ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2025-47564: WordPress EventON plugin <= 4.9.8 - Broken Access Control vulnerability
Missing Authorization vulnerability in ashanjay EventON eventon allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects EventON: from n/a through <= 4.9.8.
CVSS v3.1: 5.3
CVE-2025-54197: Substance3D - Modeler | Out-of-bounds Read (CWE-125)
Substance3D - Modeler versions 1.22.0 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 5.5
GHSA-vxv4-vwqg-hwh9: The Perl fingerd program allows arbitrary command execution from remote users.
CVE-2024-40996: bpf: Avoid splat in pskb_pull_reason
In the Linux kernel, the following vulnerability has been resolved:

bpf: Avoid splat in pskb_pull_reason

syzkaller builds (CONFIG_DEBUG_NET=y) frequently trigger a debug
hint in pskb_may_pull.

We'd like to retain this debug check because it might hint at integer
overflows and other issues (kernel code should pull headers, not huge
value).

In bpf case, this splat isn't interesting at all: such (nonsensical)
bpf programs are typically generated by a fuzzer anyway.

Do what Eric suggested and suppress such warning.

For CONFIG_DEBUG_NET=n we don't need the extra check because
pskb_may_pull will do the right thing: return an error without the
WARN() backtrace.
CVSS v3.1: 7.8
GHSA-3f48-9j7q-q2gv: NI MeasurementLink Python Services Improper Access Restriction vulnerability
ImpactAn improper access restriction in NI MeasurementLink Python services could allow an attacker on an adjacent network to reach services exposed on localhost.  These services were previously thought to be unreachable outside of the node.  This affects measurement plug-ins written in Python using version 1.1.0 of the `ni-measurementlink-service` Python package and all previous versions.PatchesUpgrade all Python measurement plug-ins to use `ni-measurementlink-service` version 1.1.1 or later.ReferencesVisit [ni.com/info](http://www.ni.com/info) and enter the info code `cve-2023-4570` for more information.
CVSS v3.1: 8.8
CVE-2025-28354: An issue in the Printer Manager Systm of Entrust Corp Printer Manager D3.18.4-3 and below allows attackers to execute a directory traversal via a crafted POST request.
CVSS v3.1: 6.5
CVE-2023-1263: CMP – Coming Soon & Maintenance Plugin by NiteoThemes <= 4.1.6 - Information Exposure
The CMP – Coming Soon & Maintenance plugin for WordPress is vulnerable to Information Exposure in versions up to, and including, 4.1.6  via the cmp_get_post_detail function. This can allow unauthenticated individuals to obtain the contents of any non-password-protected, published post or page even when maintenance mode is enabled.
CVSS v3.1: 5.3
CVE-2025-49480: Out-of-bounds access in lte-telephony
Out-of-bounds access in ASR180x 、ASR190x  in lte-telephony,  This vulnerability is associated with program files apps/lzma/src/LzmaEnc.c.

