CWE-20: Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
A kind of CWE-707 Improper Neutralization.
From the CWE List. © The MITRE Corporation.
Newest
- No product listedAn issue in the parse_month function (/time/strptime.rs) of relibc commit ab6a2e allows attackers...7.5 High
- mhsanaei 3x-uiAuthenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation7.2 High
- powerdns recursorReject more queries with invalid header values5.3 Medium
- powerdns recursorZONEMD validation can be bypassed5.3 Medium
- powerdns recursorMissing input validation for catalog zones5.9 Medium
- powerdns recursorInsufficient input validation in ZoneToCache5.9 Medium
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 moreip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()9.8 Critical
- nlnet labs nsdOut of bounds stack write with crafted APL RR7.2 High
- google chromeRace in DevTools in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had...8.3 High
- google chromeInsufficient validation of untrusted input in Navigation in Google Chrome prior to 149.0.7827.197...4.2 Medium
- olivetinOliveTin has Unvalidated `ot_`-prefixed Arguments that Bypass Input Filtering4.3 Medium
- fatpipe warpWarp Markdown notebook links may open executable local files8.8 High
- fatpipe warpWarp: SSH remote output can lead to local file overwrite and persistence8.8 High
- linux, linux kernel +1 morebpf: Validate node_id in arena_alloc_pages()7.8 High
- linux, linux kernel +1 morepppoe: drop PFC frames7.5 High
- linux, linux kernel +1 morelibceph: handle rbtree insertion error in decode_choose_args()7.5 High
- linux, linux kernel, red hat enterprise linux 10 +13 more +15 moreipc: limit next_id allocation to the valid ID range7.8 High
- qos.ch sarl logback-coreIncomplete protection against CVE-2025-112267.0 High
- poweradminPoweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction.9.6 Critical
- gogsGogs: Ability to import local repositories via Mirror Settings8.1 High
- zephyrproject zephyrOut-of-bounds read in Bluetooth Classic SDP attribute parsing (`bt_sdp_parse_attribute`)7.1 High
software.sslmate.com/src/go-pkcs12Gopackage pkcs12: Authentication bypass in Decode functions6.3 Medium- cap-go capgoCapgo - Subkey Enforcement Bypass via x-limited-key-id Header Parsing5.3 Medium
- inspektor-gadgetInspektor Gadget: Unprivileged container can crash USDT note parser via crafted ELF2.9 Low
- wwbn avideoAVideo Has Unauthenticated .env File Exposure via Official Docker Compose Configuration7.5 High
- gogsGogs: Denial of Service in repository/wiki file listing web pages4.9 Medium
- gaudire assassin gameMultiple vulnerabilities in the Assassin game by Gaudire9.4 Critical
- zhilink 智互联(深圳)科技有限公司 adp application developer platform 应用开发者平台zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 testConnection Endpoint deserialization5.3 Medium
- cap-go capgoCapgo - Denial of Service via Improper Password Policy Length Validation6.9 Medium
- cap-go capgoCapgo - App ID Confusion via ILIKE Wildcard in Preview Subdomain Lookup2.3 Low
craftcms/commercePackagistCraft Commerce: Partial Payment Amount Without Lower Bound Validation6.9 Medium- ultrajsonUltraJSON: Malformed/Truncated UTF-8 Accepted and Silently Rewritten in ujson.dumps()6.5 Medium
- containerdcontainerd CRI plugin: — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull9.4 Critical
- proxysqlProxySQL MCP run_sql_readonly executes side-effecting MySQL multi-statements despite read-only contract7.5 High
- symfony uxSymfony UX: Format-less date LiveProps parsed with the permissive DateTime constructor6.9 Medium
- hcl software verse for androidHCL Verse for Android is susceptible to an injection vulnerability6.3 Medium
- apache apisixApache APISIX: Identity Injection via forward-auth Plugin Missing Header Cleanup5.8 Medium
- daytonaio daytonaDaytona: Path traversal in sandbox volume id mounts arbitrary host paths into the sandbox — cross-tenant data access and host escape4.2 Medium
- mervinpraison praisonaiagentsPraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-controlled searxng_url parameter8.8 High
- mervinpraison praisonaiagentsPraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters8.1 High
- dadrus heimdallHeimdall: Forwarded Header Injection via Unsanitized Host Header in Proxy Mode7.0 High
- dadrus heimdallHeimdall: IP Spoofing via Unvalidated Forwarding Headers7.0 High
- socket engine.io, socketio socket.io +1 moreSocket.IO: Engine.IO WebTransport SID DoS7.5 High
- ptc flexplm, windchill and flexplm, windchill pdmlink +2 moreRemote Code Execution (RCE) vulnerability in Windchill PDMlink9.3 Critical
- black lantern security bbotSSRF via unvalidated WWW-Authenticate realm in docker_pull module3.1 Low
- steeltoeoss steeltoe.discovery.eurekaSteeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire registry fetch7.5 High
- containerdcontainerd CRI checkpoint restore CDI annotation smuggling8.4 High
- google androidIn multiple locations there is a possible provisioning bypass due to improper input validation....7.8 High
- google chromeObject lifecycle issue in Metrics in Google Chrome prior to 149.0.7827.155 allowed a remote...8.3 High
- google chromeInappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.155 allowed an...4.2 Medium
- Show moreLoading…