CWE-20 Improper Input Validation

Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution

kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path

Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)

Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)

Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations

pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination

Hazelcast allows arbitrary member memory access by low-privileged client

Banks: User-controlled prompt input can be parsed as privileged chat messages

fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set

PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface

Duplicate Advisory: PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface

Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection

Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules

Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection

Excelize: GetStyle panics on a negative fillId, borderId or fontId in styles.xml

WeasyPrint: EPS images reach the Ghostscript interpreter resulting in RCE

Backstage: Improper entity validation in deprecated Kubernetes services endpoint

Backstage: Improper input validation in proxy-backend

Coraza: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling

Apache CXF has JNDI Injection Vulnerability in JMSConfigFactory

PyMongo: PYTHON-5990 Forced Unix domain socket connection via a .sock KMS endpoint in client-side field level encryption

Socket.IO: Prototype Pollution via Unsafe Client Session Lookup

vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features

vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites)

vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service