CVE-2026-93567: Improper Input Validation

A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the tunnel authority. A remote attacker can exploit this by supplying a different Host header, leadi...

PT-2026-95492

Name of the Vulnerable Software and Affected Versions AnyCable versions prior to 1.6.15 Description The Pusher-compatible REST API in pusher/http.go includes the caller-supplied body md5 value in the HMAC input but fails to calculate the digest of the received request body or compare it with the...

CVE-2026-17576: Improper Neutralization of Special Elements used in an SQL Command

The InfiniteWP Client plugin for WordPress is vulnerable to SQL Injection via the getcomments action in versions up to, and including, 1.13.9. This is due to insufficient escaping on the array-key names supplied in the JSON request body before use in a SQL statement: IWPMMBComment::getcomments...

CVE-2026-83561: Improper Neutralization of Input During Web Page Generation

The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Elementor Cookie Blocker Regex in all versions up to, and including, 7.5.4 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-95443

Name of the Vulnerable Software and Affected Versions IBM Controller versions 11.0.0 through 11.0.1 FP7 IBM Controller versions 11.1.0 through 11.1.3 FP1 Description An authenticated user can bypass input validation because the software improperly validates client-side input regarding file size...

CVE-2026-18911: Improper Input Validation

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an agent authentication bypass, allowing unenrolled agents to send requests without proper authentication...

Cisco Identity Services Engine Multiple Vulnerabilities (cisco-sa-ise-mult-vul-ymSsTLCc)

According to its self-reported version, Cisco ISE is affected by multiple vulnerabilities. - A vulnerability in the SXP REST API of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks. CVE-2026-20284 - A vulnerability in the SXP REST API of Cisco ISE could all...

Linux Distros Unpatched Vulnerability : CVE-2026-93337

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains an improper input validation vulnerability that allows local users with VPN connection creation...

The vulnerability of the ColdFusion software platform, related to insufficient validation of input data, allows attackers to execute arbitrary code.

The vulnerability of the ColdFusion software platform is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the Rsync file transfer and synchronization utility lies in the lack of measures to neutralize specific elements, allowing a perpetrator to execute arbitrary commands.

The vulnerability of the Rsync file transfer and synchronization utility is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Linux Distros Unpatched Vulnerability : CVE-2026-92523

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RDMA/nldev: validate dynamic counter attribute length RDMANLDEVATTRSTATHWCOUNTERS is a nested attribute whose children are consumed directly with nlagetu32. The...

NPM: Svelte devalue: DoS via malformed input

NPM: Svelte devalue: DoS via malformed input vulnerability discovered by ? in WordPress Npm devalue versions 5.9.1...

CVE-2026-93337

NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains an improper input validation vulnerability that allows local users with VPN connection creation permissions to inject arbitrary pppd directives by supplying mru or mtu property values containing trailing non-numeric content after a val...

CVE-2026-93337

NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains an improper input validation vulnerability that allows local users with VPN connection creation permissions to inject arbitrary pppd directives by supplying mru or mtu property values containing trailing non-numeric content after a val...

UBUNTU-CVE-2026-93337

NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains an improper input validation vulnerability that allows local users with VPN connection creation permissions to inject arbitrary pppd directives by supplying mru or mtu property values containing trailing non-numeric content after a val...

EUVD-2026-82381

NetworkManager-l2tp contains an improper input validation vulnerability that allows local users with VPN connection creation permissions to inject arbitrary pppd directives by supplying mru or mtu property values containing trailing non-numeric content after a valid integer. Attackers can exploit...

CVE-2026-93337

NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains an improper input validation vulnerability that allows local users with VPN connection creation permissions to inject arbitrary pppd directives by supplying mru or mtu property values containing trailing non-numeric content after a val...

AZL-102281 CVE-2026-93146 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: time/namespace: Validate nanosecond field in proctimenssetoffset The function validates tvsec to be within -KTIMESECMAX, KTIMESECMAX but never validates that tvnsec is within the valid range of 0, NSECPERSEC-1 before using it in...

CVE-2026-93146

In the Linux kernel, the following vulnerability has been resolved: time/namespace: Validate nanosecond field in proctimenssetoffset The function validates tvsec to be within -KTIMESECMAX, KTIMESECMAX but never validates that tvnsec is within the valid range of 0, NSECPERSEC-1 before using it in...

CVE-2026-90207

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize input teardown with eventinput sndmidiinputevent must not be running while a rawmidi substream is closing, since this can lead to the trigger state becoming out-of-step through this sequence in...