ansulev/circl-vulnerability-scores huggingface dataset:
RHSA-2020:1016: Red Hat Security Advisory: kernel security, bug fix, and enhancement update
kernel: out of bound read in DVB connexant driver. kernel: Missing permissions check for request_key() destination allows local attackers to add keys to keyring without Write permission kernel: denial of service via ioctl call in network tun handling kernel: oob memory read in hso_probe in drivers/net/usb/hso.c kernel: usb: missing size check in the __usb_get_extra_descriptor() leading to DoS kernel: perf_event_open() and execve() race in setuid programs allows a data leak kernel: triggering AP to send IAPP location updates for stations before the required authentication process has completed can lead to DoS kernel: brcmfmac frame validation bypass kernel: null-pointer dereference in hci_uart_set_flow_control Kernel: net: weak IP ID generation leads to remote device tracking Kernel: net: using kernel space address bits to derive IP ID may potentially break KASLR kernel: ASLR bypass for setuid binaries due to late install_exec_creds() kernel: sensitive information disclosure from kernel stack memory via HIDPCONNADD command kernel: unchecked kstrdup of fwstr in drm_load_edid_firmware leads to denial of service kernel: use-after-free in arch/x86/lib/insn-eval.c kernel: denial of service in arch/powerpc/kernel/signal_32.c and arch/powerpc/kernel/signal_64.c via sigreturn() system call kernel: integer overflow and OOB read in drivers/block/floppy.c kernel: heap overflow in mwifiex_set_uap_rates() function of Marvell Wifi Driver leading to DoS kernel: heap-overflow in mwifiex_set_wmm_params() function of Marvell WiFi driver leading to DoS kernel: An out-of-bounds read in drivers/scsi/qedi/qedi_dbg.c leading to crash or information disclosure kernel: use-after-free in sound/core/init.c and sound/core/info.c kernel: Null pointer dereference in the sound/usb/line6/pcm.c kernel: memory leak in register_queue_kobjects() in net/core/net-sysfs.c leads to denial of service kernel: buffer-overflow hardening in WiFi beacon validation code. kernel: powerpc: incomplete Spectre-RSB mitigation leads to information exposure
CVSS v3.1: 4.7
CVSS v3.0: 5.5
GHSA-6j6w-975j-pgqc: Cross-site scripting vulnerability in index.php in PHP Fusebox 4.0.6 allows remote attackers to inject arbitrary web script or HTML via the fuseaction parameter.
CVE-2026-13804: Use after free in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
GHSA-vqxq-jmxf-f53r: DENX U-Boot through 2018.09-rc1 has a remotely exploitable buffer overflow via a malicious TFTP server because TFTP traffic is mishandled. Also, local exploitation can occur via a crafted kernel image.
CVSS v3.0: 9.8
GHSA-9rx5-vw74-rpgf: The fileop module of the NXLog service in NXLog Community Edition 2.10.2150 allows remote attackers to cause a denial of service (daemon crash) via a crafted Syslog payload to the Syslog service. This attack requires a specific configuration. Also, the name of the directory created must use a Syslog field. (For example, on Linux it is not possible to create a .. directory. On Windows, it is not possible to create a CON directory.)
CVSS v3.1: 7.5
CVE-2023-39279: SonicOS post-authentication Stack-Based Buffer Overflow vulnerability in the getPacketReplayData.json URL endpoint leads to a firewall crash.
CVSS v3.1: 6.5
GHSA-275c-v3rc-xghx: Kirby XSS Vulnerability
A cross-site Scripting (XSS) vulnerability in Kirby Panel before 2.3.3, 2.4.x before 2.4.2, and 2.5.x before 2.5.7 exists when displaying a specially prepared SVG document that has been uploaded as a content file.
CVSS v3.0: 5.4
GHSA-6gg7-c2v3-mxxq: The syscall32_setup_pages function in syscall32.c for Linux kernel 2.6.12 and later, on the 64-bit x86 platform, does not check the return value of the insert_vm_struct function, which allows local users to trigger a memory leak via a 32-bit application with crafted ELF headers.
GHSA-2v4j-cxx2-mgp4: Buffer overflow in Intel Graphics Driver in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context via a crafted app.
CVSS v3.0: 7.8
GHSA-qqpc-7c83-686v: This issue was addressed through improved state management. This issue is fixed in iOS 18 and iPadOS 18. A malicious Bluetooth input device may bypass pairing.
