CWE-20 · Improper Input Validation (page 13)
Page 13 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-0919 | High | 7.5 | 2026-01-27 | The HTTP parser of Tapo C210 v3, C220 v1 and C520WS v2 cameras improperly handles requests containing an excessively long URL path. An invalid‑URL error path c… |
CVE-2025-65264 | Medium | 5.5 | 2026-01-27 | The kernel driver of CPUID CPU-Z v2.17 and earlier does not validate user-supplied values passed via its IOCTL interface, allowing an attacker to access sensit… |
CVE-2026-24348 | Medium | 6.1 | 2026-01-27 | Multiple cross-site scripting vulnerabilities in Admin UI of EZCast Pro II version 1.17478.146 allow attackers to execute arbitrary JavaScript code in the brow… |
CVE-2026-24347 | Medium | 5.3 | 2026-01-27 | Improper input validation in Admin UI of EZCast Pro II version 1.17478.146 allows attackers to manipulate files in the /tmp directory |
CVE-2026-24345 | High | 8.8 | 2026-01-27 | Cross-Site Request Forgery in Admin UI of EZCast Pro II version 1.17478.146 allows attackers to bypass authorization checks and gain full access to the admin UI |
CVE-2026-24811 | Critical | 9.8 | 2026-01-27 | Vulnerability in root-project root (builtins/zlib modules). This vulnerability is associated with program files inffast.C. This issue affects root. |
CVE-2026-24412 | High | 8.8 | 2026-01-24 | iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have aHeap Buffe… |
CVE-2026-24411 | High | 7.1 | 2026-01-24 | iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have Undefined B… |
CVE-2026-24410 | High | 7.1 | 2026-01-24 | iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have Undefined B… |
CVE-2026-24409 | High | 7.1 | 2026-01-24 | iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have Undefined B… |
CVE-2026-24407 | High | 7.1 | 2026-01-24 | iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have Undefined B… |
CVE-2026-24406 | High | 8.8 | 2026-01-24 | iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have a Heap Buff… |
CVE-2026-24405 | High | 8.8 | 2026-01-24 | iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have a Heap Buff… |
CVE-2026-24404 | High | 7.1 | 2026-01-24 | iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. In versions 2.3.1.1 and below, CIccXmlArray… |
CVE-2026-24403 | High | 7.1 | 2026-01-24 | iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. In versions 2.3.1.1 and below, an integer o… |
CVE-2026-1225 | | 2026-01-22 | ACE vulnerability in configuration file processing by QOS.CH logback-core up to and including version 1.5.24 in Java applications, allows an attacker to insta… | |
CVE-2025-27378 | High | 8.6 | 2026-01-22 | AES contains a SQL injection vulnerability due to an inactive configuration that prevents the latest SQL parsing logic from being applied. When this configurat… |
CVE-2026-23887 | Medium | 5.4 | 2026-01-22 | Group-Office is an enterprise customer relationship management and groupware tool. In versions 6.8.148 and below, and 25.0.1 through 25.0.79, the application s… |
CVE-2026-22598 | | 2026-01-21 | ManageIQ is an open-source management platform. A flaw was found in the ManageIQ API prior to version radjabov-2 where a malformed TimeProfile could be created… | |
CVE-2025-68134 | High | 7.4 | 2026-01-21 | EVerest is an EV charging software stack. Prior to version 2025.10.0, the use of the `assert` function to handle errors frequently causes the module to crash… |
CVE-2025-66960 | High | 7.5 | 2026-01-21 | An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the fs/ggml/gguf.go, function readGGUFV1String reads a string length fro… |
CVE-2025-66959 | High | 7.5 | 2026-01-21 | An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the GGUF decoder |
CVE-2026-22444 | High | 7.1 | 2026-01-21 | The "create core" API of Apache Solr 8.6 through 9.10.0 lacks sufficient input validation on some API parameters, which can cause Solr to check the existence o… |
CVE-2026-0933 | Critical | 9.9 | 2026-01-20 | SummaryA command injection vulnerability (CWE-78) has been found to exist in the `wrangler pages deploy` command. The issue occurs because the `--commit-hash`… |
CVE-2025-66902 | High | 7.5 | 2026-01-20 | An input validation issue in in Pithikos websocket-server v.0.6.4 allows a remote attacker to obtain sensitive information or cause unexpected server behavior… |
