rainbutterfly/cve_corpus huggingface dataset:
CVE-2026-28801 Natro Macro: Code Injection through Pattern/Path files
Natro Macro is an open-source Bee Swarm Simulator macro written in AutoHotkey. Prior to version 1.1.0, any ahk code contained inside of a pattern or path file is executed by the macro. Since users commonly share path/pattern files, an attacker could share a file containing malicious code, which is then executed by the program. This code can operate in silence alongside the pattern, running in the background to do whatever the attacker pleases. This issue has been patched in version 1.1.0.
Problem types: cwe_id: CWE-94
description: CWE-94: Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: NatroTeam
product: NatroMacro
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6.6
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
version: 3.1
Published: 2026-03-06T06:42:13.923Z
CVE-2026-28802 Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification
Authlib is a Python library which builds OAuth and OpenID Connect servers. From version 1.6.5 to before version 1.6.7, previous tests involving passing a malicious JWT containing alg: none and an empty signature was passing the signature verification step without any changes to the application code when a failure was expected.. This issue has been patched in version 1.6.7.
Problem types: cwe_id: CWE-347
description: CWE-347: Improper Verification of Cryptographic Signature
Affected products: vendor: authlib
product: authlib
Published: 2026-03-06T06:44:26.402Z
CVE-2026-28803 Open Forms possible to view submission details of other people than intended
Open Forms allows users create and publish smart forms. Prior to 3.3.13 and 3.4.5, to be able to cosign, the cosigner receives an e-mail with instructions or a deep-link to start the cosign flow. The submission reference is communicated so that the user can retrieve the submission to be cosigned. Attackers can guess a code or modify the received code to look up arbitrary submissions, after logging in (with DigiD/eHerkenning/... depending on form configuration). This vulnerability is fixed in 3.3.13 and 3.4.5.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: open-formulieren
product: open-forms
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2026-03-11T15:52:08.464Z
CVE-2026-28804 pypdf: Inefficient decoding of ASCIIHexDecode streams
pypdf is a free and open-source pure-python PDF library. Prior to version 6.7.5, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /ASCIIHexDecode filter. This issue has been patched in version 6.7.5.
Problem types: cwe_id: CWE-407
description: CWE-407: Inefficient Algorithmic Complexity
Affected products: vendor: py-pdf
product: pypdf
Published: 2026-03-06T06:46:28.890Z
CVE-2026-28805 OpenSTAManager: Time-Based Blind SQL Injection via `options[stato]` Parameter
OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.10.2, multiple AJAX select handlers in OpenSTAManager are vulnerable to Time-Based Blind SQL Injection through the options[stato] GET parameter. The user-supplied value is read from $superselect['stato'] and concatenated directly into SQL WHERE clauses as a bare expression, without any sanitization, parameterization, or allowlist validation. An authenticated attacker can inject arbitrary SQL statements to extract sensitive data from the database, including usernames, password hashes, financial records, and any other information stored in the MySQL database. This issue has been patched in version 2.10.2.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: devcode-it
product: openstamanager
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2026-04-02T13:44:07.063Z
CVE-2026-28806 Improper authorization in device bulk actions and device update API allows cross-organization device control
Improper Authorization vulnerability in nerves-hub nerves_hub_web allows cross-organization device control via device bulk actions and device update API.

Missing authorization checks in the device bulk actions and device update API endpoints allow authenticated users to target devices belonging to other organizations and perform actions outside of their privilege level.

An attacker can select devices outside of their organization by manipulating device identifiers and perform management actions on them, such as moving them to products they control. This may allow attackers to interfere with firmware updates, access device functionality exposed by the platform, or disrupt device connectivity.

In environments where additional features such as remote console access are enabled, this could lead to full compromise of affected devices.

This issue affects nerves_hub_web: from 1.0.0 before 2.4.0.
Problem types: cwe_id: CWE-285
description: CWE-285 Improper Authorization
cwe_id: CWE-668
description: CWE-668 Exposure of Resource to Wrong Sphere
Affected products: vendor: nerves-hub
product: nerves_hub_web
cpes: cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*
default_status: unaffected
vendor: nerves-hub
product: nerves_hub_web
cpes: cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*
default_status: unaffected
vendor: nerves-hub
product: nerves_hub_web
cpes: cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*
default_status: unaffected
Credits: lang: en
value: Josh Kalderimis / NervesHub team & NervesCloud
lang: en
value: Jonatan Männchen / EEF
lang: en
value: Lars Wikman / NervesHub team & NervesCloud
Published: 2026-03-10T21:30:58.581Z
CVE-2026-28807 Path Traversal in wisp.serve_static allows arbitrary file read
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in gleam-wisp wisp allows arbitrary file read via percent-encoded path traversal.

