# CVEs published 2023-05-23

99 CVEs were published on May 23, 2023: 17 critical, 28 high. Days are UTC.

- [CVE-2023-2494](https://cve.now/CVE-2023-2494.md): Go Pricing - WordPress Responsive Pricing Tables \<= 3.3.19 - Missing Authorization to Limited Privilege Granting (CVSS 4.6, Granth Go Pricing - WordPress Responsive Pricing Tables)
- [CVE-2023-2496](https://cve.now/CVE-2023-2496.md): Go Pricing - WordPress Responsive Pricing Tables \<= 3.3.19 - Improper Authorization to Arbitrary File Upload (CVSS 7.1, Granth Go Pricing - WordPress Responsive Pricing Tables)
- [CVE-2023-2498](https://cve.now/CVE-2023-2498.md): Go Pricing - WordPress Responsive Pricing Tables \<= 3.3.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, Granth Go Pricing - WordPress Responsive Pricing Tables)
- [CVE-2023-32697](https://cve.now/CVE-2023-32697.md): Sqlite-jdbc vulnerable to remote code execution when JDBC url is attacker controlled (CVSS 8.8, xerial sqlite-jdbc · org.xerial:sqlite-jdbc)
- [CVE-2023-28015](https://cve.now/CVE-2023-28015.md): HCL Domino AppDev Pack is susceptible to a User Account Enumeration vulnerability (CVSS 5.3, HCL Software Domino AppDev Pack)
- [CVE-2023-1508](https://cve.now/CVE-2023-1508.md): SQLi in AdamPOS's Mobilmen Terminal Software (CVSS 9.8, Adam Retail Automation Systems Mobilmen Terminal Software)
- [CVE-2023-2703](https://cve.now/CVE-2023-2703.md): Information Disclosure in Finex Media's Competition Management System (CVSS 7.5, Finex Media Competition Management System)
- [CVE-2023-2702](https://cve.now/CVE-2023-2702.md): IDOR in Finex Media's Competition Management System (CVSS 8.8, Finex Media Competition Management System)
- [CVE-2023-1837](https://cve.now/CVE-2023-1837.md): Missing Authentication for critical function vulnerability in HYPR Server allows Authentication Bypass when using Legacy APIs.This issue aff (CVSS 8.5, HYPR Server)
- [CVE-2023-1209](https://cve.now/CVE-2023-1209.md): Cross-Site Scripting (XSS) vulnerabilities exist in ServiceNow records allowing an authenticated attacker to inject arbitrary scripts. (CVSS 4.3, ServiceNow Records)
- [CVE-2023-25474](https://cve.now/CVE-2023-25474.md): WordPress About Me 3000 widget Plugin \<= 2.2.6 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Csaba Kissi About Me 3000 widget)
- [CVE-2022-46813](https://cve.now/CVE-2022-46813.md): WordPress Advanced Database Cleaner Plugin \<= 3.1.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Younes JFR. Advanced Database Cleaner)
- [CVE-2023-26011](https://cve.now/CVE-2023-26011.md): WordPress Read More Excerpt Link Plugin \<= 1.6 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Tim Eckel Read More Excerpt Link)
- [CVE-2023-26014](https://cve.now/CVE-2023-26014.md): WordPress Minify HTML Plugin \<= 2.1.7 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Tim Eckel Minify HTML)
- [CVE-2023-25056](https://cve.now/CVE-2023-25056.md): WordPress Feed Them Social Plugin \<= 3.0.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, SlickRemix Feed Them Social)
- [CVE-2023-30440](https://cve.now/CVE-2023-30440.md): IBM PowerVM Hypervisor denial of service (CVSS 6.7, IBM PowerVM Hypervisor)
- [CVE-2023-23713](https://cve.now/CVE-2023-23713.md): WordPress Theme Tweaker Plugin \<= 5.20 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Manoj Thulasidas Theme Tweaker)
