ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-c846-hjc5-6vmf: SQL injection vulnerability in admin/login.php in SaphpLesson 4.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the cp_username parameter, related to an error in the CleanVar function in includes/functions.php.
GHSA-vxmv-rwgj-8gm6: KMC Controls BAC-5051E devices with firmware before E0.2.0.2 allow remote attackers to bypass intended access restrictions and read a configuration file via unspecified vectors.
CVSS v3.0: 5.3
CVE-2025-28907: WordPress WP Last Modified plugin <= 0.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rahul Arora WP Last Modified wp-last-modified allows Stored XSS.This issue affects WP Last Modified: from n/a through <= 0.1.
CVSS v3.1: 5.9
CVE-2019-19203: An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function gb18030_mbc_enc_len in file gb18030.c, a UChar pointer is dereferenced without checking if it passed the end of the matched string. This leads to a heap-based buffer over-read.
CVSS v3.1: 7.5
CVSS v2.0: 5
CVE-2011-0793: Unspecified vulnerability in the Database Vault component in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, and 11.2.0.1 allows remote authenticated users to affect integrity and availability, related to SYSDBA.
CVSS v2.0: 3.6
GHSA-3xg2-xc64-45gg: Multiple buffer overflows in EMC AutoStart 5.3.x and 5.4.x before 5.4.3 allow remote attackers to cause a denial of service (agent crash) or possibly execute arbitrary code via crafted packets.
CVE-2022-31624: MariaDB Server before 10.7 is vulnerable to Denial of Service. While executing the plugin/server_audit/server_audit.c method log_statement_ex, the held lock lock_bigbuffer is not released correctly, which allows local users to trigger a denial of service due to the deadlock.
CVSS v3.1: 5.5
CVSS v2.0: 2.1
CVE-2024-46078: itsourcecode Sports Management System Project 1.0 is vulnerable to SQL Injection in the function delete_category of the file sports_scheduling/player.php via the argument id.
CVSS v3.1: 7.5
CVE-2021-1654: Windows CSC Service Elevation of Privilege Vulnerability
Windows CSC Service Elevation of Privilege Vulnerability
CVSS v3.1: 7.8
GHSA-hg6g-jj7g-x6v2: Improper Neutralization of Input During Web Page Generation in Jenkins
In Jenkins 2.196 and earlier, LTS 2.176.3 and earlier, the f:expandableTextBox form control interpreted its content as HTML when expanded, resulting in a stored XSS vulnerability exploitable by users with permission to define its contents (typically Job/Configure).
CVSS v3.1: 5.4
CVE-2008-6230: SQL injection vulnerability in Tour.php in Pre Projects Pre Podcast Portal allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS v2.0: 7.5
CVE-2004-0580: DHCP on Linksys BEFSR11, BEFSR41, BEFSR81, and BEFSRU31 Cable/DSL Routers, firmware version 1.45.7, does not properly clear previously used buffer contents in a BOOTP reply packet, which allows remote attackers to obtain sensitive information.
CVSS v2.0: 5
GHSA-hxvf-rx4m-qx26: Ecava IntegraXor before 4.1.4393 allows remote attackers to read cleartext credentials for administrative accounts via SELECT statements that leverage the guest role.
CVE-2025-22891: BIG-IP PEM Vulnerability
When BIG-IP PEM Control Plane listener Virtual Server is configured with Diameter Endpoint profile, undisclosed traffic can cause the Virtual Server to stop processing new client connections and an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS v4.0: 8.7
CVSS v3.1: 7.5
GHSA-xwxg-r73m-j39w: The easy-pdf-restaurant-menu-upload plugin before 1.1.2 for WordPress has XSS.
CVSS v3.0: 6.1
GHSA-8c8m-j65f-9vjw: The procfs code (proc_misc.c) in Linux 2.6.14.3 and other versions before 2.6.15 allows attackers to read sensitive kernel memory via unspecified vectors in which a signed value is added to an unsigned value.
