ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2007-3353: PHP remote file inclusion vulnerability in includes/template.php in MyEvent 1.6 allows remote attackers to execute arbitrary PHP code via a URL in the myevent_path parameter.  NOTE: a reliable third party disputes this issue, saying "the entire file is a class.
CVSS v2.0: 7.5
GHSA-9fx4-733j-xgmg: IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.20.0 could allow an authenticated user to modify dashboard parameters due to improper input validation.  IBM X-Force ID:  272089.
CVSS v3.1: 4.3
CVE-2018-19714: Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS v3.0: 6.5
CVSS v2.0: 4.3
CVE-2005-3235: Multiple interpretation error in unspecified versions of Proland Protector Plus 2000 Antivirus allows remote attackers to bypass virus detection via a malicious executable in a specially crafted RAR file with malformed central and local headers, which can still be opened by products such as Winrar and PowerZip, even though they are rejected as corrupted by Winzip and BitZipper.
CVSS v2.0: 5.1
CVE-2012-6638: The tcp_rcv_state_process function in net/ipv4/tcp_input.c in the Linux kernel before 3.2.24 allows remote attackers to cause a denial of service (kernel resource consumption) via a flood of SYN+FIN TCP packets, a different vulnerability than CVE-2012-2663.
CVSS v2.0: 7.8
GHSA-324h-2v7h-q3xx: RCE vulnerability in Jenkins Yaml Axis Plugin
Yaml Axis Plugin 0.2.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types. This results in a remote code execution (RCE) vulnerability exploitable by users able to configure a multi-configuration (Matrix) job, or control the contents of a previously configured job’s SCM repository.Yaml Axis Plugin 0.2.1 configures its YAML parser to only instantiate safe types.
CVSS v3.0: 8.8
CVE-2025-21765: ipv6: use RCU protection in ip6_default_advmss()
In the Linux kernel, the following vulnerability has been resolved:

ipv6: use RCU protection in ip6_default_advmss()

ip6_default_advmss() needs rcu protection to make
sure the net structure it reads does not disappear.
CVSS v3.1: 5.5
GHSA-w9x7-rg7h-623x: The resolver in Unbound before 1.4.11 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query, which allows remote attackers to trigger continued resolvability of revoked domain names via a "ghost domain names" attack.
CVE-2023-52223: WordPress MailerLite – WooCommerce integration Plugin <= 2.0.8 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in MailerLite MailerLite – WooCommerce integration.This issue affects MailerLite – WooCommerce integration: from n/a through 2.0.8.
CVSS v3.1: 5.4
GHSA-6jfx-5cxr-8qxw: TP Link Archer AX10 V1 Firmware Version 1.3.1 Build 20220401 Rel. 57450(5553) was discovered to allow authenticated attackers to execute arbitrary code via a crafted backup file.
CVSS v3.1: 8.8
GHSA-pxcf-6j8x-3v58: A vulnerability has been found in code-projects Student Web Portal 1.0. This impacts the function valreg_passwdation of the file signup.php. The manipulation of the argument reg_passwd leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 5.5
CVSS v3.1: 7.3
PYSEC-2018-78: uWSGI before 2.0.17 mishandles a DOCUMENT_ROOT check during use of the --php-docroot option, allowing directory traversal.
GHSA-r68x-7wff-q53w: PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the admin/sellerupd.php companyname parameter.
CVSS v3.0: 6.1
GHSA-8r29-p7h5-7m8x: Buffer overflow in rpc.yppasswdd (yppasswd server) in Solaris 2.6, 7 and 8 allows remote attackers to gain root access via a long username.
GHSA-mq9g-m88j-mmvx: A vulnerability was found in NousResearch hermes-agent 0.8.0. Affected by this issue is some unknown functionality of the file gateway/platforms/webhook.py of the component Webhooks Endpoint. The manipulation of the argument _INSECURE_NO_AUTH results in missing authentication. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitation is known to be difficult. The exploit has been made public and could be used. The project was informed of the problem early through a pull request but has not reacted yet.
CVSS v4.0: 2.9
CVSS v3.1: 5.6
GHSA-gh6q-hg4q-mm5j: The WP Mail Log WordPress plugin before 1.1.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Contributor.
