ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-m36c-h8q9-4qm5: An issue was discovered in cloudwu/cstring through 2016-11-09. There is a memory leak vulnerability that could lead to a program crash.
CVSS v3.0: 7.5
CVE-2023-29739: An issue found in Alarm Clock for Heavy Sleepers v.5.3.2 for Android allows unauthorized apps to cause escalation of privilege attacks by manipulating the component.
CVSS v3.1: 9.8
RHSA-2020:1445: Red Hat Security Advisory: Red Hat AMQ Broker 7.4.3 release and security update
activemq: Corrupt MQTT frame can cause broker shutdown HTTP/2: large amount of data requests leads to denial of service HTTP/2: flood using PING frames results in unbounded memory growth HTTP/2: flood using HEADERS frames results in unbounded memory growth HTTP/2: flood using SETTINGS frames results in unbounded memory growth HTTP/2: 0-length headers lead to denial of service HTTP/2: request for large response leads to denial of service HTTP/2: flood using empty frames results in excessive resource consumption jetty: using specially formatted URL against DefaultServlet or ResourceHandler leads to XSS conditions jetty: error path information disclosure netty: HTTP request smuggling by mishandled whitespace before the colon in HTTP headers netty: HTTP request smuggling netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length header netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling
CVSS v3.1: 7.5
CVSS v3.0: 7.5
GHSA-5fjm-hw2m-m7w7: Cross-site scripting (XSS) vulnerability in index.php in Kayako eSupport 2.x allows remote attackers to inject arbitrary web script or HTML via the searchm parameter.
CVE-2019-10536: Potential double free scenario if driver receives another DIAG_EVENT_LOG_SUPPORTED event from firmware as the pointer is not set to NULL on first call in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, IPQ4019, IPQ8064, IPQ8074, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996AU, MSM8998, Nicobar, QCA6174A, QCA6574AU, QCA8081, QCA9377, QCA9379, QCN7605, QCS405, QCS605, SDA660, SDA845, SDM450, SDM630, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130
CVSS v3.1: 7.8
CVSS v2.0: 7.2
CVE-2018-6449: Host Header Injection vulnerability in the http management interface in Brocade Fabric OS versions before v9.0.0 could allow a remote attacker to exploit this vulnerability by injecting arbitrary HTTP headers
CVSS v3.1: 6.1
CVSS v2.0: 4.3
CVE-2019-0877: A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0846, CVE-2019-0847, CVE-2019-0851, CVE-2019-0879.
CVSS v3.0: 7.8
CVSS v2.0: 7.2
CVE-2023-6692: Ultimate Blocks – WordPress Blocks Plugin <= 3.0.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via metabox
The Ultimate Blocks – WordPress Blocks Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's tab anchor metabox in all versions up to, and including, 3.0.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
GHSA-rvx6-588f-ggm9: The gst_avi_demux_parse_ncdt function in gst/avi/gstavidemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (invalid memory read and crash) via a ncdt sub-tag that "goes behind" the surrounding tag.
CVSS v3.0: 7.5
CVE-2021-47385: hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field
In the Linux kernel, the following vulnerability has been resolved:

hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field

If driver read val value sufficient for
(val & 0x08) && (!(val & 0x80)) && ((val & 0x7) == ((val >> 4) & 0x7))
from device then Null pointer dereference occurs.
(It is possible if tmp = 0b0xyz1xyz, where same literals mean same numbers)
Also lm75[] does not serve a purpose anymore after switching to
devm_i2c_new_dummy_device() in w83791d_detect_subclients().

The patch fixes possible NULL pointer dereference by removing lm75[].

Found by Linux Driver Verification project (linuxtesting.org).