- [CVE-2022-46853](https://cve.now/CVE-2022-46853.md): WordPress The Post Grid Plugin \<= 5.0.4 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, RadiusTheme The Post Grid)
- [CVE-2022-46851](https://cve.now/CVE-2022-46851.md): WordPress Starter Templates Plugin \<= 3.1.20 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Brainstorm Force Starter Templates)
- [CVE-2023-23705](https://cve.now/CVE-2023-23705.md): WordPress Books Gallery Plugin \<= 4.4.8 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, HM Plugin WordPress Books Gallery)
- [CVE-2023-23724](https://cve.now/CVE-2023-23724.md): WordPress WordPress Email Marketing Plugin – WP Email Capture Plugin \<= 3.9.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Winwar Media WP Email Capture)
- [CVE-2023-23706](https://cve.now/CVE-2023-23706.md): WordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) Plugin \<= 7.5.14 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, miniOrange WordPress Social Login and Register)
- [CVE-2023-25707](https://cve.now/CVE-2023-25707.md): WordPress VikBooking Hotel Booking Engine & PMS Plugin \<= 1.5.12 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 6.3, E4J s.r.l. VikBooking Hotel Booking Engine & PMS)
- [CVE-2023-25481](https://cve.now/CVE-2023-25481.md): WordPress Podlove Subscribe button Plugin \<= 1.3.7 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Podlove Subscribe button)
- [CVE-2023-25472](https://cve.now/CVE-2023-25472.md): WordPress Podlove Podcast Publisher Plugin \<= 3.8.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Podlove Podcast Publisher)
- [CVE-2023-23694](https://cve.now/CVE-2023-23694.md): Dell VxRail versions earlier than 7.0.450, contain(s) an OS command injection vulnerability in VxRail Manager. (CVSS 4.7, Dell VxRail HCI)
- [CVE-2023-23693](https://cve.now/CVE-2023-23693.md): Dell VxRail, versions prior to 7.0.450, contains an OS command injection Vulnerability in DCManager command-line utility. (CVSS 6.7, Dell VxRail HCI)
- [CVE-2023-30469](https://cve.now/CVE-2023-30469.md): Reflrected Cross Site Scripting Vulnerability in Hitachi Ops Center Analyzer (CVSS 7.6, Hitachi Ops Center Analyzer)
- [CVE-2020-20012](https://cve.now/CVE-2020-20012.md): WebPlus Pro v1.4.7.8.4-01 is vulnerable to Incorrect Access Control. (no CVSS)
- [CVE-2023-22654](https://cve.now/CVE-2023-22654.md): Client-side enforcement of server-side security issue exists in T&D Corporation and ESPEC MIC CORP. (no CVSS, T&D Corporation and ESPEC MIC CORP. data logger products)
- [CVE-2023-23298](https://cve.now/CVE-2023-23298.md): The \`Toybox.Graphics.BufferedBitmap.initialize\` API method in CIQ API version 2.3.0 through 4.1.7 does not validate its parameters, which ca (no CVSS)
- [CVE-2023-23299](https://cve.now/CVE-2023-23299.md): The permission system implemented and enforced by the GarminOS TVM component in CIQ API version 1.0.0 through 4.1.7 can be bypassed entirely (no CVSS)
- [CVE-2023-23300](https://cve.now/CVE-2023-23300.md): The \`Toybox.Cryptography.Cipher.initialize\` API method in CIQ API version 3.0.0 through 4.1.7 does not validate its parameters, which can re (no CVSS)
- [CVE-2023-23301](https://cve.now/CVE-2023-23301.md): The \`news\` MonkeyC operation code in CIQ API version 1.0.0 through 4.1.7 fails to check that string resources are not extending past the end (no CVSS)
