ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2016-8525: A Remote Disclosure of Information vulnerability in HPE iMC PLAT version v7.2 E0403P06 and earlier was found. The problem was resolved in iMC PLAT 7.3 E0504 or subsequent version.
CVSS v3.0: 7.5
CVSS v2.0: 5
CVE-2024-39548: Junos OS Evolved: Receipt of specific packets in the aftmand process will lead to a memory leak
An Uncontrolled Resource Consumption vulnerability in the aftmand process of Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to consume memory resources, resulting in a Denial of Service (DoS) condition. The processes do not recover on their own and must be manually restarted.

This issue affects both IPv4 and IPv6. 

Changes in memory usage can be monitored using the following CLI command:
user@device> show system memory node <fpc slot> | grep evo-aftmann
This issue affects Junos OS Evolved: 



  *  All versions before 21.2R3-S8-EVO, 
  *  21.3 versions before 21.3R3-S5-EVO, 
  *  21.4 versions before 21.4R3-S5-EVO, 
  *  22.1 versions before 22.1R3-S4-EVO, 
  *  22.2 versions before 22.2R3-S4-EVO,
  *  22.3 versions before 22.3R3-S3-EVO,
  *  22.4 versions before 22.4R2-S2-EVO, 22.4R3-EVO, 
  *  23.2 versions before 23.2R1-S1-EVO, 23.2R2-EVO.
CVSS v4.0: 7.1
CVSS v3.1: 7.5
GHSA-cr8v-8mh7-xwrm: Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.64 and earlier, and 5.5.26 and earlier, allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Information Schema.
RHSA-2023:4112: Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.2.8 security update
golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding openshift: OCP & FIPS mode
CVSS v3.1: 6.5
GHSA-w9fx-47f2-7vff: Unauthenticated attackers can send configuration settings to device and possible perform physical actions remotely (e.g., on/off).
CVSS v4.0: 6.9
CVSS v3.1: 6.5
GHSA-r4p9-4g64-q7xc: Huawei HEGE-570 version 1.0.1.22(SP3); and HEGE-560, OSCA-550, OSCA-550A, OSCA-550AX, and OSCA-550X version 1.0.1.21(SP3) have an insufficient verification vulnerability. An attacker can access the device physically and exploit this vulnerability to tamper with device information. Successful exploit may cause service abnormal.
PYSEC-2022-274: LIEF commit 5d1d643 was discovered to contain a heap-buffer overflow in the component /core/CorePrPsInfo.tcc.
RHSA-2007:0387: Red Hat Security Advisory: tcpdump security and bug fix update
tcpdump denial of service tcpdump BGP integer overflow
CVE-2014-7578: The Bieber News Now (aka com.jbnews) application 12.0.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0: 5.4
GHSA-8v7m-fq65-x5vg: Live Chat (com_livechat) component 1.0 for Joomla! allows remote attackers to use the xmlhttp.php script as an open HTTP proxy to hide network scanning activities or scan internal networks via a GET request with a full URL in the query string.
CVE-2018-0774: Microsoft Edge in Windows 10 1709 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0758, CVE-2018-0762, CVE-2018-0768, CVE-2018-0769, CVE-2018-0770, CVE-2018-0772, CVE-2018-0773, CVE-2018-0775, CVE-2018-0776, CVE-2018-0777, CVE-2018-0778, and CVE-2018-0781.
CVSS v3.0: 7.5
CVSS v2.0: 7.6
CVE-2026-45433: Hardcoded Cryptographic Key Vulnerability in GX Earth ONT Models
This vulnerability exists in GX Earth 2022 ONT models due to the presence of hardcoded RSA private key within the device firmware. A remote attacker could exploit this vulnerability by extracting the cryptographic private key from the firmware, which could lead to decryption of HTTPS traffic and Man-in-the-Middle (MITM) attacks on the targeted device.
CVSS v4.0: 8.7
CVE-2020-11914: The Treck TCP/IP stack before 6.0.1.66 has an ARP Out-of-bounds Read.