CVSS v3.1: 6.5
GHSA-9492-pwhm-prgg: A security flaw has been discovered in sunkaifei FlyCMS up to abbaa5a8daefb146ad4d61027035026b052cb414. The affected element is an unknown function of the file src/main/java/com/flycms/web/system/IndexAdminController.java of the component Admin Login. Performing manipulation of the argument redirectUrl results in cross site scripting. The attack can be initiated remotely. The exploit has been released to the public and may be exploited. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 2.1
CVSS v3.1: 4.3
GHSA-ggww-q2gv-m3g4: Dolibarr ERP and CRM contain XSS Vulnerability
Dolibarr ERP/CRM through 8.0.3 has `/exports/export.php?datatoexport=` XSS.
CVSS v3.0: 6.1
GHSA-2h9h-4f6p-xvfc: Cross-site scripting (XSS) vulnerability in view.php in eTicket 1.5.5.2 allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVE-2024-42775: An Incorrect Access Control vulnerability was found in /admin/add_room_controller.php in Kashipara Hotel Management System v1.0, which allows an unauthenticated attacker to add the valid hotel room entries in the administrator section via the direct URL access.
CVSS v3.1: 9.1
CVE-2020-25221: get_gate_page in mm/gup.c in the Linux kernel 5.7.x and 5.8.x before 5.8.7 allows privilege escalation because of incorrect reference counting (caused by gate page mishandling) of the struct page that backs the vsyscall page. The result is a refcount underflow. This can be triggered by any 64-bit process that can use ptrace() or process_vm_readv(), aka CID-9fa2dd946743.
CVSS v3.1: 7.8
CVSS v2.0: 7.2
CVE-2025-6154: PHPGurukul Hostel Management System login.inc.php sql injection
A vulnerability was found in PHPGurukul Hostel Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /includes/login.inc.php. The manipulation of the argument student_roll_no leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 6.9
CVSS v3.1: 7.3
CVSS v3.0: 7.3
CVSS v2.0: 7.5
CVE-2024-31450: Owncast vulnerable to arbitrary file deletion in emoji.go (GHSL-2023-277)
Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. The Owncast application exposes an administrator API at the URL /api/admin. The emoji/delete endpoint of said API allows administrators to delete custom emojis, which are saved on disk. The parameter name is taken from the JSON request and directly appended to the filepath that points to the emoji to delete. By using path traversal sequences (../), attackers with administrative privileges can exploit this endpoint to delete arbitrary files on the system, outside of the emoji directory. This vulnerability is fixed in 0.1.3.
CVSS v3.1: 2.7
GHSA-cwpj-wxfp-crc5: In the Linux kernel, the following vulnerability has been resolved:x86/lib: Revert to _ASM_EXTABLE_UA() for {get,put}_user() fixupsDuring memory error injection test on kernels >= v6.4, the kernel panics
like below. However, this issue couldn't be reproduced on kernels <= v6.3.mce: [Hardware Error]: CPU 296: Machine Check Exception: f Bank 1: bd80000000100134
  mce: [Hardware Error]: RIP 10:<ffffffff821b9776> {__get_user_nocheck_4+0x6/0x20}
  mce: [Hardware Error]: TSC 411a93533ed ADDR 346a8730040 MISC 86
  mce: [Hardware Error]: PROCESSOR 0:a06d0 TIME 1706000767 SOCKET 1 APIC 211 microcode 80001490
  mce: [Hardware Error]: Run the above through 'mcelog --ascii'
  mce: [Hardware Error]: Machine check: Data load in unrecoverable area of kernel
  Kernel panic - not syncing: Fatal local machine checkThe MCA code can recover from an in-kernel #MC if the fixup type is
EX_TYPE_UACCESS, explicitly indicating that the kernel is attempting to
access userspace memory. However, if the fixup type is EX_TYPE_DEFAULT
the only thing that is raised for an in-kernel #MC is a panic.ex_handler_uaccess() would warn if users gave a non-canonical addresses
(with bit 63 clear) to {get, put}_user(), which was unexpected.Therefore, commitb19b74bc99b1 ("x86/mm: Rework address range check in get_user() and put_user()")replaced _ASM_EXTABLE_UA() with _ASM_EXTABLE() for {get, put}_user()
fixups. However, the new fixup type EX_TYPE_DEFAULT results in a panic.Commit6014bc27561f ("x86-64: make access_ok() independent of LAM")added the check gp_fault_address_ok() right before the WARN_ONCE() in
ex_handler_uaccess() to not warn about non-canonical user addresses due
to LAM.With that in place, revert back to _ASM_EXTABLE_UA() for {get,put}_user()
exception fixups in order to be able to handle in-kernel MCEs correctly
again.[ bp: Massage commit message. ]
CVSS v3.1: 7.1
GHSA-5p26-hw7f-3cpr: Cross-Site Scripting in html-pages
All versions of `html-pages` are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize folder names, allowing attackers to execute arbitrary JavaScript in the victim's browser through folders with names containing malicious code.RecommendationNo fix is currently available. Consider using an alternative package until a fix is made available.
