rainbutterfly/cve_corpus huggingface dataset:
CVE-2026-44012 Craft CMS: Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure
Craft CMS is a content management system (CMS). From 5.0.0-RC1 to before 5.9.18, AssetsController::actionShowInFolder() fetches an asset by ID and returns its filename and complete folder hierarchy (including volume handle, volume UID, folder names, folder UIDs, and folder URI paths) without checking whether the requesting user has viewAssets or viewPeerAssets permission on the asset’s volume. Any authenticated CP user — even one with zero volume permissions — can enumerate asset filenames and the full folder structure of any volume by supplying arbitrary asset IDs. This vulnerability is fixed in 5.9.18.
Problem types: cwe_id: CWE-862
description: CWE-862: Missing Authorization
Affected products: vendor: craftcms
product: cms
Published: 2026-05-12T20:19:33.550Z
CVE-2026-44015 Nginx UI: Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware Allows Access to Internal Services
Nginx UI is a web user interface for the Nginx web server. In 2.3.4 and earlier, an authenticated user can perform Server-Side Request Forgery (SSRF) by creating a cluster node pointing to an arbitrary internal URL and then sending API requests with the X-Node-ID header. The Proxy middleware forwards these requests to the attacker-specified internal address, bypassing network segmentation and enabling access to services bound to localhost or internal networks.
Problem types: cwe_id: CWE-918
description: CWE-918: Server-Side Request Forgery (SSRF)
Affected products: vendor: 0xJacky
product: nginx-ui
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
version: 3.1
Published: 2026-05-12T20:49:16.240Z
CVE-2026-44028 
An issue was discovered in Nix before 2.34.7 and Lix before 2.95.2. Unbounded recursion in the NAR (Nix Archive) parser could lead to a stack-to-heap overflow when the parser is run on a coroutine stack. The stack is allocated without a guard page, which means that a stack overflow could overwrite memory on the heap and could allow arbitrary code execution as the Nix daemon (run as root in multi-user installations) if ASLR hardening is bypassed. This can be exploited by all users able to connect to the daemon (e.g., in Nix, this is configurable via the allowed-users setting, defaulting to all users). The fixed versions are 2.34.7, 2.33.6, 2.32.8, 2.31.5, 2.30.5, 2.29.4, and 2.28.7 for Nix (introduced in 2.24.4); and 2.95.2, 2.94.2, and 2.93.4 for Lix (introduced in 2.93.0).
Problem types: cwe_id: CWE-674
description: CWE-674 Uncontrolled Recursion
Affected products: vendor: NixOS
product: Nix
default_status: unaffected
vendor: Lix Project
product: Lix
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
version: 3.1
Published: 2026-05-05T00:30:16.205Z
CVE-2026-44029 
An issue was discovered in Nix before 2.34.7. Writing to arbitrary files can occur via "nix-prefetch-url --unpack" or "nix store prefetch-file --unpack" directory traversal. The fixed versions are 2.34.7, 2.33.6, 2.32.8, 2.31.5, 2.30.5, 2.29.4, and 2.28.7 (introduced in 2.24.7);
Problem types: cwe_id: CWE-36
description: CWE-36 Absolute Path Traversal
Affected products: vendor: NixOS
product: Nix
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Published: 2026-05-05T00:51:05.533Z
CVE-2026-44047 SQL injection in MySQL CNID backend
An SQL injection vulnerability in the MySQL CNID backend in Netatalk 3.1.0 through 4.4.2 allows a remote authenticated attacker to obtain unauthorized access to data, modify data, or cause a denial of service.
Problem types: cwe_id: CWE-89
description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Netatalk
product: Netatalk
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
Credits: lang: en
value: Arjun Basnet from Securin
Published: 2026-05-21T07:33:57.079Z
CVE-2026-44048 Stack buffer overflow via UCS-2 type confusion in convert_charset()
A stack-based buffer overflow via UCS-2 type confusion in convert_charset() in Netatalk 2.0.4 through 4.4.2 allows a remote authenticated attacker to execute arbitrary code or cause a denial of service.
