ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2024-42031: Access permission verification vulnerability in the Settings module.
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS v3.1: 7.5
CVE-2025-2868: Reflected Cross-Site Scripting (XSS) vulnerability in Clinic Queuing System
Reflected Cross-Site Scripting (XSS) vulnerability in version 1.0 of the Clinic Queuing System. This vulnerability could allow an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the page parameter in /index.php.
CVSS v4.0: 4.8
CVE-2008-2893: SQL injection vulnerability in news.php in AJ Square aj-hyip (aka AJ HYIP Acme) allows remote attackers to execute arbitrary SQL commands via the id parameter, a different vector than CVE-2008-2532.
CVSS v2.0: 7.5
CVE-2022-27669: An unauthenticated user can use functions of XML Data Archiving Service of SAP NetWeaver Application Server for Java - version 7.50, to which access should be restricted. This may result in an escalation of privileges.
CVSS v3.1: 7.5
CVSS v2.0: 5
CVE-2026-2725: Improper Authorization in Gerrit allowing Code Review Bypass via "Submitted Together"
Incorrect authorization in the "submitted together" feature in Gerrit versions 2.12 and later allows an authenticated attacker with force push permissions on a secondary branch to bypass code review and forcefully submit code to restricted branches via a crafted submission matching the "topic" tag of an unapproved change.
CVSS v4.0: 6
CVE-2022-24292: Certain HP Print devices may be vulnerable to potential information disclosure, denial of service, or remote code execution.
CVSS v3.1: 9.8
CVSS v2.0: 10
GHSA-gv8r-9rw9-9697: Traefik affected by TLS ClientAuth Bypass on HTTP/3
SummaryThere is a potential vulnerability in Traefik managing HTTP/3 connections.More details in the [CVE-2025-68121](https://nvd.nist.gov/vuln/detail/CVE-2025-68121).Patcheshttps://github.com/traefik/traefik/releases/tag/v2.11.37https://github.com/traefik/traefik/releases/tag/v3.6.8WorkaroundsNo workaroundFor more informationIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).
CVSS v4.0: 7.8
CVSS v3.1: 10
CVE-2005-1272: Stack-based buffer overflow in the Backup Agent for Microsoft SQL Server in BrightStor ARCserve Backup Agent for SQL Server 11.0 allows remote attackers to execute arbitrary code via a long string sent to port (1) 6070 or (2) 6050.
CVSS v2.0: 7.5
GHSA-p6p7-26wf-jg2r: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AKCE Software Technology R&D Industry and Trade Inc. SKSPro allows Reflected XSS.This issue affects SKSPro: through 07012026.
CVSS v3.1: 7.6
GHSA-9qf7-q6gx-q652: Authentication Bypass by Capture-replay, Use of Password Hash With Insufficient Computational Effort vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Client login, peer authentication modules) allows Reusing Session IDs (aka Session Replay). This vulnerability is associated with program files src/client.Rs and program routines hash_password(), login proof construction.This issue affects RustDesk Client: through 1.4.5.
CVSS v4.0: 9.3
CVSS v3.1: 9.8
CVE-2016-3109: The backend/Login/load/ script in Shopware before 5.1.5 allows remote attackers to execute arbitrary code.
CVSS v3.0: 9.8
CVSS v2.0: 10
GHSA-7fj6-ch6w-c47g: The Happy Addons for Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via DOM in all versions up to and including 3.9.1.1 (versions up to 2.9.1.1 in Happy Addons for Elementor Pro) due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS v3.1: 6.1
CVE-2021-20303: A flaw found in function dataWindowForTile() of IlmImf/ImfTiledMisc.cpp. An attacker who is able to submit a crafted file to be processed by OpenEXR could trigger an integer overflow, leading to an out-of-bounds write on the heap. The greatest impact of this flaw is to application availability, with some potential impact to data integrity as well.
CVSS v3.1: 6.1
CVSS v2.0: 5.8
CVE-2019-17391: An issue was discovered in the Espressif ESP32 mask ROM code 2016-06-08 0 through 2. Lack of anti-glitch mitigations in the first stage bootloader of the ESP32 chip allows an attacker (with physical access to the device) to read the contents of read-protected eFuses, such as flash encryption and secure boot keys, by injecting a glitch into the power supply of the chip shortly after reset.
