ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-vm99-jjc2-8hw5: This vulnerability exists in TechExcel Back Office Software versions prior to 1.0.0 due to improper access controls on certain API endpoints. An authenticated remote attacker could exploit this vulnerability by manipulating a parameter through API request URL which could lead to unauthorized access to sensitive information belonging to other users.
CVSS v4.0: 8.7
CVSS v3.1: 6.5
GHSA-245j-8gjp-c4v5: A denial of service vulnerability exists in the ZfileOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to denial of service. An attacker can provide a malicious file to trigger this vulnerability.
CVSS v3.1: 5.9
CVE-2023-36707: Windows Deployment Services Denial of Service Vulnerability
Windows Deployment Services Denial of Service Vulnerability
CVSS v3.1: 6.5
GHSA-fpm6-68qr-7q7q: Missing Authorization vulnerability in Ali Khallad Contact Form By Mega Forms allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Contact Form By Mega Forms: from n/a through 1.6.1.
CVSS v3.1: 5.4
CVE-2015-3780: The Bluetooth subsystem in Apple OS X before 10.10.5 allows attackers to obtain sensitive kernel memory-layout information via a crafted app.
CVSS v2.0: 4.3
CVE-2026-56267: Flowise - PII Disclosure via Unauthenticated Forgot Password Endpoint
Flowise before 3.0.13 contains an information exposure vulnerability in the POST /api/v1/account/forgot-password endpoint that returns full user objects including PII to unauthenticated attackers. An attacker can enumerate valid email addresses and harvest sensitive user data including user IDs, names, account status, and timestamps by sending requests with known email addresses.
CVSS v4.0: 6.9
GHSA-8474-rc7c-wrhp: High severity vulnerability that affects safemode
Withdrawn, accidental duplicate publish.The safemode rubygem, as used in Foreman, versions 1.3.2 and earlier are vulnerable to bypassing safe mode limitations via special Ruby syntax. This can lead to deletion of objects for which the user does not have delete permissions or possibly to privilege escalation.
GHSA-vjcj-h7pj-5fx6: CSRF in admin/edit-category.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to edit a category, given the id, via a crafted request.
CVSS v3.1: 6.5
GHSA-jfm6-9g2x-f7pr: tiaudit in Tera Insights tiCrypt before 2025-07-17 allows unauthenticated REST API requests that reveal sensitive information about the underlying SQL queries and database structure.
CVSS v3.1: 5.3
CVE-2025-12708: Multiple Vulnerabilities in IBM Concert Software
IBM Concert 1.0.0 through 2.2.0 contains hard-coded credentials that could be obtained by a local user.
CVSS v3.1: 6.2
GHSA-63vm-454h-vhhq: pyasn1 has a DoS vulnerability in decoder
SummaryAfter reviewing pyasn1 v0.6.1 a Denial-of-Service issue has been found that leads to memory exhaustion from malformed RELATIVE-OID with excessive continuation octets.DetailsThe integer issue can be found in the decoder as `reloid += ((subId << 7) + nextSubId,)`: https://github.com/pyasn1/pyasn1/blob/main/pyasn1/codec/ber/decoder.py#L496PoCFor the DoS:Screenshots with the results:DoSLeak analysisA potential heap leak was investigated but came back clean:ScenarioAn attacker creates a malicious X.509 certificate.The application validates certificates.The application accepts the malicious certificate and tries decoding resulting in the issues mentioned above.ImpactThis issue can affect resource consumption and hang systems or stop services.
This may affect:LDAP serversTLS/SSL endpointsOCSP respondersetc.RecommendationAdd a limit to the allowed bytes in the decoder.
CVSS v3.1: 7.5
GHSA-qwr8-ggwx-2f43: SQL injection vulnerability in userlogin.jsp in Trivantis CourseMill Enterprise Learning Management System 4.1 SP4 allows remote attackers to execute arbitrary SQL commands via the user parameter (username field).  NOTE: some of these details are obtained from third party information.
GHSA-gh5x-cpm6-9f9c: Opera 6.0 and earlier allows remote attackers to access sensitive information such as cookies and links for other domains via Javascript that uses setTimeout to (1) access data after a new window to the domain has been opened or (2) access data via about:cache.
