rainbutterfly/cve_corpus huggingface dataset:
CVE-2026-42496 Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory
Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory.

_make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target.

A subsequent open through the extracted name reads or writes the attacker chosen path.
Problem types: cwe_id: CWE-59
description: CWE-59 Improper Link Resolution Before File Access ('Link Following')
Affected products: vendor: BINGOS
product: Archive::Tar
default_status: unaffected
Published: 2026-05-26T00:17:19.110Z
CVE-2026-42497 Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory
Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.

_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.

A subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone.
Problem types: cwe_id: CWE-59
description: CWE-59 Improper Link Resolution Before File Access ('Link Following')
cwe_id: CWE-732
description: CWE-732 Incorrect Permission Assignment for Critical Resource
Affected products: vendor: BINGOS
product: Archive::Tar
default_status: unaffected
Published: 2026-05-26T00:17:50.656Z
CVE-2026-42498 Apache Tomcat: WebSocket authentication header exposure
Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.2 through 9.0.117, from 8.5.24 through 8.5.100, from 7.0.83 through 7.0.109.

Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118, which fix the issue.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of HTTP Authentication Header to unexpected hosts
Affected products: vendor: Apache Software Foundation
product: Apache Tomcat
default_status: unaffected
Credits: lang: en
value: lokerxx
Published: 2026-05-12T15:17:56.531Z
CVE-2026-42499 Quadratic string concatenation in consumePhrase in net/mail
Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.
Problem types: description: CWE-407: Inefficient Algorithmic Complexity
Affected products: vendor: Go standard library
product: net/mail
default_status: unaffected
Published: 2026-05-07T19:41:18.615Z
CVE-2026-42500 Panic when reading out of bound palette index in golang.org/x/image/bmp
Decoding a paletted BMP file with an out-of-range palette index results in a panic when accessing pixels in the invalid image.
Problem types: description: CWE-129: Improper Validation of Array Index
Affected products: vendor: golang.org/x/image
product: golang.org/x/image/bmp
default_status: unaffected
Published: 2026-05-29T18:36:28.283Z
CVE-2026-42501 Malicious module proxy can bypass checksum database in cmd/go
A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation. This vulnerability affects any user using an untrusted module proxy (GOMODPROXY) or checksum database (GOSUMDB). A malicious module proxy can serve altered versions of the Go toolchain. When selecting a different version of the Go toolchain than the currently installed toolchain (due to the GOTOOLCHAIN environment variable, or a go.work or go.mod with a toolchain line), the go command will download and execute a toolchain provided by the module proxy. A malicious module proxy can bypass checksum database validation for this downloaded toolchain. Since this vulnerability affects the security of toolchain downloads, setting GOTOOLCHAIN to a fixed version is not sufficient. You must upgrade your base Go toolchain. The go tool always validates the hash of a toolchain before executing it, so fixed versions will refuse to execute any cached, altered versions of the toolchain. The go tool trusts go.sum files to contain accurate hashes of the current module's dependencies. A malicious proxy exploiting this vulnerability to serve an altered module will have caused an incorrect hash to be recorded in the go.sum. Users who have configured a non-trusted GOPROXY can determine if they have been affected by running "rm go.sum ; go mod tidy ; go mod verify", which will revalidate all dependencies of the current module. The specific flaw in more detail: The go command consults the checksum database to validate downloaded modules, when a module is not listed in the go.sum file. It verifies that the module hash reported by the checksum database matches the hash of the downloaded module. If, however, the checksum database returns a successful response that contains no entry for the module, the go command incorrectly permitted validation to succeed. A module proxy may mirror or proxy the checksum database, in which case the go command will not connect to the checksum database directly. Checksums reported by the checksum database are cryptographically signed, so a malicious proxy cannot alter the reported checksum for a module. However, a proxy which returns an empty checksum response, or a checksum response for an unrelated module, could cause the go command to proceed as if a downloaded module has been validated.
Problem types: description: CWE-347: Improper Verification of Cryptographic Signature
Affected products: vendor: Go toolchain
product: cmd/go
default_status: unaffected
Credits: lang: en
value: Mundur (https://github.com/M0nd0R)
Published: 2026-05-07T19:41:19.691Z
CVE-2026-42502 Invoking  incorrect handling of HTML elements in foreign content in golang.org/x/net/html
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
Problem types: description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: golang.org/x/net
product: golang.org/x/net/html
default_status: unaffected
Credits: lang: en
value: Tristan Madani
Published: 2026-05-22T15:01:21.649Z
CVE-2026-42503 Accidental binding to INADDR_ANY might lead to RCE in golang.org/x/tools/gopls
gopls by default communicates via pipe. However, -port and -listen flags are supported as means of debugging.
If -listen is given a value without an explicit host (e.g. :8080), or -port is used, gopls will listen on 0.0.0.0. 
As a result, users might inadvertently cause gopls to bind 0.0.0.0.
This can allow a malicious party on the same network to execute code arbitrarily via gopls.
Problem types: cwe_id: CWE-1327
description: CWE-1327 Binding to an unrestricted IP address
Affected products: vendor: golang.org/x/tools
product: golang.org/x/tools/gopls
default_status: unaffected
Published: 2026-05-06T16:20:01.428Z
CVE-2026-42504 Quadratic complexity in WordDecoder.DecodeHeader in mime
Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.
Problem types: description: CWE-407: Inefficient Algorithmic Complexity
Affected products: vendor: Go standard library
product: mime
default_status: unaffected
Credits: lang: en
value: p4p3r (https://hackerone.com/p4p3r_hak)
Published: 2026-06-02T22:01:37.219Z
CVE-2026-42506 Invoking  incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
Problem types: description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: golang.org/x/net
product: golang.org/x/net/html
default_status: unaffected
Credits: lang: en
value: ensy
Published: 2026-05-22T15:01:21.056Z
CVE-2026-42507 Arbitrary inputs are included in errors without any escaping in net/textproto
When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged.
Problem types: description: CWE-532: Insertion of Sensitive Information into Log File
Affected products: vendor: Go standard library
product: net/textproto
default_status: unaffected
Published: 2026-06-02T22:01:37.307Z
CVE-2026-42508 Invoking  auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts
Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.
Problem types: description: CWE-295: Improper Certificate Validation
Affected products: vendor: golang.org/x/crypto
product: golang.org/x/crypto/ssh/knownhosts
default_status: unaffected
Published: 2026-05-22T02:31:27.644Z
CVE-2026-42509 Apache Wicket: crafted strings can break out of the JavaScript sequence
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket.

