rainbutterfly/cve_corpus huggingface dataset:
CVE-2026-28680 Ghostfolio: Full-Read SSRF in Manual Asset Import
Ghostfolio is an open source wealth management software. Prior to version 2.245.0, an attacker can exploit the manual asset import feature to perform a full-read SSRF, allowing them to exfiltrate sensitive cloud metadata (IMDS) or probe internal network services. This issue has been patched in version 2.245.0.
Problem types: cwe_id: CWE-918
description: CWE-918: Server-Side Request Forgery (SSRF)
Affected products: vendor: ghostfolio
product: ghostfolio
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 9.3
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
version: 3.1
Published: 2026-03-06T04:26:51.379Z
CVE-2026-28681 IRRd: web UI host header injection allows password reset poisoning via attacker-controlled email links
Internet Routing Registry daemon version 4 is an IRR database server, processing IRR objects in the RPSL format. From version 4.4.0 to before version 4.4.5 and from version 4.5.0 to before version 4.5.1, an attacker can manipulate the HTTP Host header on a password reset or account creation request. The confirmation link in the resulting email can then point to an attacker-controlled domain. Opening the link in the email is sufficient to pass the token to the attacker, who can then use it on the real IRRD instance to take over the account. A compromised account can then be used to modify RPSL objects maintained by the account's mntners and perform other account actions. If the user had two-factor authentication configured, which is required for users with override access, an attacker is not able to log in, even after successfully resetting the password. This issue has been patched in versions 4.4.5 and 4.5.1.
Problem types: cwe_id: CWE-601
description: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
cwe_id: CWE-640
description: CWE-640: Weak Password Recovery Mechanism for Forgotten Password
Affected products: vendor: irrdnet
product: irrd
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
version: 3.1
Published: 2026-03-06T04:35:59.899Z
CVE-2026-28682 Gokapi: Data Leak in Upload Status Stream
Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, the upload status SSE implementation on /uploadStatus publishes global upload state to any authenticated listener and includes file_id values that are not scoped to the requesting user. This issue has been patched in version 2.2.3.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
cwe_id: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Forceu
product: Gokapi
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
version: 3.1
Published: 2026-03-06T04:43:59.708Z
CVE-2026-28683 Gokapi: Stored XSS in SVG Hotlinks
Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, if a malicious authenticated user uploads SVG and creates a hotlink for it, they can achieve stored XSS. This issue has been patched in version 2.2.3.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Forceu
product: Gokapi
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
version: 3.1
Published: 2026-03-06T04:44:32.546Z
CVE-2026-28684 python-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallback
python-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2, `set_key()` and `unset_key()` in python-dotenv follow symbolic links when rewriting `.env` files, allowing a local attacker to overwrite arbitrary files via a crafted symlink when a cross-device rename fallback is triggered. Users should upgrade to v.1.2.2 or, as a workaround, apply the patch manually.
Problem types: cwe_id: CWE-59
description: CWE-59: Improper Link Resolution Before File Access ('Link Following')
cwe_id: CWE-61
description: CWE-61: UNIX Symbolic Link (Symlink) Following
Affected products: vendor: theskumar
product: python-dotenv
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.6
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H
version: 3.1
Published: 2026-04-20T16:25:12.302Z
CVE-2026-28685 Kimai: API invoice endpoint missing customer-level access control (IDOR)
Kimai is a web-based multi-user time-tracking application. Prior to version 2.51.0, "GET /api/invoices/{id}" only checks the role-based view_invoice permission but does not verify the requesting user has access to the invoice's customer. Any user with ROLE_TEAMLEAD (which grants view_invoice) can read all invoices in the system, including those belonging to customers assigned to other teams. This issue has been patched in version 2.51.0.
Problem types: cwe_id: CWE-285
description: CWE-285: Improper Authorization
Affected products: vendor: kimai
product: kimai
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2026-03-06T04:49:08.312Z
CVE-2026-28686 ImageMagick has a write heap-buffer-overflow in PCL encoder via undersized output buffer
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, A heap-buffer-overflow vulnerability exists in the PCL encode due to an undersized output buffer allocation. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41.
