ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2020-23162: Sensitive information disclosure and weak encryption in Pyrescom Termod4 time management devices before 10.04k allows remote attackers to read a session-file and obtain plain-text user credentials.
CVSS v3.1: 7.5
CVSS v2.0: 5
GHSA-hw6r-g8gj-2987: Actions expression injection in `filter-test-configs` (`GHSL-2023-181`)
The `pytorch/pytorch` `filter-test-configs` workflow is vulnerable to an expression injection in Actions, allowing an attacker to potentially leak secrets and alter the repository using the workflow.DetailsThe [`filter-test-configs`](https://github.com/pytorch/pytorch/blob/ec26947c586dd323d741da80008403664c533f65/.github/actions/filter-test-configs/action.yml) workflow is using the raw `github.event.workflow_run.head_branch` value inside the `filter` step:In the event of a repository using `filter-test-configs` in a `pull_request_target`-triggered workflow, an attacker could use a malicious branch name to gain command execution in the step and potentially leak secrets.ImpactThis issue may lead to stealing workflow secrets.RemediationUse an intermediate environment variable for potentially attacker-controlled values such as `github.event.workflow_run.head_branch`:Resources[CodeQL for JavaScript - Expression injection in Actions](https://codeql.github.com/codeql-query-help/javascript/js-actions-command-injection/)[Keeping your GitHub Actions and workflows secure Part 2: Untrusted input](https://securitylab.github.com/research/github-actions-untrusted-input/)[Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/)
GHSA-v933-vx5p-j7w2: OpenStack Oslo utility sensitive information exposure via log files
The strutils.mask_password function in the OpenStack Oslo utility library, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 does not properly mask passwords when logging commands, which allows local users to obtain passwords by reading the log.
CVE-2000-0285: Buffer overflow in XFree86 3.3.x allows local users to execute arbitrary commands via a long -xkbmap parameter.
CVSS v2.0: 7.2
GHSA-ghw7-hv89-j7jq: The PressPrimer Quiz – AI Quiz Maker, Exam Builder & LMS Assessment Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.3.0 via the 'rule_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with custom-level access and above, to modify or delete quiz rules belonging to other teachers, resulting in unauthorized tampering of another user's quiz structure.
CVSS v3.1: 4.3
CVE-2023-46931: GPAC 2.3-DEV-rev605-gfc9e29089-master contains a heap-buffer-overflow in ffdmx_parse_side_data /afltest/gpac/src/filters/ff_dmx.c:202:14 in gpac/MP4Box.
CVSS v3.1: 5.5
CVE-2024-12696: Picture Gallery – Frontend Image Uploads, AJAX Photo List <= 1.5.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via videowhisper_picture_upload_guest Shortcode
The Picture Gallery – Frontend Image Uploads, AJAX Photo List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's videowhisper_picture_upload_guest shortcode in all versions up to, and including, 1.5.22 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
CVE-2004-0046: Cross-site scripting (XSS) vulnerability in SnapStream PVS LITE allows remote attackers to inject arbitrary web script or HTML via a GET request containing a terminating '"' (double quote) character.
CVSS v2.0: 4.3
GHSA-86f9-hf9f-rqq8: IBM Maximo Asset Management 6.2 through 6.2.8, 7.1 before 7.1.1.12, and 7.5 before 7.5.0.5 allows remote authenticated users to gain privileges via unspecified vectors, a different vulnerability than CVE-2013-5382.
GHSA-9fmm-h42j-4wpj: getcwd() file descriptor leak in FTP.
GHSA-544v-xg79-7jv5: An elevation of privilege vulnerability exists in the way that the Connected Devices Platform Service handles objects in memory, aka 'Connected Devices Platform Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0740, CVE-2020-0742, CVE-2020-0743, CVE-2020-0749, CVE-2020-0750.
CVE-2022-34306: IBM CICS TX Standard and Advanced 11.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 229435.
CVSS v3.0: 5.4
CVE-2012-4451: Multiple cross-site scripting (XSS) vulnerabilities in Zend Framework 2.0.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified input to (1) Debug, (2) Feed\PubSubHubbub, (3) Log\Formatter\Xml, (4) Tag\Cloud\Decorator, (5) Uri, (6) View\Helper\HeadStyle, (7) View\Helper\Navigation\Sitemap, or (8) View\Helper\Placeholder\Container\AbstractStandalone, related to Escaper.
