ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2003-1406: PHP remote file inclusion vulnerability in D-Forum 1.00 through 1.11 allows remote attackers to execute arbitrary PHP code via a URL in the (1) my_header parameter to header.php3 or (2) my_footer parameter to footer.php3.
CVSS v2.0: 7.5
GHSA-whpv-cjp5-g2gh: Integer overflow in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
CVSS v3.1: 6.5
CVE-2023-51711: An issue was discovered in Regify Regipay Client for Windows version 4.5.1.0 allows DLL hijacking: a user can trigger the execution of arbitrary code every time the product is executed.
CVSS v3.1: 7.8
RHSA-2020:0122: Red Hat Security Advisory: java-11-openjdk security update
OpenJDK: Incorrect exception processing during deserialization in BeanContextSupport (Serialization, 8224909) OpenJDK: Improper checks of SASL message properties in GssKrb5Base (Security, 8226352) OpenJDK: Incorrect isBuiltinStreamHandler check causing URL normalization issues (Networking, 8228548) OpenJDK: Use of unsafe RSA-MD5 checksum in Kerberos TGS (Security, 8229951) OpenJDK: Serialization filter changes via jdk.serialFilter property modification (Serialization, 8231422) OpenJDK: Excessive memory usage in OID processing in X.509 certificate parsing (Libraries, 8234037) OpenJDK: Incorrect handling of unexpected CertificateVerify TLS handshake messages (JSSE, 8231780)
CVSS v3.1: 4.8
CVE-2022-34374: Dell Container Storage Modules 1.2 contains an OS command injection in goiscsi and gobrick libraries. A remote authenticated malicious user with low privileges could exploit this vulnerability leading to to execute arbitrary OS commands on the affected system.
CVSS v3.1: 8.8
GHSA-6482-pqp2-2q5g: CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/type/hy.
CVSS v3.1: 7.2
CVE-2026-21347: Bridge | Integer Overflow or Wraparound (CWE-190)
Bridge versions 15.1.3, 16.0.1 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 7.8
CVE-2017-0400: An information disclosure vulnerability in lvm/wrapper/Bundle/EffectBundle.cpp in libeffects in Audioserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32584034.
CVSS v3.0: 5.5
CVSS v2.0: 4.3
CVE-2025-0941: MET ONE 3400+ Potential Credential Exposure
MET ONE 3400+ instruments running software v1.0.41 can, under rare conditions, temporarily store credentials in plain text within the system. This data is not available to unauthenticated users.
CVSS v3.1: 5.8
GHSA-mmmq-786f-84xq: SeaCMS v13.1 was discovered to a Server-Side Request Forgery (SSRF) via the url parameter at /admin_reslib.php.
CVSS v3.1: 9.8
GHSA-w5w5-3f25-r899: The d8s-timer for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-uuids package. The affected version of d8s-htm is 0.1.0.
CVSS v3.1: 9.8
GHSA-qchx-hx85-cqg6: In processInboundMessage of MceStateMachine.java, there is a possible SMS disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9Android ID: A-177238342
CVSS v3.1: 5.5
GHSA-chvx-77g5-qh6v: The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tutor_instructor_list' shortcode in all versions up to, and including, 2.6.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 5.4
CVE-2024-13610: Simple Social Media Share Buttons < 6.0.0 - Admin+ Stored XSS
The Simple Social Media Share Buttons  WordPress plugin before 6.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS v3.1: 4.8
CVE-2022-22779: Retained exploded messages in Keybase clients for macOS and Windows
The Keybase Clients for macOS and Windows before version 5.9.0 fails to properly remove exploded messages initiated by a user. This can occur if the receiving user switches to a non-chat feature and places the host in a sleep state before the sending user explodes the messages. This could lead to disclosure of sensitive information which was meant to be deleted from a user’s filesystem.
CVSS v3.1: 3.7
RHSA-2026:2594: Red Hat Security Advisory: kernel security update
kernel: RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem kernel: net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing kernel: Linux kernel: Out-of-bounds write in Bluetooth MGMT can lead to information disclosure and denial of service kernel: Linux kernel: Information disclosure and denial of service via out-of-bounds read in font glyph handling
CVSS v3.1: 7.1
CVE-2025-27675: Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Vulnerable OpenID Implementation V-2023-004.
CVSS v3.1: 9.8
GHSA-2fm8-4j83-qggv: Adobe Photoshop 12.0 in Creative Suite 5 (CS5) and 12.1 in Creative Suite 5.1 (CS5.1) allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted GIF file.
RHSA-2026:20590: Red Hat Security Advisory: xorg-x11-server security update
xorg: xwayland: X.Org X server: Denial of Service via integer underflow in XKB compatibility map handling xwayland: xorg: X.Org X server: Information disclosure and denial of service via out-of-bounds read in XKB geometry processing. xorg: xwayland: X.Org X server: Use-after-free vulnerability leads to server crash and potential memory corruption xorg: xwayland: X.Org X server: Information disclosure or Denial of Service via out-of-bounds read in XKB modifier map handling xorg: xwayland: X.Org X server: Information exposure and denial of service via out-of-bounds memory access
CVSS v3.1: 7.8
CVE-2019-25738: WordPress Hybrid Composer 1.4.6 Unauthenticated Settings Change
WordPress Hybrid Composer 1.4.6 contains an unauthenticated settings change vulnerability that allows unauthenticated attackers to modify WordPress options by exploiting the hc_ajax_save_option action. Attackers can send POST requests to the admin-ajax.php endpoint with the action parameter set to hc_ajax_save_option to enable user registration and set the default role to administrator, enabling account takeover.
CVSS v4.0: 9.3
CVSS v3.1: 9.8
GHSA-pc6r-6288-xqwh: vbscript.dll in VBScript 5.1, 5.6, 5.7, and 5.8 in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2, when Internet Explorer is used, allows user-assisted remote attackers to execute arbitrary code by referencing a (1) local pathname, (2) UNC share pathname, or (3) WebDAV server with a crafted .hlp file in the fourth argument (aka helpfile argument) to the MsgBox function, leading to code execution involving winhlp32.exe when the F1 key is pressed, aka "VBScript Help Keypress Vulnerability."
GHSA-63x7-86mp-j45m: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in SeventhQueen Kleo kleo allows PHP Local File Inclusion.This issue affects Kleo: from n/a through < 5.5.0.
CVSS v3.1: 7.5
CVE-2025-27104: double eval in For List Iter in Vyper
vyper is a Pythonic Smart Contract Language for the EVM. Multiple evaluation of a single expression is possible in the iterator target of a for loop. While the iterator expression cannot produce multiple writes, it can consume side effects produced in the loop body (e.g. read a storage variable updated in the loop body) and thus lead to unexpected program behavior. Specifically, reads in iterators which contain an ifexp (e.g. `for s: uint256 in ([read(), read()] if True else [])`) may interleave reads with writes in the loop body. Vyper for loops allow two kinds of iterator targets, namely the `range()` builtin and an iterable type, like SArray and DArray. During codegen, iterable lists are required to not produce any side-effects (in the following code, `range_scope` forces `iter_list` to be parsed in a constant context, which is checked against `is_constant`). However, this does not prevent the iterator from consuming side effects provided by the body of the loop. For SArrays on the other hand, `iter_list` is instantiated in the body of a `repeat` ir, so it can be evaluated several times. This issue is being addressed and is expected to be available in version 0.4.1. Users are advised to upgrade as soon as the patched release is available. There are no known workarounds for this vulnerability.
CVSS v4.0: 2.3
CVE-2022-0962: Stored XSS viva .webma file upload in star7th/showdoc
Stored XSS viva .webma file upload in GitHub repository star7th/showdoc prior to 2.10.4.
CVSS v3.0: 9
GHSA-f83w-w68r-f82v: Color Notes 1.4 contains a denial of service vulnerability that allows attackers to crash the application by pasting excessively long character strings into note fields. Attackers can generate a payload containing 350,000 repeated characters and paste it twice into a new note to cause the application to stop responding.
