Circl
5 CVEs across 4 Circl products. Browse Circl vulnerabilities, severities, and proof-of-concept exploits.
Circl products with known CVEs
Circl CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2026-39416 | Medium | 6.1 | 2026-04-08 | AIL framework is an open-source platform to collect, crawl, process and analyse unstructured data. Prior to 6.8, a stored cross-site scripting (XSS) vulnerabil… |
CVE-2025-42620 | | | 2025-12-08 | In affected versions, vulnerability-lookup handled user-controlled
content in comments and bundles in an unsafe way, which could lead to
stored Cross-Site Sc… |
CVE-2025-42616 | | | 2025-12-08 | Some endpoints in vulnerability-lookup that modified
application state (e.g. changing database entries, user data,
configurations, or other privileged action… |
CVE-2025-42615 | | | 2025-12-08 | In affected versions, vulnerability-lookup did not track or limit failed
One-Time Password (OTP) attempts during Two-Factor Authentication (2FA)
verification… |
CVE-2025-60249 | Medium | 6.4 | 2025-09-25 | vulnerability-lookup 2.16.0 allows XSS in bundle.py, comment.py, and user.py, by a user on a vulnerability-lookup instance who can add bundles, comments, or si… |
CVE-2025-32413 | Medium | 6.4 | 2025-04-08 | Vulnerability-Lookup before 2.7.1 allows stored XSS via a user bio in website/web/views/user.py. |
CVE-2023-22898 | Medium | 6.5 | 2023-01-10 | workers/extractor.py in Pandora (aka pandora-analysis/pandora) 1.3.0 allows a denial of service when an attacker submits a deeply nested ZIP archive (aka ZIP b… |
CVE-2021-45470 | High | 7.5 | 2021-12-23 | lib/DatabaseLayer.py in cve-search before 4.1.0 allows regular expression injection, which can lead to ReDoS (regular expression denial of service) or other im… |
CVE-2020-8545 | High | 7.5 | 2020-02-03 | Global.py in AIL framework 2.8 allows path traversal. |