CVSS v3.1: 4.3
CVSS v2.0: 3.3
GHSA-m5vh-3fw5-5wgh: JmsBinding.extractBodyFromJms() in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values via javax.jms.ObjectMessage.getObject() without applying any ObjectInputFilter, class allowlist or class denylist. Because this code path is reached whenever the mapJmsMessage option is enabled (the default) and Camel acts as a JMS consumer, an attacker able to publish a crafted ObjectMessage to a queue or topic consumed by a Camel application could achieve remote code execution when a deserialization gadget chain was present on the classpath. The same handling was reached transitively through camel-sjms2 (whose Sjms2Endpoint extends SjmsEndpoint) and through camel-amqp (whose AMQPJmsBinding extends JmsBinding), and by other JMS-family components built on JmsComponent such as camel-activemq and camel-activemq6.This issue affects Apache Camel: from 3.0.0 before 4.14.7, from 4.15.0 before 4.18.2, from 4.19.0 before 4.20.0.Users are recommended to upgrade to version 4.20.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.7. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.2.
CVSS v3.1: 9.8
CVE-2006-4957: SQL injection vulnerability in the GetMember function in functions.php in MyReview 1.9.4 allows remote attackers to execute arbitrary SQL commands via the email parameter to Admin.php.
CVSS v2.0: 7.5
GHSA-4q6j-2cv9-cmqj: Inappropriate implementation in WebRTC in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2021-37128: HwPCAssistant has a Path Traversal vulnerability .Successful exploitation of this vulnerability may write any file.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2007-3284: corefoundation.dll in Apple Safari 3.0.1 (552.12.2) for Windows allows remote attackers to cause a denial of service (crash) via certain forms that trigger errors related to History, possibly involving multiple form fields with the same name.
CVSS v2.0: 7.8
GHSA-37rg-fg68-qv29: Due to a Cross-Site Request Forgery (CSRF) vulnerability in SAP NetWeaver Application Server for ABAP, an authenticated attacker could initiate transactions directly via the session manager, bypassing the first transaction screen and the associated authorization check. This vulnerability could allow the attacker to perform actions and execute transactions that would normally require specific permissions, compromising the integrity and confidentiality of the system by enabling unauthorized access to restricted functionality. There is no impact to availability from this vulnerability.
CVSS v3.1: 5.4
GHSA-vg3q-rcxr-8qqv: Ubiquiti UCRM versions 2.3.0 to 2.7.7 allow an authenticated user to read arbitrary files in the local file system. Note that by default, the local file system is isolated in a docker container. Successful exploitation requires valid credentials to an account with "Edit" access to "System Customization".
CVSS v3.0: 4.7
GHSA-rwrf-2h26-c86w: Multiple cross-site scripting (XSS) vulnerabilities in SkaDate Dating allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) admin/auth.php and (2) file_uploader.php.
GHSA-4qr6-cjv5-78xj: The Demo Importer Plus plugin for WordPress is vulnerable to XML External Entity Injection (XXE) in all versions up to, and including, 2.0.9 via the SVG file upload functionality. This makes it possible for authenticated attackers, with Author-level access and above, to achieve code execution in vulnerable configurations. This only impacts sites on versions of PHP older than 8.0.
CVSS v3.1: 7.5
CVE-2021-20776: Improper authentication vulnerability in SCT-40CM01SR and AT-40CM01SR allows an attacker to bypass access restriction and execute an arbitrary command via telnet.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2002-0714: FTP proxy in Squid before 2.4.STABLE6 does not compare the IP addresses of control and data connections with the FTP server, which allows remote attackers to bypass firewall rules or spoof FTP server responses.
CVSS v2.0: 7.5
RHSA-2021:0183: Red Hat Security Advisory: linux-firmware security update
hardware: buffer overflow in bluetooth firmware
CVSS v3.1: 8.8
GHSA-7m6x-r79m-jgqx: A vulnerability in the web interface of Cisco Data Center Network Manager could allow an authenticated application administrator to execute commands on the underlying operating system with root-level privileges. The vulnerability is due to incomplete input validation of user input within an HTTP request. An attacker could exploit this vulnerability by authenticating to the application and then sending a crafted HTTP request to the targeted application. A successful exploit could allow the authenticated attacker to issue commands on the underlying operating system as the root user.
CVSS v3.0: 7.2
CVE-2018-1124: procps-ng before version 3.3.15 is vulnerable to multiple integer overflows leading to a heap corruption in file2strvec function. This allows a privilege escalation for a local attacker who can create entries in procfs by starting processes, which could result in crashes or arbitrary code execution in proc utilities run by other users.