The wisp.serve_static function is vulnerable to path traversal because sanitization runs before percent-decoding. The encoded sequence %2e%2e passes through string.replace unchanged, then uri.percent_decode converts it to .., which the OS resolves as directory traversal when the file is read.

An unauthenticated attacker can read any file readable by the application process in a single HTTP request, including application source code, configuration files, secrets, and system files.

This issue affects wisp: from 2.1.1 before 2.2.1.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: gleam-wisp
product: wisp
cpes: cpe:2.3:a:gleam-wisp:wisp:*:*:*:*:*:*:*:*
default_status: unaffected
vendor: gleam-wisp
product: wisp
cpes: cpe:2.3:a:gleam-wisp:wisp:*:*:*:*:*:*:*:*
default_status: unaffected
Credits: lang: en
value: John Downey
lang: en
value: Louis Pilfold
Published: 2026-03-10T21:34:47.859Z
CVE-2026-28808 ScriptAlias CGI targets bypass directory auth in inets httpd (mod_auth vs mod_cgi path mismatch)
Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias.

When script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory-based access controls against the DocumentRoot-relative path while mod_cgi executes the script at the ScriptAlias-resolved path. This path mismatch allows unauthenticated access to CGI scripts that directory rules were meant to protect.

This vulnerability is associated with program files lib/inets/src/http_server/mod_alias.erl, lib/inets/src/http_server/mod_auth.erl, and lib/inets/src/http_server/mod_cgi.erl.

This issue affects OTP from OTP 17.0 until OTP 28.4.2, 27.3.4.10 and 26.2.5.19 corresponding to inets from 5.10 until 9.6.2, 9.3.2.4 and 9.1.0.6.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Erlang
product: OTP
cpes: cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
default_status: affected
vendor: Erlang
product: OTP
cpes: cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
default_status: affected
Credits: lang: en
value: Igor Morgenstern / Aisle Research
lang: en
value: Konrad Pietrzak
Published: 2026-04-07T12:28:16.056Z
CVE-2026-28809 XXE in esaml SAML library allows local file read and potential SSRF
XML External Entity (XXE) vulnerability in esaml (and its forks) allows an attacker to cause the system to read local files and incorporate their contents into processed SAML documents, and potentially perform SSRF via crafted SAML messages.

esaml parses attacker-controlled SAML messages using xmerl_scan:string/2 before signature verification without disabling XML entity expansion. On Erlang/OTP versions before 27, Xmerl allows entities by default, enabling pre-signature XXE attacks. An attacker can cause the host to read local files (e.g., Kubernetes-mounted secrets) into the SAML document. If the attacker is not a trusted SAML SP, signature verification will fail and the document is discarded, but file contents may still be exposed through logs or error messages.

This issue affects all versions of esaml, including forks by arekinath, handnot2, and dropbox. Users running on Erlang/OTP 27 or later are not affected due to Xmerl defaulting to entities disabled.
Problem types: cwe_id: CWE-611
description: CWE-611 Improper Restriction of XML External Entity Reference
Affected products: vendor: dropbox
product: esaml
cpes: cpe:2.3:a:dropbox:esaml:*:*:*:*:*:*:*:*
cpe:2.3:a:arekinath:esaml:*:*:*:*:*:*:*:*
cpe:2.3:a:handnot2:esaml:*:*:*:*:*:*:*:*
default_status: affected
vendor: arekinath
product: esaml
cpes: cpe:2.3:a:arekinath:esaml:*:*:*:*:*:*:*:*
default_status: affected
vendor: handnot2
product: esaml
cpes: cpe:2.3:a:handnot2:esaml:*:*:*:*:*:*:*:*
default_status: affected
vendor: dropbox
product: esaml
cpes: cpe:2.3:a:dropbox:esaml:*:*:*:*:*:*:*:*
default_status: affected
vendor: Jump-App
product: esaml
cpes: cpe:2.3:a:jump-app:esaml:*:*:*:*:*:*:*:*
default_status: affected
Credits: lang: en
value: Bryan Lynch
lang: en
value: Jonatan Männchen / EEF
Published: 2026-03-23T10:09:29.233Z
CVE-2026-28810 Predictable DNS Transaction IDs Enable Cache Poisoning in Built-in Resolver
Generation of Predictable Numbers or Identifiers vulnerability in Erlang/OTP kernel (inet_res, inet_db modules) allows DNS Cache Poisoning.

