rainbutterfly/cve_corpus huggingface dataset:
CVE-2026-25796 ImageMagick has memory leak of watermark Image object in ReadSTEGANOImage on multiple error/early-return paths
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, in `ReadSTEGANOImage()` (`coders/stegano.c`), the `watermark` Image object is not freed on three early-return paths, resulting in a definite memory leak (~13.5KB+ per invocation) that can be exploited for denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
Problem types: cwe_id: CWE-401
description: CWE-401: Missing Release of Memory after Effective Lifetime
Affected products: vendor: ImageMagick
product: ImageMagick
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Published: 2026-02-24T00:57:27.441Z
CVE-2026-25797 ImageMagick vulnerable to Code injection via PostScript header in ps coders
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the ps coders, responsible for writing PostScript files, fails to sanitize the input before writing it into the PostScript header.  An attacker can provide a malicous file and inject arbitrary PostScript code. When the resulting file is processed by a printer or a viewer (like Ghostscript), the injected code is interpreted and executed. The html encoder does not properly escape strings that are written to in the html document. An attacker can provide a malicious file and injection arbitrary html code. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
Problem types: cwe_id: CWE-94
description: CWE-94: Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: ImageMagick
product: ImageMagick
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 5.7
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L
version: 3.1
Published: 2026-02-24T01:01:22.025Z
CVE-2026-25798 ImageMagick has NULL Pointer Dereference in ClonePixelCacheRepository via crafted image
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a NULL pointer dereference in ClonePixelCacheRepository allows a remote attacker to crash any application linked against ImageMagick by supplying a crafted image file, resulting in denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
Problem types: cwe_id: CWE-476
description: CWE-476: NULL Pointer Dereference
Affected products: vendor: ImageMagick
product: ImageMagick
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Published: 2026-02-24T01:02:30.911Z
CVE-2026-25799 ImageMagick has Division-by-Zero in YUV sampling factor validation, which leads to crash
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a logic error in YUV sampling factor validation allows an invalid sampling factor to bypass checks and trigger a division-by-zero during image loading, resulting in a reliable denial-of-service. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
Problem types: cwe_id: CWE-369
description: CWE-369: Divide By Zero
Affected products: vendor: ImageMagick
product: ImageMagick
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Published: 2026-02-24T01:05:39.405Z
CVE-2026-25802 New API has Potential XSS in its MarkdownRenderer component
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.10.8-alpha.9, a potential unsafe operation occurs in component `MarkdownRenderer.jsx`, allowing for Cross-Site Scripting(XSS) when the model outputs items containing `<script>` tag. Version 0.10.8-alpha.9 fixes the issue.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: QuantumNous
product: new-api
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.6
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:L
version: 3.1
Published: 2026-02-24T00:42:45.515Z
CVE-2026-25803 3DP-MANAGER Uses Hard-coded Credentials
3DP-MANAGER is an inbound generator for 3x-ui. In version 2.0.1 and prior, the application automatically creates an administrative account with known default credentials (admin/admin) upon the first initialization. Attackers with network access to the application's login interface can gain full administrative control, managing VPN tunnels and system settings. This issue will be patched in version 2.0.2.
Problem types: cwe_id: CWE-798
description: CWE-798: Use of Hard-coded Credentials
Affected products: vendor: denpiligrim
product: 3dp-manager
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2026-02-06T22:52:40.631Z
CVE-2026-25804 Antrea has invalid enforcement order for network policy rules caused by integer overflow
Antrea is a Kubernetes networking solution intended to be Kubernetes native. Prior to versions 2.3.2 and 2.4.3, Antrea's network policy priority assignment system has a uint16 arithmetic overflow bug that causes incorrect OpenFlow priority calculations when handling a large numbers of policies with various priority values. This results in potentially incorrect traffic enforcement. This issue has been patched in versions 2.4.3.
