rainbutterfly/cve_corpus huggingface dataset:
CVE-2026-0110 
In MM_DATA_IND of cn_NrSmMsgHdlrFromMM.cpp, there is a possible EoP due to memory corruption. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2026-03-10T20:46:39.581Z
CVE-2026-0111 
In ns_GetUserData of ns_SmscbUtilities.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2026-03-10T20:46:40.542Z
CVE-2026-0112 
In vpu_open_inst of vpu_ioctl.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2026-03-10T20:46:41.504Z
CVE-2026-0113 
In ns_GetUserData of ns_SmscbUtilities.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2026-03-10T20:46:42.467Z
CVE-2026-0114 
In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Remote code execution
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2026-03-10T20:46:43.436Z
CVE-2026-0115 
In Trusted Execution Environment, there is a possible key leak due to side channel information disclosure. This could lead to physical information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.
Problem types: description: Information disclosure
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2026-03-10T20:46:44.416Z
CVE-2026-0116 
In __mfc_handle_released_buf of mfc_core_isr.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Remote code execution
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2026-03-10T20:46:45.385Z
CVE-2026-0117 
In mfc_dec_dqbuf of mfc_dec_v4l2.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2026-03-10T20:46:46.359Z
CVE-2026-0118 
In oobconfig, there is a possible bypass of carrier restrictions due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2026-03-10T20:46:47.403Z
CVE-2026-0119 
In usim_SendMCCMNCIndMsg of usim_Registration.c, there is a possible out of bounds write due to memory corruption. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2026-03-10T20:46:48.387Z
CVE-2026-0120 
In modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Remote code execution
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2026-03-10T20:46:49.369Z
CVE-2026-0121 
In VPU, there is a possible use-after-free read due to a race condition. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Information disclosure
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2026-03-10T20:46:50.360Z
CVE-2026-0122 
In multiple places, there is a possible out of bounds write due to memory corruption. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Remote code execution
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2026-03-10T20:46:51.350Z
CVE-2026-0123 
In EfwApTransport::ProcessRxRing of efw_ap_transport.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2026-03-10T20:46:52.341Z
CVE-2026-0124 
There is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected products: vendor: Google
product: Android
default_status: unaffected
Credits: lang: en
value: Christopher Wade
Published: 2026-03-10T20:46:53.444Z
CVE-2026-0203 Junos OS: Receipt of a specifically malformed ICMP packet causes an FPC restart
An Improper Handling of Exceptional Conditions vulnerability in packet processing of Juniper Networks Junos OS allows an unauthenticated, network-adjacent attacker sending a specifically malformed ICMP packet to cause an FPC to crash and restart, resulting in a Denial of Service (DoS).



When an ICMP packet is received with a specifically malformed IP header value, the FPC receiving the packet crashes and restarts. Due to the specific type of malformed packet, adjacent upstream routers would not forward the packet, limiting the attack surface to adjacent networks.

This issue only affects ICMPv4. ICMPv6 is not vulnerable to this issue.

This issue does not affect AFT-based line cards such as the MPC10, MPC11, LC4800, LC9600, and MX304.

This issue affects Junos OS: 



  *  all versions before 21.2R3-S9, 
  *  from 21.4 before 21.4R3-S10, 
  *  from 22.2 before 22.2R3-S7, 
  *  from 22.3 before 22.3R3-S4, 
  *  from 22.4 before 22.4R3-S5, 
  *  from 23.2 before 23.2R2-S3, 
  *  from 23.4 before 23.4R2-S3, 
  *  from 24.2 before 24.2R1-S2, 24.2R2.
Problem types: cwe_id: CWE-755
description: CWE-755 Improper Handling of Exceptional Conditions
Affected products: vendor: Juniper Networks
product: Junos OS
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2026-01-15T20:17:24.552Z
CVE-2026-0204 
A vulnerability in the access control mechanism of SonicOS may allow certain management interface functions to be accessible under specific conditions.
Problem types: cwe_id: CWE-1390
description: CWE-1390 Weak Authentication
cwe_id: CWE-306
description: CWE-306 Missing authentication for critical function
Affected products: vendor: SonicWall
product: SonicOS
default_status: unknown
Published: 2026-04-29T16:15:32.039Z
CVE-2026-0205 
A post-authentication Path Traversal vulnerability in SonicOS allows an attacker to interact with usually restricted services.
Problem types: cwe_id: CWE-35
description: CWE-35 Path traversal: '.../...//'
Affected products: vendor: SonicWall
product: SonicOS
default_status: unknown
Published: 2026-04-29T16:18:45.856Z
CVE-2026-0206 
A post-authentication Stack-based Buffer Overflow vulnerabilities in SonicOS allows a remote attacker to crash a firewall.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based buffer overflow
Affected products: vendor: SonicWall
product: SonicOS
default_status: unknown
Published: 2026-04-29T16:21:40.001Z
CVE-2026-0207 Sensitive Information Logging Vulnerability in FlashBlade
A vulnerability exists in FlashBlade whereby sensitive information may be logged under specific conditions.
Problem types: cwe_id: CWE-532
description: CWE-532 Insertion of sensitive information into log file
Affected products: vendor: PureStorage
product: FlashBlade
default_status: unaffected
Published: 2026-04-14T17:53:42.785Z
CVE-2026-0209 
Under certain administrative conditions, FlashArray Purity may apply snapshot retention policies earlier or later than configured.
Problem types: cwe_id: CWE-783
description: CWE-783 Operator precedence logic error
Affected products: vendor: PureStorage
product: FlashArray
default_status: unaffected
Published: 2026-04-14T17:52:54.759Z
CVE-2026-0229 PAN-OS: Denial of Service in Advanced DNS Security Feature
A denial-of-service (DoS) vulnerability in the Advanced DNS Security (ADNS) feature of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker to initiate system reboots using a maliciously crafted packet. Repeated attempts to initiate a reboot causes the firewall to enter maintenance mode.

