CWE-20: Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
A kind of CWE-707 Improper Neutralization.
From the CWE List. © The MITRE Corporation.
Newest
- google chromeInsufficient validation of untrusted input in Accessibility in Google Chrome on Android prior to...9.6 Critical
- google chromeInsufficient validation of untrusted input in Media in Google Chrome on Windows prior to 151.0...4.3 Medium
- google chromeInsufficient validation of untrusted input in Actor in Google Chrome prior to 151.0.7922.72...4.3 Medium
- google chromeInsufficient validation of untrusted input in UI in Google Chrome on Android prior to 151.0.7922...7.5 High
- google chromeInsufficient validation of untrusted input in PDF in Google Chrome on Android prior to 151.0.7922...6.5 Medium
- google chromeInsufficient validation of untrusted input in Passwords in Google Chrome prior to 151.0.7922.72...8.1 High
- google chromeInsufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 151...9.6 Critical
- google chromeInsufficient validation of untrusted input in Web Authentication in Google Chrome on Android...9.6 Critical
- google chromeInsufficient validation of untrusted input in Print Preview in Google Chrome prior to 151.0.7922...6.5 Medium
- google chromeInsufficient validation of untrusted input in Chromecast in Google Chrome prior to 151.0.7922.72...9.6 Critical
- google chromeInsufficient validation of untrusted input in ANGLE in Google Chrome prior to 151.0.7922.72...9.6 Critical
- google chromeInsufficient validation of untrusted input in Loader in Google Chrome prior to 151.0.7922.72...6.5 Medium
- google chromeInsufficient validation of untrusted input in GPU in Google Chrome on Android prior to 151.0.7922...8.3 High
- google chromeInsufficient validation of untrusted input in Network in Google Chrome prior to 151.0.7922.72...8.3 High
- google chromeInsufficient validation of untrusted input in ANGLE in Google Chrome prior to 151.0.7922.72...9.6 Critical
- google chromeInsufficient validation of untrusted input in Dawn in Google Chrome on Android prior to 151.0...9.6 Critical
- linuxfabrik monitoring-pluginsLinuxfabrik monitoring-plugins: SSRF and auth-token disclosure via unvalidated @odata.id link in redfish-* plugins8.3 High
- drupal disable login pageDisable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-1105.7 Medium
- acacode swagger-typescript-apiswagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref`6.1 Medium
- @fastify/forwarded, fastify fastify\/forwarded +1 more@fastify/forwarded vulnerable to improper input validation via unstripped tab characters in X-Forwarded-For5.3 Medium
- widgetfactorylimited jce, joomlacontenteditor.net joomla content editor (jce) extension for joomla +1 moreJoomla Extension - joomlacontenteditor.net - Creation of hidden files and unintended file overwrite via rename function in Joomla Content Editor (JCE) < 2.9.99.106.5 Medium
- apache traffic serverApache Traffic Server: webp_transform plugin decodes unsafely and mislabels degraded responses8.2 High
- apache traffic serverApache Traffic Server: prefetch plugin can crash on attacker-influenced input8.2 High
- apache traffic serverApache Traffic Server: Untrusted @ headers can spoof ATS internal metadata7.7 High
- sipsorcery-org sipsorcerySIPSorcery: Malformed UDP packet on the RTP/ICE socket can remotely terminate a media session (DoS)7.5 High
- microsoft edge, edge for android +1 moreMicrosoft Edge for Android (Chromium-based) Tampering Vulnerability5.4 Medium
- apache activemq, activemq all, activemq amqp +2 moreApache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All: AMQP NIO negative frame size validation bypass leading to DoS7.5 High
- xenbuffer overruns in libfsimage iso9660 handling5.5 Medium
- gitpython-developers gitpythonGitPython before 3.1.50 Newline Injection via config_writer section7.3 High
- apple ipados, macos, tvos +4 more +6 moreA validation issue was addressed with improved input sanitization. This issue is fixed in iOS 26...7.1 High
- apple macosThis issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15...7.5 High
- apple macosAn issue existed in the handling of environment variables. This issue was addressed with improved...9.8 Critical
- apple ipados, macos, visionos +3 more +5 moreThe issue was addressed with improved input sanitization. This issue is fixed in iOS 26.6 and...5.5 Medium
- beaugunderson ip-addressip-address: Misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks6.9 Medium
- linux, linux kernel +1 moresmb: client: mask server-provided mode to 07777 in modefromsid7.1 High
- better-auth scimbetter-auth SCIM 1.4.0-beta.27 through 1.6.21 Account Takeover via Provider-ID Collision9.4 Critical
- apache nimbleApache NimBLE: Mesh Proxy SAR reassembly unbounded append and unchecked failure5.3 Medium
- microsoft surface management servicesMicrosoft Surface Remote Code Execution Vulnerability9.9 Critical
- zalando skipperSkipper Incomplete Fix for CVE-2026-50197 Policy Bypass8.8 High
- delvedor find-my-wayfind-my-way is Vulnerable to DDoS with HTTP27.5 High
- @auth core, nextauthjs next-auth +1 moreNextAuth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers7.5 High
- alibaba fastjsonRemote Code Execution in fastjson 1.2.68–1.2.839.0 Critical
- boazsegev facil.ioboazsegev facil.io WebSocket Frame websocket_parser.h websocket_on_protocol_error input validation6.9 Medium
- n8nn8n before 1.123.67 Module Cache Poisoning via Code Node5.8 Medium
- dompdfDompdf: Local file read due to improper file path validation in SVG images encoded as data-URI6.3 Medium
- dompdfDompdf: Chroot Validation Bypass2.3 Low
- mongodb server, mongodb, mongodb, inc. mongodb server +2 moreAuthorization Bypass via Client-Supplied $search.mergingPipeline Leaks Unauthorized Collection Data Through $$SEARCH_META6.0 Medium
- drupal development environmentDevelopment Environment - Critical - Unsupported - SA-CONTRIB-2026-0895.7 Medium
- drupal lunr exposed filtersLunr exposed filters - Critical - Unsupported - SA-CONTRIB-2026-0865.7 Medium
- drupal email login otpEmail Login OTP - Critical - Unsupported - SA-CONTRIB-2026-0855.7 Medium
- Show moreLoading…