ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-5rjg-v5wr-9xwx: Possible integer overflow can occur when stream info update is called when total number of streams detected are zero while parsing TS clip with invalid data in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
GHSA-4m9w-v6j5-322p: Multiple cross-site request forgery (CSRF) vulnerabilities in the administrative interface in Bloxx Web Filtering before 5.0.14 allow remote attackers to hijack the authentication of administrators for requests that perform administrative actions.
CVE-2018-18845: internal/advanced_comment_system/index.php and internal/advanced_comment_system/admin.php in Advanced Comment System, version 1.0, contain a reflected cross-site scripting vulnerability via ACS_path. A remote unauthenticated attacker could potentially exploit this vulnerability to supply malicious HTML or JavaScript code to a vulnerable web application, which is then reflected back to the victim and executed by the web browser. The product is discontinued.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
CVE-2024-6936: formtools.org Form Tools Setting code injection
A vulnerability, which was classified as problematic, has been found in formtools.org Form Tools 3.1.1. This issue affects some unknown processing of the file /admin/settings/index.php?page=accounts of the component Setting Handler. The manipulation of the argument Page Theme leads to code injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-271991. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 5.1
CVSS v3.1: 2.7
CVSS v3.0: 2.7
CVSS v2.0: 3.3
CVE-2025-1151: GNU Binutils ld xmemdup.c xmemdup memory leak
A vulnerability was found in GNU Binutils 2.43. It has been rated as problematic. This issue affects the function xmemdup of the file xmemdup.c of the component ld. The manipulation leads to memory leak. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The code maintainer explains: "I'm not going to commit some of the leak fixes I've been working on to the 2.44 branch due to concern that would destabilise ld. All of the reported leaks in this bugzilla have been fixed on binutils master."
CVSS v4.0: 2.3
CVSS v3.1: 3.1
CVSS v3.0: 3.1
CVSS v2.0: 2.6
GHSA-vppx-25hc-f892: IBM Langflow OSS 1.0.0 through 1.9.0 could allow a denial of service due to uncontrolled resource consumption.
CVSS v3.1: 7.1
CVE-2009-1710: WebKit in Apple Safari before 4.0 allows remote attackers to spoof the browser's display of (1) the host name, (2) security indicators, and unspecified other UI elements via a custom cursor in conjunction with a modified CSS3 hotspot property.
CVSS v2.0: 2.6
GHSA-4chp-rv27-mr56: In the Linux kernel, the following vulnerability has been resolved:PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before releaseThe fields dma_chan_tx and dma_chan_rx of the struct pci_epf_test can be
NULL even after EPF initialization. Then it is prudent to check that
they have non-NULL values before releasing the channels. Add the checks
in pci_epf_test_clean_dma_chan().Without the checks, NULL pointer dereferences happen and they can lead
to a kernel panic in some cases:Unable to handle kernel NULL pointer dereference at virtual address 0000000000000050
  Call trace:
   dma_release_channel+0x2c/0x120 (P)
   pci_epf_test_epc_deinit+0x94/0xc0 [pci_epf_test]
   pci_epc_deinit_notify+0x74/0xc0
   tegra_pcie_ep_pex_rst_irq+0x250/0x5d8
   irq_thread_fn+0x34/0xb8
   irq_thread+0x18c/0x2e8
   kthread+0x14c/0x210
   ret_from_fork+0x10/0x20[mani: trimmed the stack trace]
CVE-2024-26710: powerpc/kasan: Limit KASAN thread size increase to 32KB
In the Linux kernel, the following vulnerability has been resolved:

powerpc/kasan: Limit KASAN thread size increase to 32KB

KASAN is seen to increase stack usage, to the point that it was reported
to lead to stack overflow on some 32-bit machines (see link).

To avoid overflows the stack size was doubled for KASAN builds in
commit 3e8635fb2e07 ("powerpc/kasan: Force thread size increase with
KASAN").

However with a 32KB stack size to begin with, the doubling leads to a
64KB stack, which causes build errors:
  arch/powerpc/kernel/switch.S:249: Error: operand out of range (0x000000000000fe50 is not between 0xffffffffffff8000 and 0x0000000000007fff)

Although the asm could be reworked, in practice a 32KB stack seems
sufficient even for KASAN builds - the additional usage seems to be in
the 2-3KB range for a 64-bit KASAN build.

So only increase the stack for KASAN if the stack size is < 32KB.
CVSS v3.1: 5.5
GHSA-658f-6m2q-8572: Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General).  Supported versions that are affected are 8.4.0-8.4.9 and  9.0.0-9.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Router.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Router. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
CVSS v3.1: 7.5
RHSA-2016:2581: Red Hat Security Advisory: NetworkManager security, bug fix, and enhancement update
NetworkManager: Race condition allowing info leak
GHSA-v76g-p5xj-4qm7: SQL-Ledger 2.4.4 through 2.6.17 authenticates users by verifying that the value of the sql-ledger-[username] cookie matches the value of the sessionid parameter, which allows remote attackers to gain access as any logged-in user by setting the cookie and the parameter to the same value.
