rainbutterfly/cve_corpus huggingface dataset:
CVE-2026-10608 DedeCMS carbuyaction.php RemoveXSS sql injection
A security flaw has been discovered in DedeCMS 5.7.88. This affects the function RemoveXSS of the file /plus/carbuyaction.php. The manipulation of the argument postname/des results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: n/a
product: DedeCMS
cpes: cpe:2.3:a:dedecms:dedecms:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: R21Z20 (VulDB User)
lang: en
value: VulDB Vulnerability Moderation Team
Published: 2026-06-02T18:00:10.772Z
CVE-2026-10611 OTP bypass via plugin-based LDAP authentication in MISP when LDAP mixed authentication is enabled
An authentication bypass vulnerability exists in MISP when LDAP mixed authentication is enabled with OTP enforcement. In deployments configured with LdapAuth.mixedAuth=true and Security.require_otp=true, users authenticated through an authentication plugin, such as LDAP, may have their authenticated session established during the application beforeFilter phase before the normal login flow enforces the OTP challenge.



As a result, an attacker with valid primary authentication credentials could bypass the required OTP step by authenticating through the plugin-backed login flow and then directly accessing another application URL instead of completing the OTP verification page. This allows access to the application as the affected user without providing a valid TOTP, HOTP, or email OTP code.



The issue affects configurations where plugin-based authentication is enabled and OTP is expected to be mandatory. The fix ensures that OTP requirements are checked immediately after plugin authentication and before the user session is established, redirecting users to the appropriate OTP challenge when required.
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: misp
product: misp
default_status: unaffected
Credits: lang: en
value: Andrea Capelli
lang: en
value: Luciano Righetti
Published: 2026-06-02T12:48:11.462Z
CVE-2026-10616 nextlevelbuilder GoClaw Team Task Completion team_tasks_lifecycle.go TeamTasksTool.executeComplete authorization
A weakness has been identified in nextlevelbuilder GoClaw up to 3.11.3. The impacted element is the function TeamTasksTool.executeComplete of the file internal/tools/team_tasks_lifecycle.go of the component Team Task Completion Handler. Executing a manipulation can lead to missing authorization. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The project tagged the reported issue as bug.
Problem types: cwe_id: CWE-862
description: Missing Authorization
cwe_id: CWE-863
description: Incorrect Authorization
Affected products: vendor: nextlevelbuilder
product: GoClaw
cpes: cpe:2.3:a:nextlevelbuilder:goclaw:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: Eric-h (VulDB User)
lang: en
value: VulDB CNA Team
Published: 2026-06-02T18:30:09.138Z
CVE-2026-10617 nextlevelbuilder GoClaw Webhook Verification auth.go resolveAuth missing authentication
A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.11.3. This affects the function resolveAuth of the file internal/http/auth.go of the component Webhook Verification Handler. The manipulation leads to missing authentication. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project tagged the reported issue as bug.
Problem types: cwe_id: CWE-306
description: Missing Authentication
cwe_id: CWE-287
description: Improper Authentication
Affected products: vendor: nextlevelbuilder
product: GoClaw
cpes: cpe:2.3:a:nextlevelbuilder:goclaw:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: Eric-h (VulDB User)
lang: en
value: VulDB CNA Team
Published: 2026-06-02T19:00:12.000Z
CVE-2026-10619 sayan365 student-management-system improper authentication
A vulnerability was detected in sayan365 student-management-system up to 7f3c9ce7d410332335c2affac93a385485051800. This impacts an unknown function. The manipulation results in improper authentication. The attack can be executed remotely. The exploit is now public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. Multiple endpoints are affected. The project was informed of the problem early through an issue report but has not responded yet.
Problem types: cwe_id: CWE-287
description: Improper Authentication
Affected products: vendor: sayan365
product: student-management-system
cpes: cpe:2.3:a:sayan365:student-management-system:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: ciyou (VulDB User)
lang: en
value: VulDB CNA Team
Published: 2026-06-02T20:00:13.992Z
CVE-2026-10620 code-projects Student Admission System index.php sql injection
A flaw has been found in code-projects Student Admission System 1.0. Affected is an unknown function of the file /index.php. This manipulation of the argument eid/did causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: code-projects
product: Student Admission System
cpes: cpe:2.3:a:code-projects:student_admission_system:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: Xu Zhihan (VulDB User)
Published: 2026-06-02T20:15:12.809Z
CVE-2026-10621 CVE-2026-10621
Path traversal in restore handler in Collibra Agent, allows an attacker to write arbitrary files via a crafted ZIP archive. Collibra Agent fails to properly validate and canonicalize file path during ZIP extraction, this can allow an attacker to write files outside the intended extraction directory.
