Security Risk Category
Input Validation Security Risks — Page 3
Published vulnerability pages connected to Input Validation. Each page keeps one canonical URL and focused remediation guidance.
243 published Input Validation risks
Input Validation risks
Showing 73–108 of 243 published risks.
CVE-2026-7829 UltraVNC Repeater Rule Parser Out-of-Bounds Write
UltraVNC repeater through 1.8.2.2 contains a post-authentication out-of-bounds write in the allow/deny rule parser. In repeater/webgui/settings.c:225-272, after strncpy_s copies a rule token into temp1[rule1] (25-byte destination) or temp2/temp3 (16-byte destination), the code unconditionally writes a NUL terminator at temp1[rule1][len] = 0 without clamping len to the destination size. When an authenticated administrator saves a rule with a token length equal to or greater than the destination size, the NUL byte is written one or more bytes past the end of the stack-allocated array, corrupting adjacent stack data. An attacker who has obtained admin credentials (including via CVE-2026-7839 default password) can trigger this to gain code execution on the repeater host.
Updated Jul 15, 2026
CVE-2026-7838 UltraVNC Viewer Heap Buffer Overflow Vulnerability
UltraVNC viewer through 1.8.2.2 contains an integer overflow leading to a heap buffer overflow in the RFB protocol failure-response parsing path. In vncviewer/ClientConnection.cpp, the 4-byte network-supplied reasonLen field (type CARD32) is passed as reasonLen+1 to CheckBufferSize(). Because both operands are unsigned 32-bit, a reasonLen of 0xFFFFFFFF overflows to 0, causing CheckBufferSize to allocate only 256 bytes. The subsequent ReadString(m_netbuf, reasonLen) call then performs ReadExact for the original 4 GiB length into that 256-byte heap buffer. This overflow is reachable via rfbConnFailed (auth-scheme negotiation) and rfbVncAuthFailed (post-handshake) message types without successful authentication. A malicious VNC server, or any man-in-the-middle on the RFB stream, can trigger this condition when the victim viewer connects, potentially resulting in remote code execution as the user running the viewer. The crash was confirmed with AddressSanitizer on a portable reproduction harness (heap-buffer-overflow WRITE at offset 256).
Updated Jul 15, 2026
CVE-2026-14181 @fastify/middie Malformed URL Denial of Service
@fastify/middie versions 9.1.0 through 9.3.2 fail to guard the URL normalization step used by the standalone engine when incoming request paths contain malformed percent-encoded sequences. Inputs such as an incomplete percent escape or a truncated multibyte sequence cause the underlying decoder to throw synchronously, and the exception escapes the middie normalize step and terminates the Node.js process. The bypass affects applications that call middie.run directly on the standalone engine API, causing an immediate denial of service for all connected clients until restart. Applications using the Fastify plugin path are not affected because Fastifys error handler catches the exception. Patches: upgrade to @fastify/middie 9.3.3. Workarounds: migrate from the standalone engine API to the Fastify plugin path, where the framework error handler catches the exception.
Updated Jul 15, 2026
CVE-2026-14198 @fastify/middie Encoded Slash Middleware Bypass
@fastify/middie versions 9.1.0 through 9.3.2 decode the encoded slash %2F inside path parameter values before matching middleware paths, while Fastify's underlying router preserves the encoding during route lookup. The two layers disagree on the canonical request path, so the middleware fails to match a URL that the route handler does match. When middleware is used for authentication, authorization, rate limiting, or auditing on parameterized paths, an attacker can reach the protected handler by sending a single crafted URL with an encoded slash in the parameter position. The bypass is HTTP method agnostic and requires no authentication or special preconditions. Patches: upgrade to @fastify/middie 9.3.3. Workarounds: avoid parameterized middleware paths for security decisions, or enforce authentication at the route handler or via a Fastify hook that runs after the router has resolved the request.
Updated Jul 15, 2026
CVE-2026-53909 MyComplianceOffice File Upload Validation Vulnerability
MCO does not correctly validate types of uploaded files. File upload validation functionality relies only on client-side checks, which can be bypassed. An authorized, low-privileged attacker can upload files with arbitrary types to the server. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 25.3.3.1 but may also affect other versions.
Updated Jul 15, 2026
CVE-2026-61465 ImageMagick Memory Allocation Policy Bypass
ImageMagick before 7.1.2-26 and 6.9.13-51 is missing a check for the allowed memory allocation limit in matrix-backed operations such as -canny. An attacker can supply a crafted image that causes ImageMagick to allocate more memory than permitted by the configured policy, resulting in a denial of service.
Updated Jul 15, 2026
CVE-2026-61858 ImageMagick APNG Policy Bypass Vulnerability
ImageMagick before 7.1.2-26 contains a policy bypass vulnerability in the APNG encoder and external delegates due to missing validation checks. Attackers can write files to disallowed paths by bypassing configured policy restrictions through the APNG encoding process.
Updated Jul 15, 2026
CVE-2026-61870 ImageMagick VIFF Memory Leak Vulnerability
ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the VIFF encoder when memory allocation fails. Attackers can trigger allocation failures by processing specially crafted VIFF images to exhaust available memory and cause denial of service.
Updated Jul 15, 2026
CVE-2026-55170 in OpenFGA Helm Charts
OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, when MySQL is being used as the datastore and authorization decisions rely on case-sensitive user strings, the tuple, changelog, and authorization_model identifier columns can compare...
Updated Jul 15, 2026
CVE-2026-57019 in Junos OS
An Improper Validation of Specified Quantity in Input vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS on MX Series allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS). When a specific packet is received from device...
Updated Jul 15, 2026
CVE-2026-57023 in Junos OS
An Improper Validation of Specified Quantity in Input vulnerability in the TCP proxy plugin of Juniper Networks Junos OS on MX Series with SPC3, and SRX Series allows an unauthenticated, network-based attacker to cause a complete Denial of Service (DoS). When TCP proxy is...
