ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-w3xw-rq95-8jcw: Integer underflow in Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 might allow remote peers to cause a denial of service or possibly obtain sensitive information from memory or execute arbitrary code via a crafted message.
CVSS v3.0: 9.8
GHSA-25f3-wx76-5pq5: Under certain heavy traffic conditions srxpfe process can crash and result in a denial of service condition for the SRX1500 device. Repeated crashes of the srxpfe can result in an extended denial of service condition. The SRX device may fail to forward traffic when this condition occurs. Affected releases are Juniper Networks Junos OS: 15.1X49 versions prior to 15.1X49-D170 on SRX1500; 17.3 versions prior to 17.3R3-S7 on SRX1500; 17.4 versions prior to 17.4R2-S8, 17.4R3 on SRX1500; 18.1 versions prior to 18.1R3-S8 on SRX1500; 18.2 versions prior to 18.2R3 on SRX1500; 18.3 versions prior to 18.3R2 on SRX1500; 18.4 versions prior to 18.4R2 on SRX1500.
CVE-2023-2745: WordPress Core < 6.2.1 - Directory Traversal
WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthenticated attackers to access and load arbitrary translation files. In cases where an attacker is able to upload a crafted translation file onto the site, such as via an upload form, this could be also used to perform a Cross-Site Scripting attack.
CVSS v3.1: 5.4
CVE-2025-63002: WordPress Sermon Manager plugin <= 2.30.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in wpforchurch Sermon Manager sermon-manager-for-wordpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sermon Manager: from n/a through <= 2.30.0.
CVSS v3.1: 5.3
GHSA-6f8p-6cw3-m7m5: SQL injection vulnerability in index.php in the PNphpBB2 1.2i and earlier module for PostNuke allows remote attackers to execute arbitrary SQL commands via the c parameter.
GHSA-j8h4-v947-5h7q: When parsing the header for a DHAV file, there's an integer underflow in offset calculation that leads to reading the duration from before the start of the allocated buffer.If we load a DHAV file that is larger than MAX_DURATION_BUFFER_SIZE bytes (0x100000) for example 0x101000 bytes, then at [0] we have size = 0x101000. At [1] we have end_buffer_size = 0x100000, and at [2] we have end_buffer_pos = 0x1000.The loop then scans backwards through the buffer looking for the dhav tag; when it is found, we'll calculate end_pos based on a 32-bit offset read from the buffer.There is subsequently a check [3] that end_pos is within the section of the file that has been copied into end_buffer, but it only correctly handles the cases where end_pos is before the start of the file or after the section copied into end_buffer, and not the case where end_pos is within the the file, but before the section copied into end_buffer. If we provide such an offset, (end_pos - end_buffer_pos) can underflow, resulting in the subsequent access at [4] occurring before the beginning of the allocation.We recommend upgrading to version 8.0 or beyond.
CVSS v4.0: 5.7
CVE-2022-30917: H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the AddWlanMacList parameter at /goform/aspForm.
CVSS v3.1: 9.8
CVSS v2.0: 10
CVE-2026-20839: Windows Client-Side Caching (CSC) Service Information Disclosure Vulnerability
Improper access control in Windows Client-Side Caching (CSC) Service allows an authorized attacker to disclose information locally.
CVSS v3.1: 5.5
CVE-2022-29339: In GPAC 2.1-DEV-rev87-g053aae8-master, function BS_ReadByte() in utils/bitstream.c has a failed assertion, which causes a Denial of Service. This vulnerability was fixed in commit 9ea93a2.
