CWE-1287 Improper Validation of Specified Type of Input

fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array

PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats

Duplicate Advisory: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions

Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value

Keylime registrar is vulnerable to Denial-of-Service attack when updated to version 7.12.0

jsrsasign is vulnerable to DoS through Infinite Loop when processing zero or negative inputs

Microsoft Security Advisory CVE-2026-50524 – .NET Denial of Service Vulnerability

vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels

YesWiki: SQL injection via the `recentchanges` action `period` argument leads to arbitrary DB read

Keycloak: Unauthorized access via improper validation of encrypted SAML assertions

Mattermost doesn't validate user-supplied input in API request handlers

Concrete CMS: OAuth 2.0 Authorization-Code Handler Bypasses Account Status

Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection

Symfony's OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims

Fastify has a Body Schema Validation Bypass via Leading Space in Content-Type Header

TSPortal: Any user can forge self-deletion requests for any account

Mattermost fails to properly validate User-Agent header tokens

Insufficient type validation in pocketmine/pocketmine-mp

Mattermost fails to check Websocket request for proper UTF-8 format potentially crashing Calls plug-in

Mattermost GitHub Plugin Bot Identity Validation Bypass Allows Arbitrary GitHub Reaction Injection

Free5GC is vulnerable to DoS via the Nudm_SubscriberDataManagement API

Jenkins Git Parameter Plugin vulnerable to code injection due to inexhaustive parameter check

Synapse's invalid device keys degrade federation functionality

Mattermost Confluence Plugin has Improper Validation of Specified Type of Input

Fastify vulnerable to invalid content-type parsing, which could lead to validation bypass