rainbutterfly/cve_corpus huggingface dataset:
CVE-2026-49135 CodexBar < 0.32.0 Insecure Temporary File Handling in Notarization Workflow
CodexBar prior to 0.32.0 contains an insecure temporary file handling vulnerability that allows local attackers to access sensitive credentials or tamper with build artifacts by exploiting predictable file paths in the release notarization workflow. Attackers with access to the same host can read the App Store Connect API key written to a fixed path, pre-create files or symbolic links at predictable locations to redirect writes to attacker-controlled destinations, or tamper with notarization archives before submission.
Problem types: cwe_id: CWE-377
description: Insecure Temporary File
cwe_id: CWE-59
description: Improper Link Resolution Before File Access ('Link Following')
Affected products: vendor: steipete
product: CodexBar
default_status: affected
CVSS v3.1: attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
version: 3.1
baseSeverity: HIGH
baseScore: 7.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Credits: lang: en
value: Chia Min Jun Lennon
Published: 2026-06-01T18:57:30.839Z
CVE-2026-49136 Banana Slides 0.4.0 Path Traversal via generate_image() in ai_service.py
Banana Slides through 0.4.0, patched in commit e8bc490, contains a path traversal vulnerability in the generate_image() function within the AI service backend that allows unauthenticated attackers to read arbitrary image-format files outside the intended uploads directory by exploiting an incomplete path prefix check using os.path.startswith() without a trailing separator. Attackers can supply crafted markdown image references in user-controlled page descriptions that resolve to sibling directories whose names share the uploads folder prefix, bypassing the directory confinement check and causing the application to read files from unintended locations via PIL Image.open().
Problem types: cwe_id: CWE-22
description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Anionex
product: banana-slides
default_status: affected
CVSS v3.1: attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
version: 3.1
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Credits: lang: en
value: YU SUN
Published: 2026-06-01T19:09:51.443Z
CVE-2026-49138 Nanobot < 0.2.1 SSRF via web_fetch Tool Redirect Following
Nanobot prior to version 0.2.1 contains a server-side request forgery vulnerability in the web_fetch tool that allows remote attackers to reach internal or private network hosts by supplying a URL that redirects to a loopback or private address via a 3xx Location header. Attackers can exploit the automatic HTTP redirect following behavior in the httpx library to bypass initial URL validation and cause the runtime to send outbound requests to internal hosts before final resolved URL validation is applied.
Problem types: cwe_id: CWE-918
description: Server-Side Request Forgery (SSRF)
Affected products: vendor: HKUDS
product: nanobot
default_status: affected
CVSS v3.1: attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
version: 3.1
baseSeverity: MEDIUM
baseScore: 5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Credits: lang: en
value: Chia Min Jun Lennon
Published: 2026-06-01T19:41:51.141Z
CVE-2026-49139 Nanobot < 0.2.1 SSRF via Microsoft Teams Channel serviceUrl Poisoning
Nanobot prior to version 0.2.1 contains a server-side request forgery vulnerability in the Microsoft Teams channel handler that allows remote attackers to exfiltrate Bot Framework bearer tokens by supplying a forged activity with an attacker-controlled serviceUrl value. Attackers can poison the stored conversation reference by sending a crafted inbound activity to the Teams webhook, causing subsequent bot replies to transmit token-bearing Authorization header requests to an attacker-controlled host.
Problem types: cwe_id: CWE-918
description: Server-Side Request Forgery (SSRF)
Affected products: vendor: HKUDS
product: nanobot
default_status: affected
Credits: lang: en
value: Chia Min Jun Lennon
Published: 2026-06-01T19:50:42.993Z
CVE-2026-49140 Nanobot < 0.2.1 Denial of Service via Matrix Media Download Handler
Nanobot prior to version 0.2.1 contains a denial of service vulnerability in the Matrix channel media download handler that allows authenticated room members to exhaust process memory and bandwidth by sending media events with missing or invalid size metadata. Attackers can send multiple concurrent Matrix media events with omitted or invalid declared sizes to trigger simultaneous large media downloads that fully materialize response bodies before post-download rejection, consuming process resources until service degradation occurs.