This issue affects Apache Wicket: from 8.0.0 through 8.17.0, 9.0.0, from 10.0.0 through 10.8.0.

Users are recommended to upgrade to version 10.9.0, which fixes the issue.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Apache Software Foundation
product: Apache Wicket
default_status: unaffected
Published: 2026-05-06T08:34:00.746Z
CVE-2026-42510 
OpenStack Ironic before 35.0.1 allows ipmitool execution in a non-default configuration that has a console interface.
Problem types: cwe_id: CWE-829
description: CWE-829 Inclusion of Functionality from Untrusted Control Sphere
Affected products: vendor: OpenStack
product: Ironic
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.6
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2026-04-28T04:53:10.789Z
CVE-2026-42511 Remote code execution via malicious DHCP options
The BOOTP file field is written to the lease file without escaping embedded double-quotes, allowing injection of arbitrary dhclient.conf directives.  When the lease file is subsequently re-parsed by dhclient, e.g., after a system restart, an attacker-controlled field from the lease is passed to dhclient-script(8), which evaluates it.

A rogue DHCP server may be able to execute arbirary code as root on a system running dhclient.
Problem types: cwe_id: CWE-149
description: CWE-149: Improper Neutralization of Quoting Syntax
Affected products: vendor: FreeBSD
product: FreeBSD
default_status: unknown
Credits: lang: en
value: Joshua Rogers of AISLE Research Team
Published: 2026-04-30T06:56:36.929Z
CVE-2026-42512 Remotely triggerable out-of-bounds heap write in dhclient
As dhclient is building an environment to pass to dhclient-script, it may need to resize the array of string pointers.  The code which expands the array incorrectly calculates its new size when requesting memory, resulting in a heap buffer overrun.

A specially crafted packet can cause dhclient to overrun its buffer of environment entries.  This can result in a crash, but it may be possible to leverage this bug to achieve remote code execution.
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: FreeBSD
product: FreeBSD
default_status: unknown
Credits: lang: en
value: Joshua Rogers of AISLE Research Team
Published: 2026-04-30T07:58:37.145Z
CVE-2026-42513 Authentication Bypass Vulnerability in e-Sushrut HMIS
This vulnerability exists in e-Sushrut due to improper authentication logic that relies on client-side response parameters to determine authentication status. A remote attacker could exploit this vulnerability by intercepting and modifying the server response.  

Successful exploitation of this vulnerability could allow the attacker to bypass authentication and gain unauthorized access to user accounts on the targeted system.
Problem types: description: CWE 287 Improper Authentication
Affected products: vendor: CDAC-Noida
product: e-Sushrut, Hospital Management Information System (HMIS)
default_status: unaffected
Credits: lang: en
value: This vulnerability is reported by Harsh Verma
Published: 2026-04-29T08:13:23.151Z
CVE-2026-42514 Sensitive Data Exposure Vulnerability in e-Sushrut HMIS
This vulnerability exists in e-Sushrut due to exposure of OTPs in plaintext within API responses. A remote attacker could exploit this vulnerability by intercepting API responses containing valid OTPs.

