ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-9x73-87fh-54w9: Gardener allows metadata injection for a project secret which can lead to privilege escalation
A security vulnerability was discovered in the `gardenlet` component of Gardener. It could allow a user with administrative privileges for a Gardener project to obtain control over the seed cluster(s) where their shoot clusters are managed.Am I Vulnerable?This CVE affects all Gardener installations where https://github.com/gardener/gardener-extension-provider-gcp is in use.Affected Components`gardener/gardener` (`gardenlet`)Affected Versions< v1.116.4< v1.117.5< v1.118.2< v1.119.0Fixed Versions&gt;= v1.116.4&gt;= v1.117.5&gt;= v1.118.2&gt;= v1.119.0How do I mitigate this vulnerability?Update to a fixed version.
CVSS v3.0: 9.9
CVE-2017-10256: Vulnerability in the PeopleSoft Enterprise PRTL Interaction Hub component of Oracle PeopleSoft Products (subcomponent: EPPCM_HIER_TOP). The supported version that is affected is 9.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PRTL Interaction Hub. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PRTL Interaction Hub, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PRTL Interaction Hub accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PRTL Interaction Hub accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
CVSS v3.0: 6.1
CVSS v2.0: 5.8
CVE-2021-40047: There is a vulnerability of memory not being released after effective lifetime in the Bastet module. Successful exploitation of this vulnerability may affect integrity.
CVSS v3.1: 7.5
CVSS v2.0: 7.8
GHSA-fpq5-4vwm-78x4: LibreNMS has Broken Access control on Graphs Feature
SummaryThis vulnerability occurs when application is not checking access of each type of users as per their role and it autorizing the users to access any feature. When user access his Device dashboard in librenms, one request is going to graph.php to access image of graphs generated on the particular Device. This request can be accessed by lower privileged users as well and they can enumerate devices on librenms with their id or hostname.Details_Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer._PoCLogin with Lower privilege userGo to /graph.php?width=150&height=45&device=1&type=device_ping_perf&from=1699022192&legend=no&bg=FFFFFF00&popup_title=ICMP+ResponseIf its showing image with "device*ping_perf" which confirms that there is device with id 1Now you can change device parameter in above URL with hostname to check if that Hostname/IP exist or not like
http://127.0.0.1:8000/graph.php?width=150&height=45&device=127.0.0.1&type=device_ping_perf&from=1699022192&legend=no&bg=FFFFFF00&popup_title=ICMP+ResponseIf device hostname doesn't exist then it should show 500 errorCheck attached screenshots for more infoVulnerable code:
https://github.com/librenms/librenms/blob/fa93034edd40c130c2ff00667ca2498d84be6e69/html/graph.php#L19C1-L25C2Above is vulnerable line of code from Line number 19-25
This is not checking privilege of users to access any device hostname, its just checking if user is authenticated 
or notImpactLow privilege users can see all devices registered by admin users by using this methodSolutionImplement privilege access control feature to check if low privilege user have access or not.Screenshots:-
CVSS v3.1: 4.3
GHSA-hw5x-h98r-cfjc: This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.2. Privacy indicators for microphone access may be attributed incorrectly.
CVSS v3.1: 3.3
GHSA-6xh6-fjxr-7xrg: Cross-Site Request Forgery (CSRF) vulnerability in Aarvanshinfotech Online Exam Software: eExamhall plugin <= 4.0 versions.
CVSS v3.1: 6.5
CVE-2021-44031: An issue was discovered in Quest KACE Desktop Authority before 11.2. /dacomponentui/profiles/profileitems/outlooksettings/Insertimage.aspx contains a vulnerability that could allow pre-authentication remote code execution. An attacker could upload a .ASP file to reside at /images/{GUID}/{filename}.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
GHSA-xhrv-757w-cxjj: Biometric Shift Employee Management System has XSS via the expense_name parameter in an index.php?user=expenses request.