CVSS v3.1: 6.1
CVSS v2.0: 4.3
CVE-2023-37759: Incorrect access control in the User Registration page of Crypto Currency Tracker (CCT) before v9.5 allows unauthenticated attackers to register as an Admin account via a crafted POST request.
CVSS v3.1: 9.8
GHSA-p44q-vqpr-4xmg: Flask-HTTPAuth invokes token verification callback when missing or empty token was given by client
SummaryIn a situation where the client makes a request to a token protected resource without passing a token, or passing an empty token, Flask-HTTPAuth would invoke the application's token verification callback function with the `token` argument set to an empty string. If the application had any users in its database with an empty string set as their token, then it could potentially authenticate the client request against any of those users.NotesThis issue applies only to token authenticationThis issue applies only when the application verifies tokens by searching for them in a user database.This issue applies only if the application stores empty strings as user tokens when the user does not have an assigned token. It does not apply if the application sets those tokens to `NULL` instead.Tokens that are verified through cryptographic means (such as JWTs) are not affected by this issue.Basic and Digest authentication are not affected by this issue.RemediationTo protect against this issue, developers should make sure that no user in the user database has their `token` set to an empty string. If there are such users, change the value of those tokens to `NULL` instead.Alternatively, developers can upgrade their projects to `Flask-HTTPAuth>=4.8.1`, which fixes this issue.
CVSS v3.1: 6.5
GHSA-w3xh-p84j-v7qw: A vulnerability exists in BIG-IP systems that may allow an authenticated attacker with administrative access to escalate their privileges. A successful exploit may allow the attacker to cross a security boundary.Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS v4.0: 7.1
CVSS v3.1: 6.7
CVE-2019-18446: An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.4. It has Insecure Permissions (issue 1 of 2).
CVSS v3.1: 4.3
CVSS v2.0: 5.5
PYSEC-2021-258: TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of `tf.raw_ops.SparseDenseCwiseDiv` is vulnerable to a division by 0 error. The [implementation](https://github.com/tensorflow/tensorflow/blob/a1bc56203f21a5a4995311825ffaba7a670d7747/tensorflow/core/kernels/sparse_dense_binary_op_shared.cc#L56) uses a common class for all binary operations but fails to treat the division by 0 case separately. We have patched the issue in GitHub commit d9204be9f49520cdaaeb2541d1dc5187b23f31d9. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
GHSA-4468-gjjg-mh5q: The LDAP Authentication functionality in Foreman might allow remote attackers with knowledge of old passwords to gain access via vectors involving the password lifetime period in Active Directory.
CVSS v3.0: 8.1
CVE-2026-32751: SiYuan Vulnerable to Remote Code Execution via Stored XSS in Notebook Name - Mobile Interface
SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the mobile file tree (MobileFiles.ts) renders notebook names via innerHTML without HTML escaping when processing renamenotebook WebSocket events. The desktop version (Files.ts) properly uses escapeHtml() for the same operation. An authenticated user who can rename notebooks can inject arbitrary HTML/JavaScript that executes on any mobile client viewing the file tree. Since Electron is configured with nodeIntegration: true and contextIsolation: false, the injected JavaScript has full Node.js access, escalating stored XSS to full remote code execution. The mobile layout is also used in the Electron desktop app when the window is narrow, making this exploitable on desktop as well. This issue has been fixed in version 3.6.1.
CVSS v4.0: 5.1
CVE-2024-35804: KVM: x86: Mark target gfn of emulated atomic instruction as dirty
In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Mark target gfn of emulated atomic instruction as dirty

When emulating an atomic access on behalf of the guest, mark the target
gfn dirty if the CMPXCHG by KVM is attempted and doesn't fault.  This
fixes a bug where KVM effectively corrupts guest memory during live
migration by writing to guest memory without informing userspace that the
page is dirty.

Marking the page dirty got unintentionally dropped when KVM's emulated
CMPXCHG was converted to do a user access.  Before that, KVM explicitly
mapped the guest page into kernel memory, and marked the page dirty during
the unmap phase.