GHSA-qfcf-2jfw-4cm8: Qt 5.0.0 through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from QRasterPaintEngine::fill and QPaintEngineEx::stroke).
CVSS v3.1: 7.5
GHSA-8r66-vg6c-x88h: NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause improper processing of input data. A successful exploit of this vulnerability might lead to information disclosure or denial of service.
CVSS v3.1: 5.7
RHSA-2020:0250: Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP1 Security Update
httpd: URL normalization inconsistency curl: double free due to subsequent call of realloc() curl: heap buffer overflow in function tftp_receive_packet()
CVSS v3.0: 6.3
CVE-2024-54775: Dcat-Admin v2.2.0-beta and v2.2.2-beta contains a Cross-Site Scripting (XSS) vulnerability via /admin/auth/menu and /admin/auth/extensions.
CVSS v3.1: 4.8
GHSA-62m4-8mv5-x4gc: tpm2-tools versions before 1.1.1 are vulnerable to a password leak due to transmitting password in plaintext from client to server when generating HMAC.
CVSS v3.0: 7.5
GHSA-333x-jcc3-m545: Remote Desktop Commander Suite Agent before v4.8 contains an unquoted service path which allows attackers to escalate privileges to the system level.
CVSS v3.1: 7.8
GHSA-hrh3-rvrh-p2vg: An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is an out-of-bounds read in the SDL function SDL_FreePalette_REAL at video/SDL_pixels.c.
CVSS v3.0: 6.5
RHSA-2013:0270: Red Hat Security Advisory: jakarta-commons-httpclient security update
jakarta-commons-httpclient: missing connection hostname check against X.509 certificate name
CVSS v3.0: 3.7
GHSA-p5mp-qv23-7r77: In the Linux kernel, the following vulnerability has been resolved:ceph: fix multifs mds auth caps issueThe mds auth caps check should also validate the
fsname along with the associated caps. Not doing
so would result in applying the mds auth caps of
one fs on to the other fs in a multifs ceph cluster.
The bug causes multiple issues w.r.t user
authentication, following is one such example.Steps to Reproduce (on vstart cluster):Create two file systems in a cluster, say 'fsname1' and 'fsname2'Authorize read only permission to the user 'client.usr' on fs 'fsname1'
 $ceph fs authorize fsname1 client.usr / rAuthorize read and write permission to the same user 'client.usr' on fs 'fsname2'
 $ceph fs authorize fsname2 client.usr / rwUpdate the keyring
 $ceph auth get client.usr >> ./keyringWith above permssions for the user 'client.usr', following is the
expectation.
  a. The 'client.usr' should be able to only read the contents
     and not allowed to create or delete files on file system 'fsname1'.
  b. The 'client.usr' should be able to read/write on file system 'fsname2'.But, with this bug, the 'client.usr' is allowed to read/write on file
system 'fsname1'. See below.Mount the file system 'fsname1' with the user 'client.usr'
  $sudo bin/mount.ceph usr@.fsname1=/ /kmnt_fsname1_usr/Try creating a file on file system 'fsname1' with user 'client.usr'. This
should fail but passes with this bug.
  $touch /kmnt_fsname1_usr/file1Mount the file system 'fsname1' with the user 'client.admin' and create a
file.
  $sudo bin/mount.ceph admin@.fsname1=/ /kmnt_fsname1_admin
  $echo "data" > /kmnt_fsname1_admin/admin_file1Try removing an existing file on file system 'fsname1' with the user
'client.usr'. This shoudn't succeed but succeeds with the bug.
  $rm -f /kmnt_fsname1_usr/admin_file1For more information, please take a look at the corresponding mds/fuse patch
and tests added by looking into the tracker mentioned below.v2: Fix a possible null dereference in doutc
v3: Don't store fsname from mdsmap, validate against
    ceph_mount_options's fsname and use it
v4: Code refactor, better warning message and
    fix possible compiler warning[ Slava.Dubeyko: "fsname check failed" -> "fsname mismatch" ]
CVE-2021-42276: Microsoft Windows Media Foundation Remote Code Execution Vulnerability
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
CVSS v3.1: 7.8
CVE-2019-17205: TeamPass 2.1.27.36 allows Stored XSS by placing a payload in the username field during a login attempt. When an administrator looks at the log of failed logins, the XSS payload will be executed.