Problem types: cwe_id: CWE-121
description: Stack-based Buffer Overflow
Affected products: vendor: Netatalk
product: Netatalk
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
Credits: lang: en
value: Arjun Basnet from Securin
Published: 2026-05-21T07:34:17.301Z
CVE-2026-44049 Out-of-bounds write in convert_charset() null termination
An out-of-bounds write due to improper null termination in convert_charset() in Netatalk 2.0.4 through 4.4.2 allows a remote authenticated attacker to execute arbitrary code or cause a denial of service via crafted character data.
Problem types: cwe_id: CWE-787
description: Out-of-bounds Write
Affected products: vendor: Netatalk
product: Netatalk
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
baseScore: 7.5
baseSeverity: HIGH
Credits: lang: en
value: Arjun Basnet from Securin
Published: 2026-05-21T07:34:19.360Z
CVE-2026-44050 Heap buffer overflow in CNID daemon comm_rcv()
A heap-based buffer overflow in the CNID daemon comm_rcv() function in Netatalk 2.0.0 through 4.4.2 allows a remote authenticated attacker to execute arbitrary code with escalated privileges or cause a denial of service.
Problem types: cwe_id: CWE-122
description: Heap-based Buffer Overflow
Affected products: vendor: Netatalk
product: Netatalk
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
baseScore: 9.9
baseSeverity: CRITICAL
Credits: lang: en
value: Arjun Basnet from Securin
Published: 2026-05-21T07:34:21.459Z
CVE-2026-44051 Arbitrary file read via attacker-controlled symlink creation
An improper link resolution vulnerability in Netatalk 3.0.2 through 4.4.2 allows a remote authenticated attacker to read arbitrary files or overwrite arbitrary files via attacker-controlled symlink creation.
Problem types: cwe_id: CWE-59
description: Improper Link Resolution Before File Access ('Link Following')
Affected products: vendor: Netatalk
product: Netatalk
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
baseScore: 8.1
baseSeverity: HIGH
Credits: lang: en
value: Arjun Basnet from Securin
Published: 2026-05-21T07:34:23.569Z
CVE-2026-44052 LDAP simple-bind password exposure in log output
Netatalk 2.1.0 through 4.4.2 inserts LDAP simple-bind passwords into log output in cleartext, which allows an attacker with access to the log files to obtain LDAP credentials.
Problem types: cwe_id: CWE-532
description: Insertion of Sensitive Information into Log File
Affected products: vendor: Netatalk
product: Netatalk
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
baseScore: 7.5
baseSeverity: HIGH
Credits: lang: en
value: Arjun Basnet from Securin
Published: 2026-05-21T07:34:25.660Z
CVE-2026-44053 Weak cryptography in DHCAST128 UAM
Netatalk 1.5.0 through 4.2.2 uses a broken cryptographic algorithm in the DHCAST128 UAM, which allows a remote attacker to obtain authentication credentials or impersonate a user via cryptanalytic attack.
Problem types: cwe_id: CWE-327
description: Use of a Broken or Risky Cryptographic Algorithm
Affected products: vendor: Netatalk
product: Netatalk
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
baseScore: 7.4
baseSeverity: HIGH
Credits: lang: en
value: Arjun Basnet from Securin
Published: 2026-05-21T07:34:27.811Z
CVE-2026-44054 Predictable afpd session token
Netatalk 2.0.0 through 4.4.2 generates AFP session tokens derived from predictable process IDs, which allows a remote authenticated attacker to cause a denial of service by exploiting the reconnect mechanism.
Problem types: cwe_id: CWE-330
description: Use of Insufficiently Random Values
Affected products: vendor: Netatalk
product: Netatalk
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
baseScore: 6.5
baseSeverity: MEDIUM
Credits: lang: en
value: Arjun Basnet from Securin
Published: 2026-05-21T07:34:29.947Z
CVE-2026-44055 Bitwise OR logic bug enables shell injection
A logic error involving bitwise OR operations in Netatalk 3.1.4 through 4.4.2 allows a remote authenticated attacker to inject OS commands and execute arbitrary code.
