ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-xrwr-fcw6-fmq8: Weblate: SSRF via Project-Level Machinery Configuration
ImpactA user with the `project.edit` permission (granted by the per-project "Administration" role) can configure machine translation service URLs pointing to arbitrary internal network addresses. During configuration validation, Weblate makes an HTTP request to the attacker-controlled URL and reflects up to 200 characters of the response body back to the user in an error message. This constitutes a Server-Side Request Forgery (SSRF) with partial response read.Patcheshttps://github.com/WeblateOrg/weblate/pull/18684The solution then has been cleaned up in followup patchesWorkaroundsLimiting available machinery services via WEBLATE_MACHINERY setting can avoid this.ReferencesThanks to @DavidCarliez for disclosing this via GitHub private vulnerability reporting.
CVSS v3.1: 5
GHSA-4f47-qgv4-g7jp: Unrestricted Upload of File with Dangerous Type vulnerability in Brian Batt - elearningfreak.com Insert or Embed Articulate Content into WordPress allows Upload a Web Shell to a Web Server. This issue affects Insert or Embed Articulate Content into WordPress: from n/a through 4.3000000025.
CVSS v3.1: 9.1
CVE-2024-49773: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in SuiteCRM
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Poor input validation in export allows authenticated user do a SQL injection attack. User-controlled input is used to build SQL query. `current_post` parameter in `export` entry point can be abused to perform blind SQL injection via generateSearchWhere(). Allows for Information disclosure, including personally identifiable information. This issue has been addressed in versions 7.14.6 and 8.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS v3.1: 5.3
GHSA-4677-mwx7-hw3w: A vulnerability, which was classified as problematic, was found in CodeAstro Food Ordering System 1.0. Affected is an unknown function of the file /admin/store/edit/ of the component POST Request Parameter Handler. The manipulation of the argument Restaurant Name/Address leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 1.9
CVSS v3.1: 2.4
GHSA-2rg6-3m8g-8x9g: CiscoWorks Common Management Foundation (CMF) 2.1 and earlier allows the guest user to obtain restricted information and possibly gain administrative privileges by changing the "guest" user to the Admin user on the Modify or delete users pages.
CVE-2016-1566: Cross-site scripting (XSS) vulnerability in the file browser in Guacamole 0.9.8 and 0.9.9, when file transfer is enabled to a location shared by multiple users, allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename.  NOTE: this vulnerability was fixed in guacamole.war on 2016-01-13, but the version number was not changed.
CVSS v3.0: 5.4
CVSS v2.0: 3.5
GHSA-8ph8-qhj8-87rw: IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a privileged user to obtain sensitive Azure bot credential information. IBM X-Force ID: 226342.
CVSS v3.1: 4.9
GHSA-m8gr-q643-3q88: An issue was discovered in GitLab CE/EE affecting all versions starting from 8.16 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows deploy keys to push to an archived repository.
CVSS v3.1: 4.9
GHSA-3f3m-2fpg-4v6r: A command injection (missing input validation, escaping) in the ftp upgrade configuration interface on the Auerswald COMfort 1200 IP phone 3.4.4.1-10589 allows an authenticated remote attacker (simple user) -- in the same network as the device -- to trigger OS commands (like starting telnetd or opening a reverse shell) via a POST request to the web server.
CVE-2024-39314: toy-blog administrative token leaked through the command line parameter
toy-blog is a headless content management system implementation. Starting in version 0.4.3 and prior to version 0.5.0, the administrative password was leaked through the command line parameter. The problem was patched in version 0.5.0. As a workaround, pass `--read-bearer-token-from-stdin` to the launch arguments and feed the token from the standard input in version 0.4.14 or later. Earlier versions do not have this workaround.
CVSS v3.1: 4.7
CVE-2020-4761: IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5_2, 6.0.0.0 through 6.0.3.2, and 6.1.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 188895.
