CWE-1289: Improper Validation of Unsafe Equivalence in Input
The product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value.
A kind of CWE-20 Improper Input Validation.
From the CWE List. © The MITRE Corporation.
Newest
- octopus deploy server In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently... 8.7 High
- edgelesssys contrast Contrast 1.21.0 before 1.25.0 Credential Leak via imagepuller Wildcard Registry Selection 2.1 Low
- webpack-dev-server webpack-dev-server vulnerable to information disclosure via Host validation bypass in the open-editor endpoint 5.3 Medium
- pydantic ai, pydantic-ai, pydantic-ai-slim +2 more Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifier (incomplete fix for CVE-2026-46678 and CVE-2026-48782) 6.8 Medium
- pydantic ai, pydantic-ai, pydantic-ai-slim +2 more Pydantic AI: web_fetch_tool blocked_domains bypass via a hostname the resolver normalizes differently 3.7 Low
- octopus deploy server In affected versions of Octopus Server, an authenticated user with permission to modify roles... 8.7 High
- handlebars-lang handlebars.js Handlebars: JavaScript Injection via Own Property Check Bypass 9.2 Critical
- zilliz attu The Playground feature of Zilliz Attu before 3.0.0 allows SSRF (proxying of requests to private... 4.0 Medium
- jetbrains teamcity In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was... 8.1 High
- liquid web / stellarwp givewp WordPress GiveWP plugin <= 4.16.9 - Broken Authentication vulnerability 9.1 Critical
- trusted domain project opendmarc Trusted Domain Project OpenDMARC policy.c improper validation of unsafe equivalence in input 6.9 Medium
- aws aws-network-policy-agent, amazon-vpc-cni-k8s +1 more Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS 8.7 High
- zenhive mpp mpp Tempo keys its pre-broadcast dedup reserve on the caller-supplied transaction encoding, so a re-encoded signed transaction reserves a second slot 6.3 Medium
- aws amazon ssm agent Server-side request forgery in the Session Manager port forwarding functionality in AWS Systems Manager Agent 8.5 High
- sap se sapui5(frame options allowlist) Clickjacking vulnerability in SAPUI5(Frame Options Allowlist) 4.3 Medium
- erlang otp inets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_auth 6.0 Medium
-
perlAlmaLinux,liburi-perlDebian,perl-Algorithm-DiffAlmaLinux +181 more +183 more URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep 6.5 Medium -
libdate-manip-perlDebian,perl-Date-ManipAzure Linux +1 more Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check 7.5 High - edgelesssys contrast Edgeless Systems Contrast through 1.20.0 Credential Leak via Registry Suffix Matching 6.3 Medium
- aqara cloud oauth authorization endpoint Aqara OAuth redirect_uri validation bypass 9.3 Critical
- squid-cache squid Squid: Memory disclosure in FTP gateway 6.5 Medium
- rrwo net::cidr::set, net\ +1 more Net::CIDR::Set versions through 0.20 for Perl did not validate network masks 7.3 High
- rrwo net::cidr::set, net\ +1 more Net::CIDR::Set versions through 0.20 for Perl accept non-ASCII IP addresses and netmasks 6.5 Medium
- symfony polyfill, polyfill-intl-idn +1 more symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload decodes to ASCII-only: insecure equivalence 6.9 Medium
- hono Hono: IP Restriction bypasses static deny rules for non-canonical IPv6 5.3 Medium
- @fedify fedify Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring 7.0 High
- encode starlette, red hat exploit intelligence, openshift lightspeed +18 more +20 more Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks 6.5 Medium
- stigtsp net::cidr::lite Net::CIDR::Lite versions before 0.24 for Perl does not properly consider extraneous zero characters in CIDR mask values, which may allow IP ACL bypass 6.5 Medium
- stigtsp net::cidr::lite Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass 6.5 Medium
-
webauthn-authenticator-rscrates.io,webauthn-rs-corecrates.io +1 more webauthn-rs-core/webauthn-authenticator-rs: Origin validation mismatch possible when subdomains are allowed 2.3 Low - node-oauth node-oauth2-server, node-oauth\/oauth2-server +1 more @node-oauth/oauth2-server: PKCE code_verifier ABNF not enforced in token exchange allows brute-force redemption of intercepted authorization codes 5.9 Medium
- axios, red hat cluster observability operator 1.5.0, cryostat 4 +60 more +62 more Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF 6.3 Medium
- dunglas mercure Mercure has a Topic Selector Cache Key Collision 7.1 High
- go standard library crypto/x509, golang go, red hat assisted installer for red hat openshift container platform 2 +103 more +105 more Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509 8.2 High
- flatpak xdg-dbus-proxy xdg-dbus-proxy has an eavesdrop filter bypass allowing message interception 6.8 Medium
- nearform fast-jwt fast-jwt Affected by Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup) 9.1 Critical
- zscaler client connector Incorrect startup configuration in ZCC 5.4 Medium
- openfga OpenFGA has an Authorization Bypass through cached keys 5.8 Medium
- squid-cache squid Squid has issues in ICP message handling 6.9 Medium
- ory oathkeeper Ory Oathkeeper has an authentication bypass by cache key confusion 8.1 High
- devolutions powershell universal Improper input validation in the apps and endpoints configuration in PowerShell Universal before... 5.5 Medium
- parseplatform parse dashboard, parse-community parse-dashboard +1 more Parse Dashboard Has a Cache Key Collision that Leaks Master Key to Read-Only Sessions 7.0 High
- gitlab Improper Validation of Unsafe Equivalence in Input in GitLab 4.6 Medium
- @clerk fastify, red hat enterprise linux ai (rhel ai) 3, openshift ai (rhoai) +1 more +3 more fastify vulnerable to Body Schema Validation Bypass via Leading Space in Content-Type Header 7.5 High
- servo idna, rust-url +1 more idna accepts Punycode labels that do not produce any non-ASCII when decoded 5.1 Medium
- c-mor video surveillance, za-internet c-mor video surveillance +1 more An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01. Due to... 7.2 High
- hedgedoc MySQL & free URL mode allows to hide existing notes in hedgedoc 6.5 Medium
- 1password 1Password 8 before 8.10.36 for macOS allows local attackers to exfiltrate vault items because XPC... 7.8 High
- 1password 1Password 8 before 8.10.38 for macOS allows local attackers to exfiltrate vault items by... 4.7 Medium
- puppet firewall, firewall module +1 more Puppet Firewall Module May Leave Unmanaged Rules 5.6 Medium
- Show olderLoading…