CWE-1284 · Improper Validation of Specified Quantity in Input (page 2)
Page 2 of 4 — CVEs classified under CWE-1284, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-26940 | Medium | 6.5 | 2026-03-19 | Improper Validation of Specified Quantity in Input (CWE-1284) in the Timelion visualization plugin in Kibana can lead Denial of Service via Excessive Allocatio… |
CVE-2026-31971 | High | 8.1 | 2026-03-18 | HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data using a variety o… |
CVE-2026-31970 | High | 8.1 | 2026-03-18 | HTSlib is a library for reading and writing bioinformatics file formats. GZI files are used to index block-compressed GZIP [BGZF] files. In the GZI loading fu… |
CVE-2026-3085 | High | 8.8 | 2026-03-16 | GStreamer rtpqdm2depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
CVE-2026-2229 | High | 7.5 | 2026-03-12 | ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permess… |
CVE-2026-1528 | High | 7.5 | 2026-03-12 | ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends u… |
CVE-2025-14513 | High | 7.5 | 2026-03-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.11 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allo… |
CVE-2026-3816 | Medium | 4.3 | 2026-03-09 | A security vulnerability has been detected in OWASP DefectDojo up to 2.55.4. This vulnerability affects the function input_zip.read of the file parser.py of th… |
CVE-2026-29062 | High | 7.5 | 2026-03-06 | jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. From version 3.0.0 to before v… |
CVE-2026-27384 | Critical | 9.0 | 2026-03-05 | Improper Validation of Specified Quantity in Input vulnerability in BoldGrid W3 Total Cache w3-total-cache allows Accessing Functionality Not Properly Constrai… |
CVE-2026-3381 | Critical | 9.8 | 2026-03-05 | Compress::Raw::Zlib versions through 2.219 for Perl use potentially insecure versions of zlib. Compress::Raw::Zlib includes a copy of the zlib library. Compre… |
CVE-2026-2597 | High | 7.5 | 2026-02-27 | Crypt::SysRandom::XS versions before 0.010 for Perl is vulnerable to a heap buffer overflow in the XS function random_bytes(). The function does not validate… |
CVE-2026-26934 | Medium | 6.5 | 2026-02-26 | Improper Validation of Specified Quantity in Input (CWE-1284) in Kibana can allow an authenticated attacker with view-only privileges to cause a Denial of Serv… |
CVE-2025-14511 | High | 7.5 | 2026-02-25 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allow… |
CVE-2026-27171 | Low | 2.9 | 2026-02-18 | zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination… |
CVE-2025-14689 | Medium | 6.5 | 2026-02-17 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 12.1.0 through 12.1.3 could allow an authenticated user to cause a denial of service due to i… |
CVE-2025-13867 | Medium | 6.5 | 2026-02-17 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3 could allow an authenticated user to cause a… |
CVE-2026-2474 | High | 7.5 | 2026-02-16 | Crypt::URandom versions from 0.41 before 0.55 for Perl is vulnerable to a heap buffer overflow in the XS function crypt_urandom_getrandom(). The function does… |
CVE-2025-52534 | | 2026-02-10 | Improper bound check within AMD CPU microcode can allow a malicious guest to write to host memory, potentially resulting in loss of integrity. | |
CVE-2024-21953 | | 2026-02-10 | Improper input validation in IOMMU could allow a malicious hypervisor to reconfigure IOMMU registers resulting in loss of guest data integrity. | |
CVE-2025-15080 | | 2026-02-05 | Improper Validation of Specified Quantity in Input vulnerability in Mitsubishi Electric MELSEC iQ-R Series R08PCPU, R16PCPU, R32PCPU, and R120PCPU allows an un… | |
CVE-2025-36094 | Medium | 5.4 | 2026-02-03 | IBM Cloud Pak for Business Automation 25.0.0 through 25.0.0 Interim Fix 002, 24.0.1 through 24.0.1 Interim Fix 005, and 24.0.0 through 24.0.0 Interim Fix 007 c… |
CVE-2025-36428 | Medium | 5.3 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow an authenticated user to cause a denial of se… |
CVE-2025-36427 | Medium | 6.5 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a user to cause a denial of service due to insufficient validation of special ele… |
CVE-2025-36424 | Medium | 6.5 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a user to cause a denial of service due to improper neutralization of special ele… |
CVE-2025-36423 | Medium | 6.5 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 12.1.0 - 12.1.3 could allow a local user to cause a denial of service due to improper neutral… |
CVE-2025-36407 | Medium | 6.5 | 2026-01-30 | IBM® Db2® is vulnerable to a denial of service with a specially crafted query that uses ALTER TABLE operations. |