CVSS v3.0: 5.4
CVE-2023-27325: Parallels Desktop Updater Improper Initialization Local Privilege Escalation Vulnerability
Parallels Desktop Updater Improper Initialization Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged code on the target host system in order to exploit this vulnerability.

The specific flaw exists within the Updater service. The issue results from the lack of proper initialization of environment variables. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root.
. Was ZDI-CAN-18253.
CVSS v3.0: 7.8
GHSA-49xj-qj9r-gx79: A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the accountstatus view devices parameter due to improper neutralization of special elements in a SQL UPDATE command allowing for reading the whole database and changing values in a non critical table. This can result in a total loss of confidentiality and some loss of integrity.
CVSS v4.0: 7
CVSS v3.1: 5.5
CVE-2026-11054: Use after free in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS v3.1: 8.8
GHSA-3366-9287-7qpr: Path disclosure in JavaScript variable
ImpactPath disclosure in JavaScript variablePatchesPatch in PrestaShop 8.1.4Referenceshttps://owasp.org/www-community/attacks/Full_Path_DisclosureThanks to https://github.com/hugo-fasone
CVSS v3.1: 5.8
CVE-2011-2152: The SmarterTools SmarterStats 6.0 web server generates web pages containing external links in response to GET requests with query strings for (1) Client/frmViewReports.aspx or (2) UserControls/Popups/frmHelp.aspx, which makes it easier for remote attackers to obtain sensitive information by reading (a) web-server access logs or (b) web-server Referer logs, related to a "cross-domain Referer leakage" issue.
CVSS v2.0: 5
GHSA-79rm-f26g-296p: Jenkins Maven Release Plugin vulnerable to Cross-site Scripting
A stored cross site scripting vulnerability in Jenkins Maven Release Plugin 0.14.0 and earlier allowed attackers to inject arbitrary HTML and JavaScript in the plugin-provided web pages in Jenkins.Variables on affected views are now escaped.
CVSS v3.1: 5.4
CVE-2019-14760: An issue was discovered in KaiOS 2.5. The pre-installed Recorder application is vulnerable to HTML and JavaScript injection attacks. A local attacker can inject arbitrary HTML into the Recorder application. At a bare minimum, this allows an attacker to take control over the Recorder application's UI (e.g., display a malicious prompt to the user asking them to re-enter credentials such as their KaiOS credentials to continue using the application) and also allows an attacker to abuse any of the privileges available to the mobile application.
CVSS v3.1: 4.4
CVSS v2.0: 1.9
CVE-2026-25808: Hollo DMs get leaked and can be seen on Webfinger Browser
Hollo is a federated single-user microblogging software designed to be federated through ActivityPub. Prior to 0.6.20 and 0.7.2, there is a security vulnerability where DMs and followers-only posts were exposed through the ActivityPub outbox endpoint without authorization. This vulnerability is fixed in 0.6.20 and 0.7.2.
CVSS v3.1: 7.5
CVE-2019-7988: Adobe Photoshop CC versions 19.1.8 and earlier and 20.0.5 and earlier have an out of bound write vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS v3.0: 8.8
CVSS v2.0: 6.8
GHSA-q29v-xc37-wh5m: Docling: Unsafe URI and Path Handling in HTML Backend
ImpactThe HTML backend did not perform sufficient validation during resource handling:Accepted `file://` URIs enabling local file system access when `enable_local_fetch=True`Path resolution allowed traversal outside intended directories via `../` sequences and absolute pathsDid not block internal network resources under `enable_remote_fetch=True`HTTP redirects were not validated, potentially redirecting to unintended schemesNo resource limits for remote image downloads and `data:` URIsPatchesFixed in versions 2.91.0 (initial fixes) and 2.94.0 (additional improvements). The fixes implement:Updated local path treatment: absolute files always blocked, relative paths require `enable_local_fetch=True` (default: False) and containment within configured `base_path` for path traversal protection`file://` scheme stripped & treated as local path (above)IP address validation to prevent SSRFHTTP redirect validation, connection and read timeoutsSize limit for both remote images (with streaming download) and base64-decoded data URIsWorkaroundsKeep both `enable_local_fetch=False` and `enable_remote_fetch=False` (defaults) when processing untrusted HTML documents.ReferencesInitial fixes: [v2.91.0](https://github.com/docling-project/docling/releases/tag/v2.91.0)Additional improvements: [v2.94.0](https://github.com/docling-project/docling/releases/tag/v2.94.0)
CVSS v3.1: 7.1
GHSA-95cm-jx47-9cpv: In the Linux kernel, the following vulnerability has been resolved:bpf: Fix verifier assumptions about socket->skThe verifier assumes that 'sk' field in 'struct socket' is valid
and non-NULL when 'socket' pointer itself is trusted and non-NULL.
