ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-pfjj-m3jj-9jc9: Undefined behavior in `SparseTensorSliceDataset`
ImpactThe [implementation of `SparseTensorSliceDataset`](https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/kernels/data/sparse_tensor_slice_dataset_op.cc#L227-L292) has an undefined behavior: under certain condition it can be made to dereference a `nullptr` value:The 3 input arguments represent a sparse tensor. However, there are some preconditions that these arguments must satisfy but these are not validated in the implementation.PatchesWe have patched the issue in GitHub commit [965b97e4a9650495cda5a8c210ef6684b4b9eceb](https://github.com/tensorflow/tensorflow/commit/965b97e4a9650495cda5a8c210ef6684b4b9eceb).The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.For more informationPlease consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.AttributionThis vulnerability has been reported by Faysal Hossain Shezan from University of Virginia.
CVSS v4.0: 7.2
CVSS v3.1: 7.6
GHSA-cq4p-g9pm-3c37: A security vulnerability has been detected in jishenghua jshERP up to 3.6. The impacted element is the function getBillItemByParam of the file /jshERP-boot/depotItem/importItemExcel of the component com.jsh.erp.datasource.mappers.DepotItemMapperEx. The manipulation of the argument barCodes leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS v4.0: 2.1
CVSS v3.1: 6.3
CVE-2020-1711: An out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU versions 2.12.0 before 4.2.1 handled a response coming from an iSCSI server while checking the status of a Logical Address Block (LBA) in an iscsi_co_block_status() routine. A remote user could use this flaw to crash the QEMU process, resulting in a denial of service or potential execution of arbitrary code with privileges of the QEMU process on the host.
CVSS v3.1: 7.7
GHSA-4wcc-xwq3-8v2h: Deserialization of Untrusted Data vulnerability in Mahmudul Hasan Arif FluentBoards allows Object Injection. This issue affects FluentBoards: from n/a through 1.47.
CVSS v3.1: 9.8
CVE-2013-4703: Cross-site scripting (XSS) vulnerability in the top-page customization feature in Cybozu Office before 9.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS v2.0: 4.3
GHSA-pr4m-4844-x8pg: Microsoft Outlook Remote Code Execution Vulnerability
CVSS v3.1: 8.8
GHSA-gp5v-mf3g-qgvp: Unrestricted Upload of File with Dangerous Type vulnerability in Narkom Communication and Software Technologies Trade Ltd. Co. Pyxis Signage allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Pyxis Signage: through 31012025.
CVSS v3.1: 7.2
CVE-2024-50166: fsl/fman: Fix refcount handling of fman-related devices
In the Linux kernel, the following vulnerability has been resolved:

fsl/fman: Fix refcount handling of fman-related devices

In mac_probe() there are multiple calls to of_find_device_by_node(),
fman_bind() and fman_port_bind() which takes references to of_dev->dev.
Not all references taken by these calls are released later on error path
in mac_probe() and in mac_remove() which lead to reference leaks.

