ansulev/circl-vulnerability-scores huggingface dataset:
RHSA-2026:27708: Red Hat Security Advisory: kernel security, bug fix, and enhancement update
kernel: smc: Fix use-after-free in __pnet_find_base_ndev() kernel: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() kernel: Linux kernel: Denial of Service in libceph OSD client due to unreset sparse-read state kernel: netfilter: ctnetlink: ensure safe access to master conntrack kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks kernel: mm/page_alloc: clear page->private in free_pages_prepare() kernel: RDMA/iwcm: Fix workqueue list corruption by removing work_list kernel: wifi: mac80211: remove station if connection prep fails kernel: wifi: mac80211: use safe list iteration in radar detect work kernel: Linux kernel: smb: client: reject userspace cifs.spnego descriptions kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs kernel: net/sched: act_pedit: extend the writable skb range per key
CVSS v3.1: 6.7
CVE-2025-41747: Reflected XSS vulnerability in pxc_vlanIntfCfg.php
An XSS vulnerability in pxc_vlanIntfCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookie is secured by the httpOnly Flag. Therefore an attacker is not able to take over the session of an authenticated user.
CVSS v3.1: 7.1
CVE-2016-10531: marked is an application that is meant to parse and compile markdown. Due to the way that marked 0.3.5 and earlier parses input, specifically HTML entities, it's possible to bypass marked's content injection protection (`sanitize: true`) to inject a `javascript:` URL. This flaw exists because `&#xNNanything;` gets parsed to what it could and leaves the rest behind, resulting in just `anything;` being left.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
GHSA-pvcv-q3q7-266g: Filament multi-factor authentication (app) recovery codes can be used multiple times
A flaw in the handling of recovery codes for **app-based multi-factor authentication** allows the same recovery code to be reused indefinitely. This issue does **not** affect email-based MFA. It also only applies when recovery codes are enabled.If an attacker gains access to both the user's password and their recovery codes, they can repeatedly complete MFA without the user's app-based second factor. This weakens the expected security of MFA by turning recovery codes into a static, long-term bypass method.
CVSS v3.1: 8.1
CVE-2014-1887: The DrinkedIn BarFinder application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows remote attackers to execute arbitrary JavaScript code, and consequently obtain sensitive fine-geolocation information, by leveraging control over one of a number of adult sites, as demonstrated by (1) freelifetimecheating.com and (2) www.babesroulette.com.
CVSS v2.0: 4.3
CVE-2023-28274: Windows Win32k Elevation of Privilege Vulnerability
Windows Win32k Elevation of Privilege Vulnerability
CVSS v3.1: 7.8
CVE-2023-51764: Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain other options that exist in recent versions). Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Postfix supports <LF>.<CR><LF> but some other popular e-mail servers do not. To prevent attack variants (by always disallowing <LF> without <CR>), a different solution is required, such as the smtpd_forbid_bare_newline=yes option with a Postfix minimum version of 3.5.23, 3.6.13, 3.7.9, 3.8.4, or 3.9.
CVSS v3.1: 5.3
RHSA-2026:6226: Red Hat Security Advisory: Multicluster Global Hub 1.6.2 security update
database/sql: Postgres Scan Race Condition jspdf: jsPDF Denial of Service (DoS) golang: archive/tar: Unbounded allocation when parsing GNU sparse map axios: Axios DoS via lack of data size check tar-fs: tar-fs symlink validation bypass golang: net/url: Memory exhaustion in query parameter parsing in net/url golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption nats-server: WebSockets pre-auth memory DoS
CVSS v3.1: 7.5
GHSA-4chm-wmxx-rwf9: An uncontrolled search path element vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to craft a special configuration file to load an untrusted library with escalated privileges on affected installations.Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS v3.1: 7.8
GHSA-92x5-9q2r-x8gq: Recipes version 1.5.10 allows arbitrary HTTP requests to be madethrough the server. This is possible because the application isvulnerable to SSRF.
