103 matches found
CVE-2026-101079 agentverus agentverus-scanner context.js isSecurityDefenseSkill reliance on untrusted inputs in a security decision
A vulnerability was found in agentverus agentverus-scanner up to 0.8.1. Affected by this vulnerability is the function isSecurityDefenseSkill of the file dist/scanner/analyzers/context.js. Performing a manipulation results in reliance on untrusted inputs in a security decision. The attack must be...
CVE-2026-78427: Reliance on Untrusted Inputs in a Security Decision
The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matches one of three hardcoded service mesh sidecar images. Since the image path is entirely controlled by the workload author, any user capable of deploying workloads can evade admission den...
CVE-2026-19953: Improper Validation of Unsafe Equivalence in Input
URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep. nameprep lowercases each host label but performs no Unicode normalization. IDNA requires a label to be normalized to Form C before it is encoded RFC 5891, so a label...
PT-2026-82088
Name of the Vulnerable Software and Affected Versions Apache APISIX versions 3.11.0 through 3.17.0 Description An issue exists where the attach-consumer-label plugin fails to correctly sanitize certain input values. This allows an attacker to perform an authorization bypass or escalate privileges...
Reliance on Untrusted Inputs in a Security Decision
Overview fastify is an overhead web framework, for Node.js. Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision through the getTrustProxyFn hop-count handling in lib/request.js when trustProxy is configured as a number. An attacker can overwrite...
CVE-2026-64934
CVE-2026-64934 affects the Mira Hormone Monitor ecosystem, specifically the Mira Android App and related cloud API. The root cause is reliance on the firmware version reported by the companion app without independent attestation from the device itself. An authenticated attacker could submit arbit...
CVE-2026-64934 Mira Hormone Monitor, Mira Android App Reliance on untrusted inputs in a security decision
The Mira cloud API accepts the firmware version reported by the companion app as authoritative for a given device, without independently attesting the version from the device itself. An authenticated attacker could submit arbitrary firmware version strings for their own device, allowing them to...
CVE-2026-64934 Mira Hormone Monitor, Mira Android App Reliance on untrusted inputs in a security decision
The Mira cloud API accepts the firmware version reported by the companion app as authoritative for a given device, without independently attesting the version from the device itself. An authenticated attacker could submit arbitrary firmware version strings for their own device, allowing them to...
Reliance on Untrusted Inputs in a Security Decision
Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision through the client authentication flow in the client...
OESA-2026-2841 qt5-qtbase security update
This package provides base tools, such as string, xml, and network handling. Security Fixes: An issue was discovered in HTTP2 in Qt before 5.15.18, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.7, and 6.6.x through 6.7.x before 6.7.3. Code to make security-relevant decisions about an...
CVE-2026-12058: Reliance on Untrusted Inputs in a Security Decision
The connection confirmation pop-up of a specific feature in the PcSuite can be bypassed...
Reliance on Untrusted Inputs in a Security Decision
Overview sillytavern is a LLM Frontend for Power Users Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the headerUserLogin function. An attacker can gain unauthorized access to any user account, including administrators, by injecting...
CVE-2026-0390
Reliance on untrusted inputs in a security decision in Windows Boot Loader allows an authorized attacker to bypass a security feature locally...
UEFI Secure Boot Security Feature Bypass Vulnerability
Reliance on untrusted inputs in a security decision in Windows Boot Loader allows an authorized attacker to bypass a security feature locally...
PT-2026-32716
Name of the Vulnerable Software and Affected Versions Windows Boot Loader affected versions not specified Description Reliance on untrusted inputs in a security decision allows an authorized attacker to bypass a security feature locally. Recommendations At the moment, there is no information abou...
Reliance on Untrusted Inputs in a Security Decision
Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the PIPINDEXURL and UVINDEXURL environment variables, which bypass host execution environment sanitization and redirect Python...
Reliance on Untrusted Inputs in a Security Decision
Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the chat.send process. An attacker can inject unauthorized provenance fields by spoofing client identity metadata during the...
Reliance on Untrusted Inputs in a Security Decision
Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision in the trusted-proxy Control UI session handling process. An attacker can retain privileged scopes without device identity by accessing...
Reliance on Untrusted Inputs in a Security Decision
Overview Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision through spoofed headers in the Rate-Limit process. An attacker can circumvent request throttling by manipulating HTTP headers to appear as different users or clients, potentially...
