Apple iOS, iPadOS, and macOS Certificate Validation

Apple iOS, iPadOS, macOS, tvOS, visionOS, and watchOS contain a certificate validation issue that could allow an attacker with a compromised intermediate certificate authority to issue certificates with arbitrary extended key usages...

PT-2026-104684

Name of the Vulnerable Software and Affected Versions apu affected versions not specified Description Improper input validation in apu can lead to memory corruption, which may allow a local escalation of privilege without requiring additional execution privileges or user interaction...

CVE-2026-93317: Improper Validation of Integrity Check Value

An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed digest. The resulting snapshot could be cached under that digest and reused by a later victim build, compromising build-input integrity...

PT-2026-104685

In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patc...

The vulnerability of the software platform for conducting marketing campaigns in Adobe Campaign Classic lies in the insufficient validation of input data, allowing a hacker to execute arbitrary code.

The vulnerability of the Adobe Campaign Classic software platform for conducting marketing campaigns is related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code...

The vulnerability of the Apache ActiveMQ software platform, related to insufficient validation of input data, allows attackers to trigger service failures.

The vulnerability of the Apache ActiveMQ software platform is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures...

The vulnerability of the StaticFiles.lookup_path() function in the Starlette ASGI framework for web development allows a attacker to perform an SSRF attack.

The vulnerability of the StaticFiles.lookuppath function in the Starlette ASGI framework for web development is related to insufficient validation of requests on the server side. Exploiting this vulnerability could allow a malicious actor to perform an SSRF attack...

The vulnerability of Containerd’s execution environment, related to insufficient validation of input data, allows attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of Containerd’s execution environment is related to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to compromise the confidentiality and integrity of the protected information...

CVE-2026-105292: Cross-Site Request Forgery (CSRF)

Chaterm before 0.12.1 contains a login cross-site request forgery vulnerability that allows remote attackers to inject login state by sending chaterm:// callbacks without OAuth state validation. Attackers can trigger a crafted callback with attacker-controlled userInfo from a web page, signing th...

CVE-2026-105223: Improper Certificate Validation

maclof kubernetes-client 0.17.0 before 0.32.0 disables TLS certificate verification in parseKubeconfig and parseKubeconfigFile when a kubeconfig lacks certificate-authority-data, ignoring insecure-skip-tls-verify. On-path attackers can impersonate the Kubernetes API server to capture Bearer token...

CVE-2026-79820: Improper Authentication

A remote user validation failure vulnerability exists in HPE Integrated Lights-Out iLO 7 firmware...

CVE-2026-58834: Improper Input Validation

In setPermissionGrantState of DevicePolicyManagerService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-101919: Improper Input Validation

A flaw was found in the HyperShift operator. The operator copies user-provided Kubernetes configuration kubeconfig secrets directly into the privileged control plane namespace without proper validation or sanitization. An authenticated user with cluster and secret creation permissions can exploit...

ROS-20261005-73-0104

The vulnerability in the net/netfilter/nftablesapi.c module of the Linux operating system is related to insufficient input data validation. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-105681: Improper Neutralization of Special Elements in Data Query Logic

Ghost is a Node.js content management system. From 5.9.0 until 6.44.1, an input validation issue allowed members to access comments they were not authorized to access. This issue is fixed in version 6.44.1...

CVE-2026-85086

Improper certificate validation, Initialization of a resource with an insecure default vulnerability in Apache Thrift perl bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-85087

Improper certificate validation, Return of wrong status code vulnerability in Apache Thrift python bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-94645

Improper validation of specified quantity in input, Allocation of resources without limits or throttling vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

PT-2026-106200

Name of the Vulnerable Software and Affected Versions Ghost versions 5.9.0 through 6.44.0 Description An input validation issue in this Node.js content management system allows members to access comments for which they lack proper authorization. Recommendations Update to version 6.44.1...

PT-2026-106181

Name of the Vulnerable Software and Affected Versions Ghost versions 6.54.1 through 6.64.0 Description A validation issue in the Webmentions functionality allows an unauthenticated user to perform limited HTTP requests to hosts within the internal network of the Ghost server. This type of flaw is...