ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-w3px-8qw9-wj6x: In the Linux kernel, the following vulnerability has been resolved:soundwire: stream: fix memory leak in stream config error pathWhen stream config is failed, master runtime will release all
slave runtime in the slave_rt_list, but slave runtime is not
added to the list at this time. This patch frees slave runtime
in the config error path to fix the memory leak.
CVSS v3.1: 5.5
GHSA-8m62-94cc-x29c: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Max Chirkov FlexIDX Home Search allows Stored XSS. This issue affects FlexIDX Home Search: from n/a through 2.1.2.
CVSS v3.1: 6.5
GHSA-h6w8-2mp2-vwq2: File Upload vulnerability in Koha Library Software 23.05.04 and before allows a remote attacker to read arbitrary files via the upload-cover-image.pl component.
CVSS v3.1: 5.3
CVE-2022-40497: Wazuh v3.6.1 - v3.13.5, v4.0.0 - v4.2.7, and v4.3.0 - v4.3.7 were discovered to contain an authenticated remote code execution (RCE) vulnerability via the Active Response endpoint.
CVSS v3.1: 8.8
CVE-2015-5044: The Flow Collector in IBM Security QRadar QFLOW 7.1.x before 7.1 MR2 Patch 11 IF3 and 7.2.x before 7.2.5 Patch 4 IF3 allows remote attackers to cause a denial of service via unspecified packets.
CVSS v2.0: 3.3
CVE-2023-39464: Triangle MicroWorks SCADA Data Gateway GTWWebMonitorService Unquoted Search Path Remote Code Execution Vulnerability
Triangle MicroWorks SCADA Data Gateway GTWWebMonitorService Unquoted Search Path Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute code on affected installations of Triangle MicroWorks SCADA Data Gateway. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the configuration of the GTWWebMonitorService service. The path to the service executable contains spaces not surrounded by quotations. An attacker can leverage this vulnerability to execute arbitrary code in the context of root. Was ZDI-CAN-20538.
CVSS v3.0: 7.2
CVE-2015-9291: cPanel before 11.52.0.13 does not prevent arbitrary file-read operations via get_information_for_applications (CPANEL-1221).
CVSS v3.0: 7.5
CVSS v2.0: 5
GHSA-hw43-jx4x-7g84: A vulnerability classified as critical has been found in code-projects School Fees Payment System 1.0. This affects an unknown part of the file /branch.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 5.5
CVSS v3.1: 7.3
CVE-2024-30808: An issue was discovered in Bento4 v1.6.0-641-2-g1529b83. There is a heap-use-after-free in AP4_SubStream::~AP4_SubStream at Ap4ByteStream.cpp, leading to a Denial of Service (DoS), as demonstrated by mp42ts.
CVSS v3.1: 2.7
CVE-2011-1540: Unspecified vulnerability in HP System Management Homepage (SMH) before 6.3 allows remote authenticated users to execute arbitrary code via unknown vectors.
CVSS v2.0: 9
GHSA-969j-v3p3-p4vv: An out-of-bounds read could have led to an exploitable crash when parsing HTML with DOMParser in low memory situations. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.
CVSS v3.1: 7.5
GHSA-9qgh-5hw9-p93q: A floating point exception in parse_tiff_ifd in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an application that bundles the dcraw code.
CVSS v3.0: 5.5
RHSA-2025:22004: Red Hat Security Advisory: go-rpm-macros security update
os/exec: Unexpected paths returned from LookPath in os/exec
CVSS v3.1: 6.5
GHSA-2c4w-2px5-9x3x: Apache Axis allows Exposure of Sensitive Information to an Unauthorized Actor
Apache Axis 1.0 allows remote attackers to obtain sensitive information by requesting a non-existent WSDL file, which reveals the installation path in the resulting exception message.
CVSS v3.1: 5.3
GHSA-w284-7936-m8j9: A flaw exists in FlashArray Purity where insufficient filtering of certain data paths could expose sensitive information to an authenticated user with low privileges.
