CVE-2026-5304 | Medium | 5.7 | 2026-08-11 | An ACAP configuration file lacks input validation, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis d… |
CVE-2026-18830 | High | 8.1 | 2026-08-04 | Insufficient input validation in Amazon Bedrock AgentCore harness might allow an authenticated remote user to execute configured tools bypassing model invocati… |
CVE-2026-9390 | Critical | 9.1 | 2026-08-03 | XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup.
verify() and _get_signed_xml() in lib/XML/Sig.pm build XPath expressions by concate… |
CVE-2026-20498 | Medium | 6.0 | 2026-08-03 | In geniezone, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege if a malicious ac… |
CVE-2026-4773 | High | 8.1 | 2026-07-22 | Improper validation of specified type of input vulnerability in Magarsus Consulting Ltd. Co. IDM-MFA allows Authentication Bypass.
This issue affects IDM-MFA… |
CVE-2026-50524 | High | 7.5 | 2026-07-14 | Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to deny service over a network. |
CVE-2026-45069 | Critical | 9.1 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, OidcTokenHandler::verify… |
CVE-2026-55124 | Medium | 5.5 | 2026-07-14 | Improper validation of specified type of input in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
CVE-2026-44935 | Critical | 9.9 | 2026-07-02 | Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 befor… |
CVE-2026-54235 | Medium | 6.5 | 2026-06-22 | vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1rc0, ll temperature validation gates use comparison operators (<, >)… |
CVE-2026-10825 | | | 2026-06-16 | A denial-of-service vulnerability exists in the WebSocket API due to insufficient validation and handling of JSON-based requests. A low-privileged authenticate… |
CVE-2026-44249 | High | 8.1 | 2026-06-11 | Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an… |
CVE-2026-9753 | High | 8.1 | 2026-06-09 | The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed binary diff to return memory out-of-bou… |
CVE-2026-9742 | High | 7.5 | 2026-06-09 | When OIDC authentication is enabled in configuration, clients may set specific values in the "mechanism" parameter of the "authenticate" command that lead to s… |
CVE-2026-11460 | High | 7.3 | 2026-06-07 | A flaw has been found in Boost Serialization up to 1.91. The impacted element is an unknown function. This manipulation causes improper validation of specified… |
CVE-2024-6858 | Medium | 6.5 | 2026-06-04 | In Arista’s EOS when in 802.1X mode, multi-auth unauthenticated hosts might be allowed access to a switch port if there exists an EAPOL capable device in the f… |
CVE-2026-49941 | High | 7.5 | 2026-06-04 | Net::CIDR::Set versions through 0.20 for Perl did not validate IP addresses.
The add method called the _encode method to parse addresses. If the addresses did… |
CVE-2026-47675 | Medium | 4.3 | 2026-05-28 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the serialize() function in hono/cookie validates domai… |
CVE-2026-40851 | High | 8.4 | 2026-05-27 | A local attacker can perform a confusion attack on the cfgparser via a specially crafted file on an USB stick leading to code execution. This can result in a t… |
CVE-2026-9521 | High | 7.3 | 2026-05-26 | A security vulnerability has been detected in fraillt bitsery up to 5.2.4. Affected is the function loadFromSharedState in the library include/bitsery/ext/std_… |
CVE-2026-4646 | Medium | 4.3 | 2026-05-22 | Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate user-supplied input in API request handlers whic… |
CVE-2026-7887 | Medium | 6.4 | 2026-05-21 | For Concrete CMS 9.5.0 and below, OAuth 2.0 Authorization-Code Handler Bypasses Account Status. A user with uIsActive=0 (suspended, banned, terminated employee… |
CVE-2026-5946 | High | 7.5 | 2026-05-20 | Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CHAOS` or `HESIOD`, o… |
CVE-2026-0802 | Medium | 6.0 | 2026-05-12 | An ACAP configuration file lacked sufficient input validation, which could allow command injection and potentially lead to privilege escalation. This vulnerabi… |
CVE-2026-29645 | High | 7.5 | 2026-04-20 | NEMU (OpenXiangShan/NEMU) before v2025.12.r2 contains an improper instruction-validation flaw in its RISC-V Vector (RVV) decoder. The decoder does not correctl… |
CVE-2026-33806 | High | 7.5 | 2026-04-15 | Impact:
Fastify applications using schema.body.content for per-content-type body validation can have validation bypassed entirely by prepending a space to the… |