CVSS v3.1: 5.3
GHSA-c88g-ppxf-5fv6: Unrestricted file upload vulnerability in ImperialBB 2.3.5 and earlier allows remote authenticated users to upload and execute arbitrary PHP code by placing a .php filename in the Upload_Avatar parameter and sending the image/gif content type.
GHSA-vp32-m2qc-fv88: MySQL 5.0 before 5.0.92, 5.1 before 5.1.51, and 5.5 before 5.5.6 allows remote authenticated users to cause a denial of service (server crash) via a query that uses the (1) GREATEST or (2) LEAST function with a mixed list of numeric and LONGBLOB arguments, which is not properly handled when the function's result is "processed using an intermediate temporary table."
CVE-2021-32857: Cockpit vulnerable to Cross-site Scripting
Cockpit is a content management system that allows addition of content management functionality to any site. In versions 0.12.2 and prior, bad HTML sanitization in `htmleditor.js` may lead to cross-site scripting (XSS) issues. There are no known patches for this issue.
CVSS v3.1: 6.1
CVE-2018-6639: An out-of-bounds write (Remote Code Execution) issue was discovered in Design Science MathType 6.9c. A size used by memmove is read from the input file. This is fixed in 6.9d.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
GHSA-q24m-6h38-5xj8: ydb-go-sdk token in custom credentials object can leak through logs
ImpactSince [ydb-go-sdk/v3.48.6](https://github.com/ydb-platform/ydb-go-sdk/blob/v3.48.6/internal/balancer/balancer.go#L71) if you use a custom credentials object (implementation of interface [Credentials](https://github.com/ydb-platform/ydb-go-sdk/blob/master/credentials/credentials.go#L10)) it may leak into logs. This happens because this object could be serialized into an error message using `fmt.Errorf("something went wrong (credentials: %q)", credentials)` during connection to the YDB server. Printf func use placeholder `%q` for string representation of argument with quotes. If an argument implements interface `fmt.Stringer`, it will used through `String()` func. In other cases used fallback - serialization with reflection.If such logging occurred, a  malicious user with access to logs could read sensitive information (i.e. credentials) information and use it to get access to the database.Who is impacted: applications with custom credentials object with an explicit token field.A leak could have occurred if all of these conditions were met simultaneously:The credentials object does not implement the `fmt.Stringer` interface (does not have a `String()` method) - potentially these are custom credentials. Official credentials have a `String()` method.There was an error connecting to YDB during driver creation via `ydb.Open(...)`.Some logging system was configured (`ydb-go-sdk` does not log such errors by default).The connection error was logged into a system that a malicious user had access to.Patches`ydb-go-sdk` contains this problem in versions from v3.48.6 to v3.53.2. The fix for this problem has been released in version v3.53.3 ([PR](https://github.com/ydb-platform/ydb-go-sdk/pull/859)).WorkaroundsImplement the `fmt.Stringer` interface in your custom credentials type with explicit stringify of object state.
CVSS v3.1: 5.5
GHSA-7w2g-wqp8-2c9j: VMware Aria Automation does not apply correct input validation which allows for SQL-injection in the product. An authenticated malicious user could enter specially crafted SQL queries and perform unauthorised read/write operations in the database.
CVSS v3.1: 8.5
GHSA-xgfw-p7jc-xwr2: Pangea Communications Internet FAX ATA all Versions 3.1.8 and prior allow an attacker to bypass user authentication using a specially crafted URL to cause the device to reboot, which may be used to cause a continual denial-of-service condition.
CVSS v3.1: 7.5
CVE-2026-49482: ClipBucket: SQL Wildcard Injection in Subtitle Edit Endpoint Allows Mass Subtitle Overwrite
ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #141, ClipBucket v5 contains an improper neutralization of SQL wildcard characters in the subtitle editing endpoint. An authenticated user can send a % character as the number parameter to overwrite all subtitle titles of any video they own in a single HTTP request. This issue has been patched in version 5.5.3 - #141.
