ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2026-37222: FlexRIC v2.0.0 uses hardcoded assertions to validate Information Element (IE) counts in decoded E2AP messages. A remote unauthenticated attacker can send a valid E2AP PDU containing an unexpected number of IEs (e.g., an E2setupRequest with extra optional fields) to crash the near-RT RIC (port 36421) or iApp (port 36422) via SIGABRT. The code asserts exact IE counts rather than validating against protocol-specified ranges.
CVSS v3.1: 7.5
GHSA-58f5-mrg5-mq6c: Vulnerability in the Unified Audit component of Oracle Database Server.  Supported versions that are affected are 23.4-23.9. Easily exploitable vulnerability allows high privileged attacker having DBA privilege with network access via Oracle Net to compromise Unified Audit.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Unified Audit accessible data. CVSS 3.1 Base Score 2.7 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N).
CVSS v3.1: 2.7
CVE-2021-2073: Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.18. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS v3.1: 4.4
CVE-2021-30319: Possible integer overflow due to improper validation of command length parameters while processing WMI command in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music
CVSS v3.1: 7.8
GHSA-hrch-w2hr-7wx7: When an attacker uses a man-in-the-middle attack to sniff the request packets with success logging in, the attacker could log in to the device by replaying the user's login packet.
CVSS v3.1: 5.9
CVE-2020-17532: Apache ServiceComb Yaml remote deserialization vulnerability
When handler-router component is enabled in servicecomb-java-chassis, authenticated user may inject some data and cause arbitrary code execution. The problem happens in versions between 2.0.0 ~ 2.1.3 and fixed in Apache ServiceComb-Java-Chassis 2.1.5
CVSS v3.1: 8.8
CVSS v2.0: 6
GHSA-84fq-jfjw-frp9: A weakness has been identified in MacCMS Pro up to 2022.1.3. This vulnerability affects the function install of the file /admi.php/admin/addon/add.html of the component Plugin Installation Handler. Executing a manipulation can lead to unrestricted upload. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 2
CVSS v3.1: 4.7
CVE-2006-2912: Multiple SQL injection vulnerabilities in SelectaPix 1.31 allow remote attackers to execute arbitrary SQL commands via the (1) albumID parameter to (a) view_album.php or (b) index.php, (2) imageID parameter to (c) popup.php, or (3) username and (4) password parameters to (d) admin/member.php.
CVSS v2.0: 7.5
GHSA-947f-qh3g-pcj5: An issue was discovered with pipeline execution policies in GitLab EE affecting all versions from 17.2 prior to 17.2.5, 17.3 prior to 17.3.2 which allows authenticated users to bypass variable overwrite protection via inclusion of a CI/CD template.
CVSS v3.1: 6.5
CVE-2020-28436: Command Injection
This affects all versions of package google-cloudstorage-commands.
CVSS v3.1: 7.3
CVE-2020-11791: NETGEAR JGS516PE devices before 2.6.0.43 are affected by reflected XSS.
CVSS v3.0: 5.2
CVE-2016-20092: NetDrive 2.6.12 Unquoted Service Path Elevation of Privilege
NetDrive 2.6.12 contains an unquoted service path vulnerability in the Netdrive2_Service_Netdrive2 service that allows local users to execute arbitrary code with SYSTEM privileges. Attackers can insert malicious executables in the system root path that will be executed during service startup or system reboot, resulting in privilege escalation.
CVSS v4.0: 8.5
CVSS v3.1: 7.8
GHSA-m7mv-m566-78j6: A vulnerability found in postgresql. On this security issue an attack requires permission to create non-temporary objects in at least one schema, ability to lure or wait for an administrator to create or update an affected extension in that schema, and ability to lure or wait for a victim to use the object targeted in CREATE OR REPLACE or CREATE IF NOT EXISTS. Given all three prerequisites, the attacker can run arbitrary code as the victim role, which may be a superuser. Known-affected extensions include both PostgreSQL-bundled and non-bundled extensions. PostgreSQL blocks this attack in the core server, so there's no need to modify individual extensions.
CVSS v3.1: 8
GHSA-qc7r-vrf5-g6m3: BMC Control-M/Agent 7.0.00.000 has an Insecure File Copy.
RHSA-2010:0338: Red Hat Security Advisory: java-1.5.0-sun security update
TLS: MITM attacks via session renegotiation OpenJDK Loader-constraint table allows arrays instead of only the base-classes (6626217) OpenJDK Policy/PolicyFile leak dynamic ProtectionDomains. (6633872) OpenJDK File TOCTOU deserialization vulnerability (6736390) JDK unspecified vulnerability in JWS/Plugin component OpenJDK Inflater/Deflater clone issues (6745393) JDK unspecified vulnerability in JavaWS/Plugin component OpenJDK Unsigned applet can retrieve the dragged information before drop action occurs(6887703) OpenJDK AtomicReferenceArray causes SIGSEGV -> SEGV_MAPERR error (6888149) OpenJDK System.arraycopy unable to reference elements beyond Integer.MAX_VALUE bytes (6892265) OpenJDK Deserialization of RMIConnectionImpl objects should enforce stricter checks (6893947) OpenJDK Subclasses of InetAddress may incorrectly interpret network addresses (6893954) OpenJDK JAR "unpack200" must verify input parameters (6902299) OpenJDK CMM readMabCurveData Buffer Overflow Vulnerability (6899653) JDK multiple unspecified vulnerabilities OpenJDK Applet Trusted Methods Chaining Privilege Escalation Vulnerability (6904691) OpenJDK JPEGImageReader stepX Integer Overflow Vulnerability (6909597) JDK multiple unspecified vulnerabilities JDK multiple unspecified vulnerabilities JDK multiple unspecified vulnerabilities OpenJDK  No ClassCastException for HashAttributeSet constructors if run with -Xcomp (6894807) JDK unspecified vulnerability in ImageIO component OpenJDK ImagingLib arbitrary code execution vulnerability (6914866) OpenJDK AWT Library Invalid Index Vulnerability (6914823) JDK unspecified vulnerability in Java2D component
CVE-2024-20142: In V5 DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS09291406; Issue ID: MSV-2070.
CVSS v3.1: 6.2
CVE-2021-1223: Multiple Cisco Products Snort HTTP Detection Engine File Policy Bypass Vulnerability
Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured file policy for HTTP. The vulnerability is due to incorrect handling of an HTTP range header. An attacker could exploit this vulnerability by sending crafted HTTP packets through an affected device. A successful exploit could allow the attacker to bypass configured file policy for HTTP packets and deliver a malicious payload.
CVSS v3.0: 5.8
GHSA-w6xf-p38w-6xgp: Double free vulnerability in the authentication and authentication token alteration code in PAM-MySQL 0.6.x before 0.6.2 and 0.7.x before 0.7pre3 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted passwords, which lead to a double free of a pointer that was created by the pam_get_item function.  NOTE: this issue only occurs in certain configurations in which there are multiple PAM modules, PAM-MySQL is not evaluated first, and there are no requisite modules before PAM-MySQL.
PYSEC-2017-139: There is a heap-based buffer overflow in the Exiv2::s2Data function of types.cpp in Exiv2 0.26. A Crafted input will lead to a denial of service attack.