- [CVE-2023-23302](https://cve.now/CVE-2023-23302.md): The \`Toybox.GenericChannel.setDeviceConfig\` API method in CIQ API version 1.2.0 through 4.1.7 does not validate its parameter, which can res (no CVSS)
- [CVE-2023-23303](https://cve.now/CVE-2023-23303.md): The \`Toybox.Ant.GenericChannel.enableEncryption\` API method in CIQ API version 3.2.0 through 4.1.7 does not validate its parameter, which ca (no CVSS)
- [CVE-2023-23304](https://cve.now/CVE-2023-23304.md): The GarminOS TVM component in CIQ API version 2.1.0 through 4.1.7 allows applications with a specially crafted head section to use the \`Toyb (CVSS 7.7)
- [CVE-2023-23305](https://cve.now/CVE-2023-23305.md): The GarminOS TVM component in CIQ API version 1.0.0 through 4.1.7 is vulnerable to various buffer overflows when loading binary resources. (CVSS 9.8)
- [CVE-2023-23306](https://cve.now/CVE-2023-23306.md): The \`Toybox.Ant.BurstPayload.add\` API method in CIQ API version 2.2.0 through 4.1.7 suffers from a type confusion vulnreability, which can r (CVSS 9.8)
- [CVE-2023-23545](https://cve.now/CVE-2023-23545.md): Missing authentication for critical function exists in T&D Corporation and ESPEC MIC CORP. (CVSS 5.3, T&D Corporation and ESPEC MIC CORP. data logger products)
- [CVE-2023-25440](https://cve.now/CVE-2023-25440.md): Stored Cross Site Scripting (XSS) vulnerability in the add contact function CiviCRM 5.59.alpha1, allows attackers to execute arbitrary code (CVSS 5.4)
- [CVE-2023-25946](https://cve.now/CVE-2023-25946.md): Authentication bypass vulnerability in Qrio Lock (Q-SL2) firmware version 2.0.9 and earlier allows a network-adjacent attacker to analyze th (CVSS 8.8, Qrio Lock)
- [CVE-2023-25953](https://cve.now/CVE-2023-25953.md): Code injection vulnerability in Drive Explorer for macOS versions 3.5.4 and earlier allows an attacker who can login to the client where the (CVSS 9.0, WORKS MOBILE Japan Drive Explorer for macOS)
- [CVE-2023-26595](https://cve.now/CVE-2023-26595.md): Denial-of-service (DoS) vulnerability in Message of Cybozu Garoon 4.10.0 to 5.9.2 allows a remote authenticated attacker to cause a denial o (CVSS 5.5, Cybozu Garoon)
- [CVE-2023-27068](https://cve.now/CVE-2023-27068.md): Deserialization of Untrusted Data in Sitecore Experience Platform through 10.2 allows remote attackers to run arbitrary code via ValidationR (CVSS 9.8)
- [CVE-2023-27304](https://cve.now/CVE-2023-27304.md): Operation restriction bypass vulnerability in Message and Bulletin of Cybozu Garoon 4.6.0 to 5.9.2 allows a remote authenticated attacker to (no CVSS, Cybozu Garoon)
- [CVE-2023-27384](https://cve.now/CVE-2023-27384.md): Operation restriction bypass vulnerability in MultiReport of Cybozu Garoon 5.15.0 allows a remote authenticated attacker to alter the data o (no CVSS, Cybozu Garoon)
- [CVE-2023-27387](https://cve.now/CVE-2023-27387.md): Cross-site request forgery (CSRF) in T&D Corporation and ESPEC MIC CORP. (no CVSS, T&D Corporation and ESPEC MIC CORP. data logger products)
- [CVE-2023-27388](https://cve.now/CVE-2023-27388.md): Improper authentication vulnerability in T&D Corporation and ESPEC MIC CORP. (CVSS 9.8, T&D Corporation and ESPEC MIC CORP. data logger products)
- [CVE-2023-27397](https://cve.now/CVE-2023-27397.md): Unrestricted upload of file with dangerous type exists in MicroEngine Mailform version 1.1.0 to 1.1.8. (CVSS 9.8, MicroEngine Mailform)