CVE-2026-4598 | High | 7.5 | 2026-03-23 | Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse im… |
CVE-2019-25596 | Medium | 6.2 | 2026-03-22 | SpotAuditor 5.2.6 contains a denial of service vulnerability in the registration dialog that allows local attackers to crash the application by supplying an ex… |
CVE-2026-2092 | High | 7.7 | 2026-03-18 | A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the ove… |
CVE-2026-2454 | Medium | 5.8 | 2026-03-16 | Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to handle incorrectly reported array lengths which allows malicious user to ca… |
CVE-2026-25783 | Medium | 4.3 | 2026-03-16 | Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly validate User-Agent header tokens which allows an authenticated at… |
CVE-2026-20074 | High | 7.4 | 2026-03-11 | A vulnerability in the Intermediate System-to-Intermediate System (IS-IS) multi-instance routing feature of Cisco IOS XR Software could allow an unauthenticate… |
CVE-2026-26115 | High | 8.8 | 2026-03-10 | Improper validation of specified type of input in SQL Server allows an authorized attacker to elevate privileges over a network. |
CVE-2026-25179 | High | 7.0 | 2026-03-10 | Improper validation of specified type of input in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2026-29788 | High | 7.5 | 2026-03-06 | TSPortal is the WikiTide Foundation’s in-house platform used by the Trust and Safety team to manage reports, investigations, appeals, and transparency work. Pr… |
CVE-2026-2004 | High | 8.8 | 2026-02-12 | Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows an object creator to execute arbitrary code as the o… |
CVE-2026-2003 | Medium | 4.3 | 2026-02-12 | Improper validation of type "oidvector" in PostgreSQL allows a database user to disclose a few bytes of server memory. We have not ruled out viability of atta… |
CVE-2026-25639 | High | 7.5 | 2026-02-09 | Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeErr… |
CVE-2026-20119 | High | 7.5 | 2026-02-04 | A vulnerability in the text rendering subsystem of Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an unauthentic… |
CVE-2026-24307 | Critical | 9.3 | 2026-01-22 | Improper validation of specified type of input in M365 Copilot allows an unauthorized attacker to disclose information over a network. |
CVE-2026-21932 | High | 7.4 | 2026-01-20 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JavaFX). Supported v… |
CVE-2025-53627 | Medium | 5.3 | 2025-12-29 | Meshtastic is an open source mesh networking solution. The Meshtastic firmware (starting from version 2.5) introduces asymmetric encryption (PKI) for direct me… |
CVE-2025-12689 | Medium | 6.5 | 2025-12-17 | Mattermost versions 11.0.x <= 11.0.4, 10.12.x <= 10.12.2, 10.11.x <= 10.11.6 fail to check WebSocket request field for proper UTF-8 format, which allows attack… |
CVE-2025-13352 | Low | 3.0 | 2025-12-17 | Mattermost versions 10.11.x <= 10.11.6 and Mattermost GitHub plugin versions <=2.4.0 fail to validate plugin bot identity in reaction forwarding which allows a… |
CVE-2024-2105 | Medium | 6.5 | 2025-12-10 | An unauthorised attacker within bluetooth range may use an improper validation during the BLE connection request to deadlock the affected devices. |
CVE-2025-32901 | Medium | 4.3 | 2025-12-05 | In KDE Connect before 1.33.0 on Android, malicious device IDs (sent via broadcast UDP) could cause an application crash. |
CVE-2025-20756 | Medium | 6.5 | 2025-12-02 | In Modem, there is a possible system crash due to a logic error. This could lead to remote denial of service, if a UE has connected to a rogue base station con… |
CVE-2025-60633 | Medium | 6.5 | 2025-11-24 | An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via the Nudm_SubscriberDataManagement API. |
CVE-2025-12977 | Critical | 9.1 | 2025-11-24 | Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins fail to sanitize tag_key inputs. An attacker with network access or the ability to write reco… |
CVE-2025-41729 | High | 7.5 | 2025-11-24 | An unauthenticated remote attacker can send a specially crafted Modbus read command to the device which leads to a denial of service. |
CVE-2025-9524 | Medium | 4.3 | 2025-11-11 | The VAPIX API port.cgi did not have sufficient input validation, which may result in process crashes and impact usability. This vulnerability can only be explo… |
CVE-2025-8108 | Medium | 6.7 | 2025-11-11 | An ACAP configuration file has improper permissions and lacks input validation, which could potentially lead to privilege escalation. This vulnerability can on… |
