rainbutterfly/cve_corpus huggingface dataset:
CVE-2026-9038 Stack-based buffer overflow in XCharge C6
A stack-based buffer overflow vulnerability in the charging controller’s signal-processing logic allows an attacker with physical access to the charging interface to supply message fields that exceed expected bounds. Because the input is not sufficiently validated, memory corruption may occur, which can lead to execution of unauthorized code with elevated privileges.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based buffer overflow
Affected products: vendor: XCharge
product: C6
default_status: unaffected
Credits: lang: en
value: Lionel R. Saposnik of SaiFlow reported these vulnerabilities to CISA.
Published: 2026-05-28T19:05:45.306Z
CVE-2026-9039 Initialization of a resource with an insecure default in XCharge C6
A configuration weakness in the device’s remote management service allows an authenticated session to be established over a communication channel intended solely for vehicle-charger signaling. The service is accessible on interfaces exposed through the charging connector, and it accepts a default administrative credential. A malicious device physically connected to the charging interface could leverage this misconfiguration to obtain full administrative access.
Problem types: cwe_id: CWE-1188
description: CWE-1188 Initialization of a resource with an insecure default
Affected products: vendor: XCharge
product: C6
default_status: unaffected
Credits: lang: en
value: Lionel R. Saposnik of SaiFlow reported these vulnerabilities to CISA.
Published: 2026-05-28T19:07:09.065Z
CVE-2026-9047 
Improper handling of factor key state in the multi-factor authentication management feature in Devolutions Server allows an attacker with knowledge of a user's password to bypass the user's multi-factor authentication after the user reconfigures their factors.

This issue affects :

  *  Devolutions Server 2026.1.6.0 through 2026.1.16.0
Problem types: cwe_id: CWE-305
description: CWE-305 Authentication bypass by primary weakness
Affected products: vendor: Devolutions
product: Server
default_status: unaffected
Published: 2026-05-22T15:18:39.966Z
CVE-2026-9048 Slider Revolution 7.0.0 - 7.0.14 - Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure
The Slider Revolution plugin for WordPress is vulnerable to Sensitive Information Exposure in versions 7.0.0 - 7.0.14, via the 'slider.get.full' AJAX Action. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including raw social media API credentials: the Instagram OAuth token, Flickr API key, YouTube Data API key, and Facebook App ID, stored in any configured slider's settings.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Revolution Slider
product: Slider Revolution
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Prickly Cactus
Published: 2026-06-01T23:28:27.185Z
CVE-2026-9050 Slider Revolution 6.0.0-6.7.55 and 7.0.0-7.0.14 - Missing Authorization to Authenticated (Contributor+) Arbitrary Plugin Deactivation
The Slider Revolution plugin for WordPress in versions 6.0.0-6.7.55 and 7.0.0-7.0.14 is vulnerable to unauthorized modification of data. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Contributor-level access and above, to deactivate any active plugin installed on the site.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Revolution Slider
product: Slider Revolution
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Nguyen Ngoc Duc
Published: 2026-06-01T23:28:26.606Z
CVE-2026-9051 Authentication Bypass Vulnerability in NI SystemLink Enterprise
There is an authentication bypass vulnerability in the NI SystemLink Enterprise Dashboard application that may allow an unauthenticated remote attacker to bypass authentication controls leading to privilege escalation or information disclosure.  Successful exploitation requires an attacker to send a specially crafted HTTP request.  This vulnerability affects NI SystemLink Enterprise 2026-04 and prior versions.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing authentication for critical function
Affected products: vendor: NI
product: SystemLink Enterprise
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
baseSeverity: CRITICAL
baseScore: 9.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Published: 2026-05-29T18:04:48.703Z
CVE-2026-9053 
Mothra would respect a default value given by a website for HTML file upload forms. An attacker could craft a website with a malicious default file path, and then conceal this form element.
