CWE-20 · Improper Input Validation (page 10)
Page 10 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-13434 | Medium | 4.9 | 2026-06-26 | A flaw was found in KubeVirt's network annotation generator. When a tenant creates a VirtualMachineInstance with a Multus network configuration, the supplied n… |
CVE-2026-42390 | Medium | 5.3 | 2026-06-25 | An invalid zone might pass ZONEMD validation while it should not. This is only relevant if ZoneToCache is configured with ZONEMD validation. |
CVE-2026-42389 | Medium | 5.3 | 2026-06-25 | This fix provides extra hardening for the 5.4.x branch by doing extra validation of incoming answers from authoritative servers. |
CVE-2026-42388 | Medium | 5.9 | 2026-06-25 | Incomplete validation of the SOA record present in a catalog zone might lead to a crash. |
CVE-2026-42387 | Medium | 5.9 | 2026-06-25 | A malicious authoritative server can send a crafted zone via the ZoneToCache function that leads to a crash of the Recursor due to insuffcient input validation. |
CVE-2026-12246 | High | 8.1 | 2026-06-25 | NSD version 4.14.0 introduced a bug where a specially crafted APL RR, with an adflength larger than permitted for the address family will overwrite the stack w… |
CVE-2026-52801 | High | 8.1 | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, the Gogs Mirror Settings functionality provide an alternative way from the well protected New… |
CVE-2025-64719 | Medium | 4.9 | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, a malicious user with rights to create a new file on a repository or wiki page can trigger a d… |
CVE-2026-13025 | High | 8.3 | 2026-06-24 | Race in DevTools in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox e… |
CVE-2026-13024 | Medium | 4.2 | 2026-06-24 | Insufficient validation of untrusted input in Navigation in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer pr… |
CVE-2026-48720 | High | 8.8 | 2026-06-24 | Warp is an agentic development environment. From 0.2025.03.05.08.02.stable_00 until 0.2026.05.06.15.42.stable_01, Warp accepts non-inline `OSC 1337;File` paylo… |
CVE-2026-48704 | High | 8.8 | 2026-06-24 | Warp is an agentic development environment. From 0.2023.10.24.08.03.stable_00 until 0.2026.05.06.15.42.stable_01, Warp may open executable local files through… |
CVE-2026-12537 | High | 7.8 | 2026-06-24 | Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI (versions prior to 0.39.1) and run-gemini-cli GitHub Action (versi… |
CVE-2026-13006 | | 2026-06-24 | ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.36 in Java applications, allows an attac… | |
CVE-2026-54588 | Critical | 9.6 | 2026-06-23 | Poweradmin is a web-based DNS administration tool for PowerDNS server. Versions prior to 4.2.4 and 4.3.3 use the attacker-controlled `HTTP_HOST` request header… |
CVE-2026-45135 | High | 8.1 | 2026-06-23 | Caddy is an extensible server platform that uses TLS by default. From 2.7.0 until 2.11.3, the FastCGI transport's splitPos() in modules/caddyhttp/reverseproxy/… |
CVE-2026-49444 | High | 8.5 | 2026-06-23 | n8n is an open source workflow automation platform. Prior to 1.123.48, 2.21.8, and 2.22.4, an authenticated user with permission to create or modify workflows… |
CVE-2026-56762 | Medium | 5.3 | 2026-06-23 | Hono before 4.12.12 does not validate cookie names on the write path in the setCookie(), serialize(), and serializeSigned() functions, allowing invalid charact… |
CVE-2026-10651 | High | 7.1 | 2026-06-23 | bt_sdp_parse_attribute() in subsys/bluetooth/host/classic/sdp.c validated only that the SDP record buffer held the type-marker byte plus the 2-byte attribute I… |
CVE-2026-56306 | Medium | 6.4 | 2026-06-22 | Capgo before 12.128.2 contains a weak parsing vulnerability in the x-limited-key-id header that allows attackers to bypass subkey enforcement by submitting mal… |
CVE-2026-54911 | Medium | 6.5 | 2026-06-22 | UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps() (or ujson.dump() or ujson.encode()… |
CVE-2026-48109 | High | 8.2 | 2026-06-22 | MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, A vulnerability exists in the optional LZ4 decompression path used by Messag… |