CVSS v3.1: 7.5
CVSS v2.0: 5
RHSA-2015:1187: Red Hat Security Advisory: rh-php56-php security update
php: buffer over-read in Phar metadata parsing php: invalid pointer free() in phar_tar_process_metadata() php: buffer overflow in phar_set_inode() php: pipelined request executed in deinitialized interpreter under httpd 2.4 php: missing null byte checks for paths in various PHP extensions php: missing null byte checks for paths in various PHP extensions php: memory corruption in phar_parse_tarfile caused by empty entry file name php: integer overflow leading to heap overflow when reading FTP file listing php: multipart/form-data request parsing CPU usage DoS php: regressions in 5.4+ php: pcntl_exec() accepts paths with NUL character php: missing null byte checks for paths in DOM and GD extensions php: Incomplete Class unserialization type confusion php: exception:: getTraceAsString type confusion issue after unserialize php: denial of service when processing a crafted file with Fileinfo php: denial of service when processing a crafted file with Fileinfo php: integer overflow in ftp_genlist() resulting in heap overflow (improved fix for CVE-2015-4022) php: NULL pointer dereference in php_pgsql_meta_data()
CVE-2024-0711: Buttons Shortcode and Widget <= 1.16 - Stored XSS via shortcode
The Buttons Shortcode and Widget WordPress plugin through 1.16 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS v3.1: 6.1
CVE-2022-0932: Missing Authorization in saleor/saleor
Missing Authorization in GitHub repository saleor/saleor prior to 3.1.2.
CVSS v3.0: 6.5
GHSA-v5rp-5hx5-3vwq: The WPBookit plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.2. This is due to the plugin not properly validating a user's identity prior to updating their details like email through the edit_newdata_customer_callback() function. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
CVSS v3.1: 9.8
CVE-2026-34154: Discourse has a subscription access bypass in its discourse-subscriptions plugin
Discourse is an open-source discussion platform. In versions prior to 2026.1.4, 2026.3.1, 2026.4.1 and 2026.5.0-latest.1, a  vulnerability in the discourse-subscriptions plugin allows users to gain access to subscription-gated groups without completing payment. This issue has been fixed in versions 2026.1.4, 2026.3.1, 2026.4.1 and 2026.5.0-latest.1.
CVSS v4.0: 2.1
CVE-2008-0001: VFS in the Linux kernel before 2.6.22.16, and 2.6.23.x before 2.6.23.14, performs tests of access mode by using the flag variable instead of the acc_mode variable, which might allow local users to bypass intended permissions and remove directories.
CVSS v2.0: 3.6
CVE-2025-23983: WordPress Tijaji theme <= 1.43 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tijaji Tijaji tijaji allows Reflected XSS.This issue affects Tijaji: from n/a through <= 1.43.
CVSS v3.1: 7.1
CVE-2014-1984: Session fixation vulnerability in the management screen in Cybozu Remote Service Manager through 2.3.0 and 3.x before 3.1.1 allows remote attackers to hijack web sessions via unspecified vectors.
CVSS v2.0: 6.8
CVE-2018-1420: IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 resets access control settings to the out of the box configuration during Combined Cumulative Fix (CF) installation. This can lead to security miss-configuration of the installation. IBM X-Force ID: 138950.
CVSS v3.0: 5.3
GHSA-79f9-xgx6-3cfm: Various Lexmark products through 2022-04-27 allow External Control of a System or Configuration Setting because of Improper Input Validation.
CVSS v3.1: 8.1
GHSA-r857-cr62-xfr8: The Red_Reservations script for ColdFusion stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database via a direct request to (1) makered.mdb and (2) makered97.mdb.
GHSA-qj44-5xwc-3wgw: CRE Loaded before 6.2.14 allows remote attackers to bypass authentication and gain administrator privileges via vectors related to a modified PHP_SELF variable, which is not properly handled by (1) includes/application_top.php and (2) admin/includes/application_top.php.
GHSA-5fq3-f6hq-jcc4: Unspecified vulnerability in Oracle MySQL Server 5.6.15 and earlier allows remote authenticated users to affect availability via unknown vectors related to Privileges.
CVE-2024-13173: Health information leakage vulnerability
The health module has insufficient restrictions on loading URLs, which may lead to some information leakage.
