The Easy Appointments WordPress plugin before 3.12.28 does not correctly validate shortcode input in one of its block-rendering actions, checking only the first tag of the supplied string against an allowlist while rendering the entire string, allowing users with contributor-level access to execute arbitrary registered shortcodes.
OMICRON StationGuard version 4.00 has an improper input validation vulnerability in its IEC 61850 Sampled Values frame processing. A specially crafted Sampled Values frame can cause the affected process to terminate, disrupting alert processing for this traffic type. The overall system and other traffic processing remain unaffected. The process automatically restarts after termination, and the failure is immediately reported to the user. The vulnerability has a low severity score and no known exploits in the wild.
CVE-2026-57817 is a high-severity vulnerability in Apache CXF related to improper input validation of the c_hash parameter in OpenID Connect Hybrid Flow. If an Apache CXF relying party (RP) integrates with a non-compliant or misconfigured Identity Provider (IdP) that omits the c_hash, the RP is vulnerable to authorization code substitution or injection attacks. Fixed versions include 4.2.3, 4.1.8, and 3.6.12.
When a proxy server is configured with `customUrl.enabled`, the component accepts user-supplied input within forwarded HTTP headers without enforcing expected validation constraints. A malicious actor can manipulate these headers to influence the URL construction process, leading to an open redirect vulnerability. Additionally, unsanitized header values are written to application logs.
An attacker can exploit this to force redirection to arbitrary malicious domains, potentially enabling phishing attacks. Furthermore, they can inject forged entries into application logs, impacting the reliability of security logs and potentially hindering incident investigation.
CVE-2025-13909 is a medium severity vulnerability in WSO2 Identity Server versions 7.0.0 and 7.1.0. It involves insufficient validation of authentication requests using Email OTP, SMS OTP, or Magic Link, which fails to enforce tenant isolation. This flaw can lead to unauthorized exposure of personally identifiable information (PII) across tenants, including sensitive user details such as mobile numbers. No official patch or remediation level has been confirmed yet.
CVE-2024-10302 is a medium severity vulnerability in WSO2 API Control Plane version 4.5.0 involving improper input validation in the user self-signup flow. Unvalidated user-supplied data can be included in user claims, which downstream processes consume. This may lead to security risks such as content manipulation, redirection, UI inconsistencies, unauthorized actions, and data exposure depending on how the data is used and the privileges of affected users. No official patch or remediation guidance is currently available.
CVE-2026-70603 is an improper input validation vulnerability in the Electron framework's shell.openPath() method. Prior to fixed versions, this method did not reject file paths containing embedded null bytes, allowing attackers to bypass string-based validation checks and open unintended files. Applications that rely solely on string validation of file paths derived from untrusted input and pass them to shell.openPath() are affected. The issue is resolved in Electron versions 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1.
Ghost, a Node.js content management system, contains an improper input validation vulnerability in versions from 4.22.0 up to but not including 6.54.1. This flaw allowed users to redeem subscription offers that were no longer active. The issue is resolved in version 6.54.1.
CVE-2026-16793 is a high-severity vulnerability in Lenovo XClarity Orchestrator 2.2.0 where improper neutralization of special elements in OS commands allows an authenticated attacker to execute arbitrary commands with privileged user rights. This vulnerability does not require user interaction and affects confidentiality, integrity, and availability. No patch or official remediation has been confirmed yet.
CVE-2026-11835 is a medium-severity TOCTOU race condition vulnerability in Caliptra Core ROM versions 2.1.0 through 2.1.1. It allows a compromised local attacker with high privileges to bypass secure boot by exploiting missing input validation in the UpdateResetFlow::run() function. The attacker can supply an unvalidated AXI staging address to modify firmware after verification but before loading, while attestation reports the original verified image digest, masking the compromise.
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.1.1 until 10.2.2, every special-use classification method is built on isInSubnet, which short-circuits to false whenever the address's own subnet mask is shorter than the reference range's mask. That mask comes verbatim from the CIDR suffix on the parsed input, so appending a suffix such as /0 suppresses classification entirely: isLoopback(), isPrivate(), isLinkLocal(), isCGNAT(), isMulticast(), isUnspecified(), isBroadcast(), isULA(), and getType() all report an internal address as unremarkable, while correctForm() and address still return the real internal target. An application that builds a network trust-boundary decision on these checks, for example a filter intended to block Server-Side Request Forgery, or SSRF, may therefore treat an internal target as external and allow the request. The underlying bit comparison is correct, and mask(n) already returns the first n bits of the full parsed address independently of subnetMask; the defect is solely that the containment guard sits in the classification path. This issue is fixed in version 10.2.2.
Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This vulnerability is fixed in 4.2.7, 3.4.5, and 3.3.6.
The ip-address JavaScript library prior to version 10.3.1 improperly validates input when parsing IPv4 addresses with octets that have leading zeros. This causes a mismatch between the library's interpretation and standard network parsers, potentially leading to incorrect classification of internal versus external IP addresses. This can affect security decisions such as Server-Side Request Forgery (SSRF) protections. The issue is fixed in version 10.3.1.
CVE-2026-21553 is a high-severity vulnerability in the modems of Unisoc (Shanghai) Technologies Co., Ltd. models T8100, T9100, T8200, and T8300. It involves improper input validation that could allow a remote attacker to cause a denial of service without requiring any privileges or user interaction.
CVE-2026-21552 is a high-severity vulnerability in the modem components of Unisoc (Shanghai) Technologies Co., Ltd. products T8100, T9100, T8200, and T8300. It involves improper input validation that could allow a remote attacker to cause a denial of service without requiring any privileges or user interaction.
CVE-2026-21551 is a high-severity vulnerability in the modem components of Unisoc (Shanghai) Technologies Co., Ltd. products T8100, T9100, T8200, and T8300. The issue arises from improper input validation, which could allow a remote attacker to cause a denial of service without requiring any additional execution privileges. No information about patches or fixes is currently available.
CVE-2026-21550 is a high-severity vulnerability in the modem components of Unisoc (Shanghai) Technologies Co., Ltd. products T8100, T9100, T8200, and T8300. It involves improper input validation that could allow a remote attacker to cause a denial of service without requiring any additional execution privileges. No information about patches or fixes is currently available.