CWE-184 · Incomplete List of Disallowed Inputs (page 2)
Page 2 of 2 — CVEs classified under CWE-184, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-31992 | High | 7.1 | 2026-03-19 | OpenClaw versions prior to 2026.2.23 contain an allowlist bypass vulnerability in system.run guardrails that allows authenticated operators to execute unintend… |
CVE-2026-22175 | High | 7.1 | 2026-03-18 | OpenClaw versions prior to 2026.2.23 contain an exec approval bypass vulnerability in allowlist mode where allow-always grants could be circumvented through un… |
CVE-2026-32128 | Medium | 6.3 | 2026-03-11 | FastGPT is an AI Agent building platform. In 4.14.7 and earlier, FastGPT's Python Sandbox (fastgpt-sandbox) includes guardrails intended to prevent file writes… |
CVE-2026-28783 | Critical | 9.1 | 2026-03-04 | Craft is a content management system (CMS). Prior to 5.9.0-beta.1 and 4.17.0-beta.1, Craft CMS implements a blocklist to prevent potentially dangerous PHP func… |
CVE-2026-28363 | Critical | 9.9 | 2026-02-27 | In OpenClaw before 2026.2.23, tools.exec.safeBins validation for sort could be bypassed via GNU long-option abbreviations (such as --compress-prog) in allowlis… |
CVE-2026-1773 | High | 7.5 | 2026-02-24 | IEC 60870-5-104 used in RTU500: Potential Denial of Service impact on reception of invalid U-format frame. Product is only affected if IEC 60870-5-104 bi-direc… |
CVE-2026-25951 | High | 7.2 | 2026-02-09 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.2.11, there is a flaw in the path sanitization logic allows an authenticat… |
CVE-2026-22609 | High | 7.8 | 2026-01-10 | Fickling is a Python pickling decompiler and static analyzer. Prior to version 0.1.7, the unsafe_imports() method in Fickling's static analyzer fails to flag s… |
CVE-2026-22608 | High | 7.8 | 2026-01-10 | Fickling is a Python pickling decompiler and static analyzer. Prior to version 0.1.7, both ctypes and pydoc modules aren't explicitly blocked. Even other exist… |
CVE-2026-22607 | High | 7.8 | 2026-01-10 | Fickling is a Python pickling decompiler and static analyzer. Fickling versions up to and including 0.1.6 do not treat Python's cProfile module as unsafe. Beca… |
CVE-2026-22606 | High | 7.8 | 2026-01-10 | Fickling is a Python pickling decompiler and static analyzer. Fickling versions up to and including 0.1.6 do not treat Python’s runpy module as unsafe. Because… |
CVE-2025-69277 | Medium | 4.5 | 2025-12-31 | libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles check… |
CVE-2025-67748 | High | 7.8 | 2025-12-16 | Fickling is a Python pickling decompiler and static analyzer. Versions prior to 0.1.6 had a bypass caused by `pty` missing from the block list of unsafe module… |
CVE-2025-67747 | High | 7.8 | 2025-12-16 | Fickling is a Python pickling decompiler and static analyzer. Versions prior to 0.1.6 are missing `marshal` and `types` from the block list of unsafe module im… |
CVE-2025-67716 | Medium | 5.7 | 2025-12-11 | The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions 4.9.0 through 4.12.1 contain an input-validation flaw… |
CVE-2025-61924 | Low | 3.8 | 2025-10-16 | PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. In versions prior to 4.4.1 and 5.0.5, the Target PayPal merchant acco… |
CVE-2022-50238 | High | 7.4 | 2025-09-08 | The on-endpoint Microsoft vulnerable driver blocklist is not fully synchronized with the online Microsoft recommended driver block rules. Some entries present… |
CVE-2025-58361 | Critical | 9.3 | 2025-09-04 | Promptcraft Forge Studio is a toolkit for evaluating, optimizing, and maintaining LLM-powered applications. All versions contain an non-exhaustive URL scheme… |
CVE-2025-58353 | High | 8.2 | 2025-09-04 | Promptcraft Forge Studio is a toolkit for evaluating, optimizing, and maintaining LLM-powered applications. All versions of Promptcraft Forge Studio sanitize… |
CVE-2025-48732 | High | 7.3 | 2025-07-24 | An incomplete blacklist exists in the .htaccess sample of WWBN AVideo 14.4 and dev master commit 8a8954ff. A specially crafted HTTP request can lead to a arbit… |
CVE-2025-24388 | Low | 3.8 | 2025-06-16 | A vulnerability in the OTRS Admin Interface and Agent Interface (versions before OTRS 8) allow parameter injection due to for an autheniticated agent or admin… |
CVE-2025-1484 | Medium | 6.5 | 2025-05-30 | A vulnerability exists in the media upload component of the Asset Suite versions listed below. If successfully exploited an attacker could impact the confide… |
