CWE-20: Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
A kind of CWE-707 Improper Neutralization.
From the CWE List. © The MITRE Corporation.
Newest
- vrana adminerAdminer before 5.5.1 X-Forwarded-Prefix Backslash Bypass2.3 Low
- leanprover lean4Lean 4 before 4.32.2 Kernel Accepts Opaque Declaration With an Unbound Free Variable6.8 Medium
- nettyNetty: MQTT Topic Name and Client ID Validation Bypass3.5 Low
- apache camelApache Camel: Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes9.8 Critical
- apache camelApache Camel: Camel-Atmosphere-Websocket: WebSocket dispatch header injection9.8 Critical
- apache camelApache Camel: Camel-Knative: CloudEvent extension fields received in structured content mode were mapped onto message headers without applying any header filter strategy5.3 Medium
- apache camelApache Camel: Camel-Mail: the MimeMultipart data format copied MIME headers onto the Camel message without a header filter strategy when unmarshalling with headersInline enabled6.5 Medium
- zscaler client connectorRemote Code Execution9.1 Critical
- ggml-org llama.cppggml-org llama.cpp ggml-RPC Server ggml-rpc.cpp deserialize_tensor deserialization6.9 Medium
- maartenbelmans advanced product fields (product addons) for woocommerceAdvanced Product Fields (Product Addons) for WooCommerce <= 1.6.21 - Unauthenticated Improper Input Validation to Price Bypass via Add-to-Cart POST Request7.5 High
- keystonejs keystoneKeystone: `graphql.maxTake` bypass with negative `take`7.5 High
- misp misp-stixSTIX2 Parser Confusion and Mass Assignment Allow Unauthorized MISP Attribute Metadata Injection in misp-stix library6.9 Medium
- rocket.chatRocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6. 8.3.8, 8.2.8, 8.1.8, and 7.10...4.3 Medium
- genians genian nac v4.0, genian nac v5.0, genian ztna v6.0 +2 moreImproper input validation and Exposure of sensitive information through data queries...8.7 High
- ptc flexplm, windchill pdmlink +1 moreCritical Remote Code Execution (RCE) vulnerability reported in Windchill9.2 Critical
- microsoft office, word, 365 apps for enterprise +10 more +12 moreMicrosoft Word Information Disclosure Vulnerability6.5 Medium
- apple swift-nio, swiftnio +1 moreAn unauthenticated remote peer can crash any NIOWebSocket-based server (including Vapor and Hummingbird) with a single 11-byte frame sent after a completed WebSocket handshake, dropping all active con…5.3 Medium
- laravel-backpack crudbackpack/crud: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)8.1 High
- red hat advanced cluster management for kubernetes 2, advanced cluster management for kubernetes 2.16, advanced cluster management for kubernetes 2.17 +2 moreSubmariner: submariner: missing validation of remote endpoint subnets and clusterid enables cross-cluster traffic hijack8.7 High
- splunk enterprise securitySPL Injection through the REST API in Splunk Enterprise Security8.1 High
- splunk, splunk enterprise +1 moreSPL Injection through Splunk Web in Splunk Enterprise7.1 High
- splunk, splunk enterprise +1 moreSPL Injection through Monitoring Console Forwarder Filters in Splunk Enterprise7.1 High
- splunk, splunk enterprise +1 moreSPL Risky Command Safeguards Bypass through the Job Details Dashboard in Splunk Enterprise6.4 Medium
- moby buildkitBuildKit: Custom frontend could bypass Seccomp/AppArmor5.3 Medium
- ibm powervm hypervisor, power system e1050 \(9043-mrx\) firmware, power system e1080 \(9080-hex\) firmware +24 more +26 morePower System Improper Input Validation8.1 High
- rdk rdk-b webuiRDK WebUI DOS vulnerability6.5 Medium
- drupal link content parserLink content parser - Critical - Unsupported - SA-CONTRIB-2026-1015.9 Medium
- wazuhWazuh: Local SQL injection in FIM db due to path lookup interpolation in wazuh-syscheckd5.3 Medium
- cisco secure workloadCisco Secure Workload Software Security Hardening Release August 2026 - Improper Input Validation Vulnerabilities9.6 Critical
- eidetic-labs stigmem-nodeStigmem before 0.9.0a11 SSRF via unvalidated webhook delivery_address5.3 Medium
- apache tomcatApache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete9.8 Critical
- splware esprocSPLWare esProc SocketData.java ObjectInputStream.readUnshared deserialization6.9 Medium
- truelockmc streambertStreambert: Arbitrary File Execution via VLC/mpv Launcher Fallback8.8 High
- truelockmc streambertStreambert : Insecure Protocol Execution in open-external IPC Handler8.3 High
- tp-link systems inc. tapo c200 v5, tp-link tapo c200 firmware +1 moreDenial-of-Service via Oversized Encrypted Credential Input in TP-Link Tapo C2007.1 High
- google chromeInappropriate implementation in Media in Google Chrome on on Mac prior to 151.0.7922.169 allowed...9.6 Critical
- google chromeInappropriate implementation in CORS in Google Chrome prior to 151.0.7922.169 allowed a remote...4.2 Medium
- @clerk fastifyfastify vulnerable to schema validation bypass via root primitive coercion mismatch5.4 Medium
- froxlorFroxlor DomainZones.add allows DNS zone-file RR injection via record/type fields5.4 Medium
meshcentralnpmMeshCentral has unsanitized data fields8.3 High- nvidia triton inference serverNVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause...7.5 High
- red hat advanced cluster management for kubernetes 2, advanced cluster management for kubernetes 2.16, advanced cluster management for kubernetes 2.17 +2 moreSubmariner-operator: release workflow consumes same-org composite action via mutable @devel branch ref4.4 Medium
- rabbitmq rabbitmq-java-clientRabbitMQ Java client accepts broker frames larger than the negotiated AMQP frame_max0.0 None
- rabbitmq rabbitmq-java-clientRabbitMQ Java client malformed body frame triggers raw command assembler exception6.3 Medium
- red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreGovernance-policy-addon-controller: governance-policy-addon-controller: arbitrary container image override via managedclusteraddon annotation enables rce on spoke8.8 High
- apple ipados, macos, safari +3 more +5 moreThis issue was addressed through improved state management. This issue is fixed in iOS 18.7.10...4.3 Medium
- apple ipados, macos, safari +3 more +5 moreThis issue was addressed through improved state management. This issue is fixed in iOS 18.7.10...4.3 Medium
- apple ipados, macos, safari +3 more +5 moreThis issue was addressed through improved state management. This issue is fixed in iOS 18.7.10...4.3 Medium
- apple ipados, macos, safari +3 more +5 moreThe issue was addressed with improved input validation. This issue is fixed in iOS 18.7.10 and...4.3 Medium
- gruntwork-io terragruntTerragrunt: Arbitrary File Deletion via Malicious Module Manifest6.9 Medium
- Show moreLoading…