CVE-2026-95341: Improper Input Validation

Improper input validation in Desktop in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via crafted network traffic. Chromium security severity: Medium...

CVE-2026-102677: Improper Input Validation

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 until 42.10.0, 43.5.0, and 44.0.0-beta.6, Electron's sandboxed preload code cache did not verify that a cached entry matched the preload it was served for. A compromised renderer...

CVE-2026-95276: Improper Input Validation

Improper input validation in Themes in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code inside the sandbox via crafted network traffic. Chromium security severity: Medium...

CVE-2026-92224: Improper Neutralization of Input During Web Page Generation

Joomla! Core - 20260911 - Core - XSS in link toolbar layout in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The link toolbar layout did not properly escape inputs, leading to an XSS vector...

CVE-2026-102600: Improper Input Validation

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-engine uses inherited object properties when looking up attacker-controlled session IDs in clustered deployments. Special property names such as proto or constructor can resolve...

PT-2026-102677

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - WikiSEO Extension allows Stored XSS. This issue affects Mediawiki - WikiSEO Extension: from before 1.46.1, 1.45.5, 1.43.10...

Improper Input Validation

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Improper Input Validation via insufficient hardening of runtime option handling in the fetch and HTTP adapters, where user-supplied fetchOptions are merged into the...

Improper Input Validation

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Improper Input Validation via insufficient hardening of runtime option handling in the fetch and HTTP adapters, where user-supplied fetchOptions are merge...

EUVD-2026-88337

This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated user remote code execution on the IdentityIQ server due to improper input validation of submitted web service API content...

CVE-2026-12342

This vulnerability affects all versions of SailPoint IdentityIQ . It allows an unauthenticated user to achieve remote code execution (RCE) on the IdentityIQ server. The root cause is identified as improper input validation of submitted web service API content. No specific exploit links or patch v...

CVE-2026-12342 SailPoint IdentityIQ Improper Form Validation Vulnerability

This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated user remote code execution on the IdentityIQ server due to improper input validation of submitted web service API content...

CVE-2026-12342 SailPoint IdentityIQ Improper Form Validation Vulnerability

This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated user remote code execution on the IdentityIQ server due to improper input validation of submitted web service API content...

⚡ Weekly Recap: $387M Crypto Hack, Citrix Exploits, AI Agents Go Off-Script, and More Threats

A domain used as harmless placeholder text showed up in roughly 1,700 repositories. Then somebody registered it and started serving malicious lures. That is the kind of week this was: forgotten assumptions turning into live attack surface. Elsewhere, weak service accounts, old bugs, exposed...

CVE-2026-101015

A flaw was found in OpenDMARC. A remote attacker can bypass Domain-based Message Authentication, Reporting, and Conformance DMARC policy checks by submitting domain names containing equivalent Unicode dot characters. Due to improper input validation in domain handling, the service fails to enforc...

Zero-Day Exploitation of Citrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-88772

Overview On September 27, 2026, Citrix disclosed eight new vulnerabilities affecting NetScaler ADC and NetScaler Gateway, including two critical remote code execution RCE vulnerabilities: CVE-2026-88771 and CVE-2026-88772. Both of these RCE vulnerabilities carry a critical CVSSv4 score of 9.5, an...

CISA Says Attackers Are Exploiting Two Critical Citrix NetScaler Flaws Globally

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Sunday added two critical Citrix NetScaler ADC and Gateway flaws to its Known Exploited Vulnerabilities KEV catalog, following reports of active exploitation. The vulnerabilities are listed below - CVE-2026-88771 CVSS score: 9.5 - ...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by multiple vulnerabilities in python-multipart (CVE-2026-53537, CVE-2026-53538, CVE-2026-53539, CVE-2026-53540)

Summary Multiple Denial of Service and resource exhaustion vulnerabilities in the python-multipart parser library CVE-2026-53537, CVE-2026-53538, CVE-2026-53539, CVE-2026-53540 used by IBM InfoSphere Optim Archive Viewer have been addressed by upgrading the component to version 0.0.32...

CVE-2026-97027: Improper Input Validation

Flatpak passes through arbitrary vendor-extension keys unmodified when exporting an application's Desktop Entry .desktop and D-Bus Service .service files, instead of validating against an allowlist. A malicious Flatpak app can use this to cause denial of service e.g. forced application restart...

PT-2026-99920

Name of the Vulnerable Software and Affected Versions IdentityIQ affected versions not specified Description An unauthenticated user can achieve remote code execution on the server due to improper input validation of content submitted to web service API endpoints. Recommendations At the moment,...

CVE-2026-100370: Improper Input Validation

DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+. Prior to version 1.0.15, the isDangerousUrl method is responsible for rejecting dangerous URL values in the href and xlink:href attributes. The weakness is that "javascript:" is rejected as a scheme, while "data:" is rejected only when the...