Mark the page dirty even if the CMPXCHG fails, as the old data is written
back on failure, i.e. the page is still written.  The value written is
guaranteed to be the same because the operation is atomic, but KVM's ABI
is that all writes are dirty logged regardless of the value written.  And
more importantly, that's what KVM did before the buggy commit.

Huge kudos to the folks on the Cc list (and many others), who did all the
actual work of triaging and debugging.

base-commit: 6769ea8da8a93ed4630f1ce64df6aafcaabfce64
CVSS v3.1: 5.5
RHSA-2025:18814: Red Hat Security Advisory: java-1.8.0-openjdk security update
openjdk: Enhance certificate handling (Oracle CPU 2025-10) openjdk: Enhance Path Factories (Oracle CPU 2025-10)
CVSS v3.1: 4.8
CVE-2022-44519: Acrobat Reader | Use After Free (CWE-416)
Acrobat Reader DC version 22.001.20085 (and earlier), 20.005.3031x (and earlier) and 17.012.30205 (and earlier) are affected by a use-after-free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 5.5
GHSA-7xp2-7hw7-rv8q: The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce tokens early enough in the request lifecycle, allowing attackers to make logged in users perform unwanted actions leading to remote code execution.
CVSS v3.1: 8.8
CVE-2022-21999: Windows Print Spooler Elevation of Privilege Vulnerability
Windows Print Spooler Elevation of Privilege Vulnerability
CVSS v3.1: 7.8
CVE-2025-22414: In FrpBypassAlertActivity of FrpBypassAlertActivity.java, there is a possible way to bypass FRP due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1: 7.8
RHSA-2013:1507: Red Hat Security Advisory: java-1.7.0-ibm security update
OpenJDK: java.util.TimeZone does not restrict setting of default time zone (Libraries, 8001029) JDK: unspecified sandbox bypass (JVM) JDK: XML4J xml entity expansion excessive memory use (XML) JDK: unspecified sandbox bypass (XML) JDK: unspecified sandbox bypass (ORB) JDK: unspecified sandbox bypass (ORB) JDK: unspecified sandbox bypass (XML) OpenJDK: insufficient html escaping in jhat (jhat, 8011081) OpenJDK: Inet6Address class IPv6 address processing errors (Libraries, 8015743) JDK: unspecified vulnerability fixed in 7u45 (Deployment) OpenJDK: image conversion out of bounds read (2D, 8014102) OpenJDK: key data leak via toString() methods (Libraries, 8011071) OpenJDK: Incorrect awt_getPixelByte/awt_getPixelShort/awt_setPixelByte/awt_setPixelShort image raster checks (2D, 8014093) OpenJDK: JTable not properly performing certain access checks (Swing, 8013744) OpenJDK: insufficient InterfaceImplementor security checks (Scripting, 8017299) JDK: unspecified vulnerability fixed in 7u45 (Deployment) JDK: unspecified vulnerability fixed in 7u45 (Deployment) JDK: unspecified vulnerability fixed in 7u45 (Deployment) OpenJDK: insufficient security checks (Beans, 8012071) OpenJDK: insufficient escaping of window title string (Javadoc, 8016675) OpenJDK: default keytab path information leak (JGSS, 8022931) JDK: unspecified vulnerability fixed in 7u45 (2D) OpenJDK: javax.xml.transform.TransformerFactory does not properly honor XMLConstants.FEATURE_SECURE_PROCESSING (JAXP, 8012425) OpenJDK: insufficient checks of KDC replies (JGSS, 8014341) OpenJDK: javac does not ignore certain ignorable characters (Javadoc, 8016653) OpenJDK: JPEGImageReader and JPEGImageWriter missing band size checks (2D, 8013510) JDK: unspecified vulnerability fixed in 7u45 (Deployment) OpenJDK: RMIConnection stub missing permission check (CORBA, 8011157) OpenJDK: VersionHelper12 does not honor modifyThreadGroup restriction (JNDI, 8013739) JDK: unspecified vulnerability fixed in 7u45 (Deployment) JDK: unspecified vulnerability fixed in 7u45 (Deployment) OpenJDK: insufficient security checks (JAXWS, 8017505) OpenJDK: com.sun.org.apache.xml.internal.security.utils.UnsyncByteArrayOutputStream Denial of Service (Security, 8021290) JDK: unspecified vulnerability fixed in 7u45 (Deployment) OpenJDK: XML parsing