rainbutterfly/cve_corpus huggingface dataset:
CVE-2026-39808 
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via <insert attack vector here>
Problem types: cwe_id: CWE-78
description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: FortiSandbox
cpes: cpe:2.3:a:fortinet:fortisandbox:4.4.8:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.4.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.4.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.4.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.4.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.4.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.4.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.4.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.4.0:*:*:*:*:*:*:*
default_status: unaffected
vendor: Fortinet
product: FortiSandbox PaaS
cpes: cpe:2.3:a:fortinet:fortisandboxpaas:23.4.4374:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandboxpaas:23.4.4350:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandboxpaas:23.3.4329:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandboxpaas:23.1.4245:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandboxpaas:22.2.4151:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandboxpaas:22.2.4134:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandboxpaas:22.1.4113:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandboxpaas:21.4.4072:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandboxpaas:21.3.4055:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
Published: 2026-04-14T15:38:02.089Z
CVE-2026-39809 
A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.0 through 7.4.5, FortiClientEMS 7.2.0 through 7.2.12, FortiClientEMS 7.0 all versions may allow attacker to execute unauthorized code or commands via sending crafted requests
Problem types: cwe_id: CWE-89
description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: FortiClientEMS
cpes: cpe:2.3:a:fortinet:forticlientems:7.4.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientems:7.4.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientems:7.4.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientems:7.4.0:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.2
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
Published: 2026-04-14T15:05:56.647Z
CVE-2026-39810 
A use of hard-coded cryptographic key vulnerability in Fortinet FortiClientEMS 7.4.0 through 7.4.5 may allow attacker to information disclosure via decrypting database dump.
Problem types: cwe_id: CWE-321
description: Information disclosure
Affected products: vendor: Fortinet
product: FortiClientEMS
cpes: cpe:2.3:a:fortinet:forticlientems:7.4.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientems:7.4.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientems:7.4.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientems:7.4.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientems:7.4.0:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.2
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
Published: 2026-04-14T15:38:21.194Z
CVE-2026-39811 
A integer overflow or wraparound vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions may allow attacker to denial of service via <insert attack vector here>
Problem types: cwe_id: CWE-190
description: Denial of service
Affected products: vendor: Fortinet
product: FortiWeb
cpes: cpe:2.3:a:fortinet:fortiweb:8.0.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:8.0.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:8.0.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:8.0.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.6.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.6.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.6.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.6.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.6.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.6.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.6.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.4.12:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.4.11:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.4.10:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.4.9:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.4.8:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.4.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.4.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.4.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.4.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.4.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.4.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.4.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.4.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.2.12:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.2.11:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.2.10:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.2.9:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.2.8:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.2.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.2.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.2.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.2.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.2.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.2.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.2.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.2.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.0.12:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.0.11:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.0.10:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.0.9:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.0.8:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.0.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.0.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.0.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.0.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.0.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.0.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.0.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.0.0:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 4.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C
Published: 2026-04-14T15:38:20.186Z
CVE-2026-39813 
A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8 may allow attacker to escalation of privilege via <insert attack vector here>
Problem types: cwe_id: CWE-24
description: Escalation of privilege
Affected products: vendor: Fortinet
product: FortiSandbox
