ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-vc2w-4v3p-2mqw: Apache Solr: Insufficient file-access checking in standalone core-creation requests
The "create core" API of Apache Solr 8.6 through 9.10.0 lacks sufficient input validation on some API parameters, which can cause Solr to check the existence of and attempt to read file-system paths that should be disallowed by Solr's  "allowPaths" security setting https://https://solr.apache.org/guide/solr/latest/configuration-guide/configuring-solr-xml.html#the-solr-element .  These read-only accesses can allow users to create cores using unexpected configsets if any are accessible via the filesystem.  On Windows systems configured to allow UNC paths this can additionally cause disclosure of NTLM "user" hashes.Solr deployments are subject to this vulnerability if they meet the following criteria:Solr is running in its "standalone" mode.Solr's "allowPath" setting is being used to restrict file access to certain directories.Solr's "create core" API is exposed and accessible to untrusted users.  This can happen if Solr's  RuleBasedAuthorizationPlugin https://solr.apache.org/guide/solr/latest/deployment-guide/rule-based-authorization-plugin.html  is disabled, or if it is enabled but the "core-admin-edit" predefined permission (or an equivalent custom permission) is given to low-trust (i.e. non-admin) user roles.Users can mitigate this by enabling Solr's RuleBasedAuthorizationPlugin (if disabled) and configuring a permission-list that prevents untrusted users from creating new Solr cores.  Users should also upgrade to Apache Solr 9.10.1 or greater, which contain fixes for this issue.
CVSS v3.1: 7.1
CVE-2024-20891: Improper access control in launchFullscreenIntent of SystemUI prior to SMR Jul-2024 Release 1 allows local attackers to launch privileged activities.
CVSS v3.1: 7.8
GHSA-p4m2-q7r3-j2h5: Uncaught exception in Intel(R) RAID Web Console software all versions may allow an authenticated user to potentially enable denial of service via local access.
CVSS v3.1: 6.5
CVE-2024-39896: Directus allows SSO User Enumeration
Directus is a real-time API and App dashboard for managing SQL database content. When relying on SSO providers in combination with local authentication it can be possible to enumerate existing SSO users in the instance. This is possible because if an email address exists in Directus and belongs to a known SSO provider then it will throw a "helpful" error that the user belongs to another provider. This vulnerability is fixed in 10.13.0.
CVSS v3.1: 7.5
CVE-2019-16139: An issue was discovered in the compact_arena crate before 0.4.0 for Rust. Generativity is mishandled, leading to an out-of-bounds write or read.
CVSS v3.1: 9.8
CVSS v2.0: 9
CVE-2023-27395: A heap-based buffer overflow vulnerability exists in the vpnserver WpcParsePacket() functionality of SoftEther VPN 4.41-9782-beta, 5.01.9674 and 5.02. A specially crafted network packet can lead to arbitrary code execution. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.
CVSS v3.1: 9
GHSA-89p6-89pc-fh54: IBM UrbanCode Deploy 6.0.x before 6.0.1.13, 6.1.x before 6.1.3.3, and 6.2.x before 6.2.1.1 does not properly implement a logging-obfuscation feature for secure properties, which allows remote authenticated users to obtain sensitive information via vectors involving special characters.
CVSS v3.0: 4.3
GHSA-wj6j-v4x2-wj65: Cross Site Scripting (XSS) vulnerability exists in UEditor v1.4.3.3, which can be exploited by an attacker to obtain user cookie information.
GHSA-62v2-fqcx-rj9f: A vulnerability was found in Tenda F1202 1.2.0.20(408). It has been rated as critical. This issue affects the function fromNatlimit of the file /goform/Natlimit. The manipulation of the argument page leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260909 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v3.1: 8.8
GHSA-qc8x-wmvj-qfrf: SQL injection vulnerability in comments.php in Gamma Scripts BlogMe PHP 1.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2025-53767: Azure OpenAI Elevation of Privilege Vulnerability
Azure OpenAI Elevation of Privilege Vulnerability
CVSS v3.1: 10
CVE-2020-28622: Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code execution. An attacker can provide malicious input to trigger any of these vulnerabilities. An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser<EW>::read_edge() eh->incident_sface().