This issue affects Falcon_Linux、Kestrel、Lapwing_Linux: before v1536.
CVSS v3.1: 7.4
GHSA-5277-qw9c-vxf6: The D2DownloadService.getDownloadUrls service method in EMC Documentum D2 4.1 and 4.2 before 4.2 P16 and 4.5 before P03 allows remote authenticated users to conduct Documentum Query Language (DQL) injection attacks and bypass intended read-access restrictions via unspecified vectors.
GHSA-h3v3-xfmw-m7mg: Dell EMC PowerProtect Cyber Recovery, version 19.7.0.1, contains an Information Disclosure vulnerability. A locally authenticated high privileged Cyber Recovery user may potentially exploit this vulnerability leading to the takeover of the notification email account.
GHSA-5vh5-r999-h6wp: Squid before 4.4, when SNMP is enabled, allows a denial of service (Memory Leak) via an SNMP packet.
CVSS v3.0: 5.9
GHSA-83cg-48p4-2hxg: Use after free in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally.
CVSS v3.1: 7
RHSA-2025:1664: Red Hat Security Advisory: bind security update
bind: bind9: Many records in the additional section cause CPU exhaustion
CVSS v3.1: 7.5
CVE-2005-3089: Firefox 1.0.6 allows attackers to cause a denial of service (crash) via a Proxy Auto-Config (PAC) script that uses an eval statement. NOTE: it is not clear whether an untrusted party has any role in triggering this issue, so it might not be a vulnerability.
CVSS v2.0: 2.6
CVE-2017-16632: In SapphireIMS 4097_1, the password in the database is stored in Base64 format.
CVSS v3.1: 7.5
CVSS v2.0: 5
GHSA-5499-9jhv-ccm9: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation VisualEditor. This vulnerability is associated with program files src/ce/ve.Ce.ClipboardHandler.Js.This issue affects VisualEditor: from * before 1.39.14, 1.43.4, 1.44.1.
CVSS v4.0: 0
CVSS v3.1: 6.1
GHSA-2w8c-hj6v-28vw: A maliciously crafted pskernel.dll file in Autodesk products is used to trigger integer overflow vulnerabilities. Exploitation of these vulnerabilities may lead to code execution.
CVSS v3.1: 7.8
CVE-2022-21787: In audio DSP, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06558844; Issue ID: ALPS06558844.
CVSS v3.1: 6.7
CVSS v2.0: 4.6
CVE-2016-3680: Buffer overflow in the Wi-Fi driver in Huawei Mate 8 NXT-AL before NXT-AL10C00B182, NXT-CL before NXT-CL00C92B182, NXT-DL before NXT-DL00C17B182, and NXT-TL before NXT-TL00C01B182 allows attackers to cause a denial of service (crash) or possibly gain privileges via a crafted application, aka HWPSIRT-2016-03020.
CVSS v3.0: 7.8
CVSS v2.0: 9.3
GHSA-vj42-43ch-3xp2: In AndroidManifest.xml, there is a possible persistent denial of service due to a missing permission check. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v4.0: 10
CVSS v3.1: 5.5
CVE-2020-37168: Ecommerce Systempay 1.0 Production Key Brute Force
Ecommerce Systempay 1.0 contains a weak cryptographic implementation vulnerability that allows attackers to brute force the 16-character production secret key used for payment signature generation. Attackers can extract payment form data and signatures from POST requests to the payment endpoint, then use SHA1 hash comparison to iteratively test key candidates until discovering the correct production key, enabling them to forge valid payment signatures and manipulate transaction amounts.
CVSS v4.0: 9.3
CVSS v3.1: 9.8
CVE-2014-1243: Apple QuickTime before 7.7.5 does not initialize an unspecified pointer, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted track list in a movie file.
CVSS v2.0: 9.3
CVE-2006-5897: Multiple directory traversal vulnerabilities in PhpMyChat Plus 1.9 and earlier allow remote attackers to read arbitrary files via a .. (dot dot) in the ChatPath parameter to (1) avatar.php, (2) colorhelp_popup.php, (3) color_popup.php, (4) index.php, (5) index1.php, (6) lib/connected_users.lib.php, (7) lib/index.lib.php, and (8) phpMyChat.php3; and the (9) L parameter to logs.php.  NOTE: CVE analysis suggests that vector 1 might be incorrect.