CVSS v3.1: 8.8
CVE-2015-2564: SQL injection vulnerability in client-edit.php in ProjectSend (formerly cFTP) r561 allows remote authenticated users to execute arbitrary SQL commands via the id parameter to users-edit.php.
CVSS v2.0: 6.5
CVE-2024-57626: An issue in the mat_join2 component of MonetDB Server v11.49.1 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVSS v3.1: 7.5
GHSA-xhmw-wmwj-jvwr: Cross-Site Request Forgery (CSRF) vulnerability in ThemeinProgress WIP Custom Login plugin <= 1.2.9 versions.
CVSS v3.1: 4.3
CVE-2007-4566: Multiple buffer overflows in the login mechanism in sidvault in Alpha Centauri Software SIDVault LDAP Server before 2.0f allow remote attackers to execute arbitrary code via crafted LDAP packets, as demonstrated by a long dc entry in an LDAP bind.
CVSS v2.0: 10
CVE-2004-1560: Microsoft SQL Server 7.0 allows remote attackers to cause a denial of service (mssqlserver service halt) via a long request to TCP port 1433, possibly triggering a buffer overflow.
CVSS v2.0: 5
RHSA-2019:2782: Red Hat Security Advisory: qpid-proton security update
qpid-proton: TLS Man in the Middle Vulnerability
CVSS v3.0: 7.4
GHSA-9776-mx22-rqgw: The Ninja Chicken Ooga Booga (aka mominis.Generic_Android.Ninja_Chicken_Ooga_Booga) application 1.4.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2020-19643: Cross Site Scripting (XSS) vulnerability in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B via all fields in the FTP settings page to the "goform/formSetFtpCfg" settings page.
CVSS v3.1: 6.1
CVSS v2.0: 4.3
CVE-2012-5140: Use-after-free vulnerability in Google Chrome before 23.0.1271.97 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the URL loader.
CVSS v2.0: 10
GHSA-75q5-8jhm-6829: Authorization Bypass Through User-Controlled Key vulnerability in upKeeper Solutions product upKeeper Manager allows Utilizing REST's Trust in the System Resource to Obtain Sensitive Data.This issue affects upKeeper Manager: through 5.1.9.
CVSS v4.0: 7.6
CVSS v3.1: 6.5
GHSA-232v-j27c-5pp6: REC in MCPJam inspector due to HTTP Endpoint exposes
SummaryMCPJam inspector is the local-first development platform for MCP servers. The Latest version Versions 1.4.2 and earlier are vulnerable to remote code execution (RCE) vulnerability, which allows an attacker to send a crafted HTTP request that triggers the installation of an MCP server, leading to RCE.This vulnerability is similar to CVE-2025-49596, but more severe. While CVE-2025-49596 requires tricking a user into clicking a malicious link, this vulnerability is exploitable with no user interaction. Since MCPJam inspector by default listens on 0.0.0.0 instead of 127.0.0.1, an attacker can trigger the RCE remotely via a simple HTTP request.DetailsMCPJam inspector binds to `0.0.0.0` making its HTTP APIs remotely reachable.The `/api/mcp/connect` API, which is intended for connecting to MCP servers, becomes an open entry point for unauthorized requests. When an HTTP request reaches the `/connect` route, the system extracts the `command` and `args` fields without performing any security checks, leading to the execution of arbitrary command.PoC(1) Start up the MCPJam inspector as Github README
`npx @mcpjam/inspector@latest`(2) RCE by posting a HTTP request
A remote code execution (RCE) attack can be triggered by sending a simple HTTP request to the target host running MCPJam inspector (e.g., http://10.97.58.83:6274 in the test environment).
`curl http://10.97.58.83:6274/api/mcp/connect --header "Content-Type: application/json" --data "{\"serverConfig\":{\"command\":\"cmd.exe\",\"args\":[\"/c\", \"calc\"],\"env\":{}},\"serverId\":\"mytest\"}"`ImpactRemote Code Execution (RCE)
CVSS v3.1: 9.8
GHSA-g8wp-3x9j-448g: A vulnerable component of Orion Platform was vulnerable to SQL Injection, an authenticated attacker could leverage this for privilege escalation or remote code execution.