CVSS v4.0: 6.3
CVE-2026-12312: Memory safety bug fixed in Firefox 152
Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
GHSA-vv3h-7qwr-722v: Anytype Heart's gRPC API client challenge verification can be bypassed on localhost
ImpactThe challenge-based authentication for the local gRPC client API can be bypassed, allowing an attacker to gain access without the 4-digit code.Affected components:Anytype Desktop (all platforms) ≤ v0.48.2Anytype-CLI (headless deployments) ≤ v0.1.9Not affected:Anytype mobile apps (iOS, Android) - do not expose a local gRPC serverWho is impacted:
This vulnerability is scoped to localhost. The gRPC and gRPC-Web ports bind to 127.0.0.1 only and are not exposed to the local network or internet.Exploitation requires:Local user-level access to the machine running AnytypeDiscovery of the randomized listening portA running Anytype instanceAnytype-CLI headless deployments may be at higher risk only if an administrator has chosen to set up their own reverse proxy and configured it in a way that
exposes gRPC or gRPC-Web ports to an external network. **By default, these ports are not externally accessible and there is no built-in mechanism to expose them.**Patchesanytype-heart library: v0.48.4[Anytype Desktop](https://github.com/anyproto/anytype-ts): v0.54.5[Anytype-CLI](https://github.com/anyproto/anytype-cli): v0.1.11WorkaroundsDesktop users: No immediate action required. The vulnerability requires existing local access to the machine.Anytype-CLI administrators: If using a custom reverse proxy, ensure it does not expose gRPC or gRPC-Web ports to external networks.
CVSS v3.1: 3.6
GHSA-7v6v-vcfr-7g4f: The WP show more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's show_more shortcode in all versions up to, and including, 1.0.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
GHSA-8279-9gqq-prr4: libavformat/movenc.c in FFmpeg before 4.0.2 allows attackers to cause a denial of service (application crash caused by a divide-by-zero error) with a user crafted Waveform audio file.
CVSS v3.0: 6.5
GHSA-qgqj-ghq4-h994: REDDOXX MailDepot 2032 2.2.1242 allows authenticated users to access the mailboxes of other users.
GHSA-w89h-p889-cfjq: Multiple SQL injection vulnerabilities in ASP Portal allow remote attackers to execute arbitrary SQL commands via the (1) ItemID parameter to classifieds.asp and the (2) ID parameter to Events.asp.
CVE-2025-23956: WordPress WP Easy Post Mailer Plugin <= 0.64 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Richard Leishman WP Easy Post Mailer wp-mailer allows Reflected XSS.This issue affects WP Easy Post Mailer: from n/a through <= 0.64.
CVSS v3.1: 7.1
GHSA-2cqh-xmv5-vp25: In the Linux kernel, the following vulnerability has been resolved:HSI: omap_ssi: Fix refcount leak in ssi_probeWhen returning or breaking early from a
for_each_available_child_of_node() loop, we need to explicitly call
of_node_put() on the child node to possibly release the node.
CVE-2024-3110: Stored XSS leading to admin account takeover in mintplex-labs/anything-llm
A stored Cross-Site Scripting (XSS) vulnerability exists in the mintplex-labs/anything-llm application, affecting versions up to and including the latest before 1.0.0. The vulnerability arises from the application's failure to properly sanitize and validate user-supplied URLs before embedding them into the application UI as external links with custom icons. Specifically, the application does not prevent the inclusion of 'javascript:' protocol payloads in URLs, which can be exploited by a user with manager role to execute arbitrary JavaScript code in the context of another user's session. This flaw can be leveraged to steal the admin's authorization token by crafting malicious URLs that, when clicked by the admin, send the token to an attacker-controlled server. The attacker can then use this token to perform unauthorized actions, escalate privileges to admin, or directly take over the admin account. The vulnerability is triggered when the malicious link is opened in a new tab using either the CTRL + left mouse button click or the mouse scroll wheel click, or in some non-updated versions of modern browsers, by directly clicking on the link.
CVSS v3.0: 7.3
RHSA-2018:1666: Red Hat Security Advisory: libvirt security update
hw: cpu: speculative store bypass
CVSS v3.0: 5.6
CVE-2025-69103: WordPress Brikk theme <= 3.0.0 - Arbitrary Content Deletion vulnerability
Subscriber Arbitrary Content Deletion in Brikk <= 3.0.0 versions.
CVSS v3.1: 7.5
GHSA-g2fh-2pjf-f9ww: The Goto WordPress theme before 2.1 did not properly sanitize the formvalue JSON POST parameter in its tl_filter AJAX action, leading to an unauthenticated Reflected Cross-site Scripting (XSS) vulnerability.