CVSS v3.1: 4.3
GHSA-2pmm-79fr-p2h7: Silicon Integrated Systems XGI WindowsXP Display Manager (aka XGI VGA Driver Manager and VGA Display Manager) 6.14.10.1090 allows local users to gain privileges via a crafted 0x96002404 IOCTL call.
CVE-2023-6157: Livestatus injection in ajax_search
Improper neutralization of livestatus command delimiters in ajax_search in Checkmk <= 2.0.0p39, < 2.1.0p37, and < 2.2.0p15 allows arbitrary livestatus command execution for authorized users.
CVSS v3.1: 7.6
GHSA-mm49-gr56-gmr7: Telenium Online Web Application is vulnerable due to a Perl script that 
is called to load the login page. Due to improper input validation, an 
attacker can inject arbitrary Perl code through a crafted HTTP request, 
leading to remote code execution on the server.
CVSS v4.0: 9.3
CVSS v3.1: 9.8
GHSA-h8vw-hvvh-qqj8: IrfanView CADImage Plugin DWG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26072.
CVSS v3.0: 3.3
GHSA-gmqc-66m4-mcgh: An issue was discovered in GraphicsMagick 1.3.26. An allocation failure vulnerability was found in the function ReadTIFFImage in coders/tiff.c, which allows attackers to cause a denial of service via a crafted file, because file size is not properly used to restrict scanline, strip, and tile allocations.
CVSS v3.0: 6.5
CVE-2021-30209: Textpattern V4.8.4 contains an arbitrary file upload vulnerability where a plug-in can be loaded in the background without any security verification, which may lead to obtaining system permissions.
CVSS v3.1: 6.5
CVSS v2.0: 4
CVE-2020-13583: A denial-of-service vulnerability exists in the HTTP Server functionality of Micrium uC-HTTP 3.01.00. A specially crafted HTTP request can lead to denial of service. An attacker can send an HTTP request to trigger this vulnerability.
CVSS v3.0: 8.6
GHSA-j3w9-4qwp-6gq3: A local Unauthorized Data Modification vulnerability in HPE OfficeConnect Network Switches version PT.02.01 including PT.01.03 through PT.01.14
CVSS v3.0: 5.5
CVE-2016-9314: Sensitive Information Disclosure in com.trend.iwss.gui.servlet.ConfigBackup in Trend Micro InterScan Web Security Virtual Appliance (IWSVA) version 6.5-SP2_Build_Linux_1707 and earlier allows authenticated, remote users with least privileges to backup the system configuration and download it onto their local machine. This backup file contains sensitive information like passwd/shadow files, RSA certificates, Private Keys and Default Passphrase, etc. This was resolved in Version 6.5 CP 1737.
CVSS v3.0: 7.8
CVSS v2.0: 4
CVE-2023-6412: SQL injection in Voovi Social Networking Script
A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via photo.php in multiple parameters. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the application.
CVSS v3.1: 9.8
GHSA-wh68-8742-rwwq: In the Linux kernel, the following vulnerability has been resolved:drm/mediatek: Fix device use-after-free on unbindA recent change fixed device reference leaks when looking up drm
platform device driver data during bind() but failed to remove a partial
fix which had been added by commit 80805b62ea5b ("drm/mediatek: Fix
kobject put for component sub-drivers").This results in a reference imbalance on component bind() failures and
on unbind() which could lead to a user-after-free.Make sure to only drop the references after retrieving the driver data
by effectively reverting the previous partial fix.Note that holding a reference to a device does not prevent its driver
data from going away so there is no point in keeping the reference.
