ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-qpc9-3gvw-7vfq: In the Linux kernel, the following vulnerability has been resolved:mm/damon/core: validate damos_quota_goal->nid for node_mem_{used,free}_bpPatch series "mm/damon/core: validate damos_quota_goal->nid".node_mem[cg]_{used,free}_bp DAMOS quota goals receive the node id.  The
node id is used for si_meminfo_node() and NODE_DATA() without proper
validation.  As a result, privileged users can trigger an out of bounds
memory access using DAMON_SYSFS.  Fix the issues.The issue was originally reported [1] with a fix by another author.  The
original author announced [2] that they will stop working including the
fix that was still in the review stage.  Hence I'm restarting this.This patch (of 2):Users can set damos_quota_goal->nid with arbitrary value for
node_mem_{used,free}_bp.  But DAMON core is using those for
si_meminfo_node() without the validation of the value.  This can result in
out of bounds memory access.  The issue can actually triggered using DAMON
user-space tool (damo), like below.Fix this issue by adding the validation of the given node.  If an invalid
node id is given, it returns 0% for used memory ratio, and 100% for free
memory ratio.
CVSS v3.1: 7.1
GHSA-pjrg-ghwc-jw95: Cloudera Hue 4.6.0 allows XSS.
CVE-2023-29924: PowerJob V4.3.1 is vulnerable to Incorrect Access Control that allows for remote code execution.
CVSS v3.1: 9.8
CVE-2024-55997: WordPress Order Delivery & Pickup Location Date Time plugin <= 1.1.0 - Settings Change vulnerability
Missing Authorization vulnerability in webchunky Order Delivery & Pickup Location Date Time order-delivery-pickup-location-date-time-free-version allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Delivery & Pickup Location Date Time: from n/a through <= 1.1.0.
CVSS v3.1: 6.5
CVE-2022-2123: WP Opt-in <= 1.4.1 - Arbitrary Settings Update via CSRF
The WP Opt-in WordPress plugin through 1.4.1 is vulnerable to CSRF which allows changed plugin settings and can be used for sending spam emails.
CVSS v3.1: 4.3
CVSS v2.0: 4.3
CVE-2015-1165: RT (aka Request Tracker) 3.8.8 through 4.x before 4.0.23 and 4.2.x before 4.2.10 allows remote attackers to obtain sensitive RSS feed URLs and ticket data via unspecified vectors.
CVSS v2.0: 5
GHSA-x4xh-336q-prh9: ObjectPlanet Opinio before 7.13 allows reflected XSS via the survey/admin/surveyAdmin.do?action=viewSurveyAdmin query string. (There is also stored XSS if input to survey/admin/*.do is accepted from untrusted users.)
CVE-2024-36743: An issue in OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a Denial of Service (DoS) when an empty array is processed with oneflow.dot.
CVSS v3.1: 7.5
GHSA-wc92-3pj9-g4g4: An attacker can cause a Denial of Service and kernel panic in v4.2 and earlier versions of Espressif esp32 via a malformed beacon csa frame. The device requires a reboot to recover.
GHSA-2xr3-fxm9-q75h: Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
CVSS v3.1: 7.8
GHSA-wx59-9gp6-398v: Cross Site Scripting vulnerability in Ferozo Email version 1.1 allows a local attacker to execute arbitrary code via a crafted payload to the PDF preview component.
CVSS v3.1: 5.4
CVE-2023-22337: Improper input validation for some Intel Unison software may allow an unauthenticated user to potentially enable denial of service via network access.
CVSS v3.1: 7.5
CVE-2022-36872: Pending Intent hijacking vulnerability in SpayNotification in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows attackers to access files without permission via implicit Intent.
CVSS v3.1: 5
GHSA-c24v-xf6x-r8cc: Buffer overflow in sysctl in the Linux Kernel 2.6 before 2.6.15 allows local users to corrupt user memory and possibly cause a denial of service via a long string, which causes sysctl to write a zero byte outside the buffer.  NOTE: since the sysctl is called from a userland program that provides the argument, this might not be a vulnerability, unless a legitimate user-assisted or setuid scenario can be identified.
GHSA-v9r4-9w2c-2xcp: Crypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number of iterations.The default algorithm is HMAC-SHA1, which should only be used for legacy systems.These versions default to using 1000 iterations.Depending on the chosen algorithm, 220,000 to 1,400,000 iterations should be used.