Affected products: vendor: 9front
product: 9front
default_status: unaffected
Credits: lang: en
value: Kristo
lang: en
value: Kristo
lang: en
value: Jacob Moody
lang: en
value: Kristo
lang: en
value: cinap_lenrek
Published: 2026-05-22T02:57:35.162Z
CVE-2026-9054 Invalid IP packets cause a kernel panic
An attacker sending tcp, il, rudp, rudp, or gre packets with a length less than the header size would trigger a kernel panic.
Affected products: vendor: 9front
product: 9front
default_status: unaffected
Published: 2026-05-22T03:21:49.646Z
CVE-2026-9056 Security fix for Qlik Talend Administration Center cross-site scripting vulnerability
A stored cross-site scripting vulnerability has been found in the Talend Administration Center. An attacker with permission to manage servers can store a XSS payload that can be triggered by a different user.
Problem types: description: CWE-94: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Talend
product: Talend Administration Center
default_status: affected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
baseScore: 5.4
baseSeverity: MEDIUM
Credits: lang: en
value: Ahsan
Published: 2026-05-20T04:35:39.031Z
CVE-2026-9057 Security fix for Qlik Talend Administration Center URL access control vulnerability
A broken access control issue has been identified in the Talend Administration Center, that allows a user with “View” permission to modify the Talend Studio update URL. This issue was resolved in a patch, which is already available.
Problem types: description: CWE-284: Improper Access Control
Affected products: vendor: Talend
product: Talend Administration Center
default_status: affected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
baseScore: 8.2
baseSeverity: HIGH
Credits: lang: en
value: Kaushik Roy
Published: 2026-05-20T04:39:38.619Z
CVE-2026-9058 Improper Certificate Verification in Szafir SDK
Szafir SDK returns a success status code from the cryptographic digital signature verification process (i.e. /VerifyingTaskItem/Signature/VerificationResult/Result/@code == 0, "Positively verified") even when the trust status of the signer's certificate could not be established (i.e. /VerifyingTaskItem/Signature/VerificationResult/SigningCertificate/@certificateType == "nondetermined"). This causes consuming applications to incorrectly treat the signature as valid despite an unverified certificate chain, enabling authentication bypass and user impersonation.

This issue was fixed in version 463.
Problem types: cwe_id: CWE-637
description: CWE-637 Unnecessary Complexity in Protection Mechanism (Not Using 'Economy of Mechanism')
cwe_id: CWE-393
description: CWE-393: Return of Wrong Status Code
Affected products: vendor: Krajowa Izba Rozliczeniowa
product: Szafir SDK
default_status: unaffected
Credits: lang: en
value: Michał Leszczyński (icedev.pl)
Published: 2026-05-25T13:23:09.157Z
CVE-2026-9059 NextGEN Gallery - SQL Injection
NextGEN Gallery version prior to 4.2.1 are vulnerable to authenticated SQL injection via the 'orderby' parameter on the REST API endpoints '/imagely/v1/galleries' and '/imagely/v1/albums'.



The root cause is an insufficient sanitization function ('_clean_column()') in the data mapper layer that uses a character blacklist instead of a whitelist approach. This allows an authenticated attacker with the 'NextGEN Gallery overview' capability (assigned to the Administrator role by default) to inject arbitrary SQL into the 'ORDER BY' clause.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection')
Affected products: vendor: awesomemotive
product: NextGEN Gallery
default_status: unaffected
Published: 2026-05-20T07:41:28.135Z
CVE-2026-9064 389-ds-base: 389-ds-base: unbounded ldap controls count in get_ldapmessage_controls_ext() causes cpu and heap amplification (remote dos)
A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function in the LDAP server does not enforce an upper bound on the number of controls per LDAP message. A remote, unauthenticated attacker can send a specially crafted LDAP request containing hundreds of thousands of minimal controls within the default maximum BER message size (2 MB), causing excessive CPU consumption and heap allocation on the server. Under concurrent exploitation, this leads to significant latency degradation, worker thread starvation, or out-of-memory termination, resulting in a denial of service.