Problem types: cwe_id: CWE-78
description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Netatalk
product: Netatalk
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
baseScore: 7.5
baseSeverity: HIGH
Credits: lang: en
value: Arjun Basnet from Securin
Published: 2026-05-21T07:34:32.094Z
CVE-2026-44056 Stack buffer overflow in desktop.c
A stack-based buffer overflow in desktop.c in Netatalk 1.3 through 4.2.2 allows a remote authenticated attacker to cause a denial of service, obtain limited information, or modify limited data.
Problem types: cwe_id: CWE-121
description: Stack-based Buffer Overflow
Affected products: vendor: Netatalk
product: Netatalk
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
baseScore: 6
baseSeverity: MEDIUM
Credits: lang: en
value: Arjun Basnet from Securin
Published: 2026-05-21T07:34:34.228Z
CVE-2026-44057 Dead bounds check in Spotlight RPC unmarshaller
A dead bounds check in the Spotlight RPC unmarshaller in Netatalk 3.0.0 through 4.4.2 results in an unreachable code path that provides no effective bounds protection, which may allow a remote authenticated attacker to obtain limited information via crafted Spotlight RPC requests.
Problem types: cwe_id: CWE-561
description: Dead Code
Affected products: vendor: Netatalk
product: Netatalk
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
baseScore: 3.1
baseSeverity: LOW
Credits: lang: en
value: Arjun Basnet from Securin
Published: 2026-05-21T08:14:31.770Z
CVE-2026-44058 Authentication bypass via admin auth user
An authentication bypass vulnerability in Netatalk 2.2.2 through 4.4.2 allows a remote privileged user to authenticate as an arbitrary user via the admin auth user mechanism.
Problem types: cwe_id: CWE-287
description: Improper Authentication
Affected products: vendor: Netatalk
product: Netatalk
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: Arjun Basnet from Securin
Published: 2026-05-21T07:34:36.381Z
CVE-2026-44059 Non-reentrant privilege toggle
A race condition in the privilege toggle mechanism in Netatalk 2.2.5 through 4.4.2 allows a local attacker to obtain limited information, modify limited data, or cause a minor service disruption.
Problem types: cwe_id: CWE-362
description: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Affected products: vendor: Netatalk
product: Netatalk
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
baseScore: 3.9
baseSeverity: LOW
Credits: lang: en
value: Arjun Basnet from Securin
Published: 2026-05-21T07:34:38.485Z
CVE-2026-44060 Integer underflow in dsi_writeinit() leads to denial of service
An integer underflow in dsi_writeinit() in Netatalk 1.5.0 through 4.4.2 allows a remote unauthenticated attacker to cause a denial of service via a crafted DSI write request.
Problem types: cwe_id: CWE-191
description: Integer Underflow (Wrap or Wraparound)
Affected products: vendor: Netatalk
product: Netatalk
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
baseScore: 7.5
baseSeverity: HIGH
Credits: lang: en
value: Arjun Basnet from Securin
Published: 2026-05-21T07:34:40.613Z
CVE-2026-44061 DES-ECB auth with timing side channel
Netatalk 1.5.0 through 4.4.2 uses DES-ECB for authentication with a timing side channel, which allows a remote attacker to recover authentication credentials via timing analysis.
Problem types: cwe_id: CWE-208
description: Observable Timing Discrepancy
Affected products: vendor: Netatalk
product: Netatalk
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
baseScore: 5.9
baseSeverity: MEDIUM
Credits: lang: en
value: Arjun Basnet from Securin
Published: 2026-05-21T07:34:42.760Z
CVE-2026-44062 Missing o_len bounds check in pull_charset_flags()
A missing output length bounds check in pull_charset_flags() in Netatalk 2.0.4 through 4.4.2 allows a remote authenticated attacker to execute arbitrary code or cause a denial of service via crafted character set data.
Problem types: cwe_id: CWE-787
description: Out-of-bounds Write
Affected products: vendor: Netatalk
product: Netatalk
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
baseScore: 7.5
baseSeverity: HIGH
Credits: lang: en
value: Arjun Basnet from Securin
Published: 2026-05-21T07:34:44.871Z
CVE-2026-44063 LDAP filter injection
An LDAP injection vulnerability in Netatalk 2.1.0 through 4.4.2 allows a remote authenticated attacker to manipulate LDAP queries and obtain limited information or modify LDAP entries via crafted filter input.
