CWE-20: Improper Input Validation vulnerabilities

Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27. Older, end of support versions may also be affected. Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

CVE-2026-43899 is a critical vulnerability in ThinkInAIXYZ's DeepChat platform prior to version 1.0.4-beta.1. It involves improper input validation that allows an attacker or compromised AI endpoint to bypass security restrictions and execute arbitrary protocols via Electron's native pop-up window handlers. Specifically, malicious Markdown links with target="_blank" can trigger shell.openExternal(url) calls without proper URL validation, leading to remote code execution. This issue was introduced due to an incomplete mitigation of a previous vulnerability (CVE-2025-55733). The vulnerability is fixed in DeepChat version 1.0.

jq versions 1.8.1 and earlier contain an improper input validation vulnerability related to embedded NUL bytes in import paths. The jq language parser accepts these NUL bytes, but the underlying file path resolution uses C string operations that terminate at the NUL byte, causing a mismatch between the validated import string and the actual file accessed. This discrepancy can lead to unintended file access. The vulnerability has a medium severity with a CVSS score of 4.4. No official patch or remediation has been confirmed at this time.

Zen is a firefox-based browser. Prior to 1.19.12b, RSS feed URLs entered by the user are validated to http: or https: in promptForFeedUrl, but item links inside the feed are not subject to the same restriction. The provider maps each RSS/Atom item link into item.url, filters only for presence and date, and returns the item list. The live-folder manager later creates pinned lazy tabs from these values with gBrowser.addTrustedTab(item.url, ...). This vulnerability is fixed in 1.19.12b.

A critical vulnerability (CVE-2026-42613) exists in the Grav CMS prior to version 2.0.0-beta.2. The Login plugin's register() method improperly validates input fields from unauthenticated registration POST requests, allowing an attacker to self-register with admin.super privileges by injecting groups or access fields when registration is enabled and these fields are allowed. This vulnerability is fixed in version 2.0.0-beta.2.

pyp2spec generates working Fedora RPM spec file for Python projects. Prior to version 0.14.1, pyp2spec was writing PyPI package metadata (e.g.the summary field) into the generated spec file without escaping RPM macro directives. When a packager then runs rpmbuild, those directives get evaluated, so a malicious package can execute arbitrary commands on the build machine. This issue has been patched in version 0.14.1.

Insufficient input validation of the feature file name in `feature::LOADFEATUREFILE` adminbin call can cause arbitrary file read when a relative file path is passed.

Insufficient input validation of the `plugin` parameter of the `create_user` plugin allows arbitrary Perl code execution on behalf of the already authenticated account's system user.

PraisonAI is a multi-agent teams system. From version 2.4.1 to before version 4.6.34, PraisonAI exposes optional SQL/CQL-backed knowledge-store implementations that build table and index identifiers from unvalidated name and collection arguments. Applications that pass untrusted collection names into these backends can trigger SQL or CQL injection. This issue has been patched in version 4.6.34.

PraisonAI is a multi-agent teams system. Prior to version 4.6.34, PraisonAI's MCP (Model Context Protocol) server (praisonai mcp serve) registers four file-handling tools by default — praisonai.rules.create, praisonai.rules.show, praisonai.rules.delete, and praisonai.workflow.show. Each accepts a path or filename string from MCP tools/call arguments and joins it onto ~/.praison/rules/ (or, for workflow.show, accepts an absolute path) with no containment check. The JSON-RPC dispatcher passes params["arguments"] blind to each handler via **kwargs without validating against the advertised input schema. By setting rule_name="../../<some-path>" an attacker walks out of the rules directory and writes any file the running user can write. Dropping a Python .pth file into the user site-packages directory escalates this primitive to arbitrary code execution in any subsequent Python process the user spawns — the next praisonai CLI invocation, an IDE script run, the user's python REPL, or any background Python service. This issue has been patched in version 4.6.34.

PromptHub is an all-in-one AI toolbox for prompt, skill, and agent management. From version 0.4.9 to before version 0.5.4, apps/web/src/routes/skills.ts exposes an authenticated endpoint POST /api/skills/fetch-remote that fetches a user-supplied URL server-side and reflects the response body (up to 5 MB) back to the caller. The SSRF protection in apps/web/src/utils/remote-http.ts (isPrivateIPv6) attempts to block private/loopback destinations, but multiple alternate-but-valid IPv6 representations bypass the check. The bypasses reach any IPv4 address (loopback, RFC1918, link-local) via IPv4-mapped IPv6 in hex form, and the canonical ::1 via any representation that isn't the literal string "::1". Any authenticated user (role: user or admin) can trigger the SSRF. On deployments configured with ALLOW_REGISTRATION=true — a supported and documented configuration — this means any internet user who can register. This issue has been patched in version 0.5.4.

Improper access control in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code over a network.

An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with administrative access to achieve remote code execution.

CVE-2026-41654 is a medium severity vulnerability in Weblate versions prior to 5.17.1. It allows an authenticated user with project.add permission to import a crafted project backup ZIP containing a component JSON with a malicious repository URL. This URL can point to private network addresses or use disallowed schemes, bypassing input validation due to the use of bulk_create which skips Django's full_clean validation. The malicious URL is then written directly into the . git/config file. This issue has been fixed in Weblate version 5.17.

Open Notebook version 1.8.3 contains an improper input validation vulnerability in its file upload functionality. This flaw allows an attacker to perform path traversal attacks to access local files within the Docker container hosting the application. The vulnerability is identified as CWE-20 and has a high severity score of 8.2.

Open Notebook version 1.8.3 contains an improper input validation vulnerability in its file upload functionality. This flaw allows an attacker to perform path traversal, enabling creation or modification of files within the Docker container hosting the application. The vulnerability has a high severity rating with a CVSS 4.0 score of 7. No known exploits are reported in the wild, and no official patch or remediation information is provided.

Open Notebook version 1.8.3 suffers from a critical Server-Side Template Injection (SSTI) vulnerability due to improper input validation. This flaw allows an attacker to execute arbitrary Python code and OS commands within the Docker container hosting the application. The vulnerability arises from lack of user input sanitization in user-created transformations.

Open Notebook version 1.8.1 contains an improper input validation vulnerability combined with an overly permissive default CORS configuration. This flaw allows a remote attacker to trick a legitimate user into altering or deleting arbitrary database entries via a specially crafted malicious URL. Depending on the deployment environment, the vulnerability may also enable data exfiltration.

CI4MS versions from 0.31.1.0 up to but not including 0.31.8.0 contain an improper input validation vulnerability in the deleteProcess() action. This action accepts a POST parameter tables[] with arbitrary table names, which are passed directly to the database dropTable() function without verifying that these tables belong to the theme being deleted. An authenticated administrator can exploit this to drop any table in the database. The issue was patched in version 0.

Admidio versions prior to 5.0.9 contain an improper input validation vulnerability in the SAML IdP implementation of its SSO module. The system uses the AssertionConsumerServiceURL from incoming SAML AuthnRequest messages without verifying it against the registered URL for the service provider. This allows an attacker who knows a registered service provider's Entity ID to craft a request that causes the IdP to send signed SAML responses containing user identity attributes to an attacker-controlled URL. This vulnerability is fixed in version 5.0.9.