CVE WatchAug 6, 2026

CVE-2024-6541

The Class Mediator fails to correctly validate or sanitize `messageContext` properties when they are used to populate dynamic values. This a

CVSS

6.8

Medium

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Aug 6, 2026 · Last modified: Aug 6, 2026 · CWE-20

EPSS · 30d

Not enough EPSS history yet.

Technical description

The Class Mediator fails to correctly validate or sanitize `messageContext` properties when they are used to populate dynamic values. This allows authenticated users to potentially access or modify data across different system invocations that should be isolated. This weakness can lead to the disclosure of sensitive information belonging to other users or the unintended modification of system data by authenticated users. The exact impact depends on how `messageContext` properties are utilized within the affected WSO2 products.

Official references

security.docs.wso2.comhttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3520/

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-19177—

—

———Insufficient validation of untrusted input in UI in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)3h CVE-2026-19169—

—

———Insufficient validation of untrusted input in Contextual Tasks in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: High)3h CVE-2026-19164—

—

———Insufficient validation of untrusted input in Codecs in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)3h CVE-2026-19153—

—

———Insufficient validation of untrusted input in Workers in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)3h CVE-2026-19143—

—

———Insufficient validation of untrusted input in WebAPKs in Google Chrome on Android prior to 151.0.7922.109 allowed a local attacker to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)3h CVE-2026-163164.3 MED

—

———OMICRON StationGuard 4.00 contains an improper input validation vulnerability in its IEC 61850 Sampled Values (SV) frame processing. A specially crafted SV frame can cause the affected process to terminate, disrupting alert processing for Sampled Values traffic. The vulnerability does not affect overall system availability or the processing of other traffic types, and the process is automatically restarted, and the failure is immediately reported to the user.9h