CVSS v3.0: 6.1
CVE-2016-3367: StringBuilder in Microsoft Silverlight 5 before 5.1.50709.0 does not properly allocate memory for string-insert and string-append operations, which allows remote attackers to execute arbitrary code via a crafted web site, aka "Microsoft Silverlight Memory Corruption Vulnerability."
CVSS v3.0: 8.8
CVSS v2.0: 9.3
GHSA-mqwh-r366-4224: Cabot Cross Site Scripting (XSS) vulnerability via Endpoint column
All versions up to 0.11.16 of package cabot are vulnerable to Cross-site Scripting (XSS) via the Endpoint column.
CVSS v4.0: 2.3
CVSS v3.1: 8.2
CVE-2025-0928: Arbitrary executable upload via authenticated endpoint
In Juju versions prior to 3.6.8 and 2.9.52, any authenticated controller user was allowed to upload arbitrary agent binaries to any model or to the controller itself, without verifying model membership or requiring explicit permissions. This enabled the distribution of poisoned binaries to new or upgraded machines, potentially resulting in remote code execution.
CVSS v3.1: 8.8
RHSA-2014:0091: Red Hat Security Advisory: openstack-neutron security, bug fix, and enhancement update
Nova: Metadata queries from Neutron to Nova are not restricted by tenant
CVE-2008-5756: Buffer overflow in BreakPoint Software Hex Workshop 5.1.4 allows user-assisted attackers to cause a denial of service and possibly execute arbitrary code via a long mapping reference in a Color Mapping (.cmap) file.
CVSS v2.0: 9.3
CVE-2022-25446: Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the schedstarttime parameter in the openSchedWifi function.
CVSS v3.1: 9.8
CVSS v2.0: 10
CVE-2012-4562: Multiple integer overflows in libssh before 0.5.3 allow remote attackers to cause a denial of service (infinite loop or crash) and possibly execute arbitrary code via unspecified vectors, which triggers a buffer overflow, infinite loop, or possibly some other unspecified vulnerabilities.
CVSS v2.0: 7.5
GHSA-rpx6-6266-hrf9: A vulnerability has been found in Ruijie EG2000K 11.1(6)B2 and classified as critical. This vulnerability affects unknown code of the file /tool/index.php?c=download&a=save. The manipulation of the argument content leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 5.1
CVSS v3.1: 4.7
CVE-2024-2677: Campcodes Online Job Finder System controller.php sql injection
A vulnerability has been found in Campcodes Online Job Finder System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/category/controller.php. The manipulation of the argument CATEGORYID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257377 was assigned to this vulnerability.
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
GHSA-8mqf-8jm6-frp9: There is SQL injection vulnerability in Esri ArcGIS Insights Desktop for Mac and Windows version 2022.1  that may allow a local, authorized attacker to execute arbitrary SQL commands against the back-end database. The effort required to generate the crafted input required to exploit this issue is complex and requires significant effort before a successful attack can be expected.
CVSS v3.1: 7
CVE-2023-41039: Sandbox escape via various forms of "format" in RestrictedPython
RestrictedPython is a restricted execution environment for Python to run untrusted code. Python's "format" functionality allows someone controlling the format string to "read" all objects accessible through recursive attribute lookup and subscription from objects he can access. This can lead to critical information disclosure. With `RestrictedPython`, the format functionality is available via the `format` and `format_map` methods of `str` (and `unicode`) (accessed either via the class or its instances) and via `string.Formatter`. All known versions of `RestrictedPython` are vulnerable. This issue has been addressed in commit `4134aedcff1` which has been included in the 5.4 and 6.2 releases. Users are advised to upgrade. There are no known workarounds for this vulnerability.


