ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-6p5r-8gvj-7h94: Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Supported versions that are affected are 11.1.1.8.0, 12.2.1.0.0, 12.2.1.1.0 and 12.2.1.2.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle WebCenter Sites accessible data. CVSS 3.0 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N).
CVSS v3.0: 3.1
GHSA-v36w-f92j-7386: A vulnerability was detected in code-projects Vehicle Showroom Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /util/MonthTotalReportUpdateFunction.php. Performing a manipulation of the argument BRANCH_ID results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used.
CVSS v4.0: 5.5
CVSS v3.1: 7.3
GHSA-24m9-4jgr-2wjp: Unspecified vulnerability in the Siebel CRM component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Security.
GHSA-rf7r-626j-cq6w: IrfanView 4.50 - 64bit with BabaCAD4Image plugin version 1.3 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file, related to a "User Mode Write AV starting at BabaCAD4Image!ShowPlugInOptions+0x000000000001ecaa."
CVSS v3.0: 7.8
CVE-2022-22337: IBM Sterling B2B Integrator Standard Edition information disclosure
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 could disclose sensitive information to an authenticated user.  IBM X-Force ID:  219507.
CVSS v3.1: 4.3
CVE-2011-1278: Microsoft Excel 2002 SP3 and Office 2004 for Mac do not properly validate record information during parsing of Excel spreadsheets, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted spreadsheet, aka "Excel WriteAV Vulnerability."
CVSS v2.0: 9.3
CVE-2022-3970: LibTIFF tif_getimage.c TIFFReadRGBATileExt integer overflow
A vulnerability was found in LibTIFF. It has been classified as critical. This affects the function TIFFReadRGBATileExt of the file libtiff/tif_getimage.c. The manipulation leads to integer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 227500897dfb07fb7d27f7aa570050e62617e3be. It is recommended to apply a patch to fix this issue. The identifier VDB-213549 was assigned to this vulnerability.
CVSS v3.1: 6.3
CVE-2022-45472: CAE LearningSpace Enterprise (with Intuity License) image 267r patch 639 allows DOM XSS, related to ontouchmove and onpointerup.
CVSS v3.1: 5.4
GHSA-cpj2-grx5-hpg2: The var_export function in PHP 5.2 before 5.2.14 and 5.3 before 5.3.3 flushes the output buffer to the user when certain fatal errors occur, even if display_errors is off, which allows remote attackers to obtain sensitive information by causing the application to exceed limits for memory, execution time, or recursion.
GHSA-ppc6-q8hw-556j: A Permissions, Privileges, and Access Control vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware V1.6.2.0). The vulnerability allows unauthorized users to overwrite the original password with their password. If an attacker exploits this vulnerability and overwrite the password, the attacker can upload the original program from the PLC.
CVSS v3.1: 9.8
GHSA-rf88-px5j-vhj4: GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, XE3000/X3000 v4, and B2200/MV1000/MV1000W/USB150/N300/SF1200 v3.216 were discovered to contain a shell injection vulnerability via the interface check_config.
CVSS v3.1: 9.8
ICSA-18-172-02: Rockwell Automation Allen-Bradley CompactLogix and Compact GuardLogix (Update A)
This vulnerability may allow an attacker to intentionally send a specific TCP packet to the product and cause a Major Non-Recoverable Fault (MNRF), resulting in a denial-of-service condition.CVE-2017-9312 has been assigned to this vulnerability. A CVSS v3 base score of 8.6 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H).
CVSS v3.0: 8.6
RHSA-2024:0429: Red Hat Security Advisory: openssh security update
ssh: Prefix truncation attack on Binary Packet Protocol (BPP) openssh: potential command injection via shell metacharacters
CVSS v3.1: 6.5
CVE-2020-4839: IBM Host firmware for LC-class Systems is vulnerable to a stack based buffer overflow, caused by improper bounds checking. A remote privileged attacker could exploit this vulnerability and cause a denial of service. IBM X-Force ID: 190037.
