rainbutterfly/cve_corpus huggingface dataset:
CVE-2026-2325 Improper Input Validation in MS Teams Meetings API Handler
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to limit the size of the request body on the start meeting API endpoint, which allows an authenticated attacker to cause resource exhaustion or denial of service via a crafted oversized HTTP POST request to {{/api/v1/meetings}}.. Mattermost Advisory ID: MMSA-2026-00608
Problem types: cwe_id: CWE-770
description: CWE-770: Allocation of Resources Without Limits or Throttling
Affected products: vendor: Mattermost
product: Mattermost
default_status: unaffected
CVSS v3.1: attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
baseSeverity: MEDIUM
baseScore: 4.3
Credits: lang: en
value: Lorenzo Gallegos
Published: 2026-05-18T06:51:47.104Z
CVE-2026-2327 
Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /\*+$/ in the linkify function. An attacker can supply a long sequence of * characters followed by a non-matching character, which triggers excessive backtracking and may lead to a denial-of-service condition.
Problem types: cwe_id: CWE-1333
description: Regular Expression Denial of Service (ReDoS)
Affected products: vendor: n/a
product: markdown-it
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
exploitCodeMaturity: PROOF_OF_CONCEPT
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P
Credits: lang: en
value: Duc Le Trung
Published: 2026-02-12T05:00:07.369Z
CVE-2026-2328 Backend Access Due to Insufficient Input Validation
An unauthenticated remote attacker can exploit insufficient input validation to access backend components beyond their intended scope via path traversal, resulting in exposure of sensitive information.
Problem types: cwe_id: CWE-790
description: CWE-790 Improper Filtering of Special Elements
Affected products: vendor: WAGO
product: Device Sphere
default_status: unaffected
vendor: WAGO
product: Solution Builder
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Marvin Ramsperger from SySS GmbH
Published: 2026-03-30T06:55:31.424Z
CVE-2026-2329 Grandstream GXP1600 VoIP Phones - Unauthenticated stack buffer overflow
An unauthenticated stack-based buffer overflow vulnerability exists in the HTTP API endpoint /cgi-bin/api.values.get. A remote attacker can leverage this vulnerability to achieve unauthenticated remote code execution (RCE) with root privileges on a target device. The vulnerability affects all six device models in the series: GXP1610, GXP1615, GXP1620, GXP1625, GXP1628, and GXP1630.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: Grandstream
product: GXP1610
default_status: unaffected
vendor: Grandstream
product: GXP1615
default_status: unaffected
vendor: Grandstream
product: GXP1620
default_status: unaffected
vendor: Grandstream
product: GXP1625
default_status: unaffected
vendor: Grandstream
product: GXP1628
default_status: unaffected
vendor: Grandstream
product: GXP1630
default_status: unaffected
Credits: lang: en
value: Stephen Fewer, Senior Principal Security Researcher at Rapid7
Published: 2026-02-18T14:08:09.272Z
CVE-2026-2330 CVE-2026-2330
An attacker may access restricted filesystem areas on the device via the CROWN REST interface due to incomplete whitelist enforcement. Certain directories intended for internal testing were not covered by the whitelist and are accessible without authentication. An unauthenticated attacker could place a manipulated parameter file that becomes active after a reboot, allowing modification of critical device settings, including network configuration and application parameters.
Problem types: cwe_id: CWE-552
description: CWE-552 Files or Directories Accessible to External Parties
Affected products: vendor: SICK AG
product: SICK Lector85x
default_status: affected
vendor: SICK AG
product: SICK Lector83x
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.4
baseSeverity: CRITICAL
confidentialityImpact: LOW
environmentalScore: 9.4
environmentalSeverity: CRITICAL
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
temporalScore: 9.4
temporalSeverity: CRITICAL
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
version: 3.1
Published: 2026-03-06T07:54:45.958Z
CVE-2026-2331 CVE-2026-2331
An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-based file access feature, allowing access without authentication. This includes device parameter files, enabling an attacker to read and modify application settings, including customer-defined passwords. Additionally, exposure of the custom application directory may allow execution of arbitrary Lua code within the sandboxed AppEngine environment.
Problem types: cwe_id: CWE-552
description: CWE-552 Files or Directories Accessible to External Parties
Affected products: vendor: SICK AG
product: SICK Lector85x
default_status: affected
vendor: SICK AG
product: SICK Lector83x
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
environmentalScore: 9.8
environmentalSeverity: CRITICAL
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
temporalScore: 9.8
temporalSeverity: CRITICAL
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2026-03-06T07:56:35.445Z
CVE-2026-2332 HTTP Request Smuggling via Chunked Extension Quoted-String Parsing
In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here:
  *  https://w4ke.info/2025/06/18/funky-chunks.html

