ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2025-8003: Ashlar-Vellum Cobalt CO File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability
Ashlar-Vellum Cobalt CO File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of CO files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26235.
CVSS v3.0: 7.8
GHSA-4v9q-rjxq-3952: The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.6.59 does not sanitise its updraft_service settings, allowing high privilege users to set malicious JavaScript payload in it and leading to a Stored Cross-Site Scripting issue
GHSA-9qqr-v783-v57r: Improper neutralization of input during web page generation ('Cross-site Scripting') in Copilot Studio by an unauthorized attacker leads to elevation of privilege over a network.
CVSS v3.1: 9.3
GHSA-397c-5g2j-qxpv: TensorFlow vulnerable to segfault in `SparseBincount`
ImpactIf `SparseBincount` is given inputs for `indices`, `values`, and `dense_shape` that do not make a valid sparse tensor, it results in a segfault that can be used to trigger a denial of service attack.PatchesWe have patched the issue in GitHub commit [40adbe4dd15b582b0210dfbf40c243a62f5119fa](https://github.com/tensorflow/tensorflow/commit/40adbe4dd15b582b0210dfbf40c243a62f5119fa).The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range.For more informationPlease consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.AttributionThis vulnerability has been reported by Di Jin, Secure Systems Labs, Brown University
CVSS v3.1: 5.9
GHSA-cfg3-7pxh-cgv5: IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.13.xxx is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 220048.
CVSS v3.1: 8.8
GHSA-g99p-47x7-mq88: go-f3 module vulnerable to integer overflow leading to panic
ImpactFilecoin nodes consuming F3 messages are vulnerable.  go-f3 panics when it validates a "poison" messages.  A "poison" message can can cause integer overflow in the signer index validation.  In Lotus' case, the whole node will crash.There is no barrier to entry.  An attacker doesn't need any power to pull off this attack.These malicious messages aren't self-propagating since the bug is in the validator.  An attacker needs to directly send the message to all targets.PatchesThe fix was merged and released with go-f3 0.8.7.  All node software (Lotus, Forest, Venus) are using a patched version of go-f3 with their updates for the nv27 network upgrade.go-f3 now does proper overflow checking using `math.MaxInt64` comparison and returns error `"justificationPower overflow"` when overflow would occur.WorkaroundsThe are no immediate workarounds available.  Nodes should upgrade to the patched version, which they will have done if participating in nv27 on Filecoin mainnet.CreditsThe initial finding(unrelated path) was reported by [0xNirix](https://github.com/0xNirix) via bug bounty program which wasn't high issue. The further digging by developers led to this finding. Thank you for the contributions.
CVSS v3.1: 7.5
GHSA-547r-qmjm-8hvw: md-to-pdf vulnerable to arbitrary JavaScript code execution when parsing front matter
SummaryA Markdown front-matter block that contains JavaScript delimiter causes the JS engine in gray-matter library to execute arbitrary code in the Markdown to PDF converter process of **md-to-pdf** library, resulting in remote code execution.Details**md-to-pdf** uses the gray-matter library to parse front-matter. Gray-matter exposes a JavaScript engine that, when enabled or triggered by certain front-matter delimiters (e.g. ---js or ---javascript), will evaluate the front-matter contents as JavaScript. If user-supplied Markdown is fed to md-to-pdf and the front-matter contains malicious JS, the converter process will execute that code.PoCRunning the PoC on Windows launches the calculator application, demonstrating arbitrary code execution.ImpactRemote code execution in the process that performs Markdown->PDF conversion.If the converter is run in a web app or cloud service, an attacker uploading malicious Markdown can execute arbitrary commands on the
CVSS v3.1: 10
CVE-2002-0792: The web management interface for Cisco Content Service Switch (CSS) 11000 switches allows remote attackers to cause a denial of service (soft reset) via (1) an HTTPS POST request, or (2) malformed XML data.