Problem types: cwe_id: CWE-287
description: CWE-287: Improper Authentication
cwe_id: CWE-770
description: CWE-770: Allocation of Resources Without Limits or Throttling
Affected products: vendor: antrea-io
product: antrea
Published: 2026-02-06T22:58:35.041Z
CVE-2026-25805 Zed does not show Parameter Values for MCP Tool Calls. Users cannot detect tool poisoning.
Zed is a multiplayer code editor. Prior to 0.219.4, Zed does not show with which parameters a tool is being invoked, when asking for allowance. Further it does not show after the tool was being invoked, which parameters were used. Thus, maybe unwanted or even malicious values could be used without the user having a chance to notice it. Patched in Zed Editor 0.219.4 which includes expandable tool call details.
Problem types: cwe_id: CWE-356
description: CWE-356: Product UI does not Warn User of Unsafe Actions
Affected products: vendor: zed-industries
product: zed
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2026-02-10T17:27:49.390Z
CVE-2026-25806 PlaciPy has Missing Authorization Checks on Student Management Endpoints (IDOR)
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the GET /api/students/:email
PUT /api/students/:email/status, and DELETE /api/students/:email routes in backend/src/routes/student.routes.ts only enforce authentication using authenticateToken but do not enforce authorization. The application does not verify whether the authenticated user owns the student record being accessed, has an administrative / staff role, or is permitted to modify or delete the target student.
Problem types: cwe_id: CWE-862
description: CWE-862: Missing Authorization
Affected products: vendor: Praskla-Technology
product: assessment-placipy
Published: 2026-02-09T20:48:58.419Z
CVE-2026-25807 Unauthenticated Remote Code Execution via P2P Sharing in ZAI-Shell
ZAI Shell is an autonomous SysOps agent designed to navigate, repair, and secure complex environments. Prior to 9.0.3, the P2P terminal sharing feature (share start) opens a TCP socket on port 5757 without any authentication mechanism. Any remote attacker can connect to this port using a simple socket script. An attacker who connects to a ZAI-Shell P2P session running in --no-ai mode can send arbitrary system commands. If the host user approves the command without reviewing its contents, the command executes directly with the user's privileges, bypassing all Sentinel safety checks. This vulnerability is fixed in 9.0.3.
Problem types: cwe_id: CWE-94
description: CWE-94: Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: TaklaXBR
product: zai-shell
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2026-02-09T21:46:20.164Z
CVE-2026-25808 Hollo DMs get leaked and can be seen on Webfinger Browser
Hollo is a federated single-user microblogging software designed to be federated through ActivityPub. Prior to 0.6.20 and 0.7.2, there is a security vulnerability where DMs and followers-only posts were exposed through the ActivityPub outbox endpoint without authorization. This vulnerability is fixed in 0.6.20 and 0.7.2.
Problem types: cwe_id: CWE-862
description: CWE-862: Missing Authorization
Affected products: vendor: fedify-dev
product: hollo
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2026-02-09T21:50:10.579Z
CVE-2026-25809 PlaciPy Code Execution Allowed Without Assessment Active State Validation
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the code evaluation endpoint does not validate the assessment lifecycle state before allowing execution. There is no check to ensure that the assessment has started, is not expired, or the submission window is currently open.
Problem types: cwe_id: CWE-285
description: CWE-285: Improper Authorization
Affected products: vendor: Praskla-Technology
product: assessment-placipy
Published: 2026-02-09T20:58:09.000Z
CVE-2026-25810 PlaciPy is Missing Object-Level Authorization in student.submission.routes.ts
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the backend/src/routes/student.submission.routes.ts verify authentication but fails to enforce object-level authorization (ownership checks).
Problem types: cwe_id: CWE-862
description: CWE-862: Missing Authorization
Affected products: vendor: Praskla-Technology
product: assessment-placipy
Published: 2026-02-09T20:48:54.070Z
CVE-2026-25811 PlaciPy Email Domain Trust Enables Cross-Tenant Data Access (Multi-Tenant Isolation Failure)
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the application derives the tenant identifier directly from the email domain provided by the user, without validating domain ownership or registration. This allows cross-tenant data access.