CVSS v4.0: 8.7
GHSA-22vf-qc4p-vc3x: In Digi RealPort through 4.8.488.0, authentication relies on a challenge-response mechanism that gives access to the server password, making the protection ineffective. An attacker may send an unauthenticated request to the server. The server will reply with a weakly-hashed version of the server's access password. The attacker may then crack this hash offline in order to successfully login to the server.
CVSS v3.1: 9.8
CVE-2023-28419: WordPress Force First and Last Name as Display Name Plugin <= 1.2 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in Stranger Studios Force First and Last Name as Display Name plugin <= 1.2 versions.
CVSS v3.1: 5.4
GHSA-f76r-jqp9-73vv: Directory traversal vulnerability in scr/form.php in openElec 3.01 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the obj parameter.
GHSA-v895-7m89-39v8: Deserialization of Untrusted Data vulnerability in BoldThemes Codiqa codiqa allows Object Injection.This issue affects Codiqa: from n/a through < 1.2.8.
CVSS v3.1: 9.8
GHSA-cw9g-qwf2-42hw: In Contiki 3.0, potential nonterminating acknowledgment loops exist in the Telnet service. When the negotiated options are already disabled, servers still respond to DONT and WONT requests with WONT or DONT commands, which may lead to infinite acknowledgment loops, denial of service, and excessive CPU consumption.
GHSA-h76w-xp2h-9r2m: A buffer overflow in the razermouse driver of OpenRazer v3.3.0 and below allows attackers to cause a Denial of Service (DoS) via a crafted buffer sent to the matrix_custom_frame device.
CVSS v3.1: 7.5
CVE-2023-38241: ZDI-CAN-21246: Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 5.5
GHSA-8jmq-m9fv-qr74: An issue was discovered in Zoho ManageEngine Desktop Central before 100230. There is unauthenticated remote access to all log files of a Desktop Central instance containing critical information (private information such as location of enrolled devices, cleartext passwords, patching level, etc.) via a GET request on port 8022, 8443, or 8444.
CVSS v3.0: 9.8
CVE-2022-4142: WordPress Filter Gallery Plugin < 0.1.6 - Admin+ Stored XSS
The WordPress Filter Gallery Plugin WordPress plugin before 0.1.6 does not properly escape the filters passed in the ufg_gallery_filters ajax action before outputting them on the page, allowing a high privileged user such as an administrator to inject HTML or javascript to the plugin settings page, even when the unfiltered_html capability is disabled.
CVSS v3.1: 4.8
CVE-2022-4477: Smash Balloon Social Post Feed < 4.1.6 - Contributor+ Stored XSS
The Smash Balloon Social Post Feed WordPress plugin before 4.1.6 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks against logged-in admins.
CVSS v3.1: 5.4
CVE-2019-9061: An issue was discovered in CMS Made Simple 2.2.8. In the module ModuleManager (in the file action.installmodule.php), it is possible to reach an unserialize call with untrusted input and achieve authenticated object injection by using the "install module" feature.
CVSS v3.1: 8.8
CVSS v2.0: 6.5
CVE-2012-3160: Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.65 and earlier, and 5.5.27 and earlier, allows local users to affect confidentiality via unknown vectors related to Server Installation.
CVSS v2.0: 2.1
GHSA-w76x-q8qw-g38j: IOGraphics in Apple OS X before 10.10.5 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2015-3770.
GHSA-7j57-rvfr-h57j: Unspecified vulnerability in the PeopleSoft Enterprise SCM component in Oracle PeopleSoft Products 9.0 Bundle #36 and 9.1 Bundle #13 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Purchasing.
CVE-2023-2141: Unsafe .NET object deserialization affecting DELMIA Apriso Release 2017 through Release 2022 
An unsafe .NET object deserialization in DELMIA Apriso Release 2017 through Release 2022 could lead to post-authentication remote code execution.

CVSS v3.1: 8.5
GHSA-ffpm-3vr6-89rp: An FR-GV-205 issue in FreeRADIUS 2.x before 2.2.10 allows "DHCP - Buffer over-read in fr_dhcp_decode_options()" and a denial of service.