CVSS v2.0: 5
CVE-2026-34072: cronmaster: Middleware authentication bypass enabling unauthorized page access and server-action execution
Cr*nMaster (cronmaster) is a Cronjob management UI with human readable syntax, live logging and log history for cronjobs. Prior to version 2.2.0, an authentication bypass in middleware allows unauthenticated requests with an invalid session cookie to be treated as authenticated when the middleware’s session-validation fetch fails. This can result in unauthorized access to protected pages and unauthorized execution of privileged Next.js Server Actions. This issue has been patched in version 2.2.0.
CVSS v3.1: 8.3
GHSA-mjh5-2h4p-8jmp: Multiple PHP remote file inclusion vulnerabilities in GeekLog 1.4 allow remote attackers to execute arbitrary code via a URL in the _CONF[path] parameter to (1) links/functions.inc, (2) polls/functions.inc, (3) spamx/BlackList.Examine.class.php, (4) spamx/DeleteComment.Action.class.php, (5) spamx/EditIPofURL.Admin.class.php, (6) spamx/MTBlackList.Examine.class.php, (7) spamx/MassDelete.Admin.class.php, (8) spamx/MailAdmin.Action.class.php, (9) spamx/MassDelTrackback.Admin.class.php, (10) spamx/EditHeader.Admin.class.php, (11) spamx/EditIP.Admin.class.php, (12) spamx/IPofUrl.Examine.class.php, (13) spamx/Import.Admin.class.php, (14) spamx/LogView.Admin.class.php, and (15) staticpages/functions.inc, in the plugins/ directory.
GHSA-xqj2-5xg4-w8vj: Contributor Cross Site Scripting (XSS) in Fluent Booking <= 2.1.0 versions.
CVSS v3.1: 6.5
CVE-2025-23622: WordPress CBX Accounting & Bookkeeping plugin <= 1.3.14 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sabuj Kundu CBX Accounting & Bookkeeping cbxwpsimpleaccounting allows Reflected XSS.This issue affects CBX Accounting & Bookkeeping: from n/a through <= 1.3.14.
CVSS v3.1: 7.1
CVE-2026-4506: Mindinventory MindSQL mindsql_core.py ask_db code injection
A vulnerability was found in Mindinventory MindSQL up to 0.2.1. Impacted is the function ask_db of the file mindsql/core/mindsql_core.py. Performing a manipulation results in code injection. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
GHSA-jvvc-cv2q-j9jj: Symantec Endpoint Encryption prior to SEE 11.2.1 MP1 may be susceptible to a Privilege Escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user.
CVSS v3.0: 7.8
GHSA-4f8x-4r4g-29qq: Jsish v3.5.0 was discovered to contain a heap buffer overflow via jsi_ArraySliceCmd in src/jsiArray.c. This vulnerability can lead to a Denial of Service (DoS).
CVE-2018-8266: A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8380, CVE-2018-8381, CVE-2018-8384.
CVSS v3.0: 7.5
CVSS v2.0: 7.6
GHSA-p882-pvrr-mm88: Out of bounds write in firmware for Intel(R) NUC(R) may allow a privileged user to potentially enable escalation of privilege via local access.
GHSA-xrcr-gmf5-2r8j: Gogs: Stored XSS via data URI in issue comments
SummaryA Stored Cross-site Scripting (XSS) vulnerability exists in the comment and issue description functionality. The application's HTML sanitizer explicitly allows `data:` URI schemes, enabling authenticated users to inject arbitrary JavaScript execution via malicious links.DetailsThe vulnerability is located in `internal/markup/sanitizer.go`. The application uses the `bluemonday` HTML sanitizer but explicitly weakens the security policy by allowing the `data` URL scheme:While the Markdown renderer rewrites relative links (mitigating standard Markdown `[link](data:...)` attacks), Gogs supports **Raw HTML** input. Raw HTML anchor tags bypass the Markdown parser's link rewriting and are processed directly by the sanitizer. Since the sanitizer is configured to allow `data:` URIs, payloads like `<a href="data:text/html...">` are rendered as-is.PoCCreate a file named `exploit.md` in a repository.Add the following content (Raw HTML):Commit and push the file.Navigate to the file in the Gogs web interface.Click the "Click me for XSS" link.**Result:** An alert box with "XSS" appears, executing the JavaScript payload.ImpactThis is a **Stored XSS** vulnerability. Any user who views the malicious comment and clicks the link will execute the attacker-supplied JavaScript in their browser context. This allows attackers to:Steal authentication cookies and session tokens.Perform arbitrary actions on behalf of the victim (e.g., modifying repositories, adding collaborators).Redirect users to malicious sites.