Problem types: cwe_id: CWE-770
description: Allocation of Resources Without Limits or Throttling
Affected products: vendor: HKUDS
product: nanobot
default_status: affected
CVSS v3.1: attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
version: 3.1
baseSeverity: MEDIUM
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Credits: lang: en
value: Chia Min Jun Lennon
Published: 2026-06-01T19:54:53.921Z
CVE-2026-49141 WACRM Authorization Bypass via Automation Engine Endpoint
WACRM prior to commit 73041bf contain an authorization bypass vulnerability in the automation engine that allows authenticated attackers to access and modify contacts belonging to other tenants by supplying an arbitrary caller-controlled contact_id in the POST request body without tenant ownership verification. Attackers can exploit the service-role client that bypasses row-level security to modify victim contact fields including name, email, and company across tenant boundaries using only a known contact UUID.
Problem types: cwe_id: CWE-639
description: Authorization Bypass Through User-Controlled Key
Affected products: vendor: ArnasDon
product: wacrm
default_status: affected
CVSS v3.1: attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: HIGH
availabilityImpact: NONE
version: 3.1
baseSeverity: HIGH
baseScore: 7.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:N
Credits: lang: en
value: Midhun Mohanan
lang: en
value: VulnCheck
Published: 2026-06-08T19:13:16.960Z
CVE-2026-49143 BrowserStack Runner 0.9.5 Unauthenticated RCE via /_log HTTP Handler
BrowserStack Runner through 0.9.5 contains a remote code execution vulnerability in the /_log HTTP handler that allows unauthenticated network-adjacent attackers to execute arbitrary code by submitting crafted JSON request bodies to the handler, which passes user-supplied data to vm.runInNewContext() combined with eval(). Attackers can escape the Node.js vm sandbox by leveraging a host-context Function reference through util.format to access the host process via this.constructor.constructor, achieving full remote code execution on the underlying system without any authentication.
Problem types: cwe_id: CWE-94
description: Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: browserstack
product: browserstack-runner
default_status: affected
CVSS v3.1: attackVector: ADJACENT_NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
version: 3.1
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Credits: lang: en
value: Christ Bouchuen
Published: 2026-06-02T20:31:16.903Z
CVE-2026-49144 BrowserStack Runner 0.9.5 Path Traversal via _default HTTP Handler
BrowserStack Runner through 0.9.5 contains a path traversal vulnerability in the _default HTTP handler in lib/server.js that allows unauthenticated network-adjacent attackers to read arbitrary files. Attackers can exploit the unauthenticated HTTP server bound on all interfaces to traverse outside the project root and access sensitive files.
Problem types: cwe_id: CWE-22
description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: browserstack
product: browserstack-runner
default_status: affected
CVSS v3.1: attackVector: ADJACENT_NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
version: 3.1
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Credits: lang: en
value: Christ Bouchuen
Published: 2026-06-02T20:34:54.748Z
CVE-2026-49157 Apache ActiveMQ: Authenticated low-privilege Web users retain Jolokia broker-management capability by default
Incorrect Default Permissions vulnerability in Apache ActiveMQ.

This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.

The default Jolokia authorization settings granted non-admin (low-privilege) web-login accounts access to Jolokia operations which allowed executing broker management operations meant for admins such as addQueue and removeQueue.

Users are recommended to upgrade to version 6.2.6 or 5.19.7, which fixes the issue.
Problem types: cwe_id: CWE-276
description: CWE-276 Incorrect Default Permissions
Affected products: vendor: Apache Software Foundation
product: Apache ActiveMQ
default_status: unaffected
Credits: lang: en
value: Leon Johnson (github: lokerxx)
Published: 2026-06-01T07:20:10.862Z
CVE-2026-49185 Instruction Injection via FieldX MDM
The FieldX MDM adb messaging topic passes unverified payloads directly into Runtime.exec(), allowing command/instruction injection.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')
Affected products: vendor: Acer
product: Connect M6E 5G Portable WiFi Router
default_status: unaffected
Credits: lang: en
value: Ta-Lun Yen
Published: 2026-06-04T02:55:48.841Z
CVE-2026-49186 Lack of MQTT Broker Topic Access Control Lists
The local MQTT broker does not enforce topic-level Access Control Lists (ACLs). This allows any client to subscribe using wildcard characters (# or +) to enumerate hidden network devices or publish rogue control commands.