Problem types: cwe_id: CWE-90
description: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
Affected products: vendor: Netatalk
product: Netatalk
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
baseScore: 4.2
baseSeverity: MEDIUM
Credits: lang: en
value: Arjun Basnet from Securin
Published: 2026-05-21T07:34:47.108Z
CVE-2026-44064 ASP session ID out-of-bounds access
An out-of-bounds read in ASP session ID handling in Netatalk 1.3 through 4.4.2 allows an adjacent network attacker to obtain limited information or cause a denial of service via a crafted ASP request.
Problem types: cwe_id: CWE-125
description: Out-of-bounds Read
Affected products: vendor: Netatalk
product: Netatalk
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
baseScore: 7.1
baseSeverity: HIGH
Credits: lang: en
value: Arjun Basnet from Securin
Published: 2026-05-21T07:34:49.296Z
CVE-2026-44065 Off-by-two in papd lp_write()
An off-by-two error in lp_write() in papd in Netatalk 2.0.0 through 4.4.2 allows an adjacent network attacker to modify limited data or cause a minor service disruption via crafted print data.
Problem types: cwe_id: CWE-193
description: Off-by-one Error
Affected products: vendor: Netatalk
product: Netatalk
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
baseScore: 3.7
baseSeverity: LOW
Credits: lang: en
value: Arjun Basnet from Securin
Published: 2026-05-21T07:34:51.390Z
CVE-2026-44066 Heap out-of-bounds reads in Spotlight RPC unmarshalling
Multiple heap out-of-bounds reads in the Spotlight RPC unmarshalling code in Netatalk 3.1.0 through 4.4.2 allow a remote authenticated attacker to obtain sensitive information or cause a minor service disruption.
Problem types: cwe_id: CWE-125
description: Out-of-bounds Read
Affected products: vendor: Netatalk
product: Netatalk
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
baseScore: 7.1
baseSeverity: HIGH
Credits: lang: en
value: Arjun Basnet from Securin
Published: 2026-05-21T07:34:53.534Z
CVE-2026-44067 EA header parsing heap over-read
A heap over-read in extended attribute (EA) header parsing in Netatalk 2.1.0 through 4.4.2 allows a remote authenticated attacker to obtain limited information or cause a minor service disruption via crafted EA data.
Problem types: cwe_id: CWE-125
description: Out-of-bounds Read
Affected products: vendor: Netatalk
product: Netatalk
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L
baseScore: 3.7
baseSeverity: LOW
Credits: lang: en
value: Arjun Basnet from Securin
Published: 2026-05-21T07:34:55.647Z
CVE-2026-44068 EA path traversal via incomplete sanitization
Incomplete sanitization of extended attribute (EA) path components in Netatalk 2.1.0 through 4.4.2 allows a remote authenticated attacker to write to files outside the intended metadata namespace via crafted EA names.
Problem types: cwe_id: CWE-22
description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Netatalk
product: Netatalk
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
baseScore: 7.6
baseSeverity: HIGH
Credits: lang: en
value: Arjun Basnet from Securin
Published: 2026-05-21T07:34:57.814Z
CVE-2026-44069 Integer underflow in volxlate
An integer underflow in the volxlate function in Netatalk 3.0.0 through 4.4.2 allows a local privileged user to obtain limited information, modify limited data, or cause a minor service disruption via crafted volume translation input.
Problem types: cwe_id: CWE-191
description: Integer Underflow (Wrap or Wraparound)
Affected products: vendor: Netatalk
product: Netatalk
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
baseScore: 3.4
baseSeverity: LOW
Credits: lang: en
value: Arjun Basnet from Securin
Published: 2026-05-21T07:34:59.942Z
CVE-2026-44070 Unbounded realloc in charset conversion
An unbounded memory reallocation in the charset conversion code in Netatalk 2.0.0 through 4.4.2 allows a remote authenticated attacker to cause a minor denial of service via crafted character conversion requests.
