CWE-20: Improper Input Validation vulnerabilities

is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction.

ColdFusion is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker with high privileges could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

is affected by an Improper Input Validation vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain unauthorized read and write access. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

Insufficient input validation vulnerability in the NETGEAR R7000 models allows authenticated administrators connected to the local network to make unauthorized modification to router software and functionality.

A stack-based buffer overflow vulnerability affects certain NETGEAR models allowing an authenticated admin user to make unauthorized modification to router software and functionality.

Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification to router software and functionality.

Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification to the device software and functionality.

Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 improperly validate executable paths supplied to the  run-download  IPC handler, allowing a compromised renderer process to execute arbitrary local binaries with the application’s privileges. Version 2.5.0 contains a patch.

A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as `parallel` and `len`, which are not properly validated by the server. This improper input validation can lead to excessive stream and thread creation, as well as large buffer allocations, causing resource exhaustion. Consequently, this can result in a Denial of Service (DoS) on the affected iperf3 server.

Affected versions of cti-transmute insufficiently validate saved graph configuration data. Graph configurations can contain style properties that are later consumed by Pivotick, and Pivotick interprets svgIcon as HTML. Because saved configurations may be created by one user and later displayed to other users—including administrators—a malicious user could store a crafted svgIcon value that executes script in another viewer’s browser. The fix introduces a strict configuration schema on both the server and client. Only known properties are accepted, style entries are limited to shape, color, and size, and dangerous properties such as svgIcon and iconClass are explicitly rejected. Existing stored configurations are also sanitized when listed and again before being applied in the browser.

Privilege Escalation via URL Parameter is reported in Apache Ranger versions <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue.

Remote Code Execution via JDBC URL Injection in Apache Ranger <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue.

CVE-2026-21083 is an improper input validation vulnerability in Samsung Mobile Smart Switch software versions prior to 3.7.72.6. This flaw allows adjacent attackers to access sensitive data. The vulnerability has a medium severity rating with a CVSS score of 6.8. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.

CVE-2026-21073 is a medium severity vulnerability in Samsung Mobile Devices affecting the Galaxy Themes component prior to the SMR Aug-2026 Release 1. It involves improper input validation that could allow a physical attacker to launch arbitrary activities on the device. No official patch or remediation guidance has been provided yet, and there are no known exploits in the wild.

CVE-2026-21072 is a medium severity vulnerability in Samsung Mobile Devices involving improper input validation in the VC1 codec component (libsavsvc.so). This flaw allows local attackers to write out-of-bounds memory, potentially leading to memory corruption. The issue affects versions prior to the SMR Aug-2026 Release 1. No official patch or remediation guidance is currently available from the vendor.

CVE-2026-21071 is a medium severity vulnerability in Samsung Mobile Devices involving improper input validation in the MPEG4 codec component (libsavsvc.so). This flaw allows local attackers to write out-of-bounds memory, potentially leading to memory corruption. The issue affects versions prior to the SMR Aug-2026 Release 1. No official patch or remediation guidance has been provided yet.

CVE-2026-21070 is a medium severity vulnerability in Samsung Mobile Devices affecting the Samsung Message application prior to the SMR August 2026 Release 1. It involves improper input validation (CWE-20) that could allow physical attackers to access sensitive information. No specific affected versions or patch information is provided. The vulnerability requires physical access and user interaction to exploit and does not involve network attack vectors.

CVE-2026-21067 is a medium severity vulnerability in Samsung Mobile Devices caused by improper input validation in the libsmsd.so component. This flaw allows local attackers to write out-of-bounds memory, potentially leading to memory corruption. The issue affects versions prior to the SMR Aug-2026 Release 1. No official patch or remediation guidance has been provided yet, and there are no known exploits in the wild.