CVE-2026-53587 is a high-severity vulnerability in libgit2 prior to versions 1.8.6 and 1.9.5. It involves improper input validation in the smart-protocol pkt-line capability buffer, leading to a heap out-of-bounds read that can crash clients during the first refs-advertisement packet over various Git protocols. The issue is fixed in libgit2 versions 1.8.6 and 1.9.5.
CVE-2026-61711 is an improper input validation vulnerability in moby buildkit prior to version 0.31.1. A crafted build request with an invalid SecurityMode value could cause the build container to run without Seccomp and AppArmor protections, although Linux capabilities remained restricted. This issue is fixed in version 0.31.1.
CVE-2026-17414 is a vulnerability in IBM PowerVM Hypervisor affecting certain firmware versions during network boot. An unauthenticated attacker on the same network can disrupt the boot process of a partition performing a network boot. If the partition's OS secure boot is not enabled (default setting), the attacker can substitute the boot image, compromising the integrity of the partition's loaded software. This vulnerability impacts confidentiality, integrity, and availability but only affects partitions actively performing network boot. Other partitions and the managed system remain unaffected.
CVE-2026-19509 is a medium severity vulnerability in RDK-B WebUI affecting the ajaxSet_wireless_network_configuration.jst component. It involves improper input validation of the ssid_number parameter, which can be exploited by an authenticated attacker to cause a denial of service. No information about affected versions or patches is provided.
CVE-2026-49392 is an improper input validation vulnerability in Wazuh affecting versions from 4.6.0 up to but not including 4.14.6, and from 5.0.0-beta1 up to but not including 5.0.0-beta3. The flaw arises from unsafe concatenation of monitored file paths into SQLite queries without proper escaping on non-Windows systems, allowing a local user to inject SQL UNION SELECT expressions via crafted filenames in the File Integrity Monitoring directories. This can manipulate SELECT result sets used by the File Integrity Monitoring code. The issue is fixed in versions 4.14.6 and 5.0.0-beta3.
CVE-2026-15316 is an improper input validation vulnerability in the configuration service of TP-Link Tapo C200 v5. It involves processing encrypted credential data where oversized ciphertext values can cause exception handling failures. Successful exploitation leads to device crashes or restarts, causing temporary denial-of-service (DoS) by disrupting HTTPS management and monitoring until recovery.
Streambert, a cross-platform Electron desktop app for streaming and downloading video content, has an improper input validation vulnerability in versions prior to 2.6.0. The open-path-at-time IPC handler accepts a file path from the renderer process without validating its type or location. If attempts to launch mpv or VLC are skipped or fail, the handler passes this file path to Electron's shell.openPath, which can cause the operating system to execute arbitrary files with the privileges of the Streambert process. This allows a compromised renderer to escape the sandbox and execute local executables or scripts. The issue is fixed in version 2.6.0.
CVE-2026-52877 is an improper input validation vulnerability in the Streambert Electron desktop app before version 2.6.0. The flaw allows a compromised renderer process to pass unvalidated URLs to Electron's shell.openExternal function, potentially causing the host to open local files or launch external applications via custom URI schemes. This vulnerability is fixed in version 2.6.0.
CVE-2026-47629 is a high-severity vulnerability in NVIDIA Triton Inference Server for Linux, caused by improper input validation. Exploitation could lead to denial of service conditions. No confidentiality or integrity impacts are reported. The affected version is 0.0-26.05. There is no information on available patches or vendor advisories.
CVE-2026-63335 is an improper input validation vulnerability in the RabbitMQ Java client library prior to version 5.31.0. It occurs during inbound AMQP command assembly when a malformed sequence causes the client to throw an unexpected exception and close the connection. This can be exploited by a malicious or compromised broker peer to cause a denial of service by terminating frame processing and closing the client connection. The issue is fixed in version 5.31.0.
CVE-2026-61634 is an improper input validation vulnerability in the RabbitMQ Java client library prior to version 5.33.0. The issue arises because the negotiated AMQP frame_max value is not consistently enforced, allowing a malicious or compromised broker to send oversized method frames. This can cause the client to allocate and decode invalid frames, leading to connection disruption and client-side denial of service. The vulnerability is fixed in version 5.33.0.
