ROS-20260915-73-0076

The vulnerability of the WebAuthentication component in Google Chrome and Microsoft Edge relates to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...

ROS-20260915-73-0102

The vulnerability in Chromium is related to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to cause service failures...

ROS-20260915-73-0071

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

CVE-2026-88261: Improper Input Validation

Improper input validation vulnerability in bizwell xClick allows Stored XSS. This issue affects xClick: R2, R3, and R3.1...

CVE-2026-58683: Improper Input Validation

In IP Multimedia Subsystem, there is a possible out-of-bounds write due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-12355: Improper Neutralization of Special Elements in Output Used by a Downstream Component

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an attacker to perform JNDI injection attacks due to insufficient input validation,...

CVE-2026-44778: Improper Input Validation

Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. From 0.28.0 until 0.53.1, the USDT note parser in pkg/uprobetracer/usdt.go can allow an unprivileged container to crash or exhaust the memory of the...

CVE-2025-66974: Improper Input Validation

An issue in Prolink 13A Smart Plug Model Version: DS-3202M-UKv3 Wi-Fi and Application Version mEzee 2.6.7 allows attackers to cause a Denial of Service DoS or connection to an attacker-controlled device via supplying a crafted packet during the provisioning phase...

CVE-2026-56831: Improper Input Validation

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.0, the /cpanel/discounts administrative interface accepts negative fixedamount discount values, persists them in shdiscounts, and passes them through vendor/shopper/cart/src/Discounts/DiscountCalculator.php and...

CVE-2026-44300: Improper Input Validation

OpenCost provides cost monitoring for Kubernetes workloads and cloud costs. Prior to 1.121.0, the POST /serviceKey endpoint in pkg/costmodel/router.go allows a network client to invoke AddServiceKey without mandatory authentication and submit an arbitrary key form value that is written to the GCP...

CVE-2026-19655: Improper Input Validation

On affected platforms running Arista EOS with Dynamic Host Configuration Protocol DHCP relay/snooping configured with the information option Option 82, or with the DHCP server configured with match criteria based on the information option, an unauthenticated attacker connected to a client-facing...

ROS-20260915-73-0044

The vulnerability of the WebRTC component in Google Chrome and Microsoft Edge relates to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to gain access to confidential data...

CVE-2026-18117 Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Custom Page Alias Name

Concrete CMS 9.0.0 through 9.5.3 is vulnerable to stored XSS via the custom page alias name customAliasName because the Edit Alias dialog applied only trim to the submitted value and performed no input neutralization. An authenticated user holding canWrite editor permission on a page could store ...

CVE-2026-86924

A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7. Connecting a malicious accessory may cause unexpected system termination...

CVE-2026-86903

An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. An app may be able to disclose kernel memory...

CVE-2026-86900

An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27. Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure...

CVE-2026-86885

An input validation issue was addressed with improved input validation. This issue is fixed in iOS 27 and iPadOS 27. An attacker in radio range may be able to cause unexpected system termination...

CVE-2026-86886

A path traversal issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, watchOS 27. An app may be able to modify protected system files...

CVE-2026-86879

A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 27 and iPadOS 27. A remote attacker may be able to cause a denial-of-service...

CVE-2026-84620

An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted 3D model may lead to memory...