CVSS v4.0: 8.7
CVSS v3.1: 7.5
GHSA-p45m-r94f-7mf2: A unrestricted php file upload vulnerability exists in the import.json.php temporary copy functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary code execution when chained with an LFI vulnerability. An attacker can send a series of HTTP requests to trigger this vulnerability.
CVSS v3.1: 4.3
CVE-2025-49184: Information disclosure to unauthorized user
A remote unauthorized attacker may gather sensitive information of the application, due to missing authorization of configuration settings of the product.
CVSS v3.1: 7.5
GHSA-94pj-f7mj-c6q8: Piwigo v11.5 was discovered to contain a SQL injection vulnerability via the parameter pwg_token in /admin/batch_manager_global.php.
CVE-2025-70060: An issue pertaining to CWE-79: Improper Neutralization of Input During Web Page Generation was discovered in YMFE yapi v1.12.0.
CVSS v3.1: 5.4
GHSA-cw3c-mvjr-xchx: Brocade SANnav before 2.4.0b logs the Brocade Fabric OS Switch admin password on the SANnav support save logs.When OOM occurs on a Brocade SANnav server, the call stack trace for the Brocade switch is also collected in the heap dump file which contains this switch password in clear text. The vulnerability could allow a remote authenticated attacker with admin privilege able to access the SANnav logs or the supportsave to read the switch admin password.
CVSS v4.0: 8.5
CVSS v3.1: 4.9
GHSA-rrf2-6593-q6jh: Tenda AX1803 v1.0.0.1 was discovered to contain a heap overflow via the urls parameter in the function saveParentControlInfo . This vulnerability allows attackers to cause a Denial of Service (DoS) attack
CVSS v3.1: 7.5
CVE-2022-32427: PrinterLogic Windows Client through 25.0.0.676 allows attackers to execute directory traversal. Authenticated users with prior knowledge of the driver filename could exploit this to escalate privileges or distribute malicious content. This issue has been resolved in PrinterLogic Windows Client 25.0.0688 and all affected are advised to upgrade.
CVSS v3.1: 8.8
GHSA-w98h-6qxg-qf6h: A vulnerability was identified in itsourcecode Content Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/edit_topic.php. Such manipulation of the argument topic_id leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.
CVSS v4.0: 2.1
CVSS v3.1: 6.3
GHSA-v7q3-365h-hmpp: Unspecified vulnerability in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13, when using the Apache::Session::File session store, allows remote attackers to obtain sensitive information (user preferences and caches) via unknown vectors, related to a "limited session re-use."
CVE-2022-31667: Harbor fails to validate the user permissions when updating a robot account
Harbor fails to validate the user permissions when updating a robot account that belongs to a project that the authenticated user doesn’t have access to. 

By sending a request that attempts to update a robot account, and specifying a robot account id and robot account name that belongs to a different project that the user doesn’t have access to, it was possible to revoke the robot account permissions.
CVSS v3.1: 6.4
RHSA-2020:2342: Red Hat Security Advisory: qemu-kvm-rhev bug fix update
QEMU: slirp: heap buffer overflow during packet reassembly QEMU: slirp: OOB buffer access while emulating tcp protocols in tcp_emu() QEMU: Slirp: potential OOB access due to unsafe snprintf() usages
CVSS v3.1: 5.6
CVSS v3.0: 7
GHSA-g77q-mpv6-8w22: Cross-site request forgery (CSRF) vulnerability in the CheckUser extension for MediaWiki allows remote attackers to hijack the authentication of certain users for requests that retrieve sensitive user information via unspecified vectors.
GHSA-hr9h-5957-98cw: Vulnerability of defects introduced in the design process in the screen projection module.Successful exploitation of this vulnerability may affect service availability and integrity.