GHSA-5x5v-mm9r-g2xm: The Editor in IBM ENOVIA SmarTeam 5 before release 18 SP5, and release 19 before SP01, allows remote authenticated users to bypass intended access restrictions and read Document objects via the Workflow Process (aka Flow Process) view.
CVE-2026-20042: Cisco Nexus Dashboard Configuration REST API Unauthorized Access Vulnerability
A vulnerability in the configuration backup feature of Cisco Nexus Dashboard could allow an attacker who has the encryption password and access to Full or Config-only backup files to access sensitive information.

This vulnerability exists because authentication details are included in the encrypted backup files. An attacker with a valid backup file and encryption password from an affected device could decrypt the backup file. The attacker could then use the authentication details in the backup file to access internal-only APIs on the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system as the root user.
CVSS v3.1: 6.5
GHSA-p7qh-jxmh-67r6: The gst_mpegts_section_new function in the mpegts decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a too small section.
CVSS v3.0: 7.5
GHSA-fcmx-4fpp-mg5q: A weakness has been identified in SourceCodester Inventory Management System 1.0. The affected element is an unknown function of the file /model/user/resetPassword.php. Executing manipulation can lead to weak password recovery. The attack may be performed from remote. The exploit has been made available to the public and could be exploited.
CVSS v4.0: 5.5
CVSS v3.1: 5.3
RHSA-2021:1350: Red Hat Security Advisory: thunderbird security update
Mozilla: More internal network hosts could have been probed by a malicious webpage Mozilla: Out of bound write due to lazy initialization Mozilla: Use-after-free in Responsive Design Mode Mozilla: Secure Lock icon could have been spoofed Mozilla: Blob URLs may have been granted additional privileges Mozilla: Arbitrary FTP command execution on FTP servers using an encoded URL Mozilla: Incorrect size computation in WebAssembly JIT could lead to null-reads Mozilla: Port blocking could be bypassed Mozilla: Race condition when reading from disk while verifying signatures
CVSS v3.1: 2.5
CVSS v3.0: 6.1
CVE-2025-0691: Improper access control in permissions component in Devolutions Server 2025.1.10.0 and earlier allows an authenticated user to bypass the "Edit permission" permission by bypassing the client side validation.
CVSS v3.1: 5
CVE-2025-52993: A race condition in the Nix, Lix, and Guix package managers enables changing the ownership of arbitrary files to the UID and GID of the build user (e.g., nixbld* or guixbuild*). This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.
CVSS v3.1: 5.6
GHSA-5fgw-rv54-prjx: A vulnerability exists where a connection requiring TLS incorrectly reuses an
existing unencrypted connection from the same connection pool. If an initial
transfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request
to that same host bypasses the TLS requirement and instead transmit data
unencrypted.
CVSS v3.1: 5.9
CVE-2010-0547: client/mount.cifs.c in mount.cifs in smbfs in Samba 3.4.5 and earlier does not verify that the (1) device name and (2) mountpoint strings are composed of valid characters, which allows local users to cause a denial of service (mtab corruption) via a crafted string.
CVSS v2.0: 2.1
CVE-2021-45440: A unnecessary privilege vulnerability in Trend Micro Apex One and Trend Micro Worry-Free Business Security 10.0 SP1 (on-prem versions only) could allow a local attacker to abuse an impersonation privilege and elevate to a higher level of privileges. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS v3.1: 7.8
CVSS v2.0: 7.2
CVE-2009-1990: Unspecified vulnerability in the Business Intelligence Enterprise Edition component in Oracle Application Server 10.1.3.4.1 allows local users to affect confidentiality via unknown vectors.
CVSS v2.0: 1.7
GHSA-269r-2rrv-62mq: Kerio MailServer 5.0 allows remote attackers to cause a denial of service (hang) via SYN packets to the supported network services.
PYSEC-2024-13: Apache Airflow, versions before 2.8.1, have a vulnerability that allows a potential attacker to poison the XCom data by bypassing the protection of "enable_xcom_pickling=False" configuration setting resulting in poisoned data after XCom deserialization. This vulnerability is considered low since it requires a DAG author to exploit it. Users are recommended to upgrade to version 2.8.1 or later, which fixes this issue.
CVE-2026-41962: Permission control vulnerability in the app management and control module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS v3.1: 3.6
GHSA-gxhj-h2vr-cfxw: An uncontrolled resource consumption vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to launch a denial-of-service (DoS) attack.We have already fixed the vulnerability in the following versions:
QTS 5.0.1.2277 and later
QTS 4.5.4.2280 build 20230112 and later
QuTS hero h5.0.1.2277 build 20230112 and later
QuTS hero h4.5.4.2374 build 20230417 and later
QuTScloud c5.0.1.2374 and later
CVSS v3.1: 6.8
CVE-2017-14357: A Reflected and Stored Cross-Site Scripting (XSS) vulnerability in HP ArcSight ESM and HP ArcSight ESM Express, in any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1. This vulnerability could be exploited remotely to allow Reflected and Stored Cross-Site Scripting (XSS)
CVSS v3.0: 6.1
CVSS v2.0: 4.3
CVE-2017-10972: Uninitialized data in endianness conversion in the XEvent handling of the X.Org X Server before 2017-06-19 allowed authenticated malicious users to access potentially privileged data from the X server.
CVSS v3.0: 6.5
CVSS v2.0: 4
GHSA-xw84-2x9q-x3m5: SQL injection vulnerability in plugins.php in BMForum 5.6, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the tagname parameter.
CVE-2024-2362: Path Traversal in parisneo/lollms-webui
A path traversal vulnerability exists in the parisneo/lollms-webui version 9.3 on the Windows platform. Due to improper validation of file paths between Windows and Linux environments, an attacker can exploit this vulnerability to delete any file on the system. The issue arises from the lack of adequate sanitization of user-supplied input in the 'del_preset' endpoint, where the application fails to prevent the use of absolute paths or directory traversal sequences ('..'). As a result, an attacker can send a specially crafted request to the 'del_preset' endpoint to delete files outside of the intended directory.
CVSS v3.0: 9.1
CVE-2023-44083: A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0009), Tecnomatix Plant Simulation V2302 (All versions < V2302.0003). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the current process.
CVSS v3.1: 7.8
GHSA-p3gm-xxh4-xjmg: An OS command injection vulnerability in Hardy Barth cPH2 eCharge Ladestation v1.87.0 and earlier, may allow an unauthenticated remote attacker to execute arbitrary commands on the system via a specifically crafted arguments passed to the connectivity check feature.
CVSS v3.1: 9.8
CVE-2026-30953: LinkAce affected by SSRF via link creation: NoPrivateIpRule not applied to LinkStoreRequest
LinkAce is a self-hosted archive to collect website links. When a user creates a link via POST /links, the server fetches HTML metadata from the provided URL (LinkRepository::create() calls HtmlMeta::getFromUrl()). The LinkStoreRequest validation rules do not include NoPrivateIpRule, allowing server-side requests to internal network addresses, Docker service hostnames, and cloud metadata endpoints. The project already has a NoPrivateIpRule class (app/Rules/NoPrivateIpRule.php) but it is only applied in FetchController.php (line 99), not in the primary link creation path.
CVSS v3.1: 7.7
CVE-2025-12359: Responsive Lightbox & Gallery <= 2.5.3 - Authenticated (Author+) Server-Side Request Forgery
The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.5.3 via the 'get_image_size_by_url' function. This is due to insufficient validation of user-supplied URLs when determining image dimensions for gallery items. This makes it possible for authenticated attackers, with Author-level access and above, to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.
CVSS v3.1: 5.4
GHSA-gmx3-jm7j-288w: Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC).  Supported versions that are affected are Prior to 9.2.9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
CVSS v3.1: 6.1
CVE-2004-2547: NetWin (1) SurgeMail before 2.0c and (2) WebMail allow remote attackers to obtain sensitive information via HTTP requests that (a) specify the / URI, (b) specify the /scripts/ URI, or (c) specify a non-existent file, which reveal the path in an error message.
CVSS v2.0: 2.6
CVE-2022-0608: Integer overflow in Mojo in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS v3.1: 8.8
CVSS v2.0: 6.8