CWE-20: Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
A kind of CWE-707 Improper Neutralization.
From the CWE List. © The MITRE Corporation.
Newest
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +18 more +20 moreWindows Sensor Data Service Elevation of Privilege Vulnerability7.8 High
- microsoft windows server 2012, windows server 2012 (server core installation), windows server 2012 r2 +10 more +12 moreWindows Server Update Service (WSUS) Tampering Vulnerability7.5 High
- 1panel-dev maxkbMaxKB: RCE via MCP stdio command injection in workflow engine4.6 Medium
- microsoft .net, .net framework, .net 10.0 +15 more +17 more.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability7.5 High
- microsoft .net, microsoft visual studio 2026 version 18.4, microsoft .net 10.0 +14 more +16 more.NET and Visual Studio Denial of Service Vulnerability7.5 High
- jqlang jqjq: Embedded-NUL Truncation in CLI JSON Input Path Causes Prefix-Only Validation of Malformed Input2.9 Low
- ubiquiti inc unifi play audio port, unifi play poweramp +1 moreA series of Improper Input Validation vulnerabilities could allow a Command Injection by a...9.8 Critical
- ubiquiti inc unifi play audio port, unifi play poweramp +1 moreAn Improper Input Validation vulnerability could allow a malicious actor with access to the UniFi...7.5 High
- mongodb c driverbson_validate may skip validation when processing certain inputs5.3 Medium
- huawei emui, harmonyos +1 moreOut-of-bounds write vulnerability in the kernel module. Impact: Successful exploitation of this...5.7 Medium
- xrootdXRootD: Path traversal in directory listing allows access to the parent directory via trailing ".." pattern5.3 Medium
- emilstenstrom justhtmljusthtml before 1.15.0 Multiple Security Issues9.3 Critical
- bugsinkBugsink affected by authenticated arbitrary file write in artifactbundle/assemble7.1 High
- wolfsslImproper Validation of AES-GCM Authentication Tag Length in PKCS#7 Envelope Allows Authentication Bypass8.7 High
- juniper junos, junos os evolved, juniper networks junos os +2 moreJunos OS and Junos OS Evolved: An attacker sending a specific genuine BGP packet causes a BGP reset7.1 High
- nimiq core-rs-albatross, proof-of-stake +1 morenimiq-blockchain is missing a wall-clock upper bound on block timestamps8.1 High
- apache tomcatApache Tomcat: Fix for CVE-2025-66614 is incomplete5.3 Medium
- rapid7 velociraptorRapid7 Velociraptor Improper Input Validation in Client Message Handler8.5 High
- openclawOpenClaw < 2026.4.8 - strictInlineEval Approval Boundary Bypass via Approval-Timeout Fallback7.7 High
randcrates.ioRand is unsound with a custom logger using rand::rng()No score- canonical lxdImporting a crafted backup leads to project restriction bypass9.1 Critical
- langchain-ai langchain, langchain core +1 moreLangChain has incomplete f-string validation in prompt templates5.3 Medium
- google chromeInsufficient validation of untrusted input in WebSockets in Google Chrome prior to 147.0.7727.55...6.5 Medium
- google chromeInsufficient validation of untrusted input in WebML in Google Chrome prior to 147.0.7727.55...8.1 High
- google chromeInsufficient validation of untrusted input in Downloads in Google Chrome on Windows prior to 147...4.3 Medium
- google chromeInsufficient validation of untrusted input in WebML in Google Chrome on Windows prior to 147.0...6.5 Medium
- google chromeInsufficient validation of untrusted input in Media in Google Chrome prior to 147.0.7727.55...8.8 High
- google chromeInsufficient validation of untrusted input in ANGLE in Google Chrome on Mac prior to 147.0.7727...8.8 High
- aws sdk for go v2Denial of service in the event stream header decoder in AWS SDK for Go v28.2 High
- honoHono has a non-breaking space prefix bypass in cookie name handling in getCookie()4.8 Medium
- honoHono - Missing Cookie Name Validation in setCookie()6.9 Medium
- statamcp stata-mcpstata-mcp has insufficient validation of user-supplied Stata do-file content that can lead to command execution9.8 Critical
- openclawOpenClaw < 2026.4.2 - Loopback Protection Bypass via Trailing-Dot Localhost in CDP Discovery6.9 Medium
- jackc pgx, github.com/jackc/pgx/v5 github.com/jackc/pgx/v5/pgproto3, red hat cryostat 4 on rhel 9 +29 more +31 moreCVE-2026-33816 in github.com/jackc/pgx9.8 Critical
- apache activemq, activemq broker, apache software foundation activemq all +8 more +10 moreApache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans8.8 High
- pytries datriepytries datrie trie File datrie.pyx Trie.__setstate__ deserialization5.3 Medium
- openairinterface oai-cn5g-amfOpenAirInterface V2.2.0 AMF crashes when it receives an NGAP message with invalid procedure code...7.5 High
- samsung exynos 1080 firmware, exynos 1280 firmware, exynos 1330 firmware +17 more +19 moreAn issue was discovered in RRC in Samsung Mobile Processor, Wearable Processor, and Modem Exynos...7.5 High
- samsung exynos 1080 firmware, exynos 1280 firmware, exynos 1330 firmware +19 more +21 moreAn issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem (Exynos 980,...7.5 High
- fedml-ai fedmlFedML-AI FedML gRPC server grpc_server.py sendMessage deserialization6.9 Medium
- directusDirectus has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import7.7 High
- directusDirectus has an Open Redirect via Parser Bypass in OAuth2/SAML Authentication Flow6.1 Medium
- infiniflow ragflowRAGFlow: Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in Agent "Text Processing" Component8.7 High
- openprinting cupsOpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network6.1 Medium
- belden hirschmann hiosHirschmann HiOS EtherNet/IP Stack Denial of Service8.7 High
- nasa cfs, core flight system +1 moreNASA cFS Pickle pickle.load deserialization2.0 Low
- electronElectron: Registry key path injection in app.setAsDefaultProtocolClient on Windows4.7 Medium
- nearform fast-jwtfast-jwt has an incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key9.1 Critical
- vllmvLLM: Downmix Implementation Differences as Attack Vectors Against Audio AI Models5.9 Medium
- signalk signal k server, signalk-server +1 moresignalk-server: Arbitrary Prototype Read via `from` Field Bypass2.1 Low
- Show moreLoading…