CVSS v3.1: 9.1
GHSA-3qq6-672j-jx3v: id3_utf16_deserialize() in utf16.c in libid3tag through 0.15.1b misparses ID3v2 tags encoded in UTF-16 with an odd number of bytes, triggering an endless loop allocating memory until an OOM condition is reached, leading to denial-of-service (DoS).
CVSS v3.0: 7.5
CVE-2026-34424: Smart Slider 3 Pro 3.5.1.35 Supply Chain Attack Remote Access Toolkit
Smart Slider 3 Pro version 3.5.1.35 for WordPress and Joomla contains a multi-stage remote access toolkit injected through a compromised update system that allows unauthenticated attackers to execute arbitrary code and commands. Attackers can trigger pre-authentication remote shell execution via HTTP headers, establish authenticated backdoors accepting arbitrary PHP code or OS commands, create hidden administrator accounts, exfiltrate credentials and access keys, and maintain persistence through multiple injection points including must-use plugins and core file modifications.
CVSS v4.0: 9.3
CVSS v3.1: 9.8
GHSA-4h39-xvcp-vmwq: There is an Input Verification Vulnerability in Huawei Smartphone. Successful exploitation of insufficient input verification may cause the system to restart.
GHSA-5pqr-2c29-42gm: In SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor authorization in a specific space could retrieve application environments within that space.
CVSS v3.0: 8.1
GHSA-gh9g-ghf4-75r3: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Boris Kuzmanov 0mk Shortener plugin <= 0.2 versions.
CVSS v3.1: 5.9
CVE-2011-3944: The smacker_decode_header_tree function in libavcodec/smacker.c in FFmpeg before 0.10 allows remote attackers to have an unspecified impact via crafted Smacker data.
CVSS v2.0: 6.8
GHSA-vgwx-h8vg-v6jx: u'Multiple Read overflows issue due to improper length check while decoding Generic NAS transport/EMM info' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in APQ8053, APQ8096AU, APQ8098, Kamorta, MDM9150, MDM9205, MDM9206, MDM9607, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8905, MSM8909W, MSM8917, MSM8953, MSM8996AU, MSM8998, Nicobar, QCM2150, QCS605, QCS610, QM215, Rennell, SA415M, Saipan, SC7180, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SXR1130
CVE-2025-58785: WordPress Ray Enterprise Translation plugin <= 1.7.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in Jiro Sasamoto Ray Enterprise Translation lingotek-translation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ray Enterprise Translation: from n/a through <= 1.7.2.
CVSS v3.1: 5.4
CVE-2025-31500: Best Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an Asset name.
CVSS v3.1: 7.2
CVE-2026-1559: Youzify <= 1.3.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'checkin_place_id' Parameter
The Youzify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'checkin_place_id' parameter in all versions up to, and including, 1.3.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
RHSA-2005:069: Red Hat Security Advisory: perl security update
security flaw
CVE-2014-0465: Unspecified vulnerability in the Oracle OpenSSO component in Oracle Fusion Middleware 8.0 Update 2 Patch 5 allows remote authenticated users to affect integrity via unknown vectors related to Admin Console.
CVSS v2.0: 3.5
CVE-2007-1978: SQL injection vulnerability in index.php in the Arcade 1.00 module for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the cid parameter in a view_game_list action.
CVSS v2.0: 7.5
GHSA-9mmj-64jh-ph9c: Privilege escalation in XXL-Job
A lateral privilege escalation vulnerability in XXL-Job v2.4.1 allows users to execute arbitrary commands on another user's account via a crafted POST request to the component `/jobinfo/`.
CVSS v3.1: 8.8
PYSEC-2021-332: This affects all versions of package sqlite-web. The SQL dashboard area allows sensitive actions to be performed without validating that the request originated from the application. This could enable an attacker to trick a user into performing these actions unknowingly through a Cross Site Request Forgery (CSRF) attack.
CVE-2025-64361: WordPress Consulting Elementor Widgets plugin <= 1.4.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StylemixThemes Consulting Elementor Widgets consulting-elementor-widgets allows DOM-Based XSS.This issue affects Consulting Elementor Widgets: from n/a through <= 1.4.2.