CVSS v3.1: 8.7
CVE-2022-42318: Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Malicious guests can cause xenstored to allocate vast amounts of memory, eventually resulting in a Denial of Service (DoS) of xenstored. There are multiple ways how guests can cause large memory allocations in xenstored: - - by issuing new requests to xenstored without reading the responses, causing the responses to be buffered in memory - - by causing large number of watch events to be generated via setting up multiple xenstore watches and then e.g. deleting many xenstore nodes below the watched path - - by creating as many nodes as allowed with the maximum allowed size and path length in as many transactions as possible - - by accessing many nodes inside a transaction
CVSS v3.1: 6.5
CVE-2026-6372: WordPress Accept Cryptocurrencies with Plisio plugin <= 2.0.5 - Payment Bypass vulnerability
Missing Authorization vulnerability in Plisio Accept Cryptocurrencies with Plisio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accept Cryptocurrencies with Plisio: from n/a through 2.0.5.
CVSS v3.1: 7.5
GHSA-9xfg-frpc-8rwp: A SQL injection vulnerability was discovered in Looker Studio that allowed for data exfiltration from BigQuery data sources.By creating a malicious report with native functions enabled, and having the victim access the report, an attacker could execute injected SQL queries with the victim's permissions in BigQuery.This vulnerability was patched on 07 July 2025, and no customer action is needed.
CVSS v4.0: 7.3
CVE-2017-6918: CSRF exists in BigTree CMS 4.2.16 with the value[#][*] parameter to the admin/settings/update/ page. The Navigation Social can be changed.
CVSS v3.0: 4.3
CVSS v2.0: 4.3
GHSA-j5p3-q3mr-g82w: Out of bounds read in WebAudio in Google Chrome on Mac prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
CVSS v3.1: 7.5
CVE-2023-35009: IBM Cognos Analytics information disclosure
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could allow a remote attacker to obtain system information without authentication which could be used in reconnaissance to gather information that could be used for future attacks.  IBM X-Force ID:  257703.
CVSS v3.1: 5.3
GHSA-f5xq-vjwc-pqqj: An issue was discovered in the DBI module before 1.643 for Perl. The hv_fetch() documentation requires checking for NULL and the code does that. But, shortly thereafter, it calls SvOK(profile), causing a NULL pointer dereference.
CVSS v3.1: 4.7
CVE-2010-3206: Multiple PHP remote file inclusion vulnerabilities in DiY-CMS 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the (1) lang parameter to modules/guestbook/blocks/control.block.php, (2) main_module parameter to index.php, and (3) getFile parameter to includes/general.functions.php.
CVSS v2.0: 7.5
CVE-2006-5370: Multiple unspecified vulnerabilities in Oracle E-Business Suite 11.5.10CU2 have unknown impact and remote authenticated attack vectors, aka Vuln# (1) APPS06 for Oracle CRM Gateway for Mobile Devices and (2) APPS08 for Oracle iStore.
CVSS v2.0: 10
CVE-2000-0574: FTP servers such as OpenBSD ftpd, NetBSD ftpd, ProFTPd and Opieftpd do not properly cleanse untrusted format strings that are used in the setproctitle function (sometimes called by set_proc_title), which allows remote attackers to cause a denial of service or execute arbitrary commands.
CVSS v2.0: 5
CVE-2009-0051: ZXID 0.29 and earlier does not properly check the return value from the OpenSSL DSA_verify function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077.
CVSS v2.0: 5
CVE-2020-29564: The official Consul Docker images 0.7.1 through 1.4.2 contain a blank password for a root user. System using the Consul Docker container deployed by affected versions of the Docker image may allow a remote attacker to achieve root access with a blank password.
