CVE-2026-109383 undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent

undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool, and because JSON cannot represent...

CVE-2026-103350

Improper Validation of Specified Quantity in Input vulnerability in Magepeople inc. Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Removing Important Client Functionality.This issue affects Booking and Rental Manager: from n/a through 2.8.0...

CVE-2026-103350 WordPress Booking and Rental Manager plugin <= 2.8.0 - Other vulnerability Type vulnerability

Improper Validation of Specified Quantity in Input vulnerability in Magepeople inc. Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Removing Important Client Functionality.This issue affects Booking and Rental Manager: from n/a through 2.8.0...

CVE-2026-103350

The Magepeople inc. Booking and Rental Manager plugin for WooCommerce (versions up to and including 2.8.0 ) is vulnerable to an Improper Validation of Specified Quantity in Input (CWE-1284) vulnerability. This security flaw allows an attacker to remove important client functionality . While the s...

EUVD-2026-102233

Improper Validation of Specified Quantity in Input vulnerability in Magepeople inc. Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Removing Important Client Functionality.This issue affects Booking and Rental Manager: from n/a through 2.8.0...

CVE-2026-103350 WordPress Booking and Rental Manager plugin <= 2.8.0 - Other vulnerability Type vulnerability

Improper Validation of Specified Quantity in Input vulnerability in Magepeople inc. Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Removing Important Client Functionality.This issue affects Booking and Rental Manager: from n/a through 2.8.0...

bsh-file-validation (>=0.0.4, <=0.0.21), crewai-files (>=1.11.1.dev20260324, <=1.15.28) +4 more potentially affected by CVE-2026-104266 via tinytag (>=2.1.0, <=2.2.1)

tinytag PYPI version =2.1.0, =0.0.4, =1.11.1.dev20260324, =0.95.0, =0.11.12rc1, =1.128.0, =1.137.0 Source cves: CVE-2026-104266 Source advisory: MEND:CVE-2026-104266...

CVE-2026-55103 Discourse ActivityPub: Fix inbound actor validation and apply outbound request SSRF hardening

Discourse ActivityPub adds ActivityPub support to Discourse. Prior to commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5, inbound ActivityPub processing does not sufficiently verify that the actor authenticated by the signed request matches the Activity actor and owns the referenced federated post. ...

CVE-2026-55103

The Discourse ActivityPub component is vulnerable to insufficient verification of data authenticity and incorrect authorization. Specifically, inbound ActivityPub processing fails to verify that the authenticated actor matches the Activity actor and owns the referenced federated post. A remote at...

CLSA-2026-1792083184 Fix CVE(s): CVE-2026-13321, CVE-2026-19666, CVE-2026-80274

SECURITY UPDATE: DNSSEC validation bypass via an out-of-zone NSEC Next Domain Name - debian/patches/CVE-2026-13321.patch: reject an NSEC RRset whose next owner name is not a subdomain of the RRSIG signer name in dnsdnssecverify3 in lib/dns/dnssec.c. - CVE-2026-13321 SECURITY UPDATE: assertion...

CVE-2026-100354 kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0, runtime request, response, and direct schema validation lacks cycle detection when an allOf, anyOf, or oneOf chain refers back to an ancestor schema, even though loading and document validation accept the circular reference...

MariaDB Server has a vulnerability related to input validation errors.

MariaDB Server versions prior to 10.6.28 10.6.x series, 10.11.19 10.11.x series, 11.4.13 11.4.x series, 11.8.9 11.8.x series, 12.3.3 12.3.x series, and 13.0.2 13.0.x series have a input validation vulnerability. This vulnerability arises from the ability of the mysql50 prefix to bypass the...

sgl-project SGLang Input Validation Vulnerability

The sgl-project SGLang version 0.5.21 and earlier have a vulnerability related to input validation errors. This vulnerability arises from using the mmhashes value provided by the trusted caller as a multi-modal prefix for caching keys. A remote attacker can send different images with known or...

Guangzhou Juan IoT EseeCloud App has a vulnerability in input validation.

The Guangzhou Juan IoT EseeCloud App versions 4.9.6 and earlier, as well as the EseeCloud Firmware version 4.9.86.0 and earlier, have a vulnerability in input validation. This vulnerability arises from improper verification of device unbinding and re-binding operations by the server. Attackers ca...

Nezhahq Nezha: Input validation error vulnerability

Versions of Nezhahq Nezha from 2.1.0 to 2.3.15 had a vulnerability related to input validation errors. This vulnerability occurred because the mintTransferTool never validated the construction of Host headers for the fs.downloadurl and fs.uploadurl URLs. This could allow attackers to redirect fil...

WHEELS.DEV: Wheel

WHEELS.DEV: In versions 4.0.0 to 4.1.2, there is a vulnerability related to input validation errors. This vulnerability stems from the use of case-insensitive comparisons on a case-sensitive file system. As a result, the checks for standard paths of zip entries, package maps, development...

FreeRDP has a vulnerability related to input validation errors

FreeRDP versions 3.30.0 to 3.32.0 previously had a vulnerability related to input validation errors. This vulnerability stemmed from a resource exhaustion issue in the rdpecam client. A malicious RDP server could request unannounced camera media types. Attackers could send requests with extremely...

WHEELS.DEV: Wheel

WHEELS.DEV: Versions 1.1 to 4.1.2 contain a vulnerability related to input validation errors. This vulnerability arises from the use of nestedProperties, which parses records based on the primary key submitted by the user. However, it does not verify whether the parsed record is actually a child ...

Tandoor Recipes: Input validation vulnerability

Versions of Tandoor Recipes prior to 2.6.10 contained a vulnerability related to input validation errors. This vulnerability occurred due to unvalidated sortorder and orderfield strings being passed into Django ORM’s orderby method. Users with authenticated access could exploit this vulnerability...

Devolutions Server has a vulnerability related to input validation errors.

Devolutions Server 2026.3.8.0 and earlier versions have a vulnerability related to input validation errors. This vulnerability stems from improper control over the JIT privilege settings in the PAM checkout process. It may allow authenticated users with PAM checkout access to delete any Active...