CVE-2026-113786 is an improper input validation vulnerability in the py-pdf pypdf library prior to version 6.21.1. An attacker can craft a PDF with image data labeled with the /DCTDecode filter that causes the Pillow library to invoke an unintended image parser when loading the image. This issue only affects environments where the optional Pillow dependency is installed. The vulnerability is fixed in pypdf version 6.21.1.
CVE-2024-6423 is an improper input validation vulnerability in WSO2 API Manager that allows sensitive data to be passed via URL parameters to flows where it is not intended to be processed. Although the product does not use this data, it may be logged in access logs if users mistakenly include sensitive information in URL parameters, potentially exposing confidential data. The vulnerability affects multiple versions of WSO2 API Manager prior to specific fixed releases.
Eclipse OpenJ9 versions prior to 0.63.0 contain a vulnerability in the JITServer component that allows unauthenticated remote attackers or malicious JITServers to cause out-of-bounds heap reads. This flaw leads to immediate crashes of the JITServer daemon or client JVM process via segmentation faults, resulting in denial of service.
CVE-2026-92287 is an improper input validation vulnerability in Apache Arrow C++ (Parquet and PyArrow) versions 4.0.0 up to but not including 26.0.0. The flaw involves passing unvalidated KMS URLs to KMS clients, which can be controlled by an attacker via file contents. This may lead to sensitive KMS tokens being sent to malicious hosts. Version 26.0.0 addresses this by disabling file-controlled KMS URLs by default and requiring explicit opt-in with validation.
fast-uri versions 2.4.2 through 2.4.7, 3.1.3 through 3.1.8, and 4.0.1 through 4.2.2 contain an improper input validation vulnerability in the canonicalizeHost() function. This function passes the parsed host to the WHATWG URL parser but does not verify that the entire input was consumed as a host, allowing silent rewriting of the authority component. Specifically, data before an at-sign is dropped and certain whitespace characters are stripped without error. This can cause host-based policies to be bypassed, potentially redirecting traffic to unintended destinations. The issue is fixed in versions 2.4.8, 3.1.9, and 4.2.3 and later.
CVE-2026-112991 is a server-side request forgery (SSRF) vulnerability in the html_to_markdown expansion module of MISP misp-modules. The vulnerability arises from an incomplete URL validation function that fails to block several critical internal IP address ranges. An authenticated user able to create or modify attributes triggering this module can cause the MISP server to make requests to internal network addresses, potentially exposing sensitive data from internal services. The vulnerability affects versions from 0 up to and including 3.0.12.
Element X iOS versions before 26.05.0 contain an improper input validation vulnerability in the handling of io.element.call:// URLs. This flaw allows an attacker to bypass the URL allowlist and load attacker-controlled content inside the call screen's WKWebView, which can access the device's microphone and camera if permissions were previously granted. The issue is fixed in version 26.05.0.
Improper Input Validation vulnerability in Apache Camel Mail component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.
CVE-2026-46584 addressed mail headers reaching the Exchange without passing through a header filter, but the MimeMultipart data format retained an unfiltered path: unmarshalling a multipart message mapped mail.smtp headers onto the Exchange with no filter applied. Those names sit outside the Camel namespace that consumer filters block, so a message crafted by an external sender could still set them, and the mail.smtp namespace influences how a downstream mail producer connects and sends. This is an incomplete fix of CVE-2026-46584 rather than a new class of defect: a deployment that applied that advisory and considered camel-mail settled remained exposed on this path.
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The MimeMultipart data format now applies the header filter on unmarshal, closing the path CVE-2026-46584 left open. For deployments that cannot upgrade immediately, strip the namespace after the data format with removeHeaders("mail.smtp*") before any mail producer.
Improper Input Validation vulnerability in Apache Camel Core component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.
The saga processor consulted a header named Long-Running-Action to decide which saga an exchange belonged to. The name carries no Camel prefix, so it sits outside the namespace that consumer header filters block, and an external sender could supply it on an inbound message. That let the sender name the saga the exchange joined, attaching their request to a long-running action started by someone else, or causing compensation to be associated with an action they did not initiate. The header is only consulted by a saga service that uses it, which bounds the exposure to deployments running sagas over an LRA coordinator.
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The header is now consulted only for a saga service that actually uses it, rather than on every exchange. For deployments that cannot upgrade immediately, strip the header at the trust boundary with removeHeaders("Long-Running-Action") on every consumer that accepts messages from an untrusted sender.
Improper Input Validation vulnerability in Apache Camel Tika component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.
