CWE-20: Improper Input Validation vulnerabilities

CVE-2026-88858 is a vulnerability in Grafana OSS where a user with Viewer role can crash the server by submitting a crafted server-side math expression causing uncontrolled recursion. Additionally, a user with permission to provision alert rules can make the outage persist across server restarts. This issue affects multiple versions of Grafana OSS from 7.4.0 through 13.2.4. The vulnerability has a medium severity rating with a CVSS score of 6.5.

CVE-2026-88967 is a server-side request forgery (SSRF) vulnerability in Grafana Enterprise affecting users with query access to Azure Monitor data sources. Exploitation allows an attacker to cause the server to send requests to attacker-controlled endpoints, potentially disclosing the Azure access token associated with the data source. This vulnerability affects multiple versions of Grafana Enterprise from 10.0.0 through 13.2.4. The issue has a high severity rating with a CVSS score of 7.7. A patch is available, and Grafana manages remediation for this cloud-hosted service.

CVE-2026-111551 is a vulnerability in Apache Kafka where several deserialization paths allocate memory based on unvalidated size or count fields from input data. This can lead to excessive memory allocation, causing an OutOfMemoryError that crashes the affected consumer or Kafka Streams thread. The issue affects Kafka versions up to 4.1.2, 4.2.1, and 4.3.1. The vulnerability does not impact brokers or the cluster as a whole. It can be triggered by crafted records or assignment data in specific Kafka Streams or client library components. Fixed versions include Apache Kafka 4.2.2, 4.3.2, and 4.4.0, which validate size fields before allocation.

HCL BigFix AEX product is affected by a vulnerability in the aws-sdk package.. It may cause AWS API requests to be sent to unintended or non‐AWS endpoints.

MISP Guard, a proxy enforcing security policies on MISP feed data, had an improper input validation vulnerability in its taxonomy tag checks. The guard verified only that at least one tag from a required taxonomy was allowed, but failed to ensure all tags from that taxonomy were allowed. This flaw allowed events or attributes to carry both allowed and non-allowed tags simultaneously, bypassing data classification restrictions. An attacker with event authoring or modification rights could exploit this to distribute higher-classification data through feeds intended for lower-classification data. The vulnerability affected event-level and attribute-level tags, including nested and shadow attributes. It was fixed in misp-guard version 1.4.

An XPath injection vulnerability in WatchGuard Fireware OS's SSH authentication process allows a remote, unauthenticated attacker with access to the management SSH interface to extract sensitive configuration data by submitting a specially crafted request.

CVE-2026-116671 is a low-severity vulnerability in Xpdf versions up to 4.06 that causes an infinite loop due to improper input validation of the progression order field in JPEG 2000 images.

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, ImageMediaIO passes attacker-controlled image bytes to Pillow through Image.open(BytesIO(data)) without restricting decoder selection, and the MIME label does not constrain the selected format. Image-capable request paths through parse_image() and fetch_image() can therefore dispatch an EPS payload to host components. A host with Ghostscript affected by CVE-2024-29510 can execute commands with the vLLM process's privileges, while environments using Pillow 12.0.0 through 12.2.0 can trigger CVE-2026-59203 and exhaust media-loading workers. Deployments without the applicable vulnerable dependency are not affected by that corresponding impact. This issue is fixed in version 0.32.0.

CVE-2026-115905 is a critical vulnerability in the zip-rs zip2 Rust library affecting versions prior to 9.0.5. The flaw arises from inconsistent handling of filenames between the Central Directory File Header and Local File Header in ZIP archives, allowing crafted archives to cause a streaming extractor to write attacker-controlled files potentially overwriting important files. This issue is resolved in version 9.0.5.

MISP Guard, a proxy-based security filter for MISP feed distribution, has a case-sensitivity flaw in multiple policy enforcement checks. This flaw allows attackers with event creation privileges to bypass configured security policies by altering the letter case of taxonomy tags, attribute categories, or sharing-group UUIDs. As a result, unauthorized threat intelligence data may be disclosed to downstream feed consumers, violating confidentiality controls.

