rainbutterfly/cve_corpus huggingface dataset:
CVE-2026-20662 
An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.4, macOS Tahoe 26.3. An attacker with physical access to a locked device may be able to view sensitive user information.
Problem types: description: An attacker with physical access to a locked device may be able to view sensitive user information
Affected products: vendor: Apple
product: macOS
Published: 2026-02-11T22:58:47.157Z
CVE-2026-20663 
The issue was resolved by sanitizing logging. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3. An app may be able to enumerate a user's installed apps.
Problem types: description: An app may be able to enumerate a user's installed apps
Affected products: vendor: Apple
product: iOS and iPadOS
Published: 2026-02-11T22:58:32.467Z
CVE-2026-20664 
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.4, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. Processing maliciously crafted web content may lead to an unexpected process crash.
Problem types: description: Processing maliciously crafted web content may lead to an unexpected process crash
Affected products: vendor: Apple
product: Safari
vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: visionOS
Published: 2026-03-25T00:32:56.673Z
CVE-2026-20665 
This issue was addressed through improved state management. This issue is fixed in Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. Processing maliciously crafted web content may prevent Content Security Policy from being enforced.
Problem types: description: Processing maliciously crafted web content may prevent Content Security Policy from being enforced
Affected products: vendor: Apple
product: Safari
vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: tvOS
vendor: Apple
product: visionOS
vendor: Apple
product: watchOS
Published: 2026-03-25T00:32:50.032Z
CVE-2026-20666 
An authorization issue was addressed with improved state management. This issue is fixed in macOS Tahoe 26.3. An app may be able to access sensitive user data.
Problem types: description: An app may be able to access sensitive user data
Affected products: vendor: Apple
product: macOS
Published: 2026-02-11T22:58:08.903Z
CVE-2026-20667 
A logic issue was addressed with improved checks. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3, watchOS 26.3. An app may be able to break out of its sandbox.
Problem types: description: An app may be able to break out of its sandbox
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: watchOS
Published: 2026-02-11T22:58:03.531Z
CVE-2026-20668 
A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.3, visionOS 26.3. An app may be able to access sensitive user data.
Problem types: description: An app may be able to access sensitive user data
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: visionOS
Published: 2026-03-25T00:35:39.282Z
CVE-2026-20669 
A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Tahoe 26.3. An app may be able to access sensitive user data.
Problem types: description: An app may be able to access sensitive user data
Affected products: vendor: Apple
product: macOS
Published: 2026-02-11T22:58:51.771Z
CVE-2026-20670 
An authorization issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14.8.4, macOS Tahoe 26.3. An app may be able to access sensitive user data.
Problem types: description: An app may be able to access sensitive user data
Affected products: vendor: Apple
product: macOS
Published: 2026-03-25T00:31:41.236Z
CVE-2026-20671 
A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, watchOS 26.3. An attacker in a privileged network position may be able to intercept network traffic.
Problem types: description: An attacker in a privileged network position may be able to intercept network traffic
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: tvOS
vendor: Apple
product: visionOS
vendor: Apple
product: watchOS
Published: 2026-02-11T22:58:07.124Z
CVE-2026-20673 
A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3. Turning off "Load remote content in messages” may not apply to all mail previews.
Problem types: description: Turning off "Load remote content in messages” may not apply to all mail previews
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
Published: 2026-02-11T22:58:57.191Z
CVE-2026-20674 
A privacy issue was addressed by removing sensitive data. This issue is fixed in iOS 26.3 and iPadOS 26.3. An attacker with physical access to a locked device may be able to view sensitive user information.
Problem types: description: An attacker with physical access to a locked device may be able to view sensitive user information
Affected products: vendor: Apple
product: iOS and iPadOS
Published: 2026-02-11T22:58:49.968Z
CVE-2026-20675 
The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, watchOS 26.3. Processing a maliciously crafted image may lead to disclosure of user information.
Problem types: description: Processing a maliciously crafted image may lead to disclosure of user information
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: tvOS
vendor: Apple
product: visionOS
vendor: Apple
product: watchOS
Published: 2026-02-11T22:58:29.051Z
CVE-2026-20676 
This issue was addressed through improved state management. This issue is fixed in Safari 26.3, iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, visionOS 26.3. A website may be able to track users through Safari web extensions.
Problem types: description: A website may be able to track users through Safari web extensions
Affected products: vendor: Apple
product: Safari
vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: visionOS
Published: 2026-02-11T22:58:25.537Z
CVE-2026-20677 
A race condition was addressed with improved handling of symbolic links. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Sonoma 14.8.4, macOS Tahoe 26.3, visionOS 26.3. A shortcut may be able to bypass sandbox restrictions.
Problem types: description: A shortcut may be able to bypass sandbox restrictions
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: visionOS
Published: 2026-02-11T22:58:18.222Z
CVE-2026-20678 
An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3. An app may be able to access sensitive user data.
Problem types: description: An app may be able to access sensitive user data
Affected products: vendor: Apple
product: iOS and iPadOS
Published: 2026-02-11T22:58:43.562Z
CVE-2026-20680 
The issue was addressed with additional restrictions on the observability of app states. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3. A sandboxed app may be able to access sensitive user data.