CVE-2014-5351: The kadm5_randkey_principal_3 function in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13 sends old keys in a response to a -randkey -keepold request, which allows remote authenticated users to forge tickets by leveraging administrative access.
CVSS v2.0: 2.1
GHSA-cp43-973g-2qqg: SQL injection in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to run arbitrary SQL statements.
CVSS v3.1: 6.5
CVE-2015-2096: Use-after-free vulnerability in the Connect function in the WESPMonitor.WESPMonitorCtrl.1 ActiveX control in WebGate eDVR Manager allows remote attackers to execute arbitrary code via an invalid IP address and a page reload.
CVSS v2.0: 6.8
CVE-2017-18349: parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is mishandled in AjaxApplication.java.
CVSS v3.0: 9.8
CVSS v2.0: 10
GHSA-hc4g-j5ph-8fw3: The profile-builder plugin before 2.2.5 for WordPress has XSS.
CVSS v3.0: 6.1
CVE-2018-11455: A vulnerability has been identified in Automation License Manager 5 (All versions < 5.3.4.4), Automation License Manager 6 (All versions < 6.0.1). A directory traversal vulnerability could allow a remote attacker to move arbitrary files, which can result in code execution, compromising confidentiality, integrity and availability of the system. Successful exploitation requires a network connection to the affected device. The attacker does not need privileges or special conditions of the system, but user interaction is required.
CVSS v3.0: 8.8
CVSS v2.0: 6.8
GHSA-9vqj-64pv-w55c: TensorFlow vulnerable to `CHECK` fail in `tf.linalg.matrix_rank`
ImpactWhen `tf.linalg.matrix_rank` receives an empty input `a`, the GPU kernel gives a `CHECK` fail that can be used to trigger a denial of service attack.PatchesWe have patched the issue in GitHub commit [c55b476aa0e0bd4ee99d0f3ad18d9d706cd1260a](https://github.com/tensorflow/tensorflow/commit/c55b476aa0e0bd4ee99d0f3ad18d9d706cd1260a).The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range.For more informationPlease consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.AttributionThis vulnerability has been reported by Kang Hong Jin.
CVSS v3.1: 5.9
GHSA-94x4-q73x-wr8m: Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.56, 8.57 and 8.58. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVE-2025-27498: AEADs/ascon-aead: Plaintext exposed in decrypt_in_place_detached even on tag verification failure
aes-gcm is a pure Rust implementation of the AES-GCM. In decrypt_in_place_detached, the decrypted ciphertext (which is the correct ciphertext) is exposed even if the tag is incorrect. This is because in decrypt_inplace in asconcore.rs, tag verification causes an error to be returned with the plaintext contents still in buffer. The vulnerability is fixed in 0.4.3.
CVSS v4.0: 5.6
CVE-2022-28111: MyBatis PageHelper v1.x.x-v3.7.0 v4.0.0-v5.0.0,v5.1.0-v5.3.0 was discovered to contain a time-blind SQL injection vulnerability via the orderBy parameter.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
GHSA-m46g-pgm5-7984: Uncontrolled search path element in the Intel(R) Unite(R) Client software for Mac before version 4.2.11 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS v3.1: 4.2
GHSA-4rjf-mxfm-98h5: SQL injection vulnerability in the policy admin tool in Apache Ranger
SQL injection vulnerability in the policy admin tool in Apache Ranger before 0.5.3 allows remote authenticated administrators to execute arbitrary SQL commands via the eventTime parameter to service/plugins/policies/eventTime.
CVSS v3.0: 7.2
CVE-2018-1303: A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while preparing data to be cached in shared memory. It could be used as a Denial of Service attack against users of mod_cache_socache. The vulnerability is considered as low risk since mod_cache_socache is not widely used, mod_cache_disk is not concerned by this vulnerability.
CVSS v3.0: 7.5
CVSS v2.0: 5
CVE-2023-53510: scsi: ufs: core: Fix handling of lrbp->cmd
In the Linux kernel, the following vulnerability has been resolved:

scsi: ufs: core: Fix handling of lrbp->cmd

ufshcd_queuecommand() may be called two times in a row for a SCSI command
before it is completed. Hence make the following changes:

 - In the functions that submit a command, do not check the old value of
   lrbp->cmd nor clear lrbp->cmd in error paths.