[groeck: Dropped unnecessary continuation lines, fixed multipline alignment]
CVSS v3.1: 5.5
CVE-2017-6649: A vulnerability in the CLI of Cisco NX-OS System Software 7.1 through 7.3 running on Cisco Nexus Series Switches could allow an authenticated, local attacker to perform a command injection attack. The vulnerability is due to insufficient input validation of command arguments. An attacker could exploit this vulnerability by injecting crafted command arguments into a vulnerable CLI command. An exploit could allow the attacker to read or write arbitrary files at the user's privilege level outside of the user's path. Cisco Bug IDs: CSCvb86787, CSCve60516, CSCve60555.
CVSS v3.0: 7.8
CVSS v2.0: 4.6
GHSA-mh9r-9pcx-rx55: Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery in Terms of Use Page
Cross-Site Request Forgery (CSRF) vulnerability in the terms of use page in the implementation for the portal services package before 5.25.0 from Liferay Portal (before 7.3.6), and Liferay DXP 7.3 before service pack 1, 7.2 before fix pack 11 allows remote attackers to accept the site's terms of use via social engineering and enticing the user to visit a malicious page.
CVSS v3.1: 8.8
GHSA-rggc-m335-3wvj: OpenClaw: Same-host trusted-proxy deployments could accept local forged identity headers
SummarySame-host trusted-proxy deployments could accept local forged identity headers. In affected versions, a local same-host caller that can reach the proxy-facing Gateway port could supply identity headers normally reserved for the trusted proxy.This advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.ImpactWhen the affected feature is enabled and reachable, this could receive operator identity associated with the forged headers. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.Patched VersionsThe first stable patched version is `2026.5.18`.Mitigationsbind trusted-proxy ingress behind the actual proxy and firewall direct same-host access. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.
CVSS v4.0: 7.7
CVE-2003-0455: The imagemagick libmagick library 5.5 and earlier creates temporary files insecurely, which allows local users to create or overwrite arbitrary files.
CVSS v2.0: 4.6
GHSA-g8w6-6g57-78mr: Cross-site scripting (XSS) vulnerability in Horde Chora module before 1.2.3 allows remote attackers to inject arbitrary web script or HTML via the parent's frame page title.
GHSA-jwv9-pqwx-gv9g: SQL Injection vulnerability in cnhcit.com Haichang OA v.1.0.0 allows a remote attacker to obtain sensitive information via the if parameter in hcit.project.rte.agents.UploadImages.class.
CVSS v3.1: 8.1
GHSA-4345-j8fj-2xr3: Cross-site scripting (XSS) vulnerability in search.php in PHP Labware LabWiki 1.0 allows remote attackers to inject arbitrary web script or HTML via the search input box (query parameter).
CVE-2010-2073: auth_db_config.py in Pyftpd 0.8.4 contains hard-coded usernames and passwords for the (1) test, (2) user, and (3) roxon accounts, which allows remote attackers to read arbitrary files from the FTP server.
CVSS v3.1: 7.5
CVSS v2.0: 5
GHSA-c6v5-gr6h-936j: The dump_block function in print_sections.c in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read) via crafted frame data.
CVSS v3.1: 7.5
GHSA-fp49-vmmw-4q8x: Vulnerability of bypassing the default desktop security controls.Successful exploitation of this vulnerability may cause unauthorized modifications to the desktop.
CVSS v3.1: 5.3
ICSA-22-242-02: Hitachi Energy Gateway Station (GWS) Product
Hitachi Energy is aware of publicly disclosed reports of multiple vulnerabilities in open-source software components (OpenSSL and Node.JS) used in the Gateway Station (GWS) product. Versions are available to remediate the identified vulnerabilities.CVE-2020-1968, CVE-2020-8172, CVE-2020-8174, CVE-2020-8201, CVE-2020-8252, CVE-2020-8265, and CVE-2020-8287 have been assigned to these vulnerabilities in open source components used by GWS. A CVSS v3 base score of 8.1 has been calculated for the worst case; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS v3.0: 8.1
cisco-sa-webex-open-redirect-PWvBQ2q: Cisco Webex Meetings Open Redirect Vulnerability
A vulnerability in the web-based management interface of Cisco Webex Meetings could allow an unauthenticated, remote attacker to redirect a user to an untrusted web page, bypassing the warning mechanism that should prompt the user before the redirection.

This vulnerability is due to improper input validation of the URL parameters in an HTTP request. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to redirect a user to a malicious website, bypassing the Webex URL check that should result in a warning before the redirection to the web page. Attackers may use this type of vulnerability, known as an open redirect attack, as part of a phishing attack to convince users to unknowingly visit malicious sites.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.