CVE-2020-11157: u'Lack of handling unexpected control messages while encryption was in progress can terminate the connection and thus leading to a DoS' in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8053, APQ8076, MDM9640, MDM9650, MSM8905, MSM8917, MSM8937, MSM8940, MSM8953, QCA6174A, QCA9886, QCM2150, QM215, SDM429, SDM439, SDM450, SDM632
CVSS v3.1: 7.5
CVSS v2.0: 5
cisco-sa-ise-multi-vuln-DBQdWRy: Cisco Identity Services Engine Vulnerabilities
Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow a remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface, perform a path traversal attack, read and delete arbitrary files on an affected device, or conduct a server-side request forgery (SSRF) attack through the device.

For more information about these vulnerabilities, see the Details ["#details"] section of this advisory.

Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.


CVSS v3.1: 5.5
CVE-2012-6335: The Anti-theft service in AVG AntiVirus for Android allows physically proximate attackers to provide arbitrary location data via a "commonly available simple GPS location spoofer."
CVSS v2.0: 3.3
CVE-2010-4832: Android OS before 2.2 does not display the correct SSL certificate in certain cases, which might allow remote attackers to spoof trusted web sites via a web page containing references to external sources in which (1) the certificate of the last loaded resource is checked, instead of for the main page, or (2) later certificates are not checked when the HTTPS connection is reused.
CVSS v2.0: 4.3
GHSA-54vx-xvq8-jh85: Perl Crypt::JWT prior to 0.023 is affected by: Incorrect Access Control. The impact is: allow attackers to bypass authentication by providing a token by crafting with hmac(). The component is: JWT.pm, line 614. The attack vector is: network connectivity. The fixed version is: after commit b98a59b42ded9f9e51b2560410106207c2152d6c.
CVSS v3.0: 9.8
GHSA-pcqx-86vv-4gxg: Cross-site scripting (XSS) vulnerability in the system configuration section in the administrative user interface in Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r9, and 7.4 before 7.4r13.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS v3.0: 6.1
CVE-2025-61247: indieka900 online-shopping-system-php 1.0 is vulnerable to SQL Injection in the password parameter of login.php.
CVSS v3.1: 8.2
CVE-2022-38206: Reflected XSS vulnerability in Portal for ArcGIS (10.9.1, 10.8.1 and 10.7.1 only)
There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 and below which may allow a remote remote, unauthenticated attacker to create a crafted link which when clicked could execute arbitrary JavaScript code in the victim’s browser.
CVSS v3.1: 6.1
GHSA-9cqg-4xp4-h354: Azure Arc-enabled Kubernetes cluster Connect Elevation of Privilege Vulnerability.
CVSS v3.1: 10
GHSA-f74j-gffq-vm9p: pyquokka is Vulnerable to Remote Code Execution by Pickle Deserialization via FlightServer
DescriptionIn the FlightServer class of the pyquokka framework, the do_action() method directly uses pickle.loads() to deserialize action bodies received from Flight clients without any sanitization or validation, which results in a remote code execution vulnerability. The vulnerable code is located in pyquokka/flight.py at line 283, where arbitrary data from Flight clients is directly passed to pickle.loads().Even more concerning, when FlightServer is configured to listen on 0.0.0.0 (as shown in the provided server example at line 339), this allows attackers across the entire network to perform arbitrary remote code execution by sending malicious pickled payloads through the set_configs action.In addition, the functions cache_garbage_collect, do_put, and do_get also contain vulnerability points where pickle.loads is used to deserialize untrusted remote data. Please review and fix these issues accordingly. This report uses the set_configs action as an example.Proof of ConceptStep 1:
The victim user starts a FlightServer that binds to the network interface, e.g.:Step 2:
The attacker can then send malicious pickle dump data through the Flight client connection. The provided PoC demonstrates how an attacker can execute "ls -l" command:When the server receives this payload, the FlightServer.do_action() method calls pickle.loads(action.body.to_pybytes()) on line 283, which triggers the execution of the malicious code through Python's pickle deserialization mechanism. The provided flight_client.py demonstrates a complete PoC that connects to the vulnerable server and executes arbitrary commands through the pickle deserialization vulnerability.When the vulnerability is reproduced, python flight.py can be run to init the server and then run flight_client.py. There is an attack demo in the attachment.ImpactRemote code execution on the victim's machine over the network. Once the victim starts the FlightServer with network binding (especially 0.0.0.0), an attacker on the network can gain arbitrary code execution by connecting to the Flight endpoint and sending crafted pickle payloads through the set_configs action. This vulnerability allows for:Complete system compromiseData exfiltrationLateral movement within the networkDenial of service attacksInstallation of persistent backdoorsMitigation**Replace unsafe deserialization**: Replace `pickle.loads()` with safer alternatives such as:JSON serialization for simple data structuresProtocol Buffers or MessagePack for complex dataIf pickle must be used, implement a custom `Unpickler` with a restricted `find_class()` method that only allows whitelisted classes**Network security**:If the service is intended for internal use only, bind to localhost (`127.0.0.1`) instead of `0.0.0.0`Implement authentication and authorization mechanisms**Security warnings**: When starting the service on public interfaces, display clear security warnings to inform users about the risks.