Problem types: description: A sandboxed app may be able to access sensitive user data
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
Published: 2026-02-11T22:58:35.657Z
CVE-2026-20681 
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Tahoe 26.3. An app may be able to access information about a user's contacts.
Problem types: description: An app may be able to access information about a user's contacts
Affected products: vendor: Apple
product: macOS
Published: 2026-02-11T22:58:42.753Z
CVE-2026-20682 
A logic issue was addressed with improved state management. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3. An attacker may be able to discover a user’s deleted notes.
Problem types: description: An attacker may be able to discover a user’s deleted notes
Affected products: vendor: Apple
product: iOS and iPadOS
Published: 2026-02-11T22:58:20.954Z
CVE-2026-20684 
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.4. An app may bypass Gatekeeper checks.
Problem types: description: An app may bypass Gatekeeper checks
Affected products: vendor: Apple
product: macOS
Published: 2026-03-25T00:31:32.329Z
CVE-2026-20685 
An attacker in a privileged network position may be able to leak sensitive information. A path handling issue was addressed with improved validation. This issue is fixed in PCC Release 5E290.3.
Problem types: description: An attacker in a privileged network position may be able to leak sensitive information.
Affected products: vendor: Apple
product: Private Cloud Compute Server Software
Published: 2026-05-18T15:19:09.205Z
CVE-2026-20686 
This issue was addressed with improved input validation. This issue is fixed in iOS 26.3 and iPadOS 26.3. An app may be able to access sensitive user data.
Problem types: description: An app may be able to access sensitive user data
Affected products: vendor: Apple
product: iOS and iPadOS
Published: 2026-03-25T00:32:44.824Z
CVE-2026-20687 
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Tahoe 26.4, tvOS 26.4, watchOS 26.4. An app may be able to cause unexpected system termination or write kernel memory.
Problem types: description: An app may be able to cause unexpected system termination or write kernel memory
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: tvOS
vendor: Apple
product: watchOS
Published: 2026-03-25T00:35:38.526Z
CVE-2026-20688 
A path handling issue was addressed with improved validation. This issue is fixed in iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, visionOS 26.4. An app may be able to break out of its sandbox.
Problem types: description: An app may be able to break out of its sandbox
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: visionOS
Published: 2026-03-25T00:31:39.949Z
CVE-2026-20690 
An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. Processing an audio stream in a maliciously crafted media file may terminate the process.
Problem types: description: Processing an audio stream in a maliciously crafted media file may terminate the process
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: tvOS
vendor: Apple
product: visionOS
vendor: Apple
product: watchOS
Published: 2026-03-25T00:32:41.721Z
CVE-2026-20691 
An authorization issue was addressed with improved state management. This issue is fixed in Safari 26.4, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4, watchOS 26.4. A maliciously crafted webpage may be able to fingerprint the user.
Problem types: description: A maliciously crafted webpage may be able to fingerprint the user
Affected products: vendor: Apple
product: Safari
vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: visionOS
vendor: Apple
product: watchOS
Published: 2026-03-25T00:35:42.624Z
CVE-2026-20692 
A privacy issue was addressed with improved handling of user preferences. This issue is fixed in iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. "Hide IP Address" and "Block All Remote Content" may not apply to all mail content.
Problem types: description: "Hide IP Address" and "Block All Remote Content" may not apply to all mail content
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
Published: 2026-03-25T00:31:35.596Z
CVE-2026-20693 
This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An attacker with root privileges may be able to delete protected system files.
Problem types: description: An attacker with root privileges may be able to delete protected system files
Affected products: vendor: Apple
product: macOS
Published: 2026-03-25T00:31:46.947Z
CVE-2026-20694 
This issue was addressed with improved handling of symlinks. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.4, macOS Sonoma 14.8.5, macOS Tahoe 26.3, macOS Tahoe 26.4. An app may be able to access user-sensitive data.
Problem types: description: An app may be able to access user-sensitive data
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
Published: 2026-03-25T00:32:02.873Z
CVE-2026-20695 
An information disclosure issue was addressed with improved memory management. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to determine kernel memory layout.
Problem types: description: An app may be able to determine kernel memory layout
Affected products: vendor: Apple
product: macOS
Published: 2026-03-25T00:32:04.806Z
CVE-2026-20696 
An authorization issue was addressed with improved state management. This issue is fixed in macOS Tahoe 26.4. An app may be able to access sensitive user data.
Problem types: description: An app may be able to access sensitive user data
Affected products: vendor: Apple
product: macOS
Published: 2026-05-11T20:08:22.800Z
CVE-2026-20697 
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to access sensitive user data.
Problem types: description: An app may be able to access sensitive user data
Affected products: vendor: Apple
product: macOS
Published: 2026-03-25T00:32:33.989Z
CVE-2026-20698 
The issue was addressed with improved memory handling. This issue is fixed in iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. An app may be able to cause unexpected system termination or corrupt kernel memory.