- [CVE-2023-27507](https://cve.now/CVE-2023-27507.md): MicroEngine Mailform version 1.1.0 to 1.1.8 contains a path traversal vulnerability. (CVSS 9.8, MicroEngine Mailform)
- [CVE-2023-27512](https://cve.now/CVE-2023-27512.md): Use of hard-coded credentials exists in SolarView Compact SV-CPT-MC310 versions prior to Ver.8.10, and SV-CPT-MC310F versions prior to Ver.8 (no CVSS, Contec Co. SolarView Compact)
- [CVE-2023-27514](https://cve.now/CVE-2023-27514.md): OS command injection vulnerability in the download page of SolarView Compact SV-CPT-MC310 versions prior to Ver.8.10 and SV-CPT-MC310F versi (CVSS 8.8, Contec Co. SolarView Compact)
- [CVE-2023-27518](https://cve.now/CVE-2023-27518.md): Buffer overflow vulnerability in the multiple setting pages of SolarView Compact SV-CPT-MC310 versions prior to Ver.8.10 and SV-CPT-MC310F v (CVSS 8.8, Contec Co. SolarView Compact)
- [CVE-2023-27521](https://cve.now/CVE-2023-27521.md): OS command injection vulnerability in the mail setting page of SolarView Compact SV-CPT-MC310 versions prior to Ver.8.10 and SV-CPT-MC310F v (CVSS 8.8, Contec Co. SolarView Compact)
- [CVE-2023-27920](https://cve.now/CVE-2023-27920.md): Improper access control vulnerability in the system date/time setting page of SolarView Compact SV-CPT-MC310 versions prior to Ver.8.10 and (CVSS 4.3, Contec Co. SolarView Compact)
- [CVE-2023-27921](https://cve.now/CVE-2023-27921.md): JINS MEME CORE Firmware version 2.2.0 and earlier uses a hard-coded cryptographic key, which may lead to data acquired by a sensor of the af (CVSS 6.5, JINS MEME CORE)
- [CVE-2023-27922](https://cve.now/CVE-2023-27922.md): Cross-site scripting vulnerability in Newsletter versions prior to 7.6.9 allows a remote unauthenticated attacker to inject an arbitrary scr (no CVSS, Stefano Lissa & The Newsletter Team Newsletter)
- [CVE-2023-27923](https://cve.now/CVE-2023-27923.md): Cross-site scripting vulnerability in Tag edit function of VK Blocks 1.53.0.1 and earlier and VK Blocks Pro 1.53.0.1 and earlier allows a re (CVSS 5.4, Vektor VK Blocks and VK Blocks Pro)
- [CVE-2023-27925](https://cve.now/CVE-2023-27925.md): Cross-site scripting vulnerability in Post function of VK Blocks 1.53.0.1 and earlier and VK Blocks Pro 1.53.0.1 and earlier allows a remote (CVSS 5.4, Vektor VK Blocks and VK Blocks Pro)
- [CVE-2023-27926](https://cve.now/CVE-2023-27926.md): Cross-site scripting vulnerability in Profile setting function of VK All in One Expansion Unit 9.88.1.0 and earlier allows a remote authenti (CVSS 5.4, Vektor VK All in One Expansion Unit)
- [CVE-2023-28367](https://cve.now/CVE-2023-28367.md): Cross-site scripting vulnerability in CTA post function of VK All in One Expansion Unit 9.88.1.0 and earlier allows a remote authenticated a (CVSS 5.4, Vektor VK All in One Expansion Unit)
- [CVE-2023-28390](https://cve.now/CVE-2023-28390.md): Privilege escalation vulnerability in SR-7100VN firmware Ver.1.38(N) and earlier and SR-7100VN #31 firmware Ver.1.21 and earlier allows a ne (CVSS 6.8, ICOM INCORPORATED SR-7100VN)
- [CVE-2023-28392](https://cve.now/CVE-2023-28392.md): Wi-Fi AP UNIT AC-PD-WAPU v1.05\_B04 and earlier, AC-PD-WAPUM v1.05\_B04 and earlier, AC-PD-WAPU-P v1.05\_B04P and earlier, AC-PD-WAPUM-P v1.05\_ (CVSS 7.2, Inaba Denki Sangyo Co. Wi-Fi AP UNIT)