 - In ufshcd_release_scsi_cmd(), do not clear lrbp->cmd.

See also scsi_send_eh_cmnd().

This commit prevents that the following appears if a command times out:

WARNING: at drivers/ufs/core/ufshcd.c:2965 ufshcd_queuecommand+0x6f8/0x9a8
Call trace:
 ufshcd_queuecommand+0x6f8/0x9a8
 scsi_send_eh_cmnd+0x2c0/0x960
 scsi_eh_test_devices+0x100/0x314
 scsi_eh_ready_devs+0xd90/0x114c
 scsi_error_handler+0x2b4/0xb70
 kthread+0x16c/0x1e0
CVSS v3.1: 7.8
CVE-2022-40257: An HTML injection vulnerability exists in CERT/CC VINCE software prior to version 1.50.4
An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. An authenticated attacker can inject arbitrary HTML via a crafted email with HTML content in the Subject field.
CVSS v3.1: 5.4
GHSA-mxfq-3mpc-879j: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lexicata Lexicata allows Reflected XSS. This issue affects Lexicata: from n/a through 1.0.16.
CVSS v3.1: 7.1
GHSA-54h5-qvh3-364q: The Microsoft Server Block Message (SMB) on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, allows a denial of service vulnerability when an attacker sends specially crafted requests to the server, aka "Windows SMB Denial of Service Vulnerability".
CVSS v3.0: 7.5
GHSA-fq4j-p777-724r: A compromised Trusted OS (TOS) driver could issue a malformed call that could potentially allow  memory access outside the intended range resulting in loss of integrity.
CVSS v4.0: 1.8
GHSA-c33v-7hr2-gw69: A security vulnerability has been detected in D-Link DIR-816 1.10CNB05_R1B011D88210. Affected by this issue is the function sub_445E7C of the file /goform/singlePortForward. Such manipulation of the argument ip_address leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.
CVSS v4.0: 2.1
CVSS v3.1: 6.3
CVE-2023-50001: Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formUpgradeMeshOnline.
CVSS v3.1: 9.8
CVE-2023-37191: A stored cross-site scripting (XSS) vulnerability in Issabel issabel-pbx v.4.0.0-6 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Group and Description parameters.
CVSS v3.1: 4.8
GHSA-893q-vmc7-qcvh: The customizer in WordPress before 4.5.3 allows remote attackers to bypass intended redirection restrictions via unspecified vectors.
CVSS v3.0: 7.5
RHSA-2014:0037: Red Hat Security Advisory: jasperreports-server-pro security, bug fix, and enhancement update
axis: missing connection hostname check against X.509 certificate name hadoop: man-in-the-middle vulnerability
CVE-2023-46496: Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the DELETE function in api/files endpoint.
CVSS v3.1: 8.3
GHSA-g2xf-r6pf-g763: A local file deletion vulnerability in the Palo Alto Networks GlobalProtect app on Windows devices enables a user to delete system files from the endpoint with elevated privileges through a race condition.
CVSS v3.1: 6.3
CVE-2026-20998: Improper authentication in Smart Switch prior to version 3.7.69.15 allows remote attackers to bypass authentication.
CVSS v4.0: 7.1
GHSA-38wp-738r-69jh: A vulnerability was found in WeKan up to 8.20. This affects an unknown function of the file models/attachments.js of the component Attachment Storage. The manipulation results in improper access controls. The attack may be launched remotely. Upgrading to version 8.21 mitigates this issue. The patch is identified as c413a7e860bc4d93fe2adcf82516228570bf382d. Upgrading the affected component is advised.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVE-2019-7362: DLL preloading vulnerability in Autodesk Design Review versions 2011, 2012, 2013, and 2018. An attacker may trick a user into opening a malicious DWF file that may leverage a DLL preloading vulnerability, which may result in code execution.
CVSS v3.0: 7.8
CVSS v2.0: 6.8
CVE-2021-22229: An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.8. Under a special condition it was possible to access data of an internal repository through project fork done by a project member.
