CVE-2026-102714 | | | 2026-09-29 | `_nx_icmpv6_validate_options()` scans the option area with `while (length > 2)` (`common/src/nx_icmpv6_validate_options.c:79`). An area whose size leaves a one… |
CVE-2026-94570 | Medium | 5.9 | 2026-09-22 | SGLang contains a DoS vulnerability caused by missing input validation for AUX_DATA ZeroMQ control messages in the Decode worker, which enables an unauthentica… |
CVE-2026-75588 | Low | 2.6 | 2026-09-17 | Mattermost Desktop App versions <=6.2 6.2.2.0 fail to validate the URL scheme when checking whether a target URL is internal to the connected server, which all… |
CVE-2026-89207 | Medium | 6.5 | 2026-09-16 | A vulnerability has been identified in WTV676-HB6035 Web Interface (All versions < V3.94), WTV776-HB6035 Web Interface (All versions < V4.17). Affected devices… |
CVE-2026-87012 | Medium | 4.3 | 2026-09-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, backend/open_webui/models/calendar.py stored the… |
CVE-2026-86287 | High | 7.5 | 2026-09-07 | Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths.
Non-numeric and non-ASCII prefix lengths are accepted and treated as 0. Integers o… |
CVE-2026-52763 | Medium | 6.5 | 2026-09-05 | YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the recentchanges action (actions/recentchanges.php) accepts a period argument from two disjoi… |
CVE-2026-59680 | High | 8.0 | 2026-09-01 | An OS command injection vulnerability was found in yast2-users. When displaying the "Password Settings" tab of a user, get_password_term() in src/include/users… |
CVE-2026-82741 | | | 2026-09-01 | Improper Validation of Specified Type of Input vulnerability in ash-project ash lets an attacker confuse the stored type tag of an Ash.Type.Union value that us… |
CVE-2026-80051 | | | 2026-08-25 | github.com/graphql-go/graphql (GraphQL for Go) through 0.8.1 does not validate that a scalar variable value matches its declared type. The built-in coerceStrin… |
CVE-2026-17113 | Medium | 6.0 | 2026-08-24 | A flaw was found in CRI-O's container-creation environment-variable handling
(`mergeEnvs` in `server/utils.go`, consumed by `setupContainerEnvironmentAndWorkdi… |
CVE-2026-5304 | Medium | 5.7 | 2026-08-11 | An ACAP configuration file lacks input validation, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis d… |
CVE-2026-18830 | High | 8.1 | 2026-08-04 | Insufficient input validation in Amazon Bedrock AgentCore harness might allow an authenticated remote user to execute configured tools bypassing model invocati… |
CVE-2026-9390 | Critical | 9.1 | 2026-08-03 | XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup.
verify() and _get_signed_xml() in lib/XML/Sig.pm build XPath expressions by concate… |
CVE-2026-20498 | Medium | 6.0 | 2026-08-03 | In geniezone, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege if a malicious ac… |
CVE-2026-4773 | High | 8.1 | 2026-07-22 | Improper validation of specified type of input vulnerability in Magarsus Consulting Ltd. Co. IDM-MFA allows Authentication Bypass.
This issue affects IDM-MFA… |
CVE-2026-50524 | High | 7.5 | 2026-07-14 | Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to deny service over a network. |
CVE-2026-45069 | Critical | 9.1 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, OidcTokenHandler::verify… |
CVE-2026-55124 | Medium | 5.5 | 2026-07-14 | Improper validation of specified type of input in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
CVE-2026-44935 | Critical | 9.9 | 2026-07-02 | Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 befor… |
CVE-2026-54235 | Medium | 6.5 | 2026-06-22 | vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1rc0, ll temperature validation gates use comparison operators (<, >)… |
CVE-2026-10825 | | | 2026-06-16 | A denial-of-service vulnerability exists in the WebSocket API due to insufficient validation and handling of JSON-based requests. A low-privileged authenticate… |
CVE-2026-44249 | High | 8.1 | 2026-06-11 | Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an… |
CVE-2026-9753 | High | 8.1 | 2026-06-09 | The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed binary diff to return memory out-of-bou… |
CVE-2026-9742 | High | 7.5 | 2026-06-09 | When OIDC authentication is enabled in configuration, clients may set specific values in the "mechanism" parameter of the "authenticate" command that lead to s… |
CVE-2026-11460 | High | 7.3 | 2026-06-07 | A flaw has been found in Boost Serialization up to 1.91. The impacted element is an unknown function. This manipulation causes improper validation of specified… |
CVE-2024-6858 | Medium | 6.5 | 2026-06-04 | In Arista’s EOS when in 802.1X mode, multi-auth unauthenticated hosts might be allowed access to a switch port if there exists an EAPOL capable device in the f… |
CVE-2026-49941 | High | 7.5 | 2026-06-04 | Net::CIDR::Set versions through 0.20 for Perl did not validate IP addresses.
