PT-2026-82665

Name of the Vulnerable Software and Affected Versions crewai-tools version 1.10.2rc1 Description A SQL injection issue exists in the NL2SQLTool component. A remote attacker can execute arbitrary SQL commands by providing an unsanitized sql query argument. SQL injection is a technique where...

EUVD-2026-67272

Agno up to and including 2.5.8 is vulnerable to Remote Code Execution RCE via prompt injection. The PythonTools and ShellTools components pass unsanitized, LLM-generated arguments directly to execution sinks including exec, runpy.runpath, and subprocess.run. An unauthenticated attacker can exploi...

CVE-2026-30068

Improper input validation in the HandleUpdate function /sbi/parameterprovision.go of free5gc v4.0.1 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2026-30071: Allocation of Resources Without Limits or Throttling

An issue in the RechargePut function of free5gc v4.0.1 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2026-26452: Improper Input Validation

ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 lcontains a vulnerability in the option parsing logic that causes a segmentation fault when processing COAP messages containing invalid option numbers...

PT-2026-82521

An issue in the ModifyAMFEventSubscriptionProcedure function processor/event exposure.go of free5gc v4.1.0 allows attackers to cause a Denial of Service DoS via supplying a crafted PATCH request...

CVE-2026-81827: Improper Input Validation

Affected versions of Flowintel incorrectly attempted to validate login email addresses by calling Emailemail. That does not perform WTForms field validation; it merely constructs a validator object. Consequently, malformed attacker-controlled email input could continue through the login process a...

CVE-2026-59322: Improper Input Validation

The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor. When decodeNativeFormat processes raw byte payloads, it deserializes embedded JSON headers into a plain Map and constructs a GenericMessage with MutableMessageHeaders without sanitizin...

PT-2026-82759

Name of the Vulnerable Software and Affected Versions FFmpeg version N-122528-gdd2976b9e1 Description A Division-by-Zero issue exists in the ff sws init single context function located in /libswscale/utils.c. This flaw allows an attacker to trigger a Denial of Service DoS by providing a specially...

CVE-2026-30058: Improper Input Validation

Improper Input Validation in the HTTPModifySubscription handler of free5gc v4.0.1 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2026-26459

ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 contains a vulnerability in the option parsing logic that causes a segmentation fault when processing malformed COAP messages with insufficient option data...

CVE-2026-38347

A heap overflow in the ffswsalphablendaway function libswscale/alphablend.c of FFmpeg git-master commit 722a217 allows attackers to cause a Denial of Service DoS via a crafted input...

ROS-20260827-73-0029

The vulnerability of the ieee80211probeclient function in the net/mac80211/cfg.c module of the mac80211 stack in the Linux operating system is related to incorrect validation of input data. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

Linux kernel NFC Driver Buffer Overflow

The vulnerability in the s3fwrn82uartread function within the drivers/nfc/s3fwrn5/uart.c file of the Linux kernel’s NFC driver is related to buffer copying without checking the size of input data a classic buffer overflow condition. Exploitation of this vulnerability enables a remote attacker to...

Exploit for Improper Input Validation in Microsoft

CVE-2023-23397 — Purple Team: Exploit + Detection Two halves...

CVE-2026-63360

LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting vulnerability in the user activation confirmation endpoint. The action query parameter is copied into the response and inserted into a hidden input attribute without HTML attribute encoding. This...

CVE-2026-21809

HCL BigFix Quantum Risk Analyzer has a certain validation process that provides overly descriptive error messages when it encounters malformed input which can allow an attacker to conduct more efficient reconnaissance and fine-tune automated fuzzing tools to produce valid input...

CVE-2026-63360 LimeSurvey Community Edition 7.0.5 - Reflected XSS in user activation confirmation endpoint

LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting vulnerability in the user activation confirmation endpoint. The action query parameter is copied into the response and inserted into a hidden input attribute without HTML attribute encoding. This...

CVE-2026-63360

LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting (XSS) vulnerability in the user activation confirmation endpoint . The root cause is that the action query parameter is copied into the response and inserted into a hidden input attribute without HT...

CVE-2026-63360 LimeSurvey Community Edition 7.0.5 - Reflected XSS in user activation confirmation endpoint

LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting vulnerability in the user activation confirmation endpoint. The action query parameter is copied into the response and inserted into a hidden input attribute without HTML attribute encoding. This...