CVE-2026-88064: Improper Input Validation

Backstage is an open framework for building developer portals. Prior to 1.14.6 and from 1.15.0 until 1.15.4, the @backstage/plugin-techdocs-node package insufficiently validates mkdocs.yml supplied by an authenticated user who can register or modify a TechDocs source. Unsafe Python YAML tags,...

EUVD-2026-80932

An issue in Sogou Sogou Input Method 16.3.0.3498 fixed in 16.3.0.3498 allows a remote attacker to execute arbitrary code via the bizhelper.exe component...

PT-2026-93282

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some import configuration values before using them in SQL statements, allowing users whose role an administrator has granted the WP Import Export Lite WordPress plugin before 3.9.33's import permission ...

PT-2026-93262

Name of the Vulnerable Software and Affected Versions VeloCloud Edge affected versions not specified Description Insufficient validation of inputs within management and configuration workflows allows an authorized management request or configuration value to be interpreted as an operating-system...

CVE-2026-89207: Improper Validation of Specified Type of Input

A vulnerability has been identified in WTV676-HB6035 Web Interface All versions V3.94, WTV776-HB6035 Web Interface All versions V4.17. Affected devices do not properly validate input received from backend services. This could allow an unauthenticated remote attacker to force the device into...

CVE-2026-51990: Improper Control of Generation of Code

An issue in Sogou Sogou Input Method 16.3.0.3498 fixed in 16.3.0.3498 allows a remote attacker to execute arbitrary code via the bizhelper.exe component...

CVE-2026-18595: Improper Neutralization of Input During Web Page Generation

The WP-Lister Lite for eBay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via AJAX Cron Handler Request Parameter in all versions up to, and including, 3.8.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

ROS-20260916-73-0047

The vulnerability in the kernel-lt is related to errors in processing input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2026-73445: Improper Input Validation

On affected platforms running Arista EOS, an issue with the gRPC Network Security Interface gNSI Authz Rotate RPC may cause an incorrect Authz policy which was uploaded in the ongoing RPC stream to become active. This does not affect Bootz. This issue was discovered internally by Arista and the...

PT-2026-93389

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds write exists in the xfrm6 input addr function. The issue occurs when the secpath is full, caused by an off-by-one error in the depth check. When the transport-mode recei...

PT-2026-93690

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the skb zerocopy function where it incorrectly calls skb tx error on the source skb during an skb orphan frags failure. This operation is destructive to the source skb...

PT-2026-93682

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the HID sony driver where the sony input configured function adds controllers to the sony device list before the HID core registers the input devices. If the input...

CVE-2026-86475: Improper Input Validation

The Appointment Hour Booking WordPress plugin before 1.5.95 does not check every appointment in a booking submission against the capacity configured for its own slot, allowing unauthenticated visitors to take slots that are already fully booked...

PT-2026-93825

Name of the Vulnerable Software and Affected Versions Sentry Seer affected versions not specified Description Sentry Seer is subject to a multi-stage trust-boundary violation where unauthenticated telemetry input can be executed as code within a privileged automation environment. The issue occurs...

PT-2026-93962

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine ISE affected versions not specified Cisco ISE Passive Identity Connector ISE-PIC affected versions not specified Description Improper input validation issues exist within the software. These issues fall under the...

CVE-2026-92581: Improper Input Validation

In AVideo through 29.0, Like::construct performs counter arithmetic on raw request values before validation, allowing array-typed parameters to desynchronize stored votes from counters. Authenticated attackers can send array-typed like parameters followed by ordinary requests to drive video like...

CVE-2026-81875: Improper Input Validation

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.12, SHCParser in org.hl7.fhir.r5/src/main/java/org/hl7/fhir/r5/elementmodel/SHCParser.java can consume attacker-controlled Smart Health Card JWT content whose header...

GitLab 15.7 < 19.1.8 / 19.2 < 19.2.6 / 19.3 < 19.3.2 (CVE-2026-13210)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an...

ROS-20260916-73-0031

The vulnerability of the ufshcdqueuecommand function in the Linux operating system is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause a service failure...

SSDP Component Arbitrary Command Execution

The vulnerability of the ssdpcgimain function in the SSDP component of the D-Link DIR-820LW router’s software lies in the lack of measures to sanitize input data. Exploiting this vulnerability could allow a remote attacker to execute arbitrary commands...