Problem types: cwe_id: CWE-287
description: CWE-287: Improper Authentication
Affected products: vendor: Acer
product: Connect M6E 5G Portable WiFi Router
default_status: unaffected
Credits: lang: en
value: Ta-Lun Yen
Published: 2026-06-04T03:36:59.864Z
CVE-2026-49187 Hard-coded APK Resource Credentials & Scepters
The hard-coded APK resource files never expire, and the shared scepter leads to information leaks and potential misuse.
Problem types: cwe_id: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Acer
product: Connect M6E 5G Portable WiFi Router
default_status: unaffected
Credits: lang: en
value: Ta-Lun Yen
Published: 2026-06-04T03:50:11.957Z
CVE-2026-49188 Elevated Root Command Execution via ai_cmd Sockets
The ai_cmd utility executes with full root permissions. It pipes socket inputs directly to popen(), paving the way for unauthenticated users to execute arbitrary root commands.
Problem types: cwe_id: CWE-489
description: CWE-489: Active Debug Code
Affected products: vendor: Acer
product: Connect M6E 5G Portable WiFi Router
default_status: unaffected
Credits: lang: en
value: Ta-Lun Yen
Published: 2026-06-04T04:08:08.913Z
CVE-2026-49189 Broadcast Receiver Privilege Escalation
Unchecked public access permissions on a core Broadcast Receiver allow unauthorized local software components to invoke administrative operations.
Problem types: cwe_id: CWE-269
description: CWE-269: Improper Privilege Management
Affected products: vendor: Acer
product: Connect M6E 5G Portable WiFi Router
default_status: unaffected
Credits: lang: en
value: Ta-Lun Yen
Published: 2026-06-04T05:23:10.183Z
CVE-2026-49190 Missing Per-Instruction Authorization Checks
The system fails to evaluate instructional permissions over multiple internal operation codes (opcodes), permitting unauthorized application installations or command executions.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Acer
product: Connect M6E 5G Portable WiFi Router
default_status: unaffected
Credits: lang: en
value: Ta-Lun Yen
Published: 2026-06-04T05:28:48.908Z
CVE-2026-49191 Exposed Hard-coded M3WebServer Backend API Key
The production build of the M3WebServer hard-codes its backend API keys, which can be easily intercepted through verbose error handling pages.
Problem types: cwe_id: CWE-287
description: CWE-287: Improper Authentication
Affected products: vendor: Acer
product: Connect M6E 5G Portable WiFi Router
default_status: unaffected
Credits: lang: en
value: Ta-Lun Yen
Published: 2026-06-04T05:36:09.221Z
CVE-2026-49192 Summary Service Insecure Direct Object Reference
The summary service endpoint suffers from an IDOR vulnerability where it fails to verify user ownership of hardware serial numbers, exposing device data to scraping.
Problem types: cwe_id: CWE-639
description: CWE-639: Authorization Bypass Through User-Controlled Key
Affected products: vendor: Acer
product: Connect M6E 5G Portable WiFi Router
default_status: unaffected
Credits: lang: en
value: Ta-Lun Yen
Published: 2026-06-04T05:43:55.875Z
CVE-2026-49193 Publicly Readable AWS S3 Telemetry Buckets
Overly permissive configuration settings on cloud storage containers expose active telemetry information publicly to the internet.
Problem types: cwe_id: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Acer
product: Connect M6E 5G Portable WiFi Router
default_status: unaffected
Credits: lang: en
value: Ta-Lun Yen
Published: 2026-06-04T06:17:07.758Z
CVE-2026-49194 SCREEN_CLICK Authentication Bypass
The debugging routine SCREEN_CLICK(5053) enables a connection to skip the standard device login prompt entirely and directly enter an interactive shell interface.