CVSS v3.0: 10
GHSA-wp8r-cvvg-9jf3: An issue was discovered on Moxa AWK-3121 1.14 devices. The device provides a Wi-Fi connection that is open and does not use any encryption mechanism by default. An administrator who uses the open wireless connection to set up the device can allow an attacker to sniff the traffic passing between the user's computer and the device. This can allow an attacker to steal the credentials passing over the HTTP connection as well as TELNET traffic. Also an attacker can MITM the response and infect a user's computer very easily as well.
CVSS v3.1: 8.1
CVE-2002-1833: The default configurations for DocuTech 6110 and DocuTech 6115 have a default administrative password of (1) "service!" on Solaris 8.0 or (2) "administ" on Windows NT, which allows remote attackers to gain privileges.
CVSS v2.0: 7.5
GHSA-mjfq-3qr2-6g84: Cosmos EVM Allows Partial Precompile State Writes
ImpactSetting lower EVM call gas allows users to partially execute precompiles and error at specific points in the precompile code without reverting the partially written state.If executed on the distribution precompile when claiming funds, it could cause funds to be transferred to a user without resetting the claimable rewards to 0. The vulnerability could also be used to cause indeterministic execution by failing at other points in the code, halting validators.Any evmOS or Cosmos EVM chain using precompiles is affected.PatchesThe vulnerability was patched by wrapping each precompile execution into an atomic function that reverts any partially committed state on error.[evmos/os](https://github.com/evmos/os) patch file: https://drive.google.com/file/d/1LfC0WSrQOqwTOW3qfaE6t8Jqf1PLVtS_/For chains using a different file structure, you must manually apply the diff:**In `x/evm/statedb.go`:**Add the following function:**In `x/evm/statedb/journal.go`:**Replace the `Revert` function with the following:**In `precompiles/common/precompile.go`:**Change the function signature in `HandleGasError` to:In the `HandleGasError` function, add the following line in the switch statement in the `case storetypes.ErrorOutOfGas:` case:Add the following function:**All Precompiles:**Finally, in each precompile, locate the `Run` function, and wrap each switch statement and return values into `p.RunAtomic`. For example:WorkaroundsThere are no workarounds for chains that make use of precompiles. A coordinated upgrade is necessary to patch the issue.TestingA test was introduced in the distribution precompile to ensure that partial state writes no longer occur when a lower gas amount is set.
CVSS v4.0: 8.3
CVE-2025-43439: A privacy issue was addressed by removing sensitive data. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, visionOS 26.1. An app may be able to fingerprint the user.
CVSS v3.1: 5.5
CVE-2022-20271: In PermissionController, there is a possible way to grant some permissions without user consent due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-207672635
CVSS v3.1: 7.8
CVE-2012-3864: Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, allows remote authenticated users to read arbitrary files on the puppet master server by leveraging an arbitrary user's certificate and private key in a GET request.
CVSS v2.0: 4
CVE-2020-18703: XML External Entities (XXE) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the component 'quokka/utils/atom.py'.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
GHSA-r33p-vh3m-6j34: Anviz access control devices expose credentials (names and passwords) by allowing remote attackers to query this information without credentials via port tcp/5010.
CVE-2025-37848: accel/ivpu: Fix PM related deadlocks in MS IOCTLs
In the Linux kernel, the following vulnerability has been resolved:

accel/ivpu: Fix PM related deadlocks in MS IOCTLs

Prevent runtime resume/suspend while MS IOCTLs are in progress.
Failed suspend will call ivpu_ms_cleanup() that would try to acquire
file_priv->ms_lock, which is already held by the IOCTLs.
CVSS v3.1: 5.5
GHSA-qg5v-qf7r-mg3f: Stack-based buffer overflow in HT-MP3Player 1.0 allows remote attackers to execute arbitrary code via a long string in a .ht3 file.
GHSA-wj2h-7vcx-3r7w: In the Linux kernel, the following vulnerability has been resolved:ocfs2: handle a symlink read error correctlyPatch series "Convert ocfs2 to use folios".Mark did a conversion of ocfs2 to use folios and sent it to me as a
giant patch for review ;-)So I've redone it as individual patches, and credited Mark for the patches
where his code is substantially the same.  It's not a bad way to do it;
his patch had some bugs and my patches had some bugs.  Hopefully all our
bugs were different from each other.  And hopefully Mark likes all the
changes I made to his code!This patch (of 23):If we can't read the buffer, be sure to unlock the page before returning.