That may not be the case when socket was just created and
passed to LSM socket_accept hook.
Fix this verifier assumption and adjust tests.
CVSS v3.1: 5.5
CVE-2013-6747: IBM GSKit 7.x before 7.0.4.48 and 8.x before 8.0.50.16, as used in IBM Security Directory Server (ISDS) and Tivoli Directory Server (TDS), allows remote attackers to cause a denial of service (application crash or hang) via a malformed X.509 certificate chain.
CVSS v2.0: 7.1
GHSA-x4cr-2586-v8hv: White Shark System (WSS) 1.3.2 is vulnerable to CSRF. Attackers can use the user_edit_password.php file to modify the user password.
GHSA-2pf8-84f8-xmcp: WebITR developed by Uniong has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.
CVSS v4.0: 7.1
CVSS v3.1: 6.5
CVE-2008-2880: Heap-based buffer overflow in the IBM AFP Viewer Plug-in 2.0.7.1 and 3.2.1.1 allows remote attackers to execute arbitrary code via a long SRC property value.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS v2.0: 9.3
GHSA-v85f-w8hc-72wx: A vulnerability has been found in IBOS up to 4.5.4 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /?r=email/api/mark&op=delFromSend. The manipulation of the argument emailids leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.5.5 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-224635.
CVSS v3.1: 8.8
CVE-2015-0337: Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows remote attackers to bypass the Same Origin Policy via unspecified vectors.
CVSS v2.0: 5
RHSA-2021:4325: Red Hat Security Advisory: lasso security and enhancement update
lasso: XML signature wrapping vulnerability when parsing SAML responses
CVSS v3.1: 8.8
GHSA-mfc4-5w6j-r334: Missing Authorization vulnerability in Vagary Digital HREFLANG Tags Lite.This issue affects HREFLANG Tags Lite: from n/a through 2.0.0.
CVSS v3.1: 6.5
CVE-2021-2378: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
CVSS v3.1: 7.5
GHSA-j64g-84vg-pq34: Event Monitor in Apple Mac OS X 10.5.8 does not properly handle crafted authentication data sent to an SSH daemon, which allows remote attackers to cause a denial of service via vectors involving processing of XML log documents by other services, related to a "log injection" issue.
CVE-2018-12776: Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have a Use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVSS v3.0: 8.8
CVSS v2.0: 6.8
RHBA-2021:4438: Red Hat Bug Fix Advisory: samba bug fix and enhancement update
samba: Symlink race error can allow directory creation outside of the exported share
CVSS v3.1: 2.6
GHSA-qhw6-g646-98wf: A spoofing vulnerability exists in Microsoft Visual Studio as it includes a reply URL that is not secured by SSL, aka 'Microsoft Visual Studio Spoofing Vulnerability'.
CVE-2023-26605: In the Linux kernel 6.0.8, there is a use-after-free in inode_cgwb_move_to_attached in fs/fs-writeback.c, related to __list_del_entry_valid.
CVSS v3.1: 7.8
CVE-2022-35555: A command injection vulnerability exists in /goform/exeCommand in Tenda W6 V1.0.0.9(4122), which allows attackers to construct cmdinput parameters for arbitrary command execution.
