ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-g43c-r7c6-fhrv: In the Linux kernel, the following vulnerability has been resolved:NFSD: Fix the behavior of READ near OFFSET_MAXDan Aloni reports:Due to commit 8cfb9015280d ("NFS: Always provide aligned buffers to
the RPC read layers") on the client, a read of 0xfff is aligned up
to server rsize of 0x1000.As a result, in a test where the server has a file of size
0x7fffffffffffffff, and the client tries to read from the offset
0x7ffffffffffff000, the read causes loff_t overflow in the server
and it returns an NFS code of EINVAL to the client. The client as
a result indefinitely retries the request.The Linux NFS client does not handle NFS?ERR_INVAL, even though all
NFS specifications permit servers to return that status code for a
READ.Instead of NFS?ERR_INVAL, have out-of-range READ requests succeed
and return a short result. Set the EOF flag in the result to prevent
the client from retrying the READ request. This behavior appears to
be consistent with Solaris NFS servers.Note that NFSv3 and NFSv4 use u64 offset values on the wire. These
must be converted to loff_t internally before use -- an implicit
type cast is not adequate for this purpose. Otherwise VFS checks
against sb->s_maxbytes do not work properly.
CVSS v3.1: 7.1
CVE-2026-20024: A vulnerability in the OSPF protocol of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an authenticated, adjacent attacker to cause an affected device to reload unexpectedly, resulting in a DoS condition. To exploit this vulnerability, the attacker must have the OSPF secret key.
 This vulnerability is due to heap corruption in OSPF when parsing packets. An attacker could exploit this vulnerability by sending crafted packets to the OSPF service. A successful exploit could allow the attacker to corrupt the heap, causing the affected device to reload, resulting in a DoS condition.
CVSS v3.1: 6.8
CVE-2024-6805: Missing Authorization Checks in NI VeriStand Gateway for File Transfer Resources
The NI VeriStand Gateway is missing authorization checks when an actor attempts to access File Transfer resources.  These missing checks may result in information disclosure or remote code execution.  This affects NI VeriStand 2024 Q2 and prior versions.
CVSS v3.1: 7.5
CVE-2023-21383: In Settings, there is a possible way for the user to unintentionally send extra data due to an unclear prompt. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.
CVSS v3.1: 5.5
CVE-2016-3489: Unspecified vulnerability in the Data Pump Import component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows local users to affect confidentiality, integrity, and availability via unknown vectors.
CVSS v3.0: 6.7
CVSS v2.0: 7.2
CVE-2025-9404: Scada-LTS Folder pointHierarchySLTS cross site scripting
A vulnerability was identified in Scada-LTS up to 2.7.8.1. The affected element is an unknown function of the file /pointHierarchySLTS of the component Folder Handler. The manipulation of the argument Title leads to cross site scripting. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
CVSS v4.0: 4.8
CVSS v3.1: 2.4
CVSS v3.0: 2.4
CVSS v2.0: 3.3
CVE-2025-14189: Chanjet CRM jxf_dump_table_demo.php sql injection
A vulnerability was detected in Chanjet CRM up to 20251121. Affected is an unknown function of the file /tools/jxf_dump_table_demo.php. The manipulation of the argument gblOrgID results in sql injection. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 6.9
CVSS v3.1: 7.3
CVSS v3.0: 7.3
CVSS v2.0: 7.5
CVE-2025-12479: Systemic Lack of Cross-Site Request Forgery (CSRF) Token Implementation
Systemic Lack of Cross-Site Request Forgery (CSRF) Token Implementation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .
CVSS v4.0: 10
CVE-2026-41662: Admidio: Missing Minimum Administrator Check in Role Membership Removal
Admidio is an open-source user management solution. Prior to version 5.0.9, Role::stopMembership() does not verify whether removing a user from the administrator role leaves zero administrators. The deprecated Membership::stopMembership() contains this safety check, but the current code path bypasses it. Any administrator can remove the last remaining other administrator, locking the entire system out of administrative access. The exploit does not require concurrent requests; sequential removals produce the same result. This issue has been patched in version 5.0.9.