CVSS v3.1: 9.8
CVSS v2.0: 10
CVE-2016-11015: NETGEAR JNR1010 devices before 1.0.0.32 allow cgi-bin/webproc CSRF via the :InternetGatewayDevice.X_TWSZ-COM_URL_Filter.BlackList.1.URL parameter.
CVSS v3.1: 6.5
CVSS v2.0: 4.3
GHSA-hxx2-7vcw-mqr3: Sinatra vulnerable to Reliance on Untrusted Inputs in a Security Decision
Versions of the package sinatra from 0.0.0 are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the X-Forwarded-Host (XFH) header. When making a request to a method with redirect applied, it is possible to trigger an Open Redirect Attack by inserting an arbitrary address into this header. If used for caching purposes, such as with servers like Nginx, or as a reverse proxy, without handling the X-Forwarded-Host header, attackers can potentially exploit Cache Poisoning or Routing-based SSRF.
CVSS v4.0: 5.3
CVSS v3.1: 5.4
GHSA-cq94-fv46-w3ph: An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an unused function that allows an authenticated attacker to use up all available IPs of an account and thus not allow creation of new devices and users.
RHSA-2026:3939: Red Hat Security Advisory: nfs-utils security update
nfs-utils: rpc.mountd in the nfs-utils privilege escalation
CVSS v3.1: 6.5
GHSA-gm29-wg4h-mv2w: A vulnerability in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers could allow an authenticated, Administrator-level, remote attacker to execute arbitrary code as the root user. To exploit this vulnerability, an attacker would need to have valid Administrator credentials on the affected device.
&nbsp;
This vulnerability is due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code on the underlying operating system as the root user.
CVSS v3.1: 6.5
CVE-2024-26973: fat: fix uninitialized field in nostale filehandles
In the Linux kernel, the following vulnerability has been resolved:

fat: fix uninitialized field in nostale filehandles

When fat_encode_fh_nostale() encodes file handle without a parent it
stores only first 10 bytes of the file handle. However the length of the
file handle must be a multiple of 4 so the file handle is actually 12
bytes long and the last two bytes remain uninitialized. This is not
great at we potentially leak uninitialized information with the handle
to userspace. Properly initialize the full handle length.
CVSS v3.1: 5.5
GHSA-89v5-38xr-9m4j: Postiz has Multiple SSRF Vectors - Webhooks, RSS Feed, URL Loader
SummaryPostiz has multiple SSRF vulnerabilities where user-provided URLs are fetched server-side without any IP validation or SSRF protection.Vulnerable Code1. Webhook Send Endpoint (Most Critical)**`apps/backend/src/api/routes/webhooks.controller.ts` lines 58-70:**Accepts arbitrary URL via query parameter and fetches directly.2. Stored Webhook Delivery**`apps/orchestrator/src/activities/post.activity.ts` lines 256-281:**3. RSS/XML Feed Parser**`libraries/nestjs-libraries/src/database/prisma/autopost/autopost.service.ts` line 135:**4. HTML Content Loader**`libraries/nestjs-libraries/src/database/prisma/autopost/autopost.service.ts` line 185:**Missing ProtectionsNo `request-filtering-agent` or SSRF libraryNo private IP range filteringNo cloud metadata endpoint blockingNo DNS rebinding protectionURL validation only via `@IsUrl()` decorator (format only, no IP check)Attack Scenarios`POST /webhooks/send?url=http://169.254.169.254/latest/meta-data/` → AWS metadata theft`POST /autopost/send?url=http://127.0.0.1:6379` → Internal Redis accessCreate webhook with `http://10.0.0.1:8080/admin` → Internal service access on post publishImpact**Cloud metadata theft**: AWS/GCP/Azure credentials**Internal network scanning**: Full access to private IP ranges**Multiple entry points**: Webhooks, RSS feeds, URL loader all vulnerable
CVSS v4.0: 7.8
GHSA-8q5c-2fv2-m4f5: An exploitable vulnerability exists in the remote control functionality of Circle with Disney running firmware 2.0.1. SSL certificates for specific domain names can cause the rclient daemon to accept a different certificate than intended. An attacker can host an HTTPS server with this certificate to trigger this vulnerability.