- [CVE-2023-28394](https://cve.now/CVE-2023-28394.md): Beekeeper Studio versions prior to 3.9.9 allows a remote authenticated attacker to execute arbitrary JavaScript code with the privilege of t (CVSS 8.8, Beekeeper Studio)
- [CVE-2023-28408](https://cve.now/CVE-2023-28408.md): Directory traversal vulnerability in MW WP Form versions v4.4.2 and earlier allows a remote unauthenticated attacker to alter the website or (CVSS 9.8, Monkey Wrench MW WP Form)
- [CVE-2023-28409](https://cve.now/CVE-2023-28409.md): Unrestricted upload of file with dangerous type exists in MW WP Form versions v4.4.2 and earlier, which may allow a remote unauthenticated a (CVSS 9.8, Monkey Wrench MW WP Form)
- [CVE-2023-28413](https://cve.now/CVE-2023-28413.md): Directory traversal vulnerability in Snow Monkey Forms versions v5.0.6 and earlier allows a remote unauthenticated attacker to obtain sensit (CVSS 9.8, Monkey Wrench Snow Monkey Forms)
- [CVE-2023-2844](https://cve.now/CVE-2023-2844.md): Authorization Bypass Through User-Controlled Key in cloudexplorer-dev/cloudexplorer-lite (CVSS 7.2, cloudexplorer-dev/cloudexplorer-lite)
- [CVE-2023-2845](https://cve.now/CVE-2023-2845.md): Improper Access Control in cloudexplorer-dev/cloudexplorer-lite (CVSS 8.8, cloudexplorer-dev/cloudexplorer-lite)
- [CVE-2023-29919](https://cve.now/CVE-2023-29919.md): SolarView Compact \<= 6.0 is vulnerable to Insecure Permissions. (CVSS 9.8)
- [CVE-2023-30382](https://cve.now/CVE-2023-30382.md): A buffer overflow in the component hl.exe of Valve Half-Life up to 5433873 allows attackers to execute arbitrary code and escalate privilege (CVSS 7.3)
- [CVE-2023-31517](https://cve.now/CVE-2023-31517.md): A memory leak in the component CConsole::Chain of Teeworlds v0.7.5 allows attackers to cause a Denial of Service (DoS) via opening a crafted (no CVSS)
- [CVE-2023-31518](https://cve.now/CVE-2023-31518.md): A heap use-after-free in the component CDataFileReader::GetItem of teeworlds v0.7.5 allows attackers to cause a Denial of Service (DoS) via (CVSS 5.5)
- [CVE-2023-31664](https://cve.now/CVE-2023-31664.md): A reflected cross-site scripting (XSS) vulnerability in /authenticationendpoint/login.do of WSO2 API Manager before 4.2.0 allows attackers t (CVSS 6.1)
- [CVE-2023-31669](https://cve.now/CVE-2023-31669.md): WebAssembly wat2wasm v1.0.32 allows attackers to cause a libc++abi.dylib crash by putting '@' before a quote ("). (CVSS 5.5)
- [CVE-2023-31670](https://cve.now/CVE-2023-31670.md): An issue in wasm2c 1.0.32, wasm2wat 1.0.32, wasm-decompile 1.0.32, and wasm-validate 1.0.32 allows attackers to cause a Denial of Service (D (CVSS 7.5)
- [CVE-2023-31708](https://cve.now/CVE-2023-31708.md): A Cross-Site Request Forgery (CSRF) in EyouCMS v1.6.2 allows attackers to execute arbitrary commands via a supplying a crafted HTML file to (CVSS 4.3)
- [CVE-2023-31726](https://cve.now/CVE-2023-31726.md): AList 3.15.1 is vulnerable to Incorrect Access Control, which can be exploited by attackers to obtain sensitive information. (CVSS 7.5)
- [CVE-2023-31740](https://cve.now/CVE-2023-31740.md): There is a command injection vulnerability in the Linksys E2000 router with firmware version 1.0.06. (CVSS 7.2)
- [CVE-2023-31741](https://cve.now/CVE-2023-31741.md): There is a command injection vulnerability in the Linksys E2000 router with firmware version 1.0.06. (CVSS 7.2)