CVSS v3.0: 4.9
CVE-2017-6229: Ruckus Networks Unleashed AP firmware releases before 200.6.10.1.x and Ruckus Networks Zone Director firmware releases 10.1.0.0.x, 9.10.2.0.x, 9.12.3.0.x, 9.13.3.0.x, 10.0.1.0.x or before contain authenticated Root Command Injection in the CLI that could allow authenticated valid users to execute privileged commands on the respective systems.
CVSS v3.0: 8.8
CVSS v2.0: 9
CVE-2024-52014: Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a stack overflow via the pptp_user_ip parameter at genie_pptp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS v3.1: 5.7
GHSA-8h84-fhqq-q58v: nebula-mesh: Decrypted CA private key persists in heap after signing
`internal/pki/resolver.go:36-64` constructs a `CAManager` with the plaintext `ed25519.PrivateKey` after unwrapping via the master key; `internal/pki/ca.go:13-16` stores it. Callers at `internal/api/enroll.go:116`, `internal/api/updates.go:297`, and `internal/api/mobile_bundle.go:40` use the manager for one `Sign()` and drop the reference on function return — but the underlying slice contents are not wiped before release.The keystore package's contract (`internal/keystore/keystore.go` doc: *"Callers MUST zeroise the returned plaintext DEK as soon as it is no longer needed"*) is not met by the `CAManager` consumer. Decrypted CA private keys persist in process heap until Go's GC scavenges the underlying slice — minutes to hours under load, indefinitely on idle servers.AffectedAll released versions up to v0.3.6.Threat modelMemory-read access: core dump, ptrace, kernel swap to disk, container/VM snapshot, OOM-debug bundle, side-channel via shared cache lines. Not a remote-network vulnerability, but defeats the master-key + envelope-encryption design's promise of "private key never lingers".Suggested fixAdd a `Wipe()` method on `CAManager`:At each call site (`enroll.go:116`, `updates.go:297`, `mobile_bundle.go:40`, and any new caller), `defer caMgr.Wipe()` immediately after the `Resolve()` call. Pattern mirrors the existing `defer keystore.Zeroize(dek)` discipline in the keystore package.Optional follow-up: wrap `m.Sign()` to zeroize after each call, removing the contract on callers — but the `defer` pattern is sufficient as a minimum.
CVE-2026-7666: Potential unencrypted email transmission via STARTTLS in the SMTP backend
An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15.
`django.core.mail.backends.smtp.EmailBackend` in Django fails to prevent reuse of a partially-initialized connection after a failed `STARTTLS` handshake when `fail_silently=True`, which allows on-path network attackers to read email content via cleartext interception.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Kasper Dupont for reporting this issue.
CVSS v4.0: 2.3
CVSS v3.1: 3.1
CVE-2016-1673: Blink, as used in Google Chrome before 51.0.2704.63, allows remote attackers to bypass the Same Origin Policy via unspecified vectors.
CVSS v3.0: 8.8
CVSS v2.0: 6.8
GHSA-7w8j-85wm-6xfq: Prototype Pollution in jquery-bbq
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-bbq 1.2.1 allows a malicious user to inject properties into Object.prototype.
CVSS v3.1: 8.8
GHSA-xjrx-58mf-555f: In the Linux kernel, the following vulnerability has been resolved:timers/migration: Fix off-by-one root mis-connectionBefore attaching a new root to the old root, the children counter of the
new root is checked to verify that only the upcoming CPU's top group have
been connected to it. However since the recently added commit b729cc1ec21a
("timers/migration: Fix another race between hotplug and idle entry/exit")
this check is not valid anymore because the old root is pre-accounted
as a child to the new root. Therefore after connecting the upcoming
CPU's top group to the new root, the children count to be expected must
be 2 and not 1 anymore.This omission results in the old root to not be connected to the new
root. Then eventually the system may run with more than one top level,
which defeats the purpose of a single idle migrator.Also the old root is pre-accounted but not connected upon the new root
creation. But it can be connected to the new root later on. Therefore
the old root may be accounted twice to the new root. The propagation of
such overcommit can end up creating a double final top-level root with a
groupmask incorrectly initialized. Although harmless given that the final
top level roots will never have a parent to walk up to, this oddity
opportunistically reported the core issue:WARNING: CPU: 8 PID: 0 at kernel/time/timer_migration.c:543 tmigr_requires_handle_remote
  CPU: 8 UID: 0 PID: 0 Comm: swapper/8
  RIP: 0010:tmigr_requires_handle_remote
  Call Trace:
   <IRQ>
   ? tmigr_requires_handle_remote
   ? hrtimer_run_queues
   update_process_times
   tick_periodic
   tick_handle_periodic
   __sysvec_apic_timer_interrupt
   sysvec_apic_timer_interrupt
  </IRQ>Fix the problem by taking the old root into account in the children count
of the new root so the connection is not omitted.Also warn when more than one top level group exists to better detect
similar issues in the future.