GHSA-jx7q-f9m8-g9pq: HPE System Management Homepage before 7.5.4 allows remote authenticated users to obtain sensitive information via unspecified vectors.
CVSS v3.0: 6.5
CVE-2025-3510: tagDiv Composer <= 5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes
The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcodes in all versions up to, and including, 5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
CVE-2018-18340: Incorrect object lifecycle in MediaRecorder in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS v3.0: 8.8
CVSS v2.0: 6.8
GHSA-599w-rmp9-p3vv: In sound driver, there is a possible information disclosure due to symlink following. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06558663; Issue ID: ALPS06558663.
CVSS v3.1: 6.7
CVE-2019-18378: Symantec Messaging Gateway, prior to 10.7.3, may be susceptible to a cross-site scripting (XSS) exploit, which is a type of issue that can enable attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to potentially bypass access controls such as the same-origin policy.
CVSS v3.1: 4.8
CVSS v2.0: 3.5
CVE-2010-1251: Unspecified vulnerability in Microsoft Office Excel 2002 SP3 and Office 2004 for Mac allows remote attackers to execute arbitrary code via a crafted Excel file, aka "Excel Record Stack Corruption Vulnerability."
CVSS v2.0: 9.3
GHSA-rh5w-4xpg-jvmh: Sun Solaris 8, 9, and 10 allows "remote privileged" users to cause a denial of service (panic) via unknown vectors related to self encapsulated IP packets.
GHSA-rrq9-69xh-wj7r: Format string vulnerability in the SetBaseURL function in AtHoc toolbar allows remote attackers to execute arbitrary code via format string specifiers in an invalid URL that is recorded in the debug log.
CVE-2024-13367: Sandbox <= 0.4 - Missing Authorization to Authenticated (Subscriber+) Sandbox Download
The Sandbox plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the export_download action in all versions up to, and including, 0.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to download an entire copy of a sandbox environment which can contain sensitive information like the wp-config.php file.
CVSS v3.1: 6.5
GHSA-hr38-v64h-jq3f: Open redirect vulnerability in EMC Unisphere Central before 4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an unspecified parameter.
GHSA-mc24-4gfx-g945: Unspecified vulnerability in Microsoft Windows 8 allows remote attackers to cause a denial of service (reboot) or possibly have unknown other impact via a crafted TrueType Font (TTF) file, as demonstrated by the 120612-69701-01.dmp error report.
RHSA-2023:5810: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.3 Product Security and Bug Fix Update
golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)
CVSS v3.1: 7.5
CVE-2015-5889: rsh in the remote_cmds component in Apple OS X before 10.11 allows local users to obtain root privileges via vectors involving environment variables.
CVSS v2.0: 7.2
GHSA-j45x-3v7g-qxh8: CWE-20: Improper Input Validation vulnerability exists that could lead to a denial of service and a loss of
confidentiality, integrity of the controller when an unauthenticated crafted Modbus packet is sent to the device.
CVSS v4.0: 9.3
CVSS v3.1: 9.8
GHSA-764w-ch2j-96hf: The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows remote attackers to read process heap memory via unspecified vectors.
CVE-2024-7715: D-Link DNS-1550-04 photocenter_mgr.cgi sprintf command injection
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240812. It has been classified as critical. This affects the function sprintf of the file /cgi-bin/photocenter_mgr.cgi. The manipulation of the argument filter leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
CVE-2025-3910: Org.keycloak.authentication: two factor authentication bypass
A flaw was found in Keycloak. The org.keycloak.authorization package may be vulnerable to circumventing required actions, allowing users to circumvent requirements such as setting up two-factor authentication.
CVSS v3.1: 5.4
RHSA-2024:7005: Red Hat Security Advisory: kernel-rt security update
kernel: gpiolib: cdev: Fix use after free in lineinfo_changed_notify kernel: wifi: mac80211: Avoid address calculations via out of bounds array indexing kernel: ice: Fix improper extts handling
CVSS v3.1: 4.4
CVE-2007-5581: Multiple cross-site scripting (XSS) vulnerabilities in mpweb/scripts/mpx.dll in Cisco Unified MeetingPlace 5.4 and earlier and 6.0 allow remote attackers to inject arbitrary web script or HTML via the (1) FirstName and (2) LastName parameters.
