CVE-2026-4773
Improper validation of specified type of input vulnerability in Magarsus Consulting Ltd. Co. IDM-MFA allows Authentication Bypass. This iss
CVSS
8.1
High
EPSS
0.3%
p24
KEV
—
Exploit Today
7
0-100
Published: Jul 22, 2026 · Last modified: Jul 22, 2026 · CWE-1287
0.3%EPSS · 30 days0.5%
2026-07-232026-07-27
Improper validation of specified type of input vulnerability in Magarsus Consulting Ltd. Co. IDM-MFA allows Authentication Bypass. This issue affects IDM-MFA: from 2025.11.27 before 2026.03.10.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-505247.5 HIG46.7%
——14Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to deny service over a network.6dCVE-2026-450699.1 CRI14.8%
——4Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, OidcTokenHandler::verifyClaims() registered audience (aud), issuer (iss), and expiry (exp) checkers but did not pass the mandatory claims list to ClaimCheckerManager::check(), so a validly signed JWT that omitted those claims could pass verification. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.14dCVE-2026-551245.5 MED30.8%
——9Improper validation of specified type of input in Microsoft Office Word allows an unauthorized attacker to disclose information locally.13dCVE-2026-449359.9 CRI33.8%
——10Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 could be used by owners of one tenant to access fleet credentials of other tenants.23dCVE-2026-442498.1 HIG43.9%
——13Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions. Versions 4.1.135.Final and 4.2.15.Final patch the issue.6dCVE-2026-97538.1 HIG22.0%
——7The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed binary diff to return memory out-of-bounds or crash the server. $_internalApplyOplogUpdate can be executed by any authenticated user with access to the aggregate command.6d