CVSS v3.0: 5.3
GHSA-6v6p-c65q-8x22: Solaris 2.4 before kernel jumbo patch -35 allows set-gid programs to dump core even if the real user id is not in the set-gid group, which allows local users to overwrite or create files at higher privileges by causing a core dump, e.g. through dmesg.
CVE-2014-3790: Ruby vSphere Console (RVC) in VMware vCenter Server Appliance allows remote authenticated users to execute arbitrary commands as root by escaping from a chroot jail.
CVSS v2.0: 9
CVE-2024-27975: An Use-after-free vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM. 
CVSS v3.0: 8.8
GHSA-vqm9-87vr-9765: A group deletion race condition in 2FAuth v5.5.0 causes data inconsistencies and orphaned accounts when a group is deleted while other operations are pending.
CVSS v3.1: 6.5
CVE-2026-4379: LightPress Lightbox <= 2.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'group' Shortcode Attribute
The LightPress Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `group` attribute in the `[gallery]` shortcode in all versions up to, and including, 2.3.4. This is due to the plugin modifying gallery shortcode output to include the `group` attribute value without proper escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
RHSA-2026:5691: Red Hat Security Advisory: kernel security update
kernel: RDMA/rxe: Fix incomplete state save in rxe_requester kernel: Linux kernel: RDMA/rxe use-after-free vulnerability leading to potential arbitrary code execution kernel: sctp: avoid NULL dereference when chunk data buffer is missing kernel: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr()
CVSS v3.1: 7.5
CVE-2001-1253: Alexis 2.0 and 2.1 in COM2001 InternetPBX stores voicemail passwords in plain text in the com2001.ini file, which could allow local users to make long distance calls as other users.
CVSS v2.0: 4.6
RHSA-2021:2259: Red Hat Security Advisory: nginx:1.18 security update
nginx: Off-by-one in ngx_resolver_copy() when labels are followed by a pointer to a root domain name
CVSS v3.1: 8.1
GHSA-f953-7679-xc38: A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due to a use-after-free vulnerability, where a memory pointer is incorrectly handled. A local attacker could exploit this flaw by manipulating smartcard or YubiKey contents, leading to a denial of service that disrupts authentication. This vulnerability also presents a potential for privilege escalation, although it is difficult to exploit.
CVSS v3.1: 6.4
CVE-2025-64174: OpenMage is vulnerable to XSS in Admin Notifications
Magento-lts is a long-term support alternative to Magento Community Edition (CE). Versions 20.15.0 and below are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin with direct database access or the admin notification feed source to inject malicious scripts into vulnerable fields. Unescaped translation strings and URLs are printed into contexts inside app/code/core/Mage/Adminhtml/Block/Notification/Grid/Renderer/Actions.php. A malicious translation or polluted data can inject script. This issue is fixed in version 20.16.0.
CVSS v4.0: 4.6
CVE-2025-58198: WordPress Xpro Theme Builder Plugin <= 1.2.9 - Broken Access Control Vulnerability
Missing Authorization vulnerability in Xpro Xpro Theme Builder xpro-theme-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Xpro Theme Builder: from n/a through <= 1.2.9.
CVSS v3.1: 6.5
GHSA-xcr6-9x44-6hpq: Memory corruption in Audio while processing RT proxy port register driver.
CVSS v3.1: 8.4
CVE-2025-23587: WordPress all-in-one-box-login plugin <= 2.0.1 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ashek Al Mahmud all-in-one-box-login all-in-one-login allows Reflected XSS.This issue affects all-in-one-box-login: from n/a through <= 2.0.1.
CVSS v3.1: 7.1
GHSA-28j5-v67p-rr85: Huawei products NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00SPC100; Secospace USG6600 versions V500R001C30SPC600, V500R001C60SPC500, and V500R005C00SPC100; and USG9500 versions V500R001C30SPC600, V500R001C60SPC500, and V500R005C00SPC100 have a denial of service vulnerability. Attackers need to perform a series of operations in a special scenario to exploit this vulnerability. Successful exploit may cause the new connections can't be established, result in a denial of service.