CVSS v3.0: 7.3
GHSA-6m9h-2pr2-9j8f: 1Panel's password verification is suspected to have a timing attack vulnerability
Summary源码中密码校验处使用 != 符号，而不是`hmac.Equal`，这可能导致产生计时攻击漏洞，从而爆破密码。  
建议使用 `hmac.Equal` 比对密码。Translation:The source code uses the != symbol instead of hmac.Equal for password verification, which may lead to timing attack vulnerabilities that can lead to password cracking. It is recommended to use hmac. Equal to compare passwords.Detailshttps://github.com/1Panel-dev/1Panel/blob/dev/backend/app/service/auth.go#L81C5-L81C26Impact该产品的所有使用者。Translation:All users of this product.
CVSS v4.0: 2
CVSS v3.1: 5.9
CVE-2022-40605: MITRE CALDERA before 4.1.0 allows XSS in the Operations tab and/or Debrief plugin via a crafted operation name, a different vulnerability than CVE-2022-40606.
CVSS v3.1: 6.1
CVE-2016-10924: The ebook-download plugin before 1.2 for WordPress has directory traversal.
CVSS v3.0: 7.5
CVSS v2.0: 5
GHSA-583w-6h2g-rxp3: Buffer overflow in the _tor_resolve function in dsocks.c in dsocks before 1.4 allows remote attackers to execute arbitrary code via unspecified vectors, possibly involving a long node name.
GHSA-cqvp-qf4w-3mpx: Missing Authorization vulnerability in WPExperts Wholesale For WooCommerce.This issue affects Wholesale For WooCommerce: from n/a through 2.3.0.
CVSS v3.1: 7.5
CVE-2022-21779: In WLAN driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06704526; Issue ID: ALPS06704393.
CVSS v3.1: 6.7
CVSS v2.0: 4.6
CVE-2024-30036: Windows Deployment Services Information Disclosure Vulnerability
Windows Deployment Services Information Disclosure Vulnerability
CVSS v3.1: 6.5
CVE-2026-7069: D-Link DIR-825 miniupnpd upnpsoap.c AddPortMapping buffer overflow
A security flaw has been discovered in D-Link DIR-825 up to 3.00b32. This impacts the function AddPortMapping of the file upnpsoap.c of the component miniupnpd. Performing a manipulation of the argument NewPortMappingDescription results in buffer overflow. The attack needs to be approached within the local network. The exploit has been released to the public and may be used for attacks. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS v4.0: 8.6
CVSS v3.1: 8
CVSS v3.0: 8
CVSS v2.0: 7.7
CVE-2026-31701: ALSA: caiaq: take a reference on the USB device in create_card()
In the Linux kernel, the following vulnerability has been resolved:

ALSA: caiaq: take a reference on the USB device in create_card()

The caiaq driver stores a pointer to the parent USB device in
cdev->chip.dev but never takes a reference on it. The card's
private_free callback, snd_usb_caiaq_card_free(), can run
asynchronously via snd_card_free_when_closed() after the USB
device has already been disconnected and freed, so any access to
cdev->chip.dev in that path dereferences a freed usb_device.

On top of the refcounting issue, the current card_free implementation
calls usb_reset_device(cdev->chip.dev). A reset in a free callback
is inappropriate: the device is going away, the call takes the
device lock in a teardown context, and the reset races with the
disconnect path that the callback is already cleaning up after.

Take a reference on the USB device in create_card() with
usb_get_dev(), drop it with usb_put_dev() in the free callback,
and remove the usb_reset_device() call.
CVSS v3.1: 5.5
GHSA-x52q-7f5g-8m6f: Cross-site scripting (XSS) vulnerability in index.php in Yogurt 0.3 allows remote attackers to inject arbitrary web script or HTML via the msg parameter.
GHSA-6c6p-h79f-g6p4: Istio may allow identity impersonation if user has localhost access
ImpactUser can impersonate any workload identity within the service mesh if they have localhost access to the Istiod control plane.Patches1.15.3WorkaroundsNo. If using 1.15.2 please upgrade to 1.15.3 or later.ReferencesNone at this time.For more informationIf you have any questions or comments about this advisory, please email us at [istio-security-vulnerability-reports@googlegroups.com](mailto:istio-security-vulnerability-reports@googlegroups.com)
CVSS v3.1: 7.6
GHSA-4x8w-5x74-c8v5: actions.php in WebPortal CMS 0.6-beta generates predictable passwords containing only the time of day, which makes it easier for remote attackers to obtain access to any account via a lostpass action.
CVSS v3.1: 7.5
GHSA-89cg-954w-xf3h: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVSS v3.1: 7.8
GHSA-mxmf-28wh-c677: PHP remote file inclusion vulnerability in Login.php in Spaminator 1.7 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.
