ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2018-7535: An issue was discovered in TotalAV v4.1.7. An unprivileged user could modify or overwrite all of the product's files because of weak permissions (Everyone:F) under %PROGRAMFILES%, which allows local users to gain privileges or obtain maximum control over the product.
CVSS v3.0: 7.8
CVSS v2.0: 7.2
GHSA-86mr-69pg-9x7h: Huijietong Cloud Video Platform contains a path traversal vulnerability that allows an unauthenticated attacker can supply arbitrary file paths to the `fullPath` parameter of the `/fileDownload?action=downloadBackupFile` endpoint and retrieve files from the server filesystem. VulnCheck has observed this vulnerability being targeted by the Rondo botnet.
CVSS v4.0: 8.7
CVE-2024-38260: Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability
Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability
CVSS v3.1: 8.8
GHSA-m68r-w6q7-9x79: The SmarterTools SmarterStats 6.0 web server does not properly validate string data that is intended for storage in an XML document, which allows remote attackers to cause a denial of service (parsing error and daemon pause) via vectors involving (1) certain cookies in a SiteInfoLookup action to Admin/frmSites.aspx, or certain (2) cookies or (3) parameters to (a) Client/frmViewOverviewReport.aspx, (b) Client/frmViewReports.aspx, or (c) Services/SiteAdmin.asmx, as demonstrated by a ]]>> string, related to an "XML injection" issue.
GHSA-jg5c-9892-9g8h: BMC Patrol allows any remote attacker to flood its UDP port, causing a denial of service.
CVE-2018-15434: Cisco Unified IP Phone 7900 Series Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Unified IP Phone 7900 Series could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
CVE-2025-26564: WordPress GNUCommerce Plugin <= 1.5.4 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kagla GNUCommerce gnucommerce allows Reflected XSS.This issue affects GNUCommerce: from n/a through <= 1.5.4.
CVSS v3.1: 7.1
GHSA-6f38-6h33-w674: Unknown vulnerability in AppleFileServer for Mac OS X 10.3.4, related to "the use of SSH and reporting errors," has unknown impact and attack vectors.
CVE-2014-1271: CoreCapture in Apple iOS before 7.1 and Apple TV before 6.1 does not properly validate IOKit API calls, which allows attackers to cause a denial of service (assertion failure and device crash) via a crafted app.
CVSS v2.0: 7.8
GHSA-whcg-w8gv-22hp: Multiple cross-site request forgery (CSRF) vulnerabilities in Piwigo before 2.6.2 allow remote attackers to hijack the authentication of administrators for requests that use the (1) pwg.groups.addUser, (2) pwg.groups.deleteUser, (3) pwg.groups.setInfo, (4) pwg.users.setInfo, (5) pwg.permissions.add, or (6) pwg.permissions.remove method.
CVE-2021-45504: Certain NETGEAR devices are affected by authentication bypass. This affects CBR40 before 2.5.0.24, CBR750 before 4.6.3.6, RBR852 before 3.2.17.12, RBR850 before 3.2.17.12, and RBS850 before 3.2.17.12.
CVSS v3.1: 9.6
CVE-2026-4660: Go-getter may allow to arbitrary filesystem reads through git operations
HashiCorp’s go-getter library up to v1.8.5 may allow arbitrary file reads on the file system during certain git operations through a maliciously crafted URL. This vulnerability, CVE-2026-4660, is fixed in go-getter v1.8.6. This vulnerability does not affect the go-getter/v2 branch and package.
CVSS v3.1: 7.5
GHSA-chfv-xhr2-p6ww: SQL injection vulnerability in UStore allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password fields.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVE-2025-46965: Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS v3.1: 5.4
CVE-2025-13605: Shell command injection in 3onedata GW1101-1D(RS-485)-TB-P modbus gateway
3onedata modbus gateway device model GW1101-1D(RS-485)-TB-P (hardware version V2.2.0) allows authenticated users to execute arbitrary shell commands in the context of the root user by providing payload in the "IP address" field of the diagnosis test tools.