CVSS v2.0: 4.3
RHSA-2026:2671: Red Hat Security Advisory: OpenShift Container Platform 4.17.49 bug fix and security update
glib: Integer overflow in in g_escape_uri_string() openssl: OpenSSL: Remote code execution or Denial of Service via oversized Initialization Vector in CMS parsing libpng: LIBPNG out-of-bounds read in png_image_read_composite
CVSS v3.1: 7.1
CVE-2025-13911: Inductive Automation Ignition Execution with Unnecessary Privileges
The vulnerability affects Ignition SCADA applications where Python 
scripting is utilized for automation purposes. The vulnerability arises 
from the absence of proper security controls that restrict which Python 
libraries can be imported and executed within the scripting environment.
 The core issue lies in the Ignition service account having system 
permissions beyond what an Ignition privileged user requires. When an 
authenticated administrator uploads a malicious project file containing 
Python scripts with bind shell capabilities, the application executes 
these scripts with the same privileges as the Ignition Gateway process, 
which typically runs with SYSTEM-level permissions on Windows. 
Alternative code execution patterns could lead to similar results.
CVSS v4.0: 7.3
CVSS v3.1: 6.4
CVE-2017-9838: Dolibarr ERP/CRM is affected by multiple reflected Cross-Site Scripting (XSS) vulnerabilities in versions before 5.0.4: index.php (leftmenu parameter), core/ajax/box.php (PATH_INFO), product/stats/card.php (type parameter), holiday/list.php (month_create, month_start, and month_end parameters), and don/card.php (societe, lastname, firstname, address, zipcode, town, and email parameters).
CVSS v3.0: 5.4
CVSS v2.0: 3.5
GHSA-fwwc-f8hw-qfwf: Null pointer dereference when composing from a specially crafted draft message in Mutt >1.5.2 <2.2.12
CVSS v3.1: 2.2
GHSA-mw4p-mgpv-4m52: app\admin\controller\sys\Uploads.php in lemocms 1.8.x allows users to upload files to upload executable files.
CVE-2026-11125: Use after free in Compositing in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVSS v3.1: 8.8
GHSA-mwv2-4r83-7wmm: The BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.5. This is due to missing nonce validation on the woobe_delete_tax_term() function. This makes it possible for unauthenticated attackers to delete WooCommerce taxonomy terms (categories, tags, etc.) via a forged request granted they can trick a site administrator or shop manager into performing an action such as clicking on a link.
CVSS v3.1: 4.3
CVE-2001-1578: Unknown vulnerability in SCO OpenServer 5.0.6 and earlier allows local users to modify critical information such as certain CPU registers and segment descriptors.
CVSS v2.0: 2.1
CVE-2019-17142: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of script within a Keystroke action of a listbox field. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9081.
CVSS v3.0: 7.8
GHSA-7qw4-9r68-2rmx: mingSoft MCMS File Upload vulnerability
File Upload vulnerability in MCMS 5.3.5 allows attackers to upload arbitrary files via crafted POST request to /ms/file/upload.do.
CVSS v3.1: 8.8
GHSA-jmfc-j352-6j46: Unspecified vulnerability in the kmxfw.sys driver in CA Host-Based Intrusion Prevention System (HIPS) r8, as used in CA Internet Security Suite and Personal Firewall, allows remote attackers to cause a denial of service via unknown vectors, related to "insufficient validation."
CVE-2025-12074: Context Blog <= 1.2.5 - Unauthenticated Private Post Disclosure
The Context Blog theme for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.5 via the 'context_blog_modal_popup' due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.
CVSS v3.1: 5.3
GHSA-fgmm-c43r-4vvc: The The Events Calendar plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'tec_qr_code_modal' AJAX endpoint in all versions up to, and including, 6.15.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view draft event names and generate/view QR codes for them.
CVSS v3.1: 4.3
GHSA-xw83-pwrm-9j74: Twig remote code execution in templates
The `displayBlock` function `Template.php` in Sensio Labs Twig before 1.20.0, when Sandbox mode is enabled, allows remote attackers to execute arbitrary code via the `_self` variable in a template.
CVSS v3.1: 8.1
CVE-2006-0676: Cross-site scripting (XSS) vulnerability in header.php in PHP-Nuke 6.0 to 7.8 allows remote attackers to inject arbitrary web script or HTML via the pagetitle parameter.
CVSS v2.0: 4.3
GHSA-24mw-qrcm-pg54: Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Package Build SEC).  Supported versions that are affected are Prior to 9.2.8.1. Easily exploitable vulnerability allows high privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 2.7 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L).