CVSS v3.0: 5.5
CVE-2020-36756: 10WebAnalytics <= 1.2.8 - Cross-Site Request Forgery Bypass
The 10WebAnalytics plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.8. This is due to missing or incorrect nonce validation on the create_csv_file() function. This makes it possible for unauthenticated attackers to create a CSV file via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS v3.1: 4.3
CVE-2021-32461: Trend Micro Password Manager (Consumer) version 5.0.0.1217 and below is vulnerable to an Integer Truncation Privilege Escalation vulnerability which could allow a local attacker to trigger a buffer overflow and escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS v3.1: 7.8
CVSS v2.0: 7.2
CVE-2022-4910: Inappropriate implementation in Autofill in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVSS v3.1: 5.4
GHSA-4rxp-f57w-8645: In onCreate of RequestManageCredentials.java, there is a possible way for a third party app to install certificates without user approval due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-205150380
CVSS v3.1: 7.8
RHSA-2016:2574: Red Hat Security Advisory: kernel security, bug fix, and enhancement update
kernel: File descriptors passed over unix sockets are not properly accounted kernel: Information leak when truncating of compressed/inlined extents on BTRFS kernel: IPv6 connect causes DoS via NULL pointer dereference kernel: when NFSv4 migration is executed, kernel oops occurs at NFS client kernel: CXGB3: Logic bug in return code handling prematurely frees key structures causing Use after free or kernel panic. kernel: incorrect restoration of machine specific registers from userspace kernel: incorrect restoration of machine specific registers from userspace kernel: NULL dereference in RFCOMM bind callback kernel: Kernel panic and system lockup by triggering BUG_ON() in public_key_verify_signature() kernel: race condition in the TLB flush logic kernel: Kernel memory leakage to ethernet frames due to buffer overflow in ethernet drivers kernel: double-free in usb-audio triggered by invalid USB descriptor kernel: pipe: limit the per-user amount of pages allocated in pipes kernel: Infinite loop vulnerability in KVM kernel: Null pointer dereference in trace_writeback_dirty_page() kernel: ipv4: denial of service when destroying a network interface kernel: ACPI table override allowed when securelevel is enabled kernel: use-after-free via crafted IPV6 sendmsg for raw / tcp / udp / l2tp sockets. kernel: Information leak in Linux sound module in timer.c kernel: Information leak in events in timer.c kernel: Slave being first propagated copy causes oops in propagate_mnt kernel: Use after free in array_map_alloc Kernel: powerpc: kvm: Infinite loop via H_CEDE hypercall when running under hypervisor-mode Kernel: powerpc: tm: crash via exec system call on PPC kernel: Heap buffer overflow in hiddev driver kernel: Race condition vulnerability in execve argv arguments kernel: vfs: missing detection of hardlinks in vfs_rename() on overlayfs kernel: infiniband: Kernel crash by sending ABORT_TASK command kernel: scsi: aacraid: double fetch in ioctl_send_fib() kernel: assoc_array: don't call compare_object() on a node kernel: HID: core: prevent out-of-bound readings kernel: ALSA: Use-after-free in kill_fasync kernel: sound: a race condition in the kernel sound timer in snd_timer_user_read() kernel: overlayfs file truncation without permissions
CVSS v3.0: 5.3
GHSA-gm84-c739-5hpp: Use-after-free vulnerability in core/events/TreeScopeEventContext.cpp in the DOM implementation in Blink, as used in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers improper maintenance of TreeScope data.
GHSA-9m2q-mcvc-68f6: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alan Tien Call Now Icon Animate plugin <= 0.1.0 versions.
CVSS v3.1: 5.9
GHSA-6gr7-rrxf-7j6f: OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to execute arbitrary code, cause a denial of service, gain escalated privileges, and gain sensitive information.
CVSS v3.1: 8.2
GHSA-wp3r-3c7w-2mpf: Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows local users to affect availability via vectors related to Outside In Filters, a different vulnerability than CVE-2015-6013, CVE-2015-6014, CVE-2015-6015, and CVE-2016-0432.
GHSA-7pvx-xp68-6vm5: A vulnerability was found in ForU CMS. It has been classified as problematic. Affected is an unknown function of the file cms_chip.php. The manipulation of the argument name leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-213450 is the identifier assigned to this vulnerability.
CVSS v3.1: 5.4
GHSA-x9c2-9mp9-fq3m: A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute code via a network.We have already fixed the vulnerability in the following versions:
QTS 5.1.6.2722 build 20240402 and later
QuTS hero h5.1.6.2734 build 20240414 and later
CVSS v3.1: 5.4
GHSA-r3xx-hr64-gmm2: PluXml Blog v5.8.9 was discovered to contain a remote code execution (RCE) vulnerability in the Static Pages feature. This vulnerability is exploited via injecting a crafted payload into the Content field.
CVSS v3.1: 8.8
CVE-2021-32730: No CSRF protection on the password change form
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A cross-site request forgery vulnerability exists in versions prior to 12.10.5, and in versions 13.0 through 13.1. It's possible for forge an URL that, when accessed by an admin, will reset the password of any user in XWiki. The problem has been patched in XWiki 12.10.5 and 13.2RC1. As a workaround, it is possible to apply the patch manually by modifying the `register_macros.vm` template.