Problem types: cwe_id: CWE-770
description: Allocation of Resources Without Limits or Throttling
Affected products: vendor: Netatalk
product: Netatalk
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
baseScore: 3.1
baseSeverity: LOW
Credits: lang: en
value: Arjun Basnet from Securin
Published: 2026-05-21T07:35:02.206Z
CVE-2026-44071 FORTIFY_SOURCE disabled
Netatalk 3.1.2 through 4.4.2 is compiled without FORTIFY_SOURCE, which disables built-in buffer overflow detection at runtime, potentially allowing a remote attacker to cause a minor denial of service via memory errors that would otherwise be caught and safely terminated by runtime protection.
Problem types: cwe_id: CWE-693
description: Protection Mechanism Failure
Affected products: vendor: Netatalk
product: Netatalk
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
baseScore: 3.7
baseSeverity: LOW
Credits: lang: en
value: Arjun Basnet from Securin
Published: 2026-05-21T08:14:35.042Z
CVE-2026-44072 system() after failed chdir()
Netatalk 2.2.1 through 4.4.2 calls system() after a failed chdir() without properly handling the error condition, which allows a local privileged user to execute unintended commands or cause a minor service disruption under specific conditions.
Problem types: cwe_id: CWE-78
description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Netatalk
product: Netatalk
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L
baseScore: 2.5
baseSeverity: LOW
Credits: lang: en
value: Arjun Basnet from Securin
Published: 2026-05-21T07:35:04.333Z
CVE-2026-44073 seteuid failure ignored in auth modules
Authentication modules in Netatalk 1.5.0 through 4.4.2 fail to check the return value of seteuid(), which may allow a remote authenticated attacker to retain elevated privileges under error conditions.
Problem types: cwe_id: CWE-273
description: Improper Check for Dropped Privileges
Affected products: vendor: Netatalk
product: Netatalk
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
baseScore: 4
baseSeverity: MEDIUM
Credits: lang: en
value: Arjun Basnet from Securin
Published: 2026-05-21T07:35:06.589Z
CVE-2026-44074 Bitwise OR of errno values
Netatalk 2.1.0 through 4.4.2 combines multiple errno values using bitwise OR, resulting in incorrect error codes when multiple error conditions occur simultaneously, which may allow a remote attacker to cause a minor service disruption via conditions that trigger incorrect error-handling paths.
Problem types: cwe_id: CWE-682
description: Incorrect Calculation
Affected products: vendor: Netatalk
product: Netatalk
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
baseScore: 3.7
baseSeverity: LOW
Credits: lang: en
value: Arjun Basnet from Securin
Published: 2026-05-21T08:14:38.297Z
CVE-2026-44075 Missing break in DSI OpenSession
A missing break statement in DSI OpenSession processing in Netatalk 1.5.0 through 4.4.2 causes a DSIOPT_ATTNQUANT switch case to fall through into DSIOPT_SERVQUANT, resulting in unintended session option handling that may allow a remote attacker to cause a minor service disruption via crafted DSI session options.
Problem types: cwe_id: CWE-484
description: Omitted Break Statement in Switch
Affected products: vendor: Netatalk
product: Netatalk
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
baseScore: 3.7
baseSeverity: LOW
Credits: lang: en
value: Arjun Basnet from Securin
Published: 2026-05-21T08:14:41.523Z
CVE-2026-44076 Shell injection via volume path
Insufficient sanitization of volume paths in Netatalk 3.1.0 through 4.4.2 allows a local privileged user to inject OS commands and execute arbitrary code via a crafted volume path.
Problem types: cwe_id: CWE-78
description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Netatalk
product: Netatalk
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
baseScore: 6.7
baseSeverity: MEDIUM
Credits: lang: en
value: Arjun Basnet from Securin
Published: 2026-05-21T07:35:08.770Z
CVE-2026-44088 Remote Code Execution in SzafirHost
SzafirHost verifies the signature of the downloaded JAR file using class JarInputStream (reading from the beginning of the file), but loads classes using class JarFile/URLClassLoader (reading the Central Directory from the end). It can lead to remote code execution by allowing an attacker to combine a genuine, signed JAR file with a malicious ZIP file, causing the verification to pass but the malicious class to be loaded.


This issue was fixed in version 1.2.1.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Krajowa Izba Rozliczeniowa
product: SzafirHost
default_status: unaffected
Credits: lang: en
value: Mariusz Maik
Published: 2026-05-15T08:48:11.694Z