This issue has been resolved in firmware version 3.0.59B2024080600R4353
CVSS v4.0: 9.3
CVE-2022-22733: Access-Token in ElasticJob UI causes password disclosure
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache ShardingSphere ElasticJob-UI allows an attacker who has guest account to do privilege escalation. This issue affects Apache ShardingSphere ElasticJob-UI Apache ShardingSphere ElasticJob-UI 3.x version 3.0.0 and prior versions.
CVSS v3.1: 6.5
CVSS v2.0: 4
GHSA-9fh8-c7m3-4mgf: Improper input validation in UserAuthenticationSmm driver in UEFI firmware for some Intel(R) Server D50DNP Family products may allow a privileged user to enable escalation of privilege via local access.
CVSS v3.1: 7.5
GHSA-p74h-fjjv-jrm8: A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application does not properly assign rights to temporary files created during its update process. This could allow an authenticated attacker with the 'Manage firmware updates' role to escalate their privileges on the underlying OS level.
CVSS v4.0: 9.3
CVSS v3.1: 9.6
CVE-2002-2113: search.cgi in AGH HTMLsearch 1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the template parameter.
CVSS v2.0: 7.5
GHSA-jj45-xvq5-rhh9: Kratos has a Confused Deputy issue
A security flaw has been discovered in go-kratos kratos up to 2.9.2. This impacts the function NewServer of the file transport/http/server.go of the component http.DefaultServeMux Fallback Handler. The manipulation results in unintended intermediary. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The patch is identified as 0284a5bcf92b5a7ee015300ce3051baf7ae4718d. Applying a patch is advised to resolve this issue.
CVSS v4.0: 5.5
CVSS v3.1: 5.3
CVE-2016-11020: Kunena before 5.0.4 does not restrict avatar file extensions to gif, jpeg, jpg, and png. This can lead to XSS and remote code execution.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2022-39886: Improper access control vulnerability in IpcRxServiceModeBigDataInfo in RIL prior to SMR Nov-2022 Release 1 allows local attacker to access Device information.
CVSS v3.1: 5.9
CVE-2013-4251: The scipy.weave component in SciPy before 0.12.1 creates insecure temporary directories.
CVSS v3.1: 7.8
CVSS v2.0: 4.6
GHSA-vxp7-5w84-27pf: In Splunk AI Toolkit versions below 5.7.4, a user who holds the "admin" Splunk role could execute arbitrary OS commands on the host running the Splunk Enterprise instance.The vulnerability is possible because of an unsafe shell execution pattern in the btool configuration helper, which constructs OS command strings from dynamic parameters without disabling shell interpretation.
CVSS v3.1: 9.1
GHSA-29xj-m56g-2pfp: The TSymbolTableLevel class in ANGLE, as used in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 on Windows, allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact by triggering use of a WebGL shader that writes to an array.
CVSS v3.0: 8.8
CVE-2019-15356: The Lava Flair Z1 Android device with a build fingerprint of LAVA/Z1/Z1:8.1.0/O11019/1536680131:user/release-keys contains a pre-installed app with a package name of com.mediatek.wfo.impl app (versionCode=27, versionName=8.1.0) that allows any app co-located on the device to modify a system property through an exported interface without proper authorization.
CVSS v3.1: 5.5
CVSS v2.0: 2.1
CVE-2018-10843: source-to-image component of Openshift Container Platform before versions atomic-openshift 3.7.53, atomic-openshift 3.9.31 is vulnerable to a privilege escalation which allows the assemble script to run as the root user in a non-privileged container. An attacker can use this flaw to open network connections, and possibly other actions, on the host which are normally only available to a root user.
CVSS v3.0: 8.5
CVE-2006-2036: iOpus Secure Email Attachments (SEA), probably 1.0, does not properly handle passwords that consist of repetitions of a substring, which allows attackers to decrypt files by entering only the substring.
