CWE-20 · Improper Input Validation (page 12)
Page 12 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-69278 | High | 7.5 | 2026-03-09 | In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privi… |
CVE-2025-61616 | High | 7.5 | 2026-03-09 | In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privi… |
CVE-2025-61615 | High | 7.5 | 2026-03-09 | In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privi… |
CVE-2025-61614 | High | 7.5 | 2026-03-09 | In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privi… |
CVE-2025-61613 | High | 7.5 | 2026-03-09 | In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privi… |
CVE-2025-61612 | High | 7.5 | 2026-03-09 | In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privi… |
CVE-2025-61611 | High | 7.5 | 2026-03-09 | In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed.. |
CVE-2026-29791 | Medium | 4.9 | 2026-03-06 | Agentgateway is an open source data plane for agentic AI connectivity within or across any agent framework or environment. Prior to version 0.12.0, when conver… |
CVE-2026-29046 | High | 8.2 | 2026-03-06 | TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Prior to version 2.04, TinyWeb accepts request header values and later maps them into CGI en… |
CVE-2026-0848 | Critical | 10.0 | 2026-03-05 | NLTK versions <=3.9.2 are vulnerable to arbitrary code execution due to improper input validation in the StanfordSegmenter module. The module dynamically loads… |
CVE-2025-7375 | Medium | 6.5 | 2026-03-05 | A denial-of-service (DoS) vulnerability was identified in Omada EAP610 v3. An attacker with adjacent network access can send crafted requests to cause the dev… |
CVE-2025-11143 | Low | 3.7 | 2026-03-05 | The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using mu… |
CVE-2025-41257 | Medium | 4.8 | 2026-03-04 | Suprema’s BioStar 2 in version 2.9.11.6 allows users to set new password without providing the current one. Exploiting this flaw combined with other vulnerabil… |
CVE-2026-3545 | Critical | 9.6 | 2026-03-04 | Insufficient data validation in Navigation in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform a sandbox escape via a cra… |
CVE-2026-20020 | Medium | 6.8 | 2026-03-04 | A vulnerability in the OSPF protocol of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an unauthenticated, adjacent attacker to c… |
CVE-2026-27443 | High | 7.5 | 2026-03-04 | SEPPmail Secure Email Gateway before version 15.0.1 does not properly sanitize the headers from S/MIME protected MIME entities, allowing an attacker to control… |
CVE-2026-3204 | Critical | 9.8 | 2026-03-03 | Improper input validation in the error message page in Devolutions Server 2025.3.16 and earlier allows remote attackers to spoof the displayed error message v… |
CVE-2026-2590 | Critical | 9.8 | 2026-03-03 | Improper enforcement of the Disable password saving in vaults setting in the connection entry component in Devolutions Remote Desktop Manager 2025.3.30 and e… |
CVE-2024-55020 | Critical | 9.8 | 2026-03-03 | A command injection vulnerability in the DHCP activation feature of Weintek cMT-3072XH2 easyweb Web Version v2.1.53, OS v20231011 allows attackers to execute a… |
CVE-2025-62816 | Medium | 5.5 | 2026-03-03 | An issue was discovered in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, and 2500. Unvalidated VS4L_VERTEXIOC_BOOTUP input leads to a den… |
CVE-2026-0034 | High | 8.4 | 2026-03-02 | In setPackageOrComponentEnabled of ManagedServices.java, there is a possible notification policy desync due to improper input validation. This could lead to lo… |
CVE-2026-0015 | Medium | 6.2 | 2026-03-02 | In multiple locations of AppOpsService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local denial… |
CVE-2026-0014 | Medium | 6.2 | 2026-03-02 | In isPackageNullOrSystem of AppOpsService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local den… |
CVE-2025-48644 | Medium | 5.5 | 2026-03-02 | In multiple locations, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no ad… |
CVE-2025-48587 | Medium | 6.2 | 2026-03-02 | In multiple functions of ProfilingService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local den… |
CVE-2025-48585 | Medium | 6.2 | 2026-03-02 | In multiple functions of ProfilingService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local den… |
CVE-2026-28421 | Medium | 5.3 | 2026-02-27 | Vim is an open source, command line text editor. Versions prior to 9.2.0077 have a heap-buffer-overflow and a segmentation fault (SEGV) exist in Vim's swap fil… |
