CWE-20: Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
A kind of CWE-707 Improper Neutralization.
From the CWE List. © The MITRE Corporation.
Newest
- google chromeInsufficient validation of untrusted input in Input in Google Chrome prior to 149.0.7827.155...4.2 Medium
- truelockmc streambertStreambert: Arbitrary File Write (Zip Slip) via Subtitle Extraction10.0 Critical
- oracle jd edwards enterpriseone toolsVulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component:...9.1 Critical
- openclawOpenClaw < 2026.5.26 - Hostname Validation Bypass via Trailing-Dot Inconsistency6.0 Medium
- n8nn8n: Python sandbox escape7.1 High
- astroAstro: Host-header full-read SSRF in core prerendered error-page fetch (prerenderedErrorPageFetch default + unvalidated createRequestFromNodeRequest URL)7.5 High
- encode starletteStarlette: Unvalidated request path concatenated into authority poisons request.url.hostname3.7 Low
- fastapiexpert python-multipartPython-Multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters3.7 Low
- nodemailerNodemailer before 9.1.0 Denial of Service via addressparser8.7 High
- comma ai openpilotComma AI Openpilot Pickle modeld.py pickle.loads deserialization8.5 High
- openclawOpenClaw < 2026.5.7 - Hostname Prefix Matching Bypass in Trusted Retry Endpoint Validation6.0 Medium
- connectbot cbsshConnectBot SSH: Unbounded SSH field lengths can cause excessive memory allocation6.9 Medium
- radius-project radiusRadius Controller May Delete a Container Resource via an Injected Deployment Annotation (Multi-Tenant Installs)7.7 High
- osgeo geoserver, geoserver org.geoserver.web:gs-web-app, org.geoserver:gs-main +2 moreGeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution6.5 Medium
- google go-attestationGo-Attestation: Hash injection into trusted measurement list via unskipped SignatureHeaderSize vendor bytes in parseEfiSignatureList()8.9 High
- jmespath, jmespath jmespath.php +1 morejmespath.php has CompilerRuntime code injection via unescaped function names9.8 Critical
postgres-protocolcrates.iopostgres-protocol: Panic decoding a malformed `hstore` value allows denial of service6.9 Medium- duck-organization questbotQuest Bot: Empty automod rule causes every guild message to be deleted8.4 High
- apache cxf, red hat build of apache camel 4.18.1.p1 for spring boot 3.5.16, fuse 7 +3 more +5 moreApache CXF: JNDI Injection vulnerability in DispatchMDBMessageListenerImpl8.1 High
- apache cxf, red hat build of apache camel 4.18.1.p1 for spring boot 3.5.16, fuse 7 +8 more +10 moreApache CXF: JNDI Injection Vulnerability in JMSConfigFactory8.1 High
- apache cxf, red hat build of apache camel 4.18.1.p1 for spring boot 3.5.16, fuse 7 +5 more +7 moreApache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control9.8 Critical
- @clerk express, free5gc udm, udr +29 more +31 moreA malicious actor with access to the network and low privileges could exploit an Improper Input...9.9 Critical
- @clerk express, free5gc udm, udr +29 more +31 moreA malicious actor with access to the network and low privileges could exploit an Improper Input...9.9 Critical
- ubiquiti inc uid enterprise agentA malicious actor with access to the network and low privileges could exploit an Improper Input...9.9 Critical
- squid-cache squidSquid: Memory corruption in cache_digest reply handling5.5 Medium
- google chromeInsufficient validation of untrusted input in Linux Toolkit Theming in Google Chrome on Linux...8.3 High
- google chromeInsufficient validation of untrusted input in Network in Google Chrome prior to 149.0.7827.115...5.3 Medium
- google chromeInappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.115 allowed a...3.1 Low
- google chromeInappropriate implementation in DevTools in Google Chrome prior to 149.0.7827.115 allowed a...8.3 High
- google chromeInsufficient validation of untrusted input in Accessibility in Google Chrome on Mac prior to 149...8.3 High
- messagepack, messagepack-csharp +1 moreMessagePack-CSharp: LZ4 decompression may fail with AccessViolationException after dereferencing memory from bad input8.2 High
- penguinmod penguinmod-backendapiPenguinMod-BackendApi: NoSQL Injection in Password Reset Endpoint Allows Account Takeover8.7 High
- raszi tmp, node-tmp +1 moretmp: Type-confusion bypass of _assertPath in tmp@0.2.6 allows path traversal via non-string prefix/postfix/template8.2 High
- free5gcfree5GC: UDR Improper ueId validation in free5GC EE subscription handlers allows arbitrary identifier persistence6.9 Medium
- guzzle guzzle-servicesguzzlehttp/guzzle-services' XML Request Serialization Vulnerable to XML Injection via CDATA Terminator5.8 Medium
- guzzle psr7, guzzlephp psr-7 +1 moreguzzlehttp/psr7 has CRLF Injection via URI Host Component5.3 Medium
- guzzle psr7, guzzlephp psr-7 +1 moreguzzlehttp/psr7 has Host Confusion via Authority Reinterpretation5.3 Medium
- cerebrateCerebrate before v1.37 allows mass assignment of record identifiers during object creation8.7 High
- amd epyc™ 7003 series processors, epyc™ 9004 series processor +1 moreImproper input validation for DIMM serial presence detect (SPD) metadata could allow an attacker...5.3 Medium
- eugeny russhRussh: SSH message fields were decoded through allocation-first parsers before field-specific bounds7.5 High
- eugeny russhRussh: SSH identification parsing accepted non-canonical client banners and did not bound pre-banner input5.3 Medium
- eugeny russhRussh: Unchecked keyboard-interactive prompt count in client auth path6.5 Medium
- openvm`openvm-pairing` pairing check missing proper subfield check on scaling factor8.7 High
- fissionFission: HTTPTrigger admission omits RelativeURL / Prefix validation; kubectl apply bypasses CLI checks4.3 Medium
- splunk, splunk cloud platform, enterprise +2 moreImproper Input Validation through Classic Dashboard CSS in Splunk Enterprise5.7 Medium
- splunk, splunk cloud platform, enterprise +2 moreImproper Input Validation through Classic Dashboards in Splunk Enterprise5.7 Medium
- splunk, splunk cloud platform, enterprise +2 moreInformation Disclosure through External Content Restriction Bypass in Splunk Enterprise5.7 Medium
- splunk, splunk cloud platform, enterprise +2 moreImproper Input Validation through Protocol-Relative URL in Classic Dashboards in Splunk Enterprise5.7 Medium
- composerComposer - Critical - Unsupported - SA-CONTRIB-2026-0465.9 Medium
- roxy-wiRoxy-WI: EscapedString validator skips its '..' block when stripping (root cause for several path-traversal/RCE vectors)8.1 High
- Show moreLoading…