CVSS v3.1: 4.7
RHSA-2021:3001: Red Hat Security Advisory: Red Hat OpenShift Container Platform for Windows Containers 3.0.0 security and bug fix update
containernetworking-cni: Arbitrary path injection via type field in CNI configuration
CVSS v3.1: 7.2
CVE-2007-1117: Unspecified vulnerability in Publisher 2007 in Microsoft Office 2007 allows remote attackers to execute arbitrary code via unspecified vectors, related to a "file format vulnerability." NOTE: this information is based upon a vague pre-advisory with no actionable information.  However, the advisory is from a reliable source.
CVSS v2.0: 10
CVE-2026-9249: Unverified password change in Devolutions Server allows an attacker to change a user's password without providing the previous one via a crafted password change request.

This issue affects :

  *  Devolutions Server 2026.1.6.0 through 2026.1.16.0
  *  Devolutions Server 2025.3.20.0 and earlier
CVSS v3.1: 3.1
GHSA-h548-jhj8-q85h: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 1.0.0 before 1.3.6, from 2.0.0 before 2.0.7.Users are recommended to upgrade to version 1.3.6 and 2.0.7, which fixes the issue.
CVSS v3.1: 9.1
GHSA-5qxp-cr8v-39px: Spoofing issue in the Form Autofill component. This vulnerability was fixed in Firefox 151 and Firefox ESR 140.11.
CVSS v3.1: 6.5
GHSA-cjmf-rwpm-q3h6: error.php in Error Manager 2.1 for PHP-Nuke 6.0 allows remote attackers to obtain sensitive information via an invalid (1) language, (2) newlang, or (3) lang parameter, which leaks the pathname in a PHP error message.
CVE-2023-21385: In Whitechapel, there is a possible out of bounds read due to memory corruption. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1: 5.5
GHSA-m6cj-xcv2-9mc9: A vulnerability was found in Codezips Sales Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file deletecustcom.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 6.9
CVSS v3.1: 7.3
GHSA-7322-9mx6-5j2m: redcarpet Buffer Overflow vulnerability
Stack-based buffer overflow in the `header_anchor` function in the HTML renderer in Redcarpet before 3.3.2 allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.
CVE-2026-49014: In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. It reads a geometry attribute into a fixed-size stack buffer without validating the attribute length. The attacker embeds the exploit as an oversized geometry attribute in a crafted NetCDF file. This achieves arbitrary code execution on the server running GDAL. This is in frmts/netcdf/netcdfsg.cpp.
CVSS v3.1: 7.4
CVE-2026-20653: A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3, visionOS 26.3. An app may be able to access sensitive user data.
CVSS v3.1: 5.5
GHSA-r56h-6jmm-p8c7: The SV3C HD Camera (L-SERIES V2.3.4.2103-S50-NTD-B20170508B) does not perform proper validation on user-supplied input and is vulnerable to cross-site scripting attacks. If proper authorization was implemented, this vulnerability could be leveraged to perform actions on behalf of another user or the administrator.
CVSS v3.0: 5.4
RHSA-2023:7714: Red Hat Security Advisory: postgresql:12 security update
postgresql: Memory disclosure in aggregate function calls postgresql: Buffer overrun from integer overflow in array modification postgresql: Role pg_signal_backend can signal certain superuser processes. postgresql: extension script @substitutions@ within quoting allow SQL injection
CVSS v3.1: 7.5
GHSA-cp23-h948-mrq7: A lock screen issue allowed access to the share function on a locked device. This issue was addressed by restricting options offered on a locked device. This issue affected versions prior to iOS 12.1.
CVSS v3.0: 4.6
GHSA-8c47-56c4-8w57: A vulnerability has been found in Tenda F1202 1.2.0.20(408). Affected is the function fromPPTPUserSetting of the file /goform/PPTPUserSetting. Such manipulation of the argument delno leads to stack-based buffer overflow. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 7.4
CVSS v3.1: 8.8
CVE-2005-0814: Unknown vulnerability in lshd in Lysator LSH 1.x and 2.x before 2.0.1 allows remote attackers to cause a denial of service via unknown vectors.