GHSA-3459-9h5c-8q2x: In queryChildDocuments of FileSystemProvider.java, there is a possible way to request access to directories that should be hidden due to improper input validation. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.
CVSS v3.1: 6.8
CVE-2022-49136: Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set
In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set

hci_cmd_sync_queue shall return an error if HCI_UNREGISTER flag has
been set as that means hci_unregister_dev has been called so it will
likely cause a uaf after the timeout as the hdev will be freed.
CVSS v3.1: 7.8
CVE-2024-10595: ESAFENET CDG PublicDocInfoAjax.java delDifferCourseList sql injection
A vulnerability was found in ESAFENET CDG 5. It has been declared as critical. Affected by this vulnerability is the function delFile/delDifferCourseList of the file /com/esafenet/servlet/ajax/PublicDocInfoAjax.java. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
GHSA-m9p3-73xg-xgfx: An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Ventura 13.6.4, macOS Sonoma 14.2. An app may be able to read arbitrary files.
CVSS v3.1: 6.3
CVE-2025-32899: In KDE Connect before 1.33.0 on Android, a packet can be crafted that causes two paired devices to unpair. Specifically, it is an invalid discovery packet sent over broadcast UDP.
CVSS v3.1: 4.3
GHSA-gjhg-g59h-c3r3: The (1) fixps (aka fixps.in) and (2) psmandup (aka psmandup.in) scripts in a2ps before 4.13 allow local users to overwrite arbitrary files via a symlink attack on temporary files.
GHSA-6p53-6566-mqvv: Cross Site Scripting (XSS) vulnerability in FusionPBX 4.5.7 allows remote malicious users to inject arbitrary web script or HTML via an unsanitized "f" variable in app\vars\vars_textarea.php.
CVE-2021-20431: IBM i2 Analyst's Notebook Premium 9.2.0, 9.2.1, and 9.2.2 does not invalidate session after logout which could allow an an attacker to obtain sensitive information from the system. IBM X-Force ID: 196342.
CVSS v3.0: 4.3
GHSA-g8wx-wwr2-j96m: The uploadFile function in upload/index.php in CosCMS before 1.822 allows remote administrators to execute arbitrary commands via shell metacharacters in the name of an uploaded file.
CVE-2018-11012: ruibaby Halo 0.0.2 has stored XSS via the loginName and loginPwd parameters in a failed login attempt to AdminController.java.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
GHSA-w9fq-993h-jqfp: PHPOK 4.9.032 has an arbitrary file upload vulnerability in the import_f function in framework/admin/modulec_control.php, as demonstrated by uploading a .php file within a .php.zip archive, a similar issue to CVE-2018-8944.
CVSS v3.0: 9.8
GHSA-52jq-ww84-hqvp: A vulnerability has been found in Sanluan PublicCMS up to 4.0.202506.d/5.202506.d/6.202506.d. Impacted is the function Paid of the file publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradePaymentService.java of the component Trade Payment Handler. The manipulation of the argument paymentId leads to improper authorization. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The identifier of the patch is 7329437e1288540336b1c66c114ed3363adcba02. It is recommended to apply a patch to fix this issue.
CVSS v4.0: 1.3
CVSS v3.1: 4.2
GHSA-jq8c-j47c-vvwm: Apache SOAP's RPCRouterServlet allows reading of arbitrary files over HTTP
An Improper Restriction of XML External Entity Reference vulnerability in RPCRouterServlet of Apache SOAP allows an attacker to read arbitrary files over HTTP. This issue affects Apache SOAP version 2.2 and later versions. It is unknown whether previous versions are also affected. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS v3.1: 7.5
CVE-2013-5836: Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.51, 8.52, and 8.53 allows remote attackers to affect confidentiality via unknown vectors related to Business Interlink.
CVSS v2.0: 5
CVE-2018-20955: Swann SWWHD-INTCAM-HD devices have the twipc root password, leading to FTP access as root. NOTE: all affected customers were migrated by 2020-08-31.
CVSS v3.0: 9.8
CVSS v2.0: 10
CVE-2025-62512: Piwigo Vulnerable to User Enumeration via Password Reset Endpoint
Piwigo is an open source photo gallery application for the web. In version 15.5.0 and likely earlier 15.x releases, the password reset functionality in Piwigo allows an unauthenticated attacker to determine whether a given username or email address exists in the system. The endpoint at password.php?action=lost returns distinct messages for valid vs. invalid accounts, enabling user enumeration. As of time of publication, no known patches are available.
