Base de CVEs

CVE-2026-27953 Crítica · 9.8 CWE-20 19/03/2026

ormar: bypass de validação Pydantic via injeção de kwargs no construtor de modelo

ormar é um mini ORM assíncrono para Python. As versões 0.23.0 e anteriores são vulneráveis a bypass da validação Pydantic por meio do construtor de modelos, permitindo que qualquer usuário não autenticado ignore toda a validação de campos ao injetar __pk_only__ com valor true em um corpo de requisição JSON. Ao injetar __pk_only__ com valor true em um corpo de requisição JSON, um atacante não autenticado pode ignorar toda a validação de campos e persistir dados não validados diretamente no banco de dados. Uma injeção secundária do parâmetro __excluded__ usa o mesmo padrão para anular seletivamente campos arbitrários do modelo (por exemplo, email ou role) durante a construção. Isso afeta o padrão canônico de integração com FastAPI recomendado na documentação oficial do ormar, possibilitando escalada de privilégios, violações de integridade de dados e bypass de lógica de negócio em qualquer aplicação que use ormar.Model diretamente como parâmetro de corpo de requisição. Este problema foi corrigido na versão 0.23.1.

CVE-2026-32735 Baixa · 2.3 CWE-20 18/03/2026

Unpacking Arbitrary Mustache Template Files via `maven-dependency-plugin`

openapi-to-java-records-mustache-templates allows users to generate Java Records from OpenAPI specifications. Starting in version 5.1.1 and prior to version 5.5.1, the parent POM file of this project (`openapi-to-java-records-mustache-templates-parent`), which is used to centralize plugin configurations for multiple unit-test modules, uses `maven-dependency-plugin` to unpack arbitrary `.mustache` files from the `openapi-to-java-records-mustache-templates` artifact (of the same version). While this parent POM file is not intended for external use, it is published, and could be used by anyone, and does not follow the best security practices. The risk, is that if `openapi-to-java-records-mustache-templates` would be compromised, and malicious `.mustache` files were to be included in the resulting JAR/artifact, users would unpack these files automatically during a dependency update. This is addressed in the v3.5.1 release of `openapi-to-java-records-mustache-templates-parent`. It is strongly recommended NOT to use the parent POM for external use. The `openapi-to-java-records-mustache-templates` module is the center of this project, and surrounding modules and configurations are not intended for production-use. These only exist for testing purposes and maintainability.

CVE-2026-4407 Baixa · 2.1 CWE-20 18/03/2026

Out-of-bounds array write in Xpdf 4.06 due to missing validation

Out-of-bounds array write in Xpdf 4.06 and earlier, due to incorrect validation of the "N" field in ICCBased color spaces.

CVE-2026-20643 Média · 5.4 CWE-20 17/03/2026

Improper Input Validation em Apple Ipados

A cross-origin issue in the Navigation API was addressed with improved input validation. This issue is fixed in Background Security Improvements for iOS, iPadOS, and macOS, Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. Processing maliciously crafted web content may bypass Same Origin Policy.

CVE-2025-31966 Baixa · 2.7 CWE-20 17/03/2026

Boolean-Based SQL Injection in Multiple Unica Components

HCL Sametime is vulnerable to broken server-side validation. While the application performs client-side input checks, these are not enforced by the web server. An attacker can bypass these restrictions by sending manipulated HTTP requests directly to the server.

CVE-2026-3644 Alta · 7.5 CWE-20 16/03/2026

Incomplete control character validation in http.cookies

The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().

CVE-2026-23489 Crítica · 9.1 CWE-20 16/03/2026

Plugin Fields do GLPI vulnerável a RCE na geração de dropdowns

Fields é um plugin do GLPI que permite aos usuários adicionar campos personalizados em formulários de itens do GLPI. Antes da versão 1.23.3, é possível executar código PHP arbitrário a partir de usuários que têm permissão para criar dropdowns. Este problema foi corrigido na versão 1.23.3.

CVE-2025-6969 Média · 5.5 CWE-20 16/03/2026

ability_ability_runtime an improper input validation vulnerability

in OpenHarmony v5.1.0 and prior versions allow a local attacker cause DOS through improper input.

CVE-2025-26474 Baixa · 3.3 CWE-20 16/03/2026

communication_ipc an improper input validation vulnerability

in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information improper input. This vulnerability can be exploited only in restricted scenarios.

CVE-2025-10461 Média · 5.3 CWE-20 16/03/2026

Global file reads caused by improper URL checks in webserver

Global file reads caused by improper URL checks in webserver in Softing Industrial Automation GmbH smartLinks on docker (filesystem modules) allows file access. This issue affects smartLink SW-HT: through 1.42 smartLink SW-PN: through 1.03.

CVE-2026-22204 Média · 5.3 CWE-20 13/03/2026

wpDiscuz before 7.6.47 - Unsanitized Cookie Email Used as wp_mail() Recipient

wpDiscuz before 7.6.47 contains an email header injection vulnerability that allows attackers to manipulate mail recipients by injecting malicious data into the comment_author_email cookie. Attackers can craft a malicious cookie value that, when processed through urldecode() and passed to wp_mail() functions, enables header injection to alter email recipients or inject additional headers.

