CWE-20: Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
A kind of CWE-707 Improper Neutralization.
From the CWE List. © The MITRE Corporation.
Newest
- projectcapsule capsuleCapsule Namespace Hijacking via subresource3.9 Low
- linux, linux kernel, red hat enterprise linux 10 +5 more +7 moreRDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()7.8 High
- linux, linux kernel +1 moreblock: add pgmap check to biovec_phys_mergeable9.8 Critical
- No product listedAn issue in SourceBans Material Admin before v.1.1.6 (3ecd95e) allows attackers to manipulate...7.3 High
- tp-link systems inc. archer be450 v1, tp-link archer be450 firmware, archer be7200 firmware +1 more +3 moreArbitrary Command Injection via Browser Developer Console in TP-Link Archer BE450 and BE72008.5 High
- jenkins credentials binding, jenkins project credentials binding plugin +1 moreJenkins Credentials Binding Plugin does not properly sanitize file names for file and zip file credentials7.5 High
- nvidia geforce, gpu display driver, guest driver +2 more +4 moreNVIDIA Display Driver for Windows and Linux contains a vulnerability in the kernel driver, where...4.4 Medium
- nvidia gpu display driver, guest driver +1 moreNVIDIA Display Driver for Linux contains a vulnerability in UVM, where a user could cause...7.1 High
- e107inc e107e107: Host Header Injection in e107 password reset enables phishing8.1 High
- fraillt bitseryfraillt bitsery std_smart_ptr.h loadFromSharedState improper validation of specified type of input6.3 Medium
- changmingxie tcc-transactionchangmingxie tcc-transaction Fastjson AutoType REST API Fastjson.parseObject deserialization5.3 Medium
- microsoft azure stack hciAzure Stack HCI Information Disclosure Vulnerability7.7 High
- microsoft azure virtual network gatewayAzure Virtual Network Gateway Remote Code Execution Vulnerability9.9 Critical
- tp link systems inc. archer re360 v1, tp-link re305 firmware, re360 firmware +7 more +9 moreAuthentication Logic Vulnerability on Multiple TP-Link Range Extenders8.7 High
- baptistearno typebot.ioTypeBot: SSRF Protection Bypass via DNS-Resolved Hostnames in Webhook / HTTP Request Validation7.6 High
- apache cxf, red hat build of apache camel 4.18.1.p1 for spring boot 3.5.16, fuse 7 +4 more +6 moreApache CXF: Incomplete fix for CVE-2025-48913 (Untrusted JMS configuration can lead to RCE)7.5 High
- ubiquiti unifi os, free5gc udm, udr +59 more +61 moreA malicious actor with access to the network could exploit an Improper Input Validation...10.0 Critical
- ubiquiti inc unifi os serverA malicious actor with access to the network and high privileges could exploit an Improper Input...9.1 Critical
- libp2p js-libp2plibp2p: Memory DoS via subscription flood of unique topics7.5 High
- gmission web faxRemote Code Execution in Gmission Web FAX8.6 High
- google chromeInsufficient validation of untrusted input in Input in Google Chrome on prior to 148.0.7778.179...5.3 Medium
- splunk, splunk cloud platform, enterprise +2 moreDenial of Service through coldToFrozen.sh Script in Splunk Enterprise7.1 High
- isc bind, bind 9, red hat enterprise linux 10 +9 more +11 moreInvalid handling of CLASS != IN7.5 High
- libp2p js-libp2plibp2p: Unvalidated PUT_VALUE records allow unbounded disk exhaustion on DHT server nodes7.5 High
- haxtheweb haxcms-nodejsHAX CMS NodeJS application Vulnerable to Denial of Service using Malicious Import Request6.5 Medium
- apify apify-mcp-serverApify MCP server: Domain Allowlist Bypass in fetch-apify-docs via String Prefix Matching6.1 Medium
- xyproto algernonAlgernon: handler.lua discovery walks parent directories above the server root9.0 Critical
- apache ofbizApache OFBiz: JSON Attribute Override and URL Allowlist Bypass Leads to Remote Code Execution6.5 Medium
- openharmonyfilemanagement_storage_service has an improper input validation vulnerability3.3 Low
- mozilla firefox, thunderbird +1 moreSandbox escape due to incorrect boundary conditions in the Widget: Win32 component9.6 Critical
- opentelemetry ebpf instrumentation, open-telemetry opentelemetry-ebpf-instrumentation +1 moreOpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages7.5 High
- opentelemetry ebpf instrumentation, open-telemetry opentelemetry-ebpf-instrumentation +1 moreOpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads7.5 High
- opentelemetry ebpf instrumentation, open-telemetry opentelemetry-ebpf-instrumentation +1 moreOpenTelemetry eBPF Instrumentation: Unsafe fastelf parsing allows malformed ELF to crash agent5.5 Medium
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Remote Code Execution Vulnerability8.8 High
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Security Feature Bypass Vulnerability5.4 Medium
edumfaPyPIeduMFA: Unauthenticated Failcounter Increment on Resolver Tokens via /validate/check6.5 Medium- apple private cloud compute server software, private cloud compute +1 moreAn attacker in a privileged network position may be able to leak sensitive information. A path...6.5 Medium
- caddyserver caddyCaddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files8.1 High
astral-tokio-tarcrates.ioastral-tokio-tar has a PAX Header Desynchronization issue6.9 Medium- xiandafu beetlxiandafu beetl SpELFunction SpELFunction.java expression language injection6.9 Medium
- h2o, h2oai h2o-3 +1 moreh2oai h2o-3 JAR Model.java importBinaryModel deserialization6.9 Medium
- oinone pamirsOinone Pamirs appConfigQuery PamirsParserConfig.java JsonUtils.parseMap deserialization5.3 Medium
- php frankenphpFrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files8.1 High
- amd ryzen™ 6000 series processors with radeon™ graphics (formerly codenamed "rembrandt"), ryzen™ 7035 series processors with radeon™ graphics (formerly codenamed "rembrandt r"), ryzen™ 7040 series mobile processors with radeon™ graphics (formerly codenamed "phoenix") +4 more +6 moreImproper input validation within the AMD Platform Management Framework (PMF) could allow an...8.4 High
- openwebui open webui, open-webui +1 moreOpen WebUI - Stored Cross-Site Scripting via OAuth Picture Claim SVG Data URI8.5 High
- openwebui open webui, open-webui +1 moreOpen WebUI: Cross-Site Request Forgery (CSRF) via Image URL Manipulation4.6 Medium
- google chromeInsufficient validation of untrusted input in Skia in Google Chrome prior to 148.0.7778.168...3.1 Low
- google chromeInsufficient validation of untrusted input in GPU in Google Chrome prior to 148.0.7778.168...5.3 Medium
- google chromeInsufficient validation of untrusted input in ReadingMode in Google Chrome on Mac prior to 148.0...3.1 Low
- google chromeInsufficient validation of untrusted input in SiteIsolation in Google Chrome prior to 148.0.7778...4.3 Medium
- Show moreLoading…