Problem types: cwe_id: CWE-770
description: Allocation of Resources Without Limits or Throttling
Affected products: vendor: Red Hat
product: Red Hat Directory Server 11
cpes: cpe:/a:redhat:directory_server:11
default_status: affected
vendor: Red Hat
product: Red Hat Directory Server 12
cpes: cpe:/a:redhat:directory_server:12
default_status: affected
vendor: Red Hat
product: Red Hat Directory Server 13
cpes: cpe:/a:redhat:directory_server:13
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 10
cpes: cpe:/o:redhat:enterprise_linux:10
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 6
cpes: cpe:/o:redhat:enterprise_linux:6
default_status: unknown
vendor: Red Hat
product: Red Hat Enterprise Linux 7
cpes: cpe:/o:redhat:enterprise_linux:7
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/o:redhat:enterprise_linux:8
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/o:redhat:enterprise_linux:9
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Red Hat would like to thank Oleh Konko (1seal.org) for reporting this issue.
Published: 2026-05-20T09:00:42.557Z
CVE-2026-9065 Surecart - SQL Injection
SureCart version prior to 4.2.1 are vulnerable to authenticated SQL injection via multiple parameters ('model_name', 'model_id', 'integration_id', 'provider') on the REST API endpoint '/surecart/v1/integrations/{id}'.

The root cause is a flawed escaping bypass in the query builder ('wp-query-builder'). Values passed to the 'where()' method are only sanitized via '$wpdb->prepare()' when they do **not** contain a dot ('.') or the WordPress table prefix ('wp_'). By including a dot anywhere in the payload, an attacker completely bypasses the escaping logic and injects arbitrary SQL into the 'WHERE' clause, allowing full UNION-based extraction of the database.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection')
Affected products: vendor: brainstormforce
product: Surecart
default_status: unaffected
Published: 2026-05-20T08:23:55.218Z
CVE-2026-9078 Firefox iOS RTL Domain Rendering Issue in Link Preview
Firefox for iOS displayed specially crafted right-to-left (RTL) and internationalized domain names (IDNs) incorrectly in link preview UI surfaces. A crafted RTL hostname could visually reorder portions of the displayed domain, causing attacker-controlled sites to appear as trusted origins. This vulnerability was fixed in Firefox for iOS 151.1.
Affected products: vendor: Mozilla
product: Firefox for iOS
Credits: lang: en
value: Barath Stalin K
Published: 2026-05-25T14:05:47.780Z
CVE-2026-9082 Drupal core - Highly critical - SQL injection - SA-CORE-2026-004
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection.

This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Drupal
product: Drupal core
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Credits: lang: en
value: Michael Maturi (michaelmaturi)
lang: en
value: Björn Brala (bbrala)
lang: en
value: Benji Fisher (benjifisher)
lang: en
value: catch (catch)
lang: en
value: Lee Rowlands (larowlan)
lang: en
value: Dave Long (longwave)
lang: en
value: Drew Webber (mcdruid)
lang: en
value: Jess  (xjm)
lang: en
value: Anna Kalata (akalata)
lang: en
value: Benji Fisher (benjifisher)
lang: en
value: catch (catch)
lang: en
value: Damien McKenna (damienmckenna)
lang: en
value: Neil Drumm (drumm)
lang: en
value: Greg Knaddison (greggles)
lang: en
value: Heine Deelstra (heine)
lang: en
value: Tim Hestenes Lehnen (hestenet)
lang: en
value: Dave Long (longwave)
lang: en
value: Drew Webber (mcdruid)
lang: en
value: Juraj Nemec (poker10)
lang: en
value: Pierre Rudloff (prudloff)
lang: en
value: Jess  (xjm)
lang: en
value: Cathy Theys (yesct)
Published: 2026-05-20T18:20:52.863Z
CVE-2026-9084 MISP OIDC authentication bypass via automatic email-based account linking under insecure IdP configurations
MISP’s OIDC authentication plugin allowed automatic linking of an OIDC identity to an existing local user account based on the email claim when the local account had no stored sub value. Under insecure or untrusted IdP configurations where email ownership is not enforced, an attacker with a valid OIDC token could assert a victim’s email address and authenticate as that user, leading to account takeover.