Denial of Service (JAXP, 8014530) OpenJDK: Java2d Disposer security bypass (2D, 8017287) OpenJDK: checkPackageAccess missing security check (Libraries, 8017291) JDK: unspecified vulnerability fixed in 7u45 (Deployment) JDK: unspecified vulnerability fixed in 7u45 (Deployment) OpenJDK: Vulnerability in Libraries component (Libraries, 7023639) OpenJDK: getDeclaringClass() information leak (Libraries, 8014349) OpenJDK: ObjectInputStream/ObjectOutputStream missing checks (Libraries, 8014987) JDK: unspecified vulnerability fixed in 7u45 (2D) JDK: unspecified vulnerability fixed in 7u45 (Deployment) OpenJDK: insufficient DataFlavor security checks (AWT, 8012277) OpenJDK: Missing CORBA security checks (Libraries, 8017196) OpenJDK: XML stream factory finder information leak (JAXP, 8013502)
CVE-2024-2436: Lightweight Accordion <= 1.5.16 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
The Lightweight Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.5.16 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
GHSA-244x-f55f-vxmr: IBM Security Verify Privilege On-Premises 11.5 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser.  This information could be used in further attacks against the system.  IBM X-Force ID:  240454.
CVSS v3.1: 2.7
GHSA-p3g3-qcxj-gm4g: A vulnerability, which was classified as critical, has been found in MaxD Lightning Module 4.43 on OpenCart. This issue affects some unknown processing. The manipulation of the argument li_op/md leads to deserialization. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 2.3
CVSS v3.1: 5
CVE-2025-64085: A NULL pointer dereference vulnerability in the importDataObject() function of PDF-XChange Editor v10.7.3.401 allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS v3.1: 6.5
CVE-2012-3901: The updateTime function in sensorApp on Cisco IPS 4200 series sensors 7.0 and 7.1 allows remote attackers to cause a denial of service (process crash and traffic-inspection outage) via network traffic, aka Bug ID CSCta96144.
CVSS v2.0: 5
CVE-2017-7081: An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
CVSS v3.0: 8.8
CVSS v2.0: 6.8
CVE-2019-12579: A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux and macOS could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The PIA Linux/macOS binary openvpn_launcher.64 binary is setuid root. This binary accepts several parameters to update the system configuration. These parameters are passed to operating system commands using a "here" document. The parameters are not sanitized, which allow for arbitrary commands to be injected using shell metacharacters. A local unprivileged user can pass special crafted parameters that will be interpolated by the operating system calls.
CVSS v3.0: 7.8
CVSS v2.0: 7.2
CVE-2025-49533: Adobe Experience Manager (MS) | Deserialization of Untrusted Data (CWE-502)
Adobe Experience Manager (MS) versions 6.5.23.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could lead to arbitrary code execution by an attacker. Exploitation of this issue does not require user interaction. Scope is unchanged.
CVSS v3.1: 9.8
CVE-2021-30787: This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.5, Security Update 2021-004 Catalina, Security Update 2021-005 Mojave. An application may be able to cause unexpected system termination or write kernel memory.
CVSS v3.1: 7.8
CVSS v2.0: 6.8
GHSA-x4wc-gh9m-xgxw: FlexRIC v2.0.0 contains an authorization bypass in the iApp's xApp isolation mechanism. The equality function eq_xapp_ric_gen_id() in src/ric/iApp/xapp_ric_id.c compares m0->xapp_id against itself (m0->xapp_id) instead of the other argument (m1->xapp_id), effectively ignoring the xApp identity dimension. A malicious xApp connected to the iApp (port 36422) can delete any other xApp's subscriptions by sending an E42_RIC_SUBSCRIPTION_DELETE_REQUEST with a matching ric_gen_id. This breaks multi-tenant isolation in any deployment with multiple xApps sharing the same RIC.
