ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-qr4v-frmp-3xrc: The Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several functions in the class-cx-rest.php file in all versions up to, and including, 1.3.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create 100% off coupons, delete posts, delete leads, and update coupon statuses.
CVSS v3.1: 5.4
GHSA-vx7g-39p9-2r2g: Open redirect vulnerability in Xsuite 2.4.4.5 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirurl parameter.
CVSS v3.0: 6.1
GHSA-9rqv-q8j3-89cc: Adobe Flash Player before 11.7.700.272 and 11.8.x through 12.0.x before 12.0.0.77 on Windows and OS X, and before 11.2.202.346 on Linux, allows remote attackers to bypass the Same Origin Policy via unspecified vectors.
GHSA-5rfq-cm4h-mwv3: ircu 2.10.12.03 and 2.10.12.04 does not associate a timestamp with ops privilege on an unused channel (zannel), which allows remote attackers to (1) set or remove certain channel modes via a "netriding" attack or (2) take over a channel by joining an unlinked server with the A/Upass and then setting a new Apass.
GHSA-v98g-m79j-fq3q: Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart). Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iStore. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle iStore accessible data as well as unauthorized access to critical data or complete access to all Oracle iStore accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
ICSA-16-140-01A: Resource Data Management Intuitive 650 TDB Controller Vulnerabilities (Update A)
Resource Data Management (RDM) Intuitive 650 TDB Controller devices before 2.1.24 allow remote authenticated users to modify arbitrary passwords via unspecified vectors. Cross-site request forgery (CSRF) vulnerability on Resource Data Management (RDM) Intuitive 650 TDB Controller devices before 2.1.24 allows remote authenticated users to hijack the authentication of arbitrary users.
CVSS v3.0: 8
CVE-2015-3642: The TLS and DTLS processing functionality in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway devices with firmware 9.x before 9.3 Build 68.5, 10.0 through Build 78.6, 10.1 before Build 130.13, 10.1.e before Build 130.1302.e, 10.5 before Build 55.8, and 10.5.e before Build 55.8007.e makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE).
CVSS v3.0: 5.9
CVSS v2.0: 4.3
GHSA-r6g8-jmj9-g945: Improper Restriction of Rendered UI Layers or Frames in yourls
yourls is vulnerable to Improper Restriction of Rendered UI Layers or Frames
CVSS v3.0: 6.5
CVE-2021-39767: In miniadb, there is a possible way to get read/write access to recovery system properties due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-201308542
CVSS v3.1: 7.8
CVSS v2.0: 4.6
GHSA-xw8x-r2rg-vmq9: HPE OneView may have a missing passphrase during restore.
CVSS v3.1: 5.5
GHSA-g7w8-pp9w-7p32: Creation of order credits was not validated by acl in admin orders
ImpactCreation of order credits was not validated by ACL in admin ordersPatchesWe recommend updating to the current version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via the download overview.https://www.shopware.com/en/download/#shopware-6WorkaroundsFor older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659
CVE-2018-12320: There is a use after free in radare2 2.6.0 in r_anal_bb_free() in libr/anal/bb.c via a crafted Java binary file.
CVSS v3.0: 7.8
CVSS v2.0: 6.8
CVE-2026-27284: InDesign Desktop | Out-of-bounds Read (CWE-125)
InDesign Desktop versions 20.5.2, 21.2 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 7.8
CVE-2025-30200: ECOVACS Vacuum and Base Station Hard-Coded AES Encryption
ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic AES encryption key, which can be easily derived.
CVSS v4.0: 2.3
CVSS v3.1: 6.3
CVE-2026-13802: Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
CVE-2025-10155: PickleScan Security Bypass Using Misleading File Extension
An Improper Input Validation vulnerability in the scanning logic of mmaitre314 picklescan versions up to and including 0.0.30 allows a remote attacker to bypass pickle files security checks by supplying a standard pickle file with a PyTorch-related file extension. When the pickle file incorrectly considered safe is loaded, it can lead to the execution of malicious code.