CVE-2025-36009 | Medium | 6.5 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow an authenticated user to cause a denial of service due to excessive use of a glob… |
CVE-2026-23864 | High | 7.5 | 2026-01-26 | Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbop… |
CVE-2026-0925 | Low | 2.7 | 2026-01-26 | Tanium addressed an improper input validation vulnerability in Discover. |
CVE-2025-11743 | | 2026-01-20 | A denial-of-service security issue in the affected product. The security issue occurs when a malformed CIP forward open message is sent. This could result in a… | |
CVE-2021-47831 | High | 7.5 | 2026-01-16 | Sandboxie 5.49.7 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the container folder input field. Att… |
CVE-2021-47827 | High | 7.5 | 2026-01-16 | WebSSH for iOS 14.16.10 contains a denial of service vulnerability in the mashREPL tool that allows attackers to crash the application by pasting malformed inp… |
CVE-2021-47824 | High | 7.5 | 2026-01-16 | iDailyDiary 4.30 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the preferences tab name field. Attac… |
CVE-2021-47821 | High | 7.5 | 2026-01-16 | RarmaRadio 2.72.8 contains a denial of service vulnerability that allows attackers to crash the application by overflowing network configuration fields with la… |
CVE-2021-47818 | High | 7.5 | 2026-01-16 | DupTerminator 1.4.5639.37199 contains a denial of service vulnerability that allows attackers to crash the application by inputting a long character string in… |
CVE-2023-54337 | Critical | 9.1 | 2026-01-13 | Sysax Multi Server 6.95 contains a denial of service vulnerability in the administrative password field that allows attackers to crash the application. Attacke… |
CVE-2026-21485 | High | 8.8 | 2026-01-06 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below are prone to have Undefined Behavior (U… |
CVE-2025-10933 | | 2026-01-05 | An integer underflow vulnerability in the Silicon Labs Z-Wave Protocol Controller can lead to out of bounds memory reads. | |
CVE-2024-30516 | High | 7.5 | 2026-01-05 | Improper Validation of Specified Quantity in Input vulnerability in SaasProject Booking Package allows Accessing Functionality Not Properly Constrained by ACLs… |
CVE-2023-7332 | | 2025-12-31 | PocketMine-MP versions prior to 4.18.1 contain an improper input validation vulnerability in inventory transaction handling. A remote attacker with a valid pla… | |
CVE-2025-68383 | Medium | 6.5 | 2025-12-18 | Improper Validation of Specified Index, Position, or Offset in Input (CWE-1285) in Filebeat Syslog parser and the Libbeat Dissect processor can allow a user to… |
CVE-2025-67901 | Medium | 5.3 | 2025-12-15 | openrsync through 0.5.0, as used in OpenBSD through 7.8 and on other platforms, allows a client to cause a server SIGSEGV by specifying a length of zero for bl… |
CVE-2025-36015 | Medium | 6.5 | 2025-12-08 | IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 could allow an authenticated user to cause a denial of service due to… |
CVE-2025-65548 | Critical | 9.1 | 2025-12-08 | NUT-14 allows cashu tokens to be created with a preimage hash. However, nutshell (cashubtc/nuts) before 0.18.0 do not validate the size of preimage when the to… |
CVE-2025-12385 | | 2025-12-03 | Allocation of Resources Without Limits or Throttling, Improper Validation of Specified Quantity in Input vulnerability in The Qt Company Qt on Windows, MacOS… | |
CVE-2025-33211 | High | 7.5 | 2025-12-03 | NVIDIA Triton Server for Linux contains a vulnerability where an attacker may cause an improper validation of specified quantity in input. A successful exploit… |
CVE-2025-59820 | Medium | 6.7 | 2025-11-26 | In KDE Krita before 5.2.13, loading a manipulated TGA file could result in a heap-based buffer overflow in plugins/impex/tga/kis_tga_import.cpp (aka KisTgaImpo… |
CVE-2025-13507 | Medium | 6.5 | 2025-11-25 | Inconsistent object size validation in time series processing logic may result in later processing of oversized BSON documents leading to an assert failing and… |
CVE-2025-54515 | | 2025-11-23 | The Secure Flag passed to Versal™ Adaptive SoC’s Trusted Firmware for Cortex®-A processors (TF-A) for Arm’s Power State Coordination Interface (PSCI) commands… | |
CVE-2025-48507 | | 2025-11-23 | The security state of the calling processor into Trusted Firmware (TF-A) is not used and could potentially allow non-secure processors access to secure memorie… | |
CVE-2025-9316 | | 2025-11-12 | N-central < 2025.4 can generate sessionIDs for unauthenticated users This issue affects N-central: before 2025.4. | |