Cloud NGFW and Prisma Access® are not impacted by this vulnerability.
Problem types: cwe_id: CWE-754
description: CWE-754 Improper Check for Unusual or Exceptional Conditions
Affected products: vendor: Palo Alto Networks
product: Cloud NGFW
default_status: unaffected
vendor: Palo Alto Networks
product: PAN-OS
cpes: cpe:2.3:o:palo_alto_networks:pan-os:12.1.3:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:12.1.2:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.2.9:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.2.8:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.2.6:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.2.5:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.2.3:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.2.2:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.2.1:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.2.0:*:*:*:*:*:*:*
default_status: unaffected
vendor: Palo Alto Networks
product: Prisma Access
default_status: unaffected
Credits: lang: en
value: an internal reporter, jliu@TikkalaSecurity,
Published: 2026-02-11T17:56:09.270Z
CVE-2026-0230 Cortex XDR Agent: Local Administrator can disable the agent on macOS
A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on macOS allows a local administrator to disable the agent. This issue could be leveraged by malware to perform malicious activity without detection.
Problem types: cwe_id: CWE-754
description: CWE-754: Improper Check for Unusual or Exceptional Conditions
Affected products: vendor: Palo Alto Networks
product: Cortex XDR Agent
cpes: cpe:2.3:a:palo_alto_networks:cortex_xdr_agent:8.7-CE:*:*:*:*:macOS:*:*
cpe:2.3:a:palo_alto_networks:cortex_xdr_agent:8.3-CE:*:*:*:*:macOS:*:*
cpe:2.3:a:palo_alto_networks:cortex_xdr_agent:8.3.101-CE:*:*:*:*:macOS:*:*
default_status: unaffected
Credits: lang: en
value: Michael Roitzsch, Barkhausen Institut gGmbH Carsten Weinhold, Barkhausen Institut gGmbH
Published: 2026-03-11T18:02:13.814Z
CVE-2026-0231 Cortex XDR Broker VM: Sensitive Information Disclosure Vulnerability
An information disclosure vulnerability in Palo Alto Networks Cortex XDR® Broker VM allows an authenticated user to obtain and modify sensitive information by triggering live terminal session via Cortex UI and modifying any configuration setting. 
The attacker must have network access to the Broker VM to exploit this issue.
Problem types: cwe_id: CWE-497
description: CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere
Affected products: vendor: Palo Alto Networks
product: Cortex XDR Broker VM
default_status: unaffected
Credits: lang: en
value: an internal reporter, Nicola Kalak,
Published: 2026-03-11T18:03:21.302Z
CVE-2026-0232 Cortex XDR Agent: Local Administrator can disable the agent on Windows
A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows allows a local Windows administrator to disable the agent. This issue may be leveraged by malware to perform malicious activity without detection.
Problem types: cwe_id: CWE-15
description: CWE-15: External Control of System or Configuration Setting
Affected products: vendor: Palo Alto Networks
product: Cortex XDR Agent
default_status: unaffected
vendor: Palo Alto Networks
product: Cortex XDR Agent
cpes: cpe:2.3:a:palo_alto_networks:cortex_xdr_agent:9.0.0:*:*:*:*:Windows:*:*
cpe:2.3:a:palo_alto_networks:cortex_xdr_agent:8.9.0:*:*:*:*:Windows:*:*
cpe:2.3:a:palo_alto_networks:cortex_xdr_agent:8.7-CE:*:*:*:*:Windows:*:*
default_status: unaffected
Credits: lang: en
value: WhatThe0xDoin
Published: 2026-04-13T07:22:48.325Z
CVE-2026-0233 Autonomous Digital Experience Manager: Improper validation of ADEM certificate
A certificate validation vulnerability in Palo Alto Networks Autonomous Digital Experience Manager on Windows allows an unauthenticated attacker with adjacent network access to execute arbitrary code with NT AUTHORITY\SYSTEM  privileges.
Problem types: cwe_id: CWE-295
description: CWE-295: Improper Certificate Validation
Affected products: vendor: Palo Alto Networks
product: Autonomous Digital Experience Manager
default_status: unaffected
Credits: lang: en
value: David Fischer with OBI
Published: 2026-04-13T07:17:34.585Z
CVE-2026-0234 Cortex XSOAR: Improper Verification of Cryptographic Signature in Microsoft Teams integration
An improper verification of cryptographic signature vulnerability exists in Cortex XSOAR and Cortex XSIAM platforms during integration of Microsoft Teams that enables an unauthenticated user to access and modify protected resources.
Problem types: cwe_id: CWE-347
description: CWE-347 Improper Verification of Cryptographic Signature
Affected products: vendor: Palo Alto Networks
product: Cortex XSOAR Microsoft Teams Marketplace
default_status: unaffected
vendor: Palo Alto Networks
product: Cortex XSIAM Microsoft Teams Marketplace
default_status: unaffected
Credits: lang: en
value: quinn
Published: 2026-04-13T07:15:03.667Z
CVE-2026-0235 Prisma Browser: Access and Data Rule Bypass
A race condition vulnerability in Palo Alto Networks Prisma® Browser enables a locally authenticated non-admin user to bypass certain access and data control policies.
Problem types: cwe_id: CWE-754
description: CWE-754: Improper Check for Unusual or Exceptional Conditions
Affected products: vendor: Palo Alto Networks
product: Prisma Browser
default_status: unaffected
Credits: lang: en
value: Palo Alto Networks thanks Tan Inn Fung, Yu Ann Ong, Zhang Bosen, Stan Leow and Sean Seah from the GovTech Cybersecurity Group
Published: 2026-05-13T18:14:11.463Z
CVE-2026-0236 Prisma Browser: Code Injection Enables Security Controls Bypass
A code injection vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to its AppleScript interface allowing a locally authenticated non-admin user to leverage this exposed Apple Event handler to send unauthorized commands to the browser.