CVSS v3.0: 5.9
CVE-2021-1339: Cisco Small Business RV Series Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly. These vulnerabilities are due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system or cause the device to reload, resulting in a denial of service (DoS) condition. To exploit these vulnerabilities, an attacker would need to have valid administrator credentials on the affected device.
CVSS v3.1: 7.2
GHSA-4jqc-6m5c-wg7v: functions/imap_general.php in SquirrelMail before 1.4.21 does not properly handle 8-bit characters in passwords, which allows remote attackers to cause a denial of service (disk consumption) by making many IMAP login attempts with different usernames, leading to the creation of many preferences files.
GHSA-2rqg-qj27-3wj5: Logrhythm Web Console 7.4.9 allows for HTML tag injection through Contextualize Action -> Create a new Contextualize Action -> Inject your HTML tag in the name field.
CVSS v3.1: 6.1
GHSA-vhx8-cppg-v89v: ** UNSUPPPORTED WHEN ASSIGNED **Persistent cross-site scripting (XSS) in the web application of MOD3GP-SY-120K allows an authenticated remote attacker to introduce arbitrary JavaScript by injecting an XSS payload into the field MAIL_RCV. When a legitimate user attempts to access to the vulnerable page of the web application, the XSS payload will be executed.
CVSS v3.1: 6.3
GHSA-4mvc-4mwc-p7gv: A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The source of the vulnerability relies on multiple parameters belonging to the "multiple_ssid_htm" API which are not properly sanitized before being concatenated to OS level commands.
CVSS v3.1: 7.2
GHSA-gxjq-4fvp-4xq7: The PayPal Website Payments Standard functionality in the Ubercart module 5.x before 5.x-1.9 and 6.x before 6.x-2.1 for Drupal does not properly validate orders, which allows remote attackers to trigger unspecified "duplicate actions" via unknown vectors.
GHSA-h38h-x3rg-6r4c: A Cross Site Scripting (XSS) vulnerability in e017 CMS v.2.3.2 allows a local attacker to execute arbitrary code via a crafted script to the Name filed in the Manage Menu.
CVSS v3.1: 5.4
CVE-2023-6026: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in PHPMemcachedAdmin
A Path traversal vulnerability has been reported in elijaa/phpmemcachedadmin affecting version 1.3.0. This vulnerability allows an attacker to delete files stored on the server due to lack of proper verification of user-supplied input.
CVSS v3.1: 9.8
GHSA-6qcm-6865-m48v: ** DISPUTED **  PHP remote file inclusion vulnerability in index.php in Thomas Pequet phpPrintAnalyzer 1.1, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the rep_par_rapport_racine parameter.  NOTE: this issue has been disputed by third party researchers, stating that the rep_par_rapport_racine variable is initialized before use.
GHSA-5899-hhfh-hw26: A vulnerability classified as problematic was found in Nagios NCPA. This vulnerability affects unknown code of the file agent/listener/templates/tail.html. The manipulation of the argument name leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 2.4.0 is able to address this issue. The name of the patch is 5abbcd7aa26e0fc815e6b2b0ffe1c15ef3e8fab5. It is recommended to upgrade the affected component. VDB-216874 is the identifier assigned to this vulnerability.
CVSS v3.1: 6.1
CVE-2024-13469: Pricing Table by PickPlugins <= 1.12.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Pricing Table by PickPlugins plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Button Link in all versions up to, and including, 1.12.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
GHSA-xqg7-w425-fm4c: Memory leak in the hwsim_new_radio_nl function in drivers/net/wireless/mac80211_hwsim.c in the Linux kernel through 4.15.9 allows local users to cause a denial of service (memory consumption) by triggering an out-of-array error case.
CVSS v3.0: 5.5
GHSA-9cpx-2cx6-874v: Multiple cross-site scripting (XSS) vulnerabilies in cPanel 10 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) email parameter to (a) editquota.html or (b) dodelpop.html; (2) showtree parameter to (c) diskusage.html; or the (3) mon, (4) year, (5) target, or (6) domain parameter to (d) stats/detailbw.html.