CVE-2025-6298 | Medium | 6.7 | 2025-11-11 | ACAP applications can gain elevated privileges due to improper input validation, potentially leading to privilege escalation. This vulnerability can only be ex… |
CVE-2025-4645 | Medium | 6.7 | 2025-11-11 | An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution. This vulnerability can only be exploited if the… |
CVE-2025-59278 | High | 7.8 | 2025-10-14 | Improper validation of specified type of input in Windows Authentication Methods allows an authorized attacker to elevate privileges locally. |
CVE-2025-59277 | High | 7.8 | 2025-10-14 | Improper validation of specified type of input in Windows Authentication Methods allows an authorized attacker to elevate privileges locally. |
CVE-2025-59275 | High | 7.8 | 2025-10-14 | Improper validation of specified type of input in Windows Authentication Methods allows an authorized attacker to elevate privileges locally. |
CVE-2025-59259 | Medium | 6.5 | 2025-10-14 | Improper validation of specified type of input in Windows Local Session Manager (LSM) allows an authorized attacker to deny service over a network. |
CVE-2025-59257 | Medium | 6.5 | 2025-10-14 | Improper validation of specified type of input in Windows Local Session Manager (LSM) allows an authorized attacker to deny service over a network. |
CVE-2025-58729 | Medium | 6.5 | 2025-10-14 | Improper validation of specified type of input in Windows Local Session Manager (LSM) allows an authorized attacker to deny service over a network. |
CVE-2025-55701 | High | 7.8 | 2025-10-14 | Improper validation of specified type of input in Microsoft Windows allows an authorized attacker to elevate privileges locally. |
CVE-2025-58084 | Low | 3.5 | 2025-10-13 | Mattermost Desktop App versions <= 5.13.0 fail to validate URLs external to the configured Mattermost servers, allowing an attacker on a server the user has co… |
CVE-2025-61672 | | | 2025-10-08 | Synapse is an open source Matrix homeserver implementation. Lack of validation for device keys in Synapse before 1.138.3 and in Synapse 1.139.0 allow an attack… |
CVE-2025-20327 | High | 7.7 | 2025-09-24 | A vulnerability in the web UI of Cisco IOS Software could allow an authenticated, remote attacker with low privileges to cause a denial of service (DoS) condit… |
CVE-2025-10207 | High | 7.2 | 2025-09-18 | Improper Validation of Specified Type of Input vulnerability in ABB FLXEON.This issue affects FLXEON: through 9.3.5. |
CVE-2024-48851 | High | 7.2 | 2025-09-18 | Improper Validation of Specified Type of Input vulnerability in ABB FLXEON.A remote code execution is possible due to an improper input validation.
This is… |
CVE-2025-42929 | High | 8.1 | 2025-09-09 | Due to missing input validation, an attacker with high privilege access to ABAP reports could delete the content of arbitrary database tables, if the tables ar… |
CVE-2025-42916 | High | 8.1 | 2025-09-09 | Due to missing input validation, an attacker with high privilege access to ABAP reports could delete the content of arbitrary database tables, if the tables ar… |
CVE-2025-8402 | Medium | 4.9 | 2025-08-21 | Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.0, 10.9.x <= 10.9.3 fail to validate import data which allows a sys… |
CVE-2025-20251 | High | 8.5 | 2025-08-14 | A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defe… |
CVE-2025-20244 | High | 7.7 | 2025-08-14 | A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defe… |
CVE-2025-9042 | | | 2025-08-14 | A security issue exists due to improper handling of CIP Class 32’s request when a module is inhibited on the 5094-IY8 device. It causes the module to enter a f… |
CVE-2025-9041 | | | 2025-08-14 | A security issue exists due to improper handling of CIP Class 32’s request when a module is inhibited on the 5094-IF8 device. It causes the module to enter a f… |
CVE-2025-30027 | Medium | 6.7 | 2025-08-12 | An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution. This vulnerability can only be exploited if the… |
CVE-2025-54525 | High | 7.5 | 2025-08-11 | Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant hit to create chann… |
CVE-2025-8556 | Low | 3.7 | 2025-08-06 | A flaw was found in CIRCL's implementation of the FourQ elliptic curve. This vulnerability allows an attacker to compromise session security via low-order poin… |
CVE-2024-40682 | Medium | 6.2 | 2025-07-23 | IBM SmartCloud Analytics - Log Analysis 1.3.7.0, 1.3.7.1, 1.3.7.2, 1.3.8.0, 1.3.8.1, and 1.3.8.2 could allow a local user to cause a denial of service due to i… |