CVSS v3.1: 5.5
CVE-2024-58095: jfs: add check read-only before txBeginAnon() call
In the Linux kernel, the following vulnerability has been resolved:

jfs: add check read-only before txBeginAnon() call

Added a read-only check before calling `txBeginAnon` in `extAlloc`
and `extRecord`. This prevents modification attempts on a read-only
mounted filesystem, avoiding potential errors or crashes.

Call trace:
 txBeginAnon+0xac/0x154
 extAlloc+0xe8/0xdec fs/jfs/jfs_extent.c:78
 jfs_get_block+0x340/0xb98 fs/jfs/inode.c:248
 __block_write_begin_int+0x580/0x166c fs/buffer.c:2128
 __block_write_begin fs/buffer.c:2177 [inline]
 block_write_begin+0x98/0x11c fs/buffer.c:2236
 jfs_write_begin+0x44/0x88 fs/jfs/inode.c:299
CVSS v3.1: 5.5
GHSA-fmp9-8xv5-pfqf: An issue was discovered on Samsung mobile devices with P(9.0) software. Attackers can bypass Factory Reset Protection (FRP) via SamsungPay mini. The Samsung ID is SVE-2019-15090 (November 2019).
GHSA-7mrh-gfr7-2p24: In the Linux kernel, the following vulnerability has been resolved:Bluetooth: fix memory leak in error path of hci_alloc_dev()Early failures in Bluetooth HCI UART configuration leak SRCU percpu
memory.When device initialization fails before hci_register_dev() completes,
the HCI_UNREGISTER flag is never set. As a result, when the device
reference count reaches zero, bt_host_release() evaluates this flag as
false and falls back to a direct kfree(hdev).Because hci_release_dev() is bypassed, the SRCU struct initialized
early in hci_alloc_dev() is never cleaned up, resulting in a leak of
percpu memory.Fix the leak by explicitly calling cleanup_srcu_struct() in the
fallback (unregistered) branch of bt_host_release() before freeing
the device.
GHSA-cfjr-rrx2-8rp9: A potential vulnerability has been identified in Micro Focus Operations Bridge - Containerized. The vulnerability could be exploited by a malicious authenticated OBM (Operations Bridge Manager) user to run Java Scripts in the browser context of another OBM user. Please note: The vulnerability is only applicable if the Operations Bridge Manager capability is deployed. A potential vulnerability has been identified in Micro Focus Operations Bridge Manager (OBM). The vulnerability could be exploited by a malicious authenticated OBM user to run Java Scripts in the browser context of another OBM user. This issue affects: Micro Focus Micro Focus Operations Bridge Manager versions prior to 2022.11. Micro Focus Micro Focus Operations Bridge- Containerized versions prior to 2022.11.
CVSS v3.1: 5.4
GHSA-7vc9-vx7c-89wf: A time-of-check time-of-use vulnerability in the Trend Micro Apex One (mac) agent cache mechanism could allow a local attacker to escalate privileges on affected installations.Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.The following information is provided as informational only for CVE references, as these were addressed already via ActiveUpdate/SaaS updates in mid to late 2025 (SaaS 2507 & 2005 Yearly Release).
CVSS v3.1: 7.8
CVE-2018-11385: An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. A session fixation vulnerability within the "Guard" login feature may allow an attacker to impersonate a victim towards the web application if the session id value was previously known to the attacker.
CVSS v3.0: 8.1
CVSS v2.0: 6.8
CVE-2024-27359: Certain WithSecure products allow a Denial of Service because the engine scanner can go into an infinite loop when processing an archive file. This affects WithSecure Client Security 15, WithSecure Server Security 15, WithSecure Email and Server Security 15, WithSecure Elements Endpoint Protection 17 and later, WithSecure Client Security for Mac 15, WithSecure Elements Endpoint Protection for Mac 17 and later, WithSecure Linux Security 64 12.0, WithSecure Linux Protection 12.0, and WithSecure Atlant 1.0.35-1.