Updated Jul 15, 2026
CVE-2026-57026 in Junos OS
An Improper Validation of Syntactic Correctness of Input vulnerability in the SIP plugin of Juniper Networks Junos OS on MX Series with SPC3 and SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).If the SIP ALG is enabled on an...
Updated Jul 15, 2026
CVE-2026-55452 in Snipe-IT
Snipe-IT is an IT asset/license management system. Prior to 8.5.0, Actionlog::logaction() stores the request User-Agent header and ReportsController::postActivityReport() writes that value to the Activity Report CSV without formula escaping, allowing a low-privileged...
Updated Jul 15, 2026
CVE-2026-57156 in FreeRDP
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0 on 32-bit builds, FreeRDP clients contain an integer overflow in update_read_delta_points in libfreerdp/core/orders.c when multiplying an attacker-controlled point count by sizeof(DELTA_POINT),...
Updated Jul 15, 2026
CVE-2026-49844 in Apache Log4j API
Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0. The fix for CVE-2026-34481 did not...
Updated Jul 15, 2026
CVE-2026-52747 in ModSecurity
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 3.0.16, the multipart/form-data request body parser in libmodsecurity silently removes embedded line breaks from non-file form-field values before exporting...
Updated Jul 15, 2026
CVE-2026-52761 in ModSecurity
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 through 3.0.15, the t:utf8toUnicode transformation in src/actions/transformations/utf8_to_unicode.cc produces wrong output on i386...
Updated Jul 15, 2026
CVE-2026-45756 in Symfony JSON Path
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 7.3.0-BETA1 until 7.4.12 and 8.0.12, the JsonPath component compiles attacker-controlled match() and search() filter patterns directly into preg_match()...
Updated Jul 15, 2026
CVE-2026-45064 in Symfony HTML Sanitizer
Symfony HTML Sanitizer can leave visual-spoofing BiDi characters in sanitized URLs.
Updated Jul 15, 2026
CVE-2026-45070 in Symfony MIME
Symfony MIME can allow email header injection through unsafe MIME parameter names.
Updated Jul 15, 2026
CVE-2026-45133 in Symfony YAML
Symfony YAML can crash a worker when it parses very deeply nested YAML input.
Updated Jul 15, 2026
CVE-2026-45304 in Symfony YAML
Symfony YAML can use too much memory when crafted aliases expand recursively.
Updated Jul 15, 2026
CVE-2026-45305 in Symfony YAML
Symfony YAML can hang on crafted YAML because of slow regex backtracking.
Updated Jul 15, 2026
CVE-2026-45071 in Symfony DomCrawler
Symfony DomCrawler can read local files when it parses attacker-controlled XML content.
Updated Jul 15, 2026
CVE-2026-48358 in Adobe Commerce
Adobe Commerce has an output escaping issue that can lead to code execution without user interaction.
Updated Jul 15, 2026
CVE-2026-48760 in Symfony HTML Sanitizer
Symfony HTML Sanitizer can leave encoded visual-spoofing characters in URLs after sanitizing them.
Updated Jul 15, 2026
CVE-2026-48761 in Symfony HTML Sanitizer
Symfony HTML Sanitizer can miss URL attributes in allowed HTML and let unsafe URLs pass through.
Updated Jul 15, 2026
CVE-2026-48784 in Symfony Routing
Symfony Routing can generate a URL that collapses to a different path when dot segments are normalized.
Updated Jul 15, 2026
CVE-2026-45065 in Symfony Routing
Symfony Routing can accept a route value that should fail validation, which can create an off-site redirect-style URL.
Updated Jul 15, 2026
CVE-2026-45066 in Symfony HTML Sanitizer
Symfony HTML Sanitizer can bypass allowed link or media host rules because some URLs are parsed differently than expected.
Updated Jul 15, 2026
CVE-2026-45753 in Symfony HTML Sanitizer
Symfony HTML Sanitizer can miss JavaScript URLs in some attributes, which can allow cross-site scripting in sanitized HTML.
Updated Jul 15, 2026
CVE-2026-45755 in Symfony Mailtrap Mailer
Symfony Mailtrap Mailer does not verify the Mailtrap webhook signature, so a remote attacker can send fake webhook events.
Updated Jul 15, 2026
CVE-2026-47767 in Symfony Runtime
Symfony Runtime can still let a crafted web request change APP_ENV or APP_DEBUG on affected patched versions, bypassing an earlier fix.
Updated Jul 15, 2026
CVE-2026-45068 in Symfony Mailer
Symfony Mailer can pass a dash-prefixed recipient address to SendmailTransport in an unsafe way, which can let an attacker inject sendmail arguments.
Updated Jul 15, 2026
CVE-2026-6682 in FatFs
In FatFS R0.16 and earlier contains a FAT32 integer overflow bug in mount_volume() where fasize *= fs->n_fats can wrap, leading to attacker-controlled file-size metadata and unsafe read lengths in downstream callers. This maps to CWE-190 (Integer Overflow or Wraparound). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (7.6, High). Remote delivery is also possible in OTA/update pipelines. The estimated CISA SSVC vectors are Exploitation: PoC, Technical Impact: Total.
Updated Jul 15, 2026
CVE-2026-6685 in FatFs
FatFs R0.16 and earlier exhibits a stale dirty-cache skip via unsigned-subtraction wrap in f_read() / f_write() (fp->sect - sect < cc) during interleaved read/write on fragmented filesystems. This maps to CWE-191 (Integer Underflow). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H (6.1, Medium). The estimated CISA SSVC vectors are Exploitation: PoC, Technical Impact: Total.
Updated Jul 15, 2026