CWE-20: Improper Input Validation vulnerabilities

ShellHub is a centralized SSH gateway. Prior to 0.24.2, the device list endpoint accepts user-controlled identifiers in the the name field of each filter property in the base64-encoded filter query parameter and the sort_by query parameter, which are then passed directly as BSON/SQL keys in the database layer without validation. Any authenticated user can craft payloads that cause the aggregation / query to fail and the API to return HTTP 500 with no body, with no rate limiting applied. This vulnerability is fixed in 0.24.2.

CubeCart versions 6.6.x through 6.7.1 have an improper input validation vulnerability where the software builds the CC_STORE_URL constant directly from the Host request header without validation. This value is used verbatim in transactional email links, including password reset links. An unauthenticated attacker can exploit this by sending a password recovery request with a malicious Host header, causing the victim to receive a password reset link pointing to an attacker-controlled domain. If the victim clicks the link, the attacker can gain full account takeover or store takeover if an admin account is targeted. This vulnerability is fixed in CubeCart version 6.7.

CVE-2026-0238 is a low-severity vulnerability in Palo Alto Networks Broker VM version 30.0 that allows an authenticated administrator to inject arbitrary content into certain Broker VM fields due to improper input validation. The vulnerability requires local access with low privileges and does not involve user interaction. There are no known exploits in the wild, and no official patch or remediation guidance has been provided yet. The impact is limited to potential unauthorized content injection by an authenticated administrator. No geographic targeting is indicated.

CVE-2026-2695 is a command injection vulnerability in TeamViewer DEX Platform On-Premises versions prior to 9.2. It arises from improper input validation that allows authenticated users with at least questioner privileges to inject commands in specific instructions. Successful exploitation could enable execution of elevated commands on devices connected to the platform. The vulnerability has a CVSS score of 6.3, indicating medium severity. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.

protobufjs versions prior to 7.5.6 and between 8.0.0 and 8.0.2 contain an improper input validation vulnerability. The library generates JavaScript property accessors from schema field names without escaping certain control characters. This can cause generated encode, decode, verify, or conversion functions to fail during compilation when processing crafted schemas or JSON descriptors. The issue is fixed in versions 7.

Improper Input Validation in the NAT64 translator in The OpenThread Authors OpenThread before commit 26a882d on all platforms allows an attacker on the adjacent IPv4 network to inject corrupted IPv6 packets into the Thread mesh or bypass security checks via crafted IPv4 packets with options.

Improper input validation in Routines prior to SMR May-2026 Release 1 allows physical attackers to launch privileged activity.

CVE-2026-21019 is a high-severity vulnerability affecting Samsung Mobile Devices, specifically in the FacAtFunction component of Galaxy Watch models prior to the SMR May-2026 Release 1. It involves improper input validation that allows a local attacker to execute arbitrary code with system privileges. The vulnerability has a CVSS 4.0 base score of 8.9, indicating a significant risk. There is no official patch or remediation level confirmed yet, and no known exploits in the wild have been reported. The vendor has not provided explicit guidance or a fix at this time.

Granian is a Rust HTTP server for Python applications. From 1.2.0 to 2.7.4, Granian aborts a worker process when an unauthenticated client sends a WebSocket upgrade request whose Sec-WebSocket-Protocol header contains non-ASCII bytes. The crash happens in Granian's WebSocket scope construction path, before the ASGI application is invoked. This vulnerability is fixed in 2.7.4.

CAI Content Credentials versions c2pa-web@0.7.0, c2pa-v0.78.2 and earlier are affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

CAI Content Credentials versions c2pa-web@0.7.0, c2pa-v0.78.2 and earlier are affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

CAI Content Credentials versions c2pa-web@0.7.0, c2pa-v0.78.2 and earlier are affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

CAI Content Credentials versions c2pa-web@0.7.0, c2pa-v0.78.2 and earlier are affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

CAI Content Credentials versions c2pa-web@0.7.0, c2pa-v0.78.2 and earlier are affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

CAI Content Credentials versions c2pa-web@0.7.0, c2pa-v0.78.2 and earlier are affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

Shelf is a platform for tracking physical assets. From 1.12 to before 1.20.1, a SQL injection vulnerability in the sortBy query parameter on the /assets route allows any authenticated user (any role) to execute arbitrary SQL and read data from any table in the database, including data belonging to other organizations. This vulnerability is fixed in 1.20.1.

Improper input validation in .NET allows an unauthorized attacker to elevate privileges locally.

Heap-based buffer overflow in .NET allows an unauthorized attacker to elevate privileges locally.

JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, the upload_wasm MCP tool accepted a filesystem path from the agent and uploaded whatever bytes the path resolved to, with no validation of location, symlink target, file size, or file format. This vulnerability is fixed in 0.x.y-security-1.