cpes: cpe:2.3:a:fortinet:fortisandbox:5.0.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:5.0.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:5.0.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:5.0.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:5.0.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:5.0.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.4.8:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.4.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.4.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.4.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.4.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.4.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.4.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.4.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.4.0:*:*:*:*:*:*:*
default_status: unaffected
vendor: Fortinet
product: FortiSandbox Cloud
cpes: cpe:2.3:a:fortinet:fortisandboxcloud:24.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandboxcloud:23.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandboxcloud:5.0.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandboxcloud:5.0.4:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
Published: 2026-04-14T15:38:30.311Z
CVE-2026-39814 
A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.1 through 7.4.12, FortiWeb 7.2.7 through 7.2.12, FortiWeb 7.0.10 through 7.0.12 may allow attacker to execute unauthorized code or commands via <insert attack vector here>
Problem types: cwe_id: CWE-23
description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: FortiWeb
cpes: cpe:2.3:a:fortinet:fortiweb:8.0.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:8.0.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:8.0.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.6.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.6.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.6.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.6.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.6.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.6.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.6.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.4.12:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.4.11:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.4.10:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.4.9:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.4.8:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.4.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.4.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.4.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.4.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.4.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.4.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.4.1:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.2
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
Published: 2026-04-14T15:38:16.660Z
CVE-2026-39815 
A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiDDoS-F 7.2.1 through 7.2.2 may allow attacker to execute unauthorized code or commands via sending crafted HTTP requests
Problem types: cwe_id: CWE-89
description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: FortiDDoS-F
cpes: cpe:2.3:o:fortinet:fortiddos-f:7.2.2:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiddos-f:7.2.1:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.9
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
Published: 2026-04-14T15:38:22.588Z
CVE-2026-39816 Apache NiFi: Missing Execute Code Required Permission on TinkerpopClientService
The optional extension component TinkerpopClientService is missing the Restricted annotation with the Execute Code Required Permission in Apache NiFi 2.0.0-M1 through 2.8.0. The TinkerpopClientService supports configuration of ByteCode Submission for the Script Submission Type, enabling Groovy Script execution in the service prior to submitting the query. The missing Restricted annotation allows users without the Execute Code Permission to configure the Service in installations that use fine-grained authorization and have the optional TinkerpopClientService installed. Apache NiFi installations that do not have the nifi-other-graph-services-nar installed are not subject to this vulnerability. Upgrading to Apache NiFi 2.9.0 is the recommended mitigation.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Apache Software Foundation
product: Apache NiFi
default_status: unaffected
Credits: lang: en
value: John Walker from ZeroPath
Published: 2026-05-08T13:38:12.925Z
CVE-2026-39817 Invoking "go tool pack" does not sanitize output paths in cmd/go
The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the filesystem.
Problem types: description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Go toolchain
product: cmd/go
default_status: unaffected
Credits: lang: en
value: Harshit Gupta (Mr HAX)
Published: 2026-05-07T19:41:18.993Z
CVE-2026-39819 Invoking "go bug" follows symlinks in predictable temporary filenames in cmd/go
The "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp"). An attacker with access to the temporary directory can create a symlink in one of these names, causing "go bug" to overwrite the target of the symlink.
Problem types: description: CWE-377: Insecure Temporary File
Affected products: vendor: Go toolchain
product: cmd/go
default_status: unaffected
Credits: lang: en
value: Harshit Gupta (Mr HAX)
Published: 2026-05-07T19:41:18.849Z
CVE-2026-39820 Quadratic string concatentation in consumeComment in net/mail
Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.
Problem types: description: CWE-407: Inefficient Algorithmic Complexity
Affected products: vendor: Go standard library
product: net/mail
default_status: unaffected
Credits: lang: en
value: thatnealpatel
Published: 2026-05-07T19:41:19.854Z
CVE-2026-39821 Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".
Problem types: description: CWE-1289: Improper Validation of Unsafe Equivalence in Input
Affected products: vendor: golang.org/x/net
product: golang.org/x/net/idna
default_status: unaffected
Credits: lang: en
value: KC1zs4 (https://github.com/KC1zs4)
Published: 2026-05-22T15:01:21.462Z
CVE-2026-39823 Bypass of meta content URL escaping causes XSS in html/template
CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the <content> attribute, the escaper would fail to similarly escape it, leading to XSS.
Problem types: description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Go standard library
product: html/template
default_status: unaffected
Credits: lang: en
value: Samy Ghannad
Published: 2026-05-07T19:41:19.524Z
CVE-2026-39824 Invoking  integer overflow in NewNTUnicodeString in golang.org/x/sys/windows
NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.