Add references release.
CVSS v3.1: 5.5
GHSA-3x88-87x6-rhc4: An issue was discovered in Form Tools through 3.0.20. SQL Injection can occur via the export_group_id field when a low-privileged user (client) tries to export a form with data, e.g., manipulation of modules/export_manager/export.php?export_group_id=1&export_group_1_results=all&export_type_id=1.
CVE-2022-31470: An XSS vulnerability in the index_mobile_changepass.hsp reset-password section of Axigen Mobile WebMail before 10.2.3.12 and 10.3.x before 10.3.3.47 allows attackers to run arbitrary Javascript code that, using an active end-user session (for a logged-in user), can access and retrieve mailbox content.
CVSS v3.1: 6.1
CVSS v2.0: 4.3
CVE-2026-43617: Rsync < 3.4.3 Authorization Bypass via Hostname Resolution
Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record for their source IP address, allowing connections from hostnames that administrators intended to deny when reverse DNS resolution fails and defaults to UNKNOWN.
CVSS v4.0: 6.3
CVSS v3.1: 4.8
RHSA-2023:3827: Red Hat Security Advisory: libtiff security update
libtiff: heap-based buffer overflow in processCropSelections() in tools/tiffcrop.c
CVSS v3.1: 5.5
GHSA-hmrv-g3mg-xx3q: SQL injection vulnerability in ad/login.asp in ZonGG 1.2 allows remote attackers to execute arbitrary SQL commands via the password parameter.
CVE-2024-22519: An issue discovered in OpenDroneID OSM 3.5.1 allows attackers to impersonate other drones via transmission of crafted data packets.
CVSS v3.1: 8.2
GHSA-qh2f-ppj6-8vgp: Improper access control in Samsung Voice Recorder prior to versions 21.5.16.01 in Android 12 and Android 13, 21.4.51.02 in Android 14 allows physical attackers to access recording files on the lock screen.
CVSS v3.1: 4.6
CVE-2012-1522: Microsoft Internet Explorer 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "Cached Object Remote Code Execution Vulnerability."
CVSS v2.0: 9.3
GHSA-m2ch-6vr7-x72r: An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and earlier versions. This vulnerability is an instance of a use after free vulnerability in the JBIG2 decoder. The vulnerability is triggered by a crafted PDF file that contains a malformed JBIG2 stream. Successful exploitation could lead to arbitrary code execution.
CVSS v3.0: 8.8
CVE-2024-40425: File Upload vulnerability in Nanjin Xingyuantu Technology Co Sparkshop (Spark Mall B2C Mall v.1.1.6 and before allows a remote attacker to execute arbitrary code via the contorller/common.php component.
CVSS v3.1: 9.8
CVE-2013-4241: Multiple cross-site scripting (XSS) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) image, (3) url, or (4) testimonial parameter to the Testimonial form (hms-testimonials-addnew page); (5) date_format parameter to the Settings - Default form (hms-testimonials-settings page); (6) name parameter in a Save action to the Settings - Custom Fields form (hms-testimonials-settings-fields page); or (7) name parameter in a Save action to the Settings - Template form (hms-testimonials-templates-new page).
CVSS v3.1: 6.1
CVSS v2.0: 4.3
CVE-2026-39386: Neko has Self-service Privilege Escalation for Authenticated Users
Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC In versions 3.0.0 through 3.0.10 and 3.1.0 through 3.1.1, any authenticated user can immediately obtain full administrative control of the entire Neko instance (member management, room settings, broadcast control, session termination, etc.). This results in a complete compromise of the instance. The vulnerability has been patched in v3.0.11 and v3.1.2. If upgrading is not immediately possible, the following mitigations can reduce risk: Restrict access to trusted users only (avoid granting accounts to untrusted parties); ensure all user passwords are strong and only shared with trusted individuals; run the instance only when needed; avoid leaving it continuously exposed; place the instance behind authentication layers such as a reverse proxy with additional access controls; disable or restrict access to the /api/profile endpoint if feasible; and/or monitor for suspicious privilege changes or unexpected administrative actions. Note that these are temporary mitigations and do not fully eliminate the vulnerability. Upgrading is strongly recommended.
CVSS v3.1: 8.8
GHSA-82j4-vr25-x394: Cross-site Scripting in ShowDoc
ShowDoc is vulnerable to stored cross-site scripting due to unrestricted file upload in versions 2.10.3 and prior. A patch is available and anticipated to be part of version 2.10.4.
CVSS v3.1: 5.4
GHSA-8454-mw8r-4mjq: It was possible to interrupt the processing of a RegExp bailout and run additional JavaScript, potentially triggering garbage collection when the engine was not expecting it. This vulnerability affects Firefox < 136 and Firefox ESR < 128.8.
CVSS v3.1: 6.5
CVE-2023-52136: WordPress Custom Twitter Feeds (Tweets Widget) Plugin <= 2.1.2 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in Smash Balloon Custom Twitter Feeds – A Tweets Widget or X Feed Widget.This issue affects Custom Twitter Feeds – A Tweets Widget or X Feed Widget: from n/a through 2.1.2.
CVSS v3.1: 4.3
RHSA-2025:17161: Red Hat Security Advisory: kernel security update
kernel: ALSA: usb-audio: ALSA USB Audio Out-of-Bounds Bug kernel: md-raid10: fix KASAN warning kernel: ALSA: bcd2000: Fix a UAF bug on the error path of probing kernel: net: usb: smsc75xx: Limit packet length to skb->len kernel: i40e: fix MMIO write access to an invalid page in i40e_clear_hw kernel: net/sched: sch_qfq: Fix race condition on qfq_aggregate
CVSS v3.1: 7.3
GHSA-9qm9-mgq3-x66p: Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite,
versions before 4.5.2, contain a Key Management Error Vulnerability.
CVSS v3.1: 7.5
CVE-2026-6632: Tenda F451 httpd SafeClientFilter fromSafeClientFilter buffer overflow
A vulnerability was identified in Tenda F451 1.0.0.7_cn_svn7958. The affected element is the function fromSafeClientFilter of the file /goform/SafeClientFilter of the component httpd. The manipulation of the argument menufacturer/Go leads to buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
CVSS v4.0: 8.7
CVSS v3.1: 8.8
CVSS v3.0: 8.8
CVSS v2.0: 9
GHSA-wc6w-mqhr-fj9h: Cross-site scripting (XSS) vulnerability in readme.php in the April's Super Functions Pack plugin before 1.4.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.  NOTE: some of these details are obtained from third party information.
GHSA-4vjr-hfpp-2m7w: expand-object Vulnerable to Prototype Pollution via the expand() Function
Versions of the package expand-object from 0.0.0 to 0.4.2 are vulnerable to Prototype Pollution in the expand() function in index.js. This function expands the given string into an object and allows a nested property to be set without checking the provided keys for sensitive properties like __proto__.
CVSS v4.0: 5.5
CVSS v3.1: 7.3
CVE-2006-6787: SQL injection vulnerability in admin/admin_mail_adressee.asp in Newsletter MX 1.0.2 and earlier allows remote attackers to execute arbitrary SQL commands via the ID parameter.
CVSS v2.0: 7.5
GHSA-4rh7-jwg9-m28m: openssl-encrypt accepts refresh tokens as URL query parameters causing token leakage
SummaryRefresh tokens are accepted as URL query parameters in the keyserver and telemetry server routes.Affected CodeImpactTokens in URL query parameters are exposed in:Server access logsProxy/CDN logsBrowser historyHTTP Referer headersNetwork monitoring toolsThis creates significant token leakage risk.Recommended FixAccept refresh tokens in the request body (POST) instead of query parametersUse `Body(...)` instead of `Query(...)`FixFixed in commit `4b2adb0` on branch `releases/1.4.x` — moved refresh token from Query parameter to POST body via RefreshRequest Pydantic model.
CVSS v4.0: 6.6
CVE-2021-4371: WP Quick FrontEnd Editor <= 5.5 - Authenticated Settings Change
The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to Setting Changs in versions up to, and including, 5.5. This is due to lacking both a security nonce and a capabilities check. This makes it possible for low-authenticated attackers to change plugin settings even when they do not have the capabilities to do so.
CVSS v3.1: 4.3
GHSA-pvm4-jw4c-gwh4: Improper access control for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
CVSS v4.0: 2.3
CVSS v3.1: 5.8
CVE-2024-31216: source-controller leaks theAzure Storage SAS token into logs on connection errors
The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. The source-controller implements the source.toolkit.fluxcd.io API and is a core component of the GitOps toolkit. Prior to version 1.2.5, when source-controller was configured to use an Azure SAS token when connecting to Azure Blob Storage, the token was logged along with the Azure URL when the controller encountered a connection error. An attacker with access to the source-controller logs could use the token to gain access to the Azure Blob Storage until the token expires. This vulnerability was fixed in source-controller v1.2.5. There is no workaround for this vulnerability except for using a different auth mechanism such as Azure Workload Identity.
CVSS v3.1: 5.1
GHSA-9g7f-8r42-f32m: The NVMe driver function nvme_opc_get_log_page is vulnerable to a buffer over-read from a guest-controlled value.
CVSS v3.1: 6.5
CVE-2023-41656: WordPress Better Elementor Addons plugin <= 1.3.7 - Broken Access Control vulnerability
Missing Authorization vulnerability in wpdive Better Elementor Addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Elementor Addons: from n/a through 1.3.7.
CVSS v3.1: 5.4
GHSA-vxfc-g29g-39m5: In the Linux kernel, the following vulnerability has been resolved:drm/amdgpu: fix ucode out-of-bounds read warningClear warning that read ucode[] may out-of-bounds.
CVSS v3.1: 7.1
GHSA-rrqv-qhmg-w4f2: StarWind iSCSI SAN before 6.0 build 2013-03-20 allows a memory leak.
CVSS v3.1: 9.8
CVE-2025-37930: drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill()
In the Linux kernel, the following vulnerability has been resolved:

drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill()

Nouveau is mostly designed in a way that it's expected that fences only
ever get signaled through nouveau_fence_signal(). However, in at least
one other place, nouveau_fence_done(), can signal fences, too. If that
happens (race) a signaled fence remains in the pending list for a while,
until it gets removed by nouveau_fence_update().

Should nouveau_fence_context_kill() run in the meantime, this would be
a bug because the function would attempt to set an error code on an
already signaled fence.

Have nouveau_fence_context_kill() check for a fence being signaled.
CVSS v3.1: 5.5
GHSA-q66h-qcgx-8rcf: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in add-ons.org Email Templates Customizer for WordPress – Drag And Drop Email Templates Builder – YeeMail allows Stored XSS.This issue affects Email Templates Customizer for WordPress – Drag And Drop Email Templates Builder – YeeMail: from n/a through 2.1.4.
CVSS v3.1: 6.5
CVE-2019-13022: Bond JetSelect (all versions) has an issue in the Java class (ENCtool.jar) and corresponding password generation algorithm (used to set initial passwords upon first installation). It XORs the plaintext into the 'encrypted' password that is then stored within the database. These steps are able to be trivially reversed, allowing for escalation of privilege within the JetSelect application through obtaining the passwords of JetSelect administrators. JetSelect administrators have the ability to modify and delete all networking configuration across a vessel, as well as altering network configuration of all managed network devices (switches, routers).
CVSS v3.1: 9.8
CVSS v2.0: 10
GHSA-c2cw-3wxx-2cxv: Directory traversal vulnerability in index.php in PHPizabi 0.848b C1 HFP3 allows remote authenticated administrators to read arbitrary files via (1) a .. (dot dot), (2) a URL, or possibly (3) a full pathname in the id parameter in an admin.templates.edittemplate action.  NOTE: some of these details are obtained from third party information.
RHSA-2014:1852: Red Hat Security Advisory: flash-plugin security update
flash-plugin: multiple code execution flaws (APSB14-24) flash-plugin: multiple code execution flaws (APSB14-24) flash-plugin: multiple code execution flaws (APSB14-24) flash-plugin: multiple code execution flaws (APSB14-24) flash-plugin: multiple code execution flaws (APSB14-24) flash-plugin: multiple code execution flaws (APSB14-24) flash-plugin: multiple code execution flaws (APSB14-24) flash-plugin: multiple code execution flaws (APSB14-24) flash-plugin: multiple code execution flaws (APSB14-24) flash-plugin: multiple code execution flaws (APSB14-24) flash-plugin: multiple code execution flaws (APSB14-24) flash-plugin: multiple code execution flaws (APSB14-24) flash-plugin: information disclosure leading to session token leak (APSB14-24) flash-plugin: multiple code execution flaws (APSB14-24) flash-plugin: multiple code execution flaws (APSB14-24) flash-plugin: multiple code execution flaws (APSB14-24)
GHSA-hr66-f59g-prqh: A vulnerability, which was classified as problematic, was found in SourceCodester Resort Reservation System 1.0. Affected is an unknown function of the file registration.php. The manipulation of the argument fullname leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227640.
CVSS v3.0: 4.3
CVE-2016-6037: IBM Rational Team Concert (RTC) is vulnerable to HTML injection. A remote attacker with project administrator privileges could send a project that contains malicious HTML code, which when the project is viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 116918.
CVSS v3.0: 4.8
CVSS v2.0: 3.5
GHSA-96v6-28qx-cr4q: Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.4.0.0, LTS2025 release version 8.3.1.10, LTS2024 release versions 7.13.1.0 through 7.13.1.40, LTS 2023 release versions 7.10.1.0 through 7.10.1.70, contain a Heap-based Buffer Overflow vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service.
CVSS v3.1: 2.3
CVE-2026-27120: Leaf-kit html escaping does not work on characters that are part of extended grapheme cluster
Leafkit is a templating language with Swift-inspired syntax. Prior to 1.4.1, htmlEscaped in leaf-kit will only escape html special characters if the extended grapheme clusters match, which allows bypassing escaping by using an extended grapheme cluster containing both the special html character and some additional characters. In the case of html attributes, this can lead to XSS if there is a leaf variable in the attribute that is user controlled. This vulnerability is fixed in 1.4.1.
CVSS v3.1: 6.1
CVE-2021-30330: Possible null pointer dereference due to improper validation of APE clip in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wearables
CVSS v3.1: 7.5
CVE-2026-22565: An Improper Input Validation vulnerability could allow a malicious actor with access to the UniFi Play network to cause the device to stop responding.  

