CWE-20: Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
A kind of CWE-707 Improper Neutralization.
From the CWE List. © The MITRE Corporation.
Newest
dieselcrates.ioDiesel's SQLite backend has possible UTF-8 corruption8.7 High- apache activemq, activemq broker, apache software foundation activemq all +8 more +10 moreApache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All: Authenticated user can perform RCE via DestinationView MBean exposed by Jolokia8.8 High
- apache activemq, activemq broker, apache software foundation activemq all +8 more +10 moreApache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Possible bypass of CVE-2026-34197 via HTTP discovery second-stage URI8.8 High
- nimiq nimiq-blockchain, proof-of-stake +1 morenimiq-blockchain: Peer-triggerable panic during history sync5.3 Medium
- nimiq nimiq-block, proof-of-stake +1 morenimiq-block has skip block quorum bypass via out-of-range BitSet indices & u16 truncation9.6 Critical
- uutils coreutilsuutils coreutils cut Local Logic Error and Data Integrity Issue in Delimiter Parsing5.5 Medium
- uutils coreutilsuutils coreutils env Local Denial of Service via Improper Handling of Backslashes in Split-String Mode3.3 Low
- uutils coreutilsuutils coreutils kill System-wide Process Termination and Denial of Service via Argument Misinterpretation5.5 Medium
- uutils coreutilsuutils coreutils comm Silent Data Loss or Denial of Service via Improper Input Validation4.4 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 moreext4: reject mount if bigalloc with s_first_data_block != 07.8 High
- spring security, vmware spring security +1 morePotential Security Misconfiguration when Using withIssuerLocation5.3 Medium
- raindropInsufficient validation of Chrome extension identifiers in Raindrop.io Bookmark Manager Web App 5...6.5 Medium
- mailcow mailcow-dockerizedmailcow: dockerized vulnerable to Second Order SQL Injection in quarantine category via API7.2 High
- mozilla firefox, thunderbird +1 moreOther issue in the JavaScript Engine component5.3 Medium
- mozilla firefox, thunderbird +1 moreOther issue in the Networking: DNS component5.3 Medium
- zervit portable http/web serverIncorrect input validation on the Zervit portable HTTP/Web server8.2 High
- cyberchimps responsive blocks – page builder for blocks & patternsResponsive Blocks <= 2.2.0 - Unauthenticated Open Email Relay via REST API 'email_to' Parameter5.3 Medium
- m1k1o nekoNeko has Self-service Privilege Escalation for Authenticated Users8.8 High
- linuxfoundation spinnakerSpinnaker vulnerable to RCE when using gitrepo artifact types due to improper sanitization of user input on branch and paths10.0 Critical
- dell powerprotect data domain, data domain operating system, powerprotect dp series appliance +2 moreDell PowerProtect Data Domain, versions 8.5 through 8.6 contain an improper input validation...7.2 High
- dell powerprotect data domain, data domain operating system, powerprotect dp series appliance +2 moreDell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0...7.2 High
- cockpit-hq cockpitCockpit-HQ Cockpit Asset Handler/Aggregate data query logic injection5.3 Medium
- minecanton209 novumosNovumOS has Privilege Escalation in the Syscall Interface9.4 Critical
- stirling-tools stirling-pdf, stirlingpdf stirling pdf +1 moreStirling-PDF: Reflected XSS through crafted filename in file upload functionality3.1 Low
- imaginationtech ddk, imagination technologies graphics ddk +1 moreGPU DDK - Incorrect flags validation in RGXDerivePTEProt8 can allow GPU to overwrite read-only shared memory (e.g. libc.so)7.3 High
- flowiseai flowiseFlowise: Flowise Parameter Override Bypass Remote Command Execution7.7 High
- flowiseai flowiseFlowise: Improper Mass Assignment in Account Registration Enables Unauthorized Organization Association8.1 High
- eaton intelligent power protector, ipp software +1 moreDue to improper input validation in one of the Eaton Intelligent Power Protector (IPP) XML, it is...6.0 Medium
- wpmet metform proMetForm Pro <= 3.9.7 - Unauthenticated Payment Amount Manipulation via 'mf-calculation'5.3 Medium
- xquic project xquicXQUIC Improper STREAM Frame Validation in Initial/Handshake Packets8.3 High
- nuget nugetgalleryNuGet Gallery: Arbitrary Blob Overwrite via Nuspec Confusion and URI Fragment Truncation9.6 Critical
- adobe framemakerAdobe Framemaker | Improper Input Validation (CWE-20)6.3 Medium
- jellyfinJellyfin: Potential RCE via subtitle upload path traversal + .strm chain10.0 Critical
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Improper Input Validation (CWE-20)7.5 High
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Improper Input Validation (CWE-20)9.3 Critical
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Improper Input Validation (CWE-20)8.4 High
- it-novum openitcockpitopenITCOCKPIT has Authenticated Command Injection Leading to Remote Code Execution via Host Address Macro Expansion8.8 High
- emilstenstrom justhtmljusthtml before 1.16.0 Multiple Security Issues via Sanitization9.3 Critical
- composer, red hat hardened images +1 moreComposer is vulnerable to Command Injection via Malicious Perforce Repository7.8 High
- composer, red hat hardened images +1 moreComposer has Command Injection via Malicious Perforce Reference8.8 High
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Spoofing Vulnerability6.5 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +22 more +24 moreWindows Hyper-V Remote Code Execution Vulnerability7.3 High
- microsoft windows server 2016, windows server 2016 (server core installation), windows server 2019 +6 more +8 moreWindows Hello Security Feature Bypass Vulnerability8.7 High
- microsoft windows server 2012, windows server 2012 (server core installation), windows server 2012 r2 +8 more +10 moreWindows BitLocker Security Feature Bypass Vulnerability7.7 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +22 more +24 morePowerShell Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +22 more +24 moreWindows Hyper-V Remote Code Execution Vulnerability7.8 High
- microsoft powershell, powershell 7.4, powershell 7.5 +2 moreMicrosoft PowerShell Security Feature Bypass Vulnerability7.8 High
- microsoft windows server 2012 r2, windows server 2012 r2 (server core installation), windows server 2016 +9 more +11 moreWindows Active Directory Remote Code Execution Vulnerability8.0 High
- microsoft azure monitor, azure monitor agent +1 moreAzure Monitor Agent Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 21h2, windows 10 version 22h2, windows 11 version 23h2 +9 more +11 moreWindows Hello Security Feature Bypass Vulnerability4.4 Medium
- Show moreLoading…