The add method called the _encode method to parse addresses. If the addresses did… |
CVE-2026-47675 | Medium | 4.3 | 2026-05-28 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the serialize() function in hono/cookie validates domai… |
CVE-2026-40851 | High | 8.4 | 2026-05-27 | A local attacker can perform a confusion attack on the cfgparser via a specially crafted file on an USB stick leading to code execution. This can result in a t… |
CVE-2026-9521 | High | 7.3 | 2026-05-26 | A security vulnerability has been detected in fraillt bitsery up to 5.2.4. Affected is the function loadFromSharedState in the library include/bitsery/ext/std_… |
CVE-2026-4646 | Medium | 4.3 | 2026-05-22 | Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate user-supplied input in API request handlers whic… |
CVE-2026-7887 | Medium | 6.4 | 2026-05-21 | For Concrete CMS 9.5.0 and below, OAuth 2.0 Authorization-Code Handler Bypasses Account Status. A user with uIsActive=0 (suspended, banned, terminated employee… |
CVE-2026-5946 | High | 7.5 | 2026-05-20 | Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CHAOS` or `HESIOD`, o… |
CVE-2026-0802 | Medium | 6.0 | 2026-05-12 | An ACAP configuration file lacked sufficient input validation, which could allow command injection and potentially lead to privilege escalation. This vulnerabi… |
CVE-2026-29645 | High | 7.5 | 2026-04-20 | NEMU (OpenXiangShan/NEMU) before v2025.12.r2 contains an improper instruction-validation flaw in its RISC-V Vector (RVV) decoder. The decoder does not correctl… |
CVE-2026-33806 | High | 7.5 | 2026-04-15 | Impact:
Fastify applications using schema.body.content for per-content-type body validation can have validation bypassed entirely by prepending a space to the… |
CVE-2026-4598 | High | 7.5 | 2026-03-23 | Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse im… |
CVE-2019-25596 | Medium | 6.2 | 2026-03-22 | SpotAuditor 5.2.6 contains a denial of service vulnerability in the registration dialog that allows local attackers to crash the application by supplying an ex… |
CVE-2026-2092 | High | 7.7 | 2026-03-18 | A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the ove… |
CVE-2026-2454 | Medium | 5.8 | 2026-03-16 | Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to handle incorrectly reported array lengths which allows malicious user to ca… |
CVE-2026-25783 | Medium | 4.3 | 2026-03-16 | Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly validate User-Agent header tokens which allows an authenticated at… |
CVE-2026-20074 | High | 7.4 | 2026-03-11 | A vulnerability in the Intermediate System-to-Intermediate System (IS-IS) multi-instance routing feature of Cisco IOS XR Software could allow an unauthenticate… |
CVE-2026-26115 | High | 8.8 | 2026-03-10 | Improper validation of specified type of input in SQL Server allows an authorized attacker to elevate privileges over a network. |
CVE-2026-25179 | High | 7.0 | 2026-03-10 | Improper validation of specified type of input in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2026-29788 | High | 7.5 | 2026-03-06 | TSPortal is the WikiTide Foundation’s in-house platform used by the Trust and Safety team to manage reports, investigations, appeals, and transparency work. Pr… |
CVE-2026-2004 | High | 8.8 | 2026-02-12 | Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows an object creator to execute arbitrary code as the o… |
CVE-2026-2003 | Medium | 4.3 | 2026-02-12 | Improper validation of type "oidvector" in PostgreSQL allows a database user to disclose a few bytes of server memory. We have not ruled out viability of atta… |
CVE-2026-25639 | High | 7.5 | 2026-02-09 | Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeErr… |
CVE-2026-20119 | High | 7.5 | 2026-02-04 | A vulnerability in the text rendering subsystem of Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an unauthentic… |
CVE-2026-24307 | Critical | 9.3 | 2026-01-22 | Improper validation of specified type of input in M365 Copilot allows an unauthorized attacker to disclose information over a network. |
CVE-2026-21932 | High | 7.4 | 2026-01-20 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JavaFX). Supported v… |
CVE-2025-53627 | Medium | 5.3 | 2025-12-29 | Meshtastic is an open source mesh networking solution. The Meshtastic firmware (starting from version 2.5) introduces asymmetric encryption (PKI) for direct me… |
