rainbutterfly/cve_corpus huggingface dataset:
CVE-2026-21688 iccDEV has Type Confusion in SIccCalcOp::ArgsPushed() at IccProfLib/IccMpeCalc.cpp
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in `SIccCalcOp::ArgsPushed()` at `IccProfLib/IccMpeCalc.cpp`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
cwe_id: CWE-190
description: CWE-190: Integer Overflow or Wraparound
cwe_id: CWE-476
description: CWE-476: NULL Pointer Dereference
cwe_id: CWE-681
description: CWE-681: Incorrect Conversion between Numeric Types
Affected products: vendor: InternationalColorConsortium
product: iccDEV
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2026-01-07T21:43:06.245Z
CVE-2026-21689 iccDEV has Type Confusion in CIccProfileXml::ParseBasic() at IccXML/IccLibXML/IccProfileXml.cpp
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in `CIccProfileXml::ParseBasic()` at `IccXML/IccLibXML/IccProfileXml.cpp`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
cwe_id: CWE-190
description: CWE-190: Integer Overflow or Wraparound
cwe_id: CWE-232
description: CWE-232: Improper Handling of Undefined Values
cwe_id: CWE-476
description: CWE-476: NULL Pointer Dereference
cwe_id: CWE-690
description: CWE-690: Unchecked Return Value to NULL Pointer Dereference
cwe_id: CWE-754
description: CWE-754: Improper Check for Unusual or Exceptional Conditions
Affected products: vendor: InternationalColorConsortium
product: iccDEV
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
version: 3.1
Published: 2026-01-07T21:46:12.392Z
CVE-2026-21690 iccDEV has Type Confusion in CIccTagXmlTagData::ToXml()
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in `CIccTagXmlTagData::ToXml()`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
cwe_id: CWE-457
description: CWE-457: Use of Uninitialized Variable
cwe_id: CWE-475
description: CWE-475: Undefined Behavior for Input to API
Affected products: vendor: InternationalColorConsortium
product: iccDEV
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
version: 3.1
Published: 2026-01-07T21:50:25.822Z
CVE-2026-21691 iccDEV has Type Confusion in CIccTag:IsTypeCompressed()
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in `CIccTag:IsTypeCompressed()`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
cwe_id: CWE-140
description: CWE-140: Improper Neutralization of Delimiters
cwe_id: CWE-476
description: CWE-476: NULL Pointer Dereference
cwe_id: CWE-697
description: CWE-697: Incorrect Comparison
cwe_id: CWE-1025
description: CWE-1025: Comparison Using Wrong Factors
Affected products: vendor: InternationalColorConsortium
product: iccDEV
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
version: 3.1
Published: 2026-01-07T21:53:02.461Z
CVE-2026-21692 iccDEV has Type Confusion in ToXmlCurve() at IccXML/IccLibXML/IccMpeXml.cpp
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in `ToXmlCurve()` at `IccXML/IccLibXML/IccMpeXml.cpp`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
cwe_id: CWE-588
description: CWE-588: Attempt to Access Child of a Non-structure Pointer
cwe_id: CWE-704
description: CWE-704: Incorrect Type Conversion or Cast
cwe_id: CWE-843
description: CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')
Affected products: vendor: InternationalColorConsortium
product: iccDEV
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2026-01-07T21:56:40.528Z
CVE-2026-21693 iccDEV has Type Confusion in CIccSegmentedCurveXml::ToXml() at IccXML/IccLibXML/IccMpeXml.cpp
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in `CIccSegmentedCurveXml::ToXml()` at `IccXML/IccLibXML/IccMpeXml.cpp`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
cwe_id: CWE-681
description: CWE-681: Incorrect Conversion between Numeric Types
cwe_id: CWE-754
description: CWE-754: Improper Check for Unusual or Exceptional Conditions
cwe_id: CWE-843
description: CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')
Affected products: vendor: InternationalColorConsortium
product: iccDEV
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2026-01-07T21:58:57.486Z
CVE-2026-21694 Titra APIs have Improper Access Control
Titra is open source project time tracking software. Versions 0.99.49 and below have Improper Access Control, allowing users to view and edit other users' time entries in private projects they have not been granted access to. This issue is fixed in version 0.99.50.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: kromitgmbh
product: titra
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Published: 2026-01-07T23:10:48.362Z
CVE-2026-21695 Titra API Contains Mass Assignment Vulnerability
Titra is open source project time tracking software. In versions 0.99.49 and below, an API has a Mass Assignment vulnerability which allows authenticated users to inject arbitrary fields into time entries, bypassing business logic controls via the customfields parameter. The affected endpoint uses the JavaScript spread operator (...customfields) to merge user-controlled input directly into the database document. While customfields is validated as an Object type, there is no validation of which keys are permitted inside that object. This allows attackers to overwrite protected fields such as userId, hours, and state. The issue is fixed in version 0.99.50.
Problem types: cwe_id: CWE-915
description: CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
Affected products: vendor: kromitgmbh
product: titra
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Published: 2026-01-07T23:19:01.616Z
CVE-2026-21696 Endless reprocessing/reupload of activity log data due to SQLite max parameters limit not being considered
Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Starting in version 1.7.0 and prior to version 1.12.0, Wings does not consider SQLite max parameter limit when processing activity log entries allowing for low privileged user to trigger a condition that floods the panel with activity records. After Wings sends activity logs to the panel it deletes the processed activity entries from the wings SQLite database. However, it does not consider the max parameter limit of SQLite, 32766 as of SQLite 3.32.0. If wings attempts to delete more than 32766 entries from the SQLite database in one query, it triggers an error (SQL logic error: too many SQL variables (1)) and does not remove any entries from the database. These entries are then indefinitely re-processed and resent to the panel each time the cron runs. By successfully exploiting this vulnerability, an attacker can trigger a situation where wings will keep uploading the same activity data to the panel repeatedly (growing each time to include new activity) until the panels' database server runs out of disk space. Version 1.12.0 fixes the issue.
Problem types: cwe_id: CWE-400
description: CWE-400: Uncontrolled Resource Consumption
Affected products: vendor: pterodactyl
product: wings
Published: 2026-01-19T19:25:43.283Z
CVE-2026-21697 axios4go's Race Condition in Shared HTTP Client Allows Proxy Configuration Leak
axios4go is a Go HTTP client library. Prior to version 0.6.4, a race condition vulnerability exists in the shared HTTP client configuration. The global `defaultClient` is mutated during request execution without synchronization, directly modifying the shared `http.Client`'s `Transport`, `Timeout`, and `CheckRedirect` properties. Impacted applications include that that use axios4go with concurrent requests (multiple goroutines, `GetAsync`, `PostAsync`, etc.), those where different requests use different proxy configurations, and those that handle sensitive data (authentication credentials, tokens, API keys). Version 0.6.4 fixes this issue.
Problem types: cwe_id: CWE-362
description: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Affected products: vendor: rezmoss
product: axios4go
Published: 2026-01-07T22:29:57.393Z
CVE-2026-21708 
A vulnerability allowing a Backup Viewer to perform remote code execution (RCE) as the postgres user.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Veeam
product: Backup and Replication
default_status: unaffected
Published: 2026-03-12T16:26:52.931Z
CVE-2026-21709 
A vulnerability allowing a local attacker with administrator privileges to bypass Windows Driver Signature Enforcement.
Problem types: cwe_id: CWE-77
description: CWE-77 Command Injection - Generic
Affected products: vendor: Veeam
product: Backup and Replication
default_status: unaffected
vendor: Veeam
product: Software Appliance
default_status: unaffected
Published: 2026-04-17T15:32:10.755Z
CVE-2026-21710 
A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`.

When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`.

* This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x**
Affected products: vendor: nodejs
product: node
default_status: unaffected
Published: 2026-03-30T19:07:28.558Z
CVE-2026-21711 
A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them.

As a result, code running under `--permission` without `--allow-net` can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary.

This vulnerability affects Node.js **25.x** processes using the Permission Model where `--allow-net` is intentionally omitted to restrict network access. Note that `--allow-net` is currently an experimental feature.
Affected products: vendor: nodejs
product: node
default_status: unaffected
Published: 2026-03-30T19:07:28.526Z
CVE-2026-21712 
A flaw in Node.js URL processing causes an assertion failure in native code when `url.format()` is called with a malformed internationalized domain name (IDN) containing invalid characters, crashing the Node.js process.
Affected products: vendor: nodejs
product: node
default_status: unaffected
Published: 2026-03-30T15:13:59.172Z
CVE-2026-21713 
A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information proportional to the number of matching bytes. Under certain threat models where high-resolution timing measurements are possible, this behavior could be exploited as a timing oracle to infer HMAC values.

Node.js already provides timing-safe comparison primitives used elsewhere in the codebase, indicating this is an oversight rather than an intentional design decision.

This vulnerability affects **20.x, 22.x, 24.x, and 25.x**.
Affected products: vendor: nodejs
product: node
default_status: unaffected
Published: 2026-03-30T19:07:28.356Z
CVE-2026-21714 
A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum value of 2³¹-1. The server correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up.

This vulnerability affects HTTP2 users on Node.js 20, 22, 24 and 25.
Affected products: vendor: nodejs
product: node
default_status: unaffected
Published: 2026-03-30T19:07:28.317Z
CVE-2026-21715 
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them.

As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync.native()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.

This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-read` is intentionally restricted.
Affected products: vendor: nodejs
product: node
default_status: unaffected
Published: 2026-03-30T19:07:28.507Z
CVE-2026-21716 
An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while their callback-based equivalents (`fs.fchmod()`, `fs.fchown()`) were correctly patched.

As a result, code running under `--permission` with restricted `--allow-fs-write` can still use promise-based `FileHandle` methods to modify file permissions and ownership on already-open file descriptors, bypassing the intended write restrictions.

This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-write` is intentionally restricted.
Affected products: vendor: nodejs
product: node
default_status: unaffected
Published: 2026-03-30T19:07:28.538Z
CVE-2026-21717 
A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process.

The most common trigger is any endpoint that calls `JSON.parse()` on attacker-controlled input, as JSON parsing automatically internalizes short strings into the affected hash table.

This vulnerability affects **20.x, 22.x, 24.x, and 25.x**.
Affected products: vendor: nodejs
product: node
default_status: unaffected
Published: 2026-03-30T19:07:28.415Z
CVE-2026-21718 Copeland XWEB and XWEB Pro Use of a Broken or Risky Cryptographic Algorithm
An authentication bypass vulnerability exists in Copeland XWEB Pro 
version 1.12.1 and prior, enabling any attackers to bypass the 
authentication requirement and achieve pre-authenticated code execution 
on the system.
Problem types: cwe_id: CWE-327
description: CWE-327
Affected products: vendor: Copeland
product: Copeland XWEB 300D PRO
default_status: unaffected
vendor: Copeland
product: Copeland XWEB 500D PRO
default_status: unaffected
vendor: Copeland
product: Copeland XWEB 500B PRO
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Amir Zaltzman and Noam Moshe of Claroty Team82 reported this vulnerability to CISA.
Published: 2026-02-27T00:34:55.895Z
CVE-2026-21719 
An OS command injection vulnerability exists in CubeCart prior to 6.6.0, which may allow a user with an administrative privilege to execute an arbitrary OS command.
Problem types: cwe_id: CWE-78
description: Improper neutralization of special elements used in an OS command ('OS Command Injection')
Affected products: vendor: CubeCart Limited
product: CubeCart
Published: 2026-04-17T04:33:17.708Z
CVE-2026-21720 Unauthenticated DoS: avatar cache leaks goroutines when /avatar/:hash requests time out
Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that goroutine blocks forever trying to send on an unbuffered channel. Sustained traffic with random hashes keeps tripping this timeout, so goroutine count grows linearly, eventually exhausting memory and causing Grafana to crash on some systems.
Affected products: vendor: Grafana
product: grafana/grafana-enterprise
default_status: unaffected
vendor: Grafana
product: grafana/grafana-enterprise
default_status: unaffected
vendor: Grafana
product: grafana/grafana-enterprise
default_status: unaffected
vendor: Grafana
product: grafana/grafana
default_status: unaffected
vendor: Grafana
product: grafana/grafana
default_status: unaffected
vendor: Grafana
product: grafana/grafana
default_status: unaffected
vendor: Grafana
product: grafana/grafana-enterprise
default_status: unaffected
vendor: Grafana
product: grafana/grafana
default_status: unaffected
vendor: Grafana
product: grafana/grafana-enterprise
default_status: unaffected
vendor: Grafana
product: grafana/grafana
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 7.5
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: 2026-01-27T09:07:04.758Z
CVE-2026-21721 Dashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege Escalation
The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege escalation.
Affected products: vendor: Grafana
product: grafana/grafana
default_status: unaffected
vendor: Grafana
product: grafana/grafana
default_status: unaffected
vendor: Grafana
product: grafana/grafana
default_status: unaffected
vendor: Grafana
product: grafana/grafana
default_status: unaffected
vendor: Grafana
product: grafana/grafana
default_status: unaffected
vendor: Grafana
product: grafana/grafana-enterprise
default_status: unaffected
vendor: Grafana
product: grafana/grafana-enterprise
default_status: unaffected
vendor: Grafana
product: grafana/grafana-enterprise
default_status: unaffected
vendor: Grafana
product: grafana/grafana-enterprise
default_status: unaffected
vendor: Grafana
product: grafana/grafana-enterprise
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 8.1
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Published: 2026-01-27T09:07:55.160Z
CVE-2026-21722 Public Dashboards time range restriction on annotations can be bypassed
Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visible on the specific dashboard, even those outside the locked timerange.

This did not leak any annotations that would not otherwise be visible on the public dashboard.
Affected products: vendor: Grafana
product: grafana/grafana
default_status: unaffected
vendor: Grafana
product: grafana/grafana-enterprise
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 5.3
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Published: 2026-02-12T08:49:05.678Z
CVE-2026-21724 Missing Protected-field Authorization in Provisioning Contact Points API
A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission.
Affected products: vendor: Grafana
product: Grafana OSS
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 5.4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Published: 2026-03-26T20:06:18.829Z