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
cwe_id: CWE-131
description: CWE-131: Incorrect Calculation of Buffer Size
Affected products: vendor: ImageMagick
product: ImageMagick
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
version: 3.1
Published: 2026-03-09T21:33:15.782Z
CVE-2026-28687 ImageMagick has a Heap Use-After-Free in ImageMagick MSL decoder
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, a heap use-after-free vulnerability in ImageMagick's MSL decoder allows an attacker to trigger access to freed memory by crafting an MSL file. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: ImageMagick
product: ImageMagick
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Published: 2026-03-09T21:37:24.006Z
CVE-2026-28688 ImageMagick has a heap use-after-free in the MSL encoder
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, a heap-use-after-free vulnerability exists in the MSL encoder, where a cloned image is destroyed twice. The MSL coder does not support writing MSL so the write capability has been removed. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: ImageMagick
product: ImageMagick
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Published: 2026-03-09T21:38:08.127Z
CVE-2026-28689 ImageMagick has a Path Policy TOCTOU symlink race bypass
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, domain="path" authorization is checked before final file open/use. A symlink swap between check-time and use-time bypasses policy-denied read/write. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41.
Problem types: cwe_id: CWE-59
description: CWE-59: Improper Link Resolution Before File Access ('Link Following')
cwe_id: CWE-367
description: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
Affected products: vendor: ImageMagick
product: ImageMagick
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Published: 2026-03-09T21:39:13.731Z
CVE-2026-28690 ImageMagick has a stack write buffer overflow in MNG encoder
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, a stack buffer overflow vulnerability exists in the MNG encoder. There is a bounds checks missing that could corrupting the stack with attacker-controlled data. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41.
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: ImageMagick
product: ImageMagick
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.9
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H
version: 3.1
Published: 2026-03-09T21:39:53.647Z
CVE-2026-28691 ImageMagick has an uninitialized pointer dereference in JBIG decoder
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, an uninitialized pointer dereference vulnerability exists in the JBIG decoder due to a missing check. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41.
Problem types: cwe_id: CWE-252
description: CWE-252: Unchecked Return Value
cwe_id: CWE-824
description: CWE-824: Access of Uninitialized Pointer
Affected products: vendor: ImageMagick
product: ImageMagick
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2026-03-09T21:40:42.117Z
CVE-2026-28692 ImageMagick has a heap buffer over-read via 32-bit integer overflow in MAT decoder
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, MAT decoder uses 32-bit arithmetic due to incorrect parenthesization resulting in a heap over-read. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: ImageMagick
product: ImageMagick
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
version: 3.1
Published: 2026-03-09T21:41:39.654Z
CVE-2026-28693 ImageMagick has an integer overflow in DIB coder can result in out of bounds read or write
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, an integer overflow in DIB coder can result in out of bounds read or write. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
cwe_id: CWE-190
description: CWE-190: Integer Overflow or Wraparound
cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: ImageMagick
product: ImageMagick
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2026-03-09T21:42:28.143Z
CVE-2026-28695 Craft affected by authenticated RCE via Twig SSTI - create() function + Symfony Process gadget
Craft is a content management system (CMS). There is an authenticated admin RCE in Craft CMS 5.8.21 via Server-Side Template Injection using the create() Twig function combined with a Symfony Process gadget chain. The create() Twig function exposes Craft::createObject(), which allows instantiation of arbitrary PHP classes with constructor arguments. Combined with the bundled symfony/process dependency, this enables RCE. This bypasses the fix implemented for CVE-2025-57811 (patched in 5.8.7). This vulnerability is fixed in 5.9.0-beta.1 and 4.17.0-beta.1.
Problem types: cwe_id: CWE-1336
description: CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
Affected products: vendor: craftcms
product: cms
Published: 2026-03-04T16:15:32.556Z
CVE-2026-28696 Craft affected by IDOR via GraphQL @parseRefs
Craft is a content management system (CMS). Prior to 4.17.0-beta.1 and 5.9.0-beta.1, the GraphQL directive @parseRefs, intended to parse internal reference tags (e.g., {user:1:email}), can be abused by both authenticated users and unauthenticated guests (if a Public Schema is enabled) to access sensitive attributes of any element in the CMS. The implementation in Elements::parseRefs fails to perform authorization checks, allowing attackers to read data they are not authorized to view. This vulnerability is fixed in 4.17.0-beta.1 and 5.9.0-beta.1.
Problem types: cwe_id: CWE-639
description: CWE-639: Authorization Bypass Through User-Controlled Key
Affected products: vendor: craftcms
product: cms
Published: 2026-03-04T16:21:43.199Z
CVE-2026-28697 Craft Affected by Authenticated RCE via "craft.app.fs.write()" in Twig Templates
Craft is a content management system (CMS). Prior to 4.17.0-beta.1 and 5.9.0-beta.1, an authenticated administrator can achieve Remote Code Execution (RCE) by injecting a Server-Side Template Injection (SSTI) payload into Twig template fields (e.g., Email Templates). By calling the craft.app.fs.write() method, an attacker can write a malicious PHP script to a web-accessible directory and subsequently access it via the browser to execute arbitrary system commands. This vulnerability is fixed in 4.17.0-beta.1 and 5.9.0-beta.1.
Problem types: cwe_id: CWE-1336
description: CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
Affected products: vendor: craftcms
product: cms
Published: 2026-03-04T16:26:37.476Z
CVE-2026-28703 Stored XSS Vulnerability
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Mails Exchanged Between Users report.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')
Affected products: vendor: Zohocorp
product: ManageEngine Exchange Reporter Plus
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
baseSeverity: HIGH
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Credits: lang: en
value: C311
Published: 2026-04-03T11:29:06.108Z
CVE-2026-28704 
Emocheck insecurely loads Dynamic Link Libraries (DLLs). If a crafted DLL file is placed to the same directory, an arbitrary code may be executed with the privilege of the user invoking EmoCheck.
Problem types: cwe_id: CWE-427
description: Uncontrolled Search Path Element
Affected products: vendor: Japan Computer Emergency Response Team Coordination Center (JPCERT/CC)
product: Emocheck
Published: 2026-04-10T05:49:59.632Z
CVE-2026-28709 
Unauthorized resource manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186.
Problem types: cwe_id: CWE-863
description: CWE-863
Affected products: vendor: Acronis
product: Acronis Cyber Protect 17
default_status: unaffected
Credits: lang: en
value: @theelgo64 (https://hackerone.com/theelgo64)
Published: 2026-03-05T23:48:07.935Z
CVE-2026-28710 
Sensitive information disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186.
Problem types: cwe_id: CWE-1390
description: CWE-1390
Affected products: vendor: Acronis
product: Acronis Cyber Protect 17
default_status: unaffected
Published: 2026-03-05T23:48:48.088Z
CVE-2026-28711 
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect 17 (Windows) before build 41186.
Problem types: cwe_id: CWE-427
description: CWE-427
Affected products: vendor: Acronis
product: Acronis Cyber Protect 17
default_status: unaffected
Credits: lang: en
value: @vanitas (https://hackerone.com/vanitas)
Published: 2026-03-05T23:50:16.116Z
CVE-2026-28712 
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect 17 (Windows) before build 41186.
Problem types: cwe_id: CWE-427
description: CWE-427
Affected products: vendor: Acronis
product: Acronis Cyber Protect 17
default_status: unaffected
Credits: lang: en
value: @vanitas (https://hackerone.com/vanitas)
Published: 2026-03-05T23:50:38.746Z
CVE-2026-28713 
Default credentials set for local privileged user in Virtual Appliance. The following products are affected: Acronis Cyber Protect Cloud Agent (VMware) before build 36943, Acronis Cyber Protect 17 (VMware) before build 41186.