CVE-2026-54299 | High | 7.5 | 2026-06-22 | Astro is a web framework. Prior to 6.4.6, Astro SSR apps with prerendered error pages (/404 or /500 using export const prerender = true) fetch those pages over… |
CVE-2026-55602 | High | 8.6 | 2026-06-22 | http-proxy-middleware is node.js http-proxy middleware. From 0.16.0 until 2.0.10, 3.0.6, and 4.1.0, http-proxy-middleware documents router proxy-table entries… |
CVE-2026-53537 | Low | 3.7 | 2026-06-22 | Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, parse_options_header parsed Content-Disposition (and Content-Type) headers with e… |
CVE-2026-7165 | | 2026-06-22 | The vulnerability is present in the ‘/addJugador’ endpoint: * The 'keyJugador' and 'keyJugadorObjectiu' parameters allow the modification of other users’ i… | |
CVE-2026-12787 | Medium | 6.3 | 2026-06-21 | A vulnerability was found in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0. This affects an unknown part of the component testConnecti… |
CVE-2026-56340 | High | 8.8 | 2026-06-20 | vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal embeddings processing. Because PyTorch disables sparse tensor invariant… |
CVE-2026-56325 | Low | 3.1 | 2026-06-20 | Capgo before 12.128.2 uses ILIKE pattern matching instead of exact matching for app_id lookup in the preview subdomain resolver, allowing underscore characters… |
CVE-2026-56228 | Medium | 4.9 | 2026-06-20 | Capgo before 12.128.2 fails to enforce a maximum value on the minimum password length field in its password policy configuration. An authenticated organization… |
CVE-2026-48774 | High | 7.5 | 2026-06-19 | ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. In versions 3.0.0 through 3.0.8, ProxySQL's GenAI/MCP `run_sql_readonly` tool violates its… |
CVE-2026-21768 | Medium | 6.3 | 2026-06-19 | The compose-rich-editor library (v1.0.0-rc14) used in HCL Verse for Android's rich text email composition fails to properly validate all HTML input thereby all… |
CVE-2026-39998 | High | 8.8 | 2026-06-19 | Improper Input Validation vulnerability in Apache APISIX. The attacker can take advantage of certain configuration in forward-auth plugin to spoof identity he… |
CVE-2025-58175 | Medium | 6.5 | 2026-06-18 | GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a GeoServer that uses `ENTITY_RESO… |
CVE-2026-12569 | Critical | 9.8 | 2026-06-18 | A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the… |
CVE-2026-50196 | High | 7.5 | 2026-06-17 | Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Discovery.Eureka prior… |
CVE-2026-48055 | Critical | 10.0 | 2026-06-17 | Streambert is a cross-platform Electron Desktop App to stream and download any video media. In versions 2.4.0 and prior, a high-severity Zip Slip vulnerability… |
CVE-2026-12465 | High | 8.3 | 2026-06-17 | Object lifecycle issue in Metrics in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially pe… |
CVE-2026-12456 | Medium | 4.2 | 2026-06-17 | Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.155 allowed an attacker who convinced a user to install a malicious extension t… |
CVE-2026-12453 | Medium | 4.2 | 2026-06-17 | Insufficient validation of untrusted input in Input in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process… |
CVE-2025-48643 | High | 7.8 | 2026-06-17 | In multiple locations there is a possible provisioning bypass due to improper input validation. This could lead to local escalation of privilege with no additi… |
CVE-2026-46910 | Critical | 9.1 | 2026-06-17 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security). Supported versions that are… |
CVE-2026-0142 | Medium | 4.0 | 2026-06-16 | In iavb_parse_key_data of avb_rsa.c, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure w… |
CVE-2026-12191 | High | 7.8 | 2026-06-14 | A vulnerability was found in Comma AI Openpilot 0.11. This issue affects the function pickle.load/pickle.loads of the file selfdrive/modeld/modeld.py of the co… |
CVE-2026-45013 | High | 8.1 | 2026-06-12 | ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 have a password reset flow that constructs the reset URL… |
CVE-2026-54133 | Critical | 9.8 | 2026-06-12 | jmespath.php allows users to use JMESPath, software for declaratively specifying how to extract elements from a JSON document, in PHP applications with PHP dat… |