CVSS v3.1: 5.7
CVE-2011-2883: The NSEPA.NsepaCtrl.1 ActiveX control in nsepa.ocx in Citrix Access Gateway Enterprise Edition 8.1 before 8.1-67.7, 9.0 before 9.0-70.5, and 9.1 before 9.1-96.4 attempts to validate signed DLLs by checking the certificate subject, not the signature, which allows man-in-the-middle attackers to execute arbitrary code via HTTP header data referencing a DLL that was signed with a crafted certificate.
CVSS v2.0: 9.3
CVE-2021-43629: Projectworlds Hospital Management System v1.0 is vulnerable to SQL injection via multiple parameters in admin_home.php.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
GHSA-j6fm-9rfm-j5hx: Froxlor has an incomplete fix for CVE-2026-30932
SummaryThe LOC record regex uses `\s+` which matches newlines (allowing embedded newlines to pass), TLSA `matchingType=0` has no upper bound on hex data length, and all validators return raw input without zone-file escaping.Affected Package**Ecosystem:** Other**Package:** froxlor**Affected versions:** all versions before fix commit b34829262dc3**Patched versions:** >= commit b34829262dc3SeverityMedium -- CVSSCWECWE-74 -- Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection)DetailsDNS record content is concatenated directly into bind9 zone files at `DnsEntry.php` line 83. Before the fix, LOC/RP/SSHFP/TLSA records had no content validation at all, enabling zone file injection via embedded newlines.The fix adds format-specific regexes and field validation but has gaps: the LOC regex's `\s+` matches newlines in PHP's PCRE engine, allowing a LOC record with a newline between fields to pass validation but produce multiple lines in the zone file. TLSA `matchingType=0` only requires `len(data) >= 2` with no upper bound, enabling arbitrarily large payloads. All validators return raw input without zone-file escaping.PoC**Steps to reproduce:**`git clone https://github.com/froxlor/froxlor /tmp/froxlor_test``cd /tmp/froxlor_test && git checkout b34829262dc3~1``python3 poc.py`**Expected output:**ImpactAn authenticated froxlor user with DNS management permissions can inject arbitrary records into bind9 zone files, enabling domain hijacking, phishing, or DNS amplification attacks via unbounded TLSA payloads.Suggested RemediationReplace `\s+` in the LOC regex with `[ \t]+` to exclude newlines. Add a maximum length for TLSA `matchingType=0` data. Escape or reject newlines in all DNS record content before writing to zone files.ResourcesIncomplete fix commit: https://github.com/froxlor/froxlor/commit/b34829262dc3Original CVE: CVE-2026-30932
CVSS v4.0: 8.6
CVE-2010-0984: Acidcat CMS 3.5.3 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing credentials via a direct request for databases/acidcat_3.mdb.
CVSS v2.0: 5
GHSA-vjm2-5vch-882g: A vulnerability in the Day One setup process of Cisco IOS XE Software for Catalyst 9800 Series Wireless Controllers for Cloud (9800-CL) could allow an unauthenticated, remote attacker to access the public-key infrastructure (PKI) server that is running on an affected device.This vulnerability is due to incomplete cleanup upon completion of the Day One setup process. An attacker could exploit this vulnerability by sending Simple Certificate Enrollment Protocol (SCEP) requests to an affected device. A successful exploit could allow the attacker to request a certificate from the virtual wireless controller and then use the acquired certificate to join an attacker-controlled device to the virtual wireless controller.
CVSS v3.1: 5.3
CVE-2025-8043: Incorrect URL truncation
Focus incorrectly truncated URLs towards the beginning instead of around the origin. This vulnerability was fixed in Firefox 141.
CVSS v3.1: 9.8
CVE-2025-68709: SailingLab AppLock (aka com.alpha.applock) 4.3.8 for Android allows a local attacker to trigger arbitrary JavaScript execution via BrowserMainActivity, which accepts VIEW intents with javascript: URIs. This unsafe navigation path results in script execution and may allow UI spoofing or privilege escalation.
CVSS v3.1: 5.2
CVE-2026-0500: Remote code execution in SAP Wily Introscope Enterprise Manager (WorkStation)
Due to the usage of vulnerable third party component in SAP Wily Introscope Enterprise Manager (WorkStation), an unauthenticated attacker could create a malicious JNLP (Java Network Launch Protocol) file accessible by a public facing URL. When a victim clicks on the URL the accessed Wily Introscope Server could execute OS commands on the victim's machine. This could completely compromising confidentiality, integrity and availability of the system.