Problem types: cwe_id: CWE-94
description: CWE-94: Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: Palo Alto Networks
product: Prisma Browser
default_status: unaffected
Credits: lang: en
value: Cisors
Published: 2026-05-13T17:55:04.370Z
CVE-2026-0237 Prisma Browser: Improperly Restricted Automation Bridge Allows Security Bypass
An improper protection of alternate path vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to an internal automation bridge. This allows a locally authenticated non-admin user to leverage an exposed communication channel to send unauthorized commands to the browser, bypassing security controls.
Problem types: cwe_id: CWE-424
description: CWE-424: Improper Protection of Alternate Path
Affected products: vendor: Palo Alto Networks
product: Prisma Browser
default_status: unaffected
Credits: lang: en
value: Cisors
Published: 2026-05-13T17:48:17.677Z
CVE-2026-0238 Broker VM: Improper Input Validation in Broker VM Certificate and Key Fields
A vulnerability in Palo Alto Networks Broker VM allows an authenticated administrator to inject arbitrary content into certain Broker VM fields.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Palo Alto Networks
product: Broker VM
default_status: unaffected
Credits: lang: en
value: This issue was discovered during an internal penetration test.
Published: 2026-05-13T18:22:00.405Z
CVE-2026-0239 Chronosphere Chronocollector Information Disclosure Vulnerability
An information disclosure vulnerability in the Chronosphere Chronocollector enables an unauthenticated attacker with network access to the collector service to retrieve sensitive information.
Problem types: cwe_id: CWE-497
description: CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere
Affected products: vendor: Palo Alto Networks
product: Chronosphere Chronocollector
default_status: unaffected
Credits: lang: en
value: Palo Alto Networks thanks our internal security research teams for discovering and reporting this issue.
Published: 2026-05-13T18:27:10.295Z
CVE-2026-0240 Trust Protection Foundation: Sensitive Information Disclosure Vulnerability
An information disclosure vulnerability in Trust Protection Foundation enables an authenticated attacker to obtain sensitive information from the server's vault. Successful exploitation of this issue allows the attacker to impersonate any user within the environment and arbitrarily modify configuration settings.
Problem types: cwe_id: CWE-497
description: CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere
Affected products: vendor: Palo Alto Networks
product: Trust Protection Foundation
default_status: unaffected
Credits: lang: en
value: Palo Alto Networks thanks our internal security research teams for discovering and reporting this issue.
Published: 2026-05-13T18:54:07.294Z
CVE-2026-0241 Trust Protection Foundation: Multiple Authorization Bypass Vulnerabilities
Incorrect Authorization vulnerabilities in Trust Protection Foundation allow attackers to bypass access controls and perform unauthorized actions on restricted resources.
Problem types: cwe_id: CWE-754
description: CWE-754 Improper Check for Unusual or Exceptional Conditions
Affected products: vendor: Palo Alto Networks
product: Trust Protection Foundation
default_status: unaffected
Credits: lang: en
value: Palo Alto Networks thanks our internal security research teams for discovering and reporting this issue.
Published: 2026-05-13T19:01:24.094Z
CVE-2026-0242 Trust Protection Foundation: SQL Injection Vulnerability
A SQL injection vulnerability in Trust Protection Foundation allows an authenticated attacker to execute arbitrary SQL commands against the product database. Successful exploitation could allow an attacker to read sensitive data, modify database contents, and escalate privileges to gain full administrative control of the platform.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Palo Alto Networks
product: Trust Protection Foundation
default_status: unaffected
Credits: lang: en
value: Palo Alto Networks thanks our internal security research teams for discovering and reporting this issue.
Published: 2026-05-13T19:04:52.841Z
CVE-2026-0243 Prisma SD-WAN: Denial of Service (DoS) Vulnerability Through IPv6 Crafted Packet
A denial of service (DoS) vulnerability in Palo Alto Networks Prisma SD-WAN ION devices enables an unauthenticated attacker in a network adjacent to a Prisma SD-WAN ION device to cause a system disruption by sending a specially crafted IPv6 packet.
Problem types: cwe_id: CWE-606
description: CWE-606 Unchecked Input for Loop Condition
Affected products: vendor: Palo Alto Networks
product: Prisma SD-WAN ION
default_status: unaffected
Credits: lang: en
value: Palo Alto Networks thanks our internal security research teams for discovering and reporting this issue.
Published: 2026-05-13T19:10:53.743Z
CVE-2026-0244 Prisma SD-WAN: Improper Certificate Validation Vulnerability
An improper certificate validation vulnerability in the Palo Alto Networks Prisma SD-WAN ION enables man-in-the-middle (MitM) attacker to impersonate the controller.
Problem types: cwe_id: CWE-295
description: CWE-295 Improper Certificate Validation
Affected products: vendor: Palo Alto Networks
product: Prisma SD-WAN ION
default_status: unaffected
Credits: lang: en
value: Palo Alto Networks thanks our internal security research teams for discovering and reporting this issue.
Published: 2026-05-13T19:03:09.013Z
CVE-2026-0245 Prisma Access Agent: Information Disclosure Vulnerabilities
Multiple information disclosure vulnerabilities in Prisma Access Agent® allow a local user to access sensitive configuration data and credentials.



