Adobe C2PA Tool contains an Improper Input Validation vulnerability (CWE-20) that allows an attacker to read arbitrary files on the file system. Exploitation requires user interaction, specifically opening a malicious file. This vulnerability could expose sensitive files and directories outside the intended access scope. The CVSS 3.1 base score is 5.5 (medium severity). No patch or remediation information is currently available.
CVE-2026-19913 is a local file disclosure vulnerability in the Kaltura HTML5 Video Player's html5lib library. It arises from improper validation of the ServiceUrl parameter in mwEmbedLoader.php, which accepts non-HTTP schemes like file://. This flaw allows an unauthenticated remote attacker to read arbitrary internal files on the server by triggering an error that reflects file contents in the response. The vulnerability affects html5lib versions 2.45, 2.103, and earlier 2.x releases exposing the vulnerable endpoint.
The Kaltura HTML5 player (mwEmbed / html5lib) contains an unauthenticated remote code execution vulnerability caused by unsafe data deserialization and unsanitized filesystem path construction. mwEmbedLoader.php accepts a user‑controlled ServiceUrl, whose response is passed to unserialize(), and the resulting object’s fields are written to a cache path derived from attacker‑supplied uiconf_id without proper path validation. An attacker can write arbitrary files into web‑accessible locations and achieve code execution as the webserver user. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases exposing the vulnerable endpoint.
OpenEXR versions 3.4.0 through 3.4.12 contain a vulnerability in the exr_attr_set_bytes() function where improper input validation of a nested pointer leads to a NULL pointer dereference. This flaw can cause a deterministic crash resulting in denial of service. The issue is fixed in version 3.4.13.
CVE-2026-78329 is a critical improper input validation vulnerability in the Apache Camel Undertow component. The issue arises because the default headerFilterStrategy used by UndertowEndpoint overwrites the intended UndertowHeaderFilterStrategy, causing undertow-specific header filtering to be bypassed. This allows legacy websocket. Exchange-header prefixed headers to be mapped onto the Exchange without proper filtering, potentially enabling an undertow WebSocket producer to dispatch messages incorrectly. The vulnerability affects Apache Camel versions from 4.11.0 before 4.14.9, from 4.15.0 before 4.18.4, and from 4.19.0 before 4.22.0. Upgrading to Apache Camel 4.22.0 or the respective LTS patch releases mitigates the issue. For deployments unable to upgrade immediately, explicit configuration of the headerFilterStrategy and manual header stripping are recommended as mitigations.
CVE-2026-71300 is an improper input validation vulnerability in the Apache Camel Atmosphere Websocket component. It allows an external sender to manipulate WebSocket message dispatch headers, potentially causing messages to be delivered to unintended connected clients. This issue affects multiple Apache Camel versions from 4.0.0 up to but not including 4.14.9, 4.15.0 up to but not including 4.18.4, and 4.19.0 up to but not including 4.22.0. The vulnerability is fixed in Apache Camel 4.22.0, 4.14.9, and 4.18.4. Users unable to upgrade immediately should strip the relevant dispatch headers at the trust boundary before the producer. The fix involves renaming header string values into the Camel namespace, which may cause breaking changes for routes that set them by literal string.
CVE-2026-63621 is an improper input validation vulnerability in the Apache Camel Knative component. It allows unauthenticated attackers to inject internal Camel headers via structured-mode CloudEvent requests, potentially enabling server-side request forgery, path traversal, or message dispatch redirection. This issue affects multiple Apache Camel versions and is fixed in later releases.
Apache Camel contains an improper input validation vulnerability in its camel-mail component's MimeMultipart data format when configured with headersInline set to true. This flaw allows untrusted MIME headers to be copied as Camel message headers without filtering, potentially enabling an attacker to inject headers in the Camel-internal namespace. Such injected headers can alter the behavior of downstream route steps, depending on the route configuration. The issue affects versions from 2.17.0 before 4.14.9, from 4.15.0 before 4.18.4, and from 4.19.0 before 4.22.0. The vulnerability is fixed in Apache Camel 4.22.0, 4.14.9, and 4.18.4. Users unable to upgrade immediately should keep headersInline disabled or strip Camel-internal headers after unmarshalling.
