CWE-20: Improper Input Validation vulnerabilities

A stored cross-site scripting (XSS) vulnerability exists in the h5p-nodejs-library by Lumi Education UG in versions prior to 10.0.4. This flaw allows attackers to upload H5P content containing malicious JavaScript, which executes in the browsers of users who view the content. The vulnerability is fixed in version 10.0.4.

CVE-2026-21112 is an improper input validation vulnerability in Samsung Tips prior to Android 17. It allows local attackers to launch arbitrary activities with Samsung Tips privileges. Exploitation requires user interaction. The vulnerability has a medium severity with a CVSS score of 5.1.

CVE-2026-21101 is a high-severity vulnerability in Samsung Mobile Devices involving improper input validation in the DualDAR driver before the SMR Sep-2026 Release 1. This flaw allows local privileged attackers to potentially execute arbitrary code with root privileges.

CVE-2026-21094 is a medium severity vulnerability in Samsung Mobile Devices involving improper input validation in wpa_supplicant prior to the SMR September 2026 Release 1. This flaw allows adjacent attackers to write out-of-bounds memory, potentially leading to memory corruption.

CVE-2026-21089 is a medium severity vulnerability in Samsung Mobile Devices involving improper input validation in the libsubextractor.so component before the SMR Sep-2026 Release 1. This flaw allows local attackers to write out-of-bounds memory by exploiting the removal of style tags. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a moderate risk level. No public exploits or known active exploitation have been reported. No specific affected versions or patches have been disclosed yet.

CVE-2026-21088 is a medium severity vulnerability in Samsung Mobile Devices involving improper input validation in the libsubextractor.so component. This flaw allows local attackers to write out-of-bounds memory when loading a subtitle frame. The issue affects versions prior to the SMR Sep-2026 Release 1. No public exploits or known in-the-wild attacks have been reported. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a moderate risk primarily due to local attack vector and required user interaction.

CVE-2026-21086 is a medium-severity vulnerability in Samsung Mobile Devices involving improper authorization in the ProxyHandler component prior to the SMR Aug-2026 Release 1. This flaw allows local attackers with limited privileges to access proxy configuration settings without proper authorization.

Unvalidated memory boundary could result in arbitrary code execution. The vulnerability exists in the code developed specifically for HP projects.

Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write access. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page.

Adobe ColdFusion 2025 contains an Improper Input Validation vulnerability (CWE-20) that allows a low-privileged attacker to execute arbitrary code with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerable component is typically restricted to an administrative network zone by default. The vulnerability affects versions up to 12 and up to 23. The issue changes the security scope and has a high severity with a CVSS score of 8.4.

Adobe Illustrator Desktop 2026 contains an improper input validation vulnerability that could allow an attacker to execute arbitrary code with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions up to 30.7 and 29.8.10. The scope of the vulnerability is changed, indicating potential impact beyond the initial component.

CVE-2026-81392 is an out-of-bounds read vulnerability in Microsoft Office Excel within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to locally disclose information. The vulnerability has a medium severity rating and has been officially fixed by Microsoft in multiple versions of the software.

CVE-2026-73021 is a heap-based buffer overflow vulnerability in the Windows Biometric Service on Microsoft Windows 10 Version 1607 and later builds. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has been assigned a high severity score of 7.8 and has been officially fixed in multiple Windows 10 builds.

CVE-2026-72996 is a heap-based buffer overflow vulnerability in the Windows Biometric Service on Microsoft Windows 10 Version 1607 and later builds. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has been assigned a high severity score of 7.8 and has been officially fixed by Microsoft in multiple Windows 10 builds.

CVE-2026-72994 is a heap-based buffer overflow vulnerability in the Windows Biometric Service on Microsoft Windows 10 Version 1607 and later builds. It allows an authorized local attacker to elevate privileges. The vulnerability has been assigned a high severity with a CVSS score of 7.8. Official patches have been released to address this issue in multiple Windows 10 builds.

CVE-2026-72977 is an out-of-bounds read vulnerability in Microsoft Office PowerPoint within Microsoft 365 Apps for Enterprise. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability has a CVSS score of 6.5, indicating a medium severity level. Microsoft has released official fixes addressing this issue in multiple versions of the affected software.

CVE-2026-69614 is a high-severity stack-based buffer overflow vulnerability in Microsoft Office Access, part of Microsoft 365 Apps for Enterprise. It allows an unauthorized attacker to execute code remotely over a network. The vulnerability affects multiple versions prior to fixed releases. An official fix is available from Microsoft.

CVE-2026-69352 is a heap-based buffer overflow vulnerability in the Windows Biometric Service on Windows 10 Version 1607 and related builds. It allows an authorized local attacker to elevate privileges. The vulnerability has been assigned a high severity score of 7.8 and has been officially fixed in multiple Windows 10 builds.

CVE-2026-70581 is an integer overflow or wraparound vulnerability in the Windows Biometric Service on Microsoft Windows 10 Version 1607 and later builds. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has a high severity rating with a CVSS score of 7.8. Microsoft has issued official fixes for all affected versions.

CVE-2026-70573 is a heap-based buffer overflow vulnerability in the Windows Biometric Service on Microsoft Windows 10 Version 1607 and later builds. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has been assigned a high severity rating with a CVSS score of 7. A patch addressing this issue is officially available from Microsoft.