ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2026-25400: WordPress Apicona theme <= 24.1.0 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in thememount Apicona apicona allows Object Injection.This issue affects Apicona: from n/a through <= 24.1.0.
CVSS v3.1: 8.8
GHSA-6hxq-g3f7-5m89: In the Linux kernel, the following vulnerability has been resolved:smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe()When ksmbd_iov_pin_rsp() fails, we should call ksmbd_session_rpc_close().
CVSS v3.1: 7.8
GHSA-3c9r-8wrp-84w3: In build_read_multi_rsp of gatt_sr.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1: 8.8
CVE-2024-52525: Nextcloud Server User password is available in memory of the PHP process
Nextcloud Server is a self hosted personal cloud system. Under certain conditions the password of a user was stored unencrypted in the session data. The session data is encrypted before being saved in the session storage (Redis or disk), but it would allow a malicious process that gains access to the memory of the PHP process, to get access to the cleartext password of the user. It is recommended that the Nextcloud Server is upgraded to 28.0.12, 29.0.9 or 30.0.2.
CVSS v3.1: 1.8
GHSA-fj89-88c3-v65v: The memory resource controller (aka memcg) in the Linux kernel allows local users to cause a denial of service (deadlock) by spawning new processes within a memory-constrained cgroup.
CVSS v3.0: 5.5
CVE-2023-45735: Westermo Lynx Code Injection





A potential attacker with access to the Westermo Lynx device may be able to execute malicious code that could affect the correct functioning of the device.






CVSS v3.1: 8
GHSA-xmm6-6gqm-6vjq: A code execution vulnerability exists in the XiaomiGetApps application product. This vulnerability is caused by the verification logic being bypassed, and an attacker can exploit this vulnerability to execute malicious code.
CVSS v3.1: 8.8
CVE-2020-12405: When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a potentially exploitable crash. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9.
CVSS v3.1: 5.3
CVSS v2.0: 2.6
CVE-2026-47190: IPAM controller service account granted unnecessary full access to Secrets
IPAM is the IP address Manager for Cluster API Provider Metal3. Prior to versions 1.11.7, 1.12.4, and 1.13.0, the IPAM controller's ClusterRole granted full CRUD permissions (create, delete, get, list, patch, update, watch) on core/v1 Secrets. The controller never accesses Secrets during normal operation. If the controller pod were compromised (e.g. via supply chain attack or container escape), an attacker could leverage these excessive permissions to read, modify, or delete Secrets in the namespace, potentially exposing credentials and other sensitive data. This issue has been patched in versions 1.11.7, 1.12.4, and 1.13.0.
CVSS v3.1: 4.4
GHSA-59g8-6h58-f454: A vulnerability classified as problematic has been found in GZ Script Car Rental Script 1.8. Affected is an unknown function of the file /EventBookingCalendar/load.php?controller=GzFront/action=checkout/cid=1/layout=calendar/show_header=T/local=3. The manipulation of the argument first_name/second_name/phone/address_1/country leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-234432. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v3.0: 3.5
GHSA-f926-gc7c-947h: The Invelity Product Feeds plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in all versions up to, and including, 1.2.6. This is due to missing validation and sanitization in the 'createManageFeedPage' function. This makes it possible for authenticated administrator-level attackers to delete arbitrary files on the server via specially crafted requests that include path traversal sequences, granted they can trick an admin into clicking a malicious link.
CVSS v3.1: 8.1
CVE-2023-48880: A stored cross-site scripting (XSS) vulnerability in EyouCMS v1.6.4-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Menu Name field at /login.php?m=admin&c=Index&a=changeTableVal&_ajax=1&lang=cn.
CVSS v3.1: 4.8
RHSA-2022:8649: Red Hat Security Advisory: varnish:6 security update
varnish: Request Forgery Vulnerability
CVSS v3.1: 7.5
GHSA-hpjf-r337-qhp7: Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in NCP-HG100 1.4.48.16 and earlier. If exploited, a remote attacker who has obtained the authentication information to log in to the management page of the product may execute an arbitrary OS command with root privileges.
CVSS v4.0: 8.6
CVSS v3.0: 7.2
CVE-2001-0928: Buffer overflow in the permitted function of GNOME gtop daemon (libgtop_daemon) in libgtop 1.0.13 and earlier may allow remote attackers to execute arbitrary code via long authentication data.
