ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-75hq-cqh2-xf56: An authenticated attacker can send a specially crafted route to the “edit_route.cgi” binary and have it execute shell commands. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.303 for the LP series and 1.297 for the EP series. An attacker with this level of access on the device can monitor all communications sent to and from this device, modify onboard relays, change configuration files, or cause the device to become unstable.
CVSS v3.1: 8.8
GHSA-6m7p-cc32-5gc8: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Berger berger allows PHP Local File Inclusion.This issue affects Berger: from n/a through <= 1.1.1.
CVSS v3.1: 8.1
CVE-2001-0970: Cross-site scripting vulnerability in TDForum 1.2 CGI script (tdforum12.cgi) allows remote attackers to execute arbitrary script on other clients via a forum message that contains the script.
CVSS v2.0: 7.5
CVE-2024-45270: WordPress plugin "Carousel Slider" provided by Sayful Islam contains a cross-site request forgery vulnerability on Hero image selection feature. While logged in to the WordPress site with Carousel Slider plugin enabled, accessing a crafted page may cause a user to alter the contents of the WordPress site.
CVSS v3.1: 4.3
CVE-2026-6577: liangliangyy DjangoBlog logtracks Endpoint views.py missing authentication
A vulnerability was identified in liangliangyy DjangoBlog up to 2.1.0.0. The impacted element is an unknown function of the file owntracks/views.py of the component logtracks Endpoint. The manipulation leads to missing authentication. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 6.9
CVSS v3.1: 7.3
CVSS v3.0: 7.3
CVSS v2.0: 7.5
CVE-2022-29913: The parent process would not properly check whether the Speech Synthesis feature is enabled, when receiving instructions from a child process. This vulnerability affects Thunderbird < 91.9.
CVSS v3.1: 6.5
GHSA-h598-h2hg-rch5: LCDS Laquis SCADA prior to version 4.1.0.4150 allows an attacker using a specially crafted project file to supply a pointer for a controlled memory address, which may allow remote code execution, data exfiltration, or cause a system crash.
CVSS v3.0: 7.8
ICSA-15-267-01: Endress+Hauser Fieldcare/CodeWrights HART Comm DTM XML Injection Vulnerability
CodeWrights HART Comm DTM components, as used with Endress+Hauser FieldCare, allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via a longtag XML schema containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS v3.0: 8.3
CVE-2020-5217: Directive injection when using dynamic overrides with user input in RubyGems secure_headers
In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed into append/override_content_security_policy_directives, a semicolon could be injected leading to directive injection. This could be used to e.g. override a script-src directive. Duplicate directives are ignored and the first one wins. The directives in secure_headers are sorted alphabetically so they pretty much all come before script-src. A previously undefined directive would receive a value even if SecureHeaders::OPT_OUT was supplied. The fixed versions will silently convert the semicolons to spaces and emit a deprecation warning when this happens. This will result in innocuous browser console messages if being exploited/accidentally used. In future releases, we will raise application errors resulting in 500s. Depending on what major version you are using, the fixed versions are 6.2.0, 5.1.0, 3.8.0.
CVSS v3.1: 4.4
GHSA-wv95-5hh8-j5cp: In Bluetooth, there is a possible application crash due to bluetooth flooding a device with LMP_AU_rand packet. This could lead to remote denial of service of bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06198608; Issue ID: ALPS06198608.
GHSA-7rmr-2983-5c45: Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: MultiChannel Framework). Supported versions that are affected are 8.54 and 8.55. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 7.4 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N).
CVSS v3.0: 7.4
CVE-2018-25025: An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can unsoundly extend the lifetime of a string, leading to memory corruption.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2016-2781: chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.
CVSS v3.1: 4.6
CVSS v3.0: 6.5
CVSS v2.0: 2.1
CVE-2025-71157: RDMA/core: always drop device refcount in ib_del_sub_device_and_put()
In the Linux kernel, the following vulnerability has been resolved:

RDMA/core: always drop device refcount in ib_del_sub_device_and_put()

Since nldev_deldev() (introduced by commit 060c642b2ab8 ("RDMA/nldev: Add
support to add/delete a sub IB device through netlink") grabs a reference
using ib_device_get_by_index() before calling ib_del_sub_device_and_put(),
we need to drop that reference before returning -EOPNOTSUPP error.
