rainbutterfly/cve_corpus huggingface dataset:
CVE-2026-5863 
Inappropriate implementation in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:20:41.585Z
CVE-2026-5864 
Heap buffer overflow in WebAudio in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
Problem types: cwe_id: CWE-122
description: Heap buffer overflow
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:20:41.982Z
CVE-2026-5865 
Type Confusion in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Problem types: cwe_id: CWE-843
description: Type Confusion
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:20:42.400Z
CVE-2026-5866 
Use after free in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Problem types: cwe_id: CWE-416
description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:20:42.797Z
CVE-2026-5867 
Heap buffer overflow in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
Problem types: cwe_id: CWE-122
description: Heap buffer overflow
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:20:43.173Z
CVE-2026-5868 
Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Problem types: cwe_id: CWE-122
description: Heap buffer overflow
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:20:43.524Z
CVE-2026-5869 
Heap buffer overflow in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
Problem types: cwe_id: CWE-122
description: Heap buffer overflow
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:20:43.915Z
CVE-2026-5870 
Integer overflow in Skia in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Problem types: cwe_id: CWE-472
description: Integer overflow
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:20:44.311Z
CVE-2026-5871 
Type Confusion in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Problem types: cwe_id: CWE-843
description: Type Confusion
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:20:44.696Z
CVE-2026-5872 
Use after free in Blink in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Problem types: cwe_id: CWE-416
description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:20:45.277Z
CVE-2026-5873 
Out of bounds read and write in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Problem types: description: Out of bounds read and write
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:20:45.703Z
CVE-2026-5874 
Use after free in PrivateAI in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
Problem types: cwe_id: CWE-416
description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:20:46.077Z
CVE-2026-5875 
Policy bypass in Blink in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
Problem types: description: Policy bypass
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:20:46.990Z
CVE-2026-5876 
Side-channel information leakage in Navigation in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Problem types: cwe_id: CWE-1300
description: Side-channel information leakage
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:20:47.387Z
CVE-2026-5877 
Use after free in Navigation in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
Problem types: cwe_id: CWE-416
description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:20:47.756Z
CVE-2026-5878 
Incorrect security UI in Blink in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
Problem types: description: Incorrect security UI
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:20:48.141Z
CVE-2026-5879 
Insufficient validation of untrusted input in ANGLE in Google Chrome on Mac prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
Problem types: cwe_id: CWE-20
description: Insufficient validation of untrusted input
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:20:48.533Z
CVE-2026-5880 
Insufficient policy enforcement in browser UI in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)
Problem types: description: Incorrect security UI
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:20:49.126Z
CVE-2026-5881 
Policy bypass in LocalNetworkAccess in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
Problem types: description: Policy bypass
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:20:49.608Z
CVE-2026-5882 
Incorrect security UI in Fullscreen in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
Problem types: description: Incorrect security UI
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:20:49.954Z
CVE-2026-5883 
Use after free in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
Problem types: cwe_id: CWE-416
description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:20:50.427Z
CVE-2026-5884 
Insufficient validation of untrusted input in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
Problem types: cwe_id: CWE-20
description: Insufficient validation of untrusted input
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:20:50.785Z
CVE-2026-5885 
Insufficient validation of untrusted input in WebML in Google Chrome on Windows prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
Problem types: cwe_id: CWE-20
description: Insufficient validation of untrusted input
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:20:51.118Z
CVE-2026-5886 
Out of bounds read in WebAudio in Google Chrome on Mac prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
Problem types: cwe_id: CWE-125
description: Out of bounds read
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:20:51.484Z
CVE-2026-5887 
Insufficient validation of untrusted input in Downloads in Google Chrome on Windows prior to 147.0.7727.55 allowed a remote attacker to bypass download restrictions via a crafted HTML page. (Chromium security severity: Medium)
Problem types: cwe_id: CWE-20
description: Insufficient validation of untrusted input
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:20:51.857Z
CVE-2026-5888 
Uninitialized Use in WebCodecs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
Problem types: cwe_id: CWE-457
description: Uninitialized Use
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:20:52.176Z
CVE-2026-5889 
Cryptographic Flaw in PDFium in Google Chrome prior to 147.0.7727.55 allowed an attacker to read potentially sensitive information from encrypted PDFs via a brute-force attack. (Chromium security severity: Medium)
Problem types: description: Cryptographic Flaw
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:20:52.705Z
CVE-2026-5890 
Race in WebCodecs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
Problem types: cwe_id: CWE-362
description: Race
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:20:53.327Z
CVE-2026-5891 
Insufficient policy enforcement in browser UI in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
Problem types: description: Insufficient policy enforcement
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:20:53.739Z
CVE-2026-5892 
Insufficient policy enforcement in PWAs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to install a PWA without user consent via a crafted HTML page. (Chromium security severity: Medium)
Problem types: description: Insufficient policy enforcement
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:20:54.153Z
CVE-2026-5893 
Race in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
Problem types: cwe_id: CWE-362
description: Race
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:20:55.922Z
CVE-2026-5894 
Inappropriate implementation in PDF in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:20:56.746Z
CVE-2026-5895 
Incorrect security UI in Omnibox in Google Chrome on iOS prior to 147.0.7727.55 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name. (Chromium security severity: Low)
Problem types: description: Incorrect security UI
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:20:57.110Z
CVE-2026-5896 
Policy bypass in Audio in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass sandbox download restrictions via a crafted HTML page. (Chromium security severity: Low)
Problem types: description: Policy bypass
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:20:57.512Z
CVE-2026-5897 
Incorrect security UI in Downloads in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