Problem types: description: An app may be able to cause unexpected system termination or corrupt kernel memory
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: tvOS
vendor: Apple
product: visionOS
vendor: Apple
product: watchOS
Published: 2026-03-25T00:31:57.939Z
CVE-2026-20699 
A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.3, macOS Tahoe 26.4. An app may be able to access user-sensitive data.
Problem types: description: An app may be able to access user-sensitive data
Affected products: vendor: Apple
product: macOS
Published: 2026-03-25T00:32:09.424Z
CVE-2026-20700 
A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, watchOS 26.3. An attacker with memory write capability may be able to execute arbitrary code. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 and CVE-2025-43529 were also issued in response to this report.
Problem types: description: An attacker with memory write capability may be able to execute arbitrary code. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 and CVE-2025-43529 were also issued in response to this report.
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: tvOS
vendor: Apple
product: visionOS
vendor: Apple
product: watchOS
Published: 2026-02-11T22:58:54.448Z
CVE-2026-20701 
An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to connect to a network share without user consent.
Problem types: description: An app may be able to connect to a network share without user consent
Affected products: vendor: Apple
product: macOS
Published: 2026-03-25T00:35:37.169Z
CVE-2026-20704 
Cross-site request forgery vulnerability exists in ELECOM wireless LAN products. If a user accesses a malicious page while logged-in to the affected product, unintended operations may be performed.
Problem types: cwe_id: CWE-352
description: Cross-site request forgery (CSRF)
Affected products: vendor: ELECOM CO.,LTD.
product: WRC-X1500GS-B
vendor: ELECOM CO.,LTD.
product: WRC-X1500GSA-B
vendor: ELECOM CO.,LTD.
product: WRC-X3000GS2-B
vendor: ELECOM CO.,LTD.
product: WRC-X3000GS2-W
vendor: ELECOM CO.,LTD.
product: WRC-X3000GS2A-B
vendor: ELECOM CO.,LTD.
product: WRC-X3000GST2-B
vendor: ELECOM CO.,LTD.
product: WRC-X1800GS-B
vendor: ELECOM CO.,LTD.
product: WRC-X1800GSA-B
vendor: ELECOM CO.,LTD.
product: WRC-X1800GSH-B
vendor: ELECOM CO.,LTD.
product: WRC-X6000QS-G
vendor: ELECOM CO.,LTD.
product: WRC-X6000QSA-G
vendor: ELECOM CO.,LTD.
product: WRC-X6000XS-G
vendor: ELECOM CO.,LTD.
product: WRC-X6000XST-G
vendor: ELECOM CO.,LTD.
product: WRC-XE5400GS-G
vendor: ELECOM CO.,LTD.
product: WRC-XE5400GSA-G
Published: 2026-02-03T06:56:42.019Z
CVE-2026-20709 
Use of Default Cryptographic Key in the hardware for some Intel(R) Pentium(R) Processor Silver Series, Intel(R) Celeron(R) Processor J Series, Intel(R) Celeron(R) Processor N Series may allow an escalation of privilege. Hardware reverse engineer adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via physical access when attack requirements are present with special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (none) impacts.
Problem types: description: Escalation of Privilege
cwe_id: CWE-1394
description: Use of Default Cryptographic Key
Affected products: vendor: n/a
product: Intel(R) Pentium(R) Processor Silver Series, Intel(R) Celeron(R) Processor J Series, Intel(R) Celeron(R) Processor N Series may allow an escalation of privilege. Hardware reverse engineer adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via physical access when attack requirements are present with special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (none) impacts.
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.6
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N
attackVector: PHYSICAL
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
Published: 2026-04-08T18:20:48.374Z
CVE-2026-20711 
Cross-site scripting vulnerability exists in E-mail function of Cybozu Garoon 5.0.0 to 6.0.3, which may allow an attacker to reset arbitrary users’ passwords.
Problem types: cwe_id: CWE-79
description: Cross-site scripting (XSS)
Affected products: vendor: Cybozu, Inc.
product: Cybozu Garoon
Published: 2026-02-02T06:37:05.017Z
CVE-2026-20714 
Out-of-bounds write for some Intel(R) QAT software drivers for Windows before version 1.13 within Ring 3: User Applications may allow a escalation of privilege. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Problem types: description: Escalation of Privilege
cwe_id: CWE-787
description: Out-of-bounds Write
Affected products: vendor: n/a
product: Intel(R) QAT software drivers for Windows
default_status: unaffected
Published: 2026-05-12T17:31:55.276Z
CVE-2026-20717 
Improper input validation for some Intel(R) QAT software drivers for Windows before version 1.13 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Problem types: description: Denial of Service
cwe_id: CWE-20
description: Improper Input Validation
Affected products: vendor: n/a
product: Intel(R) QAT software drivers for Windows
default_status: unaffected
Published: 2026-05-12T16:34:23.835Z
CVE-2026-20718 
Incorrect default permissions for some Intel(R) NPU Driver software installers before version 32.0.100.4511 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Problem types: description: Escalation of Privilege
cwe_id: CWE-276
description: Incorrect Default Permissions
Affected products: vendor: n/a
product: Intel(R) NPU Driver software installers
default_status: unaffected
Published: 2026-05-12T16:34:26.444Z