CWE-20: Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
A kind of CWE-707 Improper Neutralization.
From the CWE List. © The MITRE Corporation.
Newest
- google chromeImproper input validation in Privacy in Google Chrome prior to 156.0.8078.47 allowed a remote...9.6 Critical
- google chromeImproper input validation in Downloads in Google Chrome prior to 156.0.8078.47 allowed a remote...8.8 High
- google chromeUse after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote...9.6 Critical
- google chromeImproper input validation in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote...8.8 High
- google chromeMemory corruption in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to...8.8 High
- google chromeUse after free in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to...9.6 Critical
- google chromeImproper input validation in Mobile in Google Chrome on on iOS prior to 156.0.8078.47 allowed a...8.8 High
- google chromeImproper input validation in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote...8.8 High
- google chromeImproper input validation in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a...8.8 High
- google chromeMemory corruption in History in Google Chrome on on Android prior to 156.0.8078.47 allowed a...8.8 High
- google chromeImproper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote...8.8 High
- google chromeImproper input validation in WebShare in Google Chrome prior to 156.0.8078.47 allowed a remote...8.8 High
- google chromeImproper input validation in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote...9.6 Critical
- google chromeImproper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote...8.8 High
- google chromeImproper input validation in Proxy in Google Chrome prior to 156.0.8078.47 allowed a remote...8.8 High
- google chromeImproper input validation in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote...8.8 High
- google chromeImproper input validation in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote...8.8 High
- google chromeImproper input validation in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed...8.8 High
- google chromeImproper input validation in Date in Google Chrome prior to 156.0.8078.47 allowed a remote...9.6 Critical
- google chromeImproper input validation in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed...9.6 Critical
- google chromeImproper input validation in Views in Google Chrome prior to 156.0.8078.47 allowed a remote...8.8 High
- google chromeUse after free in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote...8.8 High
- google chromeImproper input validation in ANGLE in Google Chrome on on Mac prior to 156.0.8078.47 allowed a...8.8 High
- apache software foundation arrow c++, pyarrow +1 moreApache Arrow C++, PyArrow: Parquet file-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation8.1 High
- fast-urifast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization4.8 Medium
- apple ipados, ios and ipados, iphone os +2 moreA denial-of-service issue was addressed with improved input validation. This issue is fixed in...5.9 Medium
- apple ipados, macos, ios and ipados +1 more +3 moreAn input validation issue was addressed with improved input validation. This issue is fixed in...4.3 Medium
- apple xcodeAn input validation issue was addressed with improved input validation. This issue is fixed in...4.3 Medium
- apple macosAn integer underflow was addressed with improved input validation. This issue is fixed in macOS...5.9 Medium
- apple macosA memory corruption issue was addressed with improved input validation. This issue is fixed in...3.5 Low
- misp misp-modulesMISP html_to_markdown Module SSRF via Incomplete IP Range Blocking in is_safe_url()6.3 Medium
- element-hq element-x-iosElement X iOS: io.element.call deeplink allows attacker-controlled HTTPS origin and may grant mic/camera to that origin5.1 Medium
- apache camelApache Camel: Camel-Mail Header Injection via Unfiltered mail.smtp Headers in the MimeMultipart Data Format (Incomplete Fix of CVE-2026-46584)6.5 Medium
- apache camelApache Camel: Camel-Core Saga Participation Hijacking via the Unfiltered Long-Running-Action Header4.8 Medium
- apache camelApache Camel: Camel-Tika Header Injection via Unfiltered Document Metadata6.5 Medium
- apache software foundation kylinApache Kylin: Potential JDBC source configuration validation issue6.5 Medium
- dimitri grassi salon booking systemSalon Booking System < 10.31.11 - Unauthenticated Negative Booking Total via Discount Code3.7 Low
- espnetESPnet Inference Model inference_model.py build_model deserialization5.3 Medium
- hpe superdome flex server, hewlett packard enterprise hpe compute scale-up server 3200 platform, hpe compute scale-up server 3250 platform +1 more +3 moreHPE Compute Scale-up Server 3200 and 3250 platforms and Superdome Flex server, Remote RMC file modification4.3 Medium
- hankcs hanlphankcs HanLP Model Config Loading reflection.py hanlp.load deserialization5.3 Medium
- koozali sme serverKoozali - SME Server Improper Input Validation in domain Creation Leads to Denial of Service6.9 Medium
- hankcs hanlphankcs HanLP torch_util.py load_word2vec_as_vocab_tensor deserialization5.3 Medium
- makeplane planemakeplane API Endpoint reliance on untrusted inputs in a security decision6.9 Medium
- datastax pulsar-jmsdatastax pulsar-jms PulsarObjectMessage.java decode deserialization5.3 Medium
- anthropics claude-agent-sdk-pythonClaude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution9.2 Critical
- freerdpFreeRDP from 3.30.0 before 3.32.0 Resource Exhaustion via rdpecam StartStreamsRequest6.0 Medium
- google chromeImproper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote...9.6 Critical
- microsoft 365 apps, 365 apps for enterprise, office ltsc 2021 +3 more +5 moreMicrosoft Office Word Remote Code Execution Vulnerability8.8 High
- lycheeorg lycheeLychee: Webshop payment bypass via unrestricted "Dummy" gateway selection8.3 High
- lycheeorg lycheeLychee: Webshop checkout lets the client override the payment `amount` sent to the gateway via malicious crafted POST request8.3 High
- Show moreLoading…