Problem types: cwe_id: CWE-863
description: CWE-863: Incorrect Authorization
Affected products: vendor: Praskla-Technology
product: assessment-placipy
Published: 2026-02-09T21:00:38.744Z
CVE-2026-25812 PlaciPy is Missing CSRF Protection on State-Changing Endpoints
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the application enables credentialed CORS requests but does not implement any CSRF protection mechanism.
Problem types: cwe_id: CWE-352
description: CWE-352: Cross-Site Request Forgery (CSRF)
Affected products: vendor: Praskla-Technology
product: assessment-placipy
Published: 2026-02-09T21:03:36.696Z
CVE-2026-25813 PlaciPy Exposes Sensitive Data via Application Logs
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, The application logs highly sensitive data directly to console output without masking or redaction.
Problem types: cwe_id: CWE-532
description: CWE-532: Insertion of Sensitive Information into Log File
Affected products: vendor: Praskla-Technology
product: assessment-placipy
Published: 2026-02-09T21:04:46.261Z
CVE-2026-25814 NoSQL Injection Risk via Unsanitized Query Parameters
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, User-controlled query parameters are passed directly into DynamoDB query/filter construction without validation or sanitization.
Problem types: cwe_id: CWE-74
description: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Affected products: vendor: Praskla-Technology
product: assessment-placipy
Published: 2026-02-09T21:05:50.295Z
CVE-2026-25815 
Fortinet FortiOS through 7.6.6 allows attackers to decrypt LDAP credentials stored in device configuration files, as exploited in the wild from 2025-12-16 through 2026 (by default, the encryption key is the same across all customers' installations). NOTE: the Supplier's position is that the instance of CWE-1394 is not a vulnerability because customers "are supposed to enable" a non-default option that eliminates the weakness. However, that non-default option can disrupt functionality as shown in the "Managing FortiGates with private data encryption" document, and is therefore intentionally not a default option.
Problem types: cwe_id: CWE-1394
description: CWE-1394 Use of Default Cryptographic Key
Affected products: vendor: Fortinet
product: FortiOS
default_status: unknown
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 3.2
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
version: 3.1
Published: 2026-02-05T21:14:09.241Z
CVE-2026-25817 
HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 have improper neutralization of special elements used in an OS command allowing remote code execution by attackers with low privilege access on the gateway, provided the attacker has credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-12T00:00:00.000Z
CVE-2026-25818 
HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 have weak entropy for authentication cookies, allowing an attacker with a stolen session cookie to find the user password by brute-forcing an encryption parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-12T00:00:00.000Z
CVE-2026-25819 
HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 allows unauthenticated attackers to cause a Denial of Service by using a specially crafted HTTP request that leads to a reboot of the device, provided they have access to the device's GUI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-12T00:00:00.000Z
CVE-2026-25823 
HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 have a stack buffer overflow that leads to a Denial of Service, which can also be exploited to achieve Unauthenticated Remote Code Execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-12T00:00:00.000Z
CVE-2026-25828 
grub-btrfs through 2026-01-31 (on Arch Linux and derivative distributions) allows initramfs OS command injection because it does not sanitize the $root parameter to resolve_device(). NOTE: a third party reports "exploitation may not be feasible under normal conditions and may depend on specific implementation details within resolve_device."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-02-12T00:00:00.000Z
CVE-2026-25833 
Mbed TLS 3.5.0 to 3.6.5 fixed in 3.6.6 and 4.1.0 has a buffer overflow in the x509_inet_pton_ipv6() function
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-01T00:00:00.000Z
CVE-2026-25834 
Mbed TLS v3.3.0 up to 3.6.5 and 4.0.0 allows Algorithm Downgrade.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-01T00:00:00.000Z
CVE-2026-25835 
Mbed TLS before 3.6.6 and TF-PSA-Crypto before 1.1.0 misuse seeds in a Pseudo-Random Number Generator (PRNG).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-01T00:00:00.000Z
CVE-2026-25836 
An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox Cloud 5.0.4, FortiSandbox PaaS 5.0.4 may allow  a privileged attacker with super-admin profile and CLI access to execute unauthorized code or commands via crafted HTTP requests.