CVSS v3.1: 7.8
GHSA-fc83-qrmr-hxxf: In SWFTools, a memcpy buffer overflow was found in gif2swf.
CVSS v3.0: 5.5
GHSA-m8cc-c87r-9qr2: In the Linux kernel, the following vulnerability has been resolved:net: phy: transfer phy_config_inband() locking responsibility to phylinkProblem descriptionLockdep reports a possible circular locking dependency (AB/BA) between
&pl->state_mutex and &phy->lock, as follows.phylink_resolve() // acquires &pl->state_mutex
-> phylink_major_config()
   -> phy_config_inband() // acquires &pl->phydev->lockwhereas all the other call sites where &pl->state_mutex and
&pl->phydev->lock have the locking scheme reversed. Everywhere else,
&pl->phydev->lock is acquired at the top level, and &pl->state_mutex at
the lower level. A clear example is phylink_bringup_phy().The outlier is the newly introduced phy_config_inband() and the existing
lock order is the correct one. To understand why it cannot be the other
way around, it is sufficient to consider phylink_phy_change(), phylink's
callback from the PHY device's phy->phy_link_change() virtual method,
invoked by the PHY state machine.phy_link_up() and phy_link_down(), the (indirect) callers of
phylink_phy_change(), are called with &phydev->lock acquired.
Then phylink_phy_change() acquires its own &pl->state_mutex, to
serialize changes made to its pl->phy_state and pl->link_config.
So all other instances of &pl->state_mutex and &phydev->lock must be
consistent with this order.Problem impactI think the kernel runs a serious deadlock risk if an existing
phylink_resolve() thread, which results in a phy_config_inband() call,
is concurrent with a phy_link_up() or phy_link_down() call, which will
deadlock on &pl->state_mutex in phylink_phy_change(). Practically
speaking, the impact may be limited by the slow speed of the medium
auto-negotiation protocol, which makes it unlikely for the current state
to still be unresolved when a new one is detected, but I think the
problem is there. Nonetheless, the problem was discovered using lockdep.Proposed solutionPractically speaking, the phy_config_inband() requirement of having
phydev->lock acquired must transfer to the caller (phylink is the only
caller). There, it must bubble up until immediately before
&pl->state_mutex is acquired, for the cases where that takes place.Solution details, considerations, notesThis is the phy_config_inband() call graph:phylink_start()          |   |
   |   phylink_resume()   v   v
   |   |  phylink_sfp_set_config()
   |   |  |
   v   v  v
 phylink_mac_initial_config()
   |   phylink_resolve()
   |   |  phylink_ethtool_ksettings_set()
   v   v  v
   phylink_major_config()
            |
            v
    phy_config_inband()phylink_major_config() caller #1, phylink_mac_initial_config(), does not
acquire &pl->state_mutex nor do its callers. It must acquire
&pl->phydev->lock prior to calling phylink_major_config().phylink_major_config() caller #2, phylink_resolve() acquires
&pl->state_mutex, thus also needs to acquire &pl->phydev->lock.phylink_major_config() caller #3, phylink_ethtool_ksettings_set(), is
completely uninteresting, because it only call
---truncated---
CVSS v3.1: 5.5
CVE-2015-0022: Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0017, CVE-2015-0020, CVE-2015-0026, CVE-2015-0030, CVE-2015-0031, CVE-2015-0036, and CVE-2015-0041.
CVSS v2.0: 9.3
CVE-2021-21342: A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, that result in a server-side forgery request. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
CVSS v3.1: 5.3
GHSA-q3q4-7rw2-rqpx: Denial-of-service in the login page of ASUSTOR ADM 3.1.1 allows attackers to prevent users from signing in by placing malformed text in the title.