CVSS v3.1: 5.5
GHSA-h639-qx2x-fm8f: Improper Input Validation vulnerability in Wikimedia Foundation Mediawiki - FeaturedFeeds Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - FeaturedFeeds Extension: 1.39.X, 1.42.X, 1.43.X.
CVSS v3.1: 6.5
CVE-2022-41135: WordPress Modula plugin <= 2.6.9 - Unauth. Plugin Settings Change vulnerability
Unauth. Plugin Settings Change vulnerability in Modula plugin <= 2.6.9 on WordPress.
CVSS v3.1: 6.5
CVE-2020-2938: Vulnerability in the Oracle Financial Services Loan Loss Forecasting and Provisioning product of Oracle Financial Services Applications (component: User Interface). Supported versions that are affected are 8.0.6 - 8.0.8. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financial Services Loan Loss Forecasting and Provisioning. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Financial Services Loan Loss Forecasting and Provisioning accessible data as well as unauthorized read access to a subset of Oracle Financial Services Loan Loss Forecasting and Provisioning accessible data. CVSS 3.0 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).
CVSS v3.0: 7.1
CVE-2005-0749: The load_elf_library in the Linux kernel before 2.6.11.6 allows local users to cause a denial of service (kernel crash) via a crafted ELF library or executable, which causes a free of an invalid pointer.
CVSS v2.0: 7.2
CVE-2021-24970: All-In-One-Gallery < 2.5.0 - Admin+ Local File Inclusion
The All-in-One Video Gallery WordPress plugin before 2.5.0 does not sanitise and validate the tab parameter before using it in a require statement in the admin dashboard, leading to a Local File Inclusion issue
CVSS v3.1: 7.2
CVSS v2.0: 6.5
CVE-1999-0240: Some filters or firewalls allow fragmented SYN packets with IP reserved bits in violation of their implemented policy.
CVSS v2.0: 7.5
GHSA-fp95-6cmx-rg4m: The Perfit WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.1. This is due to missing authorization checks on the `logout` function called via the `actions` function hooked to `admin_init`. This makes it possible for unauthenticated attackers to delete arbitrary plugin settings via the `action` parameter.
CVSS v3.1: 5.3
GHSA-c56w-53m4-rfhw: The WIP WooCarousel Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wip_woocarousel_products_carousel' shortcode in all versions up to, and including, 1.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
CVE-2025-10663: PHPGurukul Online Course Registration my-profile.php sql injection
A vulnerability was found in PHPGurukul Online Course Registration 3.1. This affects an unknown function of the file /my-profile.php. Performing manipulation of the argument cgpa results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used.
CVSS v4.0: 6.9
CVSS v3.1: 7.3
CVSS v3.0: 7.3
CVSS v2.0: 7.5
CVE-2016-4853: AKABEi SOFT2 games allow remote attackers to execute arbitrary OS commands via crafted saved data, as demonstrated by Happy Wardrobe.
CVSS v3.0: 7.8
CVSS v2.0: 6.8
GHSA-v676-fw8h-j3j9: wikiplugin_includetpl in lib/wiki-plugins/wikiplugin_includetpl.php in Tiki before 28.3 mishandles input to an eval. The fixed versions are 21.12, 24.8, 27.2, and 28.3.
CVSS v3.1: 9.9
GHSA-qv5f-7w93-3mpg: SQL injection vulnerability in index.php in EZpack 4.2b2 allows remote attackers to execute arbitrary SQL commands via the qType parameter in a webboard prog action.