CVE-2026-0903 | Medium | 5.4 | 2026-01-20 | Inappropriate implementation in Downloads in Google Chrome on Windows prior to 144.0.7559.59 allowed a remote attacker to bypass dangerous file type protection… |
CVE-2026-23886 | Medium | 5.3 | 2026-01-19 | Swift W3C TraceContext is a Swift implementation of the W3C Trace Context standard, and Swift OTel is an OpenTelemetry Protocol (OTLP) backend for Swift Log, S… |
CVE-2026-23880 | High | 7.3 | 2026-01-19 | OnboardLite is a comprehensive membership lifecycle platform built for student organizations at the University of Central Florida. Versions of the software pri… |
CVE-2026-23841 | Critical | 9.3 | 2026-01-19 | Movary is a web application to track, rate and explore your movie watch history. Due to insufficient input validation, attackers can trigger cross-site scripti… |
CVE-2026-23840 | Critical | 9.3 | 2026-01-19 | Movary is a web application to track, rate and explore your movie watch history. Due to insufficient input validation, attackers can trigger cross-site scripti… |
CVE-2026-23839 | Critical | 9.3 | 2026-01-19 | Movary is a web application to track, rate and explore your movie watch history. Due to insufficient input validation, attackers can trigger cross-site scripti… |
CVE-2026-23836 | Critical | 9.9 | 2026-01-19 | HotCRP is conference review software. A problem introduced in April 2024 in version 3.1 led to inadequately sanitized code generation for HotCRP formulas which… |
CVE-2025-61684 | High | 7.5 | 2026-01-19 | Quicly, an IETF QUIC protocol implementation, is susceptible to a denial-of-service attack prior to commit d9d3df6a8530a102b57d840e39b0311ce5c9e14e. A remote a… |
CVE-2025-29847 | High | 7.5 | 2026-01-19 | A vulnerability in Apache Linkis. Problem Description When using the JDBC engine and da When using the JDBC engine and data source functionality, if the URL p… |
CVE-2025-12718 | Medium | 5.8 | 2026-01-17 | The Quick Contact Form plugin for WordPress is vulnerable to Open Mail Relay in all versions up to, and including, 8.2.6. This is due to the 'qcf_validate_form… |
CVE-2025-48647 | High | 7.8 | 2026-01-16 | In cpm_fwtp_msg_handler of cpm/google/lib/tracepoint/cpm_fwtp_ipc.c, there is a possible memory overwrite due to improper input validation. This could lead to… |
CVE-2025-9014 | High | 7.5 | 2026-01-15 | A Null Pointer Dereference vulnerability exists in the referer header check of the web portal of TP-Link TL-WR841N v14, caused by improper input validation. A… |
CVE-2026-0976 | Low | 3.7 | 2026-01-15 | A flaw was found in Keycloak. This improper input validation vulnerability occurs because Keycloak accepts RFC-compliant matrix parameters in URL path segments… |
CVE-2025-65397 | Medium | 6.8 | 2026-01-14 | An insecure authentication mechanism in the safe_exec.sh startup script of Blurams Flare Camera version 24.1114.151.929 and earlier allows an attacker with phy… |
CVE-2025-68970 | Medium | 6.1 | 2026-01-14 | Permission verification bypass vulnerability in the media library module. Impact: Successful exploitation of this vulnerability may affect service confidential… |
CVE-2025-68964 | Medium | 6.2 | 2026-01-14 | Data verification vulnerability in the HiView module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-22868 | High | 7.5 | 2026-01-13 | go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node can be forced to shutdown/crash using a specially cra… |
CVE-2026-22862 | High | 7.5 | 2026-01-13 | go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node can be forced to shutdown/crash using a specially cra… |
CVE-2026-0543 | Medium | 6.5 | 2026-01-13 | Improper Input Validation (CWE-20) in Kibana's Email Connector can allow an attacker to cause an Excessive Allocation (CAPEC-130) through a specially crafted e… |
CVE-2025-37173 | High | 7.2 | 2026-01-13 | An improper input handling vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems… |
CVE-2026-21272 | High | 8.6 | 2026-01-13 | Dreamweaver Desktop versions 21.6 and earlier are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system write. An att… |
CVE-2026-21271 | High | 8.6 | 2026-01-13 | Dreamweaver Desktop versions 21.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the c… |
CVE-2026-21268 | High | 8.6 | 2026-01-13 | Dreamweaver Desktop versions 21.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the c… |
CVE-2026-20951 | High | 7.8 | 2026-01-13 | