rainbutterfly/cve_corpus huggingface dataset:
CVE-2026-3184 Util-linux: util-linux: access control bypass due to improper hostname canonicalization
A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.
Problem types: cwe_id: CWE-289
description: Authentication Bypass by Alternate Name
Affected products: vendor: Red Hat
product: Red Hat Hardened Images
cpes: cpe:/a:redhat:hummingbird:1
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 10
cpes: cpe:/o:redhat:enterprise_linux:10
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 7
cpes: cpe:/o:redhat:enterprise_linux:7
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/o:redhat:enterprise_linux:8
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/o:redhat:enterprise_linux:9
default_status: unaffected
vendor: Red Hat
product: Red Hat OpenShift Container Platform 4
cpes: cpe:/a:redhat:openshift:4
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.7
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Published: 2026-04-03T18:43:45.725Z
CVE-2026-3185 feiyuchuixue sz-boot-parent API Endpoint sys-message authorization
A vulnerability was found in feiyuchuixue sz-boot-parent up to 1.3.2-beta. Affected is an unknown function of the file /api/admin/sys-message/ of the component API Endpoint. The manipulation of the argument messageId results in authorization bypass. The attack can be launched remotely. The exploit has been made public and could be used. Upgrading to version 1.3.3-beta is able to address this issue. The patch is identified as aefaabfd7527188bfba3c8c9eee17c316d094802. The affected component should be upgraded. The project was informed beforehand and acted very professional: "We have implemented message ownership verification, so that users can only query messages related to themselves."
Problem types: cwe_id: CWE-639
description: Authorization Bypass
cwe_id: CWE-285
description: Improper Authorization
Affected products: vendor: feiyuchuixue
product: sz-boot-parent
CVSS v3.1: version: 3.1
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
baseSeverity: MEDIUM
Credits: lang: en
value: yuccun (VulDB User)
Published: 2026-02-25T13:32:09.902Z
CVE-2026-3186 feiyuchuixue sz-boot-parent Password Reset password default password
A vulnerability was determined in feiyuchuixue sz-boot-parent up to 1.3.2-beta. Affected by this vulnerability is an unknown functionality of the file /api/admin/sys-user/reset/password/ of the component Password Reset Handler. This manipulation of the argument userId causes use of default password. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.3.3-beta addresses this issue. Patch name: aefaabfd7527188bfba3c8c9eee17c316d094802. It is suggested to upgrade the affected component. The project was informed beforehand and acted very professional: "We have added authorization validation to the password reset interface; now only users with the corresponding permissions are allowed to perform password resets."
Problem types: cwe_id: CWE-1393
description: Use of Default Password
Affected products: vendor: feiyuchuixue
product: sz-boot-parent
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
baseSeverity: MEDIUM
Credits: lang: en
value: yuccun (VulDB User)
Published: 2026-02-25T13:32:12.352Z
CVE-2026-3187 feiyuchuixue sz-boot-parent API Endpoint upload unrestricted upload
A vulnerability was identified in feiyuchuixue sz-boot-parent up to 1.3.2-beta. Affected by this issue is some unknown functionality of the file /api/admin/sys-file/upload of the component API Endpoint. Such manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit is publicly available and might be used. Upgrading to version 1.3.3-beta can resolve this issue. The name of the patch is aefaabfd7527188bfba3c8c9eee17c316d094802. Upgrading the affected component is recommended. The project was informed beforehand and acted very professional: "We have introduced a whitelist restriction on the /api/admin/sys-file/upload endpoint via the oss.allowedExts and oss.allowedMimeTypes configuration options, allowing the specification of permitted file extensions and MIME types for uploads."
Problem types: cwe_id: CWE-434
description: Unrestricted Upload
cwe_id: CWE-284
description: Improper Access Controls
Affected products: vendor: feiyuchuixue
product: sz-boot-parent
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
baseSeverity: MEDIUM
Credits: lang: en
value: yuccun (VulDB User)
Published: 2026-02-25T14:32:09.116Z
CVE-2026-3188 feiyuchuixue sz-boot-parent API templates path traversal
A security flaw has been discovered in feiyuchuixue sz-boot-parent up to 1.3.2-beta. This affects an unknown part of the file /api/admin/common/download/templates of the component API. Performing a manipulation of the argument templateName results in path traversal. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.3.3-beta is able to mitigate this issue. The patch is named aefaabfd7527188bfba3c8c9eee17c316d094802. It is recommended to upgrade the affected component. The project was informed beforehand and acted very professional: "We have implemented path validity checks on parameters for the template download interface (...)"