GHSA-2rm7-xxx8-35jh: MediaWiki Cross-site Scripting (XSS)
Wikimedia MediaWiki 1.30.0 through 1.32.1 has XSS. Loading user JavaScript from a non-existent account allows anyone to create the account, and perform XSS on users loading that script. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.
CVSS v3.0: 6.1
CVE-2007-0030: Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, 2004 for Mac, and v.X for Mac allows user-assisted remote attackers to execute arbitrary code via an Excel file with an out-of-range Column field in certain BIFF8 record types, which references arbitrary memory.
CVSS v2.0: 9.3
CVE-2016-10598: arrayfire-js is a module for ArrayFire for the Node.js platform. arrayfire-js downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
CVSS v3.0: 7.5
CVSS v2.0: 8.5
CVE-2011-2900: Stack-based buffer overflow in the (1) put_dir function in mongoose.c in Mongoose 3.0, (2) put_dir function in yasslEWS.c in yaSSL Embedded Web Server (yasslEWS) 0.2, and (3) _shttpd_put_dir function in io_dir.c in Simple HTTPD (shttpd) 1.42 allows remote attackers to execute arbitrary code via an HTTP PUT request, as exploited in the wild in 2011.
CVSS v2.0: 7.5
GHSA-f8cm-6447-x5h2: jsPDF has Local File Inclusion/Path Traversal vulnerability
ImpactUser control of the first argument of the loadFile method in the node.js build allows local file inclusion/path traversal.If given the possibility to pass unsanitized paths to the loadFile method, a user can retrieve file contents of arbitrary files in the local file system the node process is running in. The file contents are included verbatim in the generated PDFs.Other affected methods are: `addImage`, `html`, `addFont`.Only the node.js builds of the library are affected, namely the `dist/jspdf.node.js` and `dist/jspdf.node.min.js` files.Example attack vector:PatchesThe vulnerability has been fixed in jsPDF@4.0.0. This version restricts file system access per default. This semver-major update does not introduce other breaking changes.WorkaroundsWith recent node versions, jsPDF recommends using the `--permission` flag in production. The feature was introduced experimentally in v20.0.0 and is stable since v22.13.0/v23.5.0/v24.0.0. See the [node documentation](https://nodejs.org/api/permissions.html) for details.For older node versions, sanitize user-provided paths before passing them to jsPDF.CreditsResearcher: kilkat (Kwangwoon Kim)
CVSS v4.0: 9.2
CVE-2026-40890: github.com/gomarkdown/markdown: Out-of-bounds Read in SmartypantsRenderer
The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdown text and rendering as HTML. Processing a malformed input containing a < character that is not followed by a > character anywhere in the remaining text with a SmartypantsRenderer will lead to Out of Bounds read or a panic. This vulnerability is fixed with commit 759bbc3e32073c3bc4e25969c132fc520eda2778.
CVSS v3.1: 7.5
CVE-2020-17522: When ORT (now via atstccfg) generates ip_allow.config files in Apache Traffic Control 3.0.0 to 3.1.0 and 4.0.0 to 4.1.0, those files include permissions that allow bad actors to push arbitrary content into and remove arbitrary content from CDN cache servers. Additionally, these permissions are potentially extended to IP addresses outside the desired range, resulting in them being granted to clients possibly outside the CDN arcitechture.
CVSS v3.1: 5.8
CVSS v2.0: 5
GHSA-qh9c-3rpf-fpp5: Directory traversal vulnerability in FastStone 4in1 Browser 1.2 allows remote attackers to read arbitrary files via a (1) ... (triple dot) or (2) ..\ (dot dot backslash) in the URL.
CVE-2016-4768: WebKit in Apple iOS before 10, tvOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4759, CVE-2016-4765, CVE-2016-4766, and CVE-2016-4767.