CVSS v3.1: 5.2
CVE-2020-11533: Ivanti Workspace Control before 10.4.30.0, when SCCM integration is enabled, allows local users to obtain sensitive information (keying material).
CVSS v3.1: 5.5
CVSS v2.0: 2.1
GHSA-5mvp-rfqx-xfgv: In all Qualcomm products with Android releases from CAF using the Linux kernel, user-level permissions can be used to gain access to kernel memory, specifically the ION cache maintenance code is writing to a user supplied address.
CVSS v3.0: 7.8
GHSA-p32r-2rg5-6gc2: A vulnerability was identified in MEPIS RM, an industrial
software product developed by Metronik. The application contained a hardcoded
cryptographic key within the Mx.Web.ComponentModel.dll component. When the
option to store domain passwords was enabled, this key was used to encrypt user
passwords before storing them in the application’s database. An attacker with
sufficient privileges to access the database could extract the encrypted
passwords, decrypt them using the embedded key, and gain unauthorized access to
the associated ICS/OT environment.
CVSS v3.1: 6.4
CVE-2020-12672: GraphicsMagick through 1.3.35 has a heap-based buffer overflow in ReadMNGImage in coders/png.c.
CVSS v3.1: 7.5
CVSS v2.0: 5
GHSA-5jwr-2vm6-6gqr: In the Linux kernel, the following vulnerability has been resolved:mm/page_table_check: fix crash on ZONE_DEVICENot all pages may apply to pgtable check.  One example is ZONE_DEVICE
pages: they map PFNs directly, and they don't allocate page_ext at all
even if there's struct page around.  One may reference
devm_memremap_pages().When both ZONE_DEVICE and page-table-check enabled, then try to map some
dax memories, one can trigger kernel bug constantly now when the kernel
was trying to inject some pfn maps on the dax device:kernel BUG at mm/page_table_check.c:55!While it's pretty legal to use set_pxx_at() for ZONE_DEVICE pages for page
fault resolutions, skip all the checks if page_ext doesn't even exist in
pgtable checker, which applies to ZONE_DEVICE but maybe more.
CVSS v3.1: 5.5
GHSA-4cm4-r3q9-95wh: SalonERP version 3.0.2 allows an external attacker to steal the cookie of arbitrary users. This is possible because the application does not correctly validate the page parameter against XSS attacks.
CVSS v3.1: 6.1
CVE-2022-21822: NVIDIA FLARE contains a vulnerability in the admin interface, where an un-authorized attacker can cause Allocation of Resources Without Limits or Throttling, which may lead to cause system unavailable.
CVSS v3.1: 7.5
CVE-2023-1090: WP SMTP Mailing Queue < 2.0.1 - Admin+ Stored XSS
The SMTP Mailing Queue WordPress plugin before 2.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS v3.1: 4.8
CVE-2007-4648: The nvcoaft51 driver in Norman Virus Control (NVC) 5.82 uses weak permissions (unrestricted write access) for the NvcOa device, which allows local users to gain privileges by (1) triggering a buffer overflow in a kernel pool via a string argument to ioctl 0xBF67201C; or by (2) sending a crafted KEVENT structure through ioctl 0xBF672028 to overwrite arbitrary memory locations.
CVSS v2.0: 7.2
GHSA-2fwg-qpp6-4fv9: Under certain conditions a malicious user can prevent legitimate users from accessing the SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, via IGS Chart service.
CVSS v3.0: 6.5
GHSA-98x8-3rxx-9jj8: The affected product is vulnerable to a command injection. An unauthenticated attacker could send commands through a malicious HTTP request which could result in remote code execution.
CVSS v4.0: 9.3
CVSS v3.1: 9.8
GHSA-9wx6-gp73-qg3j: Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a network.
CVSS v3.1: 8.1
CVE-2019-15129: The Recruitment module in Humanica Humatrix 7 1.0.0.203 and 1.0.0.681 allows an unauthenticated attacker to access all candidates' files in the photo folder on the website by specifying a "user id" parameter and file name, such as in a recruitment_online/upload/user/[user_id]/photo/[file_name] URI.
