ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Data Exposure vulnerability in the Firewall Analyzer syslog collector.
The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which metadata keys a form submission may supply, and does not exclude the keys WordPress reserves for its own use, so unauthenticated visitors submitting a public form that collects post content can attach metadata of their choosing to the post their submission creates.
mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, the fee-payer cosigning path in src/tempo/internal/fee-payer.ts copied a client-supplied access_list from a 0x78 FeePayerEnvelope without validating its length or contents. Because EIP-2930 access-list entries consume intrinsic gas even when the listed addresses are never used, a client could add fabricated address-only entries and cause the server fee_payer wallet to pay unnecessary transaction fees. The demonstrated 180-entry list remained within the 500,000 gas policy cap, 16 KB header limit, and RPC simulation budget while increasing the fee by approximately 9.4 times. This issue is fixed in version 0.8.2.
mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, FeePayerPolicy in src/tempo/internal/fee-payer.ts used decodeFunctionData to validate fee-sponsored calldata but did not reject trailing bytes. A client could append nonzero padding that increased intrinsic calldata gas while gas_limit and max_fee_per_gas remained within policy caps, causing the server fee_payer wallet to pay substantially more than the decoded transaction required. The tested 16 KB header limit bounded the demonstrated padding to about 5,500 bytes and produced approximately five times the normal transaction fee. This issue is fixed in version 0.8.2.
Adobe Experience Manager Forms JEE is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
Adobe Connect is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
CVE-2026-75634 is an improper input validation vulnerability in Adobe Content Credentials Rust SDK. This flaw could allow an attacker to bypass security features and gain unauthorized limited write access. Exploitation requires user interaction, such as visiting a malicious URL or interacting with a compromised web page. The vulnerability has a medium severity rating with a CVSS score of 4.3.
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page.
CVE-2026-19480 is an improper input validation vulnerability in Adobe Content Credentials Rust SDK that allows an attacker to bypass security features and gain unauthorized write access without user interaction. The vulnerability is rated high severity with a CVSS score of 7.5. No patch or remediation information is currently provided.
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page.
CVE-2026-76194 is an improper input validation vulnerability in Adobe Content Credentials Rust SDK that could allow an attacker to bypass security features and gain unauthorized limited write access. Exploitation requires user interaction, such as visiting a malicious URL or interacting with a compromised web page. The vulnerability has a medium severity rating with a CVSS score of 4.3.
Adobe Campaign Classic (ACC) is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.
Adobe Campaign Classic contains an improper input validation vulnerability that allows a low-privileged attacker to execute arbitrary code without user interaction. This vulnerability affects the context of the current user and changes the security scope. It is classified as critical with a CVSS score of 9.9.
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
Hosted, including Dedicated, versions of VCO were impacted and have already been patched.
Joplin before versions 3.6.15 and 3.7.2 contains an improper input validation vulnerability where synchronized resource metadata fields can include directory traversal characters. This allows an attacker with write access to a sync target or shared notebook to write files outside the intended resource directory without user interaction. The issue is fixed in versions 3.6.15 and 3.7.2.
Envoy proxy versions prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1 contain a vulnerability in the ext_authz filter where improper input validation of path-less CONNECT requests can cause a null pointer dereference. This occurs when the filter attempts to mutate query parameters based on an authorization response but the request lacks the expected :path pseudoheader. An unauthenticated downstream client can exploit this to crash the Envoy process, resulting in a denial of service. The issue is fixed in the specified versions.
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's optional oghttp2 upstream HTTP/2 codec accepts a response trailer HEADERS frame without END_STREAM. Envoy completes and deferred-deletes the ActiveRequest while oghttp2 keeps the stream open, leaving ClientStreamImpl with a dangling response_decoder_ reference. A later frame on the stream can dispatch through the freed object and crash the process. The relevant scope boundary is that the default nghttp2 codec rejects the malformed trailers, and the trigger is upstream-only with oghttp2 enabled. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Envoy proxy versions prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1 contain an improper input validation vulnerability in HTTP RBAC. This flaw allows a downstream client to craft requests that bypass negative RBAC policies due to inconsistent handling of opaque header bytes and regex matching semantics. The issue is fixed in the specified versions.
CVE-2026-92254 is a vulnerability in Watchdog Anti-Virus 1.8.640 through versions before 1.8.804 on Microsoft Windows. It involves missing authorization checks in the IOCTL handlers of the wsdkd.sys kernel driver, allowing local low-privileged attackers to delete arbitrary files with SYSTEM privileges. This bypasses NTFS access controls and can disable security products or destabilize the OS.
SysReptor is a fully customizable pentest reporting platform. Prior to 2026.61, authenticated users of SysReptor Professional can upload image files whose formats cause image processing to invoke Ghostscript, allowing embedded PostScript to operate in the shared temporary directory. An attacker can combine that behavior with a race involving GnuPG configuration files in temporary subdirectories to cause GnuPG to copy attacker-controlled Python code into the application code directory. The injected code executes with the privileges of the SysReptor application process after a worker restart. The Community edition is not affected. Version 2026.58 contains a partial mitigation, and this issue is fully fixed in version 2026.61.