CVE-2026-47196 | | 2026-06-12 | Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, the automod add command trims user input but does not reject an empty result. Adding a rule con… | |
CVE-2026-50633 | High | 8.1 | 2026-06-12 | A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipu… |
CVE-2026-50632 | High | 8.1 | 2026-06-12 | A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can all… |
CVE-2026-50628 | Critical | 9.8 | 2026-06-12 | A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP addres… |
CVE-2026-47370 | Critical | 9.9 | 2026-06-12 | A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain devices running UniFi… |
CVE-2026-47369 | Critical | 9.9 | 2026-06-12 | A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain devices running UniFi… |
CVE-2026-47367 | Critical | 9.9 | 2026-06-12 | A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UID Enterprise Agent to execu… |
CVE-2026-12034 | High | 8.3 | 2026-06-11 | Insufficient validation of untrusted input in Linux Toolkit Theming in Google Chrome on Linux prior to 149.0.7827.115 allowed a remote attacker who had comprom… |
CVE-2026-12025 | Medium | 5.3 | 2026-06-11 | Insufficient validation of untrusted input in Network in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer proce… |
CVE-2026-12017 | Low | 3.1 | 2026-06-11 | Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to bypas… |
CVE-2026-12016 | High | 8.3 | 2026-06-11 | Inappropriate implementation in DevTools in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potenti… |
CVE-2026-12009 | High | 8.3 | 2026-06-11 | Insufficient validation of untrusted input in Accessibility in Google Chrome on Mac prior to 149.0.7827.115 allowed a remote attacker who had compromised the r… |
CVE-2026-47181 | | 2026-06-11 | PenguinMod-BackendApi is the backend api for penguinmod. Prior to version 1.0.0, a NoSQL injection vulnerability in the password reset endpoint allows any auth… | |
CVE-2026-49982 | High | 8.2 | 2026-06-11 | tmp is a temporary file and directory creator for node.js. In version 0.2.6, the _assertPath guard added to tmp rejects only string values that contain the sub… |
CVE-2026-53723 | Medium | 5.8 | 2026-06-11 | Guzzle Services provides an implementation of the Guzzle Command library that uses Guzzle service descriptions to describe web services, serialize requests, an… |
CVE-2026-49214 | Medium | 5.3 | 2026-06-11 | guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Versions prior to 2.10.2 did not reject ASCII control characters, whitespace, or DEL in… |
CVE-2026-48998 | Medium | 5.3 | 2026-06-11 | guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Versions prior to 2.10.2 contain improper Host header validation when parsing raw HTTP r… |
CVE-2026-53901 | | 2026-06-11 | Cerebrate before version 1.37 contains a mass-assignment vulnerability in the generic CRUD add path. The add() handler attempted to remove an attacker-supplied… | |
CVE-2026-49218 | High | 7.5 | 2026-06-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, a missing check in the… |
CVE-2024-21944 | Medium | 5.3 | 2026-06-10 | Improper input validation for DIMM serial presence detect (SPD) metadata could allow an attacker with physical access, ring0 access on a system with a non-comp… |
CVE-2026-48110 | High | 7.5 | 2026-06-10 | Russh is a Rust SSH client & server library. From version 0.34.0 to before version 0.61.0, several russh client and server message handlers decoded attacker-co… |
CVE-2026-48108 | Medium | 5.3 | 2026-06-10 | Russh is a Rust SSH client & server library. From version 0.34.0-beta.1 to before version 0.61.0, russh did not enforce the SSH identification-string rules as… |
CVE-2026-48107 | Medium | 6.5 | 2026-06-10 | Russh is a Rust SSH client & server library. From version 0.37.0 to before version 0.61.0, in the russh client keyboard-interactive authentication path, a mali… |
CVE-2026-46679 | High | 7.5 | 2026-06-10 | libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 15.0.23, three cooperating omissions in @libp2p/gossipsub allow an unauthent… |
CVE-2026-46669 | High | 7.5 | 2026-06-10 | OpenVM is a performant and modular zkVM framework built for customization and extensibility. Prior to version 1.6.0, the openvm-pairing guest library's try_hon… |