CVE-2025-10259 | Medium | 5.3 | 2025-11-06 | Improper Validation of Specified Quantity in Input vulnerability in TCP Communication Function on Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module… |
CVE-2025-36092 | Medium | 6.5 | 2025-11-03 | IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and 24.0.0 could allow an authenticated user to cause a denial of service due to the improper validation… |
CVE-2025-11568 | Medium | 4.4 | 2025-10-15 | A data corruption vulnerability has been identified in the luksmeta utility when used with the LUKS1 disk encryption format. An attacker with the necessary per… |
CVE-2025-61938 | High | 7.5 | 2025-10-15 | When a BIG-IP Advanced WAF or ASM security policy is configured with a URL greater than 1024 characters in length for the Data Guard Protection Enforcement set… |
CVE-2025-11594 | Medium | 5.3 | 2025-10-11 | A vulnerability has been found in ywxbear PHP-Bookstore-Website-Example and PHP Basic BookStore Website up to 0e0b9f542f7a2d90a8d7f8c83caca69294e234e4. This is… |
CVE-2025-0038 | Medium | 6.6 | 2025-10-06 | In AMD Zynq UltraScale+ devices, the lack of address validation when executing CSU runtime services through the PMU Firmware can allow access to isolated or pr… |
CVE-2025-43793 | High | 7.5 | 2025-09-15 | Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 G… |
CVE-2025-2256 | High | 7.5 | 2025-09-12 | An issue has been discovered in GitLab CE/EE affecting all versions from 7.12 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed… |
CVE-2025-10094 | Medium | 6.5 | 2025-09-12 | An issue has been discovered in GitLab CE/EE affecting all versions from 10.7 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed… |
CVE-2025-32689 | High | 7.5 | 2025-09-09 | Improper Validation of Specified Quantity in Input vulnerability in Convers Lab WP SmartPay smartpay.This issue affects WP SmartPay: from n/a through <= 2.8.2. |
CVE-2024-36346 | Medium | 6.0 | 2025-09-06 | Improper input validation in AMD Power Management Firmware (PMFW) could allow a privileged attacker from Guest VM to send arbitrary input data potentially caus… |
CVE-2025-39700 | Medium | 5.5 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: ignore migration request to invalid nodes damon_migrate_pages() trie… |
CVE-2025-58835 | Medium | 5.3 | 2025-09-05 | Improper Validation of Specified Quantity in Input vulnerability in calliko Bonus for Woo bonus-for-woo allows Accessing Functionality Not Properly Constrained… |
CVE-2025-5808 | | 2025-08-29 | Improper Input Validation vulnerability in OpenText Self Service Password Reset allows Authentication Bypass.This issue affects Self Service Password Reset fro… | |
CVE-2025-8424 | | 2025-08-26 | Improper access control on the NetScaler Management Interface in NetScaler ADC and NetScaler Gateway when an attacker can get access to the appliance NSIP, Clu… | |
CVE-2025-55398 | Critical | 9.8 | 2025-08-22 | An issue was discovered in mouse07410 asn1c thru 0.9.29 (2025-03-20) - a fork of vlm asn1c. In UPER (Unaligned Packed Encoding Rules), asn1c-generated decoders… |
CVE-2025-8320 | High | 8.8 | 2025-07-30 | Tesla Wall Connector Content-Length Header Improper Input Validation Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers… |
CVE-2025-43881 | Medium | 4.3 | 2025-07-23 | Improper validation of specified quantity in input issue exists in Real-time Bus Tracking System versions prior to 1.1. If exploited, a denial of service (DoS)… |
CVE-2025-41100 | | 2025-07-21 | Incorrect authentication vulnerability in ParkingDoor. Through this vulnerability it is possible to operate the device without the access being logged in the a… | |
CVE-2022-50020 | Medium | 5.5 | 2025-06-18 | In the Linux kernel, the following vulnerability has been resolved: ext4: avoid resizing to a partial cluster size This patch avoids an attempt to resize the… |
CVE-2025-5349 | High | 8.8 | 2025-06-17 | Improper access control on the NetScaler Management Interface in NetScaler ADC and NetScaler Gateway |
CVE-2025-4365 | High | 7.5 | 2025-06-17 | Arbitrary file read in NetScaler Console and NetScaler SDX (SVM) |
CVE-2025-49292 | Medium | 4.3 | 2025-06-06 | Improper Validation of Specified Quantity in Input vulnerability in Cozmoslabs Profile Builder profile-builder allows Phishing.This issue affects Profile Build… |
CVE-2025-5257 | Medium | 6.5 | 2025-05-28 | SummaryThis advisory addresses a security vulnerability in Mautic where unpublished page previews could be accessed by unauthenticated users and potentially in… |