CVSS v3.1: 8.3
CVE-2026-45989: of: unittest: fix use-after-free in testdrv_probe()
In the Linux kernel, the following vulnerability has been resolved:

of: unittest: fix use-after-free in testdrv_probe()

The function testdrv_probe() retrieves the device_node from the PCI
device, applies an overlay, and then immediately calls of_node_put(dn).
This releases the reference held by the PCI core, potentially freeing
the node if the reference count drops to zero. Later, the same freed
pointer 'dn' is passed to of_platform_default_populate(), leading to a
use-after-free.

The reference to pdev->dev.of_node is owned by the device model and
should not be released by the driver. Remove the erroneous of_node_put()
to prevent premature freeing.
GHSA-555p-jhmj-xhrc: The Smart SEO Tool WordPress plugin before 3.0.6 does not sanitise and escape the search parameter before outputting it back in an attribute when the TDK optimisation setting is enabled, leading to a Reflected Cross-Site Scripting
CVE-2020-5530: Cross-site request forgery (CSRF) vulnerability in Easy Property Listings versions prior to 3.4 allows remote attackers to hijack the authentication of administrators via unspecified vectors.
CVSS v3.1: 8.8
CVSS v2.0: 6.8
GHSA-g62r-h4q8-qx29: Nordic Semiconductor nRF52840 devices through 2020-10-19 have improper protection against physical side channels. The flash read-out protection (APPROTECT) can be bypassed by injecting a fault during the boot phase.
CVSS v3.1: 5.7
CVE-2016-5154: Multiple heap-based buffer overflows in PDFium, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted JBig2 image.
CVSS v3.0: 8.8
CVSS v2.0: 6.8
CVE-2026-26194: Gogs: Release tag option injection in release deletion
Gogs is an open source self-hosted Git service. Prior to version 0.14.2, there's a security issue in gogs where deleting a release can fail if a user controlled tag name is passed to git without the right separator, this lets git options get injected and mess with the process. This issue has been patched in version 0.14.2.
CVSS v4.0: 8.8
CVE-2014-5275: Multiple SQL injection vulnerabilities in includes/functions.php in Pro Chat Rooms Text Chat Rooms 8.2.0 allow remote authenticated users to execute arbitrary SQL commands via the (1) password, (2) email, or (3) id parameter.
CVSS v2.0: 6.5
GHSA-hv4j-j5rr-rmfx: Buffer overflow in the PerlIO implementation in Perl 5.8.0, when installed with setuid support (sperl), allows local users to execute arbitrary code by setting the PERLIO_DEBUG variable and executing a Perl script whose full pathname contains a long directory tree.
CVE-2006-1770: Multiple PHP remote file inclusion vulnerabilities in Azerbaijan Design & Development Group (AZDG) AzDGVote allow remote attackers to execute arbitrary PHP code via a URL in the int_path parameter in (1) vote.php, (2) view.php, (3) admin.php, and (4) admin/index.php.
CVSS v2.0: 10
GHSA-xq77-398p-x2hj: The â€œThe Plus Addons for Elementor Page Builder Liteâ€? WordPress Plugin before 2.0.6 has four widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
GHSA-v3g6-94hr-fgjg: PHP remote file inclusion vulnerability in copyright.php in Olaf Noehring The Search Engine Project (TSEP) 0.942 allows remote attackers to execute arbitrary PHP code via a URL in the tsep_config[absPath] parameter.
RHSA-2014:1787: Red Hat Security Advisory: openstack-cinder security and bug fix update
openstack-cinder: Cinder-volume host data leak to virtual machine instance Trove: potential leak of passwords into log files Trove: potential leak of passwords into log files
CVE-2023-28004: 



A CWE-129: Improper validation of an array index vulnerability exists where a specially crafted
Ethernet request could result in denial of service or remote code execution. 

 

 




CVSS v3.1: 9.8
GHSA-5m5f-qg8r-p9qf: OpenNMS vulnerable to remote code execution
A BeanShell interpreter in remote server mode runs in OpenNMS Horizon versions earlier than 32.0.2 and in related Meridian versions which could allow arbitrary remote Java code execution. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.
CVSS v3.1: 7.1
GHSA-x7cj-m5fv-q3f2: A vulnerability was found in PHPGurukul Online Course Registration 3.1. This affects an unknown function of the file /my-profile.php. Performing manipulation of the argument cgpa results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used.