  *  https://w4ke.info/2025/10/29/funky-chunks-2.html


Jetty terminates chunk extension parsing at \r\n inside quoted strings instead of treating this as an error.


POST / HTTP/1.1
Host: localhost
Transfer-Encoding: chunked

1;ext="val
X
0

GET /smuggled HTTP/1.1
...





Note how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.
Problem types: cwe_id: CWE-444
description: CWE-444 Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling')
Affected products: vendor: Eclipse Foundation
product: Eclipse Jetty
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
baseSeverity: HIGH
baseScore: 7.4
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Credits: lang: en
value: https://github.com/xclow3n
Published: 2026-04-14T10:59:10.193Z
CVE-2026-2333 Improper Neutralization of Special Elements used in a Command ('Command Injection') in Owl opds
Improper Neutralization of Special Elements used in a Command ('Command Injection') in Owl opds 2.2.0.4 allows Command Injection via a crafted network request.
Problem types: cwe_id: CWE-77
description: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected products: vendor: Owl
product: opds
default_status: unaffected
Credits: lang: en
value: Luca Borzacchiello at Nozomi Networks
lang: en
value: Gabriele Quagliarella at Nozomi Networks
Published: 2026-02-20T16:48:34.348Z
CVE-2026-2336 Weak webstax_auth Cookie Authentication Allows Privilege Escalation
A privilege escalation vulnerability in Microchip IStaX allows an authenticated low-privileged user to recover a shared per-device cookie secret from their own webstax_auth session cookie and forge a new cookie with administrative privileges.This issue affects IStaX before 2026.03.
Problem types: cwe_id: CWE-331
description: CWE-331 Insufficient entropy
Affected products: vendor: Microchip
product: IStaX
default_status: unknown
Credits: lang: en
value: Rickard Jonsson
Published: 2026-04-16T17:02:06.352Z
CVE-2026-2337 Refleccted XSS on Plunet BusinessManager
A vulnerability in Plunet Plunet BusinessManager allows session hijacking, data theft, unauthorized actions on behalf of the user.This issue affects Plunet BusinessManager: 10.15.1.
Problem types: cwe_id: CWE-79
description: CWE-79 - XSS
Affected products: vendor: Plunet
product: Plunet BusinessManager
default_status: unaffected
Published: 2026-02-11T13:28:30.034Z
CVE-2026-2339 RCE in TUBITAK BILGEM's Liderahenk
Missing Authentication for Critical Function vulnerability in TUBITAK BILGEM Software Technologies Research Institute Liderahenk allows Remote Code Inclusion, Privilege Abuse, Command Injection.