Problem types: cwe_id: CWE-78
description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: FortiSandbox Cloud
cpes: cpe:2.3:a:fortinet:fortisandboxcloud:5.0.4:*:*:*:*:*:*:*
default_status: unaffected
vendor: Fortinet
product: FortiSandbox PaaS
cpes: cpe:2.3:a:fortinet:fortisandboxpaas:5.0.4:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
Published: 2026-03-10T16:44:06.991Z
CVE-2026-25846 
In JetBrains YouTrack before 2025.3.119033 access tokens could be exposed in Mailbox logs
Problem types: cwe_id: CWE-532
description: CWE-532
Affected products: vendor: JetBrains
product: YouTrack
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Published: 2026-02-09T10:38:59.786Z
CVE-2026-25847 
In JetBrains PyCharm before 2025.3.2 a DOM-based XSS on Jupyter viewer page was possible
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: JetBrains
product: PyCharm
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: LOW
baseScore: 8.2
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L
Published: 2026-02-09T10:39:00.791Z
CVE-2026-25848 
In JetBrains Hub before 2025.3.119807 authentication bypass allowing administrative actions was possible
Problem types: cwe_id: CWE-306
description: CWE-306
Affected products: vendor: JetBrains
product: Hub
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
baseScore: 9.1
baseSeverity: CRITICAL
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Published: 2026-02-09T10:39:02.452Z
CVE-2026-25850 filemanagement_storage_service has an improper preservation of permissions vulnerability
in OpenHarmony v6.0 and prior versions allow a local attacker cause information leak
Problem types: cwe_id: CWE-281
description: CWE-281 Improper preservation of permissions
Affected products: vendor: OpenHarmony
product: OpenHarmony
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Published: 2026-05-19T03:08:35.465Z
CVE-2026-25851 Chargemap chargemap.com Missing Authentication for Critical Function
WebSocket endpoints lack proper authentication mechanisms, enabling 
attackers to perform unauthorized station impersonation and manipulate 
data sent to the backend. An unauthenticated attacker can connect to the
 OCPP WebSocket endpoint using a known or discovered charging station 
identifier, then issue or receive OCPP commands as a legitimate charger.
 Given that no authentication is required, this can lead to privilege 
escalation, unauthorized control of charging infrastructure, and 
corruption of charging network data reported to the backend.
Problem types: cwe_id: CWE-306
description: CWE-306
Affected products: vendor: Chargemap
product: chargemap.com
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 9.4
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
version: 3.1
Credits: lang: en
value: Khaled Sarieddine and Mohammad Ali Sayed reported this vulnerability to CISA
Published: 2026-02-26T23:04:13.166Z
CVE-2026-25852 
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.93212.
Problem types: cwe_id: CWE-427
description: CWE-427
Affected products: vendor: Acronis
product: Acronis DeviceLock DLP
default_status: unaffected
Credits: lang: en
value: @satz4797 (https://hackerone.com/satz4797)
Published: 2026-04-29T13:42:23.180Z
CVE-2026-25854 Apache Tomcat: Occasionally open redirect
Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBalancerDrainingValve.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M23 through 9.0.115, from 8.5.30 through 8.5.100.
Other, unsupported versions may also be affected

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.
Problem types: cwe_id: CWE-601
description: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
Affected products: vendor: Apache Software Foundation
product: Apache Tomcat
default_status: unaffected
Credits: lang: en
value: gregk4sec (https://github.com/gregk4sec)
Published: 2026-04-09T19:13:13.529Z