ansulev/circl-vulnerability-scores huggingface dataset:
RHSA-2018:1812: Red Hat Security Advisory: java-1.7.1-ibm security update
OpenJDK: unsynchronized access to encryption key data (Libraries, 8172525) JDK: unspecified vulnerability fixed in 7u171, 8u161, and 9.0.4 (JavaFX) OpenJDK: LdapLoginModule insufficient username encoding in LDAP query (LDAP, 8178449) OpenJDK: DnsClient missing source port randomization (JNDI, 8182125) OpenJDK: loading of classes from untrusted locations (I18n, 8182601) OpenJDK: DerValue unbounded memory allocation (Libraries, 8182387) OpenJDK: insufficient strength of key agreement (JCE, 8185292) OpenJDK: GSS context use-after-free (JGSS, 8186212) OpenJDK: LDAPCertStore insecure handling of LDAP referrals (JNDI, 8186606) OpenJDK: use of global credentials for HTTP/SPNEGO (JGSS, 8186600) OpenJDK: SingleEntryRegistry incorrect setup of deserialization filter (JMX, 8186998) OpenJDK: GTK library loading use-after-free (AWT, 8185325) JDK: unspecified vulnerability fixed in 6u181 and 7u171 (Serialization) OpenJDK: ArrayBlockingQueue deserialization to an inconsistent state (Libraries, 8189284) OpenJDK: unbounded memory allocation during deserialization (AWT, 8190289) OpenJDK: unbounded memory allocation in BasicAttributes deserialization (JNDI, 8191142)
CVSS v3.0: 4.3
GHSA-3533-rvpc-6x56: Exposure of Sensitive Information to an Unauthorized Actor in Spring Security
DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the password if the user is not found, which makes the response delay shorter and might allow remote attackers to enumerate valid usernames via a series of login requests.
CVE-2011-2258: Unspecified vulnerability in Oracle Solaris 8, 9, 10, and 11 Express allows local users to affect confidentiality, integrity, and availability via unknown vectors related to rksh.
CVSS v2.0: 4.6
CVE-2024-5245: NETGEAR ProSAFE Network Management System Default Credentials Local Privilege Escalation Vulnerability
NETGEAR ProSAFE Network Management System Default Credentials Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NETGEAR ProSAFE Network Management System. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the product installer. The issue results from the use of default MySQL credentials. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-22755.
CVSS v3.0: 7.8
GHSA-3f9c-9c8w-rrr6: Exponent CMS version 2.3.9 suffers from a sql injection vulnerability in framework/modules/ecommerce/controllers/cartController.php.
CVSS v3.0: 9.8
CVE-2019-13031: LemonLDAP::NG before 1.9.20 has an XML External Entity (XXE) issue when submitting a notification to the notification server. By default, the notification server is not enabled and has a "deny all" rule.
CVSS v3.0: 8.1
CVSS v2.0: 6.8
CVE-2024-47636: WordPress WP JobSearch plugin <= 2.5.9 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in eyecix JobSearch wp-jobsearch allows Object Injection.This issue affects JobSearch: from n/a through <= 2.5.9.
CVSS v3.1: 9.8
CVE-2014-2338: IKEv2 in strongSwan 4.0.7 before 5.1.3 allows remote attackers to bypass authentication by rekeying an IKE_SA during (1) initiation or (2) re-authentication, which triggers the IKE_SA state to be set to established.
CVSS v2.0: 6.4
GHSA-9crc-72v8-4jmj: Unrestricted Upload of File with Dangerous Type vulnerability in zozothemes Wiguard wiguard allows Upload a Web Shell to a Web Server.This issue affects Wiguard: from n/a through < 2.0.1.
CVSS v3.1: 9.9
GHSA-q373-f6gj-mw99: Ghost through 5.85.1 allows remote attackers to bypass an authentication rate-limit protection mechanism by using many X-Forwarded-For headers with different values. NOTE: the vendor's position is that Ghost should be installed with a reverse proxy that allows only trusted X-Forwarded-For headers.
CVSS v3.1: 9.1
GHSA-6w4p-849q-7mr4: Cross-site request forgery (CSRF) vulnerability in IPplan 4.91a allows remote attackers to hijack the authentication of administrators for requests that (1) change the password, (2) add users, or (3) delete users via unknown vectors.