CVE-2018-25160 | Medium | 6.5 | 2026-02-27 | HTTP::Session2 versions through 1.09 for Perl does not validate the format of user provided session ids, enabling code injection or other impact depending on s… |
CVE-2026-2880 | Critical | 9.1 | 2026-02-27 | A vulnerability in @fastify/middie versions < 9.2.0 can result in authentication/authorization bypass when using path-scoped middleware (for example, app.use('… |
CVE-2026-2750 | Critical | 9.1 | 2026-02-27 | Improper Input Validation vulnerability in Centreon Centreon Open Tickets on Central Server on Linux (Centreon Open Tickets modules).This issue affects Centreo… |
CVE-2026-26935 | Medium | 6.5 | 2026-02-26 | Improper Input Validation (CWE-20) in the internal Content Connectors search endpoint in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-1… |
CVE-2026-27959 | High | 7.5 | 2026-02-26 | Koa is middleware for Node.js using ES2017 async functions. Prior to versions 3.1.2 and 2.16.4, Koa's `ctx.hostname` API performs naive parsing of the HTTP Hos… |
CVE-2026-27818 | High | 7.5 | 2026-02-26 | TerriaJS-Server is a NodeJS Express server for TerriaJS, a library for building web-based geospatial data explorers. A validation bug in versions prior to 4.0… |
CVE-2026-25941 | Medium | 4.3 | 2026-02-25 | FreeRDP is a free implementation of the Remote Desktop Protocol. Versions on the 2.x branch prior to to 2.11.8 and on the 3.x branch prior to 3.23.0 have an ou… |
CVE-2026-27702 | Critical | 9.9 | 2026-02-25 | Budibase is a low code platform for creating internal tools, workflows, and admin panels. Prior to version 3.30.4, an unsafe `eval()` vulnerability in Budibase… |
CVE-2026-27607 | High | 8.1 | 2026-02-25 | RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.56 through 1.0.0-alpha.82, RustFS does not validate policy conditions in p… |
CVE-2025-14963 | High | 7.8 | 2026-02-24 | A vulnerability identified in the HX Agent driver file fekern.sys allowed a threat actor with local user access the ability to gain elevated system privileges… |
CVE-2026-27590 | Critical | 9.8 | 2026-02-24 | Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's FastCGI path splitting logic computes the split index on a lo… |
CVE-2026-27585 | Medium | 6.5 | 2026-02-24 | Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the path sanitization routine in file matcher doesn't sanitize backsl… |
CVE-2026-27642 | High | 7.5 | 2026-02-24 | free5gc UDM provides Unified Data Management (UDM) for free5GC, an open-source project for 5th generation (5G) mobile core networks. In versions up to and incl… |
CVE-2026-21864 | Medium | 6.5 | 2026-02-24 | Valkey-Bloom is a Rust based Valkey module which brings a Bloom Filter (Module) data type into the Valkey distributed key-value database. Prior to commit a6861… |
CVE-2025-69251 | Medium | 5.3 | 2026-02-24 | free5gc UDM provides Unified Data Management (UDM) for free5GC, an open-source project for 5th generation (5G) mobile core networks. In versions up to and incl… |
CVE-2025-69250 | High | 7.5 | 2026-02-24 | free5gc UDM provides Unified Data Management (UDM) for free5GC, an open-source project for 5th generation (5G) mobile core networks. In versions up to and incl… |
CVE-2025-69232 | High | 7.5 | 2026-02-23 | free5GC is an open-source project for 5th generation (5G) mobile core networks. free5GC go-upf versions up to and including 1.2.6, corresponding to free5gc smf… |
CVE-2026-27623 | High | 7.5 | 2026-02-23 | Valkey is a distributed key-value database. Starting in version 9.0.0 and prior to version 9.0.3, a malicious actor with network access to Valkey can cause the… |
CVE-2026-22568 | Medium | 5.5 | 2026-02-23 | Improper neutralization of special elements in user-supplied input within the ZIA Admin UI could allow an authenticated administrator to access or retrieve una… |
CVE-2026-22567 | High | 7.6 | 2026-02-23 | Improper validation of user-supplied input in the ZIA Admin UI could allow an authenticated administrator to initiate backend functions through specific input… |
CVE-2026-2970 | Medium | 4.6 | 2026-02-23 | A vulnerability has been found in datapizza-labs datapizza-ai 0.0.2. Affected by this vulnerability is the function RedisCache of the file datapizza-ai-cache/r… |
CVE-2026-2898 | Medium | 5.5 | 2026-02-22 | A vulnerability was detected in funadmin up to 7.1.0-rc4. This issue affects the function getMember of the file app/common/service/AuthCloudService.php of the… |