CVSS v3.0: 5.3
CVSS v2.0: 5
GHSA-q9g5-98pm-w6q7: Cobbler XSS Vulnerability
Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Cross Site Scripting (XSS) vulnerability in cobbler-web that can result in Privilege escalation to admin.. This attack appear to be exploitable via "network connectivity". Sending unauthenticated JavaScript payload to the Cobbler XMLRPC API (/cobbler_api).
CVSS v3.0: 6.1
CVE-2022-28367: OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content.
CVSS v3.1: 6.1
CVSS v2.0: 4.3
CVE-2019-16716: OX App Suite through 7.10.2 has Incorrect Access Control.
CVSS v3.1: 6.6
CVSS v2.0: 8.5
CVE-2022-46081: In Garmin Connect 4.61, terminating a LiveTrack session wouldn't prevent the LiveTrack API from continued exposure of private personal information. NOTE: this is disputed by the vendor because the LiveTrack API service is not a customer-controlled product.
CVSS v3.1: 7.5
CVE-2018-20586: bitcoind and Bitcoin-Qt prior to 0.17.1 allow injection of arbitrary data into the debug log via an RPC call.
CVSS v3.1: 5.3
CVSS v2.0: 4.3
CVE-2025-26410: Weak Hard-coded Credentials
The firmware of all Wattsense Bridge devices contain the same hard-coded user and root credentials. The user password can be easily recovered via password cracking attempts. The recovered credentials can be used to log into the device via the login shell that is exposed by the serial interface. The backdoor user has been removed in firmware BSP >= 6.4.1.
CVSS v3.1: 9.8
GHSA-pgwv-vmhf-qqmw: In the Linux kernel, the following vulnerability has been resolved:iio: accel: sca3300: fix uninitialized iio scan dataFix potential leak of uninitialized stack data to userspace by ensuring
that the `channels` array is zeroed before use.
CVSS v3.1: 5.5
GHSA-5jqx-3p4m-wv4h: Multiple integer overflows in mcrypt.c in the mcrypt extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allow remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted length value, related to the (1) mcrypt_generic and (2) mdecrypt_generic functions.
CVSS v3.0: 9.8
GHSA-h6p5-xfhf-88h8: Lack of cryptographic integrity check on TETRA air-interface encrypted traffic. Since a stream cipher is employed, this allows an active adversary to manipulate cleartext data in a bit-by-bit fashion.
CVSS v3.1: 5.9
CVE-2021-40041: There is a Cross-Site Scripting(XSS) vulnerability in HUAWEI WS318n product when processing network settings. Due to insufficient validation of user input, a local authenticated attacker could exploit this vulnerability by injecting special characters. Successful exploit could cause certain information disclosure. Affected product versions include: WS318n-21 10.0.2.2, 10.0.2.5 and 10.0.2.6.
CVSS v3.1: 4.2
CVSS v2.0: 1.9
GHSA-pqxp-mpqr-m4gq: SQL injection vulnerability in VirtueMart before 1.0.11 allows remote attackers to execute arbitrary SQL commands via unspecified parameters, possibly related to improper input validation of the PATH_INFO (PHP_SELF) by virtuemart_parser.php.