PYSEC-2025-29: vyper is a Pythonic Smart Contract Language for the EVM. Vyper `sqrt()` builtin uses the babylonian method to calculate square roots of decimals. Unfortunately, improper handling of the oscillating final states may lead to sqrt incorrectly returning rounded up results. This issue is being addressed and a fix is expected in version 0.4.1. Users are advised to upgrade as soon as the patched release is available. There are no known workarounds for this vulnerability.
GHSA-4wp7-6r7w-74r2: In IKARUS anti.virus before 2.16.18, the ntguard.sys driver contains an Arbitrary Write vulnerability because of not validating input values from IOCtl 0x83000058.
CVSS v3.0: 7.8
CVE-2022-33896: A buffer underflow vulnerability exists in the way Hword of Hancom Office 2020 version 11.0.0.5357 parses XML-based office files. A specially-crafted malformed file can cause memory corruption by using memory before buffer start, which can lead to code execution. A victim would need to access a malicious file to trigger this vulnerability.
CVSS v3.0: 7.8
CVE-2025-14882: Insecure direct object reference
An API endpoint allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.
CVSS v4.0: 3.8
CVE-2013-6074: Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite 7.2.x before 7.2.2-rev25 and 7.4.x before 7.4.0-rev14 allows remote attackers to inject arbitrary web script or HTML via an attached SVG file.
CVSS v2.0: 4.3
CVE-2024-32139: WordPress Podlove Podcast Publisher plugin <= 4.0.12 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Podlove Podlove Podcast Publisher.This issue affects Podlove Podcast Publisher: from n/a through 4.0.12.
CVSS v3.1: 8.5
GHSA-mvq2-cppv-f4gq: Certain errors of the upstream libraries will insert sensitive information in the OTRS or ((OTRS)) Community Edition log mechanism and mails send to the system administrator.This issue affects:OTRS 7.0.XOTRS 8.0.XOTRS 2023.XOTRS 2024.X((OTRS)) Community Edition: 6.0.xProducts based on the ((OTRS)) Community Edition also very likely to be affected
CVSS v3.1: 6.3
CVE-2022-40654: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of X_T files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18351.
CVSS v3.0: 7.8
CVE-2021-28350: Windows GDI+ Remote Code Execution Vulnerability
Windows GDI+ Remote Code Execution Vulnerability
CVSS v3.1: 7.8
CVE-2024-28434: The CRM platform Twenty is vulnerable to stored cross site scripting via file upload in version 0.3.0. A crafted svg file can trigger the execution of the javascript code.
CVSS v3.1: 7.6
GHSA-f498-92vf-jqgh: The (1) IPv6 and (2) ATM ioctl request handlers in the kernel in FreeBSD 8.3 through 9.2-STABLE do not validate SIOCSIFADDR, SIOCSIFBRDADDR, SIOCSIFDSTADDR, and SIOCSIFNETMASK requests, which allows local users to perform link-layer actions, cause a denial of service (panic), or possibly gain privileges via a crafted application.
GHSA-p32j-h3v4-x5w6: Novell NetWare Enterprise Web Server 5.1 and 6.0 allows remote attackers to obtain sensitive server information, including the internal IP address, via a direct request to (1) snoop.jsp, (2) SnoopServlet, (3) env.bas, or (4) lcgitest.nlm.
CVE-2018-15951: Adobe Acrobat and Reader versions 2018.011.20063 and earlier, 2017.011.30102 and earlier, and 2015.006.30452 and earlier have a buffer errors vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS v3.0: 7.8
CVSS v2.0: 9.3
GHSA-9jxw-cfrh-jxq6: Cachet vulnerable to new line injection during configuration edition
ImpactAuthenticated users, regardless of their privileges (_User_ or _Admin_), can exploit a new line injection in the configuration edition feature (e.g. mail settings) and gain arbitrary code execution on the server.PatchesThis issue was addressed by improving `UpdateConfigCommandHandler` and preventing the use of new lines characters in new configuration values.WorkaroundsOnly allow trusted source IP addresses to access to the administration dashboard.Referenceshttps://blog.sonarsource.com/cachet-code-execution-via-laravel-configuration-injectionFor more informationIf you have any questions or comments about this advisory, you can contact:The original reporters, by sending an email to vulnerability.research [at] sonarsource.com;The maintainers, by opening an issue on this repository.