CVSS v3.1: 9.8
CVE-2023-2382: Netgear SRX5308 Web Management Interface cross site scripting
A vulnerability was found in Netgear SRX5308 up to 4.3.5-3 and classified as problematic. Affected by this issue is some unknown functionality of the file scgi-bin/platform.cgi?page=firewall_logs_email.htm of the component Web Management Interface. The manipulation of the argument sysLogInfo.serverName leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227660. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v3.1: 2.4
CVSS v3.0: 2.4
CVSS v2.0: 3.3
GHSA-qf4h-wj9p-f6jf: Multiple cross-site scripting (XSS) vulnerabilities in the administrator console in Novell GroupWise before 2014 R2 Service Pack 1 Hot Patch 1 allow remote attackers to inject arbitrary web script or HTML via the (1) token parameter to gwadmin-console/install/login.jsp or (2) PATH_INFO to gwadmin-console/index.jsp.
CVSS v3.0: 6.1
GHSA-rj6c-xf6w-6c96: In copy_io_entries of lwis_ioctl.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-205992503References: N/A
CVSS v3.1: 7.8
CVE-2006-1813: Directory traversal vulnerability in index.php in phpWebFTP 3.2 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the language parameter.
CVSS v2.0: 6.4
CVE-2025-58958: WordPress SmilePure Theme < 1.8.5 - Local File Inclusion Vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove SmilePure smilepure allows PHP Local File Inclusion.This issue affects SmilePure: from n/a through < 1.8.5.
CVSS v3.1: 8.1
CVE-2018-3217: Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). The supported version that is affected are 8.5.3 and 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data as well as unauthorized update, insert or delete access to some of Oracle Outside In Technology accessible data. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N).
CVSS v3.0: 7.1
CVSS v2.0: 5.8
CVE-2026-14766: CodeAstro Apartment Visitor Management System POST Parameter search-result.php sql injection
A vulnerability was identified in CodeAstro Apartment Visitor Management System 1.0. Affected by this issue is some unknown functionality of the file /apartment-visitor/search-result.php of the component POST Parameter Handler. The manipulation of the argument searchdata leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
CVE-2023-35350: Windows Active Directory Certificate Services (AD CS) Remote Code Execution Vulnerability
Windows Active Directory Certificate Services (AD CS) Remote Code Execution Vulnerability
CVSS v3.1: 7.2
CVE-2022-43408: Jenkins Pipeline: Stage View Plugin 2.26 and earlier does not correctly encode the ID of 'input' steps when using it to generate URLs to proceed or abort Pipeline builds, allowing attackers able to configure Pipelines to specify 'input' step IDs resulting in URLs that would bypass the CSRF protection of any target URL in Jenkins.
CVSS v3.1: 6.5
GHSA-hvp8-vq4w-xwvh: The Jquery news ticker plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS v3.1: 8.8
CVE-2015-4103: Xen 3.3.x through 4.5.x does not properly restrict write access to the host MSI message data field, which allows local x86 HVM guest administrators to cause a denial of service (host interrupt handling confusion) via vectors related to qemu and accessing spanning multiple fields.
CVSS v2.0: 4.9
GHSA-gmxg-c36j-9c9p: Vulnerability of trust relationships being inaccurate in distributed scenarios. Successful exploitation of this vulnerability may affect service confidentiality.
CVSS v3.1: 7.5
CVE-2024-48197: Cross Site Scripting vulnerability in Audiocodes MP-202b v.4.4.3 allows a remote attacker to escalate privileges via the login page of the web interface.
CVSS v3.1: 4.7
GHSA-5fhx-9jwj-867m: Weblate: Authenticated SSRF via redirect bypass of ALLOWED_ASSET_DOMAINS in screenshot URL uploads
ImpactThe ALLOWED_ASSET_DOMAINS setting applied only to the first issued requests and didn't restrict possible redirects.Patcheshttps://github.com/WeblateOrg/weblate/pull/18550ReferencesThis issue was reported by @spbavarva via GitHub.