This issue affects Liderahenk: before 3.5.1.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: TUBITAK BILGEM Software Technologies Research Institute
product: Liderahenk
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Credits: lang: en
value: Edip ALHAZOURİ
Published: 2026-03-10T12:39:12.987Z
CVE-2026-2340 Samba: vfs_worm does not block directory modification
A flaw was found in Samba’s vfs_worm module. The module is intended to provide write-once, read-many (WORM) protections by preventing modification of files after a configurable grace period. Due to insufficient validation during rename operations, an authenticated user with write access to a share could overwrite a protected file by renaming a newly created file over the existing WORM-protected file.
Problem types: cwe_id: CWE-280
description: Improper Handling of Insufficient Permissions or Privileges
Affected products: vendor: Red Hat
product: Red Hat Enterprise Linux 10
cpes: cpe:/o:redhat:enterprise_linux:10.2
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 6
cpes: cpe:/o:redhat:enterprise_linux:6
default_status: unknown
vendor: Red Hat
product: Red Hat Enterprise Linux 6
cpes: cpe:/o:redhat:enterprise_linux:6
default_status: unknown
vendor: Red Hat
product: Red Hat Enterprise Linux 7
cpes: cpe:/o:redhat:enterprise_linux:7
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/o:redhat:enterprise_linux:8
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/o:redhat:enterprise_linux:9
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Container Platform 4
cpes: cpe:/a:redhat:openshift:4
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
version: 3.1
Credits: lang: en
value: Red Hat would like to thank Pavel Kohout (Aisle Research) for reporting this issue.
Published: 2026-05-27T12:09:32.601Z
CVE-2026-2343 PeproDev Ultimate Invoice <= 2.2.5 - Unauthenticated Invoice Archive Download
The PeproDev Ultimate Invoice WordPress plugin through 2.2.5 has a bulk download invoices action that generates ZIP archives containing exported invoice PDFs. The ZIP files are named predictably making it possible to brute force and retreive PII.
Problem types: description: CWE-200 Information Exposure
Affected products: vendor: Unknown
product: PeproDev Ultimate Invoice
default_status: unknown
Credits: lang: en
value: Ashkan Moghaddas
lang: en
value: WPScan
Published: 2026-03-25T06:00:02.327Z
CVE-2026-2344 Stored XSS on Plunet BusinessManager
A vulnerability in Plunet Plunet BusinessManager allows unauthorized actions being performed on behalf of privileged users.This issue affects Plunet BusinessManager: 10.15.1
Problem types: cwe_id: CWE-79
description: CWE-79 - XSS
Affected products: vendor: Plunet
product: Plunet BusinessManager
default_status: unaffected
Published: 2026-02-11T14:53:20.753Z
CVE-2026-2345 Insufficient Origin Validation in Proctorio Chrome Extension postMessage Handlers
Proctorio Chrome Extension is a browser extension used for online proctoring. The extension contains multiple window.addEventListener('message', ...) handlers that do not properly validate the origin of incoming messages. Specifically, an internal messaging bridge processes messages based solely on the presence of a fromWebsite property without verifying the event.origin attribute.
Problem types: cwe_id: CWE-346
description: CWE-346 Origin Validation Error
Affected products: vendor: Proctorio
product: Secure Exam Proctor Extension
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 3.6
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Caen Jones (@vcc3v)
Published: 2026-02-11T14:49:44.991Z
CVE-2026-2347 IDOR in Akıllı Ticaret's E-Commerce Pack
Authorization bypass through User-Controlled key vulnerability in Akilli Commerce Software Technologies Ltd. Co. E-Commerce Website allows Session Hijacking.