CVSS v2.0: 5
CVE-2024-51907: WordPress WP Virtual Room Configurator plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codemenschen WP Virtual Room Configurator configure-conference-room allows Stored XSS.This issue affects WP Virtual Room Configurator: from n/a through <= 1.0.0.
CVSS v3.1: 6.5
CVE-2006-4988: Multiple cross-site scripting (XSS) vulnerabilities in Patrick Michaelis Wili-CMS allow remote attackers to inject arbitrary web script or HTML via (1) the query string to relocate.php, (2) the globals[pageid] parameter in example-view/inc/print_button.php, and other unspecified vectors.
CVSS v2.0: 4.3
CVE-2022-45429: Some Dahua software products have a vulnerability of server-side request forgery (SSRF). An Attacker can access internal resources by concatenating links (URL) that conform to specific rules.
CVSS v3.1: 7.5
CVE-2019-0650: A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka 'Microsoft Edge Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0634, CVE-2019-0645.
CVSS v3.0: 7.5
CVSS v2.0: 7.6
CVE-2024-22699: FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/admin/update_group_save.
CVSS v3.1: 8.8
CVE-2024-14009: Nagios XI < 2024R1.0.1 Privilege Escalation via System Profile
Nagios XI versions prior to 2024R1.0.1 contain a privilege escalation vulnerability in the System Profile component. The System Profile feature is an administrative diagnostic/configuration capability. Due to improper access controls and unsafe handling of exported/imported profile data and operations, an authenticated administrator could exploit this vulnerability to execute actions on the underlying XI host outside the application's security scope. Successful exploitation may allow an administrator to obtain root privileges on the XI server.
CVSS v4.0: 9.4
CVE-2024-49396: Insufficiently Protected Credentials in Elvaco M-Bus Metering Gateway CMe3100
The affected product is vulnerable due to insufficiently protected credentials, which may allow an attacker to impersonate Elvaco and send false information.
CVSS v4.0: 8.7
GHSA-m68c-mfwr-9xpc: An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0755, CVE-2019-0767, CVE-2019-0775, CVE-2019-0782.
CVSS v3.0: 5.5
GHSA-f2fr-mhhc-gjhx: Unknown vulnerability in the libcpr library for the Checkpoint/Restart (cpr) system on SGI IRIX 6.5.21f and earlier allows local users to truncate or overwrite certain files.
CVE-2025-68478: Langflow Vulnerable to External Control of File Name or Path
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0, if an arbitrary path is specified in the request body's `fs_path`, the server serializes the Flow object into JSON and creates/overwrites a file at that path. There is no path restriction, normalization, or allowed directory enforcement, so absolute paths (e.g., /etc/poc.txt) are interpreted as is. Version 1.7.0 fixes the issue.
CVSS v3.1: 7.1
CVE-2023-27767: An issue found in Wondershare Technology Co.,Ltd Dr.Fone v.12.4.9 allows a remote attacker to execute arbitrary commands via the drfone_setup_full3360.exe file.
CVSS v3.1: 7.8
GHSA-6q2p-jv44-v825: Direct static code injection vulnerability in admin/settings.php in MyBlog 0.9.8 and earlier allows remote authenticated admin users to inject arbitrary PHP code via the content parameter, which can be executed by accessing index.php.  NOTE: a separate vulnerability could be leveraged to make this issue exploitable by remote unauthenticated attackers.
GHSA-gqg8-5m8q-4j2q: KramerAV VIA GO² < 4.0.1.1326 is vulnerable to SQL Injection.
CVSS v3.1: 9.8
CVE-2011-2191: Cross-site request forgery (CSRF) vulnerability in Cherokee-admin in Cherokee before 1.2.99 allows remote attackers to hijack the authentication of administrators for requests that insert cross-site scripting (XSS) sequences, as demonstrated by a crafted nickname field to vserver/apply.
CVSS v2.0: 6.8
RHSA-2024:6847: Red Hat Security Advisory: pcp security update
pcp: pmcd heap corruption through metric pmstore operations pcp: pmpost symlink attack allows escalating pcp to root user
CVSS v3.1: 4.4
CVE-2026-5861: Use after free in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVSS v3.1: 8.8