CVSS v3.1: 9.8
CVE-2024-54112: Cross-process screen stack vulnerability in the UIExtension module
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS v3.1: 5.5
CVE-2021-23514: Path Traversal
This affects the package Crow before 0.3+4. It is possible to traverse directories to fetch arbitrary files from the server.
CVSS v3.1: 6.5
GHSA-48r5-w4v7-4vx3: Windows Storage Services in Windows 10 versions 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allows an elevation of privilege vulnerability due to the way objects are handled in memory, aka "Windows Storage Services Elevation of Privilege Vulnerability".
CVSS v3.0: 7
CVE-2015-0943: Basware Banking (Maksuliikenne) before 9.10.0.0 does not encrypt communication between the client and the backend server, which allows man-in-the-middle attackers to obtain encryption keys, user credentials, and other sensitive information by sniffing the network or modify this traffic by inserting packets into the client-server data stream.
CVSS v2.0: 5.8
CVE-2024-43142: WordPress Tutor LMS plugin <= 2.7.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in Themeum Tutor LMS allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through 2.7.3.
CVSS v3.1: 4.3
RHSA-2026:3963: Red Hat Security Advisory: kernel security update
kernel: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() kernel: macvlan: fix possible UAF in macvlan_forward_source()
CVSS v3.1: 7.8
CVE-2026-31221: PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability (CWE-502) in the checkpoint loading mechanism. The LightningModule.load_from_checkpoint() method, which is commonly used to load saved model states, internally calls torch.load() without setting the security-restrictive weights_only=True parameter. This default behavior allows the deserialization of arbitrary Python objects via the Pickle module. A remote attacker can exploit this by providing a maliciously crafted checkpoint file, leading to arbitrary code execution on the victim's system when the file is loaded.
CVSS v3.1: 8.8
CVE-2023-47073: ZDI-CAN-21709: Adobe After Effects MP4 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Adobe After Effects version 24.0.2 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 7.8
GHSA-j778-wm83-8cf7: A security vulnerability has been detected in TOTOLINK A3300R 17.0.0cu.557_B20221024. This affects the function setDmzCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ip leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
CVSS v4.0: 7.4
CVSS v3.1: 8.8
CVE-2019-18796: The BASS Audio Library 2.4.14 under Windows is prone to a BASS_StreamCreateFile Denial of Service vulnerability (infinite loop) via a crafted .mp3 file. This weakness could allow attackers to consume excessive CPU and the application becomes unresponsive.
CVSS v3.1: 6.5
CVSS v2.0: 7.1
GHSA-6wfg-rr5q-wg74: Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modules/System%20Admin/import_run.php&type=externalAssessment&step=4 URI.
CVSS v3.1: 8.8
CVE-2002-0986: The mail function in PHP 4.x to 4.2.2 does not filter ASCII control characters from its arguments, which could allow remote attackers to modify mail message content, including mail headers, and possibly use PHP as a "spam proxy."
CVSS v2.0: 5