CVSS v2.0: 7.5
GHSA-94vh-gphv-8pm8: zip Incorrectly Canonicalizes Paths during Archive Extraction Leading to Arbitrary File Write
SummaryIn the archive extraction routine of affected versions of the `zip` crate, symbolic links earlier in the archive are allowed to be used for later files in the archive without validation of the final canonicalized path, allowing maliciously crafted archives to overwrite arbitrary files in the file system when extracted.DetailsThis is a variant of the [zip-slip](https://github.com/snyk/zip-slip-vulnerability) vulnerability, we can make the extraction logic step outside of the target directory by creating a symlink to the parent directory and then extracting further files through that symlink.The documentation of the [`::zip::read::ZipArchive::extract`] method is in my opinion implying this should not happen:"Paths are sanitized with ZipFile::enclosed_name." ...
[`::zip::read::FileOptions::enclosed_name`] ... is resistant to path-based exploits ... can’t resolve to a path outside the current directory.Most archive software either decline to extract symlinks that traverse out of the directory or defer creation of symlinks after all files have been created to prevent unexpected behavior when later entries depend on earlier symbolic link entries.PoChttps://gist.github.com/eternal-flame-AD/bf71ef4f6828e741eb12ce7fd47b7b85ImpactUsers who extract untrusted archive files using the following high-level API method may be affected and critical files on the system may be overwritten with arbitrary file permissions, which can potentially lead to code execution.zip::unstable::stream::ZipStreamReader::extractzip::read::ZipArchive::extract
CVSS v4.0: 7.3
GHSA-2xp5-vm5f-w77m: A stored cross-site scripting (XSS) vulnerability exists in the 'Upload Knowledge' feature of stangirard/quivr, affecting the latest version. Users can upload files via URL, which allows the insertion of malicious JavaScript payloads. These payloads are stored on the server and executed whenever any user clicks on a link containing the payload, leading to potential data theft, session hijacking, and reputation damage.
CVSS v3.0: 6.8
CVE-2025-51488: A Stored Cross-Site Scripting (XSS) vulnerability exists in MoonShine version < 3.12.4, allowing remote attackers to store and execute arbitrary JavaScript by including a malicious HTML payload in the Name parameter when creating a new Admin.
CVSS v3.1: 4.9
CVE-2025-1299: Missing Authorization in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 18.0.5, all versions starting from 18.1 before 18.1.3, all versions starting from 18.2 before 18.2.1 that, under circumstances, could have allowed an unauthorized user to read deployment job logs by sending a crafted request.
CVSS v3.1: 4.3
GHSA-rp4p-25j3-mhw4: It was observed that while login into Business-central console, HTTP request discloses sensitive information like username and password when intercepted using some tool like burp suite etc.
CVSS v3.1: 7.5
CVE-2025-24351: A vulnerability in the “Remote Logging” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to execute arbitrary OS commands in the context of user “root” via a crafted HTTP request.
CVSS v3.1: 8.8
GHSA-4rcc-r44q-jpcm: Multiple absolute path traversal vulnerabilities in documentconverter in Open-Xchange (OX) AppSuite before 7.4.2-rev10 and 7.6.x before 7.6.0-rev10 allow remote attackers to read application files via a full pathname in a crafted (1) OLE Object or (2) image in an OpenDocument text file.
GHSA-m2c7-382p-h66r: Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker with administrative credentials to conduct a cross-site scripting (XSS) attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input that is processed by the web-based management interface. An attacker could exploit these vulnerabilities by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information. To exploit these vulnerabilities, an attacker would need valid administrative credentials.
GHSA-vm86-vfwq-9qvc: SOPlanning is vulnerable to Predictable Generation of Password Recovery Token. Due to weak mechanism of generating recovery tokens, a malicious attacker is able to brute-force all possible values and takeover any account in reasonable amount of time.This issue was fixed in version 1.55.
CVSS v4.0: 8.7
CVSS v3.1: 7.5
GHSA-x6j2-9h84-jgxx: Cisco IOS XR 6.1.1 allows local users to execute arbitrary OS commands as root by leveraging admin privileges, aka Bug ID CSCva38349.
