ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-w883-5vxm-2pq9: Messaging consumer functionality allows deserialization of user-controlled data without sufficient restriction of allowed object types in the out of support Control-M/Server and Control-M/Enterprise Manager versions 9.0.20.x and potentially earlier. This issue may allow an authenticated attacker to trigger unintended server-side behavior through crafted serialized content.
CVSS v4.0: 8.9
CVSS v3.1: 8
CVE-2010-4204: WebKit, as used in Google Chrome before 7.0.517.44, webkitgtk before 1.2.6, and other products, accesses a frame object after this object has been destroyed, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2010-2638: Unspecified vulnerability in IBM WebSphere MQ 7.0 before 7.0.1.5 allows remote authenticated users to cause a denial of service (disk consumption) via vectors that trigger an FDC with an RM680004 Probe Id value.
CVSS v2.0: 4
CVE-2001-1255: WinMySQLadmin 1.1 stores the MySQL password in plain text in the my.ini file, which allows local users to obtain unathorized access the MySQL database.
CVSS v2.0: 4.6
GHSA-c7hq-2xxf-6mw2: Out-of-bounds Read vulnerability in Open Networking Foundation (ONF) libfluid (libfluid_msg modules). This vulnerability is associated with program routines fluid_msg::of13::TableFeaturePropActions::unpack.This issue affects libfluid: 0.1.0.
CVSS v3.1: 6.5
CVE-2026-45607: Windows Hyper-V Remote Code Execution Vulnerability
Out-of-bounds read in Windows Hyper-V allows an unauthorized attacker to execute code locally.
CVSS v3.1: 8.4
GHSA-6j5p-p5gv-2c73: IBM Security ReaQta 3.12 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS v3.1: 5.3
CVE-2013-0151: The do_hvm_op function in xen/arch/x86/hvm/hvm.c in Xen 4.2.x on the x86_32 platform does not prevent HVM_PARAM_NESTEDHVM (aka nested virtualization) operations, which allows guest OS users to cause a denial of service (long-duration page mappings and host OS crash) by leveraging administrative access to an HVM guest in a domain with a large number of VCPUs.
CVSS v2.0: 4.6
GHSA-v9vm-w355-5p8c: The administrative linker functionality in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the href parameter.
CVSS v3.0: 4.8
GHSA-cv4x-m683-q82c: Multiple SQL injection vulnerabilities in admin/admin_login.php in Online Grades 3.2.4 allow remote attackers to execute arbitrary SQL commands via the (1) uname or (2) pword parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVE-2007-6168: SQL injection vulnerability in default.asp in VU Case Manager allows remote attackers to execute arbitrary SQL commands via the username parameter, a different vector than CVE-2007-6143.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS v2.0: 7.5
GHSA-f7qm-mcg6-fhvg: A vulnerability in the AnyConnect firewall for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass a configured access control list (ACL) and allow traffic that should have been denied to flow through an affected device. This vulnerability is due to a logic error in populating group ACLs when an AnyConnect client establishes a new session toward an affected device. An attacker could exploit this vulnerability by establishing an AnyConnect connection to the affected device. A successful exploit could allow the attacker to bypass configured ACL rules.
CVSS v3.1: 5.8
CVE-2009-1410: SQL injection vulnerability in index.php in Quick.Cms.Lite 0.5 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS v2.0: 7.5
CVE-2023-52226: WordPress Advanced Flamingo plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Advanced Flamingo.This issue affects Advanced Flamingo: from n/a through 1.0.
CVSS v3.1: 4.3
GHSA-h229-6mp7-pxrm: Improper access control in key input related function in Dressroom prior to SMR Sep-2024 Release 1 allows local attackers to access protected data. User interaction is required for triggering this vulnerability.
CVSS v3.1: 4.4
GHSA-jc8q-7c32-pq7p: Foxit PDF Reader Doc Object Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the handling of Doc objects. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22709.
CVSS v3.0: 7.8
GHSA-jcpx-7c75-g6c9: A client might theoretically be able to cause a mismatch between queries sent to a backend and the received responses by sending a flood of perfectly timed queries that are routed to a TCP-only or DNS over TLS backend.
CVSS v3.1: 3.1
CVE-2025-22840: Sequence of processor instructions leads to unexpected behavior for some Intel(R) Xeon(R) 6 Scalable processors may allow an authenticated user to potentially enable escalation of privilege via local access
CVSS v4.0: 5.3
CVSS v3.1: 7.4
RHSA-2025:0722: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Container Release Update
grpc: Denial of Service through Data corruption in gRPC-C++ aiohttp: aiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensions jinja2: Jinja has a sandbox breakout through malicious filenames jinja2: Jinja has a sandbox breakout through indirect reference to format method django: potential denial-of-service vulnerability in IPv6 validation
CVSS v3.1: 5.8
GHSA-x5pm-h33q-cjrw: Improper Certificate Validation in apache airflow mongo hook
When ssl was enabled for Mongo Hook, default settings included "allow_insecure" which caused that certificates were not validated. This was unexpected and undocumented.