CVSS v3.0: 7.5
GHSA-r6v5-fh4h-64xc: time vulnerable to stack exhaustion Denial of Service attack
ImpactWhen user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario.PatchesA limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned rather than exhausting the stack.WorkaroundsLimiting the length of user input is the simplest way to avoid stack exhaustion, as the amount of the stack consumed would be at most a factor of the length of the input.Alternatively, avoiding the format altogether would also ensure that the vulnerability is not encountered. To do this, addto your `clippy.toml` file. This will trigger the `clippy::disallowed_types` lint, which is warn-by-default and can be explicitly denied.
CVSS v4.0: 6.8
CVE-2016-5191: Bookmark handling in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android had insufficient validation of supplied data, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via crafted HTML pages, as demonstrated by an interpretation conflict between userinfo and scheme in an http://javascript:payload@example.com URL.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
CVE-2021-36295: Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain an authenticated remote code execution vulnerability. A remote malicious user with privileges may exploit this vulnerability to execute commands on the system.
CVSS v3.1: 7.2
GHSA-jm7r-g967-8pch: SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that, if exploited, could allow an attacker to invoke specific actions within Web Help Desk.
CVSS v3.1: 9.8
RHSA-2024:0778: Red Hat Security Advisory: Jenkins and Jenkins-2-plugins security update
google-oauth-client: missing PKCE support in accordance with the RFC for OAuth 2.0 for Native Apps can lead to improper authorization maven: Block repositories using http by default golang: go/parser: stack exhaustion in all Parse* functions snakeyaml: Denial of Service due to missing nested depth limitation for collections maven-shared-utils: Command injection via Commandline class apache-commons-text: variable interpolation RCE guava: insecure temporary directory creation springframework: Spring Expression DoS Vulnerability spring-security: Empty SecurityContext Is Not Properly Saved Upon Logout jenkins-2-plugins/script-security: Sandbox bypass vulnerability in Script Security Plugin jenkins-2-plugins/JUnit: Stored XSS vulnerability in JUnit Plugin jenkins-2-plugins/pipeline-build-step: Stored XSS vulnerability in Pipeline: Build Step Plugin jetty-server: OutOfMemoryError for large multipart without filename read via request.getParameter() jetty-server: Cookie parsing of quoted values can exfiltrate values from other cookies Jenkins: Temporary file parameter created with insecure permissions Jenkins: Information disclosure through error stack traces related to agents Jenkins: Open redirect vulnerability in OpenShift Login Plugin jetty: Improper validation of HTTP/1 content-length jenkins-plugins: cloudbees-folder: CSRF vulnerability in Folders Plugin jenkins-plugins: cloudbees-folder: Information disclosure in Folders Plugin jenkins-plugins: config-file-provider: Improper masking of credentials in Config File Provider Plugin jenkins-plugins: blueocean: CSRF vulnerability in Blue Ocean Plugin allows capturing credentials jenkins: Arbitrary file read vulnerability through the CLI can lead to RCE jenkins: cross-site WebSocket hijacking
CVSS v3.1: 8.8
GHSA-hj2p-9mfx-8r3r: Windows IKE Extension Denial of Service Vulnerability. This CVE ID is unique from CVE-2022-21843, CVE-2022-21848, CVE-2022-21889, CVE-2022-21890.
CVSS v3.1: 7.5
CVE-2007-6028: Multiple stack-based buffer overflows in the VSFlexGrid.VSFlexGridL ActiveX control in ComponentOne FlexGrid 7.1 Light allow remote attackers to cause a denial of service and possibly execute arbitrary code via a long string in the (1) Text, (2) EditSelText, (3) EditText, and (4) CellFontName property values.
CVSS v2.0: 6.8
GHSA-362p-jc7p-cx87: A vulnerability was found in GNOME gvdb. It has been classified as critical. This affects the function gvdb_table_write_contents_async of the file gvdb-builder.c. The manipulation leads to use after free. It is possible to initiate the attack remotely. The name of the patch is d83587b2a364eb9a9a53be7e6a708074e252de14. It is recommended to apply a patch to fix this issue. The identifier VDB-216789 was assigned to this vulnerability.