Problem types: description: Incorrect security UI
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:20:57.861Z
CVE-2026-5898 
Incorrect security UI in Omnibox in Google Chrome on iOS prior to 147.0.7727.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
Problem types: description: Incorrect security UI
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:20:58.284Z
CVE-2026-5899 
Insufficient policy enforcement in History Navigation in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in specific UI gestures to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Low)
Problem types: description: Incorrect security UI
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:20:58.656Z
CVE-2026-5900 
Policy bypass in Downloads in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to bypass of multi-download protections via a crafted HTML page. (Chromium security severity: Low)
Problem types: description: Policy bypass
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:20:59.034Z
CVE-2026-5901 
Insufficient policy enforcement in DevTools in Google Chrome prior to 147.0.7727.55 allowed an attacker who convinced a user to install a malicious extension to bypass enterprise host restrictions for cookie modification via a crafted Chrome Extension. (Chromium security severity: Low)
Problem types: description: Policy bypass
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:20:59.391Z
CVE-2026-5902 
Race in Media in Google Chrome on Android prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to corrupt media stream metadata via a crafted HTML page. (Chromium security severity: Low)
Problem types: cwe_id: CWE-362
description: Race
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:21:00.103Z
CVE-2026-5903 
Policy bypass in IFrameSandbox in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)
Problem types: description: Policy bypass
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:21:00.551Z
CVE-2026-5904 
Use after free in V8 in Google Chrome prior to 147.0.7727.55 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: Low)
Problem types: cwe_id: CWE-416
description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:21:00.932Z
CVE-2026-5905 
Incorrect security UI in Permissions in Google Chrome on Windows prior to 147.0.7727.55 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Low)
Problem types: description: Incorrect security UI
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:21:01.314Z
CVE-2026-5906 
Incorrect security UI in Omnibox in Google Chrome on Android prior to 147.0.7727.55 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Low)
Problem types: description: Incorrect security UI
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:21:02.617Z
CVE-2026-5907 
Insufficient data validation in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform an out of bounds memory read via a crafted video file. (Chromium security severity: Low)
Problem types: description: Insufficient data validation
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:21:03.423Z
CVE-2026-5908 
Integer overflow in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a crafted video file. (Chromium security severity: Low)
Problem types: cwe_id: CWE-472
description: Integer overflow
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:21:03.818Z
CVE-2026-5909 
Integer overflow in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a crafted video file. (Chromium security severity: Low)
Problem types: cwe_id: CWE-472
description: Integer overflow
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:21:04.162Z
CVE-2026-5910 
Integer overflow in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a crafted video file. (Chromium security severity: Low)
Problem types: cwe_id: CWE-472
description: Integer overflow
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:21:04.841Z
CVE-2026-5911 
Policy bypass in ServiceWorkers in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Low)
Problem types: description: Policy bypass
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:21:05.248Z
CVE-2026-5912 
Integer overflow in WebRTC in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Low)
Problem types: cwe_id: CWE-472
description: Integer overflow
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:21:05.665Z
CVE-2026-5913 
Out of bounds read in Blink in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Low)
Problem types: cwe_id: CWE-125
description: Out of bounds read
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:21:06.156Z
CVE-2026-5914 
Type Confusion in CSS in Google Chrome prior to 147.0.7727.55 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: Low)
Problem types: cwe_id: CWE-843
description: Type Confusion
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:21:06.501Z
CVE-2026-5915 
Insufficient validation of untrusted input in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Low)
Problem types: cwe_id: CWE-20
description: Insufficient validation of untrusted input
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:21:06.835Z
CVE-2026-5918 
Inappropriate implementation in Navigation in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:21:07.218Z
CVE-2026-5919 
Insufficient validation of untrusted input in WebSockets in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)
Problem types: cwe_id: CWE-20
description: Insufficient validation of untrusted input
Affected products: vendor: Google
product: Chrome
Published: 2026-04-08T21:21:07.618Z
CVE-2026-5921 Server-Side Request Forgery in GitHub Enterprise Server allowed extraction of sensitive environment variables via timing side-channel attack
A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an attacker to extract sensitive environment variables from the instance through a timing side-channel attack against the notebook rendering service. When private mode was disabled, the notebook viewer followed HTTP redirects without revalidating the destination host, enabling an unauthenticated SSRF to internal services. By chaining this with regex filter queries against an internal API and measuring response time differences, an attacker could infer secret values character by character. Exploitation required that private mode be disabled and that the attacker be able to chain the instance's open redirect endpoint through an external redirect to reach internal services. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.14.26, 3.15.21, 3.16.17, 3.17.14, 3.18.8, 3.19.5, and 3.20.1. This vulnerability was reported via the GitHub Bug Bounty program.
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: GitHub
product: Enterprise Server
default_status: affected
Credits: lang: en
value: R31n
Published: 2026-04-21T22:11:02.077Z
CVE-2026-5926 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
Affected products: vendor: IBM
product: Verify Identity Access Container
cpes: cpe:2.3:a:ibm:verify_identity_access_container:11.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:verify_identity_access_container:11.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:verify_identity_access_container:11.0.2:*:*:*:*:*:*:*
vendor: IBM
product: Security Verify Access Container
cpes: cpe:2.3:a:ibm:security_verify_access_container:10.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:security_verify_access_container:10.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:security_verify_access_container:10.0.9.1:*:*:*:*:*:*:*
vendor: IBM
product: Verify Identity Access
cpes: cpe:2.3:a:ibm:verify_identity_access:11.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:verify_identity_access:11.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:verify_identity_access:11.0.2:*:*:*:*:*:*:*
vendor: IBM
product: Security Verify Access
cpes: cpe:2.3:a:ibm:security_verify_access:10.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:security_verify_access:10.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:security_verify_access:10.0.9.1:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Published: 2026-04-22T23:38:46.689Z