ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-wwjx-6rfc-2qjh: CACAGOO Cloud Storage Intelligent Camera TV-288ZD-2MP with firmware 3.4.2.0919 has weak authentication of TELNET access, leading to root privileges without any password required.
CVE-2025-41368: Multiple vulnerabilities in Small HTTP server by Smallsrv
Problem in the Small HTTP Server v3.06.36 service. An authenticated path traversal vulnerability in '/' allows remote users to bypass the intended restrictions of SecurityManager and display any file if they have the appropriate permissions outside the document root configured on the server.
CVSS v4.0: 8.7
GHSA-j22c-2h2q-55pv: In the Linux kernel, the following vulnerability has been resolved:drm/v3d: Fix global performance monitor reference countingIn the SET_GLOBAL ioctl, v3d_perfmon_find() bumps the reference count on
the perfmon it returns, but v3d_perfmon_set_global_ioctl() and
v3d_perfmon_delete() fail to release that reference on several paths:v3d_perfmon_set_global_ioctl() leaks the reference on its error
paths.CLEAR_GLOBAL leaks both the find reference and the reference
previously stashed in v3d->global_perfmon by the SET_GLOBAL ioctl
that configured it.Destroying a perfmon that is the current global perfmon leaks the
reference stashed by the SET_GLOBAL ioctl.Release each of these references explicitly.
GHSA-fpfx-7373-qv7q: LCDS Laquis SCADA prior to version 4.1.0.4150 allows improper control of generation of code when opening a specially crafted project file, which may allow remote code execution, data exfiltration, or cause a system crash.
CVSS v3.0: 7.8
GHSA-fjxm-3ghx-fpjr: NETGEAR XR1000 devices before 1.0.0.58 are affected by denial of service.
GHSA-xfwx-x943-x38c: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in axiomthemes smart SEO smartSEO allows SQL Injection.This issue affects smart SEO: from n/a through <= 4.0.
CVSS v3.1: 8.5
GHSA-3v8x-9546-ch2g: BPv7 dissector crash in Wireshark 4.6.0 allows denial of service
CVSS v3.1: 5.5
GHSA-fg7f-vmj6-cm3r: Unspecified vulnerability in a Qualcomm component in Android before 2016-10-05 on Nexus 5X and 6P devices has unknown impact and attack vectors, aka internal bug 28823244.
CVSS v3.0: 9.8
CVE-2021-40788: Adobe Premiere Elements Null Pointer Dereference Application denial-of-service
Adobe Premiere Elements 20210809.daily.2242976 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 5.5
GHSA-wpxw-h4r4-3xjx: Cisco IOS 15.0 and 15.1 and IOS XE 3.x do not properly handle the "set mpls experimental imposition" command, which allows remote attackers to cause a denial of service (device crash) via network traffic that triggers (1) fragmentation or (2) reassembly, aka Bug ID CSCtr56576.
CVE-2024-20079: In gnss service, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08044040; Issue ID: MSV-1491.
CVSS v3.1: 9.8
CVE-2026-54104: U.S. GAO EPDS and CBCA EDS client-based privilege escalation
The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) trusts client-provided values for the 'epds_role_id' parameter without verification, allowing a remote, authenticated attacker to escalate their own privileges.
CVSS v4.0: 8.7
CVSS v3.1: 8.8
GHSA-6mv6-6g96-82f9: Cross-site scripting (XSS) vulnerability in Microsoft Windows SharePoint Services 2.0 allows remote attackers to inject arbitrary web script or HTML via the Picture Source (aka picture object source) field in the Rich Text Editor.
GHSA-6wpm-qx89-jgjw: Unspecified vulnerability in Microsoft Internet Explorer 6 allows remote attackers to execute arbitrary code via certain DHTML script functions, such as normalize, and "incorrectly created elements" that trigger memory corruption, aka "DHTML Script Function Memory Corruption Vulnerability."
GHSA-w324-97v9-pxqg: CMysten Labs Sui blockchain v1.2.0 was discovered to contain a stack overflow via the component /spec/openrpc.json.
CVSS v3.1: 7.5
CVE-2026-32416: WordPress PDF Poster plugin <= 2.4.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in bPlugins PDF Poster pdf-poster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PDF Poster: from n/a through <= 2.4.0.