CVSS v2.0: 2.1
CVE-2024-32130: WordPress Payment Forms for Paystack plugin <= 3.4.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paystack Payment Forms for Paystack allows Stored XSS.This issue affects Payment Forms for Paystack: from n/a through 3.4.1.
CVSS v3.1: 6.5
CVE-2024-4496: Tenda i21 formWifiMacFilterSet stack-based overflow
A vulnerability was found in Tenda i21 1.0.0.14(4656). It has been classified as critical. This affects the function formWifiMacFilterSet. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263085 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v3.1: 8.8
CVSS v3.0: 8.8
CVSS v2.0: 9
GHSA-fh5q-rp44-j3px: IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) could allow an authenticated user to access system files they should not have access to some of which could contain account credentials. IBM X-Force ID: 140368.
CVSS v3.1: 6.5
GHSA-j5fh-8vfx-pf9m: Improper access control vulnerability in Samsung Pass prior to version 4.2.03.1 allows physical attackers to access data of Samsung Pass.
CVSS v3.1: 4.6
RHSA-2012:1027: Red Hat Security Advisory: jbossas-web and jboss-naming security update
JNDI: unauthenticated remote write access is permitted by default JBoss: authentication bypass when running under JACC with ignoreBaseDecision on JBossWebRealm
GHSA-4749-58fp-f8q3: Missing Authorization vulnerability in RadiusTheme Classified Listing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Classified Listing: from n/a through 5.0.6.
CVSS v3.1: 4.3
CVE-2007-5833: Multiple cross-site scripting (XSS) vulnerabilities in BosDev BosMarket Business Directory System allow remote authenticated users to inject arbitrary web script or HTML via (1) user info (account details) or (2) a post.
CVSS v2.0: 3.5
CVE-2025-14557: XSS in Drupal 7 Facebook Pixel Module
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Facebook Pixel facebook_pixel allows Stored XSS.This issue affects Facebook Pixel: from 7.X-1.0 through 7.X-1.1.
CVSS v4.0: 4.8
CVE-2017-16814: A Directory Traversal issue was discovered in the Foxit MobilePDF app before 6.1 for iOS. This occurs by abusing the URL + escape character during a Wi-Fi transfer, which could be exploited by attackers to bypass intended restrictions on local application files.
CVSS v3.0: 5.5
CVSS v2.0: 3.3
CVE-2020-35943: A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload. (It is possible to bypass CSRF protection by simply not including a nonce parameter.)
CVSS v3.1: 6.5
CVSS v2.0: 4.3
GHSA-m99q-89rr-5mvx: A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been classified as critical. This affects an unknown part of the file /view/teacher_salary_details2.php. The manipulation of the argument index leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-265983.
CVSS v3.1: 6.3
GHSA-mvc9-pmvw-rc98: In libxaac there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-116117112
CVSS v3.1: 8.8
GHSA-h8vm-48f3-mgwg: Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.72 and earlier, 5.5.34 and earlier, and 5.6.14 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer.
GHSA-hcg3-q754-cr77: golang.org/x/crypto Vulnerable to Denial of Service (DoS) via Slow or Incomplete Key Exchange
SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.
CVSS v3.1: 7.5
GHSA-gpc8-vf5r-8fj8: In the Linux kernel, the following vulnerability has been resolved:ksmbd: fix possible memory leak in smb2_lock()argv needs to be free when setup_async_work fails or when the current
process is woken up.
GHSA-ggc6-2q83-mf7r: Vulnerability in the Oracle Database - Enterprise Edition Recovery component of Oracle Database Server. For supported versions that are affected see note. Easily exploitable vulnerability allows high privileged attacker having EXECUTE ON DBMS_IR.EXECUTESQLSCRIPT privilege with network access via Oracle Net to compromise Oracle Database - Enterprise Edition Recovery. Successful attacks of this vulnerability can result in takeover of Oracle Database - Enterprise Edition Recovery. Note: None of the supported versions are affected. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
CVSS v3.1: 7.2
RHSA-2019:1966: Red Hat Security Advisory: samba security, bug fix and enhancement update
samba: save registry file outside share as unprivileged user
CVSS v3.0: 4.2
CVE-2022-41732: IBM Maximo information disclosure

IBM Maximo Mobile 8.7 and 8.8 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 237407.