CVSS v3.1: 8.8
CVE-2003-1570: The server in IBM Tivoli Storage Manager (TSM) 5.1.x, 5.2.x before 5.2.1.2, and 6.x before 6.1 does not require credentials to observe the server console in some circumstances, which allows remote authenticated administrators to monitor server operations by establishing a console mode session, related to "session exposure."
CVSS v2.0: 3.5
GHSA-8wpx-wqvh-rxw6: An improper access control vulnerability exists in Bitdefender Box 1 (firmware version 1.3.52.928 and below) that allows an unauthenticated attacker to downgrade the device's firmware to an older, potentially vulnerable version of a Bitdefender-signed firmware. The attack requires Bitdefender BOX to be booted in Recovery Mode and that the attacker be present within the WiFi range of the BOX unit.
CVSS v4.0: 1.8
CVSS v3.1: 5.7
CVE-2025-69142: WordPress Abelle theme <= 1.22 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Abelle <= 1.22 versions.
CVSS v3.1: 8.1
RHSA-2025:10111: Red Hat Security Advisory: microcode_ctl security update
microcode_ctl: From CVEorg collector microcode_ctl: Exposure of sensitive information microcode_ctl: Exposure of sensitive information microcode_ctl: From CVEorg collector microcode_ctl: Exposure of sensitive information microcode_ctl: From CVEorg collector
CVSS v3.1: 5.6
PYSEC-2017-64: Cross-site scripting (XSS) vulnerability in the manage_findResult component in the search feature in Zope ZMI in Plone before 4.3.12 and 5.x before 5.0.7 allows remote attackers to inject arbitrary web script or HTML via vectors involving double quotes, as demonstrated by the obj_ids:tokens parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-7140.
CVE-2019-25031: Unbound before 1.9.5 allows configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack against a cleartext HTTP session. NOTE: The vendor does not consider this a vulnerability of the Unbound software. create_unbound_ad_servers.sh is a contributed script from the community that facilitates automatic configuration creation. It is not part of the Unbound installation
CVSS v3.1: 5.9
CVSS v2.0: 4.3
CVE-2026-58283: Microsoft Edge (Chromium-based) Spoofing Vulnerability
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
CVSS v3.1: 8.1
CVE-2023-0442: Loan Comparison < 1.5.2 - Reflected XSS via shortcode
The Loan Comparison WordPress plugin before 1.5.3 does not validate and escape some of its query parameters before outputting them back in a page/post via an embedded shortcode, which could allow an attacker to inject javascript into into the site via a crafted URL.
CVSS v3.1: 6.1
CVE-2025-9725: Cudy LT500E Web shadow hard-coded password
A vulnerability was identified in Cudy LT500E up to 2.3.12. Affected is an unknown function of the file /squashfs-root/etc/shadow of the component Web Interface. The manipulation leads to use of hard-coded password. The attack must be carried out locally. The attack's complexity is rated as high. The exploitability is told to be difficult. The exploit is publicly available and might be used. Upgrading to version 2.3.13 is able to address this issue. It is recommended to upgrade the affected component. The vendor explains: "[T]he firmware does store a default password of 'admin'. This password has been deprecated since LT500E firmware version 2.3.13 and is no longer used. The LT500E does not have an administrator password set by default; a new password (at least 8 characters ) must be manually created upon first login the web management page."
CVSS v4.0: 2
CVSS v3.1: 2.5
CVSS v3.0: 2.5
CVSS v2.0: 1
CVE-2023-36647: A hard-coded cryptographic private key used to sign JWT authentication tokens in ProLion CryptoSpike 3.0.15P2 allows remote attackers to impersonate arbitrary users and roles in web management and REST API endpoints via crafted JWT tokens.
CVSS v3.1: 7.5
GHSA-5mqf-9q34-g8c2: Directory Traversal vulnerability in Centro de Tecnologia da Informaco Renato Archer InVesalius3 v3.1.99995 allows attackers to write arbitrary files unto the system via a crafted .inv3 file.
CVSS v3.1: 7.5
GHSA-qvx7-87cx-j4q2: DirectX Graphics Kernel Elevation of Privilege Vulnerability.
