CWE-20: Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
A kind of CWE-707 Improper Neutralization.
From the CWE List. © The MITRE Corporation.
Newest
- microsoft 365 apps, 365 apps for enterprise, office ltsc 2021 +3 more +5 moreMicrosoft Office Access Remote Code Execution Vulnerability8.8 High
- microsoft 365 apps, 365 apps for enterprise, office ltsc 2021 +3 more +5 moreMicrosoft Office Word Information Disclosure Vulnerability6.5 Medium
- adobe commerce, commerce b2b, magento +2 more +4 moreAdobe Commerce | Improper Input Validation (CWE-20)8.7 High
- adobe commerce, commerce b2b, magento +2 more +4 moreAdobe Commerce | Improper Input Validation (CWE-20)9.1 Critical
- adobe commerce, commerce b2b, magento +2 more +4 moreAdobe Commerce | Improper Input Validation (CWE-20)4.3 Medium
- netgear r7300dstInsufficient input validation vulnerability in NETGEAR R73004.3 Medium
- netgear r7300dstInsufficient input validation vulnerability in NETGEAR R7300 router4.3 Medium
- netgear cax30, rax30, rax5 +1 more +3 moreAn insufficient input validation vulnerability exists in the website blocking feature of certain NETGEAR RAX/CAX series models6.3 Medium
- netgear cbr40, r7000, r7000p +1 more +3 moreInsufficient input validation vulnerability in Certain NETGEAR routers allows unauthorized access4.3 Medium
- zohocorp manageengine malware protection plusInsufficient Signature Validation4.9 Medium
- No product listedTensorLayer HDF5 Loading utils.py load_hdf5_graph deserialization5.3 Medium
- yoshitomo-matsubara torchdistillyoshitomo-matsubara torchdistill main_util.py load_ckpt deserialization4.8 Medium
- mozilla firefox, thunderbird +1 moreSpoofing issue in the DOM: Web Serial component6.1 Medium
- mozilla firefox, thunderbird +1 moreMitigation bypass in the File Handling component5.4 Medium
- 0xjacky nginx-uiNginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)8.8 High
- ibm maximo ai serviceMaximo AI Service Improper Input Validation7.5 High
- 0xjacky nginx-uiNginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)8.8 High
- ibm db2IBM® Db2® Denial of Service3.3 Low
- turboderp-org exllamav3OOB Read/Write via Negative Array Index in exllamav3_ext Kernel Table9.8 Critical
- red hat exploit intelligence, build of quarkus 3.27.6.redhat, build of quarkus 3.33.4.redhat +2 moreQuarkus-hibernate-orm-rest-data-panache: quarkus-hibernate-orm-rest-data-panache: information disclosure and dos via unvalidated sort parameter in rest data panache6.5 Medium
- vllm-project vllmvLLM before 0.29.0 Heap Overflow DoS via IAMF Audio Transcription Upload7.1 High
- progress sharefile storage zones controllerUnauthenticated queue manipulation through connector SSRF and response injection in Progress ShareFile Storage Zones Controller6.5 Medium
- samsung mobile checkoutImproper input validation in CreditCardRetrieveActivity of Samsung Checkout prior to version 5.1...5.1 Medium
- samsung mobile checkoutImproper input validation in GuestCreditCardRegisterActivity of Samsung Checkout prior to version...5.1 Medium
- samsung mobile checkoutImproper input validation in CreditCardRegisterActivity of Samsung Checkout prior to version 5.1...5.1 Medium
- samsung mobile devicesImproper input validation in parsing sheifd in libsimba.heifdec.media.samsung.so prior to SMR Oct...8.6 High
- samsung mobile devicesImproper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to...8.6 High
- unisoc (shanghai) technologies co., ltd. modemInformation Disclosure in Modem5.5 Medium
- linux kernelImproper Input Validation in Kernel APsys DVFS5.5 Medium
- getkin kin-openapikin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path5.3 Medium
- pyloadpyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination6.5 Medium
- apache software foundation camel karavanApache Camel Karavan: unvalidated Kubernetes resources applied from a project's kubernetes.yaml8.8 High
- sumatrapdfreader sumatrapdfSumatraPDF: SyncTeX Argument Injection in Inverse Search Enables Arbitrary Command Execution via External Editors7.1 High
- hazelcastHazelcast: Arbitrary member memory access by low-privileged client9.3 Critical
- nearform fast-jwtfast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set7.4 High
- masci banksBanks: User-controlled prompt input can be parsed as privileged chat messages6.5 Medium
- corazawaf corazaCoraza from 3.0.4 before 3.8.1 Request Body Inspection Bypass via Content-Type6.9 Medium
- corazawaf corazaCoraza before 3.8.1 Multipart filename* Charset Handling FILES Rule Bypass6.3 Medium
- corazawaf corazaOWASP Coraza WAF: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations4.0 Medium
- corazawaf corazaCoraza 3.0.0 before 3.8.1 WAF Bypass via JSON Key Collision6.9 Medium
- scriptkittyos beam mcpbeam_mcp: nested tool argument constraints advertised but not enforced5.3 Medium
- unknown wallet system for woocommerceWallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Wallet Balance Manipulation via Negative Transfer Amount6.5 Medium
- broadcom brocade active support connectivity gateway, brocade active support connectivity gateway +1 moreAn Improper Input Validation vulnerability for the registered case credentials in Brocade ASCG...6.8 Medium
- splunk, splunk enterprise +1 moreImproper Input Validation of Index Names through the collect Command in Splunk Enterprise4.3 Medium
- splunk, splunk enterprise +1 moreImproper Input Validation of Native Splunk Usernames through the REST API in Splunk Enterprise4.1 Medium
- splunk, splunk enterprise +1 moreImproper Input Validation through the collect Command in Splunk Enterprise4.3 Medium
- excelizeExcelize: GetStyle panics on a negative fillId, borderId or fontId in styles.xml6.5 Medium
- cisco campus gateway software, meraki mr wireless access points software, meraki mv firmware +1 more +3 moreCisco Meraki Hardening Release - Input Validation Vulnerabilities8.2 High
- cisco nx-os software, nx-os system software in aci mode, unified computing system (managed) +2 moreCisco NX-OS Software Security Hardening Release: October 2026 - Improper Input Validation Vulnerabilities8.6 High
- mispMISP Object Sync Drops Objects and Attributes When Description Is Empty5.3 Medium
- Show moreLoading…