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: misp
product: misp
default_status: unaffected
Credits: lang: en
value: Ali Ganiyev
lang: en
value: Luciano Righetti
Published: 2026-05-20T14:22:59.019Z
CVE-2026-9087 Keycloak: cross-session email verification proof not bound to upstream identity in first-broker-login
A flaw was found in Keycloak. The cross-session verification proof is keyed only by (local userId,
idpAlias) and is not bound to the upstream identity that was actually verified, so a second upstream account on the same IdP can consume it and get linked to the victim's local account.
Problem types: cwe_id: CWE-639
description: Authorization Bypass Through User-Controlled Key
Affected products: vendor: Red Hat
product: Red Hat Build of Keycloak
cpes: cpe:/a:redhat:build_keycloak:
default_status: affected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
version: 3.1
Published: 2026-05-20T16:13:03.022Z
CVE-2026-9088 Keycloak: keycloak: information disclosure due to user profile permission bypass
A flaw was found in org.keycloak.services. An administrator with delegated access to read group memberships and users can bypass user profile permissions by accessing the group members endpoint. This allows the administrator to view user attributes that are explicitly configured to be denied, leading to information disclosure.
Problem types: cwe_id: CWE-1220
description: Insufficient Granularity of Access Control
Affected products: vendor: Red Hat
product: Red Hat Build of Keycloak
cpes: cpe:/a:redhat:build_keycloak:
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 2.7
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Red Hat would like to thank Hadley So for reporting this issue.
Published: 2026-06-05T07:52:52.858Z
CVE-2026-9089 
The ConnectWise Automate™ Agent does not fully verify the authenticity of components obtained during plugin loading and self-update operations. This issue is addressed in Automate 2026.5.
Problem types: cwe_id: CWE-494
description: CWE-494 Download of code without integrity check
Affected products: vendor: ConnectWise
product: Automate
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: ADJACENT_NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: 2026-05-21T14:32:14.029Z
CVE-2026-9090 CVE-2026-9090
Casdoor versions 2.362.0 and earlier contain a vulnerability that allows an attacker to bypass authentication by supplying an arbitrary signing certificate. The buildSpCertificateStore function extracts the X.509 certificate directly from the incoming SAMLResponse instead of using the trusted pre-configured Identity Provider certificate, allowing an attacker to forge assertions signed with an attacker-controlled key.
Problem types: description: CWE-347 Improper Verification of Cryptographic Signature
Affected products: vendor: Casdoor
product: Casdoor
Published: 2026-05-28T16:17:21.953Z
CVE-2026-9091 CVE-2026-9091
Casdoor versions 2.362.0 and earlier contain a logic flaw in the social‑login binding flow that allows users to bypass configured MFA requirements. The binding‑rule code path in controllers/auth.go calls HandleLoggedIn directly without invoking checkMfaEnable. Any user authenticating via this path is logged in without MFA enforcement.
Problem types: description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: Casdoor
product: Casdoor
Published: 2026-05-28T16:19:39.239Z
CVE-2026-9092 CVE-2026-9092
Casdoor versions 2.362.0 and earlier contain a vulnerability involving unverified email binding that may enable account takeover. The getExistUserByBindingRule function matches users by email without checking the email_verified claim from upstream providers; the idp.UserInfo struct does not even include a EmailVerified field. An attacker can supply an unverified email claim from an upstream provider to take over accounts that use the same email address.