CVSS v3.0: 7.8
GHSA-88g6-23mm-rpg4: Inappropriate implementation in Headless in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVSS v3.1: 9.6
GHSA-r4m8-492c-frc5: An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.We have already fixed the vulnerability in the following versions:
QTS 5.1.4.2596 build 20231128 and later
QuTS hero h5.1.4.2596 build 20231128 and later
QuTScloud c5.1.5.2651 and later
CVSS v3.1: 5.5
GHSA-pqm8-v9ww-9q73: Hongdian H8922 3.0.5 devices have an undocumented feature that allows access to a shell as a superuser. To connect, the telnet service is used on port 5188 with the default credentials of root:superzxmn.
CVSS v3.1: 9.8
GHSA-vxx5-p9c9-297v: Insecure permissions in Entrust Datacard XPS Card Printer Driver 8.4 and earlier allows unauthenticated attackers to execute arbitrary code as SYSTEM via a crafted DLL payload.
CVSS v3.1: 8.4
GHSA-vg76-hv4j-w3h2: The ISO ES-IS parser in tcpdump before 4.9.2 has a buffer over-read in print-isoclns.c:esis_print().
CVSS v3.0: 9.8
GHSA-cprp-j4pp-r824: Memory leak in the virtio_gpu_resource_create_2d function in hw/display/virtio-gpu.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) via a large number of VIRTIO_GPU_CMD_RESOURCE_CREATE_2D commands.
CVSS v3.1: 6
GHSA-mhv3-v49w-phxv: In the Linux kernel, the following vulnerability has been resolved:accel/amdxdna: Validate command buffer payload countThe count field in the command header is used to determine the valid
payload size. Verify that the valid payload does not exceed the remaining
buffer space.
CVSS v3.1: 5.5
GHSA-jmpp-r595-xrp4: GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0 was discovered to contain a SQL injection vulnerability in the scost parameter in /grocery/search_products.php. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement.
CVSS v3.1: 7.7
CVE-2022-36171: MapGIS IGServer 10.5.6.11 is vulnerable to Arbitrary file deletion.
CVSS v3.1: 8.1
CVE-2015-0142: IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 before FP1 allows remote authenticated users to cause a denial of service (maintenance-mode transition and data-storage outage) by calling the System Administration Mode function.
CVSS v2.0: 4
GHSA-jphw-vq37-q7ww: In the Linux kernel, the following vulnerability has been resolved:APEI/GHES: ensure that won't go past CPER allocated recordThe logic at ghes_new() prevents allocating too large records, by
checking if they're bigger than GHES_ESTATUS_MAX_SIZE (currently, 64KB).
Yet, the allocation is done with the actual number of pages from the
CPER bios table location, which can be smaller.Yet, a bad firmware could send data with a different size, which might
be bigger than the allocated memory, causing an OOPS:Prevent that by taking the actual allocated are into account when
checking for CPER length.[ rjw: Subject tweaks ]
CVSS v3.1: 5.5
GHSA-w855-c23r-66cr: MailEnable versions prior to 10.54 contain a reflected cross-site scripting (XSS) vulnerability in the FieldTo parameter of /Mondo/lang/sys/Forms/AddressBook.aspx. The FieldTo value is not properly sanitized when processed via a GET request and is reflected inside a <script> block in the JavaScript variable var fieldTo. By supplying a crafted payload that terminates the existing Finish() function, inserts attacker-controlled script, and comments out remaining code, a remote attacker can execute arbitrary JavaScript in a victim’s browser when the victim attempts to send an email. Successful exploitation can redirect victims to malicious sites, steal non-HttpOnly cookies, inject arbitrary HTML or CSS, and perform actions as the authenticated user.
CVSS v4.0: 5.3
CVSS v3.1: 6.1
CVE-2024-35368: FFmpeg n7.0 is affected by a Double Free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c.
CVSS v3.1: 9.8
GHSA-fx5p-f64h-93xc: Opened exploitable ports in default docker-compose.yaml in go-ipfs
ImpactAllows admin API access to the IPFS node.Who ?This affects people running the  [docker-compose.yaml](https://github.com/ipfs/go-ipfs/blob/master/docker-compose.yaml) service in an environment where the docker host is directly attached to a public or untrusted IP.  In the vulnerable version, the private API endpoint is publicly forwarded by exposing it as `0.0.0.0:5001` on the host machine.If the host machine is hidden behind a firewall or NAT (and the LAN is trusted for NAT), this is not an immediate issue because of the protection from the firewall or NAT.  That said, we still recommend users update to follow security best practices of not putting unnecessary dependency on a working firewall.PatchesThis issue is in [docker-compose.yaml](https://github.com/ipfs/go-ipfs/blob/master/docker-compose.yaml).  Users need to replace their current `docker-compose.yaml` file with a version `0.12.1` or later.There is no need to update any of the binaries. Users running previous versions like `0.12.0` or earlier can download the `0.12.1` `docker-compose.yaml` file.  You can replace a vulnerable `docker-compose.yaml` file with a the new one with:How to test if you are vulnerableBinding check on the hostOn the host machine, while IPFS is running, run as root:The output will be a list of listeners bound to `:5001`.