CVSS v4.0: 9.3
GHSA-m5rc-37f7-4gfg: Off-by-one buffer overflow in NEC SOCKS5 1.0 r11 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long hostname.
CVE-2008-5213: SQL injection vulnerability in featured_article.php in AJ Article 1.0 allows remote attackers to execute arbitrary SQL commands via the artid parameter in a search detail action.
CVSS v2.0: 7.5
CVE-2025-63638: Sourcecodester AI-Powered To-Do List App v1.0 is vulnerable to Cross-Site Scripting (XSS) in the "Task Title" and "Description (Optional)" fields when creating a Task, allowing an attacker to inject arbitrary potentially malicious HTML/JavaScript code that executes in the victim's browser upon clicking the "Add Task" button.
CVSS v3.1: 6.1
CVE-2018-16496: In Versa Director, the un-authentication request found.
CVSS v3.1: 5.3
CVSS v2.0: 5
CVE-2004-1670: Multiple directory traversal vulnerabilities Merak Mail Server 7.4.5 with Icewarp Web Mail 5.2.7, and possibly other versions, allow remote attackers to (1) create arbitrary directories via a .. (dot dot) in the user parameter to viewaction.html or (2) rename arbitrary files via a ....// (doubled dot dot) in the folderold or folder parameters to folders.html.
CVSS v2.0: 7.5
CVE-2024-7395: Insufficient Authentication
An authentication bypass vulnerability in Korenix JetPort 5601v3 allows an attacker to access functionality on the device without specifying a password.This issue affects JetPort 5601v3: through 1.2.
CVSS v4.0: 9.3
GHSA-8mmh-cvrq-r3x6: In the Linux kernel, the following vulnerability has been resolved:ocfs2: split transactions in dio completion to avoid credit exhaustionDuring ocfs2 dio operations, JBD2 may report warnings via following
call trace:
ocfs2_dio_end_io_write
 ocfs2_mark_extent_written
  ocfs2_change_extent_flag
   ocfs2_split_extent
    ocfs2_try_to_merge_extent
     ocfs2_extend_rotate_transaction
      ocfs2_extend_trans
       jbd2__journal_restart
        start_this_handle
         output: JBD2: kworker/6:2 wants too many credits credits:5450 rsv_credits:0 max:5449To prevent exceeding the credits limit, modify ocfs2_dio_end_io_write() to
handle extents in a batch of transaction.Additionally, relocate ocfs2_del_inode_from_orphan().  The orphan inode
should only be removed from the orphan list after the extent tree update
is complete.  This ensures that if a crash occurs in the middle of extent
tree updates, we won't leave stale blocks beyond EOF.This patch also changes the logic for updating the inode size and removing
orphan, making it similar to ext4_dio_write_end_io().  Both operations are
performed only when everything looks good.Finally, thanks to Jans and Joseph for providing the bug fix prototype and
suggestions.
CVSS v3.1: 5.5
CVE-2025-46706: BIG-IP iRules vulnerability
When an iRule containing the HTTP::respond command is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS v4.0: 8.7
CVSS v3.1: 7.5
GHSA-6hxg-34v8-xgrp: Directory traversal vulnerability in the FireFTP add-on before 0.98.20080518 for Firefox allows remote FTP servers to create or overwrite arbitrary files via ..\ (dot dot backslash) sequences in responses to (1) MLSD and (2) LIST commands, a related issue to CVE-2002-1345.  NOTE: this can be leveraged for code execution by writing to a Startup folder.
CVE-2025-60229: WordPress Lagom theme <= 2.0 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Themeton Lagom allows Object Injection.

This issue affects Lagom: from n/a through 2.0.
CVSS v3.1: 9.8
CVE-2017-2890: An exploitable vulnerability exists in the /api/CONFIG/restore functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause an OS command injection. An attacker can send an HTTP request trigger this vulnerability.