CVSS v3.1: 6.1
CVSS v2.0: 4.3
GHSA-w8m5-hwqp-jg84: Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS v3.1: 5.4
GHSA-wr2j-q648-w99g: An issue was discovered in __split_huge_pmd in mm/huge_memory.c in the Linux kernel before 5.7.5. The copy-on-write implementation can grant unintended write access because of a race condition in a THP mapcount check, aka CID-c444eb564fb1.
CVSS v3.1: 7
GHSA-cvpp-rmjx-5x2m: Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product incorrectly permits CRLF to be skipped to delimit chunk boundaries.
CVSS v3.1: 5.4
GHSA-5x4j-m9qh-g9w5: A heap-based buffer overflow vulnerability exists in the sphere.c start_read() functionality of Sound Exchange libsox 14.4.2 and master commit 42b3557e. A specially-crafted file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
CVSS v3.1: 8.8
CVE-2021-20986: Hilscher: Denial of Service vulnerability in PROFINET IO Device
A Denial of Service vulnerability was found in Hilscher PROFINET IO Device V3 in versions prior to V3.14.0.7. This may lead to unexpected loss of cyclic communication or interruption of acyclic communication.
CVSS v3.1: 7.5
PYSEC-2025-198: In PyTorch through 2.6.0, when eager is used, nn.PairwiseDistance(p=2) produces incorrect results.
CVSS v3.1: 5.3
GHSA-9rpr-p9f6-2hhx: Buffer overflow in Vixie cron allows local users to gain root access via a long MAILTO environment variable in a crontab file.
CVE-2025-48575: In multiple functions of CertInstaller.java, there is a possible way to install certificates due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1: 7.8
GHSA-j8g4-37fg-mjm8: In the Linux kernel, the following vulnerability has been resolved:Bluetooth: vhci: Prevent use-after-free by removing debugfs files earlyMove the creation of debugfs files into a dedicated function, and ensure
they are explicitly removed during vhci_release(), before associated
data structures are freed.Previously, debugfs files such as "force_suspend", "force_wakeup", and
others were created under hdev->debugfs but not removed in
vhci_release(). Since vhci_release() frees the backing vhci_data
structure, any access to these files after release would result in
use-after-free errors.Although hdev->debugfs is later freed in hci_release_dev(), user can
access files after vhci_data is freed but before hdev->debugfs is
released.
CVSS v3.1: 7.8
CVE-2021-44416: A denial of service vulnerability exists in the cgiserver.cgi JSON command parser functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a reboot. Disconnect param is not object. An attacker can send an HTTP request to trigger this vulnerability.
CVSS v3.0: 8.6
GHSA-m2f9-5jc5-2m56: The SPIN - Motion Comic (aka me.narr8.android.serial.spin) application 2.1.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2020-8195: Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 resulting in limited information disclosure to low privileged users.
CVSS v3.1: 6.5
CVSS v2.0: 4
GHSA-rxqc-fvv8-gx29: WebKit, as used in Apple iOS before 9.2.1 and Safari before 9.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-1725 and CVE-2016-1726.
CVSS v3.0: 8.8
GHSA-q972-cgwg-346f: Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality via unknown vectors related to Test Manager for Web Apps, a different vulnerability than CVE-2016-0480, CVE-2016-0482, CVE-2016-0485, and CVE-2016-0486.  NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the DownloadServlet servlet, which allows remote attackers to read arbitrary files via directory traversal sequences in the scheduleReportName parameter.
CVE-2024-32326: TOTOLINK EX200 V4.0.3c.7646_B20201211 contains a Cross-site scripting (XSS) vulnerability through the key parameter in the setWiFiExtenderConfig function.
