CWE-1287: Improper Validation of Specified Type of Input
The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.
A kind of CWE-20 Improper Input Validation.
From the CWE List. © The MITRE Corporation.
Newest
- No product listed RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting "tz" to tzset(), , so a FIFO or device path blocks the CGI process No score
- apache software foundation kafka Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured 9.1 Critical
- openstack ironic OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete... 5.4 Medium
- flarum framework Laravel TokenGuard authentication bypass through non-string API credentials 9.2 Critical
- gitpython-developers gitpython GitPython before 3.2.0 Command Execution via ls_remote ext:: URLs 7.7 High
- microsoft .net framework 3.5, .net framework 3.5 and 4.6.2/4.7/4.7.1/4.7.2, .net framework 3.5 and 4.7.2 +5 more +7 more .NET Framework Tampering Vulnerability 7.5 High
- microsoft sharepoint server subscription edition, sharepoint server +1 more Microsoft Office SharePoint Elevation of Privilege Vulnerability 8.8 High
- dell secure connect gateway (scg) policy manager, policy manager for secure connect gateway +1 more Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an... 3.1 Low
- nearform fast-jwt fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array 8.1 High
- bytecodealliance wasmtime Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via Tag Imports 5.9 Medium
- eclipse foundation threadx netx duo ICMPv6 option validation accepts a trailing byte residue, sending the Router Advertisement, Neighbor Solicitation, Neighbor Advertisement and Redirect option walkers past the packet or into a permanen… 7.1 High
- sgl-project sglang CVE-2026-94570 5.9 Medium
- mattermost, mattermost desktop +1 more Mattermost Desktop App plugin popout scheme validation bypass 2.6 Low
- siemens wtv676-hb6035 web interface, wtv776-hb6035 web interface +1 more A vulnerability has been identified in WTV676-HB6035 Web Interface (All versions < V3.94), WTV776... 6.9 Medium
- openwebui open webui, open-webui +1 more Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value 4.3 Medium
- No product listed Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths 7.5 High
- suse yast2-users yast2-users: OS command injection via LDAP-supplied shadowLastChange/shadowExpire attribute 8.6 High
- ash-project ash Ash.Type.Union with :map_with_tag does not force the tag on dump, enabling tag confusion 2.1 Low
- graph-gophers graphql-go github.com/graphql-go/graphql (GraphQL for Go) through 0.8.1 does not validate that a scalar... 5.9 Medium
- red hat openshift container platform 4 Cri-o: cri-o: unvalidated image env var causes daemon crash 6.0 Medium
- axis communications ab os An ACAP configuration file lacks input validation, which could potentially lead to privilege... 5.7 Medium
- aws amazon bedrock agentcore harness Insufficient input validation in Amazon Bedrock AgentCore harness InvokeHarness API 8.6 High
- timlegge xml::sig, xml\ \ +1 more XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup 9.1 Critical
- mediatek mt6991 firmware, mt8768 firmware, mt8791t firmware +8 more +10 more In geniezone, there is a possible escalation of privilege due to a missing permission check. This... 6.0 Medium
- magarsus consulting ltd. co. idm-mfa OTP Bypass in Magarsus' IDM-MFA 8.1 High
- microsoft word, 365 apps, 365 apps for enterprise +15 more +17 more Microsoft Word Information Disclosure Vulnerability 5.5 Medium
- mervinpraison praisonai PraisonAI before 4.6.78 Prompt Injection Defense Bypass 8.7 High
- yeswiki YesWiki: SQL injection via the `recentchanges` action `period` argument leading to arbitrary DB read 6.5 Medium
- suse rancher, rancher fleet +1 more Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer 9.9 Critical
- microsoft .net, .net 10.0 runtime, .net 8.0 runtime +6 more +8 more .NET Framework Denial of Service Vulnerability 7.5 High
- vllm vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels 6.9 Medium
- moxa nport 6000-g2 series Improper JSON Input Validation in WebSocket API Leads to Denial of Service 7.1 High
- mongodb server, mongodb, mongodb, inc. mongodb server +2 more Server crash via malformed binary diff passed to $_internalApplyOplogUpdate. 7.2 High
- mongodb server, mongodb, mongodb, inc. mongodb server +2 more Authenticate command with specific mechanism parameter can trigger server crash 8.2 High
- boost serialization Boost Serialization improper validation of specified type of input 6.3 Medium
- arista networks eos In Arista’s EOS when in 802.1X mode, multi-auth unauthenticated hosts might be allowed access to a switch port if there exists an EAPOL capable device in the fallback VLAN. 6.5 Medium
- rrwo net::cidr::set, net\ +1 more Net::CIDR::Set versions through 0.20 for Perl did not validate IP addresses 7.5 High
- hono Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection 4.3 Medium
- sensiolabs symfony, symfony security-http +1 more Symfony: OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims 8.8 High
- helmholz rex100, rex200/250, mb connect line mbnet.mini +1 more +3 more Command injection via USB 8.4 High
- fraillt bitsery fraillt bitsery std_smart_ptr.h loadFromSharedState improper validation of specified type of input 6.3 Medium
- mattermost, mattermost server +1 more Insufficient input validation in GitHub plugin API causes denial of service 4.3 Medium
- concrete cms cms, concretecms concrete cms +1 more For Concrete CMS 9.5.0 and below, OAuth 2.0 Authorization-Code Handler Bypasses Account Status 2.3 Low
- isc bind, bind 9, red hat enterprise linux 10 +9 more +11 more Invalid handling of CLASS != IN 7.5 High
- axis os An ACAP configuration file lacked sufficient input validation, which could allow command... 6.0 Medium
- xiangshan nemu NEMU (OpenXiangShan/NEMU) before v2025.12.r2 contains an improper instruction-validation flaw in... 7.5 High
- kjur jsrsasign, red hat migration toolkit for virtualization 2.1, migration toolkit for virtualization 2.9 +5 more +7 more jsrsasign is vulnerable to DoS through Infinite Loop when processing zero or negative inputs 8.7 High
- nsasoft spotauditor SpotAuditor 5.2.6 Name Field Denial of Service 6.9 Medium
- red hat build of keycloak 26.2, build of keycloak 26.2.14, build of keycloak 26.4 +7 more +9 more Keycloak-services: keycloak: unauthorized access via improper validation of encrypted saml assertions 7.7 High
- mattermost, mattermost server +1 more DoS in Calls plugin via malformed msgpack in websocket request. 5.8 Medium
- Show olderLoading…