CVSS v3.1: 7.5
GHSA-pm8g-4f93-7m8m: The ArtPlacer Widget WordPress plugin before 2.20.7 does not sanitize and escape the "id" parameter before submitting the query, leading to a SQLI exploitable by editors and above. Note: Due to the lack of CSRF check, the issue could also be exploited via a CSRF against a logged editor (or above)
CVSS v3.1: 8.8
CVE-2024-9038: Codezips Online Shopping Portal insert-product.php unrestricted upload
A vulnerability classified as problematic was found in Codezips Online Shopping Portal 1.0. Affected by this vulnerability is an unknown functionality of the file insert-product.php. The manipulation of the argument productimage1/productimage2/productimage3 leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 5.3
CVSS v3.1: 4.3
CVSS v3.0: 4.3
CVSS v2.0: 4
CVE-2025-2694: IBM Sterling B2B Integrator cross-site scripting
IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.7_1 and 6.2.0.0 through 6.2.0.4 and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7_1 and 6.2.0.0 through 6.2.0.4 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS v3.1: 4.8
CVE-2018-6117: Confusing settings in Autofill in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
CVSS v3.0: 6.5
CVSS v2.0: 4.3
GHSA-xqw2-5rg4-323p: IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a buffer overflow, caused by improper bounds checking which could allow a local attacker to execute arbitrary code on the system with root privileges.
CVE-2023-28458: pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature). Organizers can trigger the overwriting (with the standard pretalx 404 page content) of an arbitrary file.
CVSS v3.1: 4.3
CVE-2020-35981: An issue was discovered in GPAC version 0.8.0 and 1.0.1. There is an invalid pointer dereference in the function SetupWriters() in isomedia/isom_store.c.
CVSS v3.1: 7.8
CVSS v2.0: 6.8
RHSA-2026:18043: Red Hat Security Advisory: jq security update
jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers jq: jq: Denial of Service via crafted JSON object causing hash collisions
CVSS v3.1: 7.5
CVE-2022-34486: Path traversal vulnerability in PukiWiki versions 1.4.5 to 1.5.3 allows a remote authenticated attacker with an administrative privilege to execute a malicious script via unspecified vectors.
CVSS v3.1: 7.2
GHSA-4c72-xmxx-j6j8: Avira AntiVir 7.9.0.36 and possibly 7.8.1.28, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
GHSA-7x2j-7gp6-7vr3: Multiple SQL injection vulnerabilities in DeluxeBB 1.0 and 1.0.5 allow remote attackers to execute arbitrary SQL commands via the (1) tid parameter to topic.php, the uid parameter to (2) misc.php or (3) pm.php, or the fid parameter to (3) forums.php or (4) newpost.php.
CVE-2012-10039: ZEN Load Balancer Filelog Command Execution
ZEN Load Balancer versions 2.0 and 3.0-rc1 contain a command injection vulnerability in content2-2.cgi. The filelog parameter is passed directly into a backtick-delimited exec() call without sanitation. An authenticated attacker can inject arbitrary shell commands, resulting in remote code execution as the root user. ZEN Load Balancer is the predecessor of ZEVENET and SKUDONET. The affected versions (2.0 and 3.0-rc1) are no longer supported. SKUDONET CE is the current community-maintained successor.
CVSS v4.0: 9.4
GHSA-93vr-9q9m-pj8p: TensorFlow vulnerable to Out-of-Bounds Read in DynamicStitch
ImpactIf the parameter `indices` for `DynamicStitch` does not match the shape of the parameter `data`, it can trigger an stack OOB read.PatchesWe have patched the issue in GitHub commit [ee004b18b976eeb5a758020af8880236cd707d05](https://github.com/tensorflow/tensorflow/commit/ee004b18b976eeb5a758020af8880236cd707d05).The fix will be included in TensorFlow 2.12. We will also cherrypick this commit on TensorFlow 2.11.1.For more informationPlease consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.AttributionThis has been reported via Google OSS VRP.
CVSS v3.1: 7.5
CVE-2022-44158: Tenda AC21 V16.03.08.15 is vulnerable to Buffer Overflow via function via set_device_name.