CVSS v3.1: 7.5
GHSA-2hw3-28v7-q78p: Cross-site scripting (XSS) vulnerability in Microsoft Windows SharePoint Services 3.0 SP2, and SharePoint Foundation 2010 Gold and SP1, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters in a request to a script, aka "Contact Details Reflected XSS Vulnerability."
CVE-2021-42302: Azure RTOS Elevation of Privilege Vulnerability
Azure RTOS Elevation of Privilege Vulnerability
CVSS v3.1: 6.6
GHSA-7j7w-r8q7-jxh2: The Microsoft (1) JScript and (2) VBScript engines, as used in Internet Explorer 11, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability."
CVSS v3.0: 8.8
GHSA-pp57-mqmh-44h7: Command Injection in macaddress
All versions of `macaddress` are vulnerable to command injection. For this vulnerability to be exploited an attacker needs to control the `iface` argument to the `one` method.RecommendationUpdate to version 0.2.9 or later.
CVSS v3.0: 9.8
CVE-2024-52275: Denial of Service on Tenda AC6V2 Due To Stack Overflow
Stack-based Buffer Overflow vulnerability in Shenzhen Tenda Technology Co Tenda AC6V2 (fromWizardHandle modules) allows Overflow Buffers.This issue affects Tenda AC6V2: through 15.03.06.50.
CVSS v4.0: 8.3
GHSA-xq2x-f6m4-2hrp: In the Linux kernel, the following vulnerability has been resolved:ext4: drop extent cache after doing PARTIAL_VALID1 zerooutWhen splitting an unwritten extent in the middle and converting it to
initialized in ext4_split_extent() with the EXT4_EXT_MAY_ZEROOUT and
EXT4_EXT_DATA_VALID2 flags set, it could leave a stale unwritten extent.Assume we have an unwritten file and buffered write in the middle of it
without dioread_nolock enabled, it will allocate blocks as written
extent.ext4_split_extent() first try to split this extent at B with
EXT4_EXT_DATA_PARTIAL_VALID1 and EXT4_EXT_MAY_ZEROOUT flag set, but
ext4_split_extent_at() failed to split this extent due to temporary lack
of space. It zeroout B to N and leave the entire extent as unwritten.ext4_split_extent() then try to split this extent at A with
EXT4_EXT_DATA_VALID2 flag set. This time, it split successfully and
leave an written extent from A to N.Finally ext4_map_create_blocks() only insert extent A to B to the extent
status tree, and leave an stale unwritten extent in the status tree.Fix this issue by always cached extent status entry after zeroing out
the second part.
CVSS v3.1: 5.5
CVE-2021-46699: A vulnerability has been identified in Simcenter Femap (All versions < V2022.1.1). Affected application contains a stack based buffer overflow vulnerability while parsing specially crafted BDF files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-15061)
CVSS v3.1: 7.8
CVSS v2.0: 6.8
GHSA-g7vw-43xg-8m4h: SQL injection in Liferay Portal
SQL injection vulnerability in the upgrade process for SQL Server in Liferay Portal 7.3.1 through 7.4.3.17, and Liferay DXP 7.3 before update 6, and 7.4 before update 18 allows attackers to execute arbitrary SQL commands via the name of a database table's primary key index. This vulnerability is only exploitable when chained with other attacks. To exploit this vulnerability, the attacker must modify the database and wait for the application to be upgraded.
CVSS v3.1: 8.1
CVE-2026-2750: Command Injection via CLAPI generatetraps
Improper Input Validation vulnerability in Centreon Centreon Open Tickets on Central Server on Linux (Centreon Open Tickets modules).This issue affects Centreon Open Tickets on Central Server: from all before 25.10; 24.10;24.04.
CVSS v3.1: 9.1
GHSA-3489-8qg3-xgj4: This issue was addressed by removing additional entitlements. This issue is fixed in GarageBand 10.4.3. A local attacker may be able to read sensitive information.
PYSEC-2026-529: Directory traversal vulnerability in recv_file method allows arbitrary files to be written to the master cache directory.
CVSS v3.1: 9.6
GHSA-mq8g-hxpm-gp2h: There are stack-based buffer overflow vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
CVSS v3.1: 9.8