CVSS v3.1: 4.6
CVSS v2.0: 2.1
GHSA-2mv3-9m4h-pmr6: Cross-site scripting (XSS) vulnerability in Opentools Attachment Mod before 2.4.5 allows remote attackers to inject arbitrary web script or HTML in Internet Explorer via unknown vectors related to the uploaded attachments form.  NOTE: some details were obtained from third party information.
GHSA-h267-8j5j-27gj: Storage Concentrator (SC & SCVM) contains a command injection vulnerability in the ms_service.pl service, which listens on TCP port 9000 by default and accepts custom network packets to perform device actions. An unauthenticated remote attacker can send a specially crafted packet containing a malicious payload that is processed without adequate sanitization, resulting in arbitrary command execution with root-level privileges.
CVSS v4.0: 10
CVSS v3.1: 10
GHSA-9hrv-gvrv-6gf2: Flowise Execute Flow function has an SSRF vulnerability
SummaryThe attacker provides an intranet address through the base url field configured in the Execute Flow node 
→ Bypass checkDenyList / resolveAndValidate in httpSecurity.ts (not called)
→ Causes the server to initiate an HTTP request to any internal network address, read cloud metadata, or detect internal network servicesDetailsThen initiate the call:Server received a request:And there is an echo:Fix:
Call secureFetch for verificationImpactThis is a Server-Side Request Forgery (SSRF) vulnerability that may lead to the following risks:Explore Internal Web ApplicationsAccess sensitive management interfacesLeak internal configuration, credentials, or confidential informationThis vulnerability significantly increases the risk of internal service enumeration and potential lateral movement in enterprise environments.
CVSS v4.0: 6
CVE-2024-31803: Buffer Overflow vulnerability in emp-ot v.0.2.4 allows a remote attacker to execute arbitrary code via the FerretCOT<T>::read_pre_data128_from_file function.
CVSS v3.1: 6.2
CVE-2022-1548: Playbook members are allowed to escalate their membership privileges and perform actions restricted to playbook admins.
Mattermost Playbooks plugin 1.25 and earlier fails to properly restrict user-level permissions, which allows playbook members to escalate their membership privileges and perform actions restricted to playbook admins.
CVSS v3.1: 3.7
CVE-2026-50034: Apollo Pharmacy Blood Glucose Monitoring System APG-01 BT Cleartext Transmission of Sensitive Information
An attacker within BLE communication range can passively intercept 
wireless traffic and obtain sensitive health-related information, 
including glucose measurement values.
CVSS v4.0: 7.1
CVSS v3.1: 6.5
GHSA-4cm6-j283-3qfv: Unknown vulnerability in HP-UX B.11.04 running Virtualvault 4.5 through 4.7, when running the TGA daemon, allows remote attackers to cause a denial of service via certain network traffic.
GHSA-p758-wxmr-xh9f: IBM Jazz Team Server products contain an undisclosed vulnerability that could allow an authenticated user to present a customized message on the application which could be used to phish other users. IBM X-Force ID: 192419.
CVE-2009-1613: Multiple SQL injection vulnerabilities in leap.php in Leap CMS 0.1.4, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) searchterm or (2) email parameter.
CVSS v2.0: 6.8
CVE-2020-9986: A file access issue existed with certain home folder files. This was addressed with improved access restrictions. This issue is fixed in macOS Catalina 10.15.7. A malicious application may be able to read sensitive location information.
CVSS v3.1: 3.3
CVSS v2.0: 4.3
CVE-2008-0900: Session fixation vulnerability in BEA WebLogic Server and Express 8.1 SP4 through SP6, 9.2 through MP1, and 10.0 allows remote authenticated users to hijack web sessions via unknown vectors.
CVSS v2.0: 6
GHSA-g9qg-48f9-44pg: The Intelligent Platform Management Interface (IPMI) implementation in Integrated Management Module (IMM) on IBM BladeCenter, Flex System, System x iDataPlex, and System x3### servers uses cleartext for password storage, which allows context-dependent attackers to obtain sensitive information by reading a file.