CVSS v3.1: 9.6
CVE-2021-39748: In InputMethodEditor, there is a possible way to access some files accessible to Settings due to an unsafe PendingIntent. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-203777141
CVSS v3.1: 5.5
CVSS v2.0: 2.1
GHSA-xpqm-h22m-6vxm: Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a use-after-free vulnerability in the processing of the AcroForm deleteItemAt action that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2017-2820: An exploitable integer overflow vulnerability exists in the JPEG 2000 image parsing functionality of freedesktop.org Poppler 0.53.0. A specially crafted PDF file can lead to an integer overflow causing out of bounds memory overwrite on the heap resulting in potential arbitrary code execution. To trigger this vulnerability, a victim must open the malicious PDF in an application using this library.
CVSS v3.0: 8.8
GHSA-g2x4-256v-5pvx: Codiad Cross-site Scripting Vulnerability
A Cross Site Scripting (XSS) vulnerability was found in Codiad v1.7.8 and later. The vulnerability occurs because of improper sanitization of the folder's name `$path` variable in components/filemanager/class.filemanager.php. **NOTE:** the vendor states "Codiad is no longer under active maintenance by core contributors."
CVSS v3.1: 6.1
CVE-2025-62561: Microsoft Excel Remote Code Execution Vulnerability
Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVSS v3.1: 7.8
GHSA-rmh2-6hx2-ff5v: The OLSR parser in tcpdump before 4.9.2 has a buffer over-read in print-olsr.c:olsr_print().
CVSS v3.0: 9.8
CVE-2023-50270: Apache DolphinScheduler: Session do not expire after password change
Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change.

Users are recommended to upgrade to version 3.2.1, which fixes this issue.
CVSS v3.1: 6.5
CVE-2018-4403: This issue was addressed by removing additional entitlements. This issue affected versions prior to macOS Mojave 10.14.1.
CVSS v3.0: 5.5
CVSS v2.0: 4.3
CVE-2024-35384: An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_array_length function in the mjs.c file.
CVSS v3.1: 5.5
CVE-2023-49394: Zentao versions 4.1.3 and before has a URL redirect vulnerability, which prevents the system from functioning properly.
CVSS v3.1: 6.1
GHSA-j4jc-fh4v-27gw: An issue was discovered in yasm version 1.3.0. There is a heap-buffer-overflow in inc_fopen() in modules/preprocs/nasm/nasm-pp.c.
CVSS v3.1: 5.5
CVE-2022-42450: HCL Domino Volt is affected by Cross-site scripting (XSS)
Improper sanitization of SVG files in HCL Domino Volt allows client-side script injection in deployed applications.
CVSS v3.1: 4.6
GHSA-mgjx-r4rg-4gvm: An issue was discovered in Skybox Platform before 7.5.201. Remote Unauthenticated Code Execution exists via a WAR archive containing a JSP file. The WAR file is sent to /skyboxview-softwareupdate/services/CollectorSoftwareUpdate and the JSP file is reached at /opt/skyboxview/thirdparty/jboss/server/web/work/jboss.web/localhost.
CVSS v3.0: 9.8
GHSA-6q37-cp6x-mhfw: A problem with the Palo Alto Networks GlobalProtect app can result in exposure of encrypted user credentials, used for connecting to GlobalProtect, in application logs. Normally, these application logs are only viewable by local users and are included when generating logs for troubleshooting purposes. This means that these encrypted credentials are exposed to recipients of the application logs.
CVSS v4.0: 5.5
CVSS v3.1: 7.5
CVE-2018-14401: CopyData in AxmlParser.c in AXML Parser through 2018-01-04 has an out-of-bounds read.
CVSS v3.0: 7.5
CVSS v2.0: 5
GHSA-f46v-7p7j-hx8m: The irda_recvmsg_dgram function in net/irda/af_irda.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
CVE-2022-2713: Insufficient Session Expiration in cockpit-hq/cockpit
Insufficient Session Expiration in GitHub repository cockpit-hq/cockpit prior to 2.2.0.
CVSS v3.0: 8.6