CVE-2026-45783 | High | 7.5 | 2026-06-10 | libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 16.2.6, an unauthenticated remote peer can exhaust the disk storage of any @… |
CVE-2026-50569 | Medium | 4.3 | 2026-06-10 | Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version… |
CVE-2026-45062 | High | 8.1 | 2026-06-10 | FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos() function in cgi.go misuses golang.org/x/text/se… |
CVE-2026-20257 | Medium | 5.7 | 2026-06-10 | In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and… |
CVE-2026-20256 | Medium | 5.7 | 2026-06-10 | In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and… |
CVE-2026-20255 | Medium | 5.7 | 2026-06-10 | In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and… |
CVE-2026-20254 | Medium | 5.7 | 2026-06-10 | In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and… |
CVE-2026-45565 | High | 8.1 | 2026-06-10 | Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, EscapedString (app/modules/roxywi/class_m… |
CVE-2026-45558 | Critical | 9.9 | 2026-06-10 | Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, the HAProxy section-save endpoints (POST… |
CVE-2026-45556 | Critical | 9.9 | 2026-06-10 | Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, POST /waf/<service>/<server_ip>/rule/<rul… |
CVE-2026-45329 | High | 7.1 | 2026-06-10 | ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.4 and 6.0, several ESP-TEE secure-service wrappers in esp_secure_servi… |
CVE-2026-45328 | Critical | 9.3 | 2026-06-10 | ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.4 and 6.0, the esp_tee component exposes secure-service wrappers in es… |
CVE-2026-41727 | Medium | 6.5 | 2026-06-10 | Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header values before acting on them. A producer could send a record wit… |
CVE-2026-47903 | Medium | 6.2 | 2026-06-09 | CAI Content Credentials versions c2pa-web@0.7.1, c2pa-v0.80.1 and earlier are affected by an Improper Input Validation vulnerability. An attacker could exploit… |
CVE-2026-34712 | High | 7.5 | 2026-06-09 | CAI Content Credentials versions c2pa-web@0.7.1, c2pa-v0.80.1 and earlier are affected by an Improper Input Validation vulnerability. An attacker could exploit… |
CVE-2026-47931 | High | 8.4 | 2026-06-09 | ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the… |
CVE-2026-47930 | High | 8.1 | 2026-06-09 | ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A lo… |
CVE-2026-47928 | Critical | 9.6 | 2026-06-09 | ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the… |
CVE-2026-47909 | Medium | 6.3 | 2026-06-09 | Dreamweaver Desktop versions 21.7 and earlier are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read. An atta… |
CVE-2026-9213 | High | 8.1 | 2026-06-09 | A vulnerability in the affected NETGEAR gaming routers allows attackers with the ability to intercept and tamper with traffic between the router and the Intern… |
CVE-2026-9212 | High | 8.0 | 2026-06-09 | Insufficient authentication and input validation in the listed NETGEAR models allow users connected to the local network to execute commands impacting the prod… |
CVE-2026-9211 | High | 8.8 | 2026-06-09 | An unauthenticated user on the local network can gain control of the router and make unauthorized changes to its operation. |
CVE-2026-9210 | Medium | 4.5 | 2026-06-09 | Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorize… |
CVE-2026-49840 | Critical | 9.1 | 2026-06-09 | FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on… |
CVE-2026-49475 | High | 7.5 | 2026-06-09 | FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on… |
CVE-2026-48569 | High | 7.1 | 2026-06-09 | Improper input validation in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. |
CVE-2026-48289 | Low | 3.5 | 2026-06-09 | Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by an Improper Input Validation vulnerability that could result in a Securi… |
CVE-2026-48288 | Low | 3.5 | 2026-06-09 | Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by an Improper Input Validation vulnerability that could result in a Securi… |
CVE-2026-47641 | Medium | 4.6 | 2026-06-09 | Improper input validation in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. |