GHSA-q82h-pmf9-x2xf: Rukovoditel before 3.5.3 allows XSS via user_photo to index.php?module=users/registration&action=save.
CVSS v3.1: 7.1
RHSA-2022:8976: Red Hat Security Advisory: 389-ds-base security update
389-ds-base: sending crafted message could result in DoS 389-ds-base: expired password was still allowed to access the database 389-ds-base: SIGSEGV in sync_repl
CVSS v3.1: 6.5
GHSA-6m9f-8vwq-97pm: Smarty Does Not Consider Umask Values When Setting Permissions
Smarty before 3.0.0 beta 4 does not consider the umask value when setting the permissions of files, which might allow attackers to bypass intended access restrictions via standard filesystem operations.
GHSA-54p2-rw47-2gqf: DBHcms v1.2.0 has a sensitive information leaks vulnerability as there is no security access control in /dbhcms/ext/news/ext.news.be.php, A remote unauthenticated attacker can exploit this vulnerability to get path information.
CVE-2018-18601: The TK_set_deviceModel_req_handle function in the cloud communication component in Guardzilla GZ621W devices with firmware 0.5.1.4 has a Buffer Overflow.
CVSS v3.1: 8.1
CVSS v3.0: 8.1
CVSS v2.0: 6.8
CVE-2022-20857: Cisco Nexus Dashboard Unauthorized Access Vulnerabilities
Multiple vulnerabilities in Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to execute arbitrary commands, read or upload container image files, or perform a cross-site request forgery attack. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS v3.1: 9.8
GHSA-jf99-qghw-p823: The REST interface in Cisco Spark 2015-06 allows remote attackers to cause a denial of service (resource outage) by accessing an administrative page, aka Bug ID CSCuv84125.
CVSS v3.0: 5.3
GHSA-4gq5-9fxc-cv49: Cross-site scripting (XSS) vulnerability in Twilight CMS 5.17 and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the gallery/ page.
CVE-2020-3148: Cisco Prime Network Registrar Cross-Site Request Forgery Vulnerability
A vulnerability in the web-based interface of Cisco Prime Network Registrar (CPNR) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections in the web-based interface. An attacker could exploit this vulnerability by persuading a targeted user, with an active administrative session on the affected device, to click a malicious link. A successful exploit could allow an attacker to change the device's configuration, which could include the ability to edit or create user accounts of any privilege level. Some changes to the device's configuration could negatively impact the availability of networking services for other devices on networks managed by CPNR.
CVSS v3.0: 7.1
CVE-2014-0062: Race condition in the (1) CREATE INDEX and (2) unspecified ALTER TABLE commands in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allows remote authenticated users to create an unauthorized index or read portions of unauthorized tables by creating or deleting a table with the same name during the timing window.
CVSS v2.0: 4.9
GHSA-vm7f-w6gx-mxh8: In the Linux kernel, the following vulnerability has been resolved:thermal: int340x: fix memory leak in int3400_notify()It is easy to hit the below memory leaks in my TigerLake platform:unreferenced object 0xffff927c8b91dbc0 (size 32):
  comm "kworker/0:2", pid 112, jiffies 4294893323 (age 83.604s)
  hex dump (first 32 bytes):
    4e 41 4d 45 3d 49 4e 54 33 34 30 30 20 54 68 65  NAME=INT3400 The
    72 6d 61 6c 00 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b a5  rmal.kkkkkkkkkk.
  backtrace:
    [<ffffffff9c502c3e>] __kmalloc_track_caller+0x2fe/0x4a0
    [<ffffffff9c7b7c15>] kvasprintf+0x65/0xd0
    [<ffffffff9c7b7d6e>] kasprintf+0x4e/0x70
    [<ffffffffc04cb662>] int3400_notify+0x82/0x120 [int3400_thermal]
    [<ffffffff9c8b7358>] acpi_ev_notify_dispatch+0x54/0x71
    [<ffffffff9c88f1a7>] acpi_os_execute_deferred+0x17/0x30
    [<ffffffff9c2c2c0a>] process_one_work+0x21a/0x3f0
    [<ffffffff9c2c2e2a>] worker_thread+0x4a/0x3b0
    [<ffffffff9c2cb4dd>] kthread+0xfd/0x130
    [<ffffffff9c201c1f>] ret_from_fork+0x1f/0x30Fix it by calling kfree() accordingly.
CVSS v3.1: 5.5