CVSS v3.1: 5.3
RHSA-2024:0252: Red Hat Security Advisory: krb5 security update
An update for krb5 is now available for Red Hat Enterprise Linux 8.6 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
GHSA-r53m-pfr5-7v87: Moderate severity vulnerability that affects org.apache.tomcat.embed:tomcat-embed-core
**Withdrawn:** Duplicate of GHSA-qcxh-w3j9-58qr
CVE-2014-0537: Adobe Flash Player before 13.0.0.231 and 14.x before 14.0.0.145 on Windows and OS X and before 11.2.202.394 on Linux, Adobe AIR before 14.0.0.137 on Android, Adobe AIR SDK before 14.0.0.137, and Adobe AIR SDK & Compiler before 14.0.0.137 allow attackers to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2014-0539.
CVSS v2.0: 7.5
GHSA-xmjp-848v-p77x: Use after free in Performance Manager in Google Chrome prior to 102.0.5005.61 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.
CVSS v3.1: 8.8
GHSA-rgx6-gx96-7frc: A Cross Window Forgery vulnerability exists within GitLab CE/EE affecting all versions from 16.3 prior to 16.11.5, 17.0 prior to 17.0.3, and 17.1 prior to 17.1.1. This condition allows for an attacker to abuse the OAuth authentication flow via a crafted payload.
CVSS v3.1: 6.8
CVE-2015-2824: Multiple SQL injection vulnerabilities in the Simple Ads Manager plugin before 2.7.97 for WordPress allow remote attackers to execute arbitrary SQL commands via a (1) hits[][] parameter in a sam_hits action to sam-ajax.php; the (2) cstr parameter in a load_posts action to sam-ajax-admin.php; the (3) searchTerm parameter in a load_combo_data action to sam-ajax-admin.php; or the (4) subscriber, (5) contributor, (6) author, (7) editor, (8) admin, or (9) sadmin parameter in a load_users action to sam-ajax-admin.php.
CVSS v2.0: 7.5
GHSA-qhqf-2vhv-8929: ATutor 2.2.4 contains a SQL injection vulnerability in the admin user deletion page that allows authenticated attackers to manipulate database queries through the 'id' parameter. Attackers can exploit the vulnerability by injecting malicious SQL code into the 'id' parameter of the admin_delete.php script to potentially extract or modify database information.
CVSS v4.0: 7
CVSS v3.1: 7.1
CVE-2025-7131: Campcodes Payroll Management System ajax.php sql injection
A vulnerability was found in Campcodes Payroll Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /ajax.php?action=save_employee_attendance. The manipulation of the argument employee_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 6.9
CVSS v3.1: 7.3
CVSS v3.0: 7.3
CVSS v2.0: 7.5
GHSA-79gr-58r3-pwm3: Symfony Unsafe Cache Serialization Could Enable RCE
An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. Serializing certain cache adapter interfaces could result in remote code injection. This is related to symfony/cache.
CVSS v3.1: 9.8
RHSA-2015:1834: Red Hat Security Advisory: firefox security update
Mozilla: Miscellaneous memory safety hazards (MFSA 2015-96) Mozilla: Buffer overflow in libvpx while parsing vp9 format video (MFSA 2015-101) Mozilla: Use-after-free while manipulating HTML media content (MFSA 2015-106) Mozilla: Buffer overflow while decoding WebM video (MFSA 2015-105) Mozilla: Vulnerabilities found through code inspection (MFSA 2015-112) Mozilla: Dragging and dropping images exposes final URL after redirects (MFSA 2015-110) Mozilla: Errors in the handling of CORS preflight request headers (MFSA 2015-111) Mozilla: Vulnerabilities found through code inspection (MFSA 2015-112) Mozilla: Vulnerabilities found through code inspection (MFSA 2015-112) Mozilla: Vulnerabilities found through code inspection (MFSA 2015-112) Mozilla: Vulnerabilities found through code inspection (MFSA 2015-112) Mozilla: Vulnerabilities found through code inspection (MFSA 2015-112) Mozilla: Vulnerabilities found through code inspection (MFSA 2015-112) Mozilla: Vulnerabilities found through code inspection (MFSA 2015-112)
GHSA-g82p-qfjv-w56j: Wordpress Plugin Store / Mike Rooijackers Recall Products V0.8 is affected by: Cross Site Scripting (XSS) via the 'Recall Settings' field in admin.php. An attacker can inject JavaScript code that will be stored and executed.
CVE-2024-10944: FactoryTalk® Updater Remote Code Execution
A Remote
Code Execution vulnerability exists in the affected product. The vulnerability requires
a high level of permissions and exists due to improper input validation resulting
in the possibility of a malicious Updated Agent being deployed.