CVE-2025-12689 | Medium | 6.5 | 2025-12-17 | Mattermost versions 11.0.x <= 11.0.4, 10.12.x <= 10.12.2, 10.11.x <= 10.11.6 fail to check WebSocket request field for proper UTF-8 format, which allows attack… |
CVE-2025-13352 | Low | 3.0 | 2025-12-17 | Mattermost versions 10.11.x <= 10.11.6 and Mattermost GitHub plugin versions <=2.4.0 fail to validate plugin bot identity in reaction forwarding which allows a… |
CVE-2024-2105 | Medium | 6.5 | 2025-12-10 | An unauthorised attacker within bluetooth range may use an improper validation during the BLE connection request to deadlock the affected devices. |
CVE-2025-32901 | Medium | 4.3 | 2025-12-05 | In KDE Connect before 1.33.0 on Android, malicious device IDs (sent via broadcast UDP) could cause an application crash. |
CVE-2025-20756 | Medium | 6.5 | 2025-12-02 | In Modem, there is a possible system crash due to a logic error. This could lead to remote denial of service, if a UE has connected to a rogue base station con… |
CVE-2025-60633 | Medium | 6.5 | 2025-11-24 | An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via the Nudm_SubscriberDataManagement API. |
CVE-2025-12977 | Critical | 9.1 | 2025-11-24 | Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins fail to sanitize tag_key inputs. An attacker with network access or the ability to write reco… |
CVE-2025-41729 | High | 7.5 | 2025-11-24 | An unauthenticated remote attacker can send a specially crafted Modbus read command to the device which leads to a denial of service. |
CVE-2025-9524 | Medium | 4.3 | 2025-11-11 | The VAPIX API port.cgi did not have sufficient input validation, which may result in process crashes and impact usability. This vulnerability can only be explo… |
CVE-2025-8108 | Medium | 6.7 | 2025-11-11 | An ACAP configuration file has improper permissions and lacks input validation, which could potentially lead to privilege escalation. This vulnerability can on… |
CVE-2025-6298 | Medium | 6.7 | 2025-11-11 | ACAP applications can gain elevated privileges due to improper input validation, potentially leading to privilege escalation. This vulnerability can only be ex… |
CVE-2025-4645 | Medium | 6.7 | 2025-11-11 | An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution. This vulnerability can only be exploited if the… |
CVE-2025-59278 | High | 7.8 | 2025-10-14 | Improper validation of specified type of input in Windows Authentication Methods allows an authorized attacker to elevate privileges locally. |
CVE-2025-59277 | High | 7.8 | 2025-10-14 | Improper validation of specified type of input in Windows Authentication Methods allows an authorized attacker to elevate privileges locally. |
CVE-2025-59275 | High | 7.8 | 2025-10-14 | Improper validation of specified type of input in Windows Authentication Methods allows an authorized attacker to elevate privileges locally. |
CVE-2025-59259 | Medium | 6.5 | 2025-10-14 | Improper validation of specified type of input in Windows Local Session Manager (LSM) allows an authorized attacker to deny service over a network. |
CVE-2025-59257 | Medium | 6.5 | 2025-10-14 | Improper validation of specified type of input in Windows Local Session Manager (LSM) allows an authorized attacker to deny service over a network. |
CVE-2025-58729 | Medium | 6.5 | 2025-10-14 | Improper validation of specified type of input in Windows Local Session Manager (LSM) allows an authorized attacker to deny service over a network. |
CVE-2025-55701 | High | 7.8 | 2025-10-14 | Improper validation of specified type of input in Microsoft Windows allows an authorized attacker to elevate privileges locally. |
CVE-2025-58084 | Low | 3.5 | 2025-10-13 | Mattermost Desktop App versions <= 5.13.0 fail to validate URLs external to the configured Mattermost servers, allowing an attacker on a server the user has co… |
CVE-2025-61672 | | | 2025-10-08 | Synapse is an open source Matrix homeserver implementation. Lack of validation for device keys in Synapse before 1.138.3 and in Synapse 1.139.0 allow an attack… |
CVE-2025-20327 | High | 7.7 | 2025-09-24 | A vulnerability in the web UI of Cisco IOS Software could allow an authenticated, remote attacker with low privileges to cause a denial of service (DoS) condit… |
CVE-2025-10207 | High | 7.2 | 2025-09-18 | Improper Validation of Specified Type of Input vulnerability in ABB FLXEON.This issue affects FLXEON: through 9.3.5. |
CVE-2024-48851 | High | 7.2 | 2025-09-18 | Improper Validation of Specified Type of Input vulnerability in ABB FLXEON.A remote code execution is possible due to an improper input validation.