GHSA-22x3-74c8-hwpv: Tenda A18 V15.13.07.09 was discovered to contain a stack overflow via the rule_info parameter in the formAddMacfilterRule function.
CVSS v3.1: 7.5
GHSA-4766-3xqh-rp5x: In Gradle Enterprise before 2023.1, a remote attacker may be able to gain access to a new installation (in certain installation scenarios) because of a non-unique initial system user password. Although this password must be changed upon the first login, it is possible that an attacker logs in before the legitimate administrator logs in.
CVSS v3.1: 9.8
CVE-2026-54322: Daytona: Cross-org IDOR in organization role update/delete — any org owner can rewrite or destroy another org's roles
Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.185.0, Daytona's organization role update and delete endpoints authorized the caller as an owner of the organization named in the request path, but resolved and mutated the target role by its identifier alone, without verifying the role belonged to that organization. An authenticated user who owns any organization (organizations are self-service) could therefore modify the permissions of, or delete, a role belonging to a different organization, given that role's identifier. This vulnerability is fixed in 0.185.0.
CVSS v3.1: 7.7
GHSA-pj8h-cmgw-7xpg: Transient DOS while converting TWT (Target Wake Time) frame parameters in the OTA broadcast.
CVSS v3.1: 7.5
CVE-2025-24852: Storing passwords in a recoverable format issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. If this issue is exploited, an attacker who can access the microSD card used on the product may obtain the product login password.
CVSS v3.1: 4.6
GHSA-ggj8-6hrc-qfgr: Multiple vulnerabilities in the web-based user interface of certain Cisco Small Business Series Switches could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or execute arbitrary code with root privileges on an affected device. These vulnerabilities are due to improper validation of requests that are sent to the web interface. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS v3.0: 8.6
GHSA-fvmg-22f6-q6vj: The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URLs in all versions up to, and including, 7.5.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS v3.1: 6.1
GHSA-fww2-2rfq-642g: Unrestricted file upload vulnerability in IMCE before 1.6, a Drupal module, allows remote authenticated users to upload arbitrary PHP code via a filename with a double extension such as .php.gif.
RHSA-2026:25979: Red Hat Security Advisory: samba security update
samba: Missing access check on reparse point operations samba: vfs_worm does not block directory modification samba: group policy certificate enrollment uses http:// without validation samba: Remote Code Execution in SAMR samba: Samba: Remote Code Execution in printing subsystem via unescaped job description
CVSS v3.1: 9
GHSA-m8xp-vjq7-78wm: Insufficient policy enforcement in ServiceWorker in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
CVSS v3.1: 4.3
CVE-2024-6325: Rockwell Automation Unsecured Private Keys in FactoryTalk® System Services
The v6.40 release of Rockwell Automation FactoryTalk® Policy Manager CVE-2021-22681 https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1550.html  and  CVE-2022-1161 https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1585.html  by implementing CIP security and did not update to the versions of the software CVE-2022-1161 https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1585.html  and  CVE-2022-1161. https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1585.html
CVSS v4.0: 6
GHSA-jhx2-qrv5-m4q7: SQL Injection vulnerability in kishan0725 Hospital Management System thru commit 4770d740f2512693ef8fd9aa10a8d17f79fad9bd (on March 13, 2021), allows attackers to execute arbitrary commands via the contact and doctor parameters to /search.php.
CVSS v3.1: 9.8
CVE-2006-0804: Off-by-one error in TIN 1.8.0 and earlier might allow attackers to execute arbitrary code via unknown vectors that trigger a buffer overflow.
CVSS v2.0: 7.5
RHSA-2024:2628: Red Hat Security Advisory: kernel-rt security and bug fix update
hw: amd: Instruction raise #VC exception at exit hw: amd: Instruction raise #VC exception at exit
CVSS v3.1: 7.1
CVE-2025-22449: Access control flaw for team admins allows unauthorized team additions
Mattermost versions 9.11.x <= 9.11.5 fail to enforce invite permissions, which allows team admins, with no permission to invite users to their team, to invite users by updating the "allow_open_invite" field via making their team public.
CVSS v3.1: 3.8
CVE-2010-3422: SQL injection vulnerability in the JGen (com_jgen) component 0.9.33 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a view action to index.php.