CVSS v4.0: 7.1
CVSS v3.1: 8.4
CVE-2006-1392: Multiple cross-site scripting (XSS) vulnerabilities in index.cgi in the login server in University of Washington Pubcookie 3.0.0, 3.1.0, 3.1.1, 3.2 before 3.2.1b, and 3.3 before 3.3.0a allow remote attackers to inject arbitrary web script or HTML via unspecified inputs.
CVSS v2.0: 4.3
RHSA-2016:0430: Red Hat Security Advisory: xerces-c security update
xerces-c: parser crashes on malformed input
CVE-2024-12995: ruifang-tech Rebuild Project Tasks Section tasks cross site scripting
A vulnerability classified as problematic has been found in ruifang-tech Rebuild 3.8.6. This affects an unknown part of the file /project/050-9000000000000001/tasks of the component Project Tasks Section. The manipulation of the argument description leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 5.3
CVSS v3.1: 3.5
CVSS v3.0: 3.5
CVSS v2.0: 4
GHSA-9c64-9pw3-wh7p: An issue has been discovered in GitLab EE affecting all versions starting from 12.5 before 17.1.6, all versions starting from 17.2 before 17.2.4, all versions starting from 17.3 before 17.3.1. Under certain conditions it may be possible to bypass the IP restriction for groups through GraphQL allowing unauthorised users to perform some actions at the group level.
CVSS v3.1: 4.3
GHSA-8mxg-6836-hfxw: The WP GPX Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sgpx' shortcode in all versions up to, and including, 1.7.08 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
CVE-2007-5675: Stack-based buffer overflow in the DebugPrint function in MultiXTpm Application Server before 4.0.2d allows remote attackers to execute arbitrary code via a long string argument.
CVSS v2.0: 7.5
GHSA-hpc7-gcqm-58fv: Issue summary: PBMAC1 parameters in PKCS#12 files are missing validation
which can trigger a stack-based buffer overflow, invalid pointer or NULL
pointer dereference during MAC verification.Impact summary: The stack buffer overflow or NULL pointer dereference may
cause a crash leading to Denial of Service for an application that parses
untrusted PKCS#12 files. The buffer overflow may also potentially enable
code execution depending on platform mitigations.When verifying a PKCS#12 file that uses PBMAC1 for the MAC, the PBKDF2
salt and keylength parameters from the file are used without validation.
If the value of keylength exceeds the size of the fixed stack buffer used
for the derived key (64 bytes), the key derivation will overflow the buffer.
The overflow length is attacker-controlled. Also, if the salt parameter is
not an OCTET STRING type this can lead to invalid or NULL pointer
dereference.Exploiting this issue requires a user or application to process
a maliciously crafted PKCS#12 file. It is uncommon to accept untrusted
PKCS#12 files in applications as they are usually used to store private
keys which are trusted by definition. For this reason the issue was assessed
as Moderate severity.The FIPS modules in 3.6, 3.5 and 3.4 are not affected by this issue, as
PKCS#12 processing is outside the OpenSSL FIPS module boundary.OpenSSL 3.6, 3.5 and 3.4 are vulnerable to this issue.OpenSSL 3.3, 3.0, 1.1.1 and 1.0.2 are not affected by this issue as they do
not support PBMAC1 in PKCS#12.
CVSS v3.1: 6.1
CVE-2026-24370: WordPress The Grid plugin < 2.8.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Theme-one The Grid the-grid allows Stored XSS.This issue affects The Grid: from n/a through < 2.8.0.
CVSS v3.1: 6.5
CVE-2014-1314: WindowServer in Apple OS X through 10.9.2 does not prevent session creation by a sandboxed application, which allows attackers to bypass the sandbox protection mechanism and execute arbitrary code via a crafted application.
CVSS v2.0: 10
CVE-2016-10385: In all Qualcomm products with Android releases from CAF using the Linux kernel, a use-after-free vulnerability exists in IMS RCS.
CVSS v3.0: 9.8
CVSS v2.0: 10
GHSA-4p9p-g6c8-9x7p: Multiple cross-site scripting (XSS) vulnerabilities in BEdita before 3.6.0 allow remote attackers to inject arbitrary web script or HTML via the (1) cfg[projectName] parameter to index.php/admin/saveConfig, the (2) data[stats_provider_url] parameter to index.php/areas/saveArea, or the (3) data[description] parameter to index.php/areas/saveSection.
CVE-2007-2733: Unrestricted file upload vulnerability in Jetbox CMS allows remote authenticated users with author privileges to upload arbitrary scripts via unspecified vectors, which can be accessed in webfiles/.  NOTE: this issue might be a duplicate of CVE-2004-1448.