This is… |
CVE-2025-42929 | High | 8.1 | 2025-09-09 | Due to missing input validation, an attacker with high privilege access to ABAP reports could delete the content of arbitrary database tables, if the tables ar… |
CVE-2025-42916 | High | 8.1 | 2025-09-09 | Due to missing input validation, an attacker with high privilege access to ABAP reports could delete the content of arbitrary database tables, if the tables ar… |
CVE-2025-8402 | Medium | 4.9 | 2025-08-21 | Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.0, 10.9.x <= 10.9.3 fail to validate import data which allows a sys… |
CVE-2025-20251 | High | 8.5 | 2025-08-14 | A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defe… |
CVE-2025-20244 | High | 7.7 | 2025-08-14 | A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defe… |
CVE-2025-9042 | | | 2025-08-14 | A security issue exists due to improper handling of CIP Class 32’s request when a module is inhibited on the 5094-IY8 device. It causes the module to enter a f… |
CVE-2025-9041 | | | 2025-08-14 | A security issue exists due to improper handling of CIP Class 32’s request when a module is inhibited on the 5094-IF8 device. It causes the module to enter a f… |
CVE-2025-30027 | Medium | 6.7 | 2025-08-12 | An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution. This vulnerability can only be exploited if the… |
CVE-2025-54525 | High | 7.5 | 2025-08-11 | Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant hit to create chann… |
CVE-2025-8556 | Low | 3.7 | 2025-08-06 | A flaw was found in CIRCL's implementation of the FourQ elliptic curve. This vulnerability allows an attacker to compromise session security via low-order poin… |
CVE-2024-40682 | Medium | 6.2 | 2025-07-23 | IBM SmartCloud Analytics - Log Analysis 1.3.7.0, 1.3.7.1, 1.3.7.2, 1.3.8.0, 1.3.8.1, and 1.3.8.2 could allow a local user to cause a denial of service due to i… |
CVE-2025-24335 | Low | 2.0 | 2025-07-02 | Nokia Single RAN baseband software versions earlier than 24R1-SR 2.1 MP contain a SOAP message input validation flaw, which in theory could potentially be used… |
CVE-2025-40910 | Medium | 6.5 | 2025-06-27 | Net::IP::LPM version 1.10 for Perl does not properly consider leading zero characters in IP CIDR address strings, which could allow attackers to bypass access… |
CVE-2025-52883 | Medium | 5.3 | 2025-06-24 | Meshtastic-Android is an Android application for the mesh radio software Meshtastic. Prior to version 2.5.21, an attacker is able to send an unencrypted direct… |
CVE-2025-25020 | Medium | 6.5 | 2025-06-03 | IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could allow an authenticated user to cause a den… |
CVE-2025-0325 | Medium | 4.3 | 2025-06-02 | A Guard Tour VAPIX API parameter allowed the use of arbitrary values and can be incorrectly called, allowing an attacker to block access to the guard tour conf… |
CVE-2025-40911 | Medium | 6.5 | 2025-05-27 | Net::CIDR::Set versions 0.10 through 0.13 for Perl does not properly handle leading zero characters in IP CIDR address strings, which could allow attackers to… |
CVE-2025-41650 | High | 7.5 | 2025-05-27 | An unauthenticated remote attacker can exploit input validation in cmd services of the devices, allowing them to disrupt system operations and potentially caus… |
CVE-2025-20155 | Medium | 6.0 | 2025-05-07 | A vulnerability in the bootstrap loading of Cisco IOS XE Software could allow an authenticated, local attacker to write arbitrary files to an affected system.
… |
CVE-2025-46342 | High | 8.5 | 2025-04-30 | Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.13.5 and 1.14.0, it may happen that policy rules using nam… |
CVE-2025-41395 | Medium | 6.5 | 2025-04-24 | Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate the props used by the RetrospectivePost custom post type in… |
CVE-2025-32442 | High | 7.5 | 2025-04-18 | Fastify is a fast and low overhead web framework, for Node.js. In versions 5.0.0 to 5.3.0 as well as version 4.29.0, applications that specify different valida… |
CVE-2024-42189 | Medium | 6.5 | 2025-04-15 | HCL BigFix Web Reports might be subject to a Denial of Service (DoS) attack, due to a potentially weak validation of an API parameter. |