CVSS v3.1: 8.8
RHSA-2025:15740: Red Hat Security Advisory: kernel security update
kernel: ipv6: mcast: Delay put pmc->idev in mld_del_delrec()
CVSS v3.1: 7.1
GHSA-fmq6-4w57-2w3v: wasm3 uncontrolled memory allocation vulnerability
wasm3 at commit 139076a contains a memory leak in the Read_utf8 function.
CVSS v4.0: 6.9
CVSS v3.1: 8.4
GHSA-2vmh-83hf-jfxj: soundlib/pattern.h in libopenmpt before 0.3.9 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted AMS file because of an invalid write near address 0 in an out-of-memory situation.
CVSS v3.0: 8.8
CVE-2021-26353: Failure to validate inputs in SMM may allow an attacker to create a mishandled error leaving the DRTM UApp in a partially initialized state potentially resulting in loss of memory integrity.
CVSS v3.1: 7.8
CVSS v2.0: 7.2
CVE-2022-2629: Top Bar < 3.0.4 - Admin+ Stored Cross-Site Scripting
The Top Bar WordPress plugin before 3.0.4 does not sanitise and escape some of its settings before outputting them in frontend pages, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS v3.1: 4.8
GHSA-vj73-r662-h884: Moxa MiiNePort E1 has a vulnerability of insufficient access control. An unauthenticated remote user can exploit this vulnerability to perform arbitrary system operation or disrupt service.
CVSS v3.1: 9.8
CVE-2018-14681: An issue was discovered in kwajd_read_headers in mspack/kwajd.c in libmspack before 0.7alpha. Bad KWAJ file header extensions could cause a one or two byte overwrite.
CVSS v3.0: 8.8
CVSS v2.0: 6.8
RHSA-2022:0132: Red Hat Security Advisory: firefox security update
Mozilla: Iframe sandbox bypass with XSLT Mozilla: Race condition when playing audio files Mozilla: Heap-buffer-overflow in blendGaussianBlur Mozilla: Missing throttling on external protocol launch dialog Mozilla: Use-after-free of ChannelEventQueue::mOwner Mozilla: Browser window spoof using fullscreen mode Mozilla: Out-of-bounds memory access when inserting text in edit mode Mozilla: Browser window spoof using fullscreen mode Mozilla: Leaking cross-origin URLs through securitypolicyviolation event Mozilla: Crash when handling empty pkcs7 sequence Mozilla: Spoofed origin on external protocol launch dialog Mozilla: Memory safety bugs fixed in Firefox 96 and Firefox ESR 91.5
CVSS v3.1: 8.8
CVSS v3.0: 6.1
CVE-2017-10888: BOOK WALKER for Windows Ver.1.2.9 and earlier, BOOK WALKER for Mac Ver.1.2.5 and earlier allow an attacker to access local files via unspecified vectors.
CVSS v3.0: 5.5
CVSS v2.0: 4.3
GHSA-xhjx-8qjq-pcp5: In Text Services, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1: 5.5
CVE-2025-32839: A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'GetGateways' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on.
CVSS v4.0: 8.7
CVSS v3.1: 8.8
GHSA-gmj8-3pwf-6mrg: CompuLab Intense PC and MintBox 2 devices with BIOS before 2017-05-21 do not use the CloseMnf protection mechanism for write protection of flash memory regions, which allows local users to install a firmware rootkit by leveraging administrative privileges.
CVSS v3.0: 6.7
GHSA-xwfr-c9rv-m6pp: A stack-based buffer overflow in IPsec of Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to cause a denial of service.
CVSS v3.1: 7.5
GHSA-2gx4-fph4-hgjx: A vulnerability has been found in D-Link DIR-823X 240126/240802 and classified as critical. Affected by this vulnerability is the function FUN_00412244. The manipulation leads to null pointer dereference. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 8.7
CVSS v3.1: 7.5
GHSA-rgpj-748v-34f2: A vulnerability in GSKit affects IBM Spectrum Scale 4.1.1, 4.2.0, 4.2.1, 4.2.3, and 5.0.0 that could allow a local attacker to obtain control of the Spectrum Scale daemon and to access and modify files in the Spectrum Scale file system, and possibly to obtain administrator privileges on the node. IBM X-Force ID: 139240.