CVSS v3.1: 8.8
RHSA-2008:1025: Red Hat Security Advisory: java-1.5.0-sun security update
Java Web Start File Inclusion via System Properties Override JavaWebStart allows unauthorized network connections Java WebStart privilege escalation Java Web Start exposes username and the pathname of the JWS cache Java Web Start BasicService displays local files in the browser Java WebStart allows hidden code privilege escalation Java WebStart unprivileged local file and network access JRE allows unauthorized file access and connections to localhost JRE allows unauthorized memory read access via a crafted ZIP file OpenJDK Denial-Of-Service in kerberos authentication (6588160) OpenJDK RSA public key length denial-of-service (6497740) OpenJDK allows to list files within the user home directory (6484091) OpenJDK UTF-8 decoder accepts non-shortest form sequences (4486841) OpenJDK Jar200 Decompression buffer overflow (6755943) OpenJDK calendar object deserialization allows privilege escalation (6734167) OpenJDK Privilege escalation in command line applications (6733959) OpenJDK Font processing vulnerability (6733336) OpenJDK Truetype Font processing vulnerability (6751322) OpenJDK Buffer overflow in image processing (6726779) OpenJDK temporary files have guessable file names (6721753)
CVE-2022-27502: RealVNC VNC Server 6.9.0 through 5.1.0 for Windows allows local privilege escalation because an installer repair operation executes %TEMP% files as SYSTEM.
CVSS v3.1: 7.8
CVSS v2.0: 7.2
CVE-2024-43180: IBM Concert information disclosure
IBM Concert 1.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.
CVSS v3.1: 4.3
CVE-2026-5125: raine consult-llm-mcp server.ts child_process.execSync os command injection
A vulnerability was detected in raine consult-llm-mcp up to 2.5.3. Affected by this vulnerability is the function child_process.execSync of the file src/server.ts. The manipulation of the argument git_diff.base_ref/git_diff.files results in os command injection. The attack is only possible with local access. The exploit is now public and may be used. Upgrading to version 2.5.4 addresses this issue. The patch is identified as 4abf297b34e5e8a9cb364b35f52c5f0ca1d599d3. Upgrading the affected component is recommended.
CVSS v4.0: 4.8
CVSS v3.1: 5.3
CVSS v3.0: 5.3
CVSS v2.0: 4.3
GHSA-6v6p-q7ch-hc9f: Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Dairy Farm Shop Management System v1.0 allows attackers to bypass authentication.
CVSS v3.1: 9.8
CVE-2024-34034: An issue was discovered in FlexRIC 2.0.0. It crashes during a Subscription Request denial-of-service (DoS) attack, triggered by an assertion error. An attacker must send a high number of E42 Subscription Requests to the Near-RT RIC component.
CVSS v3.1: 5.7
GHSA-wqfv-xx2r-h6v5: The network enabled distribution of Kura before 2.1.0 takes control over the device's firewall setup but does not allow IPv6 firewall rules to be configured. Still the Equinox console port 5002 is left open, allowing to log into Kura without any user credentials over unencrypted telnet and executing commands using the Equinox "exec" command. As the process is running as "root" full control over the device can be acquired. IPv6 is also left in auto-configuration mode, accepting router advertisements automatically and assigns a MAC address based IPv6 address.
CVSS v3.0: 9.8
CVE-2025-66497: Foxit PDF Reader 3D Annotation Out-of-Bounds Memory Access Vulnerability
A memory corruption vulnerability exists in the 3D annotation handling of Foxit PDF Reader due to insufficient bounds checking when parsing PRC data. When opening a PDF file containing malformed or specially crafted PRC content, out-of-bounds memory access may occur, resulting in memory corruption.
CVSS v3.1: 5.3
GHSA-fhhh-fjpg-ww94: The ObjectBackedNativeHandler class in extensions/renderer/object_backed_native_handler.cc in the extensions subsystem in Google Chrome before 47.0.2526.80 improperly implements handler functions, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage "type confusion."