CVE-2026-59568 is a critical vulnerability in Zscaler Client Connector involving improper input validation. It allows an unauthenticated, unprivileged attacker to execute arbitrary code remotely within the context of the Zscaler Client Connector. The vulnerability has a high CVSS score of 9.1, indicating severe impact on confidentiality and integrity. No affected versions or patch information are provided, and no known exploits are reported in the wild.
CVE-2026-78147 is a medium severity vulnerability in the ggml-org llama.cpp project affecting the deserialize_tensor function in the ggml-RPC Server component. The flaw involves improper handling of op/op_params arguments during deserialization, which can be triggered remotely. No patch or fix information is currently available, and no known exploits are reported in the wild.
The Advanced Product Fields (Product Addons) for WooCommerce plugin for WordPress contains an improper input validation vulnerability in all versions up to and including 1.6.21. This flaw in the 'validate_cart_data' function allows unauthenticated attackers to bypass required paid addons and complete purchases at the base product price, effectively enabling theft of products by paying less than intended. The vulnerability was partially patched in version 1.6.19 but remains present through 1.6.21.
CVE-2026-63421 is an improper input validation vulnerability in KeystoneJS prior to version 6.5.3. It allows a remote unauthenticated GraphQL client to provide a negative 'take' argument with a magnitude exceeding the configured maximum, bypassing intended query limits. This can lead to returning more records than intended, potentially exhausting service resources. The issue affects the findMany resolver and relationship queries. The vulnerability is fixed in KeystoneJS version 6.5.3.
Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file write exists in the Incus client when a malicious image server returns a crafted `Incus-Image-Hash` header. This can lead to arbitrary command execution as root on the server. Version 7.2.0 patches the issue.
Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrary command execution. Version 7.1.0 patches the issue.
CVE-2026-77710 is a medium severity vulnerability in the misp-stix component of MISP that allows crafted STIX documents to manipulate security-sensitive attribute metadata during import. The vulnerability arises because the parser selection for STIX documents is based on untrusted metadata controlled by the document producer, enabling attackers to spoof MISP-origin indicators. This leads to improper input validation where attacker-supplied STIX bundles can inject unauthorized attribute properties such as distribution, sharing restrictions, and tags. This can cause information to be shared against organizational policies or influence downstream processing. The issue is addressed by introducing an explicit classification parameter and restricting accepted attribute fields via an allow-list.
CVE-2026-65645 is an improper input validation vulnerability in Rocket.Chat's Meteor DDP methods getThreadsList and getThreadMessages. These methods accept raw, untyped parameters for room and message IDs without schema validation, allowing a MongoDB operator object to be used instead of a string ID. This flaw leads to unauthorized disclosure of private thread parents and their full reply content to any authenticated user with low privileges. The REST route chat.getThreadsList was patched in version 5.0 with proper input validation, but the DDP method remains unpatched and exploitable.
CVE-2026-16520 is a high-severity vulnerability affecting multiple versions of Genians Genian NAC and Genian ZTNA products. It involves improper input validation and exposure of sensitive information through data queries, leading to SQL Injection and authentication bypass. The affected versions span Genian NAC V4.0, V5.0, and Genian ZTNA V6.0, with specific version ranges detailed. The vulnerability has a CVSS 4.0 base score of 8.7, indicating a significant risk if exploited.
CVE-2026-77645 is a critical remote code execution vulnerability in PTC Windchill PDMLink and PTC FlexPLM. It arises from improper input validation related to deserialization of untrusted data. The vulnerability affects multiple specific versions of Windchill PDMLink. The CVSS 4.0 score is 9.2, indicating a critical severity level. No patch or vendor advisory details are provided in the input. There are no known exploits in the wild at this time.
CVE-2026-70105 is a vulnerability in Microsoft Office Word within Microsoft 365 Apps for Enterprise caused by improper input validation. This flaw allows an unauthorized attacker to disclose information over a network. The issue affects multiple versions prior to 16.112.26081010 and 16.0.5565.1000, where fixes have been applied. The vulnerability has a CVSS score of 6.5, indicating a medium severity level. No known exploits are reported in the wild. Microsoft has issued an official fix for this vulnerability.