CVSS v3.1: 6.8
GHSA-pmc5-779q-c8wv: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in saragna Saragna allows Reflected XSS.This issue affects Saragna: from n/a through 1.0.
CVSS v3.1: 7.1
GHSA-c2x2-vr52-6vjr: Use after free in Aura in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVSS v3.1: 8.3
GHSA-vrcg-pvvv-j5fm: Misys FusionCapital Opics Plus allows remote authenticated users to gain privileges via a man-in-the-middle attack that modifies the xmlMessageOut parameter.
CVSS v3.0: 7.5
CVE-2020-1250: Win32k Information Disclosure Vulnerability
<p>An information disclosure vulnerability exists when the win32k component improperly provides kernel information. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system.</p>
<p>To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.</p>
<p>The security update addresses the vulnerability by correcting how win32k handles objects in memory.</p>
CVSS v3.1: 5.5
PYSEC-2026-262: NASA AIT-Core v2.5.2 was discovered to contain multiple SQL injection vulnerabilities via the `query_packets` and `insert` functions.
CVSS v4.0: 9.3
CVSS v3.1: 9.8
CVE-2019-1010169: Jsish 2.4.77 2.0477 is affected by: Out-of-bounds Read. The impact is: denial of service. The component is: function lexer_getchar (jsiLexer.c:9). The attack vector is: executing crafted javascript code. The fixed version is: 2.4.78.
CVSS v3.0: 7.5
CVSS v2.0: 5
CVE-2025-13227: Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS v3.1: 8.8
CVE-2025-57973: WordPress WP-Members Plugin <= 3.5.4.2 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chad Butler WP-Members wp-members allows Stored XSS.This issue affects WP-Members: from n/a through <= 3.5.4.2.
CVSS v3.1: 5.5
CVE-2024-3728: Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery & Interactive Circle
The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Filterable Gallery & Interactive Circle widgets in all versions up to, and including, 5.9.15 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
GHSA-j4v3-5jgp-v85f: Multiple cross-site scripting (XSS) vulnerabilities in post.asp in CodeAvalanche FreeForum (aka CAForum) 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) msg_subject and (2) msg_body parameters.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVE-2025-26652: Windows Standards-Based Storage Management Service Denial of Service Vulnerability
Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network.
CVSS v3.1: 7.5
GHSA-3r5r-hrfx-93qm: The GiveWP plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.20.2 via the /donor-wall REST-API endpoint which provides unauthenticated users with donor information even when the donor wall is not enabled. This functionality has been completely removed in version 2.20.2.
CVSS v3.1: 5.3
RHSA-2021:2147: Red Hat Security Advisory: glib2 security update
glib: integer overflow in g_bytes_new function on 64-bit platforms due to an implicit cast from 64 bits to 32 bits
CVSS v3.1: 9.8
CVE-2024-5439: Blocksy <= 2.0.50 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Blocksy theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the custom_url parameter in all versions up to, and including, 2.0.50 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS v3.1: 6.4
CVE-2005-1610: Cross-site scripting (XSS) vulnerability in security.php for Tru-Zone NukeET 3.0 and 3.1 allows remote attackers to inject arbitrary web script or HTML via a base64 encoded Codigo parameter.
CVSS v2.0: 6.8
GHSA-v2vr-c36c-45r4: In WODESYS WD-R608U router (also known as WDR122B V2.0 and WDR28) due to lack of authentication in the configuration change module in the adm.cgi endpoint, the unauthenticated attacker can execute commands including backup creation, device restart and resetting the device to factory settings.The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version WDR28081123OV1.01 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
CVSS v4.0: 8.7
GHSA-r33h-4w36-wx5h: Memory corruption while accessing a synchronization object during concurrent operations.