CVSS v3.1: 5.4
GHSA-ccmj-4w5j-x3r2: VMware GSX Server 2.5.1 build 4968 and earlier, and Workstation 4.0 and earlier, allows local users to gain root privileges via certain enivronment variables that are used when launching a virtual machine session.
GHSA-64x3-f677-69vx: Windows iSCSI Target Service Information Disclosure Vulnerability
CVSS v3.1: 5.5
GHSA-4qpc-c9r6-9jrx: The Disable Admin Notices – Hide Dashboard Notifications plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.2. This is due to missing nonce validation in the `showPageContent()` function. This makes it possible for unauthenticated attackers to add arbitrary URLs to the blocked redirects list via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS v3.1: 4.3
GHSA-hjvc-pqw3-hpgx: The w88235ff7bdc2fb574f1789750ea99ed6 (aka com.w88235ff7bdc2fb574f1789750ea99ed6) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2012-2896: Integer overflow in the WebGL implementation in Google Chrome before 22.0.1229.79 on Mac OS X allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVSS v2.0: 7.5
CVE-2024-47310: WordPress ARI Fancy Lightbox -- Popup for WordPress plugin <= 1.3.17 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in arisoft ARI Fancy Lightbox ari-fancy-lightbox allows Stored XSS.This issue affects ARI Fancy Lightbox: from n/a through <= 1.3.17.
CVSS v3.1: 6.5
GHSA-mgpq-xcpc-pc9g: Adobe Dimension versions 3.4.7 (and earlier) is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 7.8
GHSA-h9q5-44xj-9xmq: A vulnerability has been found in code-projects Hotel and Tourism Reservation System 1.0. This affects an unknown function of the file /details.php. Such manipulation of the argument room leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 5.5
CVSS v3.1: 7.3
GHSA-77rx-vgv7-8925: A vulnerability was found in ZKTeco BioTime up to 9.5.2. It has been classified as problematic. Affected is an unknown function of the component system-group-add Handler. The manipulation of the argument user with the input <script>alert('XSS')</script> leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-270366 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 5.3
CVSS v3.1: 3.5
CVE-2019-14075: Null pointer dereference issue in radio interface layer due to lack of null check in sapmodule destructor in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in MDM9607, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8998, Nicobar, QCS605, Rennell, Saipan, SDM450, SDM630, SDM636, SDM660, SDM670, SDM710, SM6150, SM7150, SM8150, SM8250, SXR2130
CVSS v3.1: 5.5
CVSS v2.0: 4.9
GHSA-vgwq-q6hg-h895: Multiple stack-based buffer overflows in file-xwd.c in the X Window Dump (XWD) plug-in in GIMP 2.8.2 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large (1) red, (2) green, or (3) blue color mask in an XWD file.
RHSA-2024:5442: Red Hat Security Advisory: OpenShift Container Platform 4.15.28 packages and security update
golang: net/http: golang: mime/multipart: golang: net/textproto: memory exhaustion in Request.ParseMultipartForm golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses
CVSS v3.1: 6.7
GHSA-mf4x-rgh7-5xmw: Wedding Management System v1.0 is vulnerable to SQL Injection via /Wedding-Management/admin/client_edit.php?booking=31&user_id=.
CVSS v3.1: 7.2
CVE-2026-14626: NousResearch hermes-agent HTTP API run_agent.py AIAgent.run_conversation denial of service
A weakness has been identified in NousResearch hermes-agent up to 2026.4.30. The impacted element is the function AIAgent.run_conversation of the file run_agent.py of the component HTTP API. This manipulation of the argument todos causes denial of service. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 5.3
CVSS v3.1: 4.3
CVSS v3.0: 4.3
CVSS v2.0: 4
GHSA-qwjj-948r-x92x: Buffer overflow in gbnserver for Gnome Batalla Naval 1.0.4 allows remote attackers to execute arbitrary code via a long connection string.
GHSA-rqpw-2r67-hfv4: Team ENVY, a Security Research TEAM has found a flaw that allows for a remote code execution on the NVR. If an attacker does not enter any value for a specific URL parameter, NULL pointer references will occur and the NVR will reboot. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds.
CVSS v4.0: 6.9
CVE-2026-20791: Chargemap chargemap.com Insufficiently Protected Credentials
Charging station authentication identifiers are publicly accessible via web-based mapping platforms.