CVE-2025-60012 Média · 6.3 CWE-20 13/03/2026

Apache Livy: Restrict file access

Malicious configuration can lead to unauthorized file access in Apache Livy. This issue affects Apache Livy 0.7.0 and 0.8.0 when connecting to Apache Spark 3.1 or later. A request that includes a Spark configuration value supported from Apache Spark version 3.1 can lead to users gaining access to files they do not have permissions to. For the vulnerability to be exploitable, the user needs to have access to Apache Livy's REST or JDBC interface and be able to send requests with arbitrary Spark configuration values. Users are recommended to upgrade to version 0.9.0 or later, which fixes the issue.

CVE-2025-13462 Baixa · 3.3 CWE-20 12/03/2026

tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling

The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations.

CVE-2026-3967 Média · 6.3 CWE-20 11/03/2026

Alfresco Activiti Process Variable Serialization System SerializableType.java createObjectInputStream deserialization

A flaw has been found in Alfresco Activiti up to 7.19/8.8.0. Affected by this issue is the function deserialize/createObjectInputStream of the file activiti-core/activiti-engine/src/main/java/org/activiti/engine/impl/variable/SerializableType.java of the component Process Variable Serialization System. This manipulation causes deserialization. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-31900 Crítica · 9.8 CWE-20 11/03/2026

Black's vulnerable version parsing leads to RCE in GitHub Action

Black is the uncompromising Python code formatter. Black provides a GitHub action for formatting code. This action supports an option, use_pyproject: true, for reading the version of Black to use from the repository pyproject.toml. A malicious pull request could edit pyproject.toml to use a direct URL reference to a malicious repository. This could lead to arbitrary code execution in the context of the GitHub Action. Attackers could then gain access to secrets or permissions available in the context of the action. Version 26.3.0 fixes this vulnerability.

CVE-2026-30901 Alta · 7.8 CWE-20 11/03/2026

Zoom Rooms for Windows - Improper Input Validation

Improper Input Validation in Zoom Rooms for Windows before 6.6.5 in Kiosk Mode may allow an authenticated user to conduct an escalation of privilege via local access.

CVE-2026-21310 Média · 5.3 CWE-20 11/03/2026

Adobe Commerce | Improper Input Validation (CWE-20)

Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Improper Input Validation vulnerability that could result in a security feature bypass, with limited impact to integrity. Exploitation of this issue does not require user interaction.

CVE-2026-21282 Média · 5.3 CWE-20 11/03/2026

Adobe Commerce | Improper Input Validation (CWE-20)

Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Improper Input Validation vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability by providing specially crafted input, causing limited impact to application availability. Exploitation of this issue does not require user interaction.

CVE-2025-20105 Alta · 8.7 CWE-20 10/03/2026

Improper input validation in some UEFI firmware SMM module for the Intel(R) reference…

Improper input validation in some UEFI firmware SMM module for the Intel(R) reference platforms may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable local code execution. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (high) impacts.

CVE-2025-20096 Média · 5.9 CWE-20 10/03/2026

Improper input validation in the UEFI firmware for some Intel Reference Platforms may…

Improper input validation in the UEFI firmware for some Intel Reference Platforms may allow an escalation of privilege. System software adversary with a privileged user combined with a high complexity attack may enable data manipulation. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (none), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (high) and availability (high) impacts.

CVE-2025-20068 Alta · 7.1 CWE-20 10/03/2026

Improper input validation in the UEFI ImcErrorHandler module for some Intel(R) reference…

Improper input validation in the UEFI ImcErrorHandler module for some Intel(R) reference platforms may allow an escalation of privilege. System software adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

CVE-2025-20064 Alta · 8.7 CWE-20 10/03/2026

Improper input validation in the UEFI FlashUcAcmSmm module for some Intel(R) reference…

Improper input validation in the UEFI FlashUcAcmSmm module for some Intel(R) reference platforms may allow an escalation of privilege. System software adversary with a privileged user combined with a high complexity attack may enable local code execution. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (high) impacts.

CVE-2025-20027 Alta · 7.1 CWE-20 10/03/2026

Improper input validation in the UEFI WheaERST module for some Intel(R) reference…

Improper input validation in the UEFI WheaERST module for some Intel(R) reference platforms may allow an escalation of privilege. System software adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

CVE-2025-36920 Alta · 8.4 CWE-20 10/03/2026

Improper Input Validation em Google Android

In hyp_alloc of arch/arm64/kvm/hyp/nvhe/alloc.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-26310 Alta · 7.5 CWE-20 10/03/2026

Crash for scoped ip address in Envoy during DNS

Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, calling Utility::getAddressWithPort with a scoped IPv6 addresses causes a crash. This utility is called in the data plane from the original_src filter and the dns filter. This vulnerability is fixed in 1.37.1, 1.36.5, 1.35.8, and 1.34.13.