ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-4w7r-3222-8h6v: Tillitis TKey Client has an Error in Protocol Implementation
ImpactSome specific (1 out of 256) User Supplied Secrets (USS) were not used,
making the resulting Compound Device Identifier (CDI) the same as if no
USS was provided.Affected client applications: all client apps using the
[tkeyclient](https://github.com/tillitis/tkeyclient) Go module.PatchesUpgrade to v1.3.0.**NOTE WELL**: For the affected end users upgrading an app containing
`tkeyclient` to v1.3.0 means their key material will change. An end
user can get their old keys by not entering any USS. Please make sure
to communicate this to end users.Affected usersThe steps required to assess whether your USS is vulnerable may vary
depending on the client application. The example below shows how to
perform the check using `tkey-ssh-agent` and the known vulnerable USS
`adl`.Insert the TKey into the clientRun `tkey-ssh-agent -p --uss`When prompted for a User Supplied Secret, enter `adl`Note the public key and call it `pubkey-with-uss`Remove the TKey from the clientInsert the TKey into the client againRun `tkey-ssh-agent -p`Note the public key and call it `pubkey-without-uss`Expected behavior:
`pubkey-with-uss` and `pubkey-without-uss` should not be equal.Observed behavior:
`pubkey-with-uss` and `pubkey-without-uss` are equal.WorkaroundWe recommend everyone using `tkeyclient` to update to v1.3.0 and
release new versions of the client apps using it.However, end users that are unable to upgrade to a new version of a client
app, the recommendation is to change to an unaffected USS. Include
specific instructions for your client app.DetailsWhen loading the device app an optional 32 bytes USS digest is also
sent. The intention is to ask the end user to enter a USS of arbitrary
length, hash it, and then send a 32 bytes digest to TKey.However, there was a bug when sending the digest from the client. The
index in the outgoing buffer is wrong and overwrites the boolean
defining if the USS is used or not.This means that if the USS digest begins with a 0, the rest of the
digest is not used at all. If it begins with something else, setting
the boolean to true, the USS is used.The exported `LoadApp()` function calls an internal helper function
`loadApp()` which contains this code:A side effect of this behavior is that only 31 bytes of the USS are
used. This is not considered a security issue, but an option has been
added to enforce use of the full USS. See the release notes for
details. To avoid forcing all users to roll their keys, this option is
disabled by default and must be explicitly enabled.The fixThe fix focuses on solving the vulnerability only by: 1) use correct
index, 2) always use the last 31 bytes of the USS:This change means the key material of affected end users will change
compared to earlier versions of `tkeyclient`. They have the choice of:Not using a USS and keep their keys.Keep using their USS and use new generated keys.Use another USS and thus new keys.
CVSS v4.0: 4.7
CVE-2016-5042: The dwarf_get_aranges_list function in libdwarf before 20160923 allows remote attackers to cause a denial of service (infinite loop and crash) via a crafted DWARF section.
CVSS v3.1: 7.5
CVSS v2.0: 5
GHSA-8x56-x5mr-p9gq: epan/dissectors/packet-nbap.c in the NBAP dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate the number of items, which allows remote attackers to cause a denial of service (invalid read operation and application crash) via a crafted packet.
CVSS v3.0: 5.5
GHSA-cjvw-w4hq-pxwm: ASUS RT-AC86U Traffic Analyzer - Apps analysis function has insufficient filtering of special character. A remote attacker with regular user privilege can exploit this vulnerability to perform command injection attack to execute arbitrary commands, disrupt system or terminate services.
CVSS v3.1: 8.8
CVE-2005-4755: BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier (1) stores the private key passphrase (CustomTrustKeyStorePassPhrase) in cleartext in nodemanager.config; or, during domain creation with the Configuration Wizard, renders an SSL private key passphrase in cleartext (2) on a terminal or (3) in a log file, which might allow local users to obtain cryptographic keys.
CVSS v2.0: 2.1
CVE-2024-8123: The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Insecure Direct Object Reference
The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.0.8 via the duplicate_post function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to duplicate posts written by other authors including admins. This includes the ability to duplicate password-protected posts, which reveals their contents.