CVSS v3.1: 6.2
CVE-2007-4389: Cross-site request forgery (CSRF) vulnerability in /xslt in 2wire 1701HG, 1800HW, and 2071 Gateway routers, with 3.17.5, 3.7.1, and 5.29.51 software, allows remote attackers to create DNS mappings as administrators, and conduct DNS poisoning attacks, via the NAME and ADDR parameters.
CVSS v2.0: 7.8
CVE-2023-0241: pgAdmin 4 versions prior to v6.19 contains a directory traversal vulnerability. A user of the product may change another user's settings or alter the database.
CVSS v3.1: 6.5
CVE-2017-8291: Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program, as exploited in the wild in April 2017.
CVSS v3.1: 7.8
CVSS v2.0: 6.8
GHSA-4vj4-8fp8-rvf8: A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the affected software. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to click a maliciously crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
CVSS v3.0: 6.1
CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing
In the Linux kernel, the following vulnerability has been resolved:

sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing

When a listening SCTP server processes a COOKIE_ECHO chunk, the cached
peer INIT chunk embedded after the cookie is parsed and its parameters
are later walked by sctp_process_init() using sctp_walk_params().

However, the chunk header length of this cached INIT chunk was not
validated against the remaining buffer in the COOKIE_ECHO payload. If
the length field is inflated, the parameter walk can run beyond the
actual received data, leading to out-of-bounds reads and potential
memory corruption during later parameter handling (e.g. STATE_COOKIE
processing and kmemdup() copies).

Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT
chunk length does not exceed the available data in the COOKIE_ECHO
buffer before it is used.
CVSS v3.1: 9.8
CVE-2010-1030: Unspecified vulnerability in HP-UX B.11.31, with AudFilter rules enabled, allows local users to cause a denial of service via unknown vectors.
CVSS v2.0: 4.4
CVE-2021-42771: Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution.
CVSS v3.1: 7.8
CVSS v2.0: 7.2
CVE-2002-0739: Cross-site scripting in PostCalendar 3.02 allows remote attackers to insert arbitrary HTML and script, and steal cookies, by modifying a calendar entry in its preview page.
CVSS v2.0: 7.5
GHSA-974x-ffmp-xpv3: auraCMS 1.5 allows remote attackers to obtain sensitive information via an HTTP request with an invalid id parameter to (1) teman.php, (2) hal.php, or (3) arsip.php, which reveals the path in a PHP error message.
RHSA-2014:1173: Red Hat Security Advisory: flash-plugin security update
flash-plugin: multiple code execution or security bypass flaws (APSB14-21) flash-plugin: same origin policy bypass (APSB14-21) flash-plugin: multiple code execution or security bypass flaws (APSB14-21) flash-plugin: multiple code execution or security bypass flaws (APSB14-21) flash-plugin: multiple code execution or security bypass flaws (APSB14-21) flash-plugin: multiple code execution or security bypass flaws (APSB14-21) flash-plugin: multiple code execution or security bypass flaws (APSB14-21) flash-plugin: multiple code execution or security bypass flaws (APSB14-21) flash-plugin: multiple code execution or security bypass flaws (APSB14-21) flash-plugin: multiple code execution or security bypass flaws (APSB14-21) flash-plugin: multiple code execution or security bypass flaws (APSB14-21) flash-plugin: multiple code execution or security bypass flaws (APSB14-21)
GHSA-796m-2973-wc5q: OpenClaw has exec allowlist/safeBins policy-runtime mismatch via env -S wrapper interpretation