CVSS v3.1: 5.9
GHSA-9x4r-29pc-p3hh: Multiple cross-site scripting (XSS) vulnerabilities in Apache Roller before 5.0.1 allow remote authenticated users to inject arbitrary web script or HTML by leveraging the blogger role.
GHSA-x348-5vv2-6fqv: A vulnerability was found in Campcodes Online Laundry Management System 1.0. It has been classified as critical. This affects an unknown part of the file /manage_inv.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263895.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
GHSA-438c-f5p2-jch8: DomainMOD 4.11.01 has XSS via the assets/add/ssl-provider-account.php username field.
CVSS v3.0: 4.8
GHSA-9fx7-23qc-wwjv: An issue existed within the path validation logic for symlinks. This issue was addressed with improved path sanitization. This issue is fixed in iOS 15.3 and iPadOS 15.3, watchOS 8.4, tvOS 15.3, macOS Monterey 12.2, macOS Big Sur 11.6.3. An application may be able to access a user's files.
CVSS v3.1: 7.5
GHSA-4grf-x53v-r95x: IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 could allow a remote user to enumerate usernames due to differentiating error messages on existing usernames.  IBM X-Force ID:  199181.
CVSS v3.1: 5.3
GHSA-39pv-3mw4-29pm: ZyXEL Prestige 642R 2.50(FA.1) and Prestige 310 V3.25(M.01), allows remote attackers to cause a denial of service via an oversized, fragmented "jolt" style ICMP packet.
CVE-2021-44795: Modifying User Permissions via Unauthorized Access in Single Connect
Single Connect does not perform an authorization check when using the "sc-assigned-credential-ui" module. A remote attacker could exploit this vulnerability to modify users permissions. The exploitation of this vulnerability might allow a remote attacker to delete permissions from other users without authenticating.
CVSS v3.1: 5.3
GHSA-4766-988g-5hh5: IBM Security Identity Governance and Intelligence 5.2.6 could allow an unauthorized user to obtain sensitive information through user enumeration. IBM X-Force ID: 175422.
CVE-2013-1294: Race condition in the kernel in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, Windows Server 2012, and Windows RT allows local users to gain privileges via a crafted application that leverages improper handling of objects in memory, aka "Kernel Race Condition Vulnerability."
CVSS v3.1: 7
CVSS v2.0: 4.9
CVE-2009-0425: SQL injection vulnerability in index.php in Blue Eye CMS 1.0.0 and earlier allows remote attackers to execute arbitrary SQL commands via the clanek parameter.
CVSS v2.0: 7.5
GHSA-m98c-q724-x42q: An issue in /admin/index.php?n=system&c=filept&a=doGetFileList of Metinfo v7.0.0 allows attackers to perform a directory traversal and access sensitive information.
CVE-2026-41462: ProjeQtor < 12.4.4 Unauthenticated SQL Injection via Login
ProjeQtor versions 7.0 through 12.4.3 contain an unauthenticated SQL injection vulnerability in the login functionality where the login variable is directly concatenated into a SQL query without parameterization or sanitization. Attackers can inject arbitrary SQL expressions through the username field at the authentication endpoint to create privileged accounts, read sensitive data, and execute operating system commands if the database user has elevated permissions.
CVSS v4.0: 9.3
CVSS v3.1: 9.8
GHSA-fpr7-v6rw-g4pg: The framework APIs in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 do not ensure that package data originated from the Package Manager, which allows attackers to bypass an unspecified protection mechanism via a crafted application, aka internal bug 28795098.
CVSS v3.0: 7.8
GHSA-qw23-2m77-3c29: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem Theme Elements (for Elementor).This issue affects TheGem Theme Elements (for Elementor): from n/a through 5.10.5.1.
CVSS v3.1: 6.5
CVE-2024-1397: HT Mega <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via titleTag
The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's blocks in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping on the 'titleTag' user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
GHSA-gp25-qcrf-8649: account-recover.php in TorrentTrader Classic 1.09 chooses random passwords from an insufficiently large set, which makes it easier for remote attackers to obtain a password via a brute-force attack.