CVE-2016-0046: Windows Reader in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 allows remote attackers to execute arbitrary code via a crafted Reader file, aka "Microsoft Windows Reader Vulnerability."
CVSS v3.0: 7.8
CVSS v2.0: 9.3
GHSA-7gjv-5f7m-2vgj: The IKEv2 implementation in Cisco IOS 15.0 through 15.6 and IOS XE 3.3 through 3.17 allows remote attackers to cause a denial of service (device reload) via fragmented packets, aka Bug ID CSCux38417.
CVSS v3.0: 5.9
CVE-2025-40604: Download of Code Without Integrity Check Vulnerability in the SonicWall Email Security appliance loads root filesystem images without verifying signatures, allowing attackers with VMDK or datastore access to modify system files and gain persistent arbitrary code execution.
CVSS v3.1: 6.5
GHSA-xcgw-94hj-93r7: The Zoom Client for Meetings for Windows installer before version 5.5.4 does not properly verify the signature of files with .msi, .ps1, and .bat extensions. This could lead to a malicious actor installing malicious software on a customer's computer.
CVE-2021-2178: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 5.7.32 and prior and 8.0.22 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
CVSS v3.1: 6.5
GHSA-r7jg-46x5-3627: A vulnerability, which was classified as critical, has been found in 1000 Projects Bookstore Management System 1.0. Affected by this issue is some unknown functionality of the file addtocart.php. The manipulation of the argument bcid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVE-2024-20406: Cisco IOS XR Software Intermediate System-to-Intermediate System Denial of Service Vulnerability
A vulnerability in the segment routing feature for the Intermediate System-to-Intermediate System (IS-IS) protocol of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device.

This vulnerability is due to insufficient input validation of ingress IS-IS packets. An attacker could exploit this vulnerability by sending specific IS-IS packets to an affected device after forming an adjacency. A successful exploit could allow the attacker to cause the IS-IS process on all affected devices that are participating in the Flexible Algorithm to crash and restart, resulting in a DoS condition.
Note: The IS-IS protocol is a routing protocol. To exploit this vulnerability, an attacker must be Layer 2-adjacent to the affected device and must have formed an adjacency. This vulnerability affects segment routing for IS-IS over IPv4 and IPv6 control planes as well as devices that are configured as level 1, level 2, or multi-level routing IS-IS type.
CVSS v3.1: 7.4
CVE-2003-1585: Cross-site scripting (XSS) vulnerability in WebLogExpert allows remote attackers to inject arbitrary web script or HTML via a crafted client domain name, related to an "Inverse Lookup Log Corruption (ILLC)" issue.
CVSS v2.0: 4.3
GHSA-hjxm-5f5m-prmm: .NET Framework Denial of Service Vulnerability.
CVSS v3.1: 7.5
GHSA-xgp5-592f-4xcv: ImageMagick before 7.1.2-22 contains a division by zero vulnerability in binomial kernel processing that allows attackers to cause denial of service. An attacker can supply a large binomial kernel value causing integer overflow, resulting in division by zero and application crash.
CVSS v4.0: 4.8
CVSS v3.1: 3.3
CVE-2008-1126: PHP remote file inclusion vulnerability in main.php in Barryvan Compo Manager 0.3 allows remote attackers to execute arbitrary PHP code via a URL in the pageURL parameter.
CVSS v2.0: 6.8
CVE-2020-0032: In ih264d_release_display_bufs of ih264d_utils.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-145364230
CVSS v3.1: 8.8
CVSS v2.0: 9.3
GHSA-x3pg-369x-vc72: HCL Launch is vulnerable to HTML injection. HTML code is stored and included without being sanitized. This can lead to further attacks such as XSS and Open Redirections.
CVSS v3.1: 5.4
CVE-2016-4574: Off-by-one error in the append_utf8_value function in the DN decoder (dn.c) in Libksba before 1.3.4 allows remote attackers to cause a denial of service (out-of-bounds read) via invalid utf-8 encoded data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-4356.