CVSS v3.0: 7.8
CVE-2021-28280: CSRF + Cross-site scripting (XSS) vulnerability in search.php in PHPFusion 9.03.110 allows remote attackers to inject arbitrary web script or HTML
CVSS v3.1: 6.1
CVSS v2.0: 4.3
CVE-2025-36923: In NrmmDecoder::DecodeSORTransparentContext of cn_NrmmDecoder.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1: 8
CVE-2018-5298: In the Procter & Gamble "Oral-B App" (aka com.pg.oralb.oralbapp) application 5.0.0 for Android, AES encryption with static parameters is used to secure the locally stored shared preferences. An attacker can gain access to locally stored user data more easily by leveraging access to the preferences XML file.
CVSS v3.0: 7.5
CVSS v2.0: 5
CVE-2025-32007: Out-of-bounds read for some TDX before version tdx module 1.5.24 within Ring 0: Hypervisor may allow an information disclosure. Authorized adversary with a privileged user combined with a low complexity attack may enable data exposure. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
CVSS v4.0: 5.6
CVSS v3.1: 4.4
CVE-2023-0065: i2 Pros & Cons <= 1.3.1 - Contributor+ Stored XSS
The i2 Pros & Cons WordPress plugin through 1.3.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS v3.1: 5.4
GHSA-2457-vhh5-pcc4: A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x prior to 6.10.2 - - ClearPass Policy Manager 6.9.x prior to 6.9.7-HF1 - - ClearPass Policy Manager 6.8.x prior to 6.8.9-HF1. Aruba has released patches for ClearPass Policy Manager that address this security vulnerability.
CVE-2024-46753: btrfs: handle errors from btrfs_dec_ref() properly
In the Linux kernel, the following vulnerability has been resolved:

btrfs: handle errors from btrfs_dec_ref() properly

In walk_up_proc() we BUG_ON(ret) from btrfs_dec_ref().  This is
incorrect, we have proper error handling here, return the error.
CVSS v3.1: 5.5
GHSA-2f5c-8fxr-7frw: Cross-site scripting (XSS) vulnerability in Interspire FastFind 2004 and 2005 allows remote attackers to inject arbitrary web script or HTML via the query parameter.
GHSA-2w2c-jqh6-rwvr: The design of the dialplan functionality in Asterisk Open Source 1.2.x, 1.4.x, and 1.6.x; and Asterisk Business Edition B.x.x and C.x.x, when using the ${EXTEN} channel variable and wildcard pattern matches, allows context-dependent attackers to inject strings into the dialplan using metacharacters that are injected when the variable is expanded, as demonstrated using the Dial application to process a crafted SIP INVITE message that adds an unintended outgoing channel leg.  NOTE: it could be argued that this is not a vulnerability in Asterisk, but a class of vulnerabilities that can occur in any program that uses this feature without the associated filtering functionality that is already available.
GHSA-68pj-xrp5-vccj: Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata.You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "data" or "tar". See the tarfile  extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter  for more information. Only Python versions 3.12 or later are affected by these vulnerabilities, earlier versions don't include the extraction filter feature.Note that for Python 3.14 or later the default value of filter= changed from "no filtering" to `"data", so if you are relying on this new default behavior then your usage is also affected.Note that none of these vulnerabilities significantly affect the installation of source distributions which are tar archives as source distributions already allow arbitrary code execution during the build process. However when evaluating source distributions it's important to avoid installing source distributions with suspicious links.
CVSS v3.1: 7.5
RHSA-2018:1780: Red Hat Security Advisory: xmlrpc security update
xmlrpc: Deserialization of untrusted Java object through <ex:serializable> tag
CVSS v3.0: 7.5
CVE-2023-26453: Requests to cache an image could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requires at least access to adjacent networks of the imageconverter service, which is not exposed to public networks by default. Arbitrary SQL statements could be executed in the context of the services database user account. API requests are now properly checked for valid content and attempts to circumvent this check are being logged as error. No publicly available exploits are known.