CVSS v3.0: 7.5
GHSA-f3cj-j4f6-wq85: Svelte: SSR XSS via Insecure Promise Serialization in hydratable
Contents of `hydratable` promises were not properly stringified, potentially leading to an XSS exploit. You are vulnerable if all of the following is true:you are using `hydratable` (an experimental feature at the time of this report)you are passing attacker-controlled input such that a synchronous value is hydrated, then a promise value, e.g. `hydratable('someKey', () => [synchronousValue, promiseValue])`
CVSS v4.0: 5.3
GHSA-jw73-3w4r-mp3q: A flaw has been found in Shenzhen Libituo Technology LBT-T300-HW1 up to 1.2.8. This issue affects the function start_single_service of the component Web Management Interface. Executing a manipulation of the argument vpn_pptp_server/vpn_l2tp_server can lead to buffer overflow. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 8.7
CVSS v3.1: 8.8
CVE-2025-6719: Terms descriptions <= 3.4.8 - Authenticated (Admin+) Stored Cross-Site Scripting
The Terms descriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS v3.1: 4.4
GHSA-wf52-5wvv-68vv: RenderDoc through 1.26 allows an Integer Overflow with a resultant Buffer Overflow (issue 2 of 2).
CVSS v3.1: 9.8
CVE-2017-7866: FFmpeg before 2017-01-23 has an out-of-bounds write caused by a stack-based buffer overflow related to the decode_zbuf function in libavcodec/pngdec.c.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
GHSA-qf92-c3mg-jh95: In Kanboard before 1.0.47, by altering form data, an authenticated user can add a new category to a private project of another user.
CVSS v3.0: 4.3
GHSA-538c-94wq-rm22: In the Linux kernel, the following vulnerability has been resolved:dmaengine: dw-axi-dmac: ignore interrupt if no descriptorIf the channel has no descriptor and the interrupt is raised then the
kernel will OOPS. Check the result of vchan_next_desc() in the handler
axi_chan_block_xfer_complete() to avoid the error happening.
CVSS v3.1: 5.5
CVE-2024-5291: D-Link DIR-2150 GetDeviceSettings Target Command Injection Remote Code Execution Vulnerability
D-Link DIR-2150 GetDeviceSettings Target Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-2150 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the SOAP API interface, which listens on TCP port 80 by default. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21235.
CVSS v3.0: 8.8
CVE-2021-23263: Transmission of Private Resources into a New Sphere ('Resource Leak') in Crafter Engine
Unauthenticated remote attackers can read textual content via FreeMarker including files /scripts/*, /templates/* and some of the files in /.git/* (non-binary).
CVSS v3.1: 5.9
GHSA-v54w-8g4p-5f5m: In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: WCNCR00435347; Issue ID: MSV-4049.
CVSS v3.1: 6.7
CVE-2024-3338: Colibri Page Builder <= 1.0.262 - Authenticated (Author+) Stored Cross-Site Scripting
The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt data parameter in all versions up to, and including, 1.0.262 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 4.4
CVE-2018-20097: There is a SEGV in Exiv2::Internal::TiffParserWorker::findPrimaryGroups of tiffimage_int.cpp in Exiv2 0.27-RC3. A crafted input will lead to a remote denial of service attack.
CVSS v3.1: 6.5
CVSS v2.0: 4.3
GHSA-vq37-fmx5-vw56: In EMC Isilon OneFS 8.1.0.0, 8.0.1.0 - 8.0.1.1, 8.0.0.0 - 8.0.0.4, 7.2.1.0 - 7.2.1.5, 7.2.0.x, and 7.1.1.x, a malicious compliance admin (compadmin) account user could exploit a vulnerability in isi_get_itrace or isi_get_profile maintenance scripts to run any shell script as system root on a cluster in compliance mode. This could potentially lead to an elevation of privilege for the compadmin user and violate compliance mode.
CVSS v3.0: 6.7
RHSA-2025:9466: Red Hat Security Advisory: mod_proxy_cluster security update
mod_proxy_cluster: mod_proxy_cluster unauthorized MCMP requests
CVSS v3.1: 5.4
GHSA-qq9g-rvjp-rm4j: Buffer overflow in Apache 1.2.5 and earlier allows a remote attacker to cause a denial of service with a large number of GET requests containing a large number of / characters.