CVSS v3.0: 9.9
CVE-2017-9392: An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides UPnP services that are available on port 3480 and can also be accessed via port 80 using the url "/port_3480". It seems that the UPnP services provide "request_image" as one of the service actions for a normal user to retrieve an image from a camera that is controlled by the controller. It seems that the "res" (resolution) parameter passed in the query string is not sanitized and is stored on the stack which allows an attacker to overflow the buffer. The function "LU::Generic_IP_Camera_Manager::REQ_Image" is activated when the lu_request_image is passed as the "id" parameter in the query string. This function then calls "LU::Generic_IP_Camera_Manager::GetUrlFromArguments". This function retrieves all the parameters passed in the query string including "res" and then uses the value passed in it to fill up buffer using the sprintf function. However, the function in this case lacks a simple length check and as a result an attacker who is able to send more than 184 characters can easily overflow the values stored on the stack including the $RA value and thus execute code on the device.
CVSS v3.0: 8.8
CVSS v2.0: 9
CVE-2023-31754: Optimizely CMS UI before v12.16.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Admin panel.
CVSS v3.1: 4.8
CVE-2016-0037: The forms-based authentication implementation in Active Directory Federation Services (ADFS) 3.0 in Microsoft Windows Server 2012 R2 allows remote attackers to cause a denial of service (daemon outage) via crafted data, aka "Microsoft Active Directory Federation Services Denial of Service Vulnerability."
CVSS v3.0: 7.5
CVSS v2.0: 5
CVE-2018-1000400: Kubernetes CRI-O version prior to 1.9 contains a Privilege Context Switching Error (CWE-270) vulnerability in the handling of ambient capabilities that can result in containers running with elevated privileges, allowing users abilities they should not have. This attack appears to be exploitable via container execution. This vulnerability appears to have been fixed in 1.9.
CVSS v3.0: 8.8
CVSS v2.0: 6.5
CVE-2012-5096: Unspecified vulnerability in the Server component in Oracle MySQL 5.5.28 and earlier allows remote authenticated users with Server Privileges to affect availability via unknown vectors.
CVSS v2.0: 3.5
CVE-2018-6597: The Alcatel A30 device with a build fingerprint of TCL/5046G/MICKEY6US:7.0/NRD90M/J63:user/release-keys contains a hidden privilege escalation capability to achieve command execution as the root user. They have made modifications that allow a user with physical access to the device to obtain a root shell via ADB. Modifying the read-only properties by an app as the system user creates a UNIX domain socket named factory_test that will execute commands as the root user by processes that have privilege to access it (as per the SELinux rules that the vendor controls).
CVSS v3.0: 6.8
CVSS v2.0: 7.2
GHSA-g8p2-7wf7-98mq: OpenClaw/Clawdbot has 1-Click RCE via Authentication Token Exfiltration From gatewayUrl
SummaryThe Control UI trusts `gatewayUrl` from the query string without validation and auto-connects on load, sending the stored gateway token in the WebSocket connect payload.Clicking a crafted link or visiting a malicious site can send the token to an attacker-controlled server. The attacker can then connect to the victim's local gateway, modify config (sandbox, tool policies), and invoke privileged actions, achieving 1-click RCE. This vulnerability is exploitable even on instances configured to listen on loopback only, since the victim's browser initiates the outbound connection.DetailsThe root cause is the lack of validation for `gatewayUrl` combined with auto‑connect behavior on page load. With the change users now need to confirm the new gateway URL in the UI.ImpactThis is a token exfiltration vulnerability that leads to full gateway compromise. It impacts any Moltbot deployment where a user has authenticated to the Control UI. The attacker gains operator-level access to the gateway API, enabling arbitrary config changes and code execution on the gateway host. The attack works even when the gateway binds to loopback because the victim's browser acts as the bridge.
CVSS v3.1: 8.8
CVE-2024-57969: app/Model/Attribute.php in MISP before 2.4.198 ignores an ACL during a GUI attribute search.
CVSS v3.1: 4.3
CVE-2014-7452: The Shaklee Product Catalog (aka com.wProductCatalog) application 2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0: 5.4
GHSA-9r8c-8qcg-679m: Exponent CMS 2.6.0patch2 allows an authenticated user to inject persistent JavaScript code on the "User-Agent" header when logging in. When an administrator user visits the "User Sessions" tab, the JavaScript will be triggered allowing an attacker to compromise the administrator session.