This issue affects E-Commerce Website: before 4.5.001.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization bypass through User-Controlled key
Affected products: vendor: Akilli Commerce Software Technologies Ltd. Co.
product: E-Commerce Website
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Credits: lang: en
value: Ferit ÖZNER
lang: en
value: Onur BİLİCİ
Published: 2026-05-14T09:25:30.978Z
CVE-2026-2348 Quick Edit - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-009
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Quick Edit allows Cross-Site Scripting (XSS).This issue affects Quick Edit: from 0.0.0 before 1.0.5, from 2.0.0 before 2.0.1.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")
Affected products: vendor: Drupal
product: Quick Edit
default_status: unaffected
Credits: lang: en
value: Drew Webber (mcdruid)
lang: en
value: Derek Wright (dww)
lang: en
value: Vladimir Roudakov (vladimiraus)
lang: en
value: Greg Knaddison (greggles)
lang: en
value: Drew Webber (mcdruid)
Published: 2026-03-25T15:20:53.201Z
CVE-2026-2349 UI Icons - Critical - Cross-site Scripting - SA-CONTRIB-2026-010
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS).This issue affects UI Icons: from 0.0.0 before 1.0.1, from 1.1.0 before 1.1.1.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")
Affected products: vendor: Drupal
product: UI Icons
default_status: unaffected
Credits: lang: en
value: Drew Webber (mcdruid)
lang: en
value: Jean Valverde (mogtofu33)
lang: en
value: Greg Knaddison (greggles)
lang: en
value: Drew Webber (mcdruid)
Published: 2026-03-25T15:21:28.488Z
CVE-2026-2350 Tanium addressed an insertion of sensitive information into log file vulnerability in Interact and TDS.
Tanium addressed an insertion of sensitive information into log file vulnerability in Interact and TDS.
Problem types: cwe_id: CWE-532
description: Insertion of Sensitive Information into Log File
Affected products: vendor: Tanium
product: Interact
cpes: cpe:2.3:a:tanium:service_interact:3.2.195:*:*:*:*:*:*:*
cpe:2.3:a:tanium:service_interact:3.5.101:*:*:*:*:*:*:*
vendor: Tanium
product: TDS
cpes: cpe:2.3:a:tanium:service_tds:4.1.256:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 6.5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Published: 2026-02-19T23:10:33.951Z
CVE-2026-2351 Task Manager <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Read
The Task Manager plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.0.2 via the callback_get_text_from_url() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Problem types: cwe_id: CWE-73
description: CWE-73 External Control of File Name or Path
Affected products: vendor: eoxia
product: Task Manager
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
baseScore: 6.5
baseSeverity: MEDIUM
Credits: lang: en
value: Youcef Hamdani
Published: 2026-03-21T03:27:03.476Z
CVE-2026-2352 Autoptimize <= 3.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ao_post_preload' Meta Value
The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ao_post_preload' meta value in all versions up to, and including, 3.1.14. This is due to insufficient input sanitization in the `ao_metabox_save()` function and missing output escaping when the value is rendered into a `<link>` tag in `autoptimizeImages.php`. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, granted the "Image optimization" or "Lazy-load images" setting is enabled in the plugin configuration.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: optimizingmatters
product: Autoptimize
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: Hung Nguyen
Published: 2026-03-20T23:25:12.386Z
CVE-2026-2355 My Calendar – Accessible Event Manager <= 3.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `template` attribute of the `[my_calendar_upcoming]` shortcode in all versions up to, and including, 3.7.3. This is due to the use of `stripcslashes()` on user-supplied shortcode attribute values in the `mc_draw_template()` function, which decodes C-style hex escape sequences (e.g., `\x3c` to `<`) at render time, bypassing WordPress's `wp_kses_post()` content sanitization that runs at save time. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: joedolson
product: My Calendar – Accessible Event Manager
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: Muhammad Yudha - DJ
Published: 2026-03-04T11:22:29.620Z
CVE-2026-2356 User Registration & Membership <= 5.1.2 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion
The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.2 via the 'register_member' function, due to missing validation on the 'member_id' user controlled key. This makes it possible for unauthenticated attackers to delete arbitrary user accounts that newly registered on the site who has the 'urm_user_just_created' user meta set.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: wpeverest
product: User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
baseScore: 5.3
baseSeverity: MEDIUM
Credits: lang: en
value: Phú
Published: 2026-02-26T02:23:55.847Z
CVE-2026-2358 WP ULike <= 5.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attribute
The WP ULike plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `[wp_ulike_likers_box]` shortcode `template` attribute in all versions up to, and including, 5.0.1. This is due to the use of `html_entity_decode()` on shortcode attributes without subsequent output sanitization, which effectively bypasses WordPress's `wp_kses_post()` content filtering. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The post must have at least one like for the XSS to render.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: alimir
product: WP ULike – Like & Dislike Buttons for Engagement and Feedback
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: Quốc Huy
Published: 2026-03-11T05:27:16.708Z
CVE-2026-2359 Multer vulnerable to Denial of Service via resource exhaustion
Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability in Multer prior to version 2.1.0 allows an attacker to trigger a Denial of Service (DoS) by dropping connection during file upload, potentially causing resource exhaustion. Users should upgrade to version 2.1.0 to receive a patch. No known workarounds are available.
Problem types: cwe_id: CWE-772
description: CWE-772
Affected products: vendor: expressjs
product: multer
default_status: unaffected
Published: 2026-02-27T15:42:08.088Z