CVE-2025-24335 | Low | 2.0 | 2025-07-02 | Nokia Single RAN baseband software versions earlier than 24R1-SR 2.1 MP contain a SOAP message input validation flaw, which in theory could potentially be used… |
CVE-2025-40910 | Medium | 6.5 | 2025-06-27 | Net::IP::LPM version 1.10 for Perl does not properly consider leading zero characters in IP CIDR address strings, which could allow attackers to bypass access… |
CVE-2025-52883 | Medium | 5.3 | 2025-06-24 | Meshtastic-Android is an Android application for the mesh radio software Meshtastic. Prior to version 2.5.21, an attacker is able to send an unencrypted direct… |
CVE-2025-25020 | Medium | 6.5 | 2025-06-03 | IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could allow an authenticated user to cause a den… |
CVE-2025-0325 | Medium | 4.3 | 2025-06-02 | A Guard Tour VAPIX API parameter allowed the use of arbitrary values and can be incorrectly called, allowing an attacker to block access to the guard tour conf… |
CVE-2025-40911 | Medium | 6.5 | 2025-05-27 | Net::CIDR::Set versions 0.10 through 0.13 for Perl does not properly handle leading zero characters in IP CIDR address strings, which could allow attackers to… |
CVE-2025-41650 | High | 7.5 | 2025-05-27 | An unauthenticated remote attacker can exploit input validation in cmd services of the devices, allowing them to disrupt system operations and potentially caus… |
CVE-2025-20155 | Medium | 6.0 | 2025-05-07 | A vulnerability in the bootstrap loading of Cisco IOS XE Software could allow an authenticated, local attacker to write arbitrary files to an affected system.
… |
CVE-2025-46342 | High | 8.5 | 2025-04-30 | Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.13.5 and 1.14.0, it may happen that policy rules using nam… |
CVE-2025-41395 | Medium | 6.5 | 2025-04-24 | Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate the props used by the RetrospectivePost custom post type in… |
CVE-2025-32442 | High | 7.5 | 2025-04-18 | Fastify is a fast and low overhead web framework, for Node.js. In versions 5.0.0 to 5.3.0 as well as version 4.29.0, applications that specify different valida… |
CVE-2024-42189 | Medium | 6.5 | 2025-04-15 | HCL BigFix Web Reports might be subject to a Denial of Service (DoS) attack, due to a potentially weak validation of an API parameter. |
CVE-2024-47261 | Medium | 4.3 | 2025-04-08 | 51l3nc3, a member of the AXIS OS Bug Bounty Program, has found that the VAPIX API uploadoverlayimage.cgi did not have sufficient input validation to allow an a… |
CVE-2025-3070 | Medium | 6.5 | 2025-04-02 | Insufficient validation of untrusted input in Extensions in Google Chrome prior to 135.0.7049.52 allowed a remote attacker to perform privilege escalation via… |
CVE-2025-1558 | Medium | 6.5 | 2025-03-24 | Mattermost Mobile Apps versions <=2.25.0 fail to properly validate GIF images prior to rendering which allows a malicious user to cause the Android application… |
CVE-2024-47262 | Medium | 5.3 | 2025-03-04 | Dzmitry Lukyanenka, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API param.cgi was vulnerable to a race condition attack allowing for an… |
CVE-2024-56908 | Medium | 6.8 | 2025-02-13 | In Perfex Crm < 3.2.1, an authenticated attacker can send a crafted HTTP POST request to the affected upload_sales_file endpoint. By providing malicious input… |
CVE-2024-12756 | High | 7.3 | 2025-02-11 | An HTML Injection vulnerability in Avaya Spaces may have allowed disclosure of sensitive information or modification of the page content seen by the user. |
CVE-2025-24876 | High | 8.1 | 2025-02-11 | The SAP Approuter Node.js package version v16.7.1 and before is vulnerable to Authentication bypass. When trading an authorization code an attacker can steal t… |
CVE-2025-25186 | Medium | 6.5 | 2025-02-10 | Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Starting in version 0.3.2 and prior to versions 0.3.8, 0.4.19, and 0… |
CVE-2025-24804 | Medium | 4.3 | 2025-02-05 | Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment fr… |
CVE-2024-8125 | | | 2025-02-04 | Improper Validation of Specified Type of Input vulnerability in OpenText™ Content Management (Extended ECM) allows Parameter Injection.
A bad actor with the… |
CVE-2025-20630 | Medium | 6.5 | 2025-01-16 | Mattermost Mobile versions <=2.22.0 fail to properly handle posts with attachments containing fields that cannot be cast to a String, which allows an attacker… |