CVSS v4.0: 5.5
CVSS v3.1: 7.3
GHSA-r7hq-ppp5-wmmx: A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory Corruption Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet Explorer 10. This CVE ID is unique from CVE-2018-8355, CVE-2018-8359, CVE-2018-8371, CVE-2018-8372, CVE-2018-8373, CVE-2018-8385, CVE-2018-8389, CVE-2018-8390.
CVSS v3.0: 7.5
GHSA-33m2-72q5-r28q: The Liveticker (by stklcode) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'liveticker' shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
GHSA-fq74-5m7h-m7fv: A Reflected Cross-site scripting (XSS) vulnerability in interface/forms/eye_mag/php/eye_mag_functions.php in OpenEMR < 7.0.0 allows remote authenticated users to inject arbitrary web script or HTML via the REQUEST_URI.
CVSS v3.1: 5.4
GHSA-32q2-hhr5-6qvv: md-fileserver: Stored/Reflected XSS when viewing Markdown (raw HTML allowed)
SummaryA cross-site scripting (XSS) vulnerability exists in the application’s Markdown rendering logic. When user-supplied Markdown content is rendered, embedded raw HTML—including <script> tags—is processed and injected into the resulting page without sanitization, allowing arbitrary JavaScript execution in the context of the affected domain.DetailsAn attacker can craft malicious Markdown content containing <script> tags or event handlers (e.g., <img onerror=...>). When this Markdown is viewed or previewed, the embedded JavaScript executes in the victim’s browser.Vulnerable Componentsconfig.js → markdownIt: { html: true } (Lines 26–30)
The Markdown renderer is explicitly configured to allow raw HTML.lib/markd.js (Lines 33–58)
Renders Markdown content without sanitizing HTML, allowing unsafe tags and attributes to remain in the output.lib/pages/template.html
The rendered Markdown is injected into the HTML template using <%= markdown %> without sanitization or output encoding.PoCCreate a pwn.mdOpen it on browser.
<img width="944" height="238" alt="image" src="https://github.com/user-attachments/assets/cd9e1396-9f4b-4a4b-bc2a-d7530c0c00ac" />
View the HTTP request in Burp Collaborator.
<img width="1328" height="468" alt="image" src="https://github.com/user-attachments/assets/9faa65ad-73ec-42d0-9ce3-ea78b15294d8" />ImpactSuccessful exploitation allows an attacker to execute arbitrary JavaScript in the victim’s browser, leading to:Session hijackingAccount takeoverCredential theftDefacement or injection of malicious contentExfiltration of sensitive data via API tokens, CSRF tokens, or user informationThis affects all users who can view Markdown content within the application.
CVSS v3.1: 7.2
CVE-2023-21511: Out-of-bounds Read vulnerability while processing CMD_COLDWALLET_BTC_SET_PRV_UTXO in bc_core trustlet from Samsung Blockchain Keystore prior to version 1.3.12.1 allows local attacker to read arbitrary memory.
CVSS v3.1: 4.4
CVE-2024-22411: Cross site scripting in Action messages on Avo
Avo is a framework to create admin panels for Ruby on Rails apps. In Avo 3 pre12, any HTML inside text that is passed to `error` or `succeed` in an `Avo::BaseAction` subclass will be rendered directly without sanitization in the toast/notification that appears in the UI on Action completion. A malicious user could exploit this vulnerability to trigger a cross site scripting attack on an unsuspecting user. This issue has been addressed in the 3.3.0 and 2.47.0 releases of Avo. Users are advised to upgrade.
CVSS v3.1: 6.5
GHSA-qwph-9fq9-hwgv: Cross-Site Request Forgery (CSRF) vulnerability in Rishi On Page SEO + Whatsapp Chat Button allows Stored XSS. This issue affects On Page SEO + Whatsapp Chat Button: from n/a through 2.0.0.
CVSS v3.1: 7.1
GHSA-mh59-w44g-9pjr: The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.3.986 via the data_fetch. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract data from password protected posts.
CVSS v3.1: 4.3
CVE-2019-17008: When using nested workers, a use-after-free could occur during worker destruction. This resulted in a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.
CVSS v3.1: 8.8
CVSS v2.0: 6.8
RHSA-2026:20608: Red Hat Security Advisory: containernetworking-plugins security update
crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages
CVSS v3.1: 7.5