CWE-20: Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
A kind of CWE-707 Improper Neutralization.
From the CWE List. © The MITRE Corporation.
Newest
- google chromeInsufficient validation of untrusted input in iOS in Google Chrome on iOS prior to 148.0.7778.96...5.4 Medium
- google chromeInsufficient data validation in InterestGroups in Google Chrome prior to 148.0.7778.96 allowed a...8.3 High
- google chromeInsufficient data validation in DevTools in Google Chrome on Android prior to 148.0.7778.96...4.3 Medium
- google chromeInsufficient validation of untrusted input in Media in Google Chrome on Android prior to 148.0...8.3 High
- linux, linux kernel +1 morewifi: rtw89: pci: validate release report content before using for RTL8922DE8.8 High
- linux, linux kernel, red hat enterprise linux 10 +12 more +14 morenetfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry9.4 Critical
- getgrav gravGrav: Privilege Escalation via Missing Server-Side Validation of groups/access9.4 Critical
- jupyter jupyterlab, red hat migration toolkit for applications 8.2, openshift ai (rhoai) +1 more +3 moreJupyterLab has an Extension Manager API/GUI Policy Discrepancy allowing 3rd party (malicious) extensions install via POST request.8.8 High
- aas-ee open-websearchOpen-WebSearch: SSRF in `fetchWebContent` MCP tool: bracketed IPv6 literals and non-resolving hostname check bypass `isPrivateOrLocalHostname`8.2 High
- sandboxie-plus sandboxieSandboxie kernel driver denial of service via malformed IOCTL from sandboxed process8.2 High
github.com/Luzifer/otsGoots has a negative expire override that can bypass its secret retention policy5.3 Mediumsteamworkscrates.ioSteamworks game clients/servers using P2P authentication vulnerable to denial of service6.3 Medium- papercut mf, ng, ng/mf +2 morePaperCut MF: Card truncation on HP readers4.1 Medium
- ci4-cms-erp ci4msCI4MS: Arbitrary Database Table Drop via Theme deleteProcess6.9 Medium
- befeleme pyp2specImproper Input Validation leading to Improper Control of Generation of Code ('Code Injection') in pyp2spec7.8 High
- gotenbergGotenberg: ExifTool Dangerous Tag Blocklist Bypass via Group-Prefixed Tag Names Allows Arbitrary File Rename and Move8.2 High
- apache polarisApache Polaris: could broaden vended S3 credentials through wildcard-bearing namespace or table names9.4 Critical
- apache polarisApache Polaris: could broaden vended GCS credentials through unescaped identifier content in access-boundary CEL conditions9.4 Critical
- apache polarisApache Polaris: staged table creation could vend storage credentials for unvalidated locations9.4 Critical
- apache polarisApache Polaris: No protection on `write.metadata.path`9.4 Critical
- rust-opensslrust-openssl: undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs8.7 High
- frroutingMissing input validation in the MP_REACH_NLRI component of FRRouting (FRR) stable/10.0 to stable...6.5 Medium
- No product listedMindsDB Pickle pickle.loads deserialization5.3 Medium
- sgl-project sglangsgl-project SGLang HuggingFace Transformer hf_transformers_utils.py get_tokenizer code injection6.3 Medium
- mem0ai mem0mem0ai mem0 faiss.py pickle.dump deserialization5.3 Medium
- linux, linux kernel +1 moreHID: multitouch: Check to ensure report responses match the request7.8 High
- linux, linux kernel +1 morecrypto: tegra - Add missing CRYPTO_ALG_ASYNC8.8 High
- No product listedAn issue in the component DirectIo64.sys of PassMark BurnInTest v11.0 Build 1011, OSForensics v11...7.8 High
- ibm db2IBM® Db2® is vulnerable to a denial of service with a specially crafted query involving multiple subqueries6.5 Medium
prestashop/ps_checkoutPackagistps_checkout allows unauthorized method invocation through unvalidated parameter2.7 Low- weblateWeblate is Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url5.3 Medium
- progress moveit automationImproper Access Control Vulnerability in Progress MOVEit Automation7.7 High
- qt, qt qtdeclarative, red hat multicluster global hub +10 more +12 morePossible QML code injection in VectorImage component7.4 High
- No product listedAn issue in open5gs v.2.7.3 allows a remote attacker to cause a denial of service via a crafted...7.5 High
- admidioAdmidio: SAML Response Sent to Unvalidated Assertion Consumer Service URL from AuthnRequest8.2 High
- n8nn8n: SQL Injection in Oracle Database Node via Limit Field5.3 Medium
- gnu wget2wget2 Improper Certificate Validation4.8 Medium
- entechtaiwan tvicportAn issue in the TVicPort64.sys component of EnTech Taiwan TVicPort Product v4.0, File v5.2.1.0...7.8 High
- google chromeInsufficient validation of untrusted input in Feedback in Google Chrome prior to 147.0.7727.138...8.3 High
- google chromeInsufficient validation of untrusted input. in Compositing in Google Chrome prior to 147.0.7727...3.1 Low
- grav cmsGrav CMS Cache Value FileCache.php doGet deserialization2.3 Low
- nvidia flare sdk, nvflare +1 moreNVIDIA Flare SDK contains a vulnerability where an Attacker may cause an Improper Input...6.5 Medium
- hanwha vision qnd-8080r, hanwhavision knb-2000 firmware, knb-5000n firmware +251 more +253 moreMissing Error/Exception Handling5.3 Medium
astral-tokio-tarcrates.ioastral-tokio-tar is Vulnerable to PAX Header Desynchronization6.6 Medium- foxit pdf editor, pdf reader +1 moreFoxit PDF Editor/Reader AcroForm Signature Remote Code Execution Vulnerability7.8 High
- gitpython-developers gitpythonGitPython: Command injection via Git options bypass8.8 High
- linux, linux kernel +1 moreopenvswitch: validate MPLS set/set_masked payload length7.1 High
- google gemini-cli, run-gemini-cli, google cloud gemini cli +1 more +3 moreUnauthenticated Remote Code Execution in Gemini CLI CI/CD Workflows10.0 Critical
github.com/k8sgpt-ai/k8sgptGok8sGPT has Prompt Injection through its k8sGPT-Operator8.7 High- anthropic claude code, anthropics claude-code +1 moreClaude Code arbitrary code execution via git worktree commondir trust dialog bypass7.7 High
- Show moreLoading…