CVSS v3.1: 6.7
CVE-2021-1558: Cisco DNA Spaces Connector Privilege Escalation Vulnerabilities
Multiple vulnerabilities in Cisco DNA Spaces Connector could allow an authenticated, local attacker to elevate privileges and execute arbitrary commands on the underlying operating system as root. These vulnerabilities are due to insufficient restrictions during the execution of affected CLI commands. An attacker could exploit these vulnerabilities by leveraging the insufficient restrictions during execution of these commands. A successful exploit could allow the attacker to elevate privileges from dnasadmin and execute arbitrary commands on the underlying operating system as root.
CVSS v3.1: 6
CVE-2022-1843: MailPress  <= 7.2.1 - Arbitrary Settings Update & Log Files Purge via CSRF
The MailPress WordPress plugin through 7.2.1 does not have CSRF checks in various places, which could allow attackers to make a logged in admin change the settings, purge log files and more via CSRF attacks
CVSS v3.1: 6.5
CVSS v2.0: 4.3
CVE-2018-8204: A security feature bypass vulnerability exists in Device Guard that could allow an attacker to inject malicious code into a Windows PowerShell session, aka "Device Guard Code Integrity Policy Security Feature Bypass Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8200.
CVSS v3.0: 5.3
CVSS v2.0: 4.6
CVE-2024-57176: An issue in the shiroFilter function of White-Jotter project v0.2.2 allows attackers to execute a directory traversal and access sensitive endpoints via a crafted URL.
CVSS v3.1: 7.6
GHSA-jc7v-m8xx-gcf7: ecard.php in Coppermine Photo Gallery (CPG) 1.5.46 has XSS via the sender_name, recipient_email, greetings, or recipient_name parameter.
GHSA-jpmq-qfmj-5ch7: The embedded Linux kernel in certain Sun-Brocade SilkWorm switches before 20070516 does not properly handle a situation in which a non-root user creates a kernel process, which allows attackers to cause a denial of service (oops and device reboot) via unspecified vectors.
CVE-2024-45109: Photoshop Desktop | Out-of-bounds Write (CWE-787)
Photoshop Desktop versions 24.7.4, 25.11 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 7.8
CVE-2013-4810: HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager (IDM) 4.0, and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled object to (1) EJBInvokerServlet or (2) JMXInvokerServlet, aka ZDI-CAN-1760. NOTE: this is probably a duplicate of CVE-2007-1036, CVE-2010-0738, and/or CVE-2012-0874.
CVSS v3.1: 9.8
CVSS v2.0: 10
GHSA-qwfw-vm52-pf89: IBM Storage Virtualize 8.4, 8.5, 8.6, and 8.7 could allow an authenticated user to escalate their privileges in an SSH session due to incorrect authorization checks to access resources.
CVSS v3.1: 8.8
GHSA-84gw-f25v-grqx: Mozilla developers reported memory safety bugs present in Firefox 82 and Firefox ESR 78.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5.
CVE-2025-6294: code-projects Hostel Management System contact.php sql injection
A vulnerability was found in code-projects Hostel Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /contact.php. The manipulation of the argument hostel_name leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 6.9
CVSS v3.1: 7.3
CVSS v3.0: 7.3
CVSS v2.0: 7.5
CVE-2023-5146: D-Link DAR-7000/DAR-8000 updatelib.php unrestricted upload
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000 and DAR-8000 up to 20151231 and classified as critical. Affected by this issue is some unknown functionality of the file /sysmanage/updatelib.php. The manipulation of the argument file_upload leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-240242 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
GHSA-f5j9-5h8m-c8mw: Buffer overflow in the run_last_args function in client/fwknop.c in fwknop before 2.0.3, when processing --last, might allow local users to cause a denial of service (client crash) and possibly execute arbitrary code via many .fwknop.run arguments.
GHSA-9jm5-85j2-p9f4: An issue in ZKTeko BioTime v.8.5.4 and before allows a remote attacker to obtain sensitive information via the Authentication & Authorization component
CVSS v3.1: 6.5
GHSA-6q62-hhr2-mfm6: Cross-Site Request Forgery (CSRF) vulnerability in Winwar Media WP Email Capture plugin <= 3.9.3 versions.
CVSS v3.1: 4.3