CVE-2026-105648: Incomplete List of Disallowed Inputs

Ghost is a Node.js content management system. From 6.0.9 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network on some network configurations. A...

CVE-2026-105292: Cross-Site Request Forgery (CSRF)

Chaterm before 0.12.1 contains a login cross-site request forgery vulnerability that allows remote attackers to inject login state by sending chaterm:// callbacks without OAuth state validation. Attackers can trigger a crafted callback with attacker-controlled userInfo from a web page, signing th...

PT-2026-104684

Name of the Vulnerable Software and Affected Versions apu affected versions not specified Description Improper input validation in apu can lead to memory corruption, which may allow a local escalation of privilege without requiring additional execution privileges or user interaction...

PT-2026-106200

Name of the Vulnerable Software and Affected Versions Ghost versions 5.9.0 through 6.44.0 Description An input validation issue in this Node.js content management system allows members to access comments for which they lack proper authorization. Recommendations Update to version 6.44.1...

ROS-20261005-73-0133

The vulnerability of the kawethprobe function in the drivers/net/usb/kaweth.c module of the Linux USB network adapter driver framework is related to improper validation of consistency checks in input data. Exploiting this vulnerability could allow an attacker to cause service failures...

CVE-2026-85086

Improper certificate validation, Initialization of a resource with an insecure default vulnerability in Apache Thrift perl bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-105223: Improper Certificate Validation

maclof kubernetes-client 0.17.0 before 0.32.0 disables TLS certificate verification in parseKubeconfig and parseKubeconfigFile when a kubeconfig lacks certificate-authority-data, ignoring insecure-skip-tls-verify. On-path attackers can impersonate the Kubernetes API server to capture Bearer token...

Cisco ASA Improper Input Validation (CVE-2019-1687)

A vulnerability in the TCP proxy functionality for Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause the device to restart unexpectedly, resulting in a denial of service DoS condition. The...

PT-2026-106238

Name of the Vulnerable Software and Affected Versions Canimaan Software ClamXAV versions 3.3 through 3.11 Description A local privilege escalation issue exists in the Privileged Helper Tool. This is caused by a race condition and insufficient file validation, which allows a local attacker to...

PT-2026-104685

In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patc...

CVE-2026-93317: Improper Validation of Integrity Check Value

An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed digest. The resulting snapshot could be cached under that digest and reused by a later victim build, compromising build-input integrity...

PT-2026-106205

Name of the Vulnerable Software and Affected Versions Ghost versions 6.14.0 through 6.26.0 Description An input validation issue in this Node.js content management system may allow staff users to access local files located outside the intended data storage directories on the server. Recommendatio...

PT-2026-104666

Chaterm before 0.12.1 contains a login cross-site request forgery vulnerability that allows remote attackers to inject login state by sending chaterm:// callbacks without OAuth state validation. Attackers can trigger a crafted callback with attacker-controlled userInfo from a web page, signing th...

PT-2026-106002

Name of the Vulnerable Software and Affected Versions HPE Integrated Lights-Out iLO 7 version 1.25.00 Description A remote user validation failure exists in the firmware. This issue could allow an unauthorized user to gain access to the iLO, which provides capabilities to power a server and open ...

CVE-2026-101919: Improper Input Validation

A flaw was found in the HyperShift operator. The operator copies user-provided Kubernetes configuration kubeconfig secrets directly into the privileged control plane namespace without proper validation or sanitization. An authenticated user with cluster and secret creation permissions can exploit...

CVE-2026-79820: Improper Authentication

A remote user validation failure vulnerability exists in HPE Integrated Lights-Out iLO 7 firmware...

CVE-2026-93326: Incorrect Behavior Order: Validate Before Canonicalize

A build step for a Git source, crafted in a specific way, can bypass some policy validation rules. A malicious build definition can make the repository look like it is coming from a different remote URL than it really is when Git clone is happening. If policy is doing more stricter validation, fo...

Cisco ASA NULL Pointer Dereference (CVE-2024-20426)

A vulnerability in the Internet Key Exchange version 2 IKEv2 protocol for VPN termination of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected...

The vulnerability of the software platform for conducting Adobe Campaign Classic marketing campaigns stems from insufficient validation of input data, allowing a hacker to execute arbitrary code.

The vulnerability of the Adobe Campaign Classic software platform for conducting marketing campaigns is related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code...

The vulnerability of the software platform for conducting marketing campaigns in Adobe Campaign Classic lies in the insufficient validation of input data, allowing a hacker to execute arbitrary code.

The vulnerability of the Adobe Campaign Classic software platform for conducting marketing campaigns is related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code...