The built-in DNS resolver (inet_res) uses a sequential, process-global 16-bit transaction ID for UDP queries and does not implement source port randomization. Response validation relies almost entirely on this ID, making DNS cache poisoning practical for an attacker who can observe one query or predict the next ID. This conflicts with RFC 5452 recommendations for mitigating forged DNS answers.

inet_res is intended for use in trusted network environments and with trusted recursive resolvers. Earlier documentation did not clearly state this deployment assumption, which could lead users to deploy the resolver in environments where spoofed DNS responses are possible.

This vulnerability is associated with program files lib/kernel/src/inet_db.erl and lib/kernel/src/inet_res.erl.

This issue affects OTP from OTP 17.0 until OTP 28.4.2, 27.3.4.10 and 26.2.5.19 corresponding to kernel from 3.0 until 10.6.2, 10.2.7.4 and 9.2.4.11.
Problem types: cwe_id: CWE-340
description: CWE-340 Generation of Predictable Numbers or Identifiers
Affected products: vendor: Erlang
product: OTP
cpes: cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
default_status: unknown
vendor: Erlang
product: OTP
cpes: cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
default_status: unknown
Credits: lang: en
value: Luigino Camastra / Aisle Research
lang: en
value: Raimo Niskanen
Published: 2026-04-07T07:50:11.072Z
CVE-2026-28815 
A remote attacker can supply a short X-Wing HPKE encapsulated key and trigger an out-of-bounds read in the C decapsulation path, potentially causing a crash or memory disclosure depending on runtime protections. This issue is fixed in swift-crypto version 4.3.1.
Problem types: description: A remote attacker can supply a short X-Wing HPKE encapsulated key and trigger an out-of-bounds read in the C decapsulation path, potentially causing a crash or memory disclosure depending on runtime protections.
Affected products: vendor: Apple
product: macOS
Published: 2026-04-03T01:32:28.999Z
CVE-2026-28816 
A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to delete files for which it does not have permission.
Problem types: description: An app may be able to delete files for which it does not have permission
Affected products: vendor: Apple
product: macOS
Published: 2026-03-25T00:31:51.848Z
CVE-2026-28817 
A race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. A sandboxed process may be able to circumvent sandbox restrictions.
Problem types: description: A sandboxed process may be able to circumvent sandbox restrictions
Affected products: vendor: Apple
product: macOS
Published: 2026-03-25T00:32:13.344Z
CVE-2026-28818 
A logging issue was addressed with improved data redaction. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to access sensitive user data.
Problem types: description: An app may be able to access sensitive user data
Affected products: vendor: Apple
product: macOS
Published: 2026-03-25T00:32:26.603Z
CVE-2026-28819 
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to execute arbitrary code with kernel privileges.
Problem types: description: An app may be able to execute arbitrary code with kernel privileges
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
Published: 2026-05-11T20:08:27.702Z
CVE-2026-28820 
This issue was addressed with improved checks. This issue is fixed in macOS Tahoe 26.4. An app may be able to access sensitive user data.
Problem types: description: An app may be able to access sensitive user data
Affected products: vendor: Apple
product: macOS
Published: 2026-03-25T00:32:01.392Z
CVE-2026-28821 
A validation issue existed in the entitlement verification. This issue was addressed with improved validation of the process entitlement. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to gain elevated privileges.
Problem types: description: An app may be able to gain elevated privileges
Affected products: vendor: Apple
product: macOS
Published: 2026-03-25T00:32:06.941Z
CVE-2026-28822 
A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. An attacker may be able to cause unexpected app termination.
Problem types: description: An attacker may be able to cause unexpected app termination
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: tvOS
vendor: Apple
product: visionOS
vendor: Apple
product: watchOS
Published: 2026-03-25T00:32:22.854Z
CVE-2026-28823 
A path handling issue was addressed with improved validation. This issue is fixed in macOS Tahoe 26.4. An app with root privileges may be able to delete protected system files.
Problem types: description: An app with root privileges may be able to delete protected system files
Affected products: vendor: Apple
product: macOS
Published: 2026-03-25T00:32:31.385Z
CVE-2026-28824 
An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to access sensitive user data.
Problem types: description: An app may be able to access sensitive user data
Affected products: vendor: Apple
product: macOS
Published: 2026-03-25T00:32:43.579Z
CVE-2026-28825 
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to modify protected parts of the file system.
Problem types: description: An app may be able to modify protected parts of the file system
Affected products: vendor: Apple
product: macOS
Published: 2026-03-25T00:35:40.519Z
CVE-2026-28826 
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. A malicious app may be able to break out of its sandbox.
