PT-2026-51496

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in AKIN Software Computer Import Export Industry and Trade Ltd. E-Commerce allows Reflected XSS. This issue affects e-Commerce: before 1.25.01.06...

CVE-2026-49444: Improper Input Validation

n8n is an open source workflow automation platform. Prior to 1.123.48, 2.21.8, and 2.22.4, an authenticated user with permission to create or modify workflows containing a Python Code Node could escape the sandbox and achieve arbitrary code execution on the task runner container. This vulnerabili...

CVE-2026-56762: Improper Input Validation

Hono before 4.12.12 does not validate cookie names on the write path in the setCookie, serialize, and serializeSigned functions, allowing invalid characters such as control characters e.g. \r or \n when an application passes a user-controlled cookie name. This can produce malformed Set-Cookie...

CVE-2026-10651: Improper Input Validation

btsdpparseattribute in subsys/bluetooth/host/classic/sdp.c validated only that the SDP record buffer held the type-marker byte plus the 2-byte attribute ID a check of buf-len data0 before its only bounds guard an ASSERTNOMSG that compiles out when CONFIGASSERT is disabled, the production default,...

CVE-2026-54588: Improper Input Validation

Poweradmin is a web-based DNS administration tool for PowerDNS server. Versions prior to 4.2.4 and 4.3.3 use the attacker-controlled HTTPHOST request header as the authoritative source for building callback URLs in its OIDC, SAML, and logout authentication flows without any validation. An...

Ubiquiti UniFi OS Improper Input Validation Vulnerability

Ubiquiti UniFi OS contains an improper input validation vulnerability which could allow a malicious actor with access to the network to conduct command injection...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation via the getUsdtInfo function in the USDT note parser. An attacker can cause the process to crash or exhaust memory by supplying a crafted ELF file with manipulated note sizes. This is only exploitable if a gadg...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation via the getUsdtInfo function in the USDT note parser. An attacker can cause the process to crash or exhaust memory by supplying a crafted ELF file with manipulated note sizes. This is only exploitable if a gadg...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation via the getUsdtInfo function in the USDT note parser. An attacker can cause the process to crash or exhaust memory by supplying a crafted ELF file with manipulated note sizes. This is only exploitable if a gadg...

BIT-DOTNET-SDK-2026-35433 .NET Elevation of Privilege Vulnerability

Improper input validation in .NET allows an unauthorized attacker to elevate privileges locally...

BIT-DOTNET-2026-35433 .NET Elevation of Privilege Vulnerability

Improper input validation in .NET allows an unauthorized attacker to elevate privileges locally...

CVE-2026-54299: Improper Input Validation

Astro is a web framework. Prior to 6.4.6, Astro SSR apps with prerendered error pages /404 or /500 using export const prerender = true fetch those pages over HTTP at runtime when an error occurs. The URL for this fetch is derived from request.url, which in turn gets its origin from the incoming...

NVIDIA NeMo Framework arbitrary code execution vulnerability

NVIDIA NeMo Framework is an open-source generative AI development platform designed specifically for researchers and developers. It aims to efficiently build, customize, and deploy large language models, multimodal models, and voice AI models. The NVIDIA NeMo Framework has a code execution...

CVE-2026-55602: Improper Input Validation

http-proxy-middleware is node.js http-proxy middleware. From 0.16.0 until 2.0.10, 3.0.6, and 4.1.0, http-proxy-middleware documents router proxy-table entries as host, path, or host+path selectors, but the host+path implementation uses unanchored substring matching on attacker-controlled request...

CVE-2026-53537: Improper Input Validation

Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, parseoptionsheader parsed Content-Disposition and Content-Type headers with email.message.Message, which transparently applies RFC 2231/5987 decoding. The extended parameter syntax filename=charset'lang'value, name=...,...

CVE-2026-7165: Improper Input Validation

The vulnerability is present in the ‘/addJugador’ endpoint: The 'keyJugador' and 'keyJugadorObjectiu' parameters allow the modification of other users’ information without requiring prior authorization validation. This could enable an authenticated attacker to alter any user’s ID and change their...

CVE-2026-56306: Improper Input Validation

Capgo before 12.128.2 contains a weak parsing vulnerability in the x-limited-key-id header that allows attackers to bypass subkey enforcement by submitting malformed values, zero, or duplicate headers that result in NaN or falsy values. Remote attackers can manipulate the x-limited-key-id header ...

CVE-2026-56228: Improper Input Validation

Capgo before 12.128.2 fails to enforce a maximum value on the minimum password length field in its password policy configuration. An authenticated organization administrator can set an extremely large numeric value e.g., billions of characters as the minimum password length, making compliance...

FreeBSD : Routinator -- CWE-20 Improper Input Validation (40edfb37-6a59-11f1-bf61-3c7c3fba4204)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 40edfb37-6a59-11f1-bf61-3c7c3fba4204 advisory. https://www.nlnetlabs.nl/downloads/routinator/CVE-2026-49234.txt reports: When sending a specifically...

CVE-2026-56340: Improper Input Validation

vLLM versions = 0.10.2 and 0.13.0 are missing sparse tensor validation in multimodal embeddings processing. Because PyTorch disables sparse tensor invariant checks by default, an attacker can submit crafted embedding requests with malformed negative or out-of-bounds tensor indices, when the...