CVSS v2.0: 7.5
GHSA-mrcf-8r9j-jvmm: Multiple XSS vulnerabilities in WeaselCMS v0.3.6 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php because $_SERVER['PHP_SELF'] is mishandled.
CVSS v3.0: 6.1
CVE-2018-13195: The mintToken function of a smart contract implementation for Cranoo (CRN), an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS v3.1: 7.5
CVSS v2.0: 5
CVE-2009-1054: Unspecified vulnerability in JustSystems Ichitaro 13, 2004 through 2008, Lite2, and Ichitaro viewer 5.1.5.0 and earlier allows remote attackers to execute arbitrary code via a crafted file, as exploited in the wild by Trojan.Tarodrop.H in March 2009.
CVSS v2.0: 9.3
CVE-2016-6741: An elevation of privilege vulnerability in the Qualcomm camera driver in Android before 2016-11-05 could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Android ID: A-30559423. References: Qualcomm QC-CR#1060554.
CVSS v3.0: 7.8
CVSS v2.0: 9.3
CVE-2020-26908: Certain NETGEAR devices are affected by authentication bypass. This affects D6200 before 1.1.00.36, D7000 before 1.0.1.74, PR2000 before 1.0.0.30, R6020 before 1.0.0.42, R6050 before 1.0.1.22, JR6150 before 1.0.1.22, R6080 before 1.0.0.42, R6120 before 1.0.0.66, R6220 before 1.1.0.100, R6230 before 1.1.0.100, R6260 before 1.1.0.64, R6700v2 before 1.2.0.62, R6800 before 1.2.0.62, R69002 before 1.2.0.62, and WNR2020 before 1.1.0.62.
CVSS v3.1: 9.4
GHSA-x34r-63hx-w57f: Langroid has WAF Bypass Leading to RCE in TableChatAgent
Affected Scopelangroid <= 0.59.31Vulnerability DescriptionCVE-2025-46724 fix bypass:TableChatAgent can call pandas_eval tool to evaluate the expression. There is a WAF in `langroid/utils/pandas_utils.py` introduced to block code injection CVE-2025-46724. However it can be bypassed due to `_literal_ok()` returning `False` instead of raising `UnsafeCommandError` on invalid input, combined with unrestricted access to dangerous dunder attributes (`__init__`, `__globals__`, `__builtins__`). This allows chaining whitelisted DataFrame methods to leak the `eval` builtin and execute arbitrary code.Reproduction & PoCThis payload is used to bypass the waf, when executed, the column name `__import__('os').system('ls')#...` will be passed to evalhere is the PoCafter running this poc, command `ls` will be executed on the server
<img width="2501" height="1256" alt="image" src="https://github.com/user-attachments/assets/98b83585-68e0-4be4-a7a6-21909fed662e" />Gadgetpandas_eval (langroid\agent\special\table_chat_agent.py:239)
handle_tool_message (langroid\agent\base.py:2092)
handle_message (langroid\agent\base.py:1744)
agent_response (langroid\agent\base.py:760)
response (langroid\agent\task.py:1584)
step (langroid\agent\task.py:1261)
run (langroid\agent\task.py:827)Security ImpactRemote Code Execution (RCE) via `pandas_eval` tool. Attackers can execute arbitrary shell commands through controlled user input.
CVSS v4.0: 9.4
CVE-2024-33947: WordPress RegistrationMagic  plugin <= 5.3.2.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metagauss RegistrationMagic allows Reflected XSS.This issue affects RegistrationMagic: from n/a through 5.3.2.0.
CVSS v3.1: 7.1
GHSA-6h5m-c899-vgw5: obs-server before 1.7.7 allows logins by 'unconfirmed' accounts due to a bug in the REST api implementation.
CVE-2023-38225: ZDI-CAN-21118: Adobe Acrobat Reader DC AcroForm Use-After-Free Remote Code Execution Vulnerability
Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 7.8
GHSA-6h2q-3hc7-cvj3: A remote potential adjacent denial of service (DoS) and potential adjacent arbitrary code execution vulnerability that could potentially lead to a loss of confidentiality, integrity, and availability were discovered in HPE Integrated Lights-Out 5 (iLO 5) in Version: 2.71. Hewlett Packard Enterprise has provided updated firmware for HPE Integrated Lights-Out 5 (iLO 5) that addresses these security vulnerabilities.