Problem types: description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: CWE-73 External Control of File Name or Path
Affected products: vendor: Collibra
product: Collibra Platform (SaaS)
vendor: Collibra
product: Collibra Platform (SaaS)
vendor: Collibra
product: Collibra Platform (SaaS)
vendor: Collibra
product: Collibra Platform (SaaS)
vendor: Collibra
product: Collibra Platform (SaaS)
vendor: Collibra
product: Collibra Platform (on-prem)
vendor: Collibra
product: Collibra Platform (on-prem)
Published: 2026-06-02T14:03:35.360Z
CVE-2026-10622 CVE-2026-10622
Improper Authentication in REST API in Collibra Agent, allows a remote unauthenticated attacker to access privileged functionality via exposed '/rest/* endpoints.
Problem types: description: CWE-306 Missing Authentication for Critical Function
description: CWE-287 Improper Authentication
Affected products: vendor: Collibra
product: Collibra Platform (on-prem)
vendor: Collibra
product: Collibra Platform (on-prem)
vendor: Collibra
product: Collibra Platform (SaaS)
vendor: Collibra
product: Collibra Platform (SaaS)
vendor: Collibra
product: Collibra Platform (SaaS)
vendor: Collibra
product: Collibra Platform (SaaS)
vendor: Collibra
product: Collibra Platform (SaaS)
Published: 2026-06-02T14:01:06.148Z
CVE-2026-10624 SourceCodester Human Resource Management Employee View detailview.php resource injection
A vulnerability has been found in SourceCodester Human Resource Management 1.0. Affected by this vulnerability is an unknown functionality of the file /detailview.php of the component Employee View Page. Such manipulation of the argument employeeid leads to improper control of resource identifiers. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-99
description: Improper Control of Resource Identifiers
Affected products: vendor: SourceCodester
product: Human Resource Management
cpes: cpe:2.3:a:sourcecodester:human_resource_management:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: r4sh7n (VulDB User)
Published: 2026-06-02T20:30:10.773Z
CVE-2026-10629 CVE-2026-10629
SIP signaling stack in Verizon IMS (unspecified version) implements SIP signaling without IPsec integrity protection (missing Security-Client/Security-Server headers and ESP traffic), which allows an on-path attacker to compromise confidentiality, integrity, and authenticity of VoLTE signaling via passive monitoring and active manipulation of unsecured SIP messages over the radio and core network.
Problem types: description: CWE-346 Origin Validation Error
description: CWE-523 Missing Transport Layer Protection
Affected products: vendor: Verizon
product: VoLTE
Published: 2026-06-02T14:35:07.902Z
CVE-2026-10650 warmcat libwebsockets SSH Protocol sshd.c lws_ssh_parse_plaintext resource consumption
A flaw has been found in warmcat libwebsockets up to 4.5.8. This issue affects the function lws_ssh_parse_plaintext of the file plugins/protocol_lws_ssh_base/sshd.c of the component SSH Protocol Handler. Executing a manipulation of the argument msg_len can lead to resource consumption. The attack may be launched remotely. The exploit has been published and may be used. This patch is called 3f9f0c6ecaf0e6f3f219d30632c5d1f2479d7498. A patch should be applied to remediate this issue.
Problem types: cwe_id: CWE-400
description: Resource Consumption
cwe_id: CWE-404
description: Denial of Service
Affected products: vendor: warmcat
product: libwebsockets
cpes: cpe:2.3:a:warmcat:libwebsockets:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
baseSeverity: MEDIUM
Credits: lang: en
value: biniam (VulDB User)
Published: 2026-06-02T21:15:10.566Z
CVE-2026-10661 ahujasid blender-mcp server.py open injection
A vulnerability has been found in ahujasid blender-mcp up to 7636d13bded82eca58eb93c3f4cd8708dfdfbe8b. Impacted is the function Open of the file src/blender_mcp/server.py. The manipulation of the argument input_image_url leads to injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The identifier of the patch is 5b37be25242e73dc4cf1328974d30458b9e5d67e. To fix this issue, it is recommended to deploy a patch.
Problem types: cwe_id: CWE-74
description: Injection
cwe_id: CWE-707
description: Improper Neutralization
Affected products: vendor: ahujasid
product: blender-mcp
cpes: cpe:2.3:a:ahujasid:blender-mcp:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
baseSeverity: MEDIUM
Credits: lang: en
value: skywings (VulDB User)
Published: 2026-06-02T21:30:11.403Z
CVE-2026-10662 ahujasid blender-mcp ZIP File server.py requests.get server-side request forgery
A vulnerability was found in ahujasid blender-mcp up to 7636d13bded82eca58eb93c3f4cd8708dfdfbe8b. The affected element is the function requests.get of the file src/blender_mcp/server.py of the component ZIP File Handler. The manipulation of the argument zip_file_url results in server-side request forgery. The attack can be executed remotely. The exploit has been made public and could be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The patch is identified as 5b37be25242e73dc4cf1328974d30458b9e5d67e. It is advisable to implement a patch to correct this issue.