Problem types: description: CWE-190: Integer Overflow or Wraparound
Affected products: vendor: golang.org/x/sys
product: golang.org/x/sys/windows
default_status: unaffected
Published: 2026-05-22T19:39:47.629Z
CVE-2026-39825 ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil
ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not take ParseQuery's limit on the total number of query parameters (controlled by GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a query parameter that is not visible to the Rewrite function. For example, the query "a1=x&a2=x&...&a10000=x&hidden=y" can forward the parameter "hidden=y" while hiding it from the proxy's Rewrite function.
Problem types: description: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Affected products: vendor: Go standard library
product: net/http/httputil
default_status: unaffected
Published: 2026-05-07T19:41:18.453Z
CVE-2026-39826 Escaper bypass leads to XSS in html/template
If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the <script> block.
Problem types: description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Go standard library
product: html/template
default_status: unaffected
Credits: lang: en
value: Mundur (https://github.com/M0nd0R)
Published: 2026-05-07T19:41:19.138Z
CVE-2026-39827 Invoking  memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh
An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for garbage collection.
Problem types: description: CWE-401: Missing Release of Memory after Effective Lifetime
Affected products: vendor: golang.org/x/crypto
product: golang.org/x/crypto/ssh
default_status: unaffected
Credits: lang: en
value: Ziyan Zhou
Published: 2026-05-22T02:31:27.064Z
CVE-2026-39828 Invoking  bypass of certificate restrictions in golang.org/x/crypto/ssh
When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.
Problem types: description: CWE-863: Incorrect Authorization
Affected products: vendor: golang.org/x/crypto
product: golang.org/x/crypto/ssh
default_status: unaffected
Credits: lang: en
value: NCC Group Cryptography Services, sponsored by Teleport
Published: 2026-05-22T02:31:26.883Z
CVE-2026-39829 Invoking  pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh
The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.
Problem types: description: CWE-1176: Inefficient CPU Computation
Affected products: vendor: golang.org/x/crypto
product: golang.org/x/crypto/ssh
default_status: unaffected
Credits: lang: en
value: NCC Group Cryptography Services, sponsored by Teleport
Published: 2026-05-22T02:31:27.324Z
CVE-2026-39830 Invoking  client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.
Problem types: description: CWE-833: Deadlock
Affected products: vendor: golang.org/x/crypto
product: golang.org/x/crypto/ssh
default_status: unaffected
Credits: lang: en
value: NCC Group Cryptography Services, sponsored by Teleport
Published: 2026-05-22T02:31:27.208Z
CVE-2026-39831 Invoking  bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh
The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a "no-touch-required" extension in Permissions.Extensions from PublicKeyCallback.
Problem types: description: CWE-290: Authentication Bypass by Spoofing
Affected products: vendor: golang.org/x/crypto
product: golang.org/x/crypto/ssh
default_status: unaffected
Credits: lang: en
value: NCC Group Cryptography Services, sponsored by Teleport
Published: 2026-05-22T02:31:27.436Z
CVE-2026-39832 Invoking  agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent
When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.
Problem types: description: CWE-281: Improper Preservation of Permissions
Affected products: vendor: golang.org/x/crypto
product: golang.org/x/crypto/ssh/agent
default_status: unaffected
Credits: lang: en
value: NCC Group Cryptography Services, sponsored by Teleport
Published: 2026-05-22T02:31:26.660Z
CVE-2026-39833 Invoking  key constraints not enforced in golang.org/x/crypto/ssh/agent
The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.
Problem types: description: CWE-358: Improperly Implemented Security Check for Standard
Affected products: vendor: golang.org/x/crypto
product: golang.org/x/crypto/ssh/agent
default_status: unaffected
Credits: lang: en
value: NCC Group Cryptography Services, sponsored by Teleport
Published: 2026-05-22T02:31:26.294Z
CVE-2026-39834 Invoking  infinite loop on large channel writes in golang.org/x/crypto/ssh
When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.
Problem types: description: CWE-190: Integer Overflow or Wraparound
Affected products: vendor: golang.org/x/crypto
product: golang.org/x/crypto/ssh
default_status: unaffected
Credits: lang: en
value: NCC Group Cryptography Services, sponsored by Teleport
Published: 2026-05-22T02:31:27.540Z