CVSS v4.0: 6.9
CVSS v3.1: 6.5
GHSA-w258-4wwm-2876: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metagauss ProfileGrid  allows Reflected XSS. This issue affects ProfileGrid : from n/a through 5.9.5.7.
CVSS v3.1: 7.1
RHSA-2026:24344: Red Hat Security Advisory: libsoup security update
libsoup: libsoup: Information disclosure via cleartext transmission of cookies during HTTPS tunnel establishment
CVSS v3.1: 5.9
CVE-2024-41564: EMI v.1.1.10 and before, fixed in v.1.1.11, contains an Improper Validation of Specified Index, Position, or Offset in Input vulnerability. The specific issue is a failure to validate slot index and decrement stack count in EMI mod for Minecraft, which allows in-game item duplication.
CVSS v3.1: 4.3
CVE-2016-6441: A vulnerability in the Transaction Language 1 (TL1) code of Cisco ASR 900 Series routers could allow an unauthenticated, remote attacker to cause a reload of, or remotely execute code on, the affected system. This vulnerability affects Cisco ASR 900 Series Aggregation Services Routers (ASR902, ASR903, and ASR907) that are running the following releases of Cisco IOS XE Software: 3.17.0S 3.17.1S 3.17.2S 3.18.0S 3.18.1S. More Information: CSCuy15175. Known Affected Releases: 15.6(1)S 15.6(2)S. Known Fixed Releases: 15.6(1)S2.12 15.6(1.17)S0.41 15.6(1.17)SP 15.6(2)SP 16.4(0.183) 16.5(0.10).
CVSS v3.0: 9.8
CVSS v2.0: 10
GHSA-f4vp-f6h9-8cx8: A remote code execution vulnerability affecting a Valmet DNA service listening on TCP port 1517, allows an attacker to execute commands with SYSTEM privileges This issue affects: Valmet DNA versions from Collection 2012 until Collection 2021.
CVSS v3.1: 8.8
GHSA-cj9f-hg66-h4qv: Unspecified vulnerability in Oracle MySQL Server 5.6.22 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB, a different vulnerability than CVE-2015-4756.
GHSA-3m7q-mm9c-3r6p: VMware Cloud Director Object Storage Extension contains an Insertion of Sensitive Information vulnerability.A malicious actor with adjacent access to 
web/proxy server logging may be able to obtain sensitive information 
from URLs that are logged.
CVSS v3.1: 5.3
RHSA-2013:0958: Red Hat Security Advisory: java-1.7.0-openjdk security update
OpenJDK: Insecure shared memory permissions (2D, 8001034) OpenJDK: Frame injection in generated HTML (Javadoc, 8012375) OpenJDK: Integrate Apache Santuario, rework class loader (Libraries, 6741606, 8008744) OpenJDK: JConsole SSL support (Serviceability, 8003703) OpenJDK: AccessControlContext check order issue (Libraries, 8001330) OpenJDK: Resource denial of service (AWT, 8001038) OpenJDK: Better handling of memory allocation errors (Hotspot, 7158805) OpenJDK: output stream access restrictions (CORBA, 8000642) OpenJDK: Prevent revealing the local address (Networking, 8001318) OpenJDK: Better access restrictions (Sound, 8006328) OpenJDK: GnomeFileTypeDetector path access check (Libraries, 8004288) OpenJDK: ObjectStreamClass circular reference denial of service (Serialization, 8000638) OpenJDK: Unique VMIDs (Libraries, 8001033) OpenJDK: MBeanServer Introspector package access (JMX, 8008124) OpenJDK: SerialJavaObject package restriction (JDBC, 8009554) OpenJDK: getEnclosing* checks (Libraries, 8007812) OpenJDK: ObjectOutputStream access checks (Serialization, 8008132) OpenJDK: Proper class checking (JMX, 8008120) OpenJDK: Method handles (Libraries, 8009424) OpenJDK: Various AWT integer overflow checks (AWT, 8009071) OpenJDK: tracing insufficient access checks (Serviceability, 8010209) OpenJDK: Missing check for valid DOMCanonicalizationMethod canonicalization algorithm (Libraries, 8014281) OpenJDK: Incorrect image attribute verification (2D, 8012438) OpenJDK: Incorrect image channel verification (2D, 8012597) OpenJDK: Incorrect image layout verification (2D, 8012601) OpenJDK: ImagingLib byte lookup processing (2D, 8011243) OpenJDK: Incorrect IntegerComponentRaster size checks (2D, 8011248) OpenJDK: Incorrect ShortBandedRaster size checks (2D, 8011253) OpenJDK: Incorrect ByteBandedRaster size checks (2D, 8011257)
GHSA-5432-gqxr-48c4: A vulnerability was found in wonderwhy-er DesktopCommanderMCP up to 0.2.13. The impacted element is the function CommandManager of the file src/command-manager.ts. Performing manipulation results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.