CVSS v3.0: 7.5
CVSS v2.0: 5
GHSA-4gcp-hx9q-5r25: In the Linux kernel, the following vulnerability has been resolved:regulator: core: Use different devices for resource allocation and DT lookupFollowing by the below discussion, there's the potential UAF issue
between regulator and mfd.
https://lore.kernel.org/all/20221128143601.1698148-1-yangyingliang@huawei.com/From the analysis of YingliangCPU A				|CPU B
mt6370_probe()			|
  devm_mfd_add_devices()	|
				|mt6370_regulator_probe()
				|  regulator_register()
				|    //allocate init_data and add it to devres
				|    regulator_of_get_init_data()
i2c_unregister_device()		|
  device_del()			|
    devres_release_all()	|
      // init_data is freed	|
      release_nodes()		|
				|  // using init_data causes UAF
				|  regulator_register()It's common to use mfd core to create child device for the regulator.
In order to do the DT lookup for init data, the child that registered
the regulator would pass its parent as the parameter. And this causes
init data resource allocated to its parent, not itself. The issue happen
when parent device is going to release and regulator core is still doing
some operation of init data constraint for the regulator of child device.To fix it, this patch expand 'regulator_register' API to use the
different devices for init data allocation and DT lookup.
CVE-2026-24031: Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin. This vulnerability allows bypassing authentication for any user and user enumeration. Do not clear auth_username_chars. If this is not possible, install latest fixed version. No publicly available exploits are known.
CVSS v3.1: 7.7
CVE-2021-20167: Netgear RAX43 version 1.0.3.96 contains a command injection vulnerability. The readycloud cgi application is vulnerable to command injection in the name parameter.
CVSS v3.1: 8
CVSS v2.0: 7.7
GHSA-pp9r-xg4c-8j4x: Salvo Affected by Denial of Service via Unbounded Memory Allocation in Form Data Parsing
SummarySalvo's form data parsing implementations (`form_data()` method and `Extractible` macro) do not enforce payload size limits before reading request bodies into memory. This allows attackers to cause Out-of-Memory (OOM) conditions by sending extremely large payloads, leading to service crashes and denial of service.DetailsVulnerability DescriptionThree attack vectors exist in Salvo's form handling:**URL-encoded form data** (`application/x-www-form-urlencoded`)`Request::form_data()` calls `BodyExt::collect(body)` which reads the entire body into memory without size checkingAffects handlers using `req.form_data().await` directly**Multipart form data** (`multipart/form-data`)Similar unbounded memory allocation during parsingAffects handlers processing multipart uploads**Extractible macro**`#[derive(Extractible)]` with `#[salvo(extract(default_source(from = "body")))]` internally calls `form_data()`Vulnerabilities propagate to all extractors using body sourcesRoot CauseThe `FormData::read()` implementation prioritizes convenience over safety by reading entire request bodies before validation. Even when `Request::payload_with_max_size()` is available, it's not automatically applied in the form parsing path.PoCrun `Extract data from request` example in readme.md in docker file with limited memory say 100mb.Send `application/x-www-form-urlencoded` OR `multipart/form-data` payload to the endpoint.The server process OOM-crashes, instead of returning 413 error.ImpactImmediate Effects**Service Unavailability**: Servers crash under memory pressure**Resource Exhaustion**: Single request can consume all available memory**Cascading Failures**: In containerized environments, OOM can affect other servicesAttack Characteristics**Low Cost**: Attacker needs minimal bandwidth (header only, body can be streamed)**No Authentication**: Exploitable on public endpoints**Difficult to Rate-Limit**: Traditional rate limiting may not prevent single large request**Amplification**: Small network cost → large memory consumptionReal-World ScenariosPublic API endpoints accepting form dataUser registration/profile update handlersFile upload endpoints using