CVSS v3.1: 7.5
GHSA-cgm5-64xg-7qqq: Android Picasa in Android 3.0 and 2.x through 2.3.4 uses a cleartext HTTP session when transmitting the authToken obtained from ClientLogin, which allows remote attackers to gain privileges and access private pictures and web albums by sniffing the token from connections with picasaweb.google.com.
GHSA-89wj-jvpp-gwhf: The Contact Form Master  WordPress plugin through 1.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS v3.1: 6.1
GHSA-27g3-58v4-fg9w: Cross-site Scripting in Microweber
Microweber versions 1.2.17 and prior are vulnerable to cross-site scripting. A patch is available on the `dev laravel9-php8` branch of the repository.
CVSS v3.1: 6.1
CVE-2019-20483: An issue was discovered in Viki Vera 4.9.1.26180. An attacker could set a user's last name to an XSS Payload, and read another user's cookie and use that to login to the application.
CVSS v3.1: 5.4
CVSS v2.0: 3.5
GHSA-763f-93r5-54qv: SoftEther VPN 5.02.5187 is vulnerable to Buffer Overflow in Internat.c via the UniToStrForSingleChars function.
CVSS v3.1: 9.8
CVE-2023-39183: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 7). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PSM files. This could allow an attacker to execute code in the context of the current process.
CVSS v3.1: 7.8
GHSA-9x94-g556-7x2c: Cross-site scripting (XSS) vulnerability in surveyresults.asp in Smart Survey 1.0 allows remote attackers to inject arbitrary web script or HTML via the sid parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
GHSA-7w44-3x7p-5w78: ASP.NET in Microsoft .NET 3.5 does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks against the form control via the __VIEWSTATE parameter.
GHSA-r5qm-2f3r-ggqh: The JJ Texas Hold'em Poker (aka cn.jj.poker) application 1.13.23.HD for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2025-58088: Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. Specially crafted malicious URLs can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger these vulnerabilities.This vulnerability affects the archivedir parameter.
CVSS v3.1: 6.1
RHSA-2024:10771: Red Hat Security Advisory: kernel security update
kernel: vt_ioctl: fix array_index_nospec in vt_setactivate kernel: pstore/ram: Fix crash when setting number of cpus to an odd number kernel: PM / devfreq: Synchronize devfreq_monitor_[start/stop] kernel: net/smc: avoid data corruption caused by decline kernel: scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool kernel: ext4: allow ext4_get_group_info() to fail kernel: ext4: correct grp validation in ext4_mb_good_group kernel: ext4: regenerate buddy after block freeing failed if under fc replay kernel: net/smc: fix illegal rmb_desc access in SMC-D connection dump kernel: fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats kernel: ext4: fix double-free of blocks due to wrong extents moved_len kernel: Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout kernel: s390/qeth: Fix kernel panic after setting hsuid kernel: drm/vmwgfx: Fix invalid reads in fence signaled events kernel: blk-cgroup: fix list corruption from reorder of WRITE -&gt;lqueued kernel: of: module: add buffer overflow check in of_modalias() kernel: net/mlx5: Discard command completions in internal error kernel: net: hns3: fix kernel crash problem in concurrent scenario kernel: cpufreq: amd-pstate: fix memory leak on CPU EPP exit kernel: tcp: avoid too many retransmit packets kernel: drm/amdgpu: change vm-&gt;task_info handling kernel: bpf: Fix overrunning reservations in ringbuf kernel: mm/filemap: skip to create PMD-sized page cache if needed kernel: firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers kernel: firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files kernel: drm/amdgpu: avoid using null object of framebuffer kernel: tcp_metrics: validate source addr length kernel: drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc kernel: firmware: cs_dsp: Validate payload length before processing block kernel: firmware: cs_dsp: Return error if block header overflows file kernel: x86/bhi: Avoid warning in #DB handler due to BHI mitigation kernel: mm/shmem: disable PMD-sized page cache if needed kernel: mm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarray kernel: USB: serial: mos7840: fix crash on resume kernel: net/iucv: fix use after free in iucv_sock_close() kernel: bonding: fix xfrm real_dev null pointer dereference
CVSS v3.1: 5.5
GHSA-jpxq-chcc-qq3v: Cybozu Garoon 4.0.0 to 5.0.1 allows remote authenticated attackers to bypass access restriction to obtain unauthorized Multi-Report's data via unspecified vectors.