The Tika producer mapped every metadata key parsed out of the submitted document onto the Exchange as a header, with no filter applied. Document metadata is attacker-controlled content: the party that supplies the file chooses the metadata keys it carries. A crafted document could therefore set Exchange headers that the rest of the route depends on, including headers in the Camel namespace such as CamelFileName, which downstream components use to decide where content is written. The pattern is the same header-injection class as the consumer advisories published previously, reached here through parsed file content rather than through a protocol header.
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. Parsed document metadata is now filtered through a HeaderFilterStrategy before it is mapped onto the Exchange. A route that was reading a metadata-derived header the filter now blocks will see it missing. For deployments that cannot upgrade immediately, strip the Camel namespace after the Tika producer with removeHeaders("Camel*") before any component that acts on those headers.
The Salon Booking System WordPress plugin before 10.31.11 does not enforce a minimum of zero when subtracting a fixed-amount discount from a booking's total, allowing an unauthenticated visitor who knows a valid discount code to create a confirmed booking stored with a negative total.
CVE-2026-76739 is a medium severity vulnerability in Hewlett Packard Enterprise's HPE Compute Scale-up Server 3200 and 3250 platforms, as well as the Superdome Flex server. It involves improper input validation that could allow a remote attacker with limited privileges to list and modify the RMC filesystem. The vulnerability affects specific versions prior to 1.77.30 and 1.03.38. A fix is available in these versions.
CVE-2026-108121 is a vulnerability in Koozali SME Server version 11.0rc1-215 affecting the domain creation functionality. An attacker with high privileges can inject reserved Apache configuration directives, corrupting the httpd.conf file. This corruption prevents the Apache web server from starting after a reboot, causing a denial-of-service (DoS) condition impacting the web server and its hosted virtual hosts.
CVE-2026-96620 is a critical vulnerability in the anthropics claude-agent-sdk-python prior to version 0.2.121. The issue arises from improper input validation of the resume option passed to the Claude CLI, allowing an attacker to inject CLI flags such as --mcp-config. This can lead to arbitrary command execution at CLI startup, bypassing SDK permission controls. The vulnerability is fixed in version 0.2.121.
Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee hides the Omnipay Dummy test provider from the checkout options in production through OmnipayFactory::get_supported_providers(), but CreateSessionRequest validates only that the submitted provider is an OmnipayProviderType and does not enforce OmnipayProviderType::isAllowed(). A buyer, including a guest when webshop_allow_guest_checkout is enabled, can submit Dummy directly and complete the test gateway flow without a real payment. When webshop_auto_fulfill_enabled is enabled, OrderCompletedListener::fullfillOrder() can then release the purchasable item. The issue requires access to the Supporter or Pro webshop and an enabled purchasable item. Testing bypassed the closed-source license middleware, so whether the real license layer performs additional payment-provider validation remains unverified. The payment finalize status check itself is not the root cause. This issue is fixed in version 7.7.0.
Lychee is a free, open-source photo-management tool. Prior to 7.7.1, the Supporter or Pro webshop POST /api/v2/Shop/Checkout/Process flow accepts an unrestricted additional_data array and CheckoutService::preparePurchaseParameters() merges it after server-computed purchase parameters. Because later string keys overwrite earlier keys, an unauthenticated buyer can replace amount, currency, returnUrl, cancelUrl, or transactionId before CheckoutService::processPayment() passes the parameters to a non-PayPal Omnipay gateway. An attacker can therefore make a gateway accept a successful payment for an attacker-selected amount and obtain auto-fulfilled goods while underpaying the merchant. The issue requires an enabled webshop, a purchasable item, and an affected Omnipay gateway. This issue is fixed in version 7.7.1.
CVE-2026-100347 is a medium-severity vulnerability in the getkin kin-openapi library's openapi3filter.ValidationHandler middleware. It occurs because the legacy router matches HTTP methods verbatim against a trie of upper-cased standard methods, causing requests with non-standard or non-canonical HTTP methods (e.g., PROPFIND or lowercase get) to miss the route and trigger a panic. This panic happens before authentication, leading to an unauthenticated, remotely triggerable denial of service via connection aborts and unbounded error log growth. The vulnerability affects versions prior to 0.145.0 and has no known fixes or patches as of the published date.
CVE-2026-79837 is a high-severity vulnerability in Hewlett Packard Enterprise's HPE NonStop SQL/MX UDR SERVER involving improper input validation. This flaw may allow a crafted message to cause process termination, service disruption, or memory corruption, leading to undefined behavior.
CVE-2026-79836 is a medium severity vulnerability in Hewlett Packard Enterprise's HPE NonStop SQL/MX Run-Time Statistics component. It involves improper input validation that can lead to memory corruption and null pointer dereference. Exploitation of this flaw may cause process crashes, denial of service (DoS), or information disclosure.