GHSA-83wr-vr8p-fw3c: Brocade Fabric OS versions before Brocade Fabric OS v9.0.0, v8.2.2c, v8.2.1e, v8.1.2k, v8.2.0_CBN3, contains code injection and privilege escalation vulnerability.
GHSA-58j8-v6rc-xm3j: In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameters debug and InsId in interface\billing\sl_eob_process.php leads to multiple cross-site scripting (XSS) vulnerabilities.
CVSS v3.1: 5.4
GHSA-f2p2-cx3j-98m3: Insufficiently Protected Credentials vulnerability in ABB Aspect.This issue affects Aspect: before <3.08.04-s01.
CVSS v4.0: 7.3
CVSS v3.1: 7
GHSA-5r79-3284-v2f8: Nullsoft Scriptable Install System (NSIS) before 3.09 mishandles access control for an uninstaller directory.
CVSS v3.1: 5.3
RHSA-2026:27789: Red Hat Security Advisory: kernel security, bug fix, and enhancement update
kernel: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() kernel: mptcp: fix slab-use-after-free in __inet_lookup_established kernel: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync kernel: xen/privcmd: fix double free via VMA splitting kernel: bnxt_en: Fix RSS context delete logic kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing kernel: scsi: qla2xxx: Completely fix fcport double free kernel: gfs2: Fix use-after-free in iomap inline data write path kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() kernel: wifi: mac80211: remove station if connection prep fails kernel: nvmet-tcp: fix race between ICReq handling and queue teardown kernel: RDMA/mana: Validate rx_hash_key_len kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result kernel: wifi: mac80211: use safe list iteration in radar detect work kernel: exit: prevent preemption of oopsing TASK_DEAD task kernel: net/sched: act_pedit: extend the writable skb range per key
CVSS v3.1: 6.7
CVE-2018-13366: An information disclosure vulnerability in Fortinet FortiOS 6.0.1, 5.6.7 and below allows attacker to reveals serial number of FortiGate via hostname field defined in connection control setup packets of PPTP protocol.
CVSS v3.0: 5.3
CVSS v2.0: 5
GHSA-wwpj-227g-g62p: Missing Authorization vulnerability in Fahad Mahmood WP Datepicker allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Datepicker: from n/a through 2.1.1.
CVSS v3.1: 6.5
CVE-2010-2511: SQL injection vulnerability in viewnews.php in 2daybiz Multi Level Marketing (MLM) Software allows remote attackers to execute arbitrary SQL commands via the nwsid parameter.
CVSS v2.0: 7.5
PYSEC-2021-185: TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a runtime division by zero error and denial of service in `tf.raw_ops.QuantizedBatchNormWithGlobalNormalization`. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/55a97caa9e99c7f37a0bbbeb414dc55553d3ae7f/tensorflow/core/kernels/quantized_batch_norm_op.cc) does not validate all constraints specified in the op's contract(https://www.tensorflow.org/api_docs/python/tf/raw_ops/QuantizedBatchNormWithGlobalNormalization). The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
GHSA-m3vm-c2qr-hmgv: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in DELUCKS GmbH DELUCKS SEO allows Path Traversal.This issue affects DELUCKS SEO: from n/a through 2.5.5.
CVSS v3.1: 6.5
CVE-2010-4795: SQL injection vulnerability in the JS Calendar (com_jscalendar) component 1.5.1 and 1.5.4 for Joomla! allows remote attackers to execute arbitrary SQL commands via the ev_id parameter in a details action to index.php.  NOTE: some of these details are obtained from third party information.
CVSS v2.0: 7.5
CVE-2018-14899: On the EPSON WF-2750 printer with firmware JP02I2, the Web interface AirPrint Setup page is vulnerable to HTML Injection that can redirect users to malicious sites.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
GHSA-j755-pf65-mmrq: The issue was addressed with improved permissions logic. This issue is fixed in macOS Sonoma 14.1. An app may be able to access sensitive user data.