CVE-2024-47877: Extract has insufficient checks allowing attacker to create symlinks outside the extraction directory.
Extract is aA Go library to extract archives in zip, tar.gz or tar.bz2 formats. A maliciously crafted archive may allow an attacker to create a symlink outside the extraction target directory. This vulnerability is fixed in 4.0.0. If you're using the Extractor.FS interface, then upgrading to /v4 will require to implement the new methods that have been added.
CVSS v4.0: 6.9
CVE-2024-20459: Cisco ATA 190 Series Analog Telephone Adapter Muliplatform Firmware Command Injection Vulnerability
A vulnerability in the web-based management interface of Cisco ATA 190 Multiplatform Series Analog Telephone Adapter firmware could allow an authenticated, remote attacker with high privileges to execute arbitrary commands as the root user on the underlying operating system.

This vulnerability is due to a lack of input sanitization in the web-based management interface. An attacker could exploit this vulnerability by sending a malicious request to the web-based management interface. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system as the root user.
CVSS v3.1: 6.5
CVE-2022-27463: Open redirect vulnerability in objects/login.json.php in WWBN AVideo through 11.6, allows attackers to arbitrarily redirect users from a crafted url to the login page.
CVSS v3.1: 6.1
CVSS v2.0: 5.8
CVE-2017-13197: In the ihevcd_parse_slice.c function, slave threads are not joined if there is an error. This could lead to a remote denial of service of a critical system process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-64784973.
CVSS v3.0: 7.5
CVSS v2.0: 7.8
RHSA-2021:0967: Red Hat Security Advisory: Red Hat Single Sign-On 7.4.6 security update on RHEL 6
nodejs-angular: XSS due to regex-based HTML replacement keycloak: reusable "state" parameter at redirect_uri endpoint enables possibility of replay attacks
CVSS v3.1: 3.5
GHSA-f58g-762j-2j4p: The check_diskio plugin 3.2.6 and earlier for Nagios and Icinga allows local users to write to arbitrary files via a symlink attack on a temporary file with a predictable name (tmp/check_diskio_status-*-*).
GHSA-qpch-gjf6-c9gf: A CRL critical extension bypass exists in ParseCRL_Extensions where critical extensions are not properly enforced, allowing a crafted CRL with an unhandled critical extension to be accepted. This only affects builds with CRL support enabled and where a crafted CRL had a trusted signature when parsed.
CVSS v4.0: 1
CVSS v3.1: 5.3
GHSA-wvmr-8vvj-9cpr: Buffer overflow in the main function in jstest_main.c in Mujstest in Artifex Software, Inc. MuPDF before 1.10 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file.
CVSS v3.1: 5.5
GHSA-wmff-45hx-q83q: Double free vulnerability in the gdImageWebPtr function in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to have unspecified impact via large width and height values.
CVSS v3.0: 9.8
CVE-2000-0723: Helix GNOME Updater helix-update 0.5 and earlier does not properly create /tmp directories, which allows local users to create empty system configuration files such as /etc/config.d/bashrc, /etc/config.d/csh.cshrc, and /etc/rc.config.
CVSS v2.0: 1.2
CVE-2025-65553: D3D Wi-Fi Home Security System ZX-G12 v2.1.17 is susceptible to RF jamming on the 433 MHz alarm sensor channel. An attacker within RF range can transmit continuous interference to block sensor transmissions, resulting in missed alarms and loss of security monitoring. The device lacks jamming detection or mitigations, creating a denial-of-service condition that may lead to undetected intrusions or failure to trigger safety alerts.
CVSS v3.1: 6.5
PYSEC-2012-11: Buffer overflow in the fribidi_utf8_to_unicode function in PyFriBidi before 0.11.0 allows remote attackers to cause a denial of service (application crash) via a 4-byte utf-8 sequence.
CVE-2021-26229: SQL injection vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to execute arbitrary SQL statements, via the id parameter to edit_stud.php.
CVSS v3.1: 9.8
CVSS v2.0: 7.5