Problem types: description: A malicious app may be able to break out of its sandbox
Affected products: vendor: Apple
product: macOS
Published: 2026-03-25T00:31:34.798Z
CVE-2026-28827 
A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to break out of its sandbox.
Problem types: description: An app may be able to break out of its sandbox
Affected products: vendor: Apple
product: macOS
Published: 2026-03-25T00:31:49.295Z
CVE-2026-28828 
A permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to access sensitive user data.
Problem types: description: An app may be able to access sensitive user data
Affected products: vendor: Apple
product: macOS
Published: 2026-03-25T00:32:48.745Z
CVE-2026-28829 
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to modify protected parts of the file system.
Problem types: description: An app may be able to modify protected parts of the file system
Affected products: vendor: Apple
product: macOS
Published: 2026-03-25T00:32:58.109Z
CVE-2026-28830 
A race condition was addressed with additional validation. This issue is fixed in macOS Tahoe 26.4. An app may be able to access sensitive user data.
Problem types: description: An app may be able to access sensitive user data
Affected products: vendor: Apple
product: macOS
Published: 2026-05-11T20:07:33.427Z
CVE-2026-28831 
An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to access sensitive user data.
Problem types: description: An app may be able to access sensitive user data
Affected products: vendor: Apple
product: macOS
Published: 2026-03-25T00:31:48.005Z
CVE-2026-28832 
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to disclose kernel memory.
Problem types: description: An app may be able to disclose kernel memory
Affected products: vendor: Apple
product: macOS
Published: 2026-03-25T00:32:42.543Z
CVE-2026-28833 
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. An app may be able to enumerate a user's installed apps.
Problem types: description: An app may be able to enumerate a user's installed apps
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: visionOS
Published: 2026-03-25T00:35:41.254Z
CVE-2026-28834 
A race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to cause unexpected system termination.
Problem types: description: An app may be able to cause unexpected system termination
Affected products: vendor: Apple
product: macOS
Published: 2026-03-25T00:32:21.574Z
CVE-2026-28835 
A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. Mounting a maliciously crafted SMB network share may lead to system termination.
Problem types: description: Mounting a maliciously crafted SMB network share may lead to system termination
Affected products: vendor: Apple
product: macOS
Published: 2026-03-25T00:32:32.930Z
CVE-2026-28837 
A logic issue was addressed with improved checks. This issue is fixed in macOS Tahoe 26.4. An app may be able to access sensitive user data.
Problem types: description: An app may be able to access sensitive user data
Affected products: vendor: Apple
product: macOS
Published: 2026-03-25T00:32:05.740Z
CVE-2026-28838 
A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to break out of its sandbox.
Problem types: description: An app may be able to break out of its sandbox
Affected products: vendor: Apple
product: macOS
Published: 2026-03-25T00:32:16.708Z
CVE-2026-28839 
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to access sensitive user data.
Problem types: description: An app may be able to access sensitive user data
Affected products: vendor: Apple
product: macOS
Published: 2026-03-25T00:32:38.668Z
CVE-2026-28840 
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.4. An app may be able to gain root privileges.
Problem types: description: An app may be able to gain root privileges
Affected products: vendor: Apple
product: macOS
Published: 2026-05-11T20:08:15.112Z
CVE-2026-28841 
A buffer overflow was addressed with improved size validation. This issue is fixed in macOS Tahoe 26.4. A buffer overflow may result in memory corruption and unexpected app termination.
Problem types: description: A buffer overflow may result in memory corruption and unexpected app termination
Affected products: vendor: Apple
product: macOS
Published: 2026-03-25T00:31:52.799Z
CVE-2026-28842 
The issue was addressed with improved bounds checks. This issue is fixed in macOS Tahoe 26.4. A buffer overflow may result in memory corruption and unexpected app termination.
Problem types: description: A buffer overflow may result in memory corruption and unexpected app termination
Affected products: vendor: Apple
product: macOS
Published: 2026-03-25T00:32:36.111Z
CVE-2026-28844 
A file access issue was addressed with improved input validation. This issue is fixed in macOS Tahoe 26.4. An attacker may gain access to protected parts of the file system.
Problem types: description: An attacker may gain access to protected parts of the file system
Affected products: vendor: Apple
product: macOS
Published: 2026-03-25T00:32:53.794Z
CVE-2026-28845 
An authorization issue was addressed with improved state management. This issue is fixed in macOS Tahoe 26.4. An app may be able to access protected user data.
Problem types: description: An app may be able to access protected user data
Affected products: vendor: Apple
product: macOS
Published: 2026-03-25T00:32:52.681Z