CVE-2026-116372 is an improper input validation vulnerability in MISP misp-guard, a security filtering proxy for MISP feed responses. The vulnerability arises because misp-guard only filters HTTP 200 responses, allowing other 2xx status codes like 201, 203, and 206 to bypass filtering. This enables a malicious or compromised feed endpoint to deliver unfiltered content to the MISP instance. Exploitation requires control of a configured feed endpoint and no additional authentication or user interaction is needed.

The GiveWP WordPress plugin before 4.19.0.1 does not restrict the currency of a donation to the one the site or form accepts, while comparing its amount limits as bare numbers, allowing unauthenticated users to make donations below a form's configured minimum or fixed amount.

CVE-2026-115883 is an improper input validation vulnerability in langchain-ai's langgraph checkpoint savers for Postgres and SQLite state persistence. Prior to versions 3.1.3 (Postgres) and 3.1.2 (SQLite), certain namespace label operations do not properly validate dotted labels, allowing cross-namespace access. This can lead to unauthorized reads, overwrites, or deletions of another tenant's stored namespace. The issue does not affect InMemoryStore. Fixed in langgraph-checkpoint-postgres 3.1.3 and langgraph-checkpoint-sqlite 3.1.2.

CVE-2026-55444 is an input validation vulnerability in the legacy RSS servlet of intranda goobi-viewer-core versions prior to 26.05. The servlet improperly concatenates user-supplied q and filterQuery parameters into Solr queries without validation, allowing unauthenticated attackers to inject Solr boolean operators. This can bypass access controls and expose access-restricted records in the RSS feed. The issue is fixed in version 26.05.

CVE-2026-55442 is an improper input validation vulnerability in intranda goobi-viewer-core affecting versions from 23.03 up to but not including 26.05. The issue involves the SolrTools.cleanUpQuery() method, which attempts to sanitize user-supplied query strings by stripping Solr local-parameter syntax. However, the sanitization can be bypassed by wrapping the local parameter in double curly braces, allowing a valid Solr local parameter to be forwarded. This flaw affects any endpoint using this sanitizer. The vulnerability has been patched in version 26.05.

baserCMS versions 5.2.5 before 5.3.2 and 5.4.0 before 5.4.2 contain an improper input validation vulnerability in a public mail form. An unauthenticated visitor can supply a comma-separated list of email addresses in the email field, causing a single auto-reply to be sent to multiple unintended recipients. This occurs when server-side VALID_EMAIL validation is not enabled on newly created forms. The issue has been patched in versions 5.3.2 and 5.4.2.

Heimdall versions prior to 0.17.17 improperly validate client IP addresses extracted from Forwarded and X-Forwarded-For headers when the trusted_proxies option is configured. The service accepts arbitrary strings, malformed IP literals, and unknown or obfuscated identifiers without proper syntax validation. Additionally, the Forwarded header parser incorrectly splits quoted strings, potentially causing malformed parsing of client IP addresses. This vulnerability was fixed in version 0.17.17.

Heimdall versions prior to 0.17.17 have an improper input validation vulnerability in proxy mode where the Host header value is inserted unsanitized into the Forwarded HTTP header. This allows attackers to inject additional parameters, potentially spoofing IP addresses for upstream services. The issue is fixed in version 0.17.17.

CVE-2026-89317 is an improper input validation vulnerability in the Eclipse Foundation's Eclipse KeyPont GOSE component. The vulnerability arises because the GOSE library parses the JWS 'crit' header but does not enforce the requirement from RFC 7515 §4.1.11 to reject tokens with unrecognized critical extension parameters. As GOSE implements no header extensions, it should reject any token with a non-empty 'crit' header but fails to do so. This flaw affects versions from 0 up to 1.0.0-rc4 and is fixed in version 1.0.0-rc4.

Part-DB-server versions prior to 2.13.2 contain a spreadsheet formula injection vulnerability in the part import/export workflow. Authenticated users with import permissions can craft CSV files with formula-prefixed values that are stored in part fields. When these parts are exported as XLSX files, the formulas are written without neutralization, resulting in executable spreadsheet formulas. Opening the exported spreadsheet may trigger formula evaluation in spreadsheet software. This vulnerability is fixed in version 2.13.2.