CVSS v3.0: 8.8
CVSS v2.0: 6.8
GHSA-9jq2-jvwc-p52f: Contao core SQL Injection Vulnerability
Contao core prior to 2.11.4 has a SQL injection vulnerability in `contao-2.11.3\system\modules\backend\Ajax.php`
CVSS v3.1: 8.8
GHSA-h4gh-22qq-72r7: py7zr: O(n^2) algorithmic complexity DoS in PackInfo._read()
SummaryPackInfo._read() uses an O(n^2) cumulative sum pattern where
  numstreams is read directly from the archive header. A crafted .7z
  archive with a large numstreams value causes excessive CPU consumption
   during SevenZipFile.__init__() — no extraction is needed. A 50 KB
  archive takes ~7 seconds of CPU time.DetailsThe vulnerable code is in PackInfo._read() (archiveinfo.py):self.packpositions = [sum(self.packsizes[:i]) for i in
  range(self.numstreams + 1)]numstreams is parsed from the archive header via read_uint64() and is
  attacker-controlled. Each sum(self.packsizes[:i]) re-sums from the
  beginning, producing O(n^2) total work. This runs during header
  parsing in SevenZipFile.__init__(), before any extraction.Suggested fix — replace with O(n) cumulative sum:from itertools import accumulate
  self.packpositions = [0] + list(accumulate(self.packsizes))PoCTested on py7zr 1.1.0, Python 3.12.3, Linux x86_64.Results:n=  1000  size=    1042 bytes  time=0.004s
  n=  5000  size=    5042 bytes  time=0.071s
  n= 10000  size=   10042 bytes  time=0.291s
  n= 30000  size=   30043 bytes  time=2.609s
  n= 50000  size=   50043 bytes  time=7.097sImpactDenial of Service. Any application that opens .7z archives from
  untrusted sources using py7zr.SevenZipFile() can be caused to consume
  excessive CPU time with a small crafted archive. The quadratic cost
  occurs during header parsing, before any content extraction.
CVSS v4.0: 6.9
CVE-2023-40756: User enumeration is found in PHPJabbers Callback Widget v1.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
CVSS v3.1: 9.8
GHSA-qpfv-2pqx-cqjq: A vulnerability was found in code-projects Online Bus Reservation Site 1.0. It has been rated as critical. This issue affects some unknown processing of the file register.php. The manipulation of the argument Email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-273203.
CVSS v4.0: 6.9
CVSS v3.1: 7.3
GHSA-crp8-6v6m-qvrp: In FFmpeg 3.3.3, a DoS in cine_read_header() due to lack of an EOF check might cause huge CPU and memory consumption. When a crafted CINE file, which claims a large "duration" field in the header but does not contain sufficient backing data, is provided, the image-offset parsing loop would consume huge CPU and memory resources, since there is no EOF check inside the loop.
CVSS v3.0: 6.5
GHSA-48mh-j4p5-7j9v: Parse Server missing audience validation in Keycloak authentication adapter
ImpactThe Keycloak authentication adapter does not validate the `azp` (authorized party) claim of Keycloak access tokens against the configured `client-id`. A valid access token issued by the same Keycloak realm for a *different* client application can be used to authenticate as any user on the Parse Server that uses the Keycloak adapter. This enables cross-application account takeover in multi-client Keycloak realms.All Parse Server deployments that use the Keycloak authentication adapter with a Keycloak realm that has multiple client applications are affected.PatchesThe fix replaces the userinfo HTTP call with local JWT verification and enforces `azp` claim validation against the configured `client-id`.WorkaroundsNone.ReferencesGitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-48mh-j4p5-7j9vFix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.5Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.18
CVSS v4.0: 7.6
RHSA-2018:2364: Red Hat Security Advisory: qemu-kvm-rhev security update
hw: cpu: speculative store bypass
CVSS v3.0: 5.6
GHSA-7xrv-jv66-7q59: IOBit Advanced System Care (Asc.exe) 15 and Action Download Center both download components of IOBit suite into ProgramData folder, ProgramData folder has "rwx" permissions for unprivileged users. Low privilege users can use SetOpLock to wait for CreateProcess and switch the genuine component with a malicious executable thus gaining code execution as a high privilege user (Low Privilege -> high integrity ADMIN).
CVSS v3.1: 7.8
CVE-2025-30320: InDesign Desktop | NULL Pointer Dereference (CWE-476)
InDesign Desktop versions ID19.5.2, ID20.2 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to crash the application, causing disruption in service. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 5.5