CWE-20: Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
A kind of CWE-707 Improper Neutralization.
From the CWE List. © The MITRE Corporation.
Newest
- google chromeInsufficient validation of untrusted input in Downloads in Google Chrome prior to 148.0.7778.168...8.8 High
- google chromeInsufficient validation of untrusted input in DataTransfer in Google Chrome prior to 148.0.7778...5.3 Medium
- apostrophecms apostropheApostrophe has a Weak Password Recovery Mechanism for Forgotten Password and Improper Input Validation8.1 High
- element synapseSynapse pagination denial of service5.1 Medium
- cisco catalyst sd-wan managerCisco Catalyst SD-WAN Manager XML External Entity Injection Vulnerability8.6 High
- richardhbtz soundcloud-rpcsoundcloud-rpc: Remote Code Execution via XSS in Track Title9.6 Critical
- fleetdm fleetFleet server may terminate unexpectedly when handling certain gRPC requests8.7 High
- mispMISP: Improper UUID validation in MISP Collections5.3 Medium
- cubecart v6CubeCart: Pre-Authenticated Password Reset Link Poisoning via HTTP Host Header8.1 High
- palo alto networks broker vmBroker VM: Improper Input Validation in Broker VM Certificate and Key Fields1.1 Low
- teamviewer dex (on-premises)Lack of Server-side validation in Instruction Input in TeamViewer DEX Platform (On-Premises)6.3 Medium
- the openthread authors openthreadImproper Input Validation in OpenThread NAT64 Translator6.0 Medium
- adobe c2pa, c2pa-web, content credentials js sdk +1 more +3 moreCAI Content Credentials | Improper Input Validation (CWE-20)6.2 Medium
- adobe c2pa, c2pa-web, content credentials js sdk +1 more +3 moreCAI Content Credentials | Improper Input Validation (CWE-20)6.2 Medium
- adobe c2pa, c2pa-web, content credentials js sdk +1 more +3 moreCAI Content Credentials | Improper Input Validation (CWE-20)6.2 Medium
- adobe c2pa, c2pa-web, content credentials js sdk +1 more +3 moreCAI Content Credentials | Improper Input Validation (CWE-20)6.2 Medium
- adobe c2pa, c2pa-web, content credentials js sdk +1 more +3 moreCAI Content Credentials | Improper Input Validation (CWE-20)6.2 Medium
- adobe c2pa, c2pa-web, content credentials js sdk +1 more +3 moreCAI Content Credentials | Improper Input Validation (CWE-20)6.2 Medium
- adobe commerce, commerce b2b, magento +2 more +4 moreAdobe Commerce | Improper Input Validation (CWE-20)3.4 Low
- arubanetworks arubaos, sd-wan, hewlett packard enterprise (hpe) hpe aruba networking wireless operating system (aos) +2 moreUnauthenticated Denial-of-Service via Crafted Messages in a Network Protocol Handling Component7.5 High
- shelf-nu shelf.nuShelf: SQL Injection via sortBy Parameter6.5 Medium
- intel quickassist technologyImproper input validation for some Intel(R) QAT software drivers for Windows before version 1.13...8.5 High
- microsoft .net, .net 10.0, .net 8.0 +11 more +13 more.NET Elevation of Privilege Vulnerability7.3 High
- microsoft .net, .net 10.0, .net 8.0 +17 more +19 more.NET Elevation of Privilege Vulnerability7.3 High
- wgdashboardWGDashboard: Critical Vulnerability in 4.3.29.3 Critical
- intel endpoint management assistantImproper input validation for some Intel Endpoint Management Assistant (EMA) software before...8.7 High
- intel quickassist technologyImproper input validation for some Intel(R) QAT software drivers for Windows before version 2.6...6.9 Medium
- intel quickassist technologyImproper input validation for some Intel(R) QAT software drivers for Windows before version 1.13...6.9 Medium
- dragonmonk111 junoclawJunoClaw: upload_wasm accepted arbitrary filesystem paths without validation8.5 High
- apache tomcatApache Tomcat: HTTP/2 request headers not validated9.8 Critical
- protobufjs project protobufjs, protobufjs protobuf.js +1 moreprotobufjs: Denial of service from crafted field names in generated code5.3 Medium
- mozilla firefox, thunderbird, red hat enterprise linux 10 +15 more +17 moreOther issue in the JavaScript Engine component5.3 Medium
- cribl edgeLocal privilege escalation to SYSTEM in Cribl Edge for Windows8.5 High
- cribl streamDOM-based XSS in Cribl Stream7.1 High
- cribl edgeLocal privilege escalation in Cribl Edge for Linux8.5 High
- thinkinaixyz deepchatDeepChat: Incomplete Fix for CVE-2025-55733 leads to Remote Code Execution via Markdown Links bypassing `isValidExternalUrl`9.6 Critical
- apple ipados, macos, safari +5 more +7 moreThe issue was addressed with improved input validation. This issue is fixed in iOS 18.7.9 and...4.3 Medium
- apple ipados, macos, visionos +2 more +4 moreThe issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9...7.5 High
- apple ipados, macos, safari +5 more +7 moreThe issue was addressed with improved input validation. This issue is fixed in iOS 18.7.9 and...8.1 High
- apple ipados, macos, tvos +4 more +6 moreThe issue was addressed with improved input validation. This issue is fixed in iOS 18.7.7 and...7.5 High
- yiisoft yii2Yii 2: Local file inclusion via view parameter name collision7.4 High
- jqlang jqjq: Embedded NUL in jq import paths causes local redaction-policy bypass and preserves sensitive fields in published artifacts4.4 Medium
- zen-browser desktopZen Browser: RSS Live-Folder Item URLs Are Not Scheme-Restricted Before Trusted Tab Creation2.4 Low
oxidize-pdfcrates.io,OxidizePdf.NETNuGet +1 moreoxidize-pdf: NaN/inf bypass in colour content-stream emission causes PDF rejection (DoS)4.3 Medium- wikimedia foundation abusefilterAbuseFilter misuses ::userCanBitfield, exposing access-controlled information2.1 Low
- No product listedCosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure...7.3 High
- free5gcfree5GC: NRF POST /oauth2/token structured-form parser type-confusion panic family (Reflect.Set on incompatible types)7.5 High
- free5gcfree5GC: NEF crashes via logger.Fatal on PFD notification delivery failure (attacker-controlled notifyUri)7.5 High
- webpros cpanel, cpanel (cloudlinux 6, centos 6), wp squared +2 moreInsufficient input validation of the `plugin` parameter of the `create_user` plugin allows...5.3 Medium
- webpros cpanel, cpanel (cloudlinux 6, centos 6), wp squared +2 moreInsufficient input validation of the feature file name in `feature::LOADFEATUREFILE` adminbin...8.6 High
- Show moreLoading…