Affected Products:
UniFi Play PowerAmp (Version 1.0.35 and earlier) 
UniFi Play Audio Port  (Version 1.0.24 and earlier)  

Mitigation:
Update UniFi Play PowerAmp to Version 1.0.38 or later 
Update UniFi Play Audio Port  to Version 1.1.9 or later
CVSS v3.1: 7.5
CVE-2022-26697: An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in Security Update 2022-004 Catalina, macOS Monterey 12.4, macOS Big Sur 11.6.6. Processing a maliciously crafted AppleScript binary may result in unexpected application termination or disclosure of process memory.
CVSS v3.1: 7.1
CVSS v2.0: 5.8
GHSA-qr5g-2w3g-gpwm: The web interface on the Linksys WRT54g router with firmware 1.00.9 does not require credentials when invoking scripts, which allows remote attackers to perform arbitrary administrative actions via a direct request to (1) Advanced.tri, (2) AdvRoute.tri, (3) Basic.tri, (4) ctlog.tri, (5) ddns.tri, (6) dmz.tri, (7) factdefa.tri, (8) filter.tri, (9) fw.tri, (10) manage.tri, (11) ping.tri, (12) PortRange.tri, (13) ptrigger.tri, (14) qos.tri, (15) rstatus.tri, (16) tracert.tri, (17) vpn.tri, (18) WanMac.tri, (19) WBasic.tri, or (20) WFilter.tri.  NOTE: the Security.tri vector is already covered by CVE-2006-5202.
GHSA-pxj9-rmgp-44pm: Open redirect vulnerability in YOOtheme Pagekit CMS 0.8.7 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect parameter to index.php/user/logout.
RHSA-2021:3660: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.1 security update
velocity: arbitrary code execution when attacker is able to modify templates wildfly: XSS via admin console when creating roles in domain mode undertow: HTTP2SourceChannel fails to write final frame under some circumstances may lead to DoS wildfly-elytron: possible timing attack in ScramServer wildfly-core: Invalid Sensitivity Classification of Vault Expression undertow: buffer leak on incoming websocket PONG message may lead to DoS netty: Request smuggling via content-length header jakarta-el: ELParserTokenManager enables invalid EL expressions to be evaluate apache-commons-io: Limited path traversal in Apache Commons IO 2.2 to 2.6
CVSS v3.1: 4.8
GHSA-jv4x-j47q-6qvp: htmlcleaner vulnerable to stack exhaustion
An issue was discovered htmlcleaner through version 2.28 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.
CVSS v3.1: 7.5
CVE-2007-2632: Multiple cross-site scripting (XSS) vulnerabilities in PHP Multi User Randomizer (phpMUR) 2006.09.13 allow remote attackers to inject arbitrary web script or HTML via (1) the edit_plugin parameter to configure_plugin.tpl.php, or (2) certain array parameters to web/phpinfo.php, as demonstrated by 1[] or a[].
CVSS v2.0: 6.8
CVE-2022-32217: A cleartext storage of sensitive information exists in Rocket.Chat <v4.6.4 due to Oauth token being leaked in plaintext in Rocket.chat logs.
CVSS v3.1: 5.3
GHSA-x6p7-44rh-m3rr: Login by Auth0 plugin for WordPress vulnerable to Reflected Cross-Site Scripting
ImpactThe Auth0 WordPress plugin allows site administrators to opt-in to allowing the use of a `wle` parameter, which can be passed to the WordPress login page by end users. When this parameter is supplied using an expected value (which is randomly generated by the plugin, by default), the end user can fallback to using WordPress' native authentication behavior. (This is generally intended as an emergency fallback for administrators to still be able to access their dashboard in the event something goes wrong.)In previous versions of the plugin, under specific conditions, this parameter could potentially accept an arbitrary string that would be improperly rendered, potentially allowing for a cross-site scripting (XSS) attack on the login page.PatchesPlease upgrade to v4.6.1 of the plugin to resolve the issue.
CVSS v4.0: 5.1
CVSS v3.1: 6.1
CVE-2004-2373: The Buddy icon file for AOL Instant Messenger (AIM) 4.3 through 5.5 is created in a predictable location, which may allow remote attackers to use a shell: URI to exploit other vulnerabilities that involve predictable locations.
CVSS v2.0: 7.5