CWE-183 vulnerabilities

A Permissive List of Allowed Input vulnerability in the CLI of Juniper Networks Support Insights (JSI) Virtual Lightweight Collector (vLWC) allows a local, high privileged attacker to escalate their privileges to root. The CLI menu accepts input without carefully validating it, which allows for shell command injection. These shell commands are executed with root permissions and can be used to gain complete control of the system. This issue affects all JSI vLWC versions before 3.0.94.

Express XSS Sanitizer is Express 4.x and 5.x middleware which sanitizes user input data (in req.body, req.query, req.headers and req.params) to prevent Cross Site Scripting (XSS) attack. A vulnerability has been identified in versions prior to 2.0.2 where restrictive sanitization configurations are silently ignored. In version 2.0.2, the validation logic has been updated to respect explicitly provided empty configurations. Now, if allowedTags or allowedAttributes are provided (even if empty), they are passed directly to sanitize-html without being overridden.

CVE-2026-32881 affects the Gleam web server 'ewe' versions 0.6.0 through 3.0.4 and allows attackers to bypass authentication or spoof proxy-trust headers by exploiting permissive handling of chunked transfer encoding trailers. The vulnerability arises because only a limited denylist of nine header names is blocked when merging trailer headers into the request headers after body parsing. Malicious clients can append headers in the Trailer field after the final chunk, causing legitimate headers to be overwritten. This enables forging authentication credentials, session hijacking, bypassing IP-based rate limiting, or spoofing proxy-trust headers in downstream middleware that reads headers post body parsing. The issue is fixed in version 3.0.

The mongo-go-driver repository contains CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS. The C wrapper implementation contains a heap out-of-bounds read vulnerability due to incorrect assumptions about string termination in the GSSAPI standard. Since GSSAPI buffers are not guaranteed to be null-terminated or have extra padding, this results in reading one byte past the allocated heap buffer.

In JetBrains TeamCity before 2025.07.2 missing Git URL validation allowed credential leakage on Windows

Permissive list of allowed inputs in Microsoft Purview allows an authorized attacker to elevate privileges over a network.

A vulnerability has been identified in SINEC Security Monitor (All versions < V4.9.0). The affected application does not properly validate that user input complies with a list of allowed values. This could allow an authenticated remote attacker to compromise the integrity of the configuration of the affected application.