Problem types: cwe_id: CWE-287
description: CWE-287: Improper Authentication
Affected products: vendor: Acer
product: Connect M6E 5G Portable WiFi Router
default_status: unaffected
Credits: lang: en
value: Ta-Lun Yen
Published: 2026-06-04T06:21:01.353Z
CVE-2026-49195 Predator Connect W6x: unauthenticated Debug Service
Unauthenticated Debug Service. The /sbin/mtk_dut binary is exposed on TCP port 9000 without authentication, allowing any LAN-based attacker to execute arbitrary UCC commands.
Problem types: cwe_id: CWE-306
description: CWE-306: Missing Authentication
Affected products: vendor: Acer
product: Predator Connect W6x
default_status: unaffected
Credits: lang: en
value: rethesis
Published: 2026-05-29T08:02:48.780Z
CVE-2026-49196 Predator Connect W6x: Web Interface Command Injection
The Wi-Fi device blocking feature fails to sanitize MAC address input, allowing injection and execution of arbitrary shell commands.
Problem types: cwe_id: CWE-77
description: CWE-77: Command Injection
Affected products: vendor: Acer
product: Predator Connect W6x
default_status: unaffected
Credits: lang: en
value: rethesis
Published: 2026-05-29T08:15:49.883Z
CVE-2026-49197 Predator Connect W6x: Improper Authentication
Web endpoints intended for the Acer Connect app improperly validate the HTTP Authorization header, failing to block requests when Base64 decoding fails.
Problem types: cwe_id: CWE-287
description: CWE-287: Improper Authentication
Affected products: vendor: Acer
product: Predator Connect W6x
default_status: unaffected
Credits: lang: en
value: rethesis
Published: 2026-05-29T08:24:06.489Z
CVE-2026-49198 Predator Connect W6x: MQTT Broker Access Control
Improper access control in the MQTT broker allows wildcard topic subscriptions, exposing all MQTT traffic to unauthorized actors.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: Acer
product: Predator Connect W6x
default_status: unaffected
Credits: lang: en
value: rethesis
Published: 2026-05-29T08:30:28.370Z
CVE-2026-49199 Predator Connect W6x: RCE via MQTT
Crafted MQTT messages can trigger command injection, resulting in root-level code execution on the target device.
Problem types: cwe_id: CWE-77
description: CWE-77: Command Injection
Affected products: vendor: Acer
product: Predator Connect W6x
default_status: unaffected
Credits: lang: en
value: rethesis
Published: 2026-05-29T08:38:24.215Z
CVE-2026-49200 Acer Wave 7 router: Broken Access Control
The acer_cgi.log file in the device firmware is accessible without authentication via the web interface. This file contains cleartext login credentials (for web and Telnet), leading to unauthorized system access.
Problem types: cwe_id: CWE-532
description: CWE-532: Sensitive information inserted into log archives
Affected products: vendor: Acer
product: Wave 7 router
default_status: unaffected
Credits: lang: en
value: Gergo Pap
Published: 2026-05-29T08:51:15.717Z
CVE-2026-49201 Acer Wave 7 router: Hardcoded Cryptographic Key
The upload.cgi binary, responsible for processing device backups, contains a hardcoded AES encryption key. This allows an attacker to decrypt, modify, and re-encrypt system backups, facilitating persistent backdoor injection.
Problem types: cwe_id: CWE-798
description: CWE-798: Using Hardcoded Credentials
Affected products: vendor: Acer
product: Wave 7 router
default_status: unaffected
Credits: lang: en
value: Gergo Pap
Published: 2026-05-29T08:57:54.569Z
CVE-2026-49202 Unverified Meeting Recording Endpoints & Permissive CORS
Internal multimedia session archives are accessible without authentication, exacerbated by loose Cross-Origin Resource Sharing (CORS) rules that allow cross-site theft.
Problem types: cwe_id: CWE-287
description: CWE-287: Improper Authentication
Affected products: vendor: Acer
product: Connect M6E 5G Portable WiFi Router
default_status: unaffected
Credits: lang: en
value: Ta-Lun Yen
Published: 2026-06-04T06:30:57.145Z
CVE-2026-49203 Unauthenticated eSIM Configuration Manipulation
Crucial management API endpoints for cellular eSIM allocation do not validate caller authorization, allowing remote profiles to be rewritten or deleted.