Problem types: cwe_id: CWE-918
description: Server-Side Request Forgery
Affected products: vendor: ahujasid
product: blender-mcp
cpes: cpe:2.3:a:ahujasid:blender-mcp:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
baseSeverity: MEDIUM
Credits: lang: en
value: skywings (VulDB User)
Published: 2026-06-02T22:00:12.762Z
CVE-2026-10688 ahujasid blender-mcp server.py execute_blender_code code injection
A vulnerability was determined in ahujasid blender-mcp up to 7636d13bded82eca58eb93c3f4cd8708dfdfbe8b. The impacted element is the function execute_blender_code of the file /src/blender_mcp/server.py. This manipulation of the argument code causes code injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
Problem types: cwe_id: CWE-94
description: Code Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: ahujasid
product: blender-mcp
cpes: cpe:2.3:a:ahujasid:blender-mcp:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 5.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: skywings (VulDB User)
lang: en
value: VulDB CNA Team
Published: 2026-06-02T22:45:10.790Z
CVE-2026-10690 wonderwhy-er DesktopCommanderMCP read_file filesystem.ts readFileFromUrl server-side request forgery
A vulnerability was identified in wonderwhy-er DesktopCommanderMCP 0.2.37. This affects the function readFileFromUrl of the file src/tools/filesystem.ts of the component read_file. Such manipulation of the argument url leads to server-side request forgery. The attack may be performed from remote. The exploit is publicly available and might be used. The name of the patch is 53699bebba9950047bca16ac4dc8f0568f596aaa. It is best practice to apply a patch to resolve this issue.
Problem types: cwe_id: CWE-918
description: Server-Side Request Forgery
Affected products: vendor: wonderwhy-er
product: DesktopCommanderMCP
cpes: cpe:2.3:a:wonderwhy-er:desktopcommandermcp:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
baseSeverity: MEDIUM
Credits: lang: en
value: skywings (VulDB User)
Published: 2026-06-02T23:15:08.998Z
CVE-2026-10691 wonderwhy-er DesktopCommanderMCP start_search search-manager.ts redos
A security flaw has been discovered in wonderwhy-er DesktopCommanderMCP up to 0.2.38. This impacts an unknown function of the file src/search-manager.ts of the component start_search. Performing a manipulation of the argument SearchResult[] results in inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.2.39 will fix this issue. The patch is named 4ce845f8749b6a159b57b38dcc3357f7222a8078. It is suggested to upgrade the affected component.
Problem types: cwe_id: CWE-1333
description: Inefficient Regular Expression Complexity
cwe_id: CWE-400
description: Resource Consumption
Affected products: vendor: wonderwhy-er
product: DesktopCommanderMCP
cpes: cpe:2.3:a:wonderwhy-er:desktopcommandermcp:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
baseSeverity: MEDIUM
Credits: lang: en
value: skywings (VulDB User)
Published: 2026-06-02T23:30:14.612Z
CVE-2026-10692 johnhuang316 code-index-mcp search_code_advanced is_safe_regex_pattern redos
A weakness has been identified in johnhuang316 code-index-mcp up to 2.14.0. Affected is the function is_safe_regex_pattern of the component search_code_advanced. Executing a manipulation of the argument regex can lead to inefficient regular expression complexity. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.14.1 is able to address this issue. This patch is called 25bc02fac74051ddae15ce79e952f00211b1ea6b. Upgrading the affected component is recommended.
Problem types: cwe_id: CWE-1333
description: Inefficient Regular Expression Complexity
cwe_id: CWE-400
description: Resource Consumption
Affected products: vendor: johnhuang316
product: code-index-mcp
cpes: cpe:2.3:a:johnhuang316:code-index-mcp:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
baseSeverity: MEDIUM
Credits: lang: en
value: skywings (VulDB User)
Published: 2026-06-02T23:45:12.046Z
CVE-2026-10693 SourceCodester Online Boat Reservation System Administrative Endpoint improper authorization
A security vulnerability has been detected in SourceCodester Online Boat Reservation System 1.0. Affected by this vulnerability is an unknown functionality of the component Administrative Endpoint. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Multiple endpoints are affected.
Problem types: cwe_id: CWE-285
description: Improper Authorization
cwe_id: CWE-266
description: Incorrect Privilege Assignment
Affected products: vendor: SourceCodester
product: Online Boat Reservation System
cpes: cpe:2.3:a:sourcecodester:online_boat_reservation_system:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: Hemant Raj Bhati (VulDB User)
Published: 2026-06-03T00:00:12.858Z
CVE-2026-10694 SourceCodester Online Food Ordering System index.php include file inclusion
A vulnerability was detected in SourceCodester Online Food Ordering System 2.0. Affected by this issue is the function include of the file /index.php. The manipulation of the argument page results in file inclusion. The attack can be launched remotely. The exploit is now public and may be used.