CVSS v3.1: 5
CVE-2018-8843: Rockwell Automation Arena versions 15.10.00 and prior contains a use after free vulnerability caused by processing specially crafted Arena Simulation Software files that may cause the software application to crash, potentially losing any unsaved data..
CVSS v3.0: 5.5
CVSS v2.0: 4.3
CVE-2023-2985: A use after free flaw was found in hfsplus_put_super in fs/hfsplus/super.c in the Linux Kernel. This flaw could allow a local user to cause a denial of service problem.
CVSS v3.1: 5.5
CVE-2026-56285: Nitter - Server-Side Request Forgery in /video Media Proxy Endpoint
Nitter's /video media proxy endpoint fails to validate target URLs against Twitter/X domains and uses a hardcoded default HMAC key, allowing unauthenticated attackers to compute valid HMACs for arbitrary URLs. Attackers can retrieve HTTP responses from any host reachable by the server, including cloud metadata services and internal network resources.
CVSS v4.0: 7.7
CVSS v3.1: 8.6
GHSA-49hg-8v5j-mhxm: A vulnerability was identified in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. This issue affects the function langSwitchBack of the file /goform/langSwitchBack. The manipulation of the argument langSelectionOnly leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 7.4
CVSS v3.1: 8.8
GHSA-vc54-cc67-849w: A vulnerability in the Web Conferencing Component of Mitel MiCollab through 9.8.1.5 could allow an authenticated attacker to conduct a command injection attack, due to insufficient validation of user input. A successful exploit could allow an attacker to execute arbitrary commands on the system within the context of the user.
CVSS v3.1: 6.6
GHSA-h63r-7v46-7432: Permission control vulnerability in the Bluetooth module.
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS v3.1: 6.5
CVE-2009-4039: Cross-site scripting (XSS) vulnerability in Piwigo before 2.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS v2.0: 4.3
GHSA-hgj6-7826-r7m5: jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)
Summary`JDKFromStringDeserializer` constructed `InetSocketAddress` with `new InetSocketAddress(host, port)`, which performs eager DNS name resolution for hostname inputs at deserialization time. An application that binds untrusted JSON into a type containing an `InetSocketAddress` field issues an attacker-chosen DNS query during `readValue`, before any application-level validation or connect logic. The fix uses `InetSocketAddress.createUnresolved(host, port)`, deferring DNS to an explicit connect.ImpactAn attacker controlling JSON deserialized into an `InetSocketAddress`-bearing type can force outbound DNS lookups for attacker-chosen hostnames at deserialization time (SSRF / DNS-based out-of-band interaction / internal-resolver probing), purely from binding.Affected / Patched (verified via `git tag --contains` on `1f5a103`)2.18 line: `>= 2.18.0, < 2.18.8` -> fixed in **2.18.8**2.19-2.21 line: `>= 2.19.0, < 2.21.4` -> fixed in **2.21.4**3.x line: `>= 3.0.0, < 3.1.4` -> fixed in **3.1.4**Severity / CWEMaintainer: minor. Reporter: LOW. CWE-918 (SSRF).Upstream fixFasterXML/jackson-databind#5951 ("Improve InetSocketAddress deserialization"). Released 2026-06-04 in 2.18.8 / 2.21.4 / 3.1.4.CreditsOmkhar Arasaratnam (@omkhar) - finder.
CVSS v3.1: 5.3
GHSA-mc4j-jgc8-r9vr: An issue was discovered on Samsung mobile devices with N(7.x), O(8.x), and P(9.0) software. There is local SQL injection in the Story Video Editor Content Provider. The Samsung ID is SVE-2019-14062 (July 2019).
GHSA-w4rw-664q-rp8h: IBM WebSphere MQ 9.0.0.1 and 9.0.2 could allow a local user to write to a file or delete files in a directory they should not have access to due to improper access controls. IBM X-Force ID: 117926.
CVSS v3.0: 5.5