CVE-2025-2826 | Low | 2.6 | 2025-05-27 | n affected platforms running Arista EOS, ACL policies may not be enforced. IPv4 ingress ACL, MAC ingress ACL, or IPv6 standard ingress ACL enabled on one or mo… |
CVE-2024-9448 | High | 7.5 | 2025-05-08 | On affected platforms running Arista EOS with Traffic Policies configured the vulnerability will cause received untagged packets not to hit Traffic Policy rule… |
CVE-2025-20151 | Medium | 4.3 | 2025-05-07 | A vulnerability in the implementation of the Simple Network Management Protocol Version 3 (SNMPv3) feature of Cisco IOS Software and Cisco IOS XE Software coul… |
CVE-2025-32399 | Medium | 5.3 | 2025-05-07 | An Unchecked Input for Loop Condition in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to cause IO devices that use the library to enter an infinit… |
CVE-2025-46656 | Low | 2.9 | 2025-04-26 | python-markdownify (aka markdownify) before 0.14.1 allows large headline prefixes such as <h9999999> in addition to <h1> through <h6>. This causes memory consu… |
CVE-2025-3511 | High | 7.5 | 2025-04-25 | Improper Validation of Specified Quantity in Input vulnerability in Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O module, CC-Link IE TSN Analog-Dig… |
CVE-2025-43972 | Medium | 6.8 | 2025-04-21 | An issue was discovered in GoBGP before 3.35.0. An attacker can cause a crash in the pkg/packet/bgp/bgp.go flowspec parser by sending fewer than 20 bytes in a… |
CVE-2025-43970 | Medium | 4.3 | 2025-04-21 | An issue was discovered in GoBGP before 3.35.0. pkg/packet/mrt/mrt.go does not properly check the input length, e.g., by ensuring that there are 12 bytes or 36… |
CVE-2025-43964 | Low | 2.9 | 2025-04-21 | In LibRaw before 0.21.4, tag 0x412 processing in phase_one_correct in decoders/load_mfbacks.cpp does not enforce minimum w0 and w1 values. |
CVE-2025-29784 | High | 7.5 | 2025-04-18 | NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, the s parameter in GET requests for forum sear… |
CVE-2025-32415 | Low | 2.9 | 2025-04-17 | In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploit this, a crafted XM… |
CVE-2025-25178 | High | 7.8 | 2025-04-04 | Software installed and run as a non-privileged user may conduct improper GPU system calls to cause kernel system memory corruption. |
CVE-2024-45351 | High | 7.8 | 2025-03-26 | A code execution vulnerability exists in the Xiaomi Game center application product. The vulnerability is caused by improper input validation and can be explo… |
CVE-2024-8000 | Medium | 5.3 | 2025-03-04 | On affected platforms running Arista EOS with 802.1X configured, certain conditions may occur where a dynamic ACL is received from the AAA server resulting in… |
CVE-2025-0286 | High | 8.4 | 2025-03-03 | Various Paragon Software products contain an arbitrary kernel memory write vulnerability within biontdrv.sys that is caused by a failure to properly validate t… |
CVE-2025-0285 | High | 7.8 | 2025-03-03 | Various Paragon Software products contain an arbitrary kernel memory mapping vulnerability within biontdrv.sys that is caused by a failure to properly validate… |
CVE-2024-53879 | Low | 2.8 | 2025-02-25 | NVIDIA CUDA toolkit for Linux and Windows contains a vulnerability in the cuobjdump binary, where a user could cause a crash by passing a malformed ELF file to… |
CVE-2024-53878 | Low | 2.8 | 2025-02-25 | NVIDIA CUDA toolkit for Linux and Windows contains a vulnerability in the cuobjdump binary, where a user could cause a crash by passing a malformed ELF file to… |
CVE-2023-20508 | Medium | 5.0 | 2025-02-12 | Improper access control in the ASP could allow a privileged attacker to perform an out-of-bounds write to a memory location not controlled by the attacker, pot… |
CVE-2023-31331 | Low | 3.0 | 2025-02-11 | Improper access control in the DRTM firmware could allow a privileged attacker to perform multiple driver initializations, resulting in stack memory corruption… |
CVE-2023-20582 | Medium | 5.3 | 2025-02-11 | Improper handling of invalid nested page table entries in the IOMMU may allow a privileged attacker to induce page table entry (PTE) faults to bypass RMP check… |
CVE-2023-20581 | Low | 2.5 | 2025-02-11 | Improper access control in the IOMMU may allow a privileged attacker to bypass RMP checks, potentially leading to a loss of guest memory integrity. |
CVE-2023-20515 | Medium | 5.7 | 2025-02-11 | Improper access control in the fTPM driver in the trusted OS could allow a privileged attacker to corrupt system memory, potentially leading to loss of integri… |
CVE-2025-24100 | Low | 3.3 | 2025-01-27 | A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. An app may be abl… |