CWE-184: Incomplete List of Disallowed Inputs
The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.
Also known as Denylist / Deny List, Blocklist / Block List, Blacklist / Black List.
A kind of CWE-693 Protection Mechanism Failure.
From the CWE List. © The MITRE Corporation.
Newest
- openclawOpenClaw < 2026.2.23 - Exec Approval Bypass via Unrecognized Multiplexer Shell Wrappers7.1 High
- openclawOpenClaw < 2026.2.22 - Allowlist Parsing Mismatch in system.run Shell Chains5.6 Medium
- openclawOpenClaw 2026.2.22-2 < 2026.2.23 - Allowlist Bypass via sort Long-Option Abbreviation in tools.exec.safeBins8.7 High
- openclawOpenClaw is vulnerable to validation bypass through GNU long-option abbreviations in allowlist mode9.9 Critical
ficklingPyPIFickling has safety check bypass via REDUCE+BUILD opcode sequence5.3 Medium- hitachi energy rtu500 series cmu firmware, hitachienergy rtu520 firmware, rtu530 firmware +2 more +4 moreIEC 60870-5-104: Potential Denial of Service impact on reception of invalid U-format frame....8.7 High
ficklingPyPIFickling has a detection bypass via stdlib network-protocol constructors2.3 Low- openclawOpenClaw < 2026.2.19 - safeBins stdin-only bypass via sort output and recursive grep flags2.0 Low
- mmaitre314 picklescanpicklescan - Scanning Bypass via Dynamic Eval in scan_pytorch7.1 High
- frangoteam fuxaFUXA has a Path Traversal Sanitization Bypass8.6 High
- trailofbits ficklingFickling has Static Analysis Bypass via Incomplete Dangerous Module Blocklist8.9 High
- trailofbits ficklingFickling vulnerable to use of ctypes and pydoc gadget chain to bypass detection8.9 High
- trailofbits ficklingFickling Blocklist Bypass: cProfile.run()8.9 High
- trailofbits ficklingFickling has a bypass via runpy.run_path() and runpy.run_module()8.9 High
- libsodiumlibsodium has Incomplete List of Disallowed Inputs4.5 Medium
- mmaitre314 picklescanpicklescan - Remote Code Execution via Incomplete Disallowed Inputs9.3 Critical
- mmaitre314 picklescanpicklescan - Remote Code Execution via Unblocked ctypes Module9.3 Critical
- trailofbits ficklingFickling has Code Injection vulnerability via pty.spawn()7.1 High
- trailofbits ficklingFickling has missing detection for marshal.loads and types.FunctionType in unsafe modules list7.1 High
- auth0 nextjs-auth0Auth0 Next.js SDK has Improper Validation of Query Parameters5.7 Medium
- prestashop checkout, prestashopcorp ps checkout +1 morePrestaShop Checkout Target PayPal merchant account hijacking from backoffice3.8 Low
- microsoft windowsThe on-endpoint Microsoft vulnerable driver blocklist is not fully synchronized with the online...7.4 High
- marcelotessaro promptcraft-forge-studioPromptcraft Forge Studio's incomplete URL check is vulnerable to XSS via SVG9.3 Critical
- marcelotessaro promptcraft-forge-studioPromptcraft Forge Studio: Complete Sanitizer Bypass Enables XSS via Overlapping Patterns8.2 High
- wwbn avideoAn incomplete blacklist exists in the .htaccess sample of WWBN AVideo 14.4 and dev master commit...7.3 High
- otrs ag ((otrs)) community edition, otrs +1 moreUnsafe handling of AJAX calls3.8 Low
- hitachi energy asset suiteA vulnerability exists in the media upload component of the Asset Suite versions listed below....6.3 Medium
- microsoft onenote, office, 365 apps for enterprise +7 more +9 moreMicrosoft OneNote Security Feature Bypass Vulnerability7.8 High
- mmaitre314 picklescanpicklescan - Remote Code Execution via timeit.timeit() Detection Bypass7.6 High
- mmaitre314 picklescanPicklescan - Arbitrary Code Execution via Unsafe Numpy Function Detection Bypass7.6 High
- mmaitre314 picklescanPicklescan Vulnerable to Exfiltration via DNS via linecache and ssl.get_server_certificate6.8 Medium
- mmaitre314 picklescanpicklescan - Security scanning bypass via non-standard file extensions5.3 Medium
- mmaitre314 picklescanpicklescan - Security scanning bypass via 'pip main'5.3 Medium
- wintercms winterWinter CMS Modules allows a sandbox bypass in Twig templates leading to data modification and deletion8.5 High
- fedora-python lxml html cleanHTML Cleaner allows crafted scripts in special contexts like svg or math to pass through7.7 High
- bytecodealliance wasmtimeWasmtime doesn't fully sandbox all the Windows device filenames2.3 Low
- ankitects ankiAnkitects Anki LaTeX Blocklist Bypass vulnerability3.1 Low
- servicenow now platform, servicenow, servicenow utah, vancouver, and washington dc now platform +2 moreIncomplete Input Validation in GlideExpression Script9.2 Critical
- servicenow now platformIncomplete Input Validation in SecurelyAccess API6.9 Medium
- microsoft outlook, 365 apps, 365 apps for enterprise +5 more +7 moreMicrosoft Outlook Remote Code Execution Vulnerability8.8 High
- mybbIncomplete disallowed remote addresses list in MyBB5.0 Medium
- cisco ios xe software, ios xe +1 moreA vulnerability in the NETCONF feature of Cisco IOS XE Software could allow an authenticated,...6.5 Medium
- katexKaTeX is missing normalization of the protocol in URLs allows bypassing forbidden protocols5.5 Medium
- ailux imx6, imx6 bundle +1 moreA CWE-693 “Protection Mechanism Failure” vulnerability in the embedded Chromium browser ...6.8 Medium
- babel, babeljs babel-plugin-polyfill-corejs2, babel-plugin-polyfill-corejs3 +6 more +8 moreBabel vulnerable to arbitrary code execution when compiling specifically crafted malicious code9.4 Critical
- bookreenPrivilege Escalation in Bookreen9.8 Critical
- apache nifiApache NiFi: Incomplete Validation of JDBC and JNDI Connection URLs6.5 Medium
- solarwinds platformSolarWinds Platform Incomplete List of Disallowed Inputs Vulnerability7.2 High
- getgrav gravGrav vulnerable to Server-side Template Injection (SSTI) via Denylist Bypass8.8 High
- getgrav gravGrav Server-side Template Injection via Insufficient Validation in filterFilter8.8 High
- Show moreLoading…