CVE-2026-16139 is a path traversal vulnerability in Progress ShareFile Storage Zones Controller versions up to 5.12.5 and 6.0.2. An authenticated zone administrator can exploit improper validation in the download preparation process to write files outside the intended directory. This vulnerability can lead to remote code execution in version 5.x, while remote code execution is not confirmed for version 6.x.
CVE-2026-22072 is a high-severity vulnerability in OPPO Health version 6.2.9 caused by improper input validation (CWE-20). It allows loading arbitrary external URLs through WebView components, which can execute malicious JavaScript code capable of stealing user tokens. No official patch or remediation guidance has been provided by the vendor yet. There are no known exploits in the wild at this time.
The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to Price Manipulation via the `cart_data` parameter in all versions up to, and including, 2.9.9.6.8. This is due to the `dopbsp_woocommerce_add_to_cart` AJAX action being registered via `wp_ajax_nopriv_*` with no authentication, no nonce verification, and no server-side recalculation of pricing — the `update` handler reads `price_total` directly from the attacker-controlled `cart_data` POST parameter and persists it to the database via `$wpdb->insert()` without validating it against the calendar's configured pricing. The `woocommerce_before_calculate_totals` callback subsequently reads the stored attacker-supplied value back from the database and passes it directly to `$product->set_price()` without recomputing from calendar settings. This makes it possible for unauthenticated attackers to override the WooCommerce checkout price of any bookable product tied to a booking calendar to an arbitrary value, effectively enabling the purchase of any such product at a self-chosen price.
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the ckan_get_mqa_quality and ckan_get_mqa_quality_details tools in src/tools/quality.ts use isValidMqaServer to validate the server_url parameter with a prefix-only regular expression for dati.gov.it, allowing suffix-host and URL-userinfo values to target an attacker-controlled host and return a spoofed response. This issue is fixed in version 0.4.112.
CVE-2026-73658 is a high-severity vulnerability in trigger.dev, a platform for building and deploying AI agents and workflows. Versions from 4.4.2 up to but not including 4.5.0-rc.5 have improper input validation in Aws4FetchClient methods that assign user-controlled keys to URL pathnames. This allows an attacker with a valid environment API key to bypass path normalization and obtain presigned URLs for other tenants' object-store keys, potentially reading or overwriting task payloads. The issue is fixed starting in version 4.5.0-rc.5. The vulnerability involves CWE-20 (Improper Input Validation), CWE-22 (Path Traversal), and CWE-862 (Missing Authorization).
CVE-2026-59109 is a high severity SQL injection vulnerability in the Zalktis accounting application. It occurs when importing received electronic invoices or e-commerce exports, where partner-controlled text fields are concatenated directly into SQL statements without proper escaping or parameterization. The application's escaping helper function is not applied on these code paths, allowing an attacker controlling invoice data to alter SQL query logic. This affects versions of Zalktis before 2026.1.586 and 2026.2.592.
WebErpMesv2 versions 1.19 and prior contain an improper input validation vulnerability that allows any self-registered user to upload arbitrary PHP files via the HR Expense scan_file parameter, resulting in remote code execution. The vulnerability is exacerbated by open registration and broken role middleware that silently swallows exceptions, enabling effectively unauthenticated remote code execution on default installations. A patch addressing this issue is available in commit 5c54862fa044b363fd2be03d586750e81afd6818.
NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken() helper in the next-auth/jwt and @auth/core/jwt modules can throw an uncaught exception when it reads a malformed Authorization: Bearer header. When no session cookie is present, getToken() URL-decodes the bearer value before validating it, and malformed percent encoding causes decodeURIComponent() to throw instead of treating the token as invalid. Because getToken() is commonly called in API routes, middleware, and server-side request handlers, a single unauthenticated request can trigger an unhandled exception in code paths that authenticate requests, causing a per-request denial of service without exposing tokens, sessions, or other data and without bypassing authentication. This issue is fixed in @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32.
MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of the authorization and token endpoints returned by an OIDC issuer's discovery document. A user induced to connect to an uncontrolled MongoDB deployment using MONGODB-OIDC authentication may have an uncontrolled URI dispatched to their operating system's default protocol handler, potentially exposing credentials or, under certain conditions, resulting in code execution in the user's context.