CVSS v3.1: 7.5
CVE-2025-24513: ingress-nginx controller - auth secret file path traversal vulnerability
A security issue was discovered in  ingress-nginx https://github.com/kubernetes/ingress-nginx  where attacker-provided data are included in a filename by the ingress-nginx Admission Controller feature, resulting in directory traversal within the container. This could result in denial of service, or when combined with other vulnerabilities, limited disclosure of Secret objects from the cluster.
CVSS v3.1: 4.8
CVE-2025-24904: libsignal-service-rs doesn't sanity check plaintext envelopes are not sanity-checked
libsignal-service-rs is a Rust version of the libsignal-service-java library which implements the core functionality to communicate with Signal servers. Prior to commit 82d70f6720e762898f34ae76b0894b0297d9b2f8, plaintext content envelopes could be injected by a server or a malicious client, and may have been able to bypass the end-to-end encryption and authentication. The vulnerability is fixed per 82d70f6720e762898f34ae76b0894b0297d9b2f8. The `Metadata` struct contains an additional `was_encrypted` field, which breaks the API, but should be easily resolvable. No known workarounds are available.
CVSS v3.1: 8.5
GHSA-85xx-xhjm-rhrw: Socket.IO-client Java before 2.0.1 vulnerable to NULL Pointer Dereference
The package io.socket:socket.io-client before 2.0.1 is vulnerable to NULL Pointer Dereference when parsing a packet with with invalid payload format.
CVSS v3.1: 7.5
GHSA-v5w5-498x-xfrc: The Shortcodes AnyWhere plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.0.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
CVSS v3.1: 7.3
GHSA-4gc7-qcvf-38wg: In OpenClaw, manually adding sort to tools.exec.safeBins could bypass allowlist approval via --compress-program
SummaryThis issue applies to a **non-default configuration** only.
If `sort` is manually added to `tools.exec.safeBins`, OpenClaw could treat `sort --compress-program=<prog>` as valid safe-bin usage.
In `security=allowlist` + `ask=on-miss`, this could satisfy allowlist checks and skip operator approval, while GNU `sort` may invoke an external program via `--compress-program`.Affected Packages / VersionsEcosystem: npmPackage: `openclaw`Affected: `<= 2026.2.21-2`Patched (planned next release): `>= 2026.2.22`Default InstallationsDefault installs are not impacted by this specific path because `sort` is not included in default `tools.exec.safeBins`.ImpactType: approval/allowlist bypass in optional safe-bin configurationScope: deployments that explicitly include `sort` in `tools.exec.safeBins` and use `allowlist + ask=on-miss`Consequence: an external program may run under the OpenClaw process context without expected approvalTechnical Details`sort` safe-bin profile allowed `--compress-program` as a value flag.Safe-bin satisfaction could therefore mark allowlist checks as satisfied.In `ask=on-miss`, satisfied allowlist checks skip approval prompts.FixBlock `--compress-program` in safe-bin sort policy.Add unit and e2e regression coverage for `sort --compress-program` denial in safe-bin mode.Fix Commit(s)`57fbbaebca4d34d17549accf6092ae26eb7b605c`OpenClaw thanks @tdjackey for reporting.
CVSS v4.0: 5.8
CVSS v3.1: 8.8
GHSA-m3gq-3gw9-x3fv: Libreswan 4.2 through 4.5 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted IKEv1 packet because pluto/ikev1.c wrongly expects that a state object exists. This is fixed in 4.6.
CVE-2021-30510: Use after free in Aura in Google Chrome prior to 90.0.4430.212 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS v3.1: 8.8
CVSS v2.0: 6.8
GHSA-pv7w-xvfq-976m: Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2013-5573: Cross-site scripting (XSS) vulnerability in the default markup formatter in Jenkins 1.523 allows remote attackers to inject arbitrary web script or HTML via the Description field in the user configuration.
CVSS v2.0: 4.3
CVE-2011-3722: Coppermine Photo Gallery (CPG) 1.5.12 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by include/inspekt.php and certain other files.
CVSS v2.0: 5
CVE-2023-26518: WordPress WP TFeed Plugin <= 1.6.9 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in AccessPress Themes WP TFeed plugin <= 1.6.9 versions.
CVSS v3.1: 5.4