You then need to check that those listeners are private and preferably even localhost IPs.
⚠️ If this listener is on `0.0.0.0` or a public IP you are very likely vulnerable.Remote hailingWhile IPFS is running, you can try to contact the API from a remote machine. (Replace `1.2.3.4` with your node public IP.  Or if you want to test in an untrusted NAT, then substitute the LAN IP instead.)⚠️ If you see any json outputted (e.g.,  `{"Commit": "<string>","Golang": "<string>","Repo": "<string>","System": "<string>","Version": "<string>"}`), then you are vulnerable.If it **fails**, then you are safe.For more informationIf you have any questions or comments about this advisory:Please first read https://docs.ipfs.io/reference/http/api/ about best practicesAsk in [IPFS Discord #ipfs-chatter](https://discord.gg/ipfs)Open an issue in [go-ipfs](https://github.com/ipfs/go-ipfs)
CVE-2015-9145: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 617, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, SD 850, and SDX20, lack of input validation in NPA driver functions leads to null pointer dereference.
CVSS v3.0: 9.8
CVSS v2.0: 10
GHSA-8p3f-99h8-4v6p: Uncontrolled search path element for some Intel(R) Network Adapter Driver installers for Windows 11 before version 29.4 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS v4.0: 5.4
CVSS v3.1: 6.7
GHSA-h97c-qp24-439v: Insecure State Generation in laravel/socialite
laravel/socialite versions prior to 2.0.9 are found to have an insecure state generation mechanism, potentially exposing the OAuth authentication process to security risks. The issue has been addressed in version 2.0.9 by ensuring that the state is generated using a truly random approach, enhancing the security of the OAuth flow.
GHSA-vm64-rwh3-4fc9: The Kadence WooCommerce Email Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer name in all versions up to, and including, 1.5.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 7.2
GHSA-2wj4-9c89-gmgp: SQL injection vulnerability in index.php in Danneo CMS 0.5.1 and earlier, when the Referers statistics option is enabled, allows remote attackers to execute arbitrary SQL commands via the HTTP Referer header.
GHSA-8vmj-6582-mgcq: A potential attacker can execute an arbitrary code at the time of the PEI phase and influence the subsequent boot stages. This can lead to the mitigations bypassing, physical memory contents disclosure, discovery of any secrets from any Virtual Machines (VMs) and bypassing memory isolation and confidential computing boundaries. Additionally, an attacker can build a payload which can be injected into the SMRAM memory. This issue affects: Module name: PlatformInitAdvancedPreMem SHA256: 644044fdb8daea30a7820e0f5f88dbf5cd460af72fbf70418e9d2e47efed8d9b Module GUID: EEEE611D-F78F-4FB9-B868-55907F169280 This issue affects: AMI Aptio 5.x.
CVSS v3.1: 8.2
CVE-2023-45769: WordPress WP Report Post Plugin <= 2.1.2 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Alex Raven WP Report Post plugin <= 2.1.2 versions.
CVSS v3.1: 7.1
GHSA-c96h-hhgw-4533: In the Linux kernel, the following vulnerability has been resolved:gpio: graniterapids: Fix vGPIO driver crashMove setting irq_chip.name from probe() function to the initialization
of "irq_chip" struct in order to fix vGPIO driver crash during bootup.Crash was caused by unauthorized modification of irq_chip.name field
where irq_chip struct was initialized as const.This behavior is a consequence of suboptimal implementation of
gpio_irq_chip_set_chip(), which should be changed to avoid
casting away const qualifier.Crash log:
BUG: unable to handle page fault for address: ffffffffc0ba81c0
/#PF: supervisor write access in kernel mode
/#PF: error_code(0x0003) - permissions violation
CPU: 33 UID: 0 PID: 1075 Comm: systemd-udevd Not tainted 6.12.0-rc6-00077-g2e1b3cc9d7f7 #1
Hardware name: Intel Corporation Kaseyville RP/Kaseyville RP, BIOS KVLDCRB1.PGS.0026.D73.2410081258 10/08/2024
RIP: 0010:gnr_gpio_probe+0x171/0x220 [gpio_graniterapids]
CVSS v3.1: 5.5
GHSA-5vpw-rqv4-gcp5: The saveFile method in MediaController.java in the Telegram Messenger application before 2017-12-08 for Android allows directory traversal via a pathname obtained in a file-transfer request from a remote peer, as demonstrated by writing to tgnet.dat or tgnet.dat.bak.