CVSS v2.0: 6
CVE-2024-11283: WP JobHunt <= 7.1 - Authentication Bypass to Candidate
The WP JobHunt plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 7.1. This is due to wp_ajax_google_api_login_callback function not properly verifying a user's identity prior to authenticating them. This makes it possible for unauthenticated attackers to access arbitrary candidate accounts.
CVSS v3.1: 7.5
GHSA-5cxw-77wg-jrf3: PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context
SummaryPraisonAI's direct-prompt CLI automatically expands `@url:` mentions in raw prompt text before agent execution begins.If a prompt contains `@url:<http-or-https-url>`, the CLI calls `MentionsParser.process(...)`. The `@url:` handler then performs a direct `urllib.request.urlopen()` request to the attacker-controlled URL and returns the response body. That response body is prepended to the final model prompt context.There is no loopback/private-address restriction, no metadata-service restriction, and no approval gate before the fetch.As a result, attacker-influenced prompt text can cause the operator's machine to fetch localhost-only HTTP resources and inject the response into model context.Example:This causes PraisonAI to make an HTTP request to the local machine and prepend the fetched response body to the prompt that the model receives.This is a narrow local SSRF / local content disclosure issue in automatic prompt preprocessing. It is not a remote server takeover.DetailsThe affected direct-prompt CLI path is in:The CLI imports and instantiates `MentionsParser` on the direct prompt path:This means raw prompt text is interpreted as a mention language before query rewriting, prompt expansion, tool execution, or LLM invocation.The affected mention implementation is in:`@url:` is a first-class mention type:The URL mention handler performs an unrestricted HTTP request:There is no validation rejecting:The returned body is added to the generated mention context and then prepended to the prompt.The resulting chain is:PoCThe following PoC is non-destructive. It starts a local HTTP server on `127.0.0.1:8766`, passes a prompt containing `@url:http://localhost.:8766/` through the real `MentionsParser.process(...)` implementation, and confirms that the local response body is injected into the generated prompt context.Full PoCObserved outputExpected secure behaviorA prompt-borne `@url:` mention should not be able to read loopback or private-network resources by default.At minimum, the following should be rejected before any HTTP request is made:Actual vulnerable behaviorThe loopback request succeeds, and the returned local content is inserted into the generated prompt context.ImpactAn attacker who can influence prompt text passed to PraisonAI's direct-prompt CLI can cause the operator's machine to perform local HTTP requests and inject the fetched response body into the model prompt context.Potential impact includes:reading localhost-only HTTP resources;reading local dashboards, admin panels, development servers, or internal web services bound to loopback;exposing fetched local content to the model prompt;exposing fetched local content through downstream logs, traces, model output, or agent memory depending on the operator workflow.This report does not claim unauthenticated remote server takeover. The attacker must influence the prompt text that an operator runs with the direct-prompt CLI.
CVSS v3.1: 5.5
RHSA-2019:3158: Red Hat Security Advisory: java-1.7.0-openjdk security update
OpenJDK: Missing restrictions on use of custom SocketImpl (Networking, 8218573) OpenJDK: NULL pointer dereference in DrawGlyphList (2D, 8222690) OpenJDK: Unexpected exception thrown by Pattern processing crafted regular expression (Concurrency, 8222684) OpenJDK: Unexpected exception thrown by XPathParser processing crafted XPath expression (JAXP, 8223505) OpenJDK: Incorrect handling of nested jar: URLs in Jar URL handler (Networking, 8223892) OpenJDK: Unexpected exception thrown by XPath processing crafted XPath expression (JAXP, 8224532) OpenJDK: Unexpected exception thrown during Font object deserialization (Serialization, 8224915) OpenJDK: Missing glyph bitmap image dimension check in FreetypeFontScaler (2D, 8225286) OpenJDK: Integer overflow in bounds check in SunGraphics2D (2D, 8225292) OpenJDK: Incorrect handling of HTTP proxy responses in HttpURLConnection (Networking, 8225298) OpenJDK: Excessive memory allocation in CMap when reading TrueType font (2D, 8225597) OpenJDK: Insufficient filtering of HTML event attributes in Javadoc (Javadoc, 8226765)
CVSS v3.0: 4.7
PYSEC-2026-207: `durabletask` versions 1.4.1, 1.4.2, and 1.4.3 were published on 2026-05-19 within a
35-minute window through a compromised PyPI maintainer account and contained
 malicious code.