Problem types: cwe_id: CWE-287
description: CWE-287: Improper Authentication
Affected products: vendor: Acer
product: Connect M6E 5G Portable WiFi Router
default_status: unaffected
Credits: lang: en
value: Ta-Lun Yen
Published: 2026-06-04T06:25:22.841Z
CVE-2026-49204 Hard-coded AWS Cognito Testing Accounts
Leftover debug modules contain fixed credentials for internal AWS Cognito test sandboxes, risking asset exploitation.
Problem types: cwe_id: CWE-798
description: CWE-798: Use of Hard-coded Credentials
Affected products: vendor: Acer
product: Connect M6E 5G Portable WiFi Router
default_status: unaffected
Credits: lang: en
value: Ta-Lun Yen
Published: 2026-06-04T06:35:18.896Z
CVE-2026-49232 Routinator exits when accepting an incoming HTTP or RTR connection fails
Routinator exits on any error when accepting incoming HTTP or RTR connections, including ones it can recover from such as running out of file descriptors. This condition can be triggered maliciously by an attacker by opening a large number of connections to the HTTP or RTR server.

This only affects users that make their HTTP or RTR server available to untrusted networks.
Problem types: cwe_id: CWE-755
description: CWE-755 Improper Handling of Exceptional Conditions
Affected products: vendor: NLnet Labs
product: Routinator
default_status: affected
Credits: lang: en
value: X41 D-Sec GmbH
Published: 2026-06-08T12:58:37.695Z
CVE-2026-49233 Routinator cache path traversal using rogue rsync URIs
Routinator does not properly check the module component of rsync URIs, which are used to create the file system paths for the Routinator cache. This allows for path traversal by having a module name containing .., potentially providing an attacker access to the entire Routinator rsync cache.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: NLnet Labs
product: Routinator
default_status: affected
Credits: lang: en
value: X41 D-Sec GmbH
Published: 2026-06-08T12:58:49.824Z
CVE-2026-49234 Routinator crashes on specifically crafted ASN strings in the API
When sending a specifically crafted non-UTF-8 string as select-asn query parameter to the /api/v1/origins endpoint, Routinator crashes. 

This only affects users who allow API access from untrusted networks.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: NLnet Labs
product: Routinator
default_status: affected
Credits: lang: en
value: X41 D-Sec GmbH
Published: 2026-06-08T12:58:58.702Z
CVE-2026-49235 Routinator crashes on specifically crafted RRDP XML files
When Routinator encounters a file via RRDP using a specifically crafted Document Type Definition, Routinator crashes.
Problem types: cwe_id: CWE-755
description: CWE-755 Improper Handling of Exceptional Conditions
Affected products: vendor: NLnet Labs
product: Routinator
default_status: affected
Credits: lang: en
value: X41 D-Sec GmbH
Published: 2026-06-08T12:59:09.249Z
CVE-2026-49237 Local Privilege Escalation in Canonical Multipass
An issue was discovered in Canonical Multipass for macOS before version 1.16.3 due to an incomplete fix for CVE-2025-5199. While the patch in version 1.16.0 updated the ownership of the multipassd daemon binary to root:wheel, five co-located binaries (multipass, qemu-img, qemu-system-aarch64, qemu-system-x86_64, and sshfs_server) in /Library/Application Support/com.canonical.multipass/bin/ retain ownership by the installing user and remain writable. Because the root LaunchDaemon (com.canonical.multipassd.plist) configures a PATH environment variable that prioritizes this user-writable directory and invokes these auxiliary binaries by their bare names, a local attacker can replace an auxiliary binary (such as qemu-img) with a malicious wrapper. When the root daemon subsequently triggers the binary during routine execution (e.g., via multipass launch), the malicious code executes with root privileges, leading to local privilege escalation.
Problem types: cwe_id: CWE-276
description: Incorrect default permissions
Affected products: vendor: Canonical
product: Multipass
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published: 2026-05-28T13:22:42.840Z