CVSS v3.1: 5.5
RHSA-2017:0847: Red Hat Security Advisory: curl security update
curl: negotiate not treated as connection-oriented (incomplete fix for CVE-2015-3148)
CVSS v3.0: 4.8
GHSA-mwvc-gfrx-j34p: Dell Netvault Backup before 10.0.5 allows remote attackers to cause a denial of service (crash) via a crafted request.
PYSEC-2017-115: exiv2 0.26 contains a Stack out of bounds read in webp parser
CVSS v3.0: 5.5
GHSA-52mw-589c-4mv9: Brocade Fabric OS prior to v9.0.1a and 8.2.3a and after v9.0.0 and 8.2.2d may observe high CPU load during security scanning, which could lead to a slower response to CLI commands and other operations.
CVSS v3.1: 5.3
CVE-2025-7902: yangzongzhuan RuoYi SysNoticeController.java addSave cross site scripting
A vulnerability classified as problematic has been found in yangzongzhuan RuoYi up to 4.8.1. Affected is the function addSave of the file com/ruoyi/web/controller/system/SysNoticeController.java. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 5.1
CVSS v3.1: 3.5
CVSS v3.0: 3.5
CVSS v2.0: 4
GHSA-f2fj-cj3g-rj2x: Improper access control in the software installer for the Intel(R) Serial IO driver for Intel(R) NUC 11 Gen before version 30.100.2104.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS v3.1: 7.8
GHSA-r57p-9vwh-hqg7: IrfanView DXF File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24629.
CVSS v3.0: 7.8
GHSA-vgpr-fwc5-7j92: In mobile_log_d, there is a possible information disclosure due to improper input validation. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-11; Patch ID: ALPS05457039.
CVSS v3.1: 4.4
CVE-2026-26292: Gitea LFS mirror synchronization bypasses migration HTTP transport restrictions
Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport protections for those LFS requests.
CVE-2020-2153: Jenkins Backlog Plugin 2.4 and earlier transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure.
CVSS v3.1: 4.3
CVSS v2.0: 4
GHSA-vxxj-3vjg-7c8h: Multiple untrusted search path vulnerabilities in Soda PDF 5.1.183.10520 allow local users to gain privileges via a Trojan horse (1) dwmapi.dll or (2) api-ms-win-core-localregistry-l1-1-0.dll file in the current working directory.
GHSA-w8gf-g2vq-j2f4: amphp/http-client  Denial of Service via HTTP/2 CONTINUATION Frames
Early versions of `amphp/http-client` with HTTP/2 support (v4.0.0-rc10 to 4.0.0) will collect HTTP/2 `CONTINUATION` frames in an unbounded buffer and will not check the header size limit until it has received the `END_HEADERS` flag, resulting in an OOM crash. Later versions of `amphp/http-client` (v4.1.0-rc1 and up) depend on `amphp/http` for HTTP/2 processing and will therefore need an updated version of `amphp/http`, see [GHSA-qjfw-cvjf-f4fm](https://github.com/amphp/http/security/advisories/GHSA-qjfw-cvjf-f4fm).AcknowledgementsThank you to [Bartek Nowotarski](https://nowotarski.info/) for reporting the vulnerability.
CVSS v3.1: 8.2
GHSA-qj6g-3fwx-29q3: Changes to user permissions in Portal for ArcGIS 10.9.1 and below are incompletely applied in specific use cases. This issue may allow users to access content that they are no longer privileged to access.
CVSS v3.1: 4.6
GHSA-x2pj-x7hv-qm35: The Liaison Site Prober plugin for WordPress is vulnerable to Information Exposure in all versions up to and including 1.2.1 via the /wp-json/site-prober/v1/logs REST API endpoint. The permissions_read() permission callback unconditionally returns true (via __return_true()) instead of checking for appropriate capabilities. This makes it possible for unauthenticated attackers to retrieve sensitive audit log data including IP addresses, user IDs, usernames, login/logout events, failed login attempts, and detailed activity descriptions.
CVSS v3.1: 5.3