On import, the package fetched a remote payload (`rope.pyz`) from an
attacker-controlled host and executed it.
The payload was a credential-theft framework that interrogated cloud instance metadata
(AWS/Azure/GCP) and secret stores, harvested Kubernetes service-account tokens,
HashiCorp Vault tokens, and credentials from known filesystem paths,
attempted to brute-force password manager vaults.
Anything obtained was exfiltrated to command-and-control infrastructure
 with a GitHub dead-drop fallback.
It established persistence via a systemd unit (`pgsql-monitor.service`)
and included a geo-targeted destructive wiper.

Indicators of compromise:
- Dropped payload: rope.pyz
  (sha256 069ac1dc7f7649b76bc72a11ac700f373804bfd81dab7e561157b703999f44ce)
 - Primary C2: check.git-service[.]com (160.119.64.3)
- Secondary C2: t.m-kosche[.]com (185.95.159.32)
- Persistence unit: pgsql-monitor.service

The affected releases have been removed from PyPI.
The known-good versions remain available.
`durabletask` version 1.5.0 has been released by the maintainers.

This campaign is likely attributable to the threat actor tracked as
TeamPCP, based on shared infrastructure and payload overlap with prior
supply chain compromises (including the @antv and guardrails-ai waves).
GHSA-h8g3-63cv-v336: Sure Start on HP Commercial PCs 2015 allows local users to cause a denial of service (BIOS recovery failure) by leveraging administrative access.
CVSS v3.0: 7.9
CVE-2022-43688: Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Stored Cross-Site Scripting (XSS) in icons since the Microsoft application tile color is not sanitized. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.
CVSS v3.1: 4.8
GHSA-7px8-gc65-33rq: In FileCatalyst Direct 3.8.8 and earlier through 3.8.6, the web server does not properly sanitize illegal characters in a URL which is then displayed on a subsequent error page. A malicious actor could craft a URL which would then execute arbitrary code within an HTML script tag.
CVSS v3.1: 7.2
CVE-2024-10813: Product Table for WooCommerce by CodeAstrology (wooproducttable.com) <= 3.5.1 - Information Exposure
The Product Table for WooCommerce by CodeAstrology (wooproducttable.com) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.1 via the var_dump_table parameter. This makes it possible for unauthenticated attackers var data.
CVSS v3.1: 5.3
CVE-2004-1661: MailWorks Professional allows remote attackers to bypass authentication and gain privileges via a cookie that contains "auth=1" and "uId=1."
CVSS v2.0: 7.5
GHSA-rvrw-7cfv-7x29: Null pointer dereference in SuiteLink server while processing commands 0x03/0x10
CVE-2025-44004: Unauthenticated Channel Subscription Creation in Mattermost Confluence Plugin
Mattermost Confluence Plugin version <1.5.0 fails to check the authorization of the user to the Mattermost instance which allows attackers to create a channel subscription without proper authorization via API call to the create channel subscription endpoint.
CVSS v3.1: 7.2
CVE-2024-26679: inet: read sk->sk_family once in inet_recv_error()
In the Linux kernel, the following vulnerability has been resolved:

inet: read sk->sk_family once in inet_recv_error()

inet_recv_error() is called without holding the socket lock.

IPv6 socket could mutate to IPv4 with IPV6_ADDRFORM
socket option and trigger a KCSAN warning.
CVSS v3.1: 5.5
CVE-2026-1335: Out-Of-Bounds Write vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIDWORKS Desktop 2026
An Out-Of-Bounds Write vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIDWORKS Desktop 2026 could allow an attacker to execute arbitrary code while opening a specially crafted EPRT file.
CVSS v3.1: 7.8
CVE-2012-1951: Use-after-free vulnerability in the nsSMILTimeValueSpec::IsEventBased function in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 allows remote attackers to cause a denial of service (heap memory corruption) or possibly execute arbitrary code by interacting with objects used for SMIL Timing.
CVSS v2.0: 10
CVE-2021-46165: Zoho ManageEngine Desktop Central before 10.0.662, during startup, launches an executable file from the batch files, but this file's path might not be properly defined.
CVSS v3.1: 7.8
CVSS v2.0: 4.6
CVE-2024-39840: Factorio before 1.1.101 allows a crafted server to execute arbitrary code on clients via a custom map that leverages the ability of certain Lua base module functions to execute bytecode and generate fake objects.
CVSS v3.1: 8.8
CVE-2022-48614: Special:Ask in Semantic MediaWiki before 4.0.2 allows Reflected XSS.
CVSS v3.1: 6.1