Users are recommended to upgrade to version 4.0.0, which fixes this issue.
CVSS v3.1: 9.1
CVE-2025-48529: In setRingtoneUri of VoicemailNotificationSettingsUtil.java , there is a possible cross user data leak due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1: 5.5
GHSA-cxxp-554j-3fvp: A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Update 2021-004 Mojave, iOS 14.6 and iPadOS 14.6. Processing a maliciously crafted USD file may lead to unexpected application termination or arbitrary code execution.
CVSS v3.1: 7.8
CVE-2020-15023: Askey AP5100W devices through AP5100W_Dual_SIG_1.01.097 are affected by WPS PIN offline brute-force cracking. This arises because of issues with the random number selection for the Diffie-Hellman exchange. By capturing an attempted (and even failed) WPS authentication attempt, it is possible to brute force the overall authentication exchange. This allows an attacker to obtain the recovered WPS PIN in minutes or even seconds, and eventually obtain the Wi-Fi PSK key, gaining access to the Wi=Fi network.
CVSS v3.1: 5.9
CVSS v2.0: 4.3
RHSA-2012:1591: Red Hat Security Advisory: JBoss Enterprise Application Platform 6.0.1 update
httpd: mod_negotiation XSS via untrusted file names in directories with MultiViews enabled apache-cxf: Certain child policies of WS-SecurityPolicy 1.1 SupportingToken policy not applied on the client side apache-cxf: Apache CXF does not verify that elements were signed / encrypted by a particular Supporting Token Mojarra: deployed web applications can read FacesContext from other applications under certain conditions httpd: mod_negotiation XSS via untrusted file names in directories with MultiViews enabled JBoss: Datasource connection manager returns valid connection for wrong credentials when using security-domains apache-cxf: SOAPAction spoofing on document literal web services JBoss Enterprise Application Platform: org.jboss.as.ejb3: JBoss Enterprise Application Platform: Access restriction bypass via improper EJB method authorization JBoss Enterprise Application Platform: JBoss EAP: JBEAP: JBoss Enterprise Application Platform: Unauthorized EJB access via authorization module bypass
CVSS v3.1: 5.3
GHSA-qm2m-hfw4-jq7f: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Xiaomi Xiaomi Router allows Overflow Buffers.
CVSS v3.1: 6.7
CVE-2026-3136: Google Cloud Build Comment Control Bypass
An improper authorization vulnerability in GitHub Trigger Comment Control in Google Cloud Build prior to 2026-1-26 allows a remote attacker to execute arbitrary code in the build environment.

This vulnerability was patched on 26 January 2026, and no customer action is needed.
CVSS v4.0: 8.6
GHSA-8979-mhqq-p899: Siemens Desigo PX Web modules PXA40-W0, PXA40-W1, PXA40-W2 for Desigo PX automation controllers PXC00-E.D, PXC50-E.D, PXC100-E.D, PXC200-E.D (All firmware versions < V6.00.046) and Desigo PX Web modules PXA30-W0, PXA30-W1, PXA30-W2 for Desigo PX automation controllers PXC00-U, PXC64-U, PXC128-U (All firmware versions < V6.00.046) use a pseudo random number generator with insufficient entropy to generate certificates for HTTPS, potentially allowing remote attackers to reconstruct the corresponding private key.
CVSS v3.0: 7.5
GHSA-q66x-x6v7-27j2: Buffer overflow in Qpopper (qpop) 3.0 allows remote root access via AUTH command.
GHSA-57q9-jqvx-2qj7: The Registrations for the Events Calendar WordPress plugin before 2.7.10 does not escape the qtype parameter before outputting it back in an attribute in the settings page, leading to a Reflected Cross-Site Scripting
CVE-2022-43146: An arbitrary file upload vulnerability in the image upload function of Canteen Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file.
CVSS v3.1: 7.2
GHSA-xqvc-9mc9-4fgx: A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in the forward.c:reply_query() if the reply destination address/port is used by the pending forwarded queries. However, it does not use the address/port to retrieve the exact forwarded query, substantially reducing the number of attempts an attacker on the network would have to perform to forge a reply and get it accepted by dnsmasq. This issue contrasts with RFC5452, which specifies a query's attributes that all must be used to match a reply. This flaw allows an attacker to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25685 or CVE-2020-25686, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.
