rainbutterfly/cve_corpus huggingface dataset:
CVE-2026-23898 Joomla! Core - [20260305] - Arbitrary file deletion in com_joomlaupdate
Lack of input validation leads to an arbitrary file deletion vulnerability in the autoupdate server mechanism.
Problem types: cwe_id: CWE-73
description: CWE-73 Destructive File Deletion and Potential System Compromise
Affected products: vendor: Joomla! Project
product: Joomla! CMS
default_status: unaffected
Credits: lang: en
value: Phil Taylor
Published: 2026-04-01T09:03:40.185Z
CVE-2026-23899 Joomla! Core - [20260306] - Improper access check in webservice endpoints
An improper access check allows unauthorized access to webservice endpoints.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Joomla! Project
product: Joomla! CMS
default_status: unaffected
Credits: lang: en
value: vnth4nhnt from CyStack
Published: 2026-04-01T09:03:18.563Z
CVE-2026-23900 Extension - phoca.cz - Stored XSS vectors in Phoca Maps component 5.0.0 - 6.0.2 for Joomla
Various stored XSS vulnerabilities in the maps- and icon rendering logic in Phoca Maps component 5.0.0-6.0.2 have been discovered.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: phoca.cz
product: phoca.cz - Phoca Maps for Joomla
default_status: unaffected
Credits: lang: en
value: Felipe Monteiro
lang: en
value: Leandro Vallim
Published: 2026-04-11T12:52:12.525Z
CVE-2026-23901 Apache Shiro: Brute force attack possible to determine valid user names
Observable Timing Discrepancy vulnerability in Apache Shiro.

This issue affects Apache Shiro: from 1.*, 2.* before 2.0.7.

Users are recommended to upgrade to version 2.0.7 or later, which fixes the issue.

Prior to Shiro 2.0.7, code paths for non-existent vs. existing users are different enough,
that a brute-force attack may be able to tell, by timing the requests only, determine if
the request failed because of a non-existent user vs. wrong password.

The most likely attack vector is a local attack only.
Shiro security model  https://shiro.apache.org/security-model.html#username_enumeration  discusses this as well.

Typically, brute force attack can be mitigated at the infrastructure level.
Problem types: cwe_id: CWE-208
description: CWE-208 Observable Timing Discrepancy
Affected products: vendor: Apache Software Foundation
product: Apache Shiro
default_status: unaffected
Credits: lang: en
value: 4ra1n
lang: en
value: Y4tacker
lang: en
value: lprimak
Published: 2026-02-10T09:25:51.765Z
CVE-2026-23902 Apache DolphinScheduler: Users are able to use tenants that are not defined on the platform during workflow execution.
Incorrect Authorization vulnerability in Apache DolphinScheduler allows authenticated users with system login permissions to use tenants that are not defined on the platform during workflow execution.

This issue affects Apache DolphinScheduler versions prior to 3.4.1. 

Users are recommended to upgrade to version 3.4.1, which fixes this issue.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Apache Software Foundation
product: Apache DolphinScheduler
default_status: unaffected
Credits: lang: en
value: Jihang Yu
Published: 2026-04-24T10:56:18.289Z
CVE-2026-23903 Apache Shiro: Auth bypass when accessing static files only on case-insensitive filesystems
Authentication Bypass by Alternate Name vulnerability in Apache Shiro.

This issue affects Apache Shiro: before 2.0.7.

Users are recommended to upgrade to version 2.0.7, which fixes the issue.

The issue only effects static files. If static files are served from a case-insensitive filesystem,
such as default macOS setup, static files may be accessed by varying the case of the filename in the request.
If only lower-case (common default) filters are present in Shiro, they may be bypassed this way.

Shiro 2.0.7 and later has a new parameters to remediate this issue
shiro.ini: filterChainResolver.caseInsensitive = true
application.propertie: shiro.caseInsensitive=true

Shiro 3.0.0 and later (upcoming) makes this the default.
Problem types: cwe_id: CWE-289
description: CWE-289 Authentication Bypass by Alternate Name
Affected products: vendor: Apache Software Foundation
product: Apache Shiro
default_status: unaffected
Credits: lang: en
value: Jesse Yang
lang: en
value: Lenny Pimak
Published: 2026-02-09T09:26:21.772Z
CVE-2026-23906 Apache Druid: Authentication Bypass via LDAP Anonymous Bind
Affected Products and Versions
  *  Apache Druid
  *  Affected Versions: 0.17.0 through 35.x (all versions prior to 36.0.0)
  *  Prerequisites:  *  druid-basic-security extension enabled
  *  LDAP authenticator configured
  *  Underlying LDAP server permits anonymous bind                                                                                                                                                   






Vulnerability Description

An authentication bypass vulnerability exists in Apache Druid when using the druid-basic-security extension with LDAP authentication. If the underlying LDAP server is configured to allow anonymous
binds, an attacker can bypass authentication by providing an existing username with an empty password. This allows unauthorized access to otherwise restricted Druid resources without valid credentials.