CVSS v3.1: 8.8
CVE-2021-1316: Cisco Small Business RV Series Routers Management Interface Command Injection Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges. These vulnerabilities are due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to a targeted device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system. To exploit these vulnerabilities, an attacker would need to have valid administrator credentials on an affected device.
CVSS v3.1: 7.2
GHSA-mgqh-xx5m-2h5f: In the Linux kernel, the following vulnerability has been resolved:usb: mtu3: fix kernel panic at qmu transfer done irq handlerWhen handle qmu transfer irq, it will unlock @mtu->lock before give back
request, if another thread handle disconnect event at the same time, and
try to disable ep, it may lock @mtu->lock and free qmu ring, then qmu
irq hanlder may get a NULL gpd, avoid the KE by checking gpd's value before
handling it.e.g.
qmu done irq on cpu0                 thread running on cpu1qmu_done_tx()
  handle gpd [0]
    mtu3_requ_complete()        mtu3_gadget_ep_disable()
      unlock @mtu->lock
        give back request         lock @mtu->lock
                                    mtu3_ep_disable()
                                      mtu3_gpd_ring_free()
                                   unlock @mtu->lock
      lock @mtu->lock
    get next gpd [1][1]: goto [0] to handle next gpd, and next gpd may be NULL.
CVE-2026-24904: TrustTunnel has `client_random_prefix` rule bypass via fragmented or partial TLS ClientHello
TrustTunnel is an open-source VPN protocol with a rule bypass issue in versions prior to 0.9.115. In `tls_listener.rs`, `TlsListener::listen()` peeks 1024 bytes and calls `extract_client_random(...)`. If `parse_tls_plaintext` fails (for example, a fragmented/partial ClientHello split across TCP writes), `extract_client_random` returns `None`. In `rules.rs`, `RulesEngine::evaluate` only evaluates `client_random_prefix` when `client_random` is `Some(...)`. As a result, when extraction fails (`client_random == None`), any rule that relies on `client_random_prefix` matching is skipped and evaluation falls through to later rules. As an important semantics note: `client_random_prefix` is a match condition only. It does not mean "block non-matching prefixes" by itself. A rule with `client_random_prefix = ...` triggers its `action` only when the prefix matches (and the field is available to evaluate). Non-matches (or `None`) simply do not match that rule and continue to fall through. The vulnerability is fixed in version 0.9.115.
CVSS v3.1: 5.3
GHSA-pc7r-985x-4w4m: A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows attackers to arbitrarily add Administrator users.
CVSS v3.1: 8.8
GHSA-m6gv-xh9g-mmcp: MyBB (aka MyBulletinBoard) 1.6 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by inc/3rdparty/diff/Diff/ThreeWay.php and certain other files.
CVE-2022-47453: In wcn service, there is a possible missing params check. This could lead to local denial of service in wcn service.
CVSS v3.1: 5.5
GHSA-gvq9-x998-gj3m: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes FreeAgent allows PHP Local File Inclusion.This issue affects FreeAgent: from n/a through 2.1.2.
CVSS v3.1: 8.1
GHSA-3gfg-g579-3wmq: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.45. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS v3.1: 4.9
GHSA-33gp-xwq2-f742: An issue in the /store/items/search endpoint of Agent Protocol server commit e9a89f allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS v3.1: 7.5
GHSA-h6vv-5xx4-c25q: Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS v3.1: 9.8
CVE-2017-1002008: Vulnerability in wordpress plugin membership-simplified-for-oap-members-only v1.58, The file download code located membership-simplified-for-oap-members-only/download.php does not check whether a user is logged in and has download privileges.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2022-37235: Netgear Nighthawk AC1900 Smart WiFi Dual Band Gigabit Router R7000-V1.0.11.134_10.2.119 is vulnerable to Buffer Overflow via the wl binary in firmware. There is a stack overflow vulnerability caused by strncat
CVSS v3.1: 9.8
CVE-2010-0691: SQL injection vulnerability in druckansicht.php in JTL-Shop 2 allows remote attackers to execute arbitrary SQL commands via the s parameter.
CVSS v2.0: 7.5