CVSS v3.1: 5.4
CVE-2007-0716: Stack-based buffer overflow in Apple QuickTime before 7.1.5 allows remote user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted QTIF file.
CVSS v2.0: 5.8
GHSA-v9f3-9mfg-cc55: Insufficient policy enforcement in DevTools in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension. (Chromium security severity: Medium)
CVSS v3.1: 3.1
GHSA-f6h3-846h-2r8w: OpenClaw's elevated allowFrom accepted broader identity signals than specified within sender-scoped authorization
SummaryIn certain elevated-mode configurations, `tools.elevated.allowFrom` accepted broader identity signals than intended. The fix tightens matching to sender-scoped identity by default and makes mutable metadata matching explicit.ContextOpenClaw is commonly used in 1:1 chats or trusted group chats. In that intended model, this issue is best treated as authorization hardening / defense-in-depth for elevated sender approval.Affected Packages / VersionsPackage: `openclaw` (npm)Latest published npm version at triage: `2026.2.21-2`Affected versions: `<= 2026.2.21-2`Planned patched version (pre-set for publish-ready advisory): `2026.2.22`DetailsElevated sender authorization now matches sender-scoped identity values only by default (`SenderId`, `From`, `SenderE164`) and no longer considers recipient routing fields such as `ctx.To`.Mutable sender metadata (`SenderName`, `SenderUsername`, `SenderTag`) now requires explicit allowlist prefixes (`name:`, `username:`, `tag:`). Explicit identity prefixes are also supported (`id:`, `from:`, `e164:`).Fix Commit(s)`6817c0ec7b4fa830123d4f5c340f075a4bd04ee2`Release Process NoteThe advisory `patched_versions` is pre-set to the planned next release (`2026.2.22`). Once npm `openclaw@2026.2.22` is published, this advisory can be published without additional content edits.OpenClaw thanks @jiseoung for reporting.
CVSS v4.0: 5.3
CVE-2026-3936: Use after free in WebView in Google Chrome on Android prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVSS v3.1: 8.8
CVE-2023-48736: In International Color Consortium DemoIccMAX 3e7948b, CIccCLUT::Interp2d in IccTagLut.cpp in libSampleICC.a has an out-of-bounds read.
CVSS v3.1: 6.5
CVE-2022-34042: Barangay Management System v1.0 was discovered to contain a SQL injection vulnerability via the hidden_id parameter at /pages/household/household.php.
CVSS v3.1: 7.2
CVE-2024-57951: hrtimers: Handle CPU state correctly on hotplug
In the Linux kernel, the following vulnerability has been resolved:

hrtimers: Handle CPU state correctly on hotplug

Consider a scenario where a CPU transitions from CPUHP_ONLINE to halfway
through a CPU hotunplug down to CPUHP_HRTIMERS_PREPARE, and then back to
CPUHP_ONLINE:

Since hrtimers_prepare_cpu() does not run, cpu_base.hres_active remains set
to 1 throughout. However, during a CPU unplug operation, the tick and the
clockevents are shut down at CPUHP_AP_TICK_DYING. On return to the online
state, for instance CFS incorrectly assumes that the hrtick is already
active, and the chance of the clockevent device to transition to oneshot
mode is also lost forever for the CPU, unless it goes back to a lower state
than CPUHP_HRTIMERS_PREPARE once.

This round-trip reveals another issue; cpu_base.online is not set to 1
after the transition, which appears as a WARN_ON_ONCE in enqueue_hrtimer().

Aside of that, the bulk of the per CPU state is not reset either, which
means there are dangling pointers in the worst case.

Address this by adding a corresponding startup() callback, which resets the
stale per CPU state and sets the online flag.

[ tglx: Make the new callback unconditionally available, remove the online
  	modification in the prepare() callback and clear the remaining
  	state in the starting callback instead of the prepare callback ]
CVSS v3.1: 7.8
GHSA-pw8j-vg82-pm6c: MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are called in internal aggregation stage. This issue affected MongoDB Server v6.0 version 6.0.3.
