CWE-20: Improper Input Validation vulnerabilities

Improper input validation in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.

Improper input validation in Windows Hello allows an authorized attacker to bypass a security feature locally.

Untrusted pointer dereference in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally.

Improper input validation in Windows Server Update Service allows an unauthorized attacker to perform tampering over a network.

CVE-2026-39417 is an OS command injection vulnerability in 1Panel-dev MaxKB versions 2.7.1 and below. It arises from an incomplete fix for a previous vulnerability (CVE-2025-53928) where the MCP node configuration can still be injected via user-supplied JSON in the workflow creation API. This allows an attacker with limited privileges to inject arbitrary commands that execute when the workflow is triggered. The issue is fixed in version 2.8.0. The CVSS score is 4.6, indicating medium severity.

jq versions prior to commit 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b contain a vulnerability where input parsing improperly handles embedded NUL bytes. The tool uses strlen() instead of the actual byte count from fgets(), causing it to truncate input at the first NUL byte and only validate the prefix as JSON. This allows attackers to craft inputs with a valid JSON prefix followed by malicious trailing data that jq ignores but downstream consumers may process. This vulnerability has been patched in the specified commit.

CVE-2026-22563 is a critical vulnerability affecting Ubiquiti Inc's UniFi Play PowerAmp and UniFi Play Audio Port devices. It involves improper input validation that could allow a command injection by an attacker with access to the UniFi Play network. The vulnerability affects UniFi Play PowerAmp versions 1.0.35 and earlier, and UniFi Play Audio Port versions 1.0.24 and earlier. The vendor has released updates to address this issue: version 1.0.38 or later for UniFi Play PowerAmp and version 1.

CVE-2026-22565 is an improper input validation vulnerability in Ubiquiti Inc's UniFi Play PowerAmp and UniFi Play Audio Port devices. A malicious actor with network access to these devices could exploit this flaw to cause the device to stop responding, resulting in a denial of service. The vulnerability affects UniFi Play PowerAmp versions 1.0.35 and earlier, and UniFi Play Audio Port versions 1.0.24 and earlier. Updates to UniFi Play PowerAmp version 1.0.38 or later and UniFi Play Audio Port version 1.

The bson_validate function may return early on specific inputs and incorrectly report success. This behavior could result in skipping validation for BSON data, allowing malformed or invalid UTF-8 sequences to bypass validation and be processed incorrectly. The issue may affect applications that rely on these functions to validate untrusted BSON data before further processing. This issue affects MongoDB C Driver versions prior to 1.30.5, MongoDB C Driver version 2.0.0 and MongoDB C Driver version 2.0.1

This update includes the following RPMs: qt5: * qt5-filesystem-5.15.18-2.1.hum1 (aarch64, x86_64) * qt5-rpm-macros-5.15.18-2.1.hum1 (noarch) * qt5-srpm-macros-5.15.18-2.1.hum1 (noarch) * qt5-5.15.18-2.1.hum1.src (src)

CVE-2026-21010 is a vulnerability in Samsung Mobile Devices involving improper input validation in Retail Mode before the SMR April 2026 Release 1. This flaw allows local attackers with limited privileges to trigger privileged functions without user interaction. The vulnerability has a CVSS score of 6.6, indicating a medium severity level. No official patch or remediation guidance has been provided yet, and there are no known exploits in the wild. The vulnerability affects Samsung Mobile Devices generally, with no specific versions detailed. The vendor has not issued an advisory or fix at this time.

CVE-2026-21003 is a medium severity vulnerability in Samsung Mobile Devices involving improper input validation of data related to network restrictions. This flaw exists in device software versions prior to the SMR April 2026 Release 1. It allows physical attackers to bypass network restrictions by exploiting the improper validation. The vulnerability has a CVSS 4.0 base score of 5.2, indicating moderate impact. There is no official patch or remediation level currently confirmed from the vendor. No known exploits are reported in the wild at this time.

CVE-2026-34855 is an out-of-bounds write vulnerability in the kernel module of Huawei HarmonyOS affecting multiple versions from 4.0.0 to 6.0.0. Exploitation can impact system availability and confidentiality. The vulnerability is due to improper input validation (CWE-20). It has a CVSS 3.1 base score of 5.7, indicating medium severity.

An Improper Input Validation vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker, sending a specific genuine BGP packet in an already established BGP session to reset only that session causing a Denial of Service (DoS). An attacker repeatedly sending the packet will sustain the Denial of Service (DoS).This issue affects Junos OS: * 25.2 versions before 25.2R2 This issue does not affect Junos OS versions before 25.2R1. This issue affects Junos OS Evolved: * 25.2-EVO versions before 25.2R2-EVO This issue does not affect Junos OS Evolved versions before 25.2R1-EVO.eBGP and iBGP are affected. IPv4 and IPv6 are affected.

Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614. This issue affects Apache Tomcat: from 11.0.15 through 11.0.19, from 10.1.50 through 10.1.52, from 9.0.113 through 9.0.115. Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.

Rapid7 Velociraptor versions prior to 0.76.2 contain an improper input validation vulnerability in the client monitoring message handler on the Velociraptor server (primarily Linux) that allows an authenticated remote attacker to write to arbitrary internal server queues via a crafted monitoring message with a malicious queue name. The server handler that receives client monitoring messages does not sufficiently validate the queue name supplied by the client, allowing a rogue client to write arbitrary messages to privileged internal queues. This may lead to remote code execution on the Velociraptor server. Rapid7 Hosted Velociraptor instances are not affected by this vulnerability.

CVE-2026-34178 is a critical vulnerability in Canonical LXD before version 6.8 where improper input validation allows an authenticated attacker with instance-creation permissions in a restricted project to bypass project restrictions. The vulnerability arises because the backup import process validates project restrictions against one file in the backup archive but creates instances from a separate file that is not checked. This flaw can be exploited to set restricted security settings, potentially leading to full host compromise.

A vulnerability in the honojs hono web application framework prior to version 4.12.12 allows bypass of cookie prefix protections due to inconsistent handling between browser cookie parsing and the parse() function. This discrepancy enables attacker-controlled cookies to override legitimate cookies by exploiting normalization differences. The issue is fixed in version 4.12.12. The vulnerability has a medium severity with a CVSS score of 4.8.

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ All: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.3. Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions 0.24.0 and prior, a Server-Side Template Injection (SSTI) vulnerability exists in RAGFlow's Agent workflow Text Processing (StringTransform) and Message components. These components use Python's jinja2.Template (unsandboxed) to render user-supplied templates, allowing any authenticated user to execute arbitrary operating system commands on the server. At time of publication, there are no publicly available patches.