CVSS v2.0: 5
CVE-2007-0735: Use-after-free vulnerability in Libinfo in Apple Mac OS X 10.3.9 through 10.4.9 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors involving crafted web pages that trigger certain error conditions that are not properly reported in certain circumstances, resulting in accessing deallocated memory.
CVSS v2.0: 9.3
GHSA-34r7-q49f-h37c: Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js
Versions of `uglify-js` prior to 2.4.24 are affected by a vulnerability which may cause crafted JavaScript to have altered functionality after minification.RecommendationUpgrade UglifyJS to version >= 2.4.24.
CVSS v3.1: 9.8
CVE-2024-8336: SourceCodester Music Gallery Site Master.php sql injection
A vulnerability classified as critical was found in SourceCodester Music Gallery Site 1.0. Affected by this vulnerability is an unknown functionality of the file /php-music/classes/Master.php?f=delete_music. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
CVE-2014-2019: The iCloud subsystem in Apple iOS before 7.1 allows physically proximate attackers to bypass an intended password requirement, and turn off the Find My iPhone service or complete a Delete Account action and then associate this service with a different Apple ID account, by entering an arbitrary iCloud Account Password value and a blank iCloud Account Description value.
CVSS v3.1: 4.6
CVSS v2.0: 4.9
CVE-2021-20130: ManageEngine ADManager Plus Build 7111 contains a post-authentication remote code execution vulnerability due to improperly validated file uploads in the PasswordExpiry interface.
CVSS v3.1: 8.8
CVSS v2.0: 6.5
RHSA-2005:802: Red Hat Security Advisory: xloadimage security update
security flaw
CVE-2024-0452: AI ChatBot <= 5.3.4 - Missing Authorization via openai_file_upload_callback
The AI ChatBot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the openai_file_upload_callback function in all versions up to, and including, 5.3.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files to a linked OpenAI account.
CVSS v3.1: 5
CVE-2020-29457: A Privilege Elevation vulnerability in OPC UA .NET Standard Stack 1.4.363.107 could allow a rogue application to establish a secure connection.
CVSS v3.1: 4.4
CVSS v2.0: 2.1
GHSA-2r6r-f3xv-whcp: The Elegant Themes Divi theme, Extra theme, and Divi Page Builder plugin for WordPress are vulnerable to DOM-Based Stored Cross-Site Scripting via the ‘title’ parameter in versions up to, and including, 4.25.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
GHSA-qxpg-92h3-8vjc: Missing Authorization vulnerability in PressTigers Simple Job Board allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Job Board: from n/a through 2.10.5.
CVSS v3.1: 5.3
GHSA-gg2r-3wrr-86p6: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Tapandsign Technologies Software Inc. Tap&Sign allows Cross-Site Scripting (XSS).This issue affects Tap&Sign: through 23012026.NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v3.1: 4.7
CVE-2010-2129: Directory traversal vulnerability in the JE Ajax Event Calendar (com_jeajaxeventcalendar) component 1.0.1 and 1.0.3 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter to index.php.  NOTE: some of these details are obtained from third party information.
CVSS v2.0: 6.8
GHSA-3r9q-7hff-7fm4: OpenPLC_V3 is vulnerable to an Initialization of a Resource with an Insecure Default vulnerability which could allow an attacker to gain access to the system by bypassing authentication via an API.
CVSS v4.0: 9.2
CVSS v3.1: 9.8
CVE-2025-68256: staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser
In the Linux kernel, the following vulnerability has been resolved:

staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser

The Information Element (IE) parser rtw_get_ie() trusted the length
byte of each IE without validating that the IE body (len bytes after
the 2-byte header) fits inside the remaining frame buffer. A malformed
frame can advertise an IE length larger than the available data, causing
the parser to increment its pointer beyond the buffer end. This results
in out-of-bounds reads or, depending on the pattern, an infinite loop.

Fix by validating that (offset + 2 + len) does not exceed the limit
before accepting the IE or advancing to the next element.

This prevents OOB reads and ensures the parser terminates safely on
malformed frames.
GHSA-qhfg-3j7q-77q7: EXFO - BV-10 Performance Endpoint Unit Undocumented privileged user. Unit has an undocumented hard-coded privileged user.
CVSS v3.1: 9.8
GHSA-973x-65j7-xcf4: Decompressors can crash the JVM and leak memory content in Aircompressor
SummaryAll decompressor implementations of Aircompressor (LZ4, LZO, Snappy, Zstandard) can crash the JVM for certain input, and in some cases also leak the content of other memory of the Java process (which could contain sensitive information).DetailsWhen decompressing certain data, the decompressors try to access memory outside the bounds of the given byte arrays or byte buffers. Because Aircompressor uses the JDK class `sun.misc.Unsafe` to speed up memory access, no additional bounds checks are performed and this has similar security consequences as out-of-bounds access in C or C++, namely it can lead to non-deterministic behavior or crash the JVM.Users should update to Aircompressor 0.27 or newer where these issues have been fixed.ImpactWhen decompressing data from untrusted users, this can be exploited for a denial-of-service attack by crashing the JVM, or to leak other sensitive information from the Java process.
CVSS v3.1: 8.6
GHSA-5qj9-gxv6-5gjr: Multiple cross-site scripting (XSS) vulnerabilities in Kmita Gallery allow remote attackers to inject arbitrary web script or HTML via the (1) begin parameter to index.php and the (2) searchtext parameter to search.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVE-2016-1965: Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 mishandle a navigation sequence that returns to the original page, which allows remote attackers to spoof the address bar via vectors involving the history.back method and the location.protocol property.
CVSS v3.0: 4.3
CVSS v2.0: 4.3
GHSA-qrvm-x4ph-76fj: In the Linux kernel, the following vulnerability has been resolved:net: dsa: clean up FDB, MDB, VLAN entries on unbindAs explained in many places such as commit b117e1e8a86d ("net: dsa:
delete dsa_legacy_fdb_add and dsa_legacy_fdb_del"), DSA is written given
the assumption that higher layers have balanced additions/deletions.
As such, it only makes sense to be extremely vocal when those
assumptions are violated and the driver unbinds with entries still
present.But Ido Schimmel points out a very simple situation where that is wrong:
https://lore.kernel.org/netdev/ZDazSM5UsPPjQuKr@shredder/
(also briefly discussed by me in the aforementioned commit).Basically, while the bridge bypass operations are not something that DSA
explicitly documents, and for the majority of DSA drivers this API
simply causes them to go to promiscuous mode, that isn't the case for
all drivers. Some have the necessary requirements for bridge bypass
operations to do something useful - see dsa_switch_supports_uc_filtering().Although in tools/testing/selftests/net/forwarding/local_termination.sh,
we made an effort to popularize better mechanisms to manage address
filters on DSA interfaces from user space - namely macvlan for unicast,
and setsockopt(IP_ADD_MEMBERSHIP) - through mtools - for multicast, the
fact is that 'bridge fdb add ... self static local' also exists as
kernel UAPI, and might be useful to someone, even if only for a quick
hack.It seems counter-productive to block that path by implementing shim
.ndo_fdb_add and .ndo_fdb_del operations which just return -EOPNOTSUPP
in order to prevent the ndo_dflt_fdb_add() and ndo_dflt_fdb_del() from
running, although we could do that.Accepting that cleanup is necessary seems to be the only option.
Especially since we appear to be coming back at this from a different
angle as well. Russell King is noticing that the WARN_ON() triggers even
for VLANs:
https://lore.kernel.org/netdev/Z_li8Bj8bD4-BYKQ@shell.armlinux.org.uk/What happens in the bug report above is that dsa_port_do_vlan_del() fails,
then the VLAN entry lingers on, and then we warn on unbind and leak it.This is not a straight revert of the blamed commit, but we now add an
informational print to the kernel log (to still have a way to see
that bugs exist), and some extra comments gathered from past years'
experience, to justify the logic.
CVSS v3.1: 5.5
CVE-2024-47238: Dell Client Platform BIOS contains an Improper Input Validation vulnerability in an externally developed component. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary code execution.
CVSS v3.1: 7.5
CVE-2025-66678: An issue in the HwRwDrv.sys component of Nil Hardware Editor Hardware Read & Write Utility v1.25.11.26 and earlier allows attackers to execute arbitrary read and write operations via a crafted request.
CVSS v3.1: 9.8
RHSA-2023:5526: Red Hat Security Advisory: bind security update
bind: stack exhaustion in control channel code may lead to DoS
CVSS v3.1: 7.5
GHSA-22r4-f9q2-4m9g: In TrustZone in all Android releases from CAF using the Linux kernel, an Information Exposure vulnerability could potentially exist.
CVSS v3.0: 5.5
GHSA-9f22-7vh5-xpww: In JetBrains TeamCity before 2021.2, blind SSRF via an XML-RPC call was possible.
