CWE-20: Improper Input Validation vulnerabilities

A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative varints or deep recursion—can be used to crash the application, impacting service availability.

Due to improper input validation in one of the Eaton Intelligent Power Protector (IPP) XML, it is possible for an attacker with admin privileges and access to the local system to inject malicious code resulting in arbitrary command execution. This security issue has been fixed in the latest version of Eaton IPP software which is available on the Eaton download centre.

Composer versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::generateP4Command() method. This flaw allows an attacker to inject arbitrary shell commands via specially crafted Perforce connection parameters in a malicious composer.json file. Exploitation requires running Composer commands on untrusted projects with attacker-supplied composer.json files. The vulnerability has been fixed in Composer versions 2.2.27 and 2.9.6.

The MetForm Pro plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 3.9.7 This is due to the payment integrations (Stripe/PayPal) trusting a user-submitted calculation field value without recomputing or validating it against the configured form price. This makes it possible for unauthenticated attackers to manipulate the payment amount via the 'mf-calculation' field in the form submission REST request granted there exists a specific form with this particular configuration.

CVE-2026-6328 is a high-severity vulnerability in the XQUIC Project's xquic implementation on Linux. It involves improper input validation and improper verification of cryptographic signatures in the QUIC protocol's packet processing and STREAM frame handler modules. This flaw allows protocol manipulation. The vulnerability affects versions up to 1.8.3 of XQUIC. No official patch or remediation guidance has been provided yet, and there are no known exploits in the wild.

CVE-2026-39399 is a critical vulnerability in the NuGetGallery backend job that processes . nuspec files within NuGet packages. The flaw arises from improper input validation of package metadata, enabling attackers to inject malicious metadata via crafted . nuspec files. Exploitation involves URI fragment injection through unsanitized package identifiers, allowing arbitrary blob writes within the storage container beyond intended . nupkg files. This can lead to remote code execution and tampering with existing content. The vulnerability affects versions prior to commit 0e80f87628349207cdcaf55358491f8a6f1ca276. A patch addressing this issue has been committed, mitigating the risk.

Adobe Framemaker versions 2022.8 and earlier are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read. An attacker could leverage this vulnerability to access sensitive files or data on the system. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue requires user interaction.

ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.

ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Attacker requires elevated privileges. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Stack-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to deny service over a network.

CVE-2026-32201 is a medium severity vulnerability in Microsoft SharePoint Enterprise Server 2016 caused by improper input validation. This flaw allows an unauthorized attacker to perform spoofing attacks over a network. The vulnerability affects multiple versions prior to specific fixed releases. Microsoft has issued official fixes for the affected versions. Exploitation in the wild is confirmed, and the vulnerability is listed in the CISA KEV catalog.

Improper input validation in Windows Hyper-V allows an authorized attacker to execute code locally.

Improper input validation in Windows Hello allows an unauthorized attacker to bypass a security feature over a network.

Improper input validation in Windows BitLocker allows an unauthorized attacker to bypass a security feature locally.

Improper input validation in Microsoft PowerShell allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Hyper-V allows an unauthorized attacker to execute code locally.

Improper input validation in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature locally.

Improper input validation in Windows Active Directory allows an authorized attacker to execute code over an adjacent network.

Loop with unreachable exit condition ('infinite loop') in .NET, .NET Framework, Visual Studio allows an unauthorized attacker to deny service over a network.