CVSS v3.1: 3.7
RHSA-2017:3454: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.0 security update
Artemis: Deserialization of untrusted input vulnerability eap: HTTP header injection / response splitting EAP7 Privilege escalation when managing domain including earlier version slaves EAP7: Internal IP address disclosed on redirect when request header Host field is not set undertow: Long URL proxy request lead to java.nio.BufferOverflowException and DoS EAP: Sensitive data can be exposed at the server level in domain mode admin-cli: Potential EAP resource starvation DOS attack via GET requests for server log files jboss: jbossas: unsafe chown of server.log in jboss init script allows privilege escalation wildfly: ParseState headerValuesCache can be exploited to fill heap with garbage wildfly: Arbitrary file read via path traversal undertow: HTTP Request smuggling vulnerability due to permitting invalid characters in HTTP requests undertow: IO thread DoS via unclean Websocket closing jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper hibernate-validator: Privilege escalation when running under the security manager undertow: HTTP Request smuggling vulnerability (incomplete fix of CVE-2017-2666) undertow: improper whitespace parsing leading to potential HTTP request smuggling EAP-7: Wrong privileges on multiple property files
CVSS v3.0: 5.5
CVE-2008-2247: Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) for Exchange Server 2003 SP2 allows remote attackers to inject arbitrary web script or HTML via unspecified e-mail fields, a different vulnerability than CVE-2008-2248.
CVSS v2.0: 4.3
CVE-2009-3617: Format string vulnerability in the AbstractCommand::onAbort function in src/AbstractCommand.cc in aria2 before 1.6.2, when logging is enabled, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via format string specifiers in a download URI.  NOTE: some of these details are obtained from third party information.
CVSS v2.0: 7.6
GHSA-r54p-xv62-5qww: Easyndexer 1.0 contains an arbitrary file download vulnerability that allows unauthenticated attackers to download sensitive files by manipulating the file parameter. Attackers can send POST requests to showtif.php with arbitrary file paths in the file parameter to retrieve system files like configuration and initialization files.
CVSS v4.0: 8.7
CVSS v3.1: 7.5
GHSA-876p-4wgc-75rx: Apache Struts RCE Vulnerability
Apache Struts 2.x before 2.3.20.3, 2.3.24.3, and 2.3.28 allows remote attackers to execute arbitrary code via a `%{}` sequence in a tag attribute, aka forced double OGNL evaluation.
CVSS v3.0: 8.8
CVE-2022-20174: In exynos_secEnv_init of mach-gs101.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-210847407References: N/A
CVSS v3.1: 4.4
CVSS v2.0: 2.1
CVE-2026-10857: Reflected XSS in Akinsoft's e-Commerce
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in AKIN Software Computer Import Export Industry and Trade Ltd. E-Commerce allows Reflected XSS.

This issue affects e-Commerce: before 1.25.01.06.
CVSS v3.1: 6.1
GHSA-j5wx-x974-9cqx: Cross-Site Request Forgery (CSRF) vulnerability in blackandwhitedigital BookPress – For Book Authors allows Cross-Site Scripting (XSS). This issue affects BookPress – For Book Authors: from n/a through 1.2.7.
CVSS v3.1: 7.1
CVE-2021-24601: WPFront Notification Bar < 2.1.0.08087 - Authenticated Stored XSS
The WPFront Notification Bar WordPress plugin before 2.1.0.08087 does not properly sanitise and escape its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVSS v3.1: 5.4
CVSS v2.0: 3.5
CVE-2023-45288: HTTP/2 CONTINUATION flood in net/http
An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.
CVSS v3.1: 7.5
GHSA-jfvp-7x6p-h2pv: runc can be confused to create empty files/directories on the host
Impactrunc 1.1.13 and earlier as well as 1.2.0-rc2 and earlier can be tricked into
creating empty files or directories in arbitrary locations in the host
filesystem by sharing a volume between two containers and exploiting a race
with os.MkdirAll. While this can be used to create empty files, existing
files **will not** be truncated.An attacker must have the ability to start containers using some kind of custom
volume configuration. Containers using user namespaces are still affected, but
the scope of places an attacker can create inodes can be significantly reduced.