GHSA-5fgv-cvr8-xg48: Moodle vulnerable to Cross-site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) the Login-As feature or (2) when the global search feature is enabled, unspecified global search forms in the Global Search Engine.  NOTE: vector 1 might be resultant from a cross-site request forgery (CSRF) vulnerability.
CVSS v4.0: 1.3
CVE-2012-5574: lib/form/sfForm.class.php in Symfony CMS before 1.4.20 allows remote attackers to read arbitrary files via a crafted upload request.
CVSS v2.0: 5
GHSA-6x4q-qqxj-h82w: The Error Log Viewer WordPress plugin through 1.1.1 does not validate the path of the log file to clear, allowing high privilege users to clear arbitrary files on the web server, including those outside of the blog folder
CVSS v3.1: 4.9
CVE-2012-3106: Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.3.5 and 8.3.7 allows context-dependent attackers to affect availability via unknown vectors related to Outside In Filters, a different vulnerability than CVE-2012-1766, CVE-2012-1767, CVE-2012-1769, CVE-2012-1770, CVE-2012-1771, CVE-2012-1772, CVE-2012-1773, CVE-2012-3107, CVE-2012-3108, and CVE-2012-3110.
CVSS v2.0: 2.1
GHSA-pxhw-m5jj-mmp6: The core_get_proxyauth_dn function in ns-slapd in Sun Java System Directory Server Enterprise Edition 7.0 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted LDAP Search Request message.
GHSA-cwrg-6rc5-qfv7: A third-party vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to write beyond the boundaries of allocated memory in a DOE file. If exploited, a threat actor could leverage this vulnerability to execute arbitrary code. To exploit this vulnerability, a legitimate user must execute the malicious code crafted by the threat actor.
CVSS v4.0: 8.5
CVSS v3.1: 7.3
GHSA-7rf4-7p99-q8hp: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D Bone Weight Modifier structures. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5423.
CVSS v3.0: 8.8
GHSA-j36m-8cr4-5cq4: In the Linux kernel, the following vulnerability has been resolved:drm/amd/display: prevent hang on link training fail[Why]
When link training fails, the phy clock will be disabled. However, in
enable_streams, it is assumed that link training succeeded and the
mux selects the phy clock, causing a hang when a register write is made.[How]
When enable_stream is hit, check if link training failed. If it did, fall
back to the ref clock to avoid a hang and keep the system in a recoverable
state.
CVSS v3.1: 5.5
GHSA-36xm-f9vf-c2w5: Buffer overflow in the pop-2d POP daemon in the IMAP package allows remote attackers to gain privileges via the FOLD command.
CVE-2021-36917: WordPress Hide My WP premium plugin <= 6.2.3 - Unauthenticated Plugin Deactivation vulnerability
WordPress Hide My WP plugin (versions <= 6.2.3) can be deactivated by any unauthenticated user. It is possible to retrieve a reset token which can then be used to deactivate the plugin.
CVSS v3.1: 6.5
CVE-2025-4473: Frontend Dashboard 1.5.10 - 2.2.7 - Missing Authorization to Authenticated (Subscriber+) Account Takeover/Privilege Escalation via ajax_request Function
The Frontend Dashboard plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the ajax_request() function in versions 1.0 to 2.2.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to control where the plugin sends outgoing emails. By pointing SMTP to their own server, attackers could capture password reset emails intended for administrators, and elevate their privileges for full site takeover.
CVSS v3.1: 8.8
GHSA-8pp7-jpcf-f887: SonicWall GMS and Analytics CAS Web Services application use static values for authentication without proper checks leading to authentication bypass vulnerability. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
CVSS v3.1: 9.8
CVE-2017-5685: The BIOS in Intel NUC systems based on 6th Gen Intel Core processors prior to version KY0045 may allow may allow an attacker with physical access to the system to gain access to personal information.