Summary`tools.exec` allowlist/safe-bins evaluation could diverge from runtime execution for wrapper commands using GNU `env -S/--split-string` semantics. This allowed policy checks to treat a command as a benign safe-bin invocation while runtime executed a different payload.Affected Packages / VersionsPackage: `openclaw` (npm)Vulnerable versions: `<= 2026.2.22-2` (latest currently published npm version)Patched version (released): `2026.2.23`ImpactAn attacker able to influence tool command text (for example via untrusted prompt/content injection reaching an exec-capable flow) could bypass allowlist/safe-bins intent and execute unexpected commands.Technical DetailsRoot cause was policy/runtime interpretation mismatch for dispatch wrappers:analysis resolved an effective executable from wrapper-unwrapped argv,execution could still run original wrapper argv semantics,safe-bin short-flag handling also allowed unknown short options in clusters.RemediationThe fix hardens exec approvals to fail closed and enforce analysis/runtime parity:introduce wrapper execution planning with semantic-wrapper blocking,carry planned `effectiveArgv` + `policyBlocked` metadata through resolution,evaluate allowlist/safe-bins against planned argv,enforce canonical rebuilt shell command from planned argv for allowlist auto-paths,use planned argv for node-host/mac exec-host invocation paths,reject unknown short safe-bin flags,add regression tests for semantic `env` wrappers and parity fixtures.Fix Commit(s)`a1c4bf07c6baad3ef87a0e710fe9aef127b1f606`Release Process Note`patched_versions` is pre-set to the released version (`2026.2.23`). Patched in `2026.2.23` and published.OpenClaw thanks @jiseoung for reporting.
CVSS v4.0: 5.7
GHSA-q67g-j9gg-987x: httpd.c in atophttpd 2.8.0 has an off-by-one error and resultant out-of-bounds read because a certain 1024-character req string would not have a final '\0' character.
CVSS v3.1: 5.3
RHSA-2017:1916: Red Hat Security Advisory: glibc security, bug fix, and enhancement update
glibc: Unbounded stack allocation in nan* functions glibc: Segmentation fault caused by passing out-of-range data to strftime() glibc: LD_POINTER_GUARD in the environment is not sanitized glibc: Integer overflow in hcreate and hcreate_r glibc: Unbounded stack allocation in catopen function
CVSS v3.0: 8.1
CVE-2024-1843: Auto Affiliate Links <= 6.4.3 - Missing Authorization via aalAddLink
The Auto Affiliate Links plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the aalAddLink function in all versions up to, and including, 6.4.3. This makes it possible for authenticated attackers, with subscriber access or higher, to add arbitrary links to posts.
CVSS v3.1: 4.3
CVE-2022-42270: NVIDIA distributions of Linux contain a vulnerability in nvdla_emu_task_submit, where unvalidated input may allow a local attacker to cause stack-based buffer overflow in kernel code, which may lead to escalation of privileges, compromised integrity and confidentiality, and denial of service.


CVSS v3.1: 7.8
CVE-2025-30371: Metabase vulnerable to circumvention of local link access protection in GeoJson endpoint
Metabase is a business intelligence and embedded analytics tool. Versions prior to v0.52.16.4, v1.52.16.4, v0.53.8, and v1.53.8 are vulnerable to circumvention of local link access protection in GeoJson endpoint. Self hosted Metabase instances that are using the GeoJson feature could be potentially impacted if their Metabase is colocated with other unsecured resources. This is fixed in v0.52.16.4, v1.52.16.4, v0.53.8, and v1.53.8. Migrating to Metabase Cloud or redeploying Metabase in a dedicated subnet with strict outbound port controls is an available workaround.
CVSS v4.0: 2.1
GHSA-7wxq-7p7w-g6p5: The LDAP configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
GHSA-2328-876m-g2rg: In vowifiservice, there is a possible missing permission check.This could lead to local denial of service with no additional execution privileges
CVSS v3.1: 5.5
CVE-2026-7139: Totolink A8000RU CGI cstecgi.cgi setWiFiAclRules os command injection
A flaw has been found in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setWiFiAclRules of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument mode causes os command injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.
CVSS v4.0: 9.3
CVSS v3.1: 9.8
CVSS v3.0: 9.8
CVSS v2.0: 10