The vulnerability stems from improper validation of LDAP authentication responses when anonymous binds are permitted, effectively treating anonymous bind success as valid user authentication. 

Impact

A remote, unauthenticated attacker can:
  *  Gain unauthorized access to the Apache Druid cluster
  *  Access sensitive data stored in Druid datasources
  *  Execute queries and potentially manipulate data
  *  Access administrative interfaces if the bypassed account has elevated privileges
  *  Completely compromise the confidentiality, integrity, and availability of the Druid deployment                                                                                                                                                                                    


Mitigation
 
Immediate Mitigation (No Druid Upgrade Required):                                                                                                                                                    
  *  Disable anonymous bind on your LDAP server. This prevents the vulnerability from being exploitable and is the recommended immediate action.



Resolution
  *  Upgrade Apache Druid to version 36.0.0 or later, which includes fixes to properly reject anonymous LDAP bind attempts.
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: Apache Software Foundation
product: Apache Druid
default_status: unaffected
Published: 2026-02-10T09:28:09.007Z
CVE-2026-23907 Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code
This issue affects the 
ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6.


The ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because 
the filename that is obtained from 
PDComplexFileSpecification.getFilename() is appended to the extraction path.

Users who have copied this example into their production code should 
review it to ensure that the extraction path is acceptable. The example 
has been changed accordingly, now the initial path and the extraction 
paths are converted into canonical paths and it is verified that 
extraction path contains the initial path. The documentation has also 
been adjusted.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Apache Software Foundation
product: Apache PDFBox Examples
default_status: unaffected
Credits: lang: en
value: Joakim Bülow (Neo4j Security Team)
Published: 2026-03-10T09:43:40.384Z
CVE-2026-23918 Apache HTTP Server: http2: double free and possible RCE on early reset
Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol.

This issue affects Apache HTTP Server: 2.4.66.