- [CVE-2023-31747](https://cve.now/CVE-2023-31747.md): Wondershare Filmora 12 (Build 12.2.1.2088) was discovered to contain an unquoted service path vulnerability via the component NativePushServ (CVSS 7.8)
- [CVE-2023-31752](https://cve.now/CVE-2023-31752.md): SourceCodester Employee and Visitor Gate Pass Logging System v1.0 is vulnerable to SQL Injection via /employee\_gatepass/classes/Login.php. (CVSS 9.8)
- [CVE-2023-31759](https://cve.now/CVE-2023-31759.md): Weak Security in the 433MHz keyfob of Kerui W18 Alarm System v1.0 allows attackers to gain full access via a code replay attack. (CVSS 7.5)
- [CVE-2023-31761](https://cve.now/CVE-2023-31761.md): Weak security in the transmitter of Blitzwolf BW-IS22 Smart Home Security Alarm v1.0 allows attackers to gain full access to the system via (CVSS 7.5)
- [CVE-2023-31762](https://cve.now/CVE-2023-31762.md): Weak security in the transmitter of Digoo DG-HAMB Smart Home Security System v1.0 allows attackers to gain full access to the system via a c (CVSS 7.5)
- [CVE-2023-31763](https://cve.now/CVE-2023-31763.md): Weak security in the transmitter of AGShome Smart Alarm v1.0 allows attackers to gain full access to the system via a code replay attack. (CVSS 7.5)
- [CVE-2023-31814](https://cve.now/CVE-2023-31814.md): D-Link DIR-300 firmware \<=REVA1.06 and \<=REVB2.06 is vulnerable to File inclusion via /model/\_\_lang\_msg.php. (CVSS 9.8)
- [CVE-2023-31826](https://cve.now/CVE-2023-31826.md): Skyscreamer Open Source Nevado JMS v1.3.2 does not perform security checks when receiving messages. (CVSS 7.8, org.skyscreamer:nevado-jms)
- [CVE-2023-31860](https://cve.now/CVE-2023-31860.md): Wuzhi CMS v3.1.2 has a storage type XSS vulnerability in the backend of the Five Finger CMS b2b system. (CVSS 5.4)
- [CVE-2023-31994](https://cve.now/CVE-2023-31994.md): Certain Hanwha products are vulnerable to Denial of Service (DoS). (CVSS 5.3)
- [CVE-2023-31995](https://cve.now/CVE-2023-31995.md): Hanwha IP Camera ANE-L7012R 1.41.01 is vulnerable to Cross Site Scripting (XSS). (CVSS 5.4)
- [CVE-2023-31996](https://cve.now/CVE-2023-31996.md): Hanwha IP Camera ANE-L7012R 1.41.01 is vulnerable to Command Injection due to improper sanitization of special characters for the NAS storag (CVSS 8.8)
- [CVE-2023-33338](https://cve.now/CVE-2023-33338.md): Old Age Home Management 1.0 is vulnerable to SQL Injection via the username parameter. (CVSS 9.8)
- [CVE-2023-33359](https://cve.now/CVE-2023-33359.md): Piwigo 13.6.0 is vulnerable to Cross Site Request Forgery (CSRF) in the "add tags" function. (CVSS 4.3)
- [CVE-2023-33361](https://cve.now/CVE-2023-33361.md): Piwigo 13.6.0 is vulnerable to SQL Injection via /admin/permalinks.php. (CVSS 9.8)
- [CVE-2023-33362](https://cve.now/CVE-2023-33362.md): Piwigo 13.6.0 is vulnerable to SQL Injection via in the "profile" function. (CVSS 9.8)
- [CVE-2023-33599](https://cve.now/CVE-2023-33599.md): EasyImages2.0 ≤ 2.8.1 is vulnerable to Cross Site Scripting (XSS) via viewlog.php. (CVSS 6.1)
- [CVE-2023-33617](https://cve.now/CVE-2023-33617.md): An OS Command Injection vulnerability in Parks Fiberlink 210 firmware version V2.1.14\_X000 was found via the /boaform/admin/formPing target\_ (CVSS 7.2)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-05-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.