CVSS v3.1: 2.7
GHSA-5mx2-2mgw-x8rm: OpenClaw: BlueBubbles beta plugin webhook auth hardening (remove passwordless fallback)
SummaryBlueBubbles webhook auth in the optional beta iMessage plugin allowed a passwordless fallback path. In some reverse-proxy/local routing setups, this could allow unauthenticated webhook events.Affected Component and ScopeComponent: `extensions/bluebubbles` webhook handlerScope: only deployments using the optional BlueBubbles plugin where webhook password auth was not configured for incoming webhook eventsAffected Packages / VersionsPackage: `openclaw/openclaw` (npm)Latest published npm version at triage time (2026-02-21): `2026.2.19-2`Affected structured range: `<=2026.2.19-2`Fixed on `main`; planned patched release: `2026.2.21` (`>=2026.2.21`)DetailsThe vulnerable implementation had multiple auth branches, including a passwordless fallback with loopback/proxy heuristics.The fix now uses one authentication codepath:inbound webhook token/guid must match `channels.bluebubbles.password`webhook target matching is consolidated to shared plugin-sdk logicBlueBubbles config validation now requires `password` when `serverUrl` is setImpactBlueBubbles is an optional beta iMessage plugin, and onboarding/channel-add flows already require a password. Practical exposure is mainly custom/manual configurations that omitted webhook password authentication.RemediationUpgrade to a release that includes this patch (`>=2026.2.21`, planned).Ensure BlueBubbles webhook delivery includes a matching password (`?password=<password>` or `x-password`).Fix Commit(s)`6b2f2811dc623e5faaf2f76afaa9279637174590``283029bdea23164ab7482b320cb420d1b90df806`Release Process Note`patched_versions` is pre-set to the planned next release (`2026.2.21`) so once npm release is out, advisory publish can proceed without additional ticket edits.OpenClaw thanks @zpbrent for reporting.
CVSS v4.0: 6.3
CVSS v3.1: 4.8
CVE-2025-2584: WebAssembly wabt binary-reader-interp.cc GetReturnCallDropKeepCount heap-based overflow
A vulnerability was found in WebAssembly wabt 1.0.36. It has been declared as critical. This vulnerability affects the function BinaryReaderInterp::GetReturnCallDropKeepCount of the file wabt/src/interp/binary-reader-interp.cc. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 2.3
CVSS v3.1: 5
CVSS v3.0: 5
CVSS v2.0: 5.1
CVE-2016-10611: strider-sauce is Sauce Labs / Selenium support for Strider. strider-sauce downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested zip file with an attacker controlled zip file if the attacker is on the network or positioned in between the user and the remote server.
CVSS v3.0: 8.1
CVSS v2.0: 9.3
GHSA-fh2x-v9fw-7v49: ** DISPUTED ** libxml2 2.9.4, when used in recover mode, allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted XML document.  NOTE: The maintainer states "I would disagree of a CVE with the Recover parsing option which should only be used for manual recovery at least for XML parser."
CVSS v3.0: 4.7
GHSA-fj3w-jwp8-x2g3: fast-xml-parser has stack overflow in XMLBuilder with preserveOrder
ImpactApplication crashes with stack overflow when user use XML builder with `prserveOrder:true` for following or similar inputCause: `arrToStr` was not validating if the input is an array or a string and treating all non-array values as text content.
_What kind of vulnerability is it? Who is impacted?_PatchesYes in 5.3.8WorkaroundsUse XML builder with `preserveOrder:false` or check the input data before passing to builder.References[_Are there any links users can visit to find out more?_](https://github.com/NaturalIntelligence/fast-xml-parser/pull/791)
CVSS v4.0: 2.7
CVE-2007-0189: PHP remote file inclusion vulnerability in index.php in GeoBB Georgian Bulletin Board allows remote attackers to execute arbitrary PHP code via a URL in the action parameter.  NOTE: CVE disputes this issue, since GeoBB 1.0 sets $action to a whitelisted value
CVSS v2.0: 7.5
CVE-2024-21257: Vulnerability in the Oracle Hyperion BI+ product of Oracle Hyperion (component: UI and Visualization).   The supported version that is affected is 11.2.18.0.000. Easily exploitable vulnerability allows low privileged attacker with access to the physical communication segment attached to the hardware where the Oracle Hyperion BI+ executes to compromise Oracle Hyperion BI+.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Hyperion BI+ accessible data. CVSS 3.1 Base Score 3.0 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N).
CVSS v3.1: 3
GHSA-xgm3-gj32-7f57: WonderCMS 4.3.2 contains a cross-site scripting vulnerability that allows attackers to inject malicious JavaScript through the module installation endpoint. Attackers can craft a specially designed XSS payload to install a reverse shell module and execute remote commands by tricking an authenticated administrator into accessing a malicious link.
CVSS v4.0: 8.6
CVSS v3.1: 8.8
GHSA-wj68-rrf7-99f9: ASP Portal 3.2.5 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request to ASPPortal.mdb.
CVE-2025-9946: LockerPress – WordPress Security Plugin <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
The LockerPress – WordPress Security Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS v3.1: 6.1
GHSA-gj8c-fhmc-cqpg: An issue has been discovered in GitLab CE/EE affecting all versions starting with 13.11, 13.12 and 14.0. A specially crafted design image allowed attackers to read arbitrary files on the server.
CVSS v3.1: 6.5