CVSS v3.1: 5
CVE-2020-1540: Windows Backup Engine Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists when the Windows Backup Engine improperly handles memory.
To exploit this vulnerability, an attacker would first have to gain execution on the victim system. An attacker could then run a specially crafted application to elevate privileges.
The security update addresses the vulnerability by correcting how the Windows Backup Engine handles memory.
CVSS v3.1: 7.8
GHSA-6cfq-hcw2-7hq2: kkFileView v4.1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the url parameter at /controller/OnlinePreviewController.java.
CVSS v3.1: 6.1
CVE-2011-2403: SQL injection vulnerability in HP Network Automation 7.2x, 7.5x, 7.6x, 9.0, and 9.10 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS v2.0: 6.5
GHSA-6fp2-jjv9-q3w2: Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 7.8
CVE-2019-15108: An issue was discovered in WSO2 API Manager 2.6.0 before WSO2-CARBON-PATCH-4.4.0-4457. There is XSS via a crafted filename to the file-upload feature of the event simulator component.
CVSS v3.0: 3.5
CVE-2025-14331: Same-origin policy bypass in the Request Handling component
Same-origin policy bypass in the Request Handling component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.
CVSS v3.1: 6.5
GHSA-rmpj-q623-hh55: Using a specially crafted URL command, a remote authenticated user can execute commands as root on the G-Cam and G-Code (Firmware Versions 1.12.0.25 and prior as well as the limited Versions 1.12.13.2 and 1.12.14.5).
CVE-2024-47060: Unauthorized Access After Organization or Project Deactivation in Zitadel
Zitadel is an open source identity management platform. In Zitadel, even after an organization is deactivated, associated projects, respectively their applications remain active. Users across other organizations can still log in and access through these applications, leading to unauthorized access. Additionally, if a project was deactivated access to applications was also still possible. The issue stems from the fact that when an organization is deactivated in Zitadel, the applications associated with it do not automatically deactivate. The application lifecycle is not tightly coupled with the organization's lifecycle, leading to a situation where the organization or project is marked as inactive, but its resources remain accessible. This vulnerability allows for unauthorized access to projects and their resources, which should have been restricted post-organization deactivation. Versions 2.62.1, 2.61.1, 2.60.2, 2.59.3, 2.58.5, 2.57.5, 2.56.6, 2.55.8, and 2.54.10 have been released which address this issue. Users are advised to upgrade. Users unable to upgrade may explicitly disable the application to make sure the client is not allowed anymore.
CVSS v3.1: 4.3
GHSA-r2ff-mfrc-wmc3: A race condition in the at command for Solaris 2.6 through 9 allows local users to delete arbitrary files via the -r argument with .. (dot dot) sequences in the job name, then modifying the directory structure after at checks permissions to delete the file and before the deletion actually takes place.
CVE-2007-1482: Cross-site scripting (XSS) vulnerability in index.php in WBBlog allows remote attackers to inject arbitrary web script or HTML via the e_id parameter in a viewentry cmd.
CVSS v2.0: 4.3
CVE-2023-4736: Untrusted Search Path in vim/vim
Untrusted Search Path in GitHub repository vim/vim prior to 9.0.1833.
CVSS v3.0: 7.8
GHSA-mxmw-6qgj-h67x: Jenkins PRQA Plugin stored password in plain text
Jenkins PRQA Plugin stored a password unencrypted in its global configuration file on the Jenkins controller. This password could be viewed by users with access to the Jenkins controller file system.The plugin now stores the password encrypted in the configuration files on disk.
CVSS v3.0: 3.3
GHSA-3j9x-gm2x-f8f7: FutureNet MA and IP-K series provided by Century Systems Co., Ltd. contain an OS command Injection vulnerability. A user who logs in to the Web UI of the product may execute an arbitrary OS command.
CVSS v4.0: 8.6
CVSS v3.1: 7.2
GHSA-6prf-mxrq-j35h: A vulnerability classified as critical was found in Tenda AC8 16.03.34.06. This vulnerability affects the function formSetRebootTimer of the file /goform/SetSysAutoRebbotCfg. The manipulation of the argument rebootTime leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 8.7
CVSS v3.1: 8.8
GHSA-h3rv-9c6w-cv3x: Possible buffer overflow due to lack of offset length check while updating the buffer value in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
GHSA-5mj3-9vm5-289q: In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1: 7.8
GHSA-rhjm-r2rh-2g5q: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'GetUsers' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on.