CVE-2023-32215: Mozilla developers and community members Gabriele Svelto, Andrew Osmond, Emily McDonough, Sebastian Hengst, Andrew McCreight and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 112 and Firefox ESR 102.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11.
CVSS v3.1: 8.8
CVE-2016-6327: drivers/infiniband/ulp/srpt/ib_srpt.c in the Linux kernel before 4.5.1 allows local users to cause a denial of service (NULL pointer dereference and system crash) by using an ABORT_TASK command to abort a device write operation.
CVSS v3.0: 5.5
CVSS v2.0: 4.9
CVE-2026-34536: iccDEV: SO in SIccCalcOp::ArgsUsed()
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, a crafted ICC profile can trigger a stack overflow (SO) in SIccCalcOp::ArgsUsed(). The issue is observable under AddressSanitizer as a stack-overflow when iccApplyProfiles processes a malicious profile, with the crash occurring while computing argument usage during calculator underflow/overflow checks. This issue has been patched in version 2.3.1.6.
CVSS v3.1: 6.2
GHSA-mq6c-qgpj-jw78: Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have a Heap Overflow vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVSS v3.0: 8.8
CVE-2019-2102: In the Bluetooth Low Energy (BLE) specification, there is a provided example Long Term Key (LTK). If a BLE device were to use this as a hardcoded LTK, it is theoretically possible for a proximate attacker to remotely inject keystrokes on a paired Android host due to improperly used crypto. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-128843052.
CVSS v3.0: 8.8
CVSS v2.0: 8.3
GHSA-p4vc-pp2h-cfvh: The Custom Post Type UI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.18.0. This is due to the plugin not verifying that a user has the required capability to perform actions in the "cptui_process_post_type" function. This makes it possible for authenticated attackers, with subscriber level access and above, to add, edit, or delete custom post types in limited situations.
CVSS v3.1: 4.8
GHSA-m5vx-8chx-qvmm: Form validation can be skipped
ImpactBy crafting a special `GET` request containing a valid form state, a form can be submitted without invoking any validators.
We consider the severity _low_ because it is not possible to _change_ any form values since the form state is secured with an HMAC that is still verified.
That means that this issue can only be exploited if Form Finishers cause side effects even if no form values have been sent.Patcheshttps://github.com/neos/form/commit/69de4219b1f58157e2be6b05811463875d75c246WorkaroundsForm Finishers can be adjusted in a way that they only execute an action if the submitted form contains some expected data.
Alternatively a custom Finisher can be added as first finisher.ReferencesThis regression was introduced with https://github.com/neos/form/commit/049d415295be8d4a0478ccba97dba1bb81649567
Original report: https://tickets.neos.io/#ticket/zoom/411 (internal)
CVSS v3.1: 6.5
CVE-2025-54622: Binding authentication bypass vulnerability in the devicemanager module.
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS v3.1: 8.3
GHSA-m7f4-5qv5-c37g: SQL injection vulnerability in h_goster.asp in Turuncu Portal 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
RHSA-2024:1188: Red Hat Security Advisory: kernel security, bug fix, and enhancement update
kernel: out-of-bounds write in hw_atl_utils_fw_rpc_wait() in drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c kernel: use-after-free in tc_new_tfilter() in net/sched/cls_api.c kernel: use-after-free when psi trigger is destroyed while being polled kernel: memory leak in drivers/hid/hid-elo.c kernel: u8 overflow problem in cfg80211_update_notlisted_nontrans() kernel: use-after-free in bss_ref_get in net/wireless/scan.c kernel: BSS list corruption in cfg80211_add_nontrans_list in net/wireless/scan.c kernel: Denial of service in beacon protection for P2P-device kernel: KVM: x86/mmu: race condition in direct_page_fault() kernel: x86/mm: Randomize per-cpu entry area kernel: Out-Of-Bounds Read vulnerability in smbCalcSize kernel: refcount leak in ctnetlink_create_conntrack() kernel: use-after-free during a race condition between a nonblocking atomic commit and a driver unload in drivers/gpu/drm/drm_atomic.c kernel: CIFS Filesystem Decryption Improper Input Validation Remote Code Execution Vulnerability in function receive_encrypted_standard of client
CVSS v3.1: 6.8
GHSA-7rhj-8m83-26xf: Twonky Server before 8.5.1 has XSS via a modified "language" parameter in the Language section.
CVSS v3.0: 6.1
GHSA-6w85-2w93-mrpr: In the Linux kernel, the following vulnerability has been resolved:speakup: Fix sizeof() vs ARRAY_SIZE() bugThe "buf" pointer is an array of u16 values.  This code should be
using ARRAY_SIZE() (which is 256) instead of sizeof() (which is 512),
otherwise it can the still got out of bounds.
CVSS v3.1: 5.3
GHSA-2fmp-7xwf-wvwr: Arbitrary File Read in Snyk Broker
All versions of snyk-broker after 4.72.0 including and before 4.73.1 are vulnerable to Arbitrary File Read. It allows arbitrary file reads to users with access to Snyk's internal network of any files ending in the following extensions: yaml, yml or json.
CVSS v3.1: 6.5
CVE-2012-1864: win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly handle user-mode input passed to kernel mode for driver objects, which allows local users to gain privileges via a crafted application, aka "String Atom Class Name Handling Vulnerability," a different vulnerability than CVE-2012-1865.
CVSS v2.0: 7.2
GHSA-679m-g3c6-mvxp: Unknown vulnerability in Sun Management Center (SunMC) 2.1.1, 3.0, and 3.0 Revenue Release (RR), when installed and run by root, allows local users to create or modify arbitrary files.