RHSA-2016:2575: Red Hat Security Advisory: curl security, bug fix, and enhancement update
curl: TLS session resumption client cert bypass curl: Re-using connection with wrong client cert curl: Incorrect reuse of client certificates
CVSS v3.0: 4.2
GHSA-hpv8-x276-m59f: vLLM Vulnerable to Remote DoS via Special-Token Placeholders
SummaryThis report explains a Token Injection vulnerability in vLLM’s multimodal processing. Unauthenticated, text-only prompts that spell special tokens are interpreted as control. Image and video placeholder sequences supplied without matching data cause vLLM to index into empty grids during input-position computation, raising an unhandled IndexError and terminating the worker or degrading availability. Multimodal paths that rely on `image_grid_thw`/`video_grid_thw` are affected. Severity: High (remote DoS). Reproduced on vLLM 0.10.0 with Qwen2.5-VL.DetailsAffected component: multimodal input position computation.File/functions (paths are indicative):vllm/model_executor/layers/rotary_embedding.pyget_input_positions_tensor(...)_vl_get_input_positions_tensor(...)Failure mechanism:The code counts detected vision tokens and then indexes video_grid_thw/image_grid_thw accordingly.When user input carries placeholder tokens but no actual multimodal payload, these grids are empty. The code does not bounds-check before indexing.Representative snippet (context):Abbreviated call path:PoCEnvironmentvLLM: 0.10.0Model: Qwen/Qwen2.5-VL-3B-InstructLaunch server:Request (text-only, no image/video data)Observed resultHTTP 500; logs show IndexError: list index out of range from _vl_get_input_positions_tensor(...).In some deployments, the worker exits and capacity remains reduced until manual restart.ImpactType: Token Injection leading to Remote Denial of Service (unauthenticated). A single request can trigger the fault.Scope: Any vLLM deployment that serves VLMs and accepts raw user text via OpenAI-compatible endpoints (self-hosted or proxied/managed fronts).Effect: Request → unhandled exception in position computation → worker termination / service unavailability.FixesChanges associated with https://github.com/vllm-project/vllm/issues/32656CreditsPengyu Ding (Infra Security, Ant Group)  
Ziteng Xu (Infra Security, Ant Group)
CVSS v3.1: 6.5
CVE-2018-14795: DeltaV Versions 11.3.1, 12.3.1, 13.3.0, 13.3.1, and R5 is vulnerable due to improper path validation which may allow an attacker to replace executable files.
CVSS v3.0: 8.8
CVSS v2.0: 6.5
RHSA-2009:1617: Red Hat Security Advisory: tomcat security update for Red Hat Network Satellite Server
tomcat request dispatcher information disclosure vulnerability tomcat6 Denial-Of-Service with AJP connection tomcat XML parser information disclosure
CVE-2018-19226: An issue was discovered in LAOBANCMS 2.0. It allows remote attackers to list .txt files via a direct request for the /data/0/admin.txt URI.
CVSS v3.0: 5.3
CVSS v2.0: 5
CVE-2023-46639: WordPress kk Star Ratings plugin <= 5.4.5 - Broken Access Control vulnerability
Missing Authorization vulnerability in FeedbackWP kk Star Ratings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects kk Star Ratings: from n/a through 5.4.5.
CVSS v3.1: 5.3
GHSA-6pxp-rm7g-gpvq: upc.exe in Ubisoft Uplay Desktop Client versions 63.0.5699.0 allows remote attackers to execute arbitrary code. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of URI handlers. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code under the context of the current process.
CVSS v3.0: 8.8
GHSA-8gj3-qcvj-2568: Unauthenticated Broken Access Control in Five Star Restaurant Menu <= 2.5.2 versions.
CVSS v3.1: 7.5
GHSA-pwr4-4xx9-866h: In construct_transaction_from_cmd of lwis_ioctl.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1: 7.8
CVE-2026-31468: vfio/pci: Fix double free in dma-buf feature
In the Linux kernel, the following vulnerability has been resolved:

vfio/pci: Fix double free in dma-buf feature

The error path through vfio_pci_core_feature_dma_buf() ignores its
own advice to only use dma_buf_put() after dma_buf_export(), instead
falling through the entire unwind chain.  In the unlikely event that
we encounter file descriptor exhaustion, this can result in an
unbalanced refcount on the vfio device and double free of allocated
objects.

Avoid this by moving the "put" directly into the error path and return
the errno rather than entering the unwind chain.
CVSS v3.1: 7.8
CVE-2019-6501: In QEMU 3.1, scsi_handle_inquiry_reply in hw/scsi/scsi-generic.c allows out-of-bounds write and read operations.
CVSS v3.0: 5.5
CVSS v2.0: 2.1
CVE-2025-24206: An authentication issue was addressed with improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4. An attacker on the local network may be able to bypass authentication policy.
