Potential for improper filtering of HTTP headers in Spring Cloud Function.
Spring Cloud Function 5.0.0 - 5.0.3
Spring Cloud Function 4.3.0 - 4.3.4
Spring Cloud Function 4.2.0 - 4.2.7
Spring Cloud Function 3.2.16 and earlier
CVE-2026-57499 is a critical OS command injection vulnerability in the Liman open source server management software core component. It affects versions prior to 2.2.2 - 1103. An authenticated administrator can exploit improper input validation in the log rotation configuration endpoint by injecting shell commands via the ip_address parameter, which is unsafely embedded in a shell command. This vulnerability allows arbitrary command execution on the Liman server. It has a high CVSS score of 9.1 and is fixed in version 2.2.2 - 1103.
CVE-2026-59354 is a critical vulnerability in Spring Security's OAuth2 Authorization Server module versions 7.0.0 through 7.0.4. When Dynamic Client Registration is enabled, the registration endpoint inadequately validates certain client metadata fields. An attacker with a valid Initial Access Token can register a malicious client with crafted metadata, potentially leading to Stored Cross-Site Scripting (XSS), Privilege Escalation, or Server-Side Request Forgery (SSRF) depending on server configuration and metadata usage.
CVE-2026-47880 is a medium severity vulnerability in Spring Integration affecting multiple versions including 5.5.21 and earlier, 6.4.0 through 6.4.12, 6.5.0 through 6.5.10, 7.0.0 through 7.0.5, and 7.1.0. It involves improper input validation where a JMS message producer can set certain JMS String properties (replyChannel, errorChannel, json__TypeId__) that are copied directly into Spring Integration MessageHeaders without validation.
CVE-2026-56547 is a low severity vulnerability in HCLSoftware Traveler affecting versions prior to 14.5.1.1. It involves improper input validation in the Apple profile generation process for Mail, Calendar, and Contacts synchronization. The profile requires embedding the Logon Name and Mail Address, which cannot be changed later. The vulnerability allows an attacker to submit values that are reflected back in the Apple profile without verifying that these values match the authenticated user's Domino directory entry. However, the profile is not usable without additional information, limiting the attack to the attacker's own device.
CVE-2026-77554 is a critical vulnerability in the Ubiquiti Inc UniFi Talk Application involving improper input validation that allows an unauthenticated network attacker to perform command injection on the host device. The vulnerability has a CVSS score of 10, indicating maximum severity with full impact on confidentiality, integrity, and availability. No patch or official remediation guidance has been provided yet.
CVE-2026-77552 is a critical vulnerability in Ubiquiti Inc's UniFi Enterprise Audio/Video Bridge involving improper input validation. This flaw allows a network-based attacker to perform command injection on the affected device without requiring privileges or user interaction. The vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability. No specific affected versions or patches have been disclosed yet. There are no known exploits in the wild at this time.
CVE-2026-77548 is a critical Improper Input Validation vulnerability in the Ubiquiti Inc UniFi Protect Application. It allows a malicious actor with network access and low privileges to perform command injection on the host device. The vulnerability has a CVSS score of 9.9, indicating severe impact on confidentiality, integrity, and availability. No patch or official remediation has been confirmed yet.
CVE-2026-77547 is a critical Improper Input Validation vulnerability in the Ubiquiti Inc UniFi Access Application. It allows a malicious actor with network access and low privileges to perform command injection on the host device. The vulnerability has a high CVSS score of 9.9, indicating severe impact on confidentiality, integrity, and availability. No patch or official remediation has been confirmed yet. There are no known exploits in the wild at this time.
CVE-2026-77546 is a critical Improper Input Validation vulnerability in the Ubiquiti Inc UniFi Access Application. It allows a low-privileged attacker with network access to perform command injection on the host device, potentially leading to full system compromise. The vulnerability has a CVSS score of 9.9, indicating high impact on confidentiality, integrity, and availability. No patch or official remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
CVE-2026-77543 is a critical vulnerability in the Ubiquiti Inc UniFi Access Application involving improper input validation that allows a low-privileged network user to perform command injection on the host device. The vulnerability has a very high CVSS score of 9.9, indicating severe impact on confidentiality, integrity, and availability. No patch or official remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
CVE-2026-77542 is a critical vulnerability in Ubiquiti Inc's UID Enterprise Agent involving improper input validation. An attacker with network access and high privileges could exploit this flaw to perform command injection on the host device. The vulnerability has a CVSS score of 9.1, indicating high impact on confidentiality, integrity, and availability. No patch or official remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
CVE-2026-77540 is a critical vulnerability in Ubiquiti Inc's UniFi OS Server involving improper input validation that allows a privileged network user to perform command injection on the host device. The vulnerability has a high CVSS score of 9.1, indicating severe impact on confidentiality, integrity, and availability. No patch or official remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
CVE-2026-77539 is a critical vulnerability in Ubiquiti Inc's UniFi OS Server involving improper input validation. An attacker with network access and high privileges can exploit this flaw to perform command injection on the host device. This vulnerability has a high CVSS score of 9.1, indicating severe impact on confidentiality, integrity, and availability. No patch or official remediation guidance has been provided yet. There are no known exploits in the wild at this time.
CVE-2026-77537 is a critical vulnerability in the Ubiquiti Inc UniFi Protect Application involving improper input validation that allows an unauthenticated network attacker to perform command injection on the host device. This vulnerability has a CVSS score of 10.0, indicating it can lead to complete compromise of confidentiality, integrity, and availability. No patch or official remediation guidance has been provided yet.
CVE-2026-77535 is a critical vulnerability in Ubiquiti Inc's UniFi Network Application involving improper input validation. A malicious actor with network access and high privileges can exploit this flaw to perform command injection on an adopted device. The vulnerability has a high CVSS score of 9.1, indicating severe impact on confidentiality, integrity, and availability. No specific affected versions or patches have been provided yet, and there are no known exploits in the wild at this time.
CVE-2026-77533 is a critical vulnerability in the Ubiquiti Inc UniFi Protect Application involving improper input validation. An attacker with network access and low privileges could exploit this flaw to perform command injection on the host device, potentially leading to full system compromise. The vulnerability has a high CVSS score of 9.9, indicating severe impact on confidentiality, integrity, and availability. No patch or official remediation guidance has been provided yet. There are no known exploits in the wild at this time.
CVE-2026-65637 is a critical improper input validation vulnerability in Apache Tomcat. It affects versions 11.0.20 through 11.0.24, 10.1.53 through 10.1.57, and 9.0.115 through 9.0.120. The issue arises from an incomplete fix for a previous vulnerability (CVE-2026-32990). Successful exploitation could lead to full confidentiality, integrity, and availability impact. Users are advised to upgrade to fixed versions 11.0.25, 10.1.58, or 9.0.121.
OpenEXR versions 3.4.0 through 3.4.12 contain an improper input validation vulnerability in the HTJ2K decoder. The decoder fails to verify that a header-length field (PLEN) fits within the available buffer before using it, leading to an out-of-bounds read during decoding of crafted EXR files. This flaw is fixed in version 3.4.13.
CVE-2026-71443 is an Improper Input Validation vulnerability in Adobe's C2PA Tool that can cause the application to crash, resulting in a denial-of-service condition. Exploitation does not require user interaction. No patch or official remediation has been confirmed yet.