CVE-2026-27170 | High | 7.1 | 2026-02-21 | OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. In versions 1.1.2-alpha and below, URL ingest allows ov… |
CVE-2026-26953 | Medium | 5.4 | 2026-02-19 | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. Versions 6.0 and above have a S… |
CVE-2026-26952 | Medium | 5.4 | 2026-02-19 | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. Versions 6.4 and below are vulne… |
CVE-2026-26314 | High | 7.5 | 2026-02-19 | go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. Prior to version 1.16.9, a vulnerable node can be forced to shutdown/cr… |
CVE-2026-26063 | | 2026-02-19 | CediPay is a crypto-to-fiat app for the Ghanaian market. A vulnerability in CediPay prior to version 1.2.3 allows attackers to bypass input validation in the t… | |
CVE-2025-13587 | Medium | 6.5 | 2026-02-19 | The Two Factor (2FA) Authentication via Email plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in versions up to, and including, 1.9.8. T… |
CVE-2026-24734 | High | 7.5 | 2026-02-17 | Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomc… |
CVE-2026-24733 | Low | 3.7 | 2026-02-17 | Improper Input Validation vulnerability in Apache Tomcat. Tomcat did not limit HTTP/0.9 requests to the GET method. If a security constraint was configured… |
CVE-2025-66614 | Critical | 9.1 | 2026-02-17 | Improper Input Validation vulnerability. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 throu… |
CVE-2026-2555 | Medium | 5.0 | 2026-02-16 | A weakness has been identified in JeecgBoot 3.9.1. This vulnerability affects the function importDocumentFromZip of the file org/jeecg/modules/airag/llm/contro… |
CVE-2025-70123 | High | 7.5 | 2026-02-13 | An improper input validation and protocol compliance vulnerability in free5GC v4.0.1 allows remote attackers to cause a denial of service. The UPF incorrectly… |
CVE-2026-2391 | Low | 3.7 | 2026-02-12 | ### Summary The `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-… |
CVE-2026-20627 | Medium | 5.5 | 2026-02-11 | An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in iOS 26.3 and iPadOS 26.3… |
CVE-2026-21258 | Medium | 5.5 | 2026-02-10 | Improper input validation in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-21247 | High | 7.3 | 2026-02-10 | Improper input validation in Windows Hyper-V allows an authorized attacker to execute code locally. |
CVE-2026-21229 | High | 8.0 | 2026-02-10 | Improper input validation in Power BI allows an authorized attacker to execute code over a network. |
CVE-2025-25210 | High | 8.2 | 2026-02-10 | Improper input validation for some Server Firmware Update Utility(SysFwUpdt) before version 16.0.12 within Ring 3: User Applications may allow an escalation of… |
CVE-2025-22453 | High | 7.5 | 2026-02-10 | Improper input validation for some Server Firmware Update Utility(SysFwUpdt) before version 16.0.12 within Ring 3: User Applications may allow an escalation of… |
CVE-2026-25892 | High | 7.5 | 2026-02-09 | Adminer is open-source database management software. Adminer v5.4.1 and earlier has a version check mechanism where adminer.org sends signed version info via J… |
CVE-2026-2113 | High | 7.3 | 2026-02-07 | A security vulnerability has been detected in yuan1994 tpadmin up to 1.3.12. This affects an unknown part in the library /public/static/admin/lib/webuploader/0… |
CVE-2026-25631 | Medium | 6.5 | 2026-02-06 | n8n is an open source workflow automation platform. Prior to 1.121.0, there is a vulnerability in the HTTP Request node's credential domain validation allowed… |
CVE-2026-25723 | Medium | 6.5 | 2026-02-06 | Claude Code is an agentic coding tool. Prior to version 2.0.55, Claude Code failed to properly validate commands using piped sed operations with the echo comma… |
CVE-2026-25722 | Critical | 9.1 | 2026-02-06 | Claude Code is an agentic coding tool. Prior to version 2.0.57, Claude Code failed to properly validate directory changes when combined with write operations t… |
CVE-2025-15566 | High | 8.8 | 2026-02-06 | A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/auth-proxy-set-headers` Ingress annotation can be used to inject config… |
CVE-2025-12131 | Medium | 6.5 | 2026-02-05 | A truncated 802.15.4 packet can lead to an assert, resulting in a denial of service. |
CVE-2026-25514 | High | 8.8 | 2026-02-04 | FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a critical SQL injection… |