CVSS v4.0: 8.7
CVSS v3.1: 8.8
CVE-2024-5131: Improper Access Control in lunary-ai/lunary
An Improper Access Control vulnerability exists in the lunary-ai/lunary repository, affecting versions up to and including 1.2.2. The vulnerability allows unauthorized users to view any prompts in any projects by supplying a specific prompt ID to an endpoint that does not adequately verify the ownership of the prompt ID. This issue was fixed in version 1.2.25.
CVSS v3.0: 7.5
GHSA-5f9h-83hw-8qfv: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
CVSS v3.1: 7.8
ICSA-20-352-03: PTC Kepware LinkMaster
The affected product has incorrect default permissions, which may grant an attacker access to reconfigure the service in any manner.CVE-2020-13535 has been assigned to this vulnerability. A CVSS v3 base score of 9.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
CVSS v3.0: 9.3
GHSA-4ghp-qfgj-33p6: In the Linux kernel, the following vulnerability has been resolved:vsock/virtio: fix accept queue count leak on transport mismatchvirtio_transport_recv_listen() calls sk_acceptq_added() before
vsock_assign_transport(). If vsock_assign_transport() fails or
selects a different transport, the error path returns without
calling sk_acceptq_removed(), permanently incrementing
sk_ack_backlog.After approximately backlog+1 such failures, sk_acceptq_is_full()
returns true, causing the listener to reject all new connections.Fix by moving sk_acceptq_added() to after the transport validation,
matching the pattern used by vmci_transport and hyperv_transport.
CVSS v3.1: 5.5
CVE-2011-2611: Unspecified vulnerability in the printing functionality in Opera before 11.50 allows user-assisted remote attackers to cause a denial of service (application crash) via a crafted web page.
CVSS v2.0: 4.3
GHSA-gmwg-2c9p-97x5: Multiple memory corruption flaws are present in ArubaOS which could allow an unauthenticated user to crash ArubaOS processes. With sufficient time and effort, it is possible these vulnerabilities could lead to the ability to execute arbitrary code - remote code execution has not yet been confirmed.
CVSS v3.0: 7.5
CVE-2021-29863: IBM QRadar SIEM 7.3 and 7.4 is vulnerable to server side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. This vulnerability is due to an incomplete fix for CVE-2020-4786. IBM X-Force ID: 206087.
CVSS v3.0: 5.4
GHSA-2mc6-hfwx-q7vw: Winlogbeat versions before 5.6.16 and 6.6.2 had an insufficient logging flaw. An attacker able to inject certain characters into a log entry could prevent Winlogbeat from recording the event.
CVSS v3.1: 7.5
CVE-2002-2435: The Cascading Style Sheets (CSS) implementation in Microsoft Internet Explorer 8.0 and earlier does not properly handle the :visited pseudo-class, which allows remote attackers to obtain sensitive information about visited web pages via a crafted HTML document, a related issue to CVE-2010-2264.
CVSS v2.0: 4.3
GHSA-685x-r4m9-ffxr: ImageMagick before 6.9.11-40 and 7.x before 7.0.10-40 mishandles the -authenticate option, which allows setting a password for password-protected PDF files. The user-controlled password was not properly escaped/sanitized and it was therefore possible to inject additional shell commands via coders/pdf.c.
CVSS v3.1: 7.8
GHSA-29h8-2658-grhq: In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
CVSS v3.1: 5.5
CVE-2017-5364: Memory Corruption Vulnerability in Foxit PDF Toolkit v1.3 allows an attacker to cause Denial of Service and Remote Code Execution when the victim opens the specially crafted PDF file. The Vulnerability has been fixed in v2.0.
CVSS v3.0: 7.8
CVSS v2.0: 6.8
CVE-2018-8960: The ReadTIFFImage function in coders/tiff.c in ImageMagick 7.0.7-26 Q16 does not properly restrict memory allocation, leading to a heap-based buffer over-read.