Sufficiently strict LSM policies (SELinux/Apparmor) can also in principle block
this attack -- we suspect the industry standard SELinux policy may restrict
this attack's scope but the exact scope of protection hasn't been analysed.This is exploitable using runc directly as well as through Docker and
Kubernetes.The CVSS score for this vulnerability is
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N (Low severity, 3.6).WorkaroundsUsing user namespaces restricts this attack fairly significantly such that the
attacker can only create inodes in directories that the remapped root
user/group has write access to. Unless the root user is remapped to an actual
user on the host (such as with rootless containers that don't use
/etc/sub[ug]id), this in practice means that an attacker would only be able to
create inodes in world-writable directories.A strict enough SELinux or AppArmor policy could in principle also restrict the
scope if a specific label is applied to the runc runtime, though we haven't
thoroughly tested to what extent the standard existing policies block this
attack nor what exact policies are needed to sufficiently restrict this attack.PatchesFixed in runc v1.1.14 and v1.2.0-rc3.`main` patches:https://github.com/opencontainers/runc/pull/4359https://github.com/opencontainers/runc/commit/63c2908164f3a1daea455bf5bcd8d363d70328c7`release-1.1` patches:https://github.com/opencontainers/runc/commit/8781993968fd964ac723ff5f360b6f259e809a3ehttps://github.com/opencontainers/runc/commit/f0b652ea61ff6750a8fcc69865d45a7abf37accfCreditsThanks to Rodrigo Campos Catelin (@rata) and Alban Crequy (@alban) from
Microsoft for discovering and reporting this vulnerability.
CVSS v4.0: 4.8
CVSS v3.1: 3.6
GHSA-xh66-6mj6-94rg: Use-After-Free in str_escape in mruby/mruby in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited.
CVSS v3.1: 9.8
GHSA-4crp-jh2p-xg7w: Multiple format string vulnerabilities in lib/silcclient/command.c in Secure Internet Live Conferencing (SILC) Toolkit before 1.1.10, and SILC Client 1.1.8 and earlier, allow remote attackers to execute arbitrary code via format string specifiers in a channel name, related to (1) silc_client_command_topic, (2) silc_client_command_kick, (3) silc_client_command_leave, and (4) silc_client_command_users.
GHSA-f7p4-6695-gjgj: Windows Media Foundation Core Remote Code Execution Vulnerability
CVSS v3.1: 7.3
CVE-2026-35228: Vulnerability in the Oracle MCP Server Helper Tool product of Oracle Open Source Projects (component: helper tool). The supported versions that is affected is 1.0.1-1.0.156. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle MCP Server Helper Tool. Successful attacks of this vulnerability can result in Oracle MCP Server Helper Tool executing malicious SQL.
CVSS v3.1: 8.7
GHSA-w83r-756w-m93f: In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image, performing some operations, and unmounting can lead to a use-after-free in btrfs_queue_work in fs/btrfs/async-thread.c.
CVSS v3.1: 7.8
GHSA-7v8v-3xwh-j47p: An information disclosure vulnerability exists in the Rocket.Chat server fixed v3.13, v3.12.2 & v3.11.3 that allowed email addresses to be disclosed by enumeration and validation checks.
CVSS v3.1: 7.5
CVE-2021-3422: Indexer denial-of-service via malformed S2S request
The lack of validation of a key-value field in the Splunk-to-Splunk protocol results in a denial-of-service in Splunk Enterprise instances configured to index Universal Forwarder traffic. The vulnerability impacts Splunk Enterprise versions before 7.3.9, 8.0 versions before 8.0.9, and 8.1 versions before 8.1.3. It does not impact Universal Forwarders. When Splunk forwarding is secured using TLS or a Token, the attack requires compromising the certificate or token, or both. Implementation of either or both reduces the severity to Medium.
CVSS v3.1: 7.5
GHSA-prr7-r48q-37cm: The Buffer::Set function in core/cross/buffer.cc in the O3D plug-in in Google Chrome OS before 26.0.1410.57 does not prevent uninitialized data from remaining in a buffer, which might allow remote attackers to obtain sensitive information via unspecified vectors.
PYSEC-2025-46: A vulnerability was found in erdogant pypickle up to 1.1.5. It has been classified as critical. This affects the function Save of the file pypickle/pypickle.py. The manipulation leads to improper authorization. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The patch is named 14b4cae704a0bb4eb6723e238f25382d847a1917. It is recommended to upgrade the affected component.
CVSS v3.1: 5.5
CVE-2024-5801: IP Forwarding enabled in B&R Automation Runtime
Enabled IP Forwarding feature in B&R Automation Runtime versions before 6.0.2 may allow remote attack-ers to compromise network security by routing IP-based packets through the host, potentially by-passing firewall, router, or NAC filtering.
CVSS v4.0: 5.3
CVE-2018-17374: SQL Injection exists in the Auction Factory 4.5.5 component for Joomla! via the filter_order_Dir or filter_order parameter.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
CVE-2014-3514: activerecord/lib/active_record/relation/query_methods.rb in Active Record in Ruby on Rails 4.0.x before 4.0.9 and 4.1.x before 4.1.5 allows remote attackers to bypass the strong parameters protection mechanism via crafted input to an application that makes create_with calls.
CVSS v2.0: 7.5