CVE-2026-25513 | High | 8.8 | 2026-02-04 | FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a critical SQL injection… |
CVE-2026-21893 | High | 7.2 | 2026-02-04 | n8n is an open source workflow automation platform. From version 0.187.0 to before 1.120.3, a command injection vulnerability was identified in n8n’s community… |
CVE-2026-24512 | High | 8.8 | 2026-02-03 | A security issue was discovered in ingress-nginx where the `rules.http.paths.path` Ingress field can be used to inject configuration into nginx. This can lead… |
CVE-2026-1580 | High | 8.8 | 2026-02-03 | A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/auth-method` Ingress annotation can be used to inject configuration int… |
CVE-2026-22220 | Medium | 4.5 | 2026-02-03 | A lack of proper input validation in the HTTP processing path in TP-Link Archer BE230 v1.2 (web modules) may allow a crafted request to cause the device’s web… |
CVE-2026-24936 | Critical | 9.8 | 2026-02-03 | When a specific function is enabled while joining a AD Domain from ADM, an improper input parameters validation vulnerability in a specific CGI program allowin… |
CVE-2025-67484 | Critical | 9.8 | 2026-02-03 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiFormatXml.Php. This issue affects MediaWi… |
CVE-2025-67480 | Medium | 6.5 | 2026-02-03 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiQueryRevisionsBase.Php. This issue affect… |
CVE-2025-61652 | | 2026-02-03 | Vulnerability in Wikimedia Foundation DiscussionTools.This issue affects DiscussionTools: from * before 1.43.4, 1.44.1. | |
CVE-2026-1691 | Medium | 6.3 | 2026-01-30 | A vulnerability has been found in bolo-solo up to 2.6.4. This impacts the function importMarkdownsSync of the file src/main/java/org/b3log/solo/bolo/prop/Backu… |
CVE-2026-25128 | High | 7.5 | 2026-01-30 | fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 5… |
CVE-2024-4027 | High | 7.5 | 2026-01-30 | A flaw was found in Undertow. Servlets using a method that calls HttpServletRequestImpl.getParameterNames() can cause an OutOfMemoryError when the client sends… |
CVE-2026-25126 | High | 7.1 | 2026-01-29 | PolarLearn is a free and open-source learning program. Prior to version 0-PRERELEASE-15, the vote API route (`POST /api/v1/forum/vote`) trusts the JSON body’s… |
CVE-2026-25117 | | 2026-01-29 | pwn.college DOJO is an education platform for learning cybersecurity. Prior to commit e33da14449a5abcff507e554f66e2141d6683b0a, missing sandboxing on `/workspa… | |
CVE-2025-15545 | Medium | 6.8 | 2026-01-29 | The backup restore function does not properly validate unexpected or unrecognized tags within the backup file. When such a crafted file is restored, the inject… |
CVE-2025-71011 | Medium | 6.2 | 2026-01-29 | An input validation vulnerability in the flow.Tensor.new_empty/flow.Tensor.new_ones/flow.Tensor.new_zeros component of OneFlow v0.9.0 allows attackers to cause… |
CVE-2025-71009 | Medium | 6.2 | 2026-01-29 | An input validation vulnerability in the flow.scatter/flow.scatter_add component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a cr… |
CVE-2026-23571 | Medium | 6.8 | 2026-01-29 | A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Nomad-RunPkgStatusRequest instruction. Improper… |
CVE-2026-23570 | Medium | 6.5 | 2026-01-29 | A missing validation of a user-controlled value in the TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version… |
CVE-2026-23566 | Medium | 6.5 | 2026-01-29 | A vulnerability in TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 26.1 for Windows allows an attacker… |
CVE-2026-24856 | High | 7.8 | 2026-01-28 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Versions prior to… |
CVE-2025-71007 | High | 7.5 | 2026-01-28 | An input validation vulnerability in the oneflow.index_add component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input. |
CVE-2025-71003 | High | 7.5 | 2026-01-28 | An input validation vulnerability in the flow.arange() component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input. |
CVE-2025-59895 | High | 7.5 | 2026-01-28 | Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a remote denial-of-service (DoS) vulnerability in the configuration restore f… |
CVE-2026-1315 | High | 7.5 | 2026-01-27 | By sending crafted files to the firmware update endpoint of Tapo C220 v1 and C520WS v2, the device terminates core system services before verifying authenticat… |