multipart formsAny endpoint using `#[derive(Extractible)]` with body sourcesSuggestion: Make Multipart File Upload Handling Explicit Opt-InProblem StatementCurrently, Salvo's multipart form data parsing automatically handles file uploads without explicit developer intent. This creates several security and usability concerns:**Unintended File Storage**: Developers may unknowingly accept file uploads when they only intended to handle text fields**Disk Space Exhaustion**: Automatic file buffering to disk can fill storage without proper limits**Resource Cleanup**: Temporary files may not be properly cleaned up if handlers don't expect them**Attack Surface**: Endpoints inadvertently become file upload targets
CVSS v4.0: 8.7
GHSA-3x4w-mxpf-fhqq: Craft CMS Vulnerable to Stored XSS in Revision Context Menu
The revision/draft context menu in the element editor renders the creator’s `fullName` as raw HTML due to the 
use of `Template::raw()` combined with `Craft::t()` string interpolation. A low-privileged control panel user
(e.g., Author) can set their fullName to an XSS payload via the profile editor, then create an entry with two
saves.If an administrator is logged in and executes a specifically crafted payload while an elevated session is active, the attacker’s account can be elevated to administrator.Users should update to Craft 5.9.11 with the patch to mitigate the issue.
CVSS v4.0: 5.3
CVE-2016-5047: NetApp OnCommand System Manager 8.3.x before 8.3.2P5 allows remote authenticated users to cause a denial of service via unspecified vectors.
CVSS v3.0: 6.5
CVSS v2.0: 4
RHSA-2014:0798: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.4 update
CXF: The SecurityTokenService accepts certain invalid SAML Tokens as valid CXF: UsernameTokens are sent in plaintext with a Symmetric EncryptBeforeSigning policy CXF: HTML content posted to SOAP endpoint could cause OOM errors CXF: Large invalid content could cause temporary space to fill JAX-RS: Information disclosure via XML eXternal Entity (XXE)
GHSA-gwxm-wqpq-w539: Jenkins Email Extension Plugin showed plain text SMTP password in configuration form field
An exposure of sensitive information vulnerability exists in Jenkins Email Extension Plugin 2.61 and older in src/main/resources/hudson/plugins/emailext/ExtendedEmailPublisher/global.groovy and ExtendedEmailPublisherDescriptor.java that allows attackers with control of a Jenkins administrator's web browser (e.g. malicious extension) to retrieve the configured SMTP password.
CVSS v3.0: 6.5
CVE-2022-20709: Cisco Small Business RV Series Routers Vulnerabilities
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned software Cause denial of service (DoS) For more information about these vulnerabilities, see the Details section of this advisory.
CVSS v3.1: 10
CVE-2023-5499: Shenzhen Reachfar v28 information exposure
Information exposure vulnerability in Shenzhen Reachfar v28, the exploitation of which could allow a remote attacker to retrieve all the week's logs stored in the 'log2' directory. An attacker could retrieve sensitive information such as remembered wifi networks, sent messages, SOS device locations and device configurations.
CVSS v3.1: 7.5
GHSA-m6h6-qqfx-g75p: BlueDragon Server and Server JX 6.2.1.286 for Windows allows remote attackers to cause a denial of service (hang) via a request for a .cfm file whose name contains an MS-DOS device name such as (1) con, (2) aux, (3) com1, and (4) com2.
RHSA-2023:2236: Red Hat Security Advisory: toolbox security and bug fix update
golang: net/http: handle server errors after sending GOAWAY golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests
CVSS v3.1: 5.3
GHSA-cc4m-mp48-x7qg: Spring AI's support for Anthropic's Skills API used LLM-influenced filenames unsanitized in Path.resolve before writing files to disk
Spring AI's support for Anthropic's Skills API used LLM-influenced filenames unsanitized in Path.resolve before writing files to disk. This could allow a malicious user to write files outside the intended target directory, including restricted directories.Affected versions:
Spring AI: 1.1.0 through 1.1.7
CVSS v3.1: 6.5