CVE-2025-46417 | High | 7.5 | 2025-04-24 | The unsafe globals in Picklescan before 0.0.25 do not include ssl. Consequently, ssl.get_server_certificate can exfiltrate data via DNS after deserialization. |
CVE-2025-29822 | High | 7.8 | 2025-04-08 | Incomplete list of disallowed inputs in Microsoft Office OneNote allows an unauthorized attacker to bypass a security feature locally. |
CVE-2025-1716 | Critical | 9.8 | 2025-02-26 | picklescan before 0.0.21 does not treat 'pip' as an unsafe global. An attacker could craft a malicious model that uses Pickle to pull in a malicious PyPI packa… |
CVE-2024-54149 | High | 8.4 | 2024-12-09 | Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Winter CMS prior to versions 1.2.7, 1.1.11, and 1.0.476 allow… |
CVE-2024-52595 | High | 7.7 | 2024-11-19 | lxml_html_clean is a project for HTML cleaning functionalities copied from `lxml.html.clean`. Prior to version 0.4.0, the HTML Parser in lxml does not properly… |
CVE-2024-51745 | Critical | 10.0 | 2024-11-05 | Wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's filesystem sandbox implementation on Windows blocks access to special device filenames such a… |
CVE-2024-32152 | Low | 3.1 | 2024-07-22 | A blocklist bypass vulnerability exists in the LaTeX functionality of Ankitects Anki 24.04. A specially crafted malicious flashcard can lead to an arbitrary fi… |
CVE-2024-5217 | Critical | 9.8 | 2024-07-10 | ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnera… |
CVE-2024-5178 | Medium | 4.9 | 2024-07-10 | ServiceNow has addressed a sensitive file read vulnerability that was identified in the Washington DC, Vancouver, and Utah Now Platform releases. This vulnerab… |
CVE-2024-30103 | High | 8.8 | 2024-06-11 | Microsoft Outlook Remote Code Execution Vulnerability |
CVE-2024-23336 | Medium | 5.0 | 2024-05-01 | MyBB is a free and open source forum software. The default list of disallowed remote hosts does not contain the `127.0.0.0/8` block, which may result in a Serv… |
CVE-2024-20278 | Medium | 6.5 | 2024-03-27 | A vulnerability in the NETCONF feature of Cisco IOS XE Software could allow an authenticated, remote attacker to elevate privileges to root on an affected devi… |
CVE-2024-28246 | Medium | 5.5 | 2024-03-25 | KaTeX is a JavaScript library for TeX math rendering on the web. Code that uses KaTeX's `trust` option, specifically that provides a function to blacklist cert… |
CVE-2023-45593 | Medium | 6.8 | 2024-03-05 | A CWE-184 “Incomplete List of Disallowed Inputs” vulnerability in the embedded Chromium browser (concerning the handling of alternative URLs, other than “ http… |
CVE-2023-45133 | Critical | 9.3 | 2023-10-12 | Babel is a compiler for writingJavaScript. In `@babel/traverse` prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of `babel-traverse`, using Babel to… |
CVE-2023-3374 | Critical | 9.8 | 2023-09-05 | Incomplete List of Disallowed Inputs vulnerability in Unisign Bookreen allows Privilege Escalation. This issue affects Bookreen: before 3.0.0. |
CVE-2023-40037 | Medium | 6.5 | 2023-08-18 | Apache NiFi 1.21.0 through 1.23.0 support JDBC and JNDI JMS access in several Processors and Controller Services with connection URL validation that does not p… |
CVE-2023-23844 | High | 7.2 | 2023-07-26 | The SolarWinds Platform was susceptible to the Incorrect Comparison Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web… |
CVE-2023-34253 | High | 8.8 | 2023-06-14 | Grav is a flat-file content management system. Prior to version 1.7.42, the denylist introduced in commit 9d6a2d to prevent dangerous functions from being exec… |
CVE-2023-34252 | High | 8.8 | 2023-06-14 | Grav is a flat-file content management system. Prior to version 1.7.42, there is a logic flaw in the `GravExtension.filterFilter()` function whereby validation… |
CVE-2023-2017 | High | 8.8 | 2023-04-17 | Server-side Template Injection (SSTI) in Shopware 6 (<= v6.4.20.0, v6.5.0.0-rc1 <= v6.5.0.0-rc4), affecting both shopware/core and shopware/platform GitHub rep… |
CVE-2023-29003 | High | 8.8 | 2023-04-04 | SvelteKit is a web development framework. The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a `+server.j… |
CVE-2022-34888 | Low | 2.7 | 2023-01-30 | The Remote Mount feature can potentially be abused by valid, authenticated users to make connections to internal services that may not normally be accessible t… |
CVE-2022-43396 | High | 8.8 | 2022-12-30 | In the fix for CVE-2022-24697, a blacklist is used to filter user input commands. But there is a risk of being bypassed. The user can control the command by co… |
CVE-2022-23536 | Medium | 6.5 | 2022-12-19 | Cortex provides multi-tenant, long term storage for Prometheus. A local file inclusion vulnerability exists in Cortex versions 1.13.0, 1.13.1 and 1.14.0, where… |