CVSS v3.0: 8.8
CVSS v2.0: 6.8
CVE-2019-20799: In Cherokee through 1.2.104, multiple memory corruption errors may be used by a remote attacker to destabilize the work of a server.
CVSS v3.1: 7.5
CVSS v2.0: 5
CVE-2026-6015: Tenda AC9 POST Request QuickIndex formQuickIndex stack-based overflow
A vulnerability has been found in Tenda AC9 15.03.02.13. Impacted is the function formQuickIndex of the file /goform/QuickIndex of the component POST Request Handler. Such manipulation of the argument PPPOEPassword leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 8.7
CVSS v3.1: 8.8
CVSS v3.0: 8.8
CVSS v2.0: 9
CVE-2026-30793: RustDesk Flutter URI Handler Sets Permanent Password Without Privilege Check or User Confirmation
Cross-Site Request Forgery (CSRF) vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Flutter URI scheme handler, FFI bridge modules) allows Privilege Escalation. This vulnerability is associated with program files flutter/lib/common.Dart, src/flutter_ffi.Rs and program routines URI handler for rustdesk://password/, bind.MainSetPermanentPassword().

This issue affects RustDesk Client: through 1.4.5.
CVSS v4.0: 9.3
RHSA-2022:4818: Red Hat Security Advisory: mariadb:10.3 security and bug fix update
mysql: Server: DML unspecified vulnerability (CPU Apr 2021) mysql: Server: DML unspecified vulnerability (CPU Apr 2021) mysql: InnoDB unspecified vulnerability (CPU Jul 2021) mysql: InnoDB unspecified vulnerability (CPU Jul 2021) mysql: InnoDB unspecified vulnerability (CPU Oct 2021) mariadb: Crash in get_sort_by_table() in subquery with ORDER BY having outer ref mariadb: save_window_function_values triggers an abort during IN subquery mariadb: Crash in set_var.cc via certain UPDATE queries with nested subqueries mariadb: Crash caused by mishandling of a pushdown from a HAVING clause to a WHERE clause mariadb: Integer overflow in sql_lex.cc integer leading to crash mysql: InnoDB unspecified vulnerability (CPU Apr 2022) mariadb: crash in Used_tables_and_const_cache::used_tables_and_const_cache_join mariadb: improper locking due to unreleased lock in the ds_xbstream.cc mariadb: DoS due to improper locking due to unreleased lock in plugin/server_audit/server_audit.c
CVSS v3.1: 5.5
CVE-2023-32118: WordPress SALERT Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPoperation SALERT – Fake Sales Notification WooCommerce plugin <= 1.2.1 versions.
CVSS v3.1: 7.1
CVE-2022-37937: Pre-auth memory corruption in HPE Serviceguard
CVSS v3.1: 9.8
CVE-2023-32992: Missing permission checks in Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier allow attackers with Overall/Read permission to send an HTTP request to an attacker-specified URL and parse the response as XML, or parse a local file on the Jenkins controller as XML.
CVSS v3.1: 8.8
GHSA-qxwx-c654-v423: An issue (4 of 6) was discovered in Veritas Enterprise Vault through 14.1.2. On start-up, the Enterprise Vault application starts several services that listen on random .NET Remoting TCP ports for possible commands from client applications. These TCP services can be exploited due to deserialization behavior that is inherent to the .NET Remoting service. A malicious attacker can exploit both TCP remoting services and local IPC services on the Enterprise Vault Server. This vulnerability is mitigated by properly configuring the servers and firewall as described in the vendor's security alert for this vulnerability (VTS21-003, ZDI-CAN-14075).
CVSS v3.1: 9.8
CVE-2024-3560: LearnPress – WordPress LMS Plugin <= 4.2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the _id value in all versions up to, and including, 4.2.6.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
CVE-2018-10958: In types.cpp in Exiv2 0.26, a large size value may lead to a SIGABRT during an attempt at memory allocation for an Exiv2::Internal::PngChunk::zlibUncompress call.
CVSS v3.0: 6.5
CVSS v2.0: 4.3