CVSS v3.1: 7.8
GHSA-7w68-wxf2-gv4h: D-Link D-View uploadFile Directory Traversal Arbitrary File Creation Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of D-Link D-View. Authentication is required to exploit this vulnerability.The specific flaw exists within the uploadFile function. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to create files in the context of SYSTEM. Was ZDI-CAN-19527.
CVSS v3.0: 8.1
CVE-2006-0109: Cross-site scripting vulnerability in category.php in Modular Merchant Shopping Cart allows remote attackers to inject arbitrary web script or HTML via the cat parameter.
CVSS v2.0: 5
GHSA-gmvf-rv8w-2hrh: HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service.
CVSS v3.1: 7.5
GHSA-cv9w-4mcm-4cc2: NEC Platforms DT900 and DT900S Series 5.0.0.0 – v5.3.4.4, v5.4.0.0 – v5.6.0.20 allows an attacker to access a non-documented the system settings to change settings via local network with unauthenticated user.
CVSS v3.1: 9.1
GHSA-3fhh-fr6w-p45p: Red-M 1050 (Bluetooth Access Point) PPP server allows bonded users to cause a denial of service and possibly execute arbitrary code via a long user name.
CVE-2026-45622: Vvveb: Unauthenticated reflected XSS in public product return form via customer_order_id
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, there is an unauthenticated reflected cross-site scripting (XSS) issue in the public product return form in Vvveb CMS. The customer_order_id POST parameter is inserted into the Order %s not found! error message when the order lookup fails, and that message is rendered in the frontend template without HTML escaping. As a result, attacker-controlled HTML/JavaScript executes in the submitting user's browser. This vulnerability is fixed in 1.0.8.3.
CVSS v4.0: 5.3
GHSA-pf3v-wfmw-4fxc: my.activation.php3 in F5 FirePass 4100 SSL VPN allows remote attackers to execute arbitrary shell commands via shell metacharacters in the username parameter.
GHSA-63j8-q3xx-g3c2: Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVSS v3.1: 9.6
GHSA-h2wx-c553-qg53: Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-7086, CVE-2015-7087, CVE-2015-7088, CVE-2015-7089, CVE-2015-7090, CVE-2015-7091, CVE-2015-7092, and CVE-2015-7117.
CVSS v3.0: 6.6
RHSA-2007:0937: Red Hat Security Advisory: kernel security update
x86_64 syscall vulnerability
GHSA-9gwx-9cwp-5c2m: Billion laughs attack (XML bomb)
ImpactOpencast is vulnerable to the [Billion laughs attack](https://en.wikipedia.org/wiki/Billion_laughs_attack)  which allows an attacker to easily execute a (seemingly permanent) denial of service attack, essentially taking down Opencast using a single HTTP request.Consider an XML file (`createMediaPackage.xml`) like this:Throwing this at Opencast will cause Opencast to parse the XML and expand the Lorem Ipsum about 100 000 times, instantly consuming a huge amount of memory:Additional notes:You can likely use other endpoints accepting XML (this was just the first one I tried) and depending on how much memory you want to consume, you might want to enlarge the lorem ipsum text.Opencast's XML parser does limit the expansion to 100 000 times, already limiting the attack. Nevertheless, this can already harm the system.To exploit this, users need to have ingest privileges, limiting the group of potential attackersPatchesThe problem has been fixed in Opencast 9.6. Older versions of Opencast are not patched sue to the extent of this patch.WorkaroundsThere is no known workaround for this issue.References[Billion laughs attack explained](https://en.wikipedia.org/wiki/Billion_laughs_attack)For technical details, take a look at the patch fixing the issue: https://github.com/opencast/opencast/commit/_________For more informationIf you have any questions or comments about this advisory:Open an issue in [our issue tracker](https://github.com/opencast/opencast/issues)Email us at [security@opencast.org](mailto:security@opencast.org)
CVSS v3.1: 8.1
CVE-2016-15053: Nagios XI < 5.2.4 XSS via “My Reports” Listing
Nagios XI versions prior to 5.2.4 are vulnerable to cross-site scripting (XSS) via the “My Reports” listing of the web interface. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS v4.0: 5.1
CVE-2023-0580: Information Disclosure vulnerability in My Control System (on-premise)
Insecure Storage of Sensitive Information vulnerability in ABB My Control System (on-premise) allows an attacker who successfully exploited this vulnerability to gain access to the secure application data or take control of the application.