CVE-2022-32763 | Medium | 6.1 | 2022-12-15 | A cross-site scripting (xss) sanitization vulnerability bypass exists in the SanitizeHtml functionality of Lansweeper lansweeper 10.1.1.0. A specially-crafted… |
CVE-2022-35962 | High | 8.0 | 2022-08-29 | Zulip is an open source team chat and Zulip Mobile is an app for iOS and Andriod users. In Zulip Mobile through version 27.189, a crafted link in a message sen… |
CVE-2022-38179 | Medium | 4.7 | 2022-08-12 | JetBrains Ktor before 2.1.0 was vulnerable to the Reflect File Download attack |
CVE-2021-31370 | Medium | 6.5 | 2021-10-19 | An Incomplete List of Disallowed Inputs vulnerability in Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on QFX5000 Series and EX4600 Series allows… |
CVE-2021-25737 | Low | 2.7 | 2021-09-06 | A security issue was discovered in Kubernetes where a user may be able to redirect pod traffic to private networks on a Node. Kubernetes already prevents creat… |
CVE-2021-25631 | High | 8.8 | 2021-05-03 | In the LibreOffice 7-1 series in versions prior to 7.1.2, and in the 7-0 series in versions prior to 7.0.5, the denylist can be circumvented by manipulating th… |
CVE-2020-14372 | High | 7.5 | 2021-03-03 | A flaw was found in grub2 in versions prior to 2.06, where it incorrectly enables the usage of the ACPI command when Secure Boot is enabled. This flaw allows a… |
CVE-2021-1135 | Medium | 4.6 | 2021-01-20 | Multiple vulnerabilities in the REST API endpoint of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to view, modify, an… |
CVE-2021-1255 | Medium | 4.6 | 2021-01-20 | Multiple vulnerabilities in the REST API endpoint of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to view, modify, an… |
CVE-2021-1133 | Medium | 4.6 | 2021-01-20 | Multiple vulnerabilities in the REST API endpoint of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to view, modify, an… |
CVE-2020-3384 | High | 8.2 | 2020-07-31 | A vulnerability in specific REST API endpoints of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to inject arbitrary co… |
CVE-2020-5253 | Low | 3.9 | 2020-03-10 | NetHack before version 3.6.0 allowed malicious use of escaping of characters in the configuration file (usually .nethackrc) which could be exploited. This bug… |
CVE-2019-9212 | Critical | 9.8 | 2019-02-27 | SOFA-Hessian through 4.0.2 allows remote attackers to execute arbitrary commands via a crafted serialized Hessian object because blacklisting of com.caucho.nam… |
CVE-2018-16863 | High | 7.3 | 2018-12-03 | It was found that RHSA-2018:2918 did not fully fix CVE-2018-16509. An attacker could possibly exploit another variant of the flaw and bypass the -dSAFER protec… |
CVE-2016-7076 | Medium | 6.4 | 2018-05-29 | sudo before version 1.8.18p1 is vulnerable to a bypass in the sudo noexec restriction if application run via sudo executed wordexp() C library function with a… |
CVE-2017-2602 | Low | 3.1 | 2018-05-15 | jenkins before versions 2.44, 2.32.2 is vulnerable to an improper blacklisting of the Pipeline metadata files in the agent-to-master security subsystem. This c… |
CVE-2018-7489 | Critical | 9.8 | 2018-02-26 | FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete f… |
CVE-2017-7525 | Critical | 9.8 | 2018-02-06 | A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform… |
CVE-2017-15095 | Critical | 9.8 | 2018-02-06 | A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code ex… |
CVE-2018-6383 | High | 8.8 | 2018-01-29 | Monstra CMS through 3.0.4 has an incomplete "forbidden types" list that excludes .php (and similar) file extensions but not the .pht or .phar extension, which… |
CVE-2018-5968 | High | 8.1 | 2018-01-22 | FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-75… |
CVE-2017-0909 | Critical | 9.8 | 2017-11-16 | The private_address_check ruby gem before 0.4.1 is vulnerable to a bypass due to an incomplete blacklist of common private/local network addresses used to prev… |
CVE-2015-5946 | High | 7.8 | 2017-08-07 | Incomplete blacklist vulnerability in SuiteCRM 7.2.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extensi… |
CVE-2017-7540 | Critical | 9.8 | 2017-07-21 | rubygem-safemode, as used in Foreman, versions 1.3.2 and earlier are vulnerable to bypassing safe mode limitations via special Ruby syntax. This can lead to de… |
CVE-2016-6189 | Medium | 4.3 | 2017-02-17 | Incomplete blacklist in SOGo before 2.3.12 and 3.x before 3.1.1 allows remote authenticated users to obtain sensitive information by reading the fields in the… |