Problem types: description: CWE-290 Authentication Bypass by Spoofing
Affected products: vendor: Casdoor
product: Casdoor
Published: 2026-05-28T16:20:45.547Z
CVE-2026-9093 CVE-2026-9093
In Casdoor versions 2.362.0 and earlier, the SAML service provider implementation does not validate the AudienceRestriction element in SAML assertions. The buildSp function in object/saml_sp.go never sets AudienceURI on the gosaml2 SAMLServiceProvider struct and never inspects WarningInfo.NotInAudience. This allows assertions issued for other service providers to be accepted by Casdoor.
Problem types: description: CWE-863 Incorrect Authorization
Affected products: vendor: Casdoor
product: Casdoor
Published: 2026-05-28T16:21:50.192Z
CVE-2026-9094 CVE-2026-9094
Casdoor versions 2.362.0 and earlier contain a vulnerability enabling cross-organization token exchange. The GetTokenExchangeToken function in object/token_oauth.go validates JWT signatures but does not verify that the token's user belongs to the same organization as the target application. This can result in privilege escalation across organizational boundaries.
Problem types: description: CWE-284 Improper Access Control
Affected products: vendor: Casdoor
product: Casdoor
Published: 2026-05-28T16:25:09.055Z
CVE-2026-9095 CVE-2026-9095
Casdoor versions 2.362.0 and earlier map SAML assertions to user sessions without replay protection. The ParseSamlResponse() function in object/saml_sp.go calls sp.RetrieveAssertionInfo() and immediately maps the result to a user session. There is no assertion ID cache, OneTimeUse condition enforcement, or replay detection anywhere in the SAML SP code path. As a result, an attacker can replay a previously captured SAML assertion to obtain an authenticated session for the assertion’s subject, including administrator accounts, without needing the user’s password or MFA credentials.
Problem types: description: CWE-294 Authentication Bypass by Capture-replay
Affected products: vendor: Casdoor
product: Casdoor
Published: 2026-05-28T16:25:17.364Z
CVE-2026-9096 CVE-2026-9096
Casdoor versions 2.362.0 and earlier do not enforce SAML assertion time bounds. The gosaml2 library reports all time-validation results, including NotOnOrAfter and NotBefore, in the assertionInfo.WarningInfo field. However, ParseSamlResponse() never reads this field, meaning that time bounds are computed by the library but silently discarded before the user session is issued.
Problem types: description: CWE-613 Insufficient Session Expiration
Affected products: vendor: Casdoor
product: Casdoor
Published: 2026-05-28T16:27:15.206Z
CVE-2026-9097 CVE-2026-9097
Casdoor versions 2.362.0 and earlier do not verify that a JWT used for token exchange is still active. The GetTokenExchangeToken() function in object/token_oauth.go validates the JWT signature and parses its claims, but never queries the Token table to verify whether the subject token has been revoked or invalidated. Because the revocation check is entirely absent, administrators are unable to terminate active sessions or revoke compromised tokens.
Problem types: description: CWE-613 Insufficient Session Expiration
Affected products: vendor: Casdoor
product: Casdoor
Published: 2026-05-28T16:29:06.752Z
CVE-2026-9098 CVE-2026-9098
In Casdoor versions 2.362.0 and earlier, the SAML callback handler in controllers/auth.go accepts any well-formed SAMLResponse sent to /api/acs without verifying that it corresponds to an AuthnRequest previously issued by Casdoor. Additionally, if an administrator disables or deletes an IdP (Identity Provider) after a SAML flow has started, the handler still processes the response using the provider snapshot loaded at the start of the request. As a result, an attacker controlling a registered upstream IdP can send unsolicited SAML responses, or replay a legitimately captured response in a different session or after the original flow has ended. In both cases, Casdoor accepts the response and issues a session, enabling persistent unauthorized access.
Problem types: description: CWE-346 Origin Validation Error
Affected products: vendor: Casdoor
product: Casdoor
Published: 2026-05-28T16:31:42.767Z