systems Weblogic Server 6.1 allows remote attackers to cause a denial of service via a series of requests to .JSP files that contain an MS-DOS device name.
GHSA-9fv7-4p87-hr9r: Out-of-bounds Write vulnerability in libaudiosaplus_sec.so library prior to SMR Apr-2023 Release 1 allows local attacker to execute arbitrary code.
CVSS v3.1: 7.8
CVE-2022-28429: Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/inbox.php&action=delete&msgid=.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2018-20216: QEMU can have an infinite loop in hw/rdma/vmw/pvrdma_dev_ring.c because return values are not checked (and -1 is mishandled).
CVSS v3.1: 7.5
CVSS v2.0: 5
GHSA-7xpw-5vf9-rwr4: Uncontrolled search path element in the Intel(R) oneAPI Collective Communications Library (oneCCL) before version 2021.6 for Intel(R) oneAPI Base Toolkit may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS v3.1: 7.3
GHSA-m3gq-f9rc-qmwx: Improper session management in the identity provider authentication flow in Devolutions Server 2023.3.14.0 and earlier allows an authenticated user via an identity provider to stay authenticated after his user is disabled or deleted in the identity provider such as Okta or Microsoft O365.The user will stay authenticated until the Devolutions Server token expiration.
CVSS v3.1: 5.5
GHSA-679x-v483-q6x9: In veilid-core in Veilid before 0.3.4, the protocol's ping function can be misused in a way that decreases the effectiveness of safety and private routes.
CVSS v3.1: 5.3
GHSA-323g-q36v-hmmc: Tor before 0.4.9.7 has a NULL pointer dereference when a CERT cell is received out of order, aka TROVE-2026-006.
CVSS v3.1: 3.7
CVE-2021-47374: dma-debug: prevent an error message from causing runtime problems
In the Linux kernel, the following vulnerability has been resolved:

dma-debug: prevent an error message from causing runtime problems

For some drivers, that use the DMA API. This error message can be reached
several millions of times per second, causing spam to the kernel's printk
buffer and bringing the CPU usage up to 100% (so, it should be rate
limited). However, since there is at least one driver that is in the
mainline and suffers from the error condition, it is more useful to
err_printk() here instead of just rate limiting the error message (in hopes
that it will make it easier for other drivers that suffer from this issue
to be spotted).
CVSS v3.1: 5.5
GHSA-m9hx-h78h-jqvc: Sunshine for Windows, version v2025.122.141614, contains a DLL search-order hijacking vulnerability, allowing attackers to insert a malicious DLL in user-writeable PATH directories.
CVSS v3.1: 7.8