CVSS v3.0: 3.9
CVSS v2.0: 2.1
GHSA-wj2x-pw29-8r3p: Use of Hard-coded Credentials in /var/www/xms/application/controllers/gatherLogs.php in the administrative console in Dialogic PowerMedia XMS through 3.5 allows remote attackers to interact with a web service.
CVSS v3.0: 9.8
CVE-2023-53399: ksmbd: fix NULL pointer dereference in smb2_get_info_filesystem()
In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix NULL pointer dereference in smb2_get_info_filesystem()

If share is , share->path is NULL and it cause NULL pointer
dereference issue.
CVSS v3.1: 5.5
GHSA-fqv5-38q6-69j6: Microsoft SharePoint Spoofing Vulnerability This CVE ID is unique from CVE-2021-1717.
CVSS v3.1: 5.4
GHSA-4wrc-rw64-f2jp: The Absolute Lending Solutions (aka com.soln.S008F6C05EC0B63264B429F6D76286562) application 1.0073.b0073 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2023-26068: Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 2 of 4).
CVSS v3.1: 9.8
CVE-2024-57852: firmware: qcom: scm: smc: Handle missing SCM device
In the Linux kernel, the following vulnerability has been resolved:

firmware: qcom: scm: smc: Handle missing SCM device

Commit ca61d6836e6f ("firmware: qcom: scm: fix a NULL-pointer
dereference") makes it explicit that qcom_scm_get_tzmem_pool() can
return NULL, therefore its users should handle this.
CVSS v3.1: 5.5
CVE-2004-0609: rssh 2.0 through 2.1.x expands command line arguments before entering a chroot jail, which allows remote authenticated users to determine the existence of files in a directory outside the jail.
CVSS v2.0: 5
GHSA-3872-f48p-pxqj: Improper Neutralization of Special Elements used in a Command ('Command Injection') in Weblate
ImpactWeblate didn't correctly sanitize some arguments passed to Git and Mercurial, which allowed changing their behavior in an unintended way.PatchesThe issues were fixed in the 4.11.1 release. The following commits are addressing it:35d59f1f040541c358cece0a8d4a63183ca919b8d83672a3e7415da1490334e2c9431e5da1966842WorkaroundsInstances in which untrusted users cannot create new components are not affected.References[SNYK-PYTHON-WEBLATE-2414088](https://security.snyk.io/vuln/SNYK-PYTHON-WEBLATE-2414088)For more informationIf you have any questions or comments about this advisory:Open a topic in [discussions](https://github.com/WeblateOrg/weblate/discussions)Email us at [care@weblate.org](mailto:care@weblate.org)
CVSS v4.0: 8.7
CVSS v3.1: 8.8
RHSA-2023:5952: Red Hat Security Advisory: Red Hat OpenShift Service Mesh for 2.4.4 security update
containerd: pulling and extracting crafted container image may result in Unix file permission changes buildkit: Data disclosure in provenance attestation describing a build golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)
CVSS v3.1: 7.5
CVE-2023-42912: Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Sonoma 14.2. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution.
CVSS v3.1: 7.8
GHSA-3wq6-8f7g-92vm: HCL Verse v10 and v11 is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability due to improper handling of message content. An unauthenticated remote attacker could exploit this vulnerability using specially-crafted markup to execute script in a victim's web browser within the security context of the hosting Web site and/or steal the victim's cookie-based authentication credentials.
GHSA-c5rv-hjjc-jv7m: tiagorlampert CHAOS vulnerable to Cross Site Scripting
Cross Site Scripting vulnerability in tiagorlampert CHAOS v.5.0.1 allows a remote attacker to escalate privileges via the sendCommandHandler function in the handler.go component.
CVSS v3.1: 4.8
CVE-2021-27623: SAP Internet Graphics Service, versions - 7.20,7.20EXT,7.53,7.20_EX2,7.81, allows an unauthenticated attacker after retrieving an existing system state value can submit a malicious IGS request over a network which due to insufficient input validation in method CXmlUtility::CheckLength() which will trigger an internal memory corruption error in the system causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified.
CVSS v3.0: 5.9