Problem types: cwe_id: CWE-73
description: File Inclusion
Affected products: vendor: SourceCodester
product: Online Food Ordering System
cpes: cpe:2.3:a:sourcecodester:online_food_ordering_system:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: Jxsec (VulDB User)
Published: 2026-06-03T00:15:08.880Z
CVE-2026-10701 Incorrect boundary conditions in the Graphics: Text component
Incorrect boundary conditions in the Graphics: Text component. This vulnerability was fixed in Firefox 151.0.3.
Affected products: vendor: Mozilla
product: Firefox
Credits: lang: en
value: taiho kim
Published: 2026-06-02T17:15:59.828Z
CVE-2026-10702 JIT miscompilation in the JavaScript Engine: JIT component
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 151.0.3.
Affected products: vendor: Mozilla
product: Firefox
Credits: lang: en
value: Nebula Security
Published: 2026-06-02T17:16:00.917Z
CVE-2026-10703 EIPStackGroup OpENer SendRRData cipmessagerouter.c CreateMessageRouterRequestStructure use after free
A security vulnerability has been detected in EIPStackGroup OpENer up to 2.3.0. Affected is the function CreateMessageRouterRequestStructure of the file cipmessagerouter.c of the component SendRRData Handler. The manipulation leads to use after free. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Problem types: cwe_id: CWE-416
description: Use After Free
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: EIPStackGroup
product: OpENer
cpes: cpe:2.3:a:eipstackgroup:opener:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: QvuQ_lkx (VulDB User)
lang: en
value: VulDB CNA Team
Published: 2026-06-03T00:30:10.797Z
CVE-2026-10704 SourceCodester Pizzafy E-Commerce System Administrative Control Panel admin_class_novo.php login sql injection
A vulnerability was detected in SourceCodester Pizzafy E-Commerce System 1.0. Affected by this vulnerability is the function Login of the file /admin/admin_class_novo.php of the component Administrative Control Panel. The manipulation of the argument Username results in sql injection. The attack can be executed remotely. The exploit is now public and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: SourceCodester
product: Pizzafy E-Commerce System
cpes: cpe:2.3:a:sourcecodester:pizzafy_e-commerce_system:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: Fklov (VulDB User)
Published: 2026-06-03T00:45:08.307Z
CVE-2026-10705 dask HLL hyperloglog.py nunique_approx resource consumption
A flaw has been found in dask up to 3.0. Affected by this issue is the function nunique_approx of the file dask/dataframe/hyperloglog.py of the component HLL Handler. This manipulation causes resource consumption. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitation is known to be difficult. The pull request to fix this issue awaits acceptance.
Problem types: cwe_id: CWE-400
description: Resource Consumption
cwe_id: CWE-404
description: Denial of Service
Affected products: vendor: n/a
product: dask
cpes: cpe:2.3:a:dask:dask:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:R
baseSeverity: LOW
Credits: lang: en
value: Dem0 (VulDB User)
lang: en
value: VulDB CNA Team
Published: 2026-06-03T01:15:10.343Z
CVE-2026-10717 Open-Seachest/Seachest show SCSI Defect List Vulnerability
Out of bounds write and reads in openSeaChest’s --showSCSIDefects in Seagate’s openSeaChest v25.05.3 on all supported platforms allows for writing defect information out of bounds for very large defects lists via a very bad drive with lots of defects or a maliciously crafted SCSI device’s defect response length.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds write
Affected products: default_status: unaffected
Published: 2026-06-02T22:06:34.629Z
CVE-2026-10718 Open Seachest/Seachest NVMe Trim (Deallocate) Vulnerability
Out of bounds write in openSeaChest’s Trim/Unmap operation in Seagate’s openSeaChest v26.03.0 on all supported platforms allows for writing extra memory describing a range of LBAs to deallocate 16 bytes outside of the allocated space when running this operation.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds write
Affected products: default_status: unaffected
Published: 2026-06-02T22:19:40.813Z
CVE-2026-10719 Open Seachest/Seachest NVMe show Format Descriptors Vulnerability
Out of bounds write in openSeaChest’s --showSupportedFormats in Seagate’s openSeaChest v25.05.3 on all supported platforms allows for writing 1 extra byte outside of allocated memory which sets a value to 1 via a maliciously crafted NVMe device with a bogus value in the namespace FLBAS byte.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds write
Affected products: default_status: unaffected
Published: 2026-06-02T22:31:45.704Z