Of the services that make up the My Control System (on-premise) application, the following ones are affected by this vulnerability:
User Interface
System Monitoring1
Asset Inventory




This issue affects My Control System (on-premise): from 5.0;0 through 5.13.


CVSS v3.1: 5.4
GHSA-p4rv-88gx-v3fc: During an internal security assessment, a potential vulnerability was discovered in Lenovo Software Fix that could allow a local authenticated user to perform arbitrary code execution with elevated privileges.
CVSS v4.0: 8.5
CVSS v3.1: 7.8
CVE-2024-38700: WordPress WPCS – WordPress Currency Switcher Professional plugin <= 1.2.0.3 - Arbitrary Shortcode Execution vulnerability
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in realmag777 WPCS allows Code Injection.This issue affects WPCS: from n/a through 1.2.0.3.
CVSS v3.1: 6.5
CVE-2023-6042: Getwid < 2.0.3 - Unauthenticated Arbitrary Email Sending to Admin
Any unauthenticated user may send e-mail from the site with any title or content to the admin
CVSS v3.1: 7.5
GHSA-5ww6-px42-wc85: SM2 Decryption Buffer Overflow
In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" parameter is populated with the buffer size required to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the "out" parameter. A bug in the implementation of the SM2 decryption code means that the calculation of the buffer size required to hold the plaintext returned by the first call to EVP_PKEY_decrypt() can be smaller than the actual size required by the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a second time with a buffer that is too small. A malicious attacker who is able present SM2 content for decryption to an application could cause attacker chosen data to overflow the buffer by up to a maximum of 62 bytes altering the contents of other data held after the buffer, possibly changing application behaviour or causing the application to crash. The location of the buffer is application dependent but is typically heap allocated. Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k).
CVSS v3.1: 9.8
RHSA-2025:22571: Red Hat Security Advisory: kernel security update
kernel: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() kernel: e1000e: fix heap overflow in e1000_set_eeprom kernel: wifi: mt76: fix linked list corruption kernel: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect() kernel: i40e: fix idx validation in config queues msg kernel: i40e: add validation for ring_len param
CVSS v3.1: 7.5
GHSA-v395-x24j-4r3g: SQL injection in pgAdmin 4's named restore point endpoint (POST /browser/server/restore_point/{gid}/{sid}). The user-supplied 'value' field was interpolated directly into the SQL string with str.format() instead of being passed as a bound parameter, allowing an authenticated pgAdmin user with a connected PostgreSQL session to inject additional statements through that endpoint.The injected SQL executes under the database role the user is already authenticated as. The defect does not cross a privilege boundary -- the user already has direct SQL access to that role through the Query Tool -- so the attacker gains no capability beyond what their database role already grants them. The marginal impact accounts for the fact that the injection path is not the documented SQL-execution interface, so a deployment that gates the Query Tool at the application layer could see SQL executed through a path it did not anticipate.Fix passes the restore point name as a bound parameter and schema-qualifies the function call as pg_catalog.pg_create_restore_point so a non-default search_path on the connection cannot redirect the call to a shadow definition. A regression test asserts the value arrives as a bound parameter and not spliced into the SQL string.This issue affects pgAdmin 4: from 1.0 before 9.16.
CVSS v4.0: 5.3
CVSS v3.1: 4.3
CVE-2017-17480: In OpenJPEG 2.3.0, a stack-based buffer overflow was discovered in the pgxtovolume function in jp3d/convert.c. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly remote code execution.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
GHSA-c33w-24p9-8m24: configobj ReDoS exploitable by developer using values in a server-side configuration file
All versions of the package configobj are vulnerable to Regular Expression Denial of Service (ReDoS) via the validate function, using (.+?)\((.*)\). **Note:** This is only exploitable in the case of a developer, putting the offending value in a server side configuration file.
CVSS v3.1: 3.7
GHSA-pm9x-4392-2c2p: RubyGems may allow a maliciously crafted gem to overwrite files
RubyGems versions 2.6.12 and earlier fail to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem.
CVSS v3.0: 7.5