Successful exploitation of this vulnerability could allow an attacker to impersonate the target user and gain unauthorized access to user accounts on the targeted system.
Problem types: cwe_id: CWE-319
description: CWE-319 Cleartext transmission of sensitive information
Affected products: vendor: CDAC-Noida
product: e-Sushrut, Hospital Management Information System (HMIS)
default_status: unaffected
Credits: lang: en
value: This vulnerability is reported by Harsh Verma
Published: 2026-04-29T08:17:12.372Z
CVE-2026-42515 Insecure Direct Object Reference (IDOR) Vulnerability in e-Sushrut HMIS
This vulnerability exists in e-Sushrut due to improper access control in resource access validation. An authenticated attacker could exploit this vulnerability by manipulating parameter in the API request URL to gain unauthorized access to sensitive information of patients on the targeted system.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization bypass through User-Controlled key
Affected products: vendor: CDAC-Noida
product: e-Sushrut, Hospital Management Information System (HMIS)
default_status: unaffected
Credits: lang: en
value: This vulnerability is reported by Harsh Verma
Published: 2026-04-29T08:22:57.139Z
CVE-2026-42516 Broken Access Control Vulnerability in e-Sushrut HMIS
This vulnerability exists in e-Sushrut due to improper authorization checks during resource access. An authenticated attacker could exploit this vulnerability by manipulating encoded parameters in the request URL to gain unauthorized access to patient accounts on the targeted system.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization bypass through User-Controlled key
Affected products: vendor: CDAC-Noida
product: e-Sushrut, Hospital Management Information System (HMIS)
default_status: unaffected
Credits: lang: en
value: This vulnerability is reported by Harsh Verma
Published: 2026-04-29T08:26:15.611Z
CVE-2026-42517 Cryptographic Failure Vulnerability in e-Sushrut HMIS
This vulnerability exists in e-Sushrut due to the use of reversible Base64 encoding for protecting sensitive data. An authenticated attacker could exploit this vulnerability by decoding and manipulating Base64-encoded parameters in the request URL to gain unauthorized access to sensitive information on the targeted system.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization bypass through User-Controlled key
Affected products: vendor: CDAC-Noida
product: e-Sushrut, Hospital Management Information System (HMIS)
default_status: unaffected
Credits: lang: en
value: This vulnerability is reported by Harsh Verma
Published: 2026-04-29T08:30:09.583Z
CVE-2026-42518 Information Disclosure Vulnerability in e-Sushrut HMIS
This vulnerability exists in e-Sushrut due to disclosure of sensitive information and hardcoded AES encryption keys in client-side JavaScript. An unauthenticated remote attacker could exploit this vulnerability by accessing the client-side code to extract sensitive information and cryptographic keys.