CVSS v3.1: 7.7
CVE-2022-29417: WordPress ShortPixel Adaptive Images plugin <= 3.3.1 - Subscriber+ Plugin Settings Update vulnerability
Plugin Settings Update vulnerability in ShortPixel's ShortPixel Adaptive Images plugin <= 3.3.1 at WordPress allows an attacker with a low user role like a subscriber or higher to change the plugin settings.
CVSS v3.1: 4.3
CVE-2011-0872: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 6 Update 25 and earlier allows remote attackers to affect availability via unknown vectors related to NIO.
CVSS v2.0: 5
GHSA-m6f7-w2rh-cx8m: An unspecified interface in SAP TREX 7.10 Revision 63 allows remote attackers to execute arbitrary OS commands with SIDadm privileges via unspecified vectors, aka SAP Security Note 2234226.
CVSS v3.0: 9.8
GHSA-hhp5-2m4q-mmrp: An issue was discovered in swftools through 20200710. A NULL pointer dereference exists in the function params_dump() located in abc.c. It allows an attacker to cause Denial of Service.
GHSA-g7f2-pg3w-c5m2: The Clean Login WordPress plugin before 1.13.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CVSS v3.1: 5.4
GHSA-m735-cmh6-hrcx: NET&SYS MNG2120J 5.76.1006c and MNG6300 5.83.6305jrc2 devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
CVSS v3.0: 9.8
CVE-2013-2289: Cross-site scripting (XSS) vulnerability in admin/templates/default.php in Batavi 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING to admin/index.php.
CVSS v2.0: 4.3
GHSA-93hm-9f4h-hw39: Memory Corruption when multiple threads concurrently access and modify shared resources.
CVSS v3.1: 7.8
CVE-2025-30937: WordPress Responsify WP plugin <= 1.9.11 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in stefanledin Responsify WP responsify-wp allows Stored XSS.This issue affects Responsify WP: from n/a through <= 1.9.11.
CVSS v3.1: 5.9
CVE-2003-0657: Multiple SQL injection vulnerabilities in the infolog module for phpgroupware 0.9.14 and earlier could allow remote attackers to conduct unauthorized database actions.
CVSS v2.0: 7.5
CVE-2025-0466: Sensei LMS < 4.24.4 - Unauthenticated sensei_email/sensei_message Disclosure
The Sensei LMS WordPress plugin before 4.24.4 does not properly protect some its REST API routes, allowing unauthenticated attackers to leak sensei_email and sensei_message Information.
CVSS v3.1: 5.3
PYSEC-2008-15: Multiple cross-site request forgery (CSRF) vulnerabilities in Plone CMS 3.0.5 and 3.0.6 allow remote attackers to (1) add arbitrary accounts via the join_form page and (2) change the privileges of arbitrary groups via the prefs_groups_overview page.
GHSA-8gcc-m45m-24jc: The Weluka Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'weluka-map' shortcode in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
GHSA-wq63-c6fv-j4j6: The goTenna Pro has a payload length vulnerability that makes it possible to tell the length of the payload regardless of the encryption used.
CVSS v4.0: 5.3
CVSS v3.1: 4.3
GHSA-5fpf-9vcp-wpjr: A potential attacker can execute an arbitrary code at the time of the PEI phase and influence the subsequent boot stages. This can lead to the mitigations bypassing, physical memory contents disclosure, discovery of any secrets from any Virtual Machines (VMs) and bypassing memory isolation and confidential computing boundaries. Additionally, an attacker can build a payload which can be injected into the SMRAM memory. This issue affects: Module name: S3Resume2Pei SHA256: 7bb29f05534a8a1e010443213451425098faebd45948a4642db969b19d0253fc Module GUID: 89E549B0-7CFE-449D-9BA3-10D8B2312D71
CVSS v3.1: 8.2
GHSA-3x35-4hvx-j24p: In ConvertRGBToPlanarYUV of Codec2BufferUtils.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1: 7.4
GHSA-35qp-vx95-wwwf: A Command Injection vulnerability in Zoom Node Multimedia Routers (MMRs) before version 5.2.1716.0 may allow a meeting participant to conduct remote code execution of the MMR via network access.
CVSS v3.1: 9.9