Problem types: cwe_id: CWE-1392
description: CWE-1392
Affected products: vendor: Acronis
product: Acronis Cyber Protect Cloud Agent
default_status: unaffected
vendor: Acronis
product: Acronis Cyber Protect 17
default_status: unaffected
Published: 2026-03-05T23:51:30.830Z
CVE-2026-28714 
Unnecessary transmission of sensitive cryptographic material. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186.
Problem types: cwe_id: CWE-522
description: CWE-522
Affected products: vendor: Acronis
product: Acronis Cyber Protect 17
default_status: unaffected
Published: 2026-03-05T23:51:47.409Z
CVE-2026-28715 
Sensitive information disclosure due to improper authorization checks. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186.
Problem types: cwe_id: CWE-863
description: CWE-863
Affected products: vendor: Acronis
product: Acronis Cyber Protect 17
default_status: unaffected
Published: 2026-03-05T23:52:09.573Z
CVE-2026-28716 
Information disclosure and manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186.
Problem types: cwe_id: CWE-863
description: CWE-863
Affected products: vendor: Acronis
product: Acronis Cyber Protect 17
default_status: unaffected
Published: 2026-03-05T23:52:29.601Z
CVE-2026-28717 
Local privilege escalation due to improper directory permissions. The following products are affected: Acronis Cyber Protect 17 (Windows) before build 41186.
Problem types: cwe_id: CWE-276
description: CWE-276
Affected products: vendor: Acronis
product: Acronis Cyber Protect 17
default_status: unaffected
Credits: lang: en
value: @oriotie (https://hackerone.com/oriotie)
Published: 2026-03-05T23:53:46.001Z
CVE-2026-28718 
Denial of service due to insufficient input validation in authentication logging. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186.
Problem types: cwe_id: CWE-779
description: CWE-779
Affected products: vendor: Acronis
product: Acronis Cyber Protect 17
default_status: unaffected
Credits: lang: en
value: @vultza (https://hackerone.com/vultza)
Published: 2026-03-05T23:54:05.522Z
CVE-2026-28719 
Unauthorized resource manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186.
Problem types: cwe_id: CWE-863
description: CWE-863
Affected products: vendor: Acronis
product: Acronis Cyber Protect 17
default_status: unaffected
Credits: lang: en
value: @vultza (https://hackerone.com/vultza)
Published: 2026-03-05T23:54:24.475Z
CVE-2026-28720 
Unauthorized modification of settings due to insufficient authorization checks. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186.
Problem types: cwe_id: CWE-863
description: CWE-863
Affected products: vendor: Acronis
product: Acronis Cyber Protect 17
default_status: unaffected
Credits: lang: en
value: @vultza (https://hackerone.com/vultza)
Published: 2026-03-05T23:54:43.281Z
CVE-2026-28721 
Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect 17 (Windows) before build 41186.
Problem types: cwe_id: CWE-610
description: CWE-610
Affected products: vendor: Acronis
product: Acronis Cyber Protect 17
default_status: unaffected
Credits: lang: en
value: @vultza (https://hackerone.com/vultza)
Published: 2026-03-05T23:55:01.493Z
CVE-2026-28722 
Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect 17 (Windows) before build 41186.
Problem types: cwe_id: CWE-610
description: CWE-610
Affected products: vendor: Acronis
product: Acronis Cyber Protect 17
default_status: unaffected
Credits: lang: en
value: @vultza (https://hackerone.com/vultza)
Published: 2026-03-05T23:55:18.190Z
CVE-2026-28723 
Unauthorized report deletion due to insufficient access control. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186.
Problem types: cwe_id: CWE-863
description: CWE-863
Affected products: vendor: Acronis
product: Acronis Cyber Protect 17
default_status: unaffected
Credits: lang: en
value: @vultza (https://hackerone.com/vultza)
Published: 2026-03-05T23:55:37.600Z
CVE-2026-28724 
Unauthorized data access due to insufficient access control validation. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186.
Problem types: cwe_id: CWE-863
description: CWE-863
Affected products: vendor: Acronis
product: Acronis Cyber Protect 17
default_status: unaffected
Credits: lang: en
value: @vultza (https://hackerone.com/vultza)
Published: 2026-03-05T23:55:51.963Z