Successful exploitation of this vulnerability could lead to exposure of sensitive data and compromise of cryptographic protections on the targeted system.
Problem types: cwe_id: CWE-321
description: CWE-321 Use of hard-coded cryptographic key
Affected products: vendor: CDAC-Noida
product: e-Sushrut, Hospital Management Information System (HMIS)
default_status: unaffected
Credits: lang: en
value: This vulnerability is reported by Harsh Verma
Published: 2026-04-29T08:37:32.944Z
CVE-2026-42519 
A missing permission check in Jenkins Script Security Plugin 1399.ve6a_66547f6e1 and earlier allows attackers with Overall/Read permission to enumerate pending and approved Script Security classpaths.
Affected products: vendor: Jenkins Project
product: Jenkins Script Security Plugin
default_status: unaffected
Published: 2026-04-29T13:31:29.232Z
CVE-2026-42520 
Jenkins Credentials Binding Plugin 719.v80e905ef14eb_ and earlier does not sanitize file names for file and zip file credentials, allowing attackers able to provide credentials to a job to write files to arbitrary locations on the node filesystem, which can lead to remote code execution if Jenkins is configured to allow a low-privileged user to configure file or zip file credentials used for a job running on the built-in node.
Affected products: vendor: Jenkins Project
product: Jenkins Credentials Binding Plugin
default_status: unaffected
Published: 2026-04-29T13:31:29.921Z
CVE-2026-42521 
Jenkins Matrix Authorization Strategy Plugin 2.0-beta-1 through 3.2.9 (both inclusive) invokes parameterless constructors of classes specified in configuration when deserializing inheritance strategies, without restricting the classes that can be instantiated, allowing attackers with Item/Configure permission to instantiate arbitrary types, which may lead to information disclosure or other impacts depending on the classes available on the classpath.
Affected products: vendor: Jenkins Project
product: Jenkins Matrix Authorization Strategy Plugin
default_status: unaffected
Published: 2026-04-29T13:31:30.608Z
CVE-2026-42522 
A missing permission check in Jenkins GitHub Branch Source Plugin 1967.vdea_d580c1a_b_a_ and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL with attacker-specified GitHub App credentials.
Affected products: vendor: Jenkins Project
product: Jenkins GitHub Branch Source Plugin
default_status: unaffected
Published: 2026-04-29T13:31:31.337Z
CVE-2026-42523 
Jenkins GitHub Plugin 1.46.0 and earlier improperly processes the current job URL as part of JavaScript implementing validation of the feature "GitHub hook trigger for GITScm polling", resulting in a stored cross-site scripting (XSS) vulnerability exploitable by non-anonymous attackers with Overall/Read permission.
Affected products: vendor: Jenkins Project
product: Jenkins GitHub Plugin
default_status: unaffected
Published: 2026-04-29T13:31:32.189Z
CVE-2026-42524 
Jenkins HTML Publisher Plugin 427 and earlier does not escape job name and URL in the legacy wrapper file, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Affected products: vendor: Jenkins Project
product: Jenkins HTML Publisher Plugin
default_status: unaffected
Published: 2026-04-29T13:31:32.905Z
CVE-2026-42525 
Jenkins Microsoft Entra ID (previously Azure AD) Plugin 666.v6060de32f87d and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks.
Affected products: vendor: Jenkins Project
product: Jenkins Microsoft Entra ID (previously Azure AD) Plugin
default_status: unaffected
Published: 2026-04-29T13:31:33.582Z
CVE-2026-42526 Apache Airflow Amazon provider: Prevent unauthorized access to team-scoped secrets in AWS Secrets Manager and SSM Parameter Store backends
In the AWS Secrets Manager and SSM Parameter Store secrets backends of `apache-airflow-providers-amazon` prior to 9.28.0, the team-scoping logic could resolve a `conn_id` containing a `/` (e.g. `"my_team/conn"`) to the same path as another team's team-scoped secret when the caller had no team context. A privileged caller without team context could therefore retrieve another team's secret by crafting a colliding `conn_id`. Fixed in 9.28.0 by switching the team-scope separator to `--` and rejecting team-shaped `conn_id`s when team context is absent. Affects the experimental multi-tenant teams feature only. Users are recommended to upgrade to `apache-airflow-providers-amazon` 9.28.0, which fixes the issue.
Problem types: cwe_id: CWE-863
description: CWE-863: Incorrect Authorization
Affected products: vendor: Apache Software Foundation
product: Apache Airflow Amazon provider
default_status: unaffected
Credits: lang: en
value: Justin Pakzad
Published: 2026-05-19T19:17:51.565Z
CVE-2026-42534 Jostle logic bypass degrades resolution performance
NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the jostle logic that could defeat its purpose and degrade resolution performance. Retransmits of the same query could renew the age of slow running queries and not allow the jostle logic to see them as aged and potential targets for replacement with new queries. An adversary who can query a vulnerable Unbound and who can control a domain name server that replies slowly and/or maliciously to Unbound's queries can exploit the vulnerability and degrade the resolution performance of Unbound. When Unbound's 'num-queries-per-thread' reaches its limit, the jostle logic kicks in. When a new query comes in, half of the available queries that are also slow to resolve are candidates for replacement. The vulnerability then happens because duplicate queries that need resolution would skew the aging result by using the timestamp of the latest duplicate query instead of the original one that started the resolution effort. Cache and local data response performance remains unaffected. Coordinated attacks could raise this to a denial of resolution service. Unbound 1.25.1 contains a patch with a fix to attach an initial, non-updatable start time for incoming queries that allow the jostle logic to work as intended.
Problem types: cwe_id: CWE-440
description: CWE-440: Expected Behavior Violation
Affected products: vendor: NLnet Labs
product: Unbound
default_status: unaffected
Credits: lang: en
value: Qifan Zhang (Palo Alto Networks)
Published: 2026-05-20T09:19:37.920Z
CVE-2026-42535 Apache HTTP Server: mod_dav_fs protected directory access
A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes.

Users are recommended to upgrade to version 2.4.68, which fixes this issue.
Problem types: cwe_id: CWE-668
description: CWE-668 Exposure of Resource to Wrong Sphere
Affected products: vendor: Apache Software Foundation
product: Apache HTTP Server
default_status: unaffected
Credits: lang: en
value: Zhenpeng (Leo) Lin at depthfirst
Published: 2026-06-08T15:14:49.189Z
CVE-2026-42536 Apache HTTP Server: mod_xml2enc heap overflow
Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and untrusted content

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: Apache Software Foundation
product: Apache HTTP Server
default_status: unaffected
Credits: lang: en
value: Zhenpeng (Leo) Lin at depthfirst
Published: 2026-06-08T15:23:46.290Z