The Prisma Access Agent on Linux, ChromeOS, Android, and iOS are not affected.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Palo Alto Networks
product: Prisma Access Agent
default_status: unaffected
vendor: Palo Alto Networks
product: Prisma Access Agent
default_status: unaffected
Credits: lang: en
value: Palo Alto Networks thanks our internal security research teams for discovering and reporting this issue.
Published: 2026-05-13T18:54:09.052Z
CVE-2026-0246 Prisma Access Agent: Local Privilege Escalation Vulnerability
A vulnerability with a privilege management mechanism in the Palo Alto Networks Prisma Access Agent® enables a locally authenticated non-administrative user to escalate their privileges to root on macOS and Linux or NT AUTHORITY\SYSTEM on Windows. This allows the user to execute arbitrary code and read sensitive information otherwise accessible only to privileged accounts.



The Prisma Access Agent on iOS, Android and Chrome OS are not affected.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Palo Alto Networks
product: Prisma Access Agent
default_status: unaffected
vendor: Palo Alto Networks
product: Prisma Access Agent
default_status: unaffected
vendor: Palo Alto Networks
product: Prisma Access Agent
default_status: unaffected
vendor: Palo Alto Networks
product: Prisma Access Agent
default_status: unaffected
Credits: lang: en
value: Palo Alto Networks thanks our internal security research teams for discovering and reporting this issue.
Published: 2026-05-13T18:51:06.275Z