Improper Input Validation

ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 have a password reset flow that constructs the reset URL using `req.hostname`, which is derived directly from the attacker-controlled HTT

Inappropriate implementation in DevTools in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severit

Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)

Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViews.

OpenVM is a performant and modular zkVM framework built for customization and extensibility. Prior to version 1.6.0, the openvm-pairing guest library's try_honest_pairing_check function invokes Theorem 3 of https://eprint.iacr.org/2024/640.

A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can allow code execution capabilities, if untrusted users are allowed to configure JMS f

A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters. Use

Insufficient validation of untrusted input in Network in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity

Insufficient validation of untrusted input in Linux Toolkit Theming in Google Chrome on Linux prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious

Insufficient validation of untrusted input in Accessibility in Google Chrome on Mac prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

Improper input validation in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability

Qlik Sense Path Traversal Vulnerability

Cisco VPN Routers Remote Code Execution Vulnerability

Intel Ethernet Diagnostics Driver for Windows Denial-of-Service Vulnerability

Apple iOS and iPadOS Out-of-Bounds Write Vulnerability

Apple iOS, iPadOS, and macOS Remote Code Execution Vulnerability

Apache ActiveMQ Improper Input Validation Vulnerability

Adobe Reader and Adobe Acrobat Stack-Based Buffer Overflow Vulnerability

Microsoft Office Security Feature Bypass Vulnerability

Mozilla Firefox and Thunderbird Sandbox Escape Vulnerability

Microsoft Windows MSHTML Platform Security Feature Bypass Vulnerability

Cisco IOS and IOS XE Software Improper Input Validation Vulnerability

Apple iOS and macOS Out-of-Bounds Write Vulnerability

Cisco IOS and IOS XE Software DHCP Remote Code Execution Vulnerability

Microsoft Office Malformed EPS File Vulnerability

Alcatel OmniPCX Enterprise Remote Code Execution Vulnerability

Apache Struts 1 Improper Input Validation Vulnerability

Apple macOS Out-of-Bounds Read Vulnerability

Apache Struts Improper Input Validation Vulnerability

Cisco IOS Software for Cisco Industrial Ethernet Switches PROFINET Denial-of-Service Vulnerability

Google Chromium ANGLE and GPU Improper Input Validation Vulnerability

Cisco IOS XE Software Ethernet Virtual Private Network Border Gateway Protocol Denial-of-Service Vulnerability

Microsoft .NET Framework Remote Code Execution Vulnerability

DotNetNuke (DNN) Remote Code Execution Vulnerability

ThinkPHP "noneCms" Remote Code Execution Vulnerability

Microsoft Windows SMB Remote Code Execution Vulnerability

ImageMagick Improper Input Validation Vulnerability

Microsoft Silverlight Information Disclosure Vulnerability

Trend Micro Multiple Products Improper Input Validation Vulnerability

Siemens SIMATIC CP 1543-1 Improper Privilege Management Vulnerability

Palo Alto Networks PAN-OS Command Injection Vulnerability

Barracuda Networks ESG Appliance Improper Input Validation Vulnerability

Microsoft WordPad Information Disclosure Vulnerability

Mitel MiVoice Connect Data Validation Vulnerability

Microsoft Project Remote Code Execution Vulnerability

Microsoft Windows Shell Remote Code Execution Vulnerability

Linux Kernel Improper Input Validation Vulnerability

Accellion FTA OS Command Injection Vulnerability