CVSS v3.0: 8.8
GHSA-w5p3-xgv8-w45f: Cross-site scripting vulnerability in Bulletin of Cybozu Garoon 4.6.0 to 5.0.2 allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors.
GHSA-p7xr-742m-rrg9: A weakness has been identified in code-projects Simple Grading System 1.0. Affected by this vulnerability is an unknown functionality of the file /edit_student.php of the component Admin Panel. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited.
CVSS v4.0: 2.1
CVSS v3.1: 6.3
GHSA-26w2-2f8h-v6xj: Premium Antispam in Symantec Mail Security for Domino Server 5.1.x before 5.1.2.28 does not filter certain SMTP address formats, which allows remote attackers to use the product as a spam relay.
CVE-2024-52390: WordPress CYAN Backup plugin <= 2.5.3 - Arbitrary File Download vulnerability
Path Traversal: '.../...//' vulnerability in Greg Ross CYAN Backup cyan-backup allows Path Traversal.This issue affects CYAN Backup: from n/a through <= 2.5.3.
CVSS v3.1: 4.9
RHSA-2023:5480: Red Hat Security Advisory: Release of OpenShift Serverless Logic 1.30.0 SP1 security update
quarkus: HTTP security policy bypass
CVSS v3.1: 8.1
CVE-2009-3095: The mod_proxy_ftp module in the Apache HTTP Server allows remote attackers to bypass intended access restrictions and send arbitrary commands to an FTP server via vectors related to the embedding of these commands in the Authorization HTTP header, as demonstrated by a certain module in VulnDisco Pack Professional 8.11.
CVSS v2.0: 5
RHSA-2026:1537: Red Hat Security Advisory: python security update
cpython: python: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of service
CVSS v3.1: 7.5
GHSA-2337-r63v-x38x: An information disclosure vulnerability in the Qualcomm audio driver. Product: Android. Versions: Android Kernel. Android ID: A-35764875. References: QC-CR#2029798.
CVSS v3.0: 5.3
GHSA-6j47-h927-wmwr: ** DISPUTED **  The ipv6_getsockopt_sticky function in the kernel in Red Hat Enterprise Linux (RHEL) Beta 5.1.0 allows local users to obtain sensitive information (kernel memory contents) via a negative value of the len parameter.  NOTE: this issue has been disputed in a bug comment, stating that "len is ignored when copying header info to the user's buffer."
GHSA-4wx7-2657-7ph3: Information Disclosure in Operator Client application in BVMS 10.1.1, 11.0 and 11.1.0 and VIDEOJET Decoder VJD-7513 versions 10.23 and 10.30 allows man-in-the-middle attacker to compromise confidential video stream. This is only applicable for UDP encryption when target system contains cameras with platform CPP13 or CPP14 and firmware version 8.x.
CVSS v3.1: 5.9
GHSA-6whg-2qc2-5q4g: Stack-based buffer overflow in the HMIWeb Browser HSCDSPRenderDLL ActiveX control in Honeywell Process Solutions (HPS) Experion R2xx, R30x, R31x, and R400.x; Honeywell Building Solutions (HBS) Enterprise Building Manager R400 and R410.1; and Honeywell Environmental Combustion and Controls (ECC) SymmetrE R410.1 allows remote attackers to execute arbitrary code via unspecified vectors.
GHSA-82rc-cc5p-ff4m: zhimengzhe iBarn v1.5 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the $search parameter at /own.php.
CVSS v3.1: 6.1
GHSA-43x5-8m6r-mx5q: A use-after-free vulnerability can occur when the SMIL animation controller incorrectly registers with the refresh driver twice when only a single registration is expected. When a registration is later freed with the removal of the animation controller element, the refresh driver incorrectly leaves a dangling pointer to the driver's observer array. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66.
CVSS v3.0: 9.8