Users are recommended to upgrade to version 2.4.67, which fixes the issue.
Problem types: cwe_id: CWE-415
description: CWE-415 Double Free
Affected products: vendor: Apache Software Foundation
product: Apache HTTP Server
default_status: unaffected
Credits: lang: en
value: Bartlomiej Dmitruk, striga.ai
lang: en
value: Stanislaw Strzalkowski, isec.pl
Published: 2026-05-04T14:44:28.513Z
CVE-2026-23919 Insufficient isolation of JavaScript (Duktape) execution context on Zabbix Server
For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessing, Webhooks). This can lead to confidentiality loss where a regular (non-super) Zabbix administrator leaks data for hosts they do not have access to. A fix has been released that makes the built in Zabbix JavaScript objects read-only, but please be advised that usage of global JavaScript variables is not recommended because their content could be leaked. More information <a href='https://www.zabbix.com/documentation/7.4/en/manual/installation/known_issues#preprocessing-global-variables-are-unsafe'>in Zabbix documentation</a>.
Problem types: cwe_id: CWE-488
description: CWE-488: Exposure of Data Element to Wrong Session
Affected products: vendor: Zabbix
product: Zabbix
default_status: unknown
Credits: lang: en
value: Zabbix wants to thank Yerdan (big_john) for submitting this report on the HackerOne bug bounty platform.
Published: 2026-03-24T18:26:43.877Z
CVE-2026-23920 Host and event action script regex validation can be bypassed in certain situations, leading to potential command injection
Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject shell commands.
Problem types: cwe_id: CWE-78
description: CWE-78 CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Zabbix
product: Zabbix
default_status: unknown
Credits: lang: en
value: Zabbix wants to thank YoKo Kho (@YoKoAcc) from PT ITSEC Asia, Tbk for submitting this report on the HackerOne bug bounty platform.
Published: 2026-03-24T18:27:52.882Z
CVE-2026-23921 Blind, read-only SQL injection in Zabbix API via sortfield parameter
A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Although query results are not returned directly, an attacker can exfiltrate arbitrary database data through time-based techniques, potentially leading to session identifier disclosure and administrator account compromise.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Zabbix
product: Zabbix
default_status: unknown
Credits: lang: en
value: Zabbix wants to thank SeaWind for submitting this report on the HackerOne bug bounty platform.
Published: 2026-03-24T18:28:41.491Z
CVE-2026-23923 Unauthenticated arbitrary PHP class instantiation
An unauthenticated attacker can exploit the Frontend 'validate' action to blindly instantiate arbitrary PHP classes. The impact depends on environment setup but appears limited at this time.
Problem types: cwe_id: CWE-470
description: CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Affected products: vendor: Zabbix
product: Zabbix
default_status: unknown
Credits: lang: en
value: Zabbix wants to thank pitticus for submitting this report on the HackerOne bug bounty platform.
Published: 2026-03-24T18:29:23.165Z
CVE-2026-23924 Agent 2 Docker plugin arbitrary file read via Docker API injection
Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon. An attacker capable of invoking Agent 2 can read arbitrary files from running Docker containers by injecting them via the Docker archive API.
Problem types: cwe_id: CWE-88
description: CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Affected products: vendor: Zabbix
product: Zabbix
default_status: unknown
Credits: lang: en
value: Zabbix wants to thank kelsier from clocktwice.com for submitting this report on the HackerOne bug bounty platform.
Published: 2026-03-24T18:30:00.615Z
CVE-2026-23925 Unauthorized host creation via configuration.import API by low-privilege user with write permissions
An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API. This can lead to confidentiality loss by creating unauthorized hosts. Note that the User role is normally not sufficient to create and edit templates/hosts even with write permissions.
Problem types: cwe_id: CWE-863
description: CWE-863: Incorrect Authorization
Affected products: vendor: Zabbix
product: Zabbix
default_status: unknown
Published: 2026-03-06T08:24:15.428Z
CVE-2026-23926 Stored XSS vulnerability in Host navigator widget maintenance tooltip
An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user that opens tooltip for that maintenance period in the Host navigator widget. This can allow the attacker to perform unauthorized actions depending on which user opens the tooltip.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Zabbix
product: Zabbix
default_status: unknown
Credits: lang: en
value: Zabbix wants to thank Daniel Santos (@bananabr) for submitting this report on the HackerOne bug bounty platform.
Published: 2026-05-06T06:58:51.362Z
CVE-2026-23927 Agent 2 Oracle plugin TNS connection string injection via the 'service' parameter
A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter. This can lead to Agent 2 connecting to an attacker-controlled server and leaking Oracle database credentials if they are saved in a named session.
Problem types: cwe_id: CWE-522
description: CWE-522: Insufficiently Protected Credentials
Affected products: vendor: Zabbix
product: Zabbix
default_status: unknown
Credits: lang: en
value: Zabbix wants to thank kelsier from clocktwice.com for submitting this report on the HackerOne bug bounty platform.
Published: 2026-05-06T06:59:42.854Z
CVE-2026-23928 Stored XSS vulnerability in the Item history/Plain text widget
The Item history widget (in Zabbix 7.0+) or the Plain text widget (in Zabbix 6.0) can execute injected JavaScript when HTML display is enabled. This can allow an attacker to perform unauthorized actions depending on which user opens a dashboard containing these widgets. The malicious JavaScript would have to come from a monitored host controlled by the attacker. Note: the Item history widget is a replacement for the Plain text widget since Zabbix 7.0.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Zabbix
product: Zabbix
default_status: unknown
Published: 2026-05-06T07:00:33.681Z
CVE-2026-23939 Path Traversal in Local File Store Backend
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Store.Local' module) allows Relative Path Traversal. This vulnerability is associated with program files lib/hexpm/store/local.ex and program routines 'Elixir.Hexpm.Store.Local':get/3, 'Elixir.Hexpm.Store.Local':put/4, 'Elixir.Hexpm.Store.Local':delete/2, 'Elixir.Hexpm.Store.Local':delete_many/2.

This issue does NOT affect hex.pm the service. Only self-hosted deployments using the Local Storage backend are affected.

This issue affects hexpm: from 931ee0ed46fa89218e0400a4f6e6d15f96406050 before 5d2ccd2f14f45a63225a73fb5b1c937baf36fdc0.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: hexpm
product: hexpm
cpes: cpe:2.3:a:hexpm:hexpm:*:*:*:*:*:*:*:*
default_status: unaffected
Credits: lang: en
value: Michael Lubas / Paraxial.io
lang: en
value: Jonatan Männchen / EEF
lang: en
value: Eric Meadows-Jönsson / Hex.pm
Published: 2026-02-26T19:41:18.762Z
CVE-2026-23940 Denial of Service via Oversized Package Upload
Uncontrolled Resource Consumption vulnerability in hexpm hexpm/hexpm allows Excessive Allocation. Publishing an oversized package can cause Hex.pm to run out of memory while extracting the uploaded package tarball. This can terminate the affected application instance and result in a denial of service for package publishing and potentially other package-processing functionality.

This issue affects hexpm: before 495f01607d3eae4aed7ad09b2f54f31ec7a7df01; hex.pm: before 2026-03-10.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: hexpm
product: hexpm
cpes: cpe:2.3:a:hexpm:hexpm:*:*:*:*:*:*:*:*
default_status: affected
vendor: hexpm
product: hex.pm
default_status: unaffected
Credits: lang: en
value: Joud Zakharia / zentrust partners GmbH
lang: en
value: Eric Meadows-Jönsson / Hex.pm
Published: 2026-03-13T16:07:53.328Z
CVE-2026-23941 Request smuggling via first-wins Content-Length parsing in inets httpd
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smuggling.

This vulnerability is associated with program files lib/inets/src/http_server/httpd_request.erl and program routines httpd_request:parse_headers/7.

The server does not reject or normalize duplicate Content-Length headers. The earliest Content-Length in the request is used for body parsing while common reverse proxies (nginx, Apache httpd, Envoy) honor the last Content-Length value. This violates RFC 9112 Section 6.3 and allows front-end/back-end desynchronization, leaving attacker-controlled bytes queued as the start of the next request.

This issue affects OTP from OTP 17.0 until OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to inets from 5.10 until 9.6.1, 9.3.2.3 and 9.1.0.5.
Problem types: cwe_id: CWE-444
description: CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
Affected products: vendor: Erlang
product: OTP
cpes: cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
default_status: unknown
vendor: Erlang
product: OTP
cpes: cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
default_status: unknown
Credits: lang: en
value: Luigino Camastra / Aisle Research
lang: en
value: Konrad Pietrzak
Published: 2026-03-13T09:11:58.175Z
CVE-2026-23942 SFTP root escape via component-agnostic prefix check in ssh_sftpd
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal.

This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:is_within_root/2.

The SFTP server uses string prefix matching via lists:prefix/2 rather than proper path component validation when checking if a path is within the configured root directory. This allows authenticated users to access sibling directories that share a common name prefix with the configured root directory. For example, if root is set to /home/user1, paths like /home/user10 or /home/user1_backup would incorrectly be considered within the root.

This issue affects OTP from OTP 17.0 until OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to ssh from 3.0.1 until 5.5.1, 5.2.11.6 and 5.1.4.14.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Erlang
product: OTP
cpes: cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
default_status: unknown
vendor: Erlang
product: OTP
cpes: cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
default_status: unknown
Credits: lang: en
value: Luigino Camastra / Aisle Research
lang: en
value: Jakub Witczak
lang: en
value: Michał Wąsowski
Published: 2026-03-13T09:11:56.424Z
CVE-2026-23943 Pre-auth SSH DoS via unbounded zlib inflate
Improper Handling of Highly Compressed Data (Compression Bomb) vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial of Service via Resource Depletion.

The SSH transport layer advertises legacy zlib compression by default and inflates attacker-controlled payloads pre-authentication without any size limit, enabling reliable memory exhaustion DoS.

Two compression algorithms are affected:

* zlib: Activates immediately after key exchange, enabling unauthenticated attacks
* zlib@openssh.com: Activates post-authentication, enabling authenticated attacks

Each SSH packet can decompress ~255 MB from 256 KB of wire data (1029:1 amplification ratio). Multiple packets can rapidly exhaust available memory, causing OOM kills in memory-constrained environments.

This vulnerability is associated with program files lib/ssh/src/ssh_transport.erl and program routines ssh_transport:decompress/2, ssh_transport:handle_packet_part/4.

This issue affects OTP from OTP 17.0 until OTP 28.4.1, 27.3.4.9 and 26.2.5.18 corresponding to ssh from 3.0.1 until 5.5.1, 5.2.11.6 and 5.1.4.14.
Problem types: cwe_id: CWE-409
description: CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)
Affected products: vendor: Erlang
product: OTP
cpes: cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
default_status: unknown
vendor: Erlang
product: OTP
cpes: cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
default_status: unknown
Credits: lang: en
value: Igor Morgenstern / Aisle Research
lang: en
value: Michał Wąsowski
lang: en
value: Jakub Witczak
Published: 2026-03-13T09:11:57.794Z
CVE-2026-23944 Arcane allows unauthenticated proxy access to remote environments
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to version 1.13.2, unauthenticated requests could be proxied to remote environment agents, allowing access to remote environment resources without authentication. The environment proxy middleware handled `/api/environments/{id}/...` requests for remote environments before authentication was enforced. When the environment ID was not local, the middleware proxied the request and attached the manager-held agent token, even if the caller was unauthenticated. This enabled unauthenticated access to remote environment operations (e.g., listing containers, streaming logs, or other agent endpoints). An unauthenticated attacker could access and manipulate remote environment resources via the proxy, potentially leading to data exposure, unauthorized changes, or service disruption. Version 1.13.2 patches the vulnerability.
Problem types: cwe_id: CWE-306
description: CWE-306: Missing Authentication for Critical Function
Affected products: vendor: getarcaneapp
product: arcane
Published: 2026-01-19T21:16:08.193Z