CWE-20: Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
A kind of CWE-707 Improper Neutralization.
From the CWE List. © The MITRE Corporation.
Newest
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +1 more +3 moreIperf3: iperf3 server accepts unbounded peer-controlled json parameters enabling remote denial of service via resource exhaustion7.5 High
- misp cti-transmutecti-transmute Saved Graph Configuration Allows Stored Cross-Site Scripting via svgIcon5.1 Medium
- dokployDokploy: Incomplete fix of CVE-2026-45628: Command Injection via Unvalidated Branch Fields in Compose Deployment Pipeline (server-side regex missing in compose.ts)9.9 Critical
- discourseDiscourse: Onebox iframe origin allowlist enforces URL authority boundary6.3 Medium
- linuxRDMA/irdma: Prevent rereg_mr for non-mem regions7.8 High
- linuxvmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets7.5 High
- linuxdrm/amdkfd: Check bounds on CRIU restore queue type and mqd size7.1 High
- linuxmedia: v4l2-ctrls: validate HEVC active reference counts7.8 High
- linuxwifi: ath6kl: fix OOB access from firmware ADDBA window size8.8 High
- linuxlibceph: Reject monmaps advertising zero monitors7.5 High
- linuxlibceph: reject zero bucket types in crush_decode9.8 Critical
- linuxrbd: Reset positive result codes to zero in object map update path7.5 High
- linuxtcp: challenge ACK for non-exact RST in SYN-RECEIVED8.2 High
- apache rangerApache Ranger: Privilege Escalation via URL Parameter9.8 Critical
- apache rangerApache Ranger: Remote Code Execution via JDBC URL Injection9.8 Critical
- samsung smart switchImproper input validation in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to...6.8 Medium
- samsung android, samsung mobile devices +1 moreImproper input validation in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows...5.1 Medium
- samsung android, samsung mobile devices +1 moreImproper input validation in MPEG4 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows...5.1 Medium
- samsung android, samsung mobile devices +1 moreImproper input validation in Samsung Message prior to SMR Aug-2026 Release 1 allows physical...5.1 Medium
- samsung android, samsung mobile devices +1 moreImproper input validation in libcodec2_sec_flacdec.so prior to SMR Aug-2026 Release 1 allows...5.1 Medium
- samsung android, samsung mobile devices +1 moreOut-of-bounds write in libcodec2secqcelpdec.so prior to SMR Aug-2026 Release 1 allows local...4.4 Medium
- samsung android, samsung mobile devices +1 moreImproper input validation in Samsung Dialer prior to SMR Aug-2026 Release 1 allows remote...6.0 Medium
- samsung android, samsung mobile devices +1 moreImproper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows physical...6.7 Medium
- samsung android, samsung mobile devices +1 moreImproper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local...6.9 Medium
- lmammino oidc-authorizerlmammino oidc-authorizer Lambda Authorizer handler.rs log file6.9 Medium
- kata-containersKata Containers: Config Path Annotation Arbitrary File Loading9.6 Critical
- tp-link systems inc. archer a6 v4Authenticated Denial-of-Service in HTTPD Service in TP-Link Archer A66.8 Medium
- aehrc pathlingPathling: $import-pnp operation enables authenticated SSRF, credential leakage, and warehouse data poisoning8.6 High
- aehrc pathlingPathling $bulk-submit allows bearer-token exfiltration and persistent warehouse poisoning via unvalidated manifest output URLs8.7 High
- hapifhir ca.uhn.hapi.fhir:org.hl7.fhir.r5, ca.uhn.hapi.fhir:org.hl7.fhir.utilities, ca.uhn.hapi.fhir:org.hl7.fhir.validation +2 more +4 moreHAPI FHIR: XHTML narrative parser unbounded recursion causes StackOverflow denial of service7.5 High
- hapifhir ca.uhn.hapi.fhir:org.hl7.fhir.r5, ca.uhn.hapi.fhir:org.hl7.fhir.utilities, ca.uhn.hapi.fhir:org.hl7.fhir.validation +2 more +4 moreHAPI FHIR: JSON utility parser unbounded recursion causes StackOverflow denial of service7.5 High
- hapifhir ca.uhn.hapi.fhir:org.hl7.fhir.validation, ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli, org.hl7.fhir.core +2 moreHAPI FHIR: Stored XSS in scan report via unescaped IG and profile titles5.0 Medium
- tobit laboratories ag teamdavidTeamDavid: Server-Side Request Forgery (SSRF) via 'pathname' parameter in link storing functionality6.3 Medium
- tobit laboratories ag teamdavidTeamDavid: Stored XSS in web application5.3 Medium
- tobit laboratories ag teamdavidTeamDavid: Arbitrary File Write leading to Stored XSS8.5 High
- tobit laboratories ag teamdavidTeamDavid: Server-Side Request Forgery (SSRF) via 'pathname' parameter in move archive functionality6.3 Medium
- tobit laboratories ag teamdavidTeamDavid: Server-Side Request Forgery (SSRF) via 'pathname' parameter in sending functionality6.3 Medium
- tobit laboratories ag teamdavidTeamDavid: Server-Side Request Forgery (SSRF) via 'pathnameroot' parameter in search functionality7.7 High
- tobit laboratories ag teamdavidTeamDavid: Header Injection through request body in link storing functionality5.3 Medium
- google chromeInsufficient validation of untrusted input in UI in Google Chrome prior to 151.0.7922.109 allowed...8.3 High
- google chromeInsufficient validation of untrusted input in Codecs in Google Chrome prior to 151.0.7922.109...9.6 Critical
- google chromeInsufficient validation of untrusted input in Workers in Google Chrome prior to 151.0.7922.109...8.1 High
- google chromeInsufficient validation of untrusted input in WebAPKs in Google Chrome on Android prior to 151.0...8.6 High
- google chromeInsufficient validation of untrusted input in Contextual Tasks in Google Chrome prior to 151.0...8.8 High
- wso2 api manager, enterprise integrator, micro integrator +1 more +3 moreInformation Disclosure and Integrity Violation via Improper Message Context Handling in Multiple WSO2 Products6.8 Medium
- thimpress wp hotel bookingWP Hotel Booking < 2.3.3 - Unauthenticated Payment Bypass via Price Manipulation5.3 Medium
- easyappointments easy appointmentsEasy Appointments < 3.12.28 - Contributor+ Shortcode Allowlist Bypass2.7 Low
- omicron electronics gmbh stationguardMalformed IEC 61850 Sampled Values frames cause partial denial of service in StationGuard1.3 Low
- apache cxfApache CXF: The authorization code hash (c_hash) is not enforced for the hybrid OIDC flow8.1 High
- wso2 api control plane, api manager, identity server +5 more +7 moreHeader Injection via Custom URL Configuration in Multiple WSO2 Products Allows Open Redirect and Log Forgery5.4 Medium
- Show moreLoading…