CVSS v3.1: 6.5
ICSA-11-362-01: ScadaTEC ScadaPhone & Modbus TagServer Buffer Overflow Vulnerability
Buffer overflow in TurboPower Abbrevia before 4.0, as used in ScadaTEC ScadaPhone 5.3.11.1230 and earlier, ScadaTEC ModbusTagServer 4.1.1.81 and earlier, and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted ZIP file.
CVE-2006-5393: Cisco Secure Desktop (CSD) does not require that the ClearPageFileAtShutdown (aka CCE-Winv2.0-407) registry value equals 1, which might allow local users to read certain memory pages that were written during another user's SSL VPN session.
CVSS v3.1: 5.5
CVSS v2.0: 2.1
CVE-2024-35267: Azure DevOps Server Spoofing Vulnerability
Azure DevOps Server Spoofing Vulnerability
CVSS v3.1: 7.6
CVE-2025-50157: Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability
Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information over a network.
CVSS v3.1: 5.7
GHSA-f2gj-f7q5-jjg4: Unspecified vulnerability in the Deployment component in Oracle Java SE and Java for Business 6 Update 21 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the January 2011 CPU. Oracle has not commented on claims from a reliable third party coordinator that the ActiveX Plugin does not properly initialize an object field that is used as a window handle, which allows attackers to execute arbitrary code.
CVE-2012-2021: Multiple cross-site scripting (XSS) vulnerabilities in HP AssetManager 5.20, 5.21, 5.22, and 9.30 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS v2.0: 4.3
GHSA-x8xh-hfg5-qrf9: Cross-Site Request Forgery (CSRF) vulnerability in Rextheme WP VR – 360 Panorama and Virtual Tour Builder For WordPress plugin <= 8.2.7 versions.
CVSS v3.1: 8.8
CVE-2021-45885: An issue was discovered in Stormshield Network Security (SNS) 4.2.2 through 4.2.7 (fixed in 4.2.8). Under a specific update-migration scenario, the first SSH password change does not properly clear the old password.
CVSS v3.1: 7.5
CVSS v2.0: 4.3
CVE-2019-14387: cPanel before 82.0.2 has Self XSS in the cPanel and webmail master templates (SEC-506).
CVSS v3.0: 6.1
CVSS v2.0: 4.3
CVE-2023-1350: liferea Feed Enrichment update.c update_job_run os command injection
A vulnerability was found in liferea. It has been rated as critical. Affected by this issue is the function update_job_run of the file src/update.c of the component Feed Enrichment. The manipulation of the argument source with the input |date &gt;/tmp/bad-item-link.txt leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 8d8b5b963fa64c7a2122d1bbfbb0bed46e813e59. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-222848.
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
GHSA-vqwf-pqwm-mrf6: The Check & Log Email WordPress plugin before 1.0.6 does not sanitise and escape a parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
CVSS v3.1: 6.1
CVE-2021-34073: A Cross Site Scripting (XSS) vulnerabilty exists in Sourcecodester Gadget Works Online Ordering System in PHP/MySQLi 1.0 via the Category parameter in an add function in category/index.php.
CVSS v3.1: 5.4
CVSS v2.0: 3.5
RHSA-2006:0597: Red Hat Security Advisory: libwmf security update
security flaw
GHSA-p38f-vh2f-mc7r: Cross-site Scripting (XSS) - Stored in GitHub repository linagora/twake prior to 2023.Q1.1200+.
CVSS v3.1: 6.1
GHSA-5c5v-qc32-cgm2: SQL injection vulnerability in info.php in BrotherScripts (BS) and ScriptsFeed Auto Dealer allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2025-23636: WordPress My Favorite Car plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dimitar A. My Favorite Car my-favorite-cars allows Reflected XSS.This issue affects My Favorite Car: from n/a through <= 1.0.
CVSS v3.1: 7.1
GHSA-43pm-2hpj-j6cj: Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.