CVSS v4.0: 2.1
CVSS v3.1: 6.3
CVE-2023-0340: Custom Content Shortcode <= 4.0.2 - Contributor+ LFI
The Custom Content Shortcode WordPress plugin through 4.0.2 does not validate one of its shortcode attribute, which could allow users with a contributor role and above to include arbitrary files via a traversal attack. This could also allow them to read non PHP files and retrieve their content. RCE could also be achieved if the attacker manage to upload a malicious image containing PHP code, and then include it via the affected attribute, on a default WP install, authors could easily achieve that given that they have the upload_file capability.
CVSS v3.1: 8.8
CVE-2022-49907: net: mdio: fix undefined behavior in bit shift for __mdiobus_register
In the Linux kernel, the following vulnerability has been resolved:

net: mdio: fix undefined behavior in bit shift for __mdiobus_register

Shifting signed 32-bit value by 31 bits is undefined, so changing
significant bit to unsigned. The UBSAN warning calltrace like below:

UBSAN: shift-out-of-bounds in drivers/net/phy/mdio_bus.c:586:27
left shift of 1 by 31 places cannot be represented in type 'int'
Call Trace:
 <TASK>
 dump_stack_lvl+0x7d/0xa5
 dump_stack+0x15/0x1b
 ubsan_epilogue+0xe/0x4e
 __ubsan_handle_shift_out_of_bounds+0x1e7/0x20c
 __mdiobus_register+0x49d/0x4e0
 fixed_mdio_bus_init+0xd8/0x12d
 do_one_initcall+0x76/0x430
 kernel_init_freeable+0x3b3/0x422
 kernel_init+0x24/0x1e0
 ret_from_fork+0x1f/0x30
 </TASK>
CVSS v3.1: 7.8
GHSA-v6jm-v768-76h2: Relative path traversal vulnerability in Setelsa Security's ConacWin CB, in its 3.8.2.2 version and earlier, the exploitation of which could allow an attacker to perform an arbitrary download of files from the system via the "Download file" parameter.
CVSS v3.1: 7.5
CVE-2002-0554: webdriver in IBM Informix Web DataBlade 4.12 allows remote attackers to bypass user access levels or read arbitrary files via a SQL injection attack in an HTTP request.
CVSS v2.0: 7.5
GHSA-h7wh-hpm7-8p7h: Vulnerability in the Oracle Project Contracts product of Oracle E-Business Suite (component: Hold Management). Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Contracts. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Project Contracts accessible data as well as unauthorized access to critical data or complete access to all Oracle Project Contracts accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
ICSA-20-338-01: National Instruments CompactRIO
Incorrect permissions are set by default for an API entry-point of a specific service, allowing a non-authenticated user to trigger a function that could reboot the device remotely. CVE-2020-25191 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
CVSS v3.0: 7.5
GHSA-jcvv-34g9-68c7: Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWAN_Wizard534.
CVSS v3.1: 7.5
CVE-2026-46847: Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle WebCenter Portal.  While the vulnerability is in Oracle WebCenter Portal, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Portal. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
CVSS v3.1: 9.9
PYSEC-2022-125: Tensorflow is an Open Source Machine Learning Framework. An attacker can craft a TFLite model that would cause a write outside of bounds of an array in TFLite. In fact, the attacker can override the linked list used by the memory allocator. This can be leveraged for an arbitrary write primitive under certain conditions. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
CVE-2015-6992: CoreText in Apple iOS before 9.1, OS X before 10.11.1, and iTunes before 12.3.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6975 and CVE-2015-7017.
CVSS v2.0: 7.5
GHSA-pgmv-px7h-43x3: exports/download.php in the 99 Robots WP Background Takeover Advertisements plugin before 4.1.5 for WordPress has Directory Traversal via a .. in the filename parameter.
CVSS v3.0: 7.5
GHSA-w79p-phhc-5r23: In the Linux kernel, the following vulnerability has been resolved:Bluetooth: L2CAP: Fix not validating setsockopt user inputCheck user input length before copying data.
CVSS v3.1: 7.1
CVE-2024-41228: A symlink following vulnerability in the pouch cp function of AliyunContainerService pouch v1.3.1 allows attackers to escalate privileges and write arbitrary files.
CVSS v3.1: 7.6
CVE-2025-56254: PHPGurukul Employee Leave Management System 2.1 contains an Insecure Direct Object Reference (IDOR) vulnerability in leave-details.php. An authenticated user can change the leaveid parameter in the URL to access leave application details of other users.
CVSS v3.1: 4.3
GHSA-3pcq-34w5-p4g2: modern-async's `forEachSeries` and `forEachLimit` functions do not limit the number of requests
ImpactThis is a bug affecting two of the functions in this library: `forEachSeries` and `forEachLimit`. They should limit the concurrency of some actions but, in practice, they don't. Any code calling these functions will be written thinking they would limit the concurrency but they won't. This could lead to potential security issues in other projects.PatchesThe problem has been patched in 1.0.4.WorkaroundsThere is no workaround aside from upgrading to 1.0.4.
CVSS v3.1: 7.5
GHSA-f23m-r9xm-vv4f: There is a cross-site scripting vulnerability in the
management console of Absolute Secure Access prior to version 13.52. Attackers
with system administrator permissions can interfere with another system
administrator’s use of the management console when the second administrator logs
in. Attack complexity is high, attack requirements are present, privileges
required are high, user interaction required is none. The impact to
confidentiality is none, the impact to availability is low, and the impact to
system integrity is high.
CVSS v4.0: 5.9
CVE-2018-25239: Smart VPN 1.1.3.0 Denial of Service via Search
Smart VPN 1.1.3.0 contains a denial of service vulnerability that allows local attackers to crash the application by submitting oversized input through the search interface. Attackers can paste a buffer of 2100 characters into the top right search bar to trigger an unhandled exception that crashes the application.
CVSS v4.0: 6.9
CVSS v3.1: 6.2
GHSA-f3jh-qvm4-mg39: Erroneous authentication pass in Spring Security
In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, versions 6.2.x prior to 6.2.3, an application is possible vulnerable to broken access control when it directly uses the AuthenticatedVoter#vote passing a null Authentication parameter.Specifically, an application is vulnerable if:The application uses AuthenticatedVoter directly and a null authentication parameter is passed to it resulting in an erroneous true return value.An application is not vulnerable if any of the following is true:The application does not use AuthenticatedVoter#vote directly.The application does not pass null to AuthenticatedVoter#vote.Note that AuthenticatedVoter is deprecated since 5.8, use implementations of AuthorizationManager as a replacement.
CVSS v3.1: 8.2
PYSEC-2019-223: Google TensorFlow 1.7.x and earlier is affected by a Buffer Overflow vulnerability. The type of exploitation is context-dependent.
CVE-2021-22486: There is a issue of Unstandardized field names in Huawei Smartphone. Successful exploitation of this vulnerability may affect service confidentiality.
CVSS v3.1: 7.5
CVSS v2.0: 5
GHSA-8fxj-mc6p-c854: AppleKeyStore in Apple iOS before 9 allows physically proximate attackers to reset the count of incorrect passcode attempts via a device backup.
GHSA-5c5x-7wp7-xwgj: The WPCargo Track & Trace WordPress plugin before 6.9.5 does not sanitise and escape the wpcargo_tracking_number parameter before outputting it back in the page, which could allow attackers to perform reflected Cross-Site Scripting attacks.
CVSS v3.1: 6.1
CVE-2018-13711: The mintToken function of a smart contract implementation for Databits, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS v3.0: 7.5
CVSS v2.0: 5
GHSA-36cg-qj95-mq7x: In the Linux kernel, the following vulnerability has been resolved:drm/amd/display: prevent memory leakIn dcn*_create_resource_pool the allocated memory should be released if
construct pool fails.