CVSS v4.0: 5.5
RHSA-2007:0077: Red Hat Security Advisory: seamonkey security update
security flaw NSS: SSLv2 protocol buffer overflows NSS: SSLv2 protocol buffer overflows security flaw security flaw security flaw security flaw security flaw security flaw : seamonkey cookie setting / same-domain bypass vulnerability security flaw security flaw security flaw security flaw security flaw
GHSA-7459-h4w5-fw6x: Bond JetSelect (all versions) has an issue in the Java class (ENCtool.jar) and corresponding password generation algorithm (used to set initial passwords upon first installation). It XORs the plaintext into the 'encrypted' password that is then stored within the database. These steps are able to be trivially reversed, allowing for escalation of privilege within the JetSelect application through obtaining the passwords of JetSelect administrators. JetSelect administrators have the ability to modify and delete all networking configuration across a vessel, as well as altering network configuration of all managed network devices (switches, routers).
CVE-2026-36340: An issue in Krayin CRM v.2.1.5 and fixed in v.2.1.6 allows a remote attacker to execute arbitrary code via the compose email function
CVSS v3.1: 8.1
CVE-2024-52405: WordPress B-Banner Slider plugin <= 1.1 - Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in bikramjoshii B-Banner Slider b-banner-slider allows Upload a Web Shell to a Web Server.This issue affects B-Banner Slider: from n/a through <= 1.1.
CVSS v3.1: 9.9
CVE-2026-33620: PinchTab: API Bearer Token Exposed in URL Query Parameter via Server Logs and Intermediary Systems
PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab `v0.7.8` through `v0.8.3` accepted the API token from a `token` URL query parameter in addition to the `Authorization` header. When a valid API credential is sent in the URL, it can be exposed through request URIs recorded by intermediaries or client-side tooling, such as reverse proxy access logs, browser history, shell history, clipboard history, and tracing systems that capture full URLs. This issue is an unsafe credential transport pattern rather than a direct authentication bypass. It only affects deployments where a token is configured and a client actually uses the query-parameter form. PinchTab's security guidance already recommended `Authorization: Bearer <token>`, but `v0.8.3` still accepted `?token=` and included first-party flows that generated and consumed URLs containing the token. This was addressed in v0.8.4 by removing query-string token authentication and requiring safer header- or session-based authentication flows.
CVSS v3.1: 4.3
CVE-2024-39581: Dell PowerScale InsightIQ, versions 5.0 through 5.1, contains a File or Directories Accessible to External Parties vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability to read, modify, and delete arbitrary files.
CVSS v3.1: 7.3
GHSA-w265-826q-pq4h: Unauthenticated Broken Access Control in Masteriyo - LMS <= 2.1.5 versions.
CVSS v3.1: 7.5
RHSA-2020:2212: Red Hat Security Advisory: ruby security update
ruby: HTTP response splitting in WEBrick ruby: Buffer under-read in String#unpack
CVSS v3.0: 4.8
CVE-2024-41678: GLPI has multiple reflected XSS
GLPI is a free asset and IT management software package. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflected XSS vulnerability. Upgrade to 10.0.17.
CVSS v3.1: 6.5
GHSA-8r89-x93x-mjq2: Craft CMS Stored Cross-site Scripting in User Addresses Title
Craft CMS 4.2.0.1 suffers from Stored Cross Site Scripting (XSS) in `/admin/myaccount`.
CVSS v3.1: 5.4
GHSA-x2gv-fj8v-x2rx: Cross Site Scripting vulnerability in TeslaLogger Admin Panel before v.1.59.6 allows a remote attacker to execute arbitrary code via the New Journey field.
CVSS v3.1: 4.8
GHSA-gx46-jj8m-4x8v: Craig Morrison Mail Transport System Professional (aka MTS Pro) acts as an open relay when configured to relay all mail through an external SMTP server, which allows remote attackers to relay mail by connecting to the MTS Pro server, then sending a MAIL FROM that specifies a domain that is local to the server.
GHSA-f3qc-f3rx-3hrm: The D-Link DSL6740C modem has a Path Traversal Vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files. Additionally, since the device's default password is a combination of the MAC address, attackers can obtain the MAC address through this vulnerability and attempt to log in to the device using the default password.
CVSS v3.1: 7.5
RHSA-2018:1136: Red Hat Security Advisory: glusterfs security update
glusterfs: Privilege escalation via gluster_shared_storage when snapshot scheduling is enabled
CVSS v3.0: 8.3