CVSS v3.1: 7.6
CVE-2022-35168: Due to improper input sanitization of XML input in SAP Business One - version 10.0, an attacker can perform a denial-of-service attack rendering the system temporarily inoperative.
CVSS v3.1: 7.5
CVSS v2.0: 5
GHSA-xvh5-5qg4-x9qp: n8n has In-Process Memory Disclosure in its Task Runner
ImpactAn authenticated user with permission to create or modify workflows could use the JavaScript Task Runner to allocate uninitialized memory buffers. Uninitialized buffers may contain residual data from the same Node.js process — including data from prior requests, tasks, secrets, or tokens — resulting in information disclosure of sensitive in-process data.Task Runners must be enabled using `N8N_RUNNERS_ENABLED=true`.In external runner mode, the impact is limited to data within the external runner process.PatchesThe issue has been fixed in n8n versions >= 1.123.22, >= 2.10.1 , and >= 2.9.3. Users should upgrade to this version or later to remediate the vulnerability.WorkaroundsIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:Limit workflow creation and editing permissions to fully trusted users only.Use external runner mode (`N8N_RUNNERS_MODE=external`) to isolate the runner process.These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
CVSS v4.0: 7.1
CVSS v3.1: 6.5
CVE-2021-47587: net: systemport: Add global locking for descriptor lifecycle
In the Linux kernel, the following vulnerability has been resolved:

net: systemport: Add global locking for descriptor lifecycle

The descriptor list is a shared resource across all of the transmit queues, and
the locking mechanism used today only protects concurrency across a given
transmit queue between the transmit and reclaiming. This creates an opportunity
for the SYSTEMPORT hardware to work on corrupted descriptors if we have
multiple producers at once which is the case when using multiple transmit
queues.

This was particularly noticeable when using multiple flows/transmit queues and
it showed up in interesting ways in that UDP packets would get a correct UDP
header checksum being calculated over an incorrect packet length. Similarly TCP
packets would get an equally correct checksum computed by the hardware over an
incorrect packet length.

The SYSTEMPORT hardware maintains an internal descriptor list that it re-arranges
when the driver produces a new descriptor anytime it writes to the
WRITE_PORT_{HI,LO} registers, there is however some delay in the hardware to
re-organize its descriptors and it is possible that concurrent TX queues
eventually break this internal allocation scheme to the point where the
length/status part of the descriptor gets used for an incorrect data buffer.

The fix is to impose a global serialization for all TX queues in the short
section where we are writing to the WRITE_PORT_{HI,LO} registers which solves
the corruption even with multiple concurrent TX queues being used.
CVSS v3.1: 5.5
GHSA-3q84-pcr7-4gjf: Insufficient checking of memory buffer in ASP Secure OS may allow an attacker with a malicious TA to read/write to the ASP Secure OS kernel virtual address space, potentially leading to privilege escalation.
CVSS v4.0: 7.3
CVSS v3.1: 7
CVE-2024-13809: Hero Slider - WordPress Slider Plugin <= 1.3.5 - Authenticated (Subscriber+) SQL Injection
The Hero Slider - WordPress Slider Plugin plugin for WordPress is vulnerable to SQL Injection via several parameters in all versions up to, and including, 1.3.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS v3.1: 6.5
GHSA-35rm-77cm-584v: An issue was discovered on Samsung mobile devices with Q(10.0) (exynos9830 chipsets) software. RKP allows arbitrary code execution. The Samsung ID is SVE-2020-17435 (August 2020).
CVE-2007-4013: Multiple unspecified vulnerabilities in (1) Net6Helper.DLL (aka Net6Launcher Class) 4.5.2 and earlier, (2) npCtxCAO.dll (aka Citrix Endpoint Analysis Client) in a Firefox plugin directory, and (3) a second npCtxCAO.dll (aka CCAOControl Object) before 4.5.0.0 in Citrix Access Gateway Standard Edition before 4.5.5 and Advanced Edition before 4.5 HF1 have unknown impact and attack vectors, possibly related to buffer overflows.  NOTE: vector 3 might overlap CVE-2007-3679.
CVSS v2.0: 9.3