Problem types: cwe_id: CWE-22
description: Path Traversal
Affected products: vendor: feiyuchuixue
product: sz-boot-parent
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
baseSeverity: MEDIUM
Credits: lang: en
value: yuccun (VulDB User)
Published: 2026-02-25T15:32:09.025Z
CVE-2026-3189 feiyuchuixue sz-boot-parent download server-side request forgery
A weakness has been identified in feiyuchuixue sz-boot-parent up to 1.3.2-beta. This vulnerability affects unknown code of the file /api/admin/common/files/download. Executing a manipulation of the argument url can lead to server-side request forgery. The attack can be executed remotely. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. Upgrading to version 1.3.3-beta is able to resolve this issue. This patch is called aefaabfd7527188bfba3c8c9eee17c316d094802. Upgrading the affected component is advised. The project was informed beforehand and acted very professional: "We have added a URL protocol whitelist validation to the file download interface, allowing only http and https protocols."
Problem types: cwe_id: CWE-918
description: Server-Side Request Forgery
Affected products: vendor: feiyuchuixue
product: sz-boot-parent
CVSS v3.1: version: 3.1
baseScore: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C
baseSeverity: LOW
Credits: lang: en
value: yuccun (VulDB User)
Published: 2026-02-25T16:02:09.732Z
CVE-2026-3190 Keycloak: keycloak: information disclosure via improper role enforcement in uma 2.0 protection api
A flaw was found in Keycloak. The User-Managed Access (UMA) 2.0 Protection API endpoint for permission tickets fails to enforce the `uma_protection` role check. This allows any authenticated user with a token issued for a resource server client, even without the `uma_protection` role, to enumerate all permission tickets in the system. This vulnerability partial leads to information disclosure.
Problem types: cwe_id: CWE-280
description: Improper Handling of Insufficient Permissions or Privileges
Affected products: vendor: Red Hat
product: Red Hat build of Keycloak 26.4
cpes: cpe:/a:redhat:build_keycloak:26.4::el9
default_status: affected
vendor: Red Hat
product: Red Hat build of Keycloak 26.4
cpes: cpe:/a:redhat:build_keycloak:26.4::el9
default_status: affected
vendor: Red Hat
product: Red Hat build of Keycloak 26.4
cpes: cpe:/a:redhat:build_keycloak:26.4::el9
default_status: affected
vendor: Red Hat
product: Red Hat build of Keycloak 26.4.11
cpes: cpe:/a:redhat:build_keycloak:26.4::el9
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Red Hat would like to thank Evan Hendra (Independent Security Researcher) for reporting this issue.
Published: 2026-03-26T19:12:38.438Z
CVE-2026-3191 Minify HTML <= 2.1.12 - Cross-Site Request Forgery to Plugin Settings Update
The Minify HTML plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.12. This is due to missing or incorrect nonce validation on the 'minify_html_menu_options' function. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: teckel
product: Minify HTML
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
baseScore: 5.4
baseSeverity: MEDIUM
Credits: lang: en
value: Osvaldo Noe Gonzalez Del Rio
Published: 2026-03-31T11:18:56.726Z
CVE-2026-3192 Chia Blockchain RPC Credential rpc_server_base.py _authenticate improper authentication
A security vulnerability has been detected in Chia Blockchain 2.1.0. This issue affects the function _authenticate of the file rpc_server_base.py of the component RPC Credential Handler. The manipulation leads to improper authentication. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is assessed as difficult. The exploit has been disclosed publicly and may be used. The vendor was informed early via email. A separate report via bugbounty was rejected with the reason "This is by design. The user is responsible for host security".
Problem types: cwe_id: CWE-287
description: Improper Authentication
Affected products: vendor: Chia
product: Blockchain
CVSS v3.1: version: 3.1
baseScore: 5.6
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Published: 2026-02-25T16:02:12.515Z
CVE-2026-3193 Chia Blockchain send_transaction cross-site request forgery
A vulnerability was detected in Chia Blockchain 2.1.0. Impacted is an unknown function of the file /send_transaction. The manipulation results in cross-site request forgery. The attack may be performed from remote. The attack requires a high level of complexity. The exploitability is considered difficult. The exploit is now public and may be used. The vendor was informed early via email. A separate report via bugbounty was rejected with the reason "This is by design. The user is responsible for host security".
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery
cwe_id: CWE-862
description: Missing Authorization
Affected products: vendor: Chia
product: Blockchain
CVSS v3.1: version: 3.1
baseScore: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
baseSeverity: LOW
Published: 2026-02-25T16:32:08.589Z
CVE-2026-3194 Chia Blockchain RPC Server Master Passphrase get_private_key missing authentication
A flaw has been found in Chia Blockchain 2.1.0. The affected element is the function send_transaction/get_private_key of the component RPC Server Master Passphrase Handler. This manipulation causes missing authentication. The attack can only be executed locally. The attack's complexity is rated as high. The exploitability is described as difficult. The exploit has been published and may be used. The vendor was informed early via email. A separate report via bugbounty was rejected with the reason "This is by design. The user is responsible for host security".
Problem types: cwe_id: CWE-306
description: Missing Authentication
cwe_id: CWE-287
description: Improper Authentication
Affected products: vendor: Chia
product: Blockchain
CVSS v3.1: version: 3.1
baseScore: 4.5
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: DeSneake (VulDB User)
Published: 2026-02-25T17:02:17.420Z
CVE-2026-3198 Improper Access Control in mlflow/mlflow
MLflow 3.9.0 with basic-auth (`--app-name basic-auth`) fails to enforce authorization checks for multiple Gateway API 'list' endpoints. Specifically, the `BEFORE_REQUEST_HANDLERS` dictionary in `mlflow/server/auth/__init__.py` does not include entries for `ListGatewaySecretInfos`, `ListGatewayEndpoints`, and `ListGatewayModelDefinitions`. This allows any authenticated user, regardless of their assigned permissions, to enumerate all gateway secrets, endpoints, and model definitions. This vulnerability exposes sensitive information, such as API keys, endpoint configurations, and proprietary model definitions, to unauthorized users.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: mlflow
product: mlflow/mlflow
Published: 2026-06-02T02:50:47.890Z
CVE-2026-3200 z-9527 admin user.js getUsers sql injection
A vulnerability was identified in z-9527 admin 1.0/2.0. The affected element is the function checkName/register/login/getUser/getUsers of the file /server/controller/user.js. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: z-9527
product: admin
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: VulDB
Published: 2026-02-25T20:02:08.548Z
CVE-2026-3201 Improperly Controlled Sequential Memory Allocation in Wireshark
USB HID protocol dissector memory exhaustion in Wireshark 4.6.0 to 4.6.3 and 4.4.0 to 4.4.13 allows denial of service
Problem types: cwe_id: CWE-1325
description: CWE-1325: Improperly Controlled Sequential Memory Allocation
Affected products: vendor: Wireshark Foundation
product: Wireshark
default_status: unknown
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 4.7
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: 齐柯宇 (Qi Kery)
Published: 2026-02-25T14:35:50.969Z
CVE-2026-3202 NULL Pointer Dereference in Wireshark
NTS-KE protocol dissector crash in Wireshark 4.6.0 to 4.6.3 allows denial of service
Problem types: cwe_id: CWE-476
description: CWE-476: NULL Pointer Dereference
Affected products: vendor: Wireshark Foundation
product: Wireshark
default_status: unknown
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 4.7
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
version: 3.1
Published: 2026-02-25T14:35:55.986Z
CVE-2026-3203 Buffer Over-read in Wireshark
RF4CE Profile protocol dissector crash in Wireshark 4.6.0 to 4.6.3 and 4.4.0 to 4.4.13 allows denial of service
Problem types: cwe_id: CWE-126
description: CWE-126: Buffer Over-read
Affected products: vendor: Wireshark Foundation
product: Wireshark
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
version: 3.1
Published: 2026-02-25T14:36:00.984Z
CVE-2026-3204 
Improper
 input validation in the error message page in Devolutions Server 2025.3.16 and earlier allows remote attackers to spoof the displayed error message via a specially crafted URL.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Devolutions
product: Server
default_status: unaffected
Published: 2026-03-03T21:24:30.044Z
CVE-2026-3206 Improper management of context cancelations
Improper Resource Shutdown or Release vulnerability in KrakenD, SLU KrakenD-CE (CircuitBreaker modules), KrakenD, SLU KrakenD-EE (CircuitBreaker modules). This issue affects KrakenD-CE: before 2.13.1; KrakenD-EE: before 2.12.5.
Problem types: cwe_id: CWE-404
description: CWE-404 Improper Resource Shutdown or Release
Affected products: vendor: KrakenD
product: KrakenD-CE
default_status: unaffected
vendor: KrakenD
product: KrakenD-EE
default_status: unaffected
Published: 2026-02-25T15:12:23.336Z
CVE-2026-3207 TIBCO BPM Enterprise Remote Code Execution (RCE) Vulnerability
Configuration issue in Java Management Extensions (JMX) in TIBCO BPM Enterprise version 4.x allows unauthorised access.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing authentication for critical function
Affected products: vendor: TIBCO
product: TIBCO BPM Enterprise
default_status: unaffected
Published: 2026-03-17T18:20:16.934Z
CVE-2026-3208 Mercado Pago payments for WooCommerce <= 8.7.11 - Missing Authorization to Unauthenticated PIX Payment QR Code Image Disclosure
The Mercado Pago payments for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'mp_pix_image' WooCommerce API endpoint in all versions up to, and including, 8.7.11. This makes it possible for unauthenticated attackers to retrieve PIX payment QR code images for arbitrary orders. PIX QR codes contain sensitive merchant information including PIX keys (which may be CPF/CNPJ personal identifiers), transaction amounts, merchant name and city, and MercadoPago transaction references.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: mercadopago
product: Mercado Pago payments for WooCommerce
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
baseScore: 5.3
baseSeverity: MEDIUM
Credits: lang: en
value: Muhammad Sharief
Published: 2026-05-06T03:27:21.276Z
CVE-2026-3209 fosrl Pangolin Role verifyApiKeyRoleAccess access control
A vulnerability has been found in fosrl Pangolin up to 1.15.4-s.3. This affects the function verifyRoleAccess/verifyApiKeyRoleAccess of the component Role Handler. The manipulation leads to improper access controls. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Upgrading to version 1.15.4-s.4 mitigates this issue. The identifier of the patch is 5e37c4e85fae68e756be5019a28ca903b161fdd5. Upgrading the affected component is advised.
Problem types: cwe_id: CWE-284
description: Improper Access Controls
cwe_id: CWE-266
description: Incorrect Privilege Assignment
Affected products: vendor: fosrl
product: Pangolin
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
baseSeverity: MEDIUM
Credits: lang: en
value: h3nrrrych4u (VulDB User)
lang: en
value: h3nrrrych4u (VulDB User)
Published: 2026-02-25T23:02:10.115Z
CVE-2026-3210 Material Icons - Moderately critical - Access bypass - SA-CONTRIB-2026-011
Incorrect Authorization vulnerability in Drupal Material Icons allows Forceful Browsing.This issue affects Material Icons: from 0.0.0 before 2.0.4.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Drupal
product: Material Icons
default_status: unaffected
Credits: lang: en
value: Jen M (jannakha)
lang: en
value: Bryan Sharpe (b_sharpe)
lang: en
value: Jen M (jannakha)
lang: en
value: Damien McKenna (damienmckenna)
lang: en
value: Greg Knaddison (greggles)
lang: en
value: Juraj Nemec (poker10)
lang: en
value: Ra MÃ¤nd (ram4nd)
lang: en
value: Jess  (xjm)
Published: 2026-03-25T15:21:43.470Z
CVE-2026-3211 Theme Negotiation by Rules - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-012
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Theme Negotiation by Rules allows Cross Site Request Forgery.This issue affects Theme Negotiation by Rules: from 0.0.0 before 1.2.1.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Drupal
product: Theme Negotiation by Rules
default_status: unaffected
Credits: lang: en
value: Juraj Nemec (poker10)
lang: en
value: Zoltan Attila Horvath (huzooka)
lang: en
value: Juraj Nemec (poker10)
lang: en
value: Damien McKenna (damienmckenna)
lang: en
value: Greg Knaddison (greggles)
lang: en
value: Juraj Nemec (poker10)
lang: en
value: Jess  (xjm)
Published: 2026-03-25T15:21:53.456Z
CVE-2026-3212 Tagify - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-013
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Tagify allows Cross-Site Scripting (XSS).This issue affects Tagify: from 0.0.0 before 1.2.49.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")
Affected products: vendor: Drupal
product: Tagify
default_status: unaffected
Credits: lang: en
value: David LÃ³pez (akalam)
lang: en
value: Mingsong  (mingsong)
lang: en
value: David LÃ³pez (akalam)
lang: en
value: David Galeano (gxleano)
lang: en
value: Mingsong  (mingsong)
lang: en
value: Damien McKenna (damienmckenna)
lang: en
value: Dan Smith (galooph)
lang: en
value: Greg Knaddison (greggles)
lang: en
value: Drew Webber (mcdruid)
lang: en
value: Jess  (xjm)
Published: 2026-03-25T15:22:11.601Z
CVE-2026-3213 Anti-Spam by CleanTalk - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-014
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Anti-Spam by CleanTalk allows Cross-Site Scripting (XSS).This issue affects Anti-Spam by CleanTalk: from 0.0.0 before 9.7.0.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")
Affected products: vendor: Drupal
product: Anti-Spam by CleanTalk
default_status: unaffected
Credits: lang: en
value: Drew Webber (mcdruid)
lang: en
value: glomberg
lang: en
value: Drew Webber (mcdruid)
lang: en
value: sergefcleantalk
lang: en
value: Damien McKenna (damienmckenna)
lang: en
value: Greg Knaddison (greggles)
lang: en
value: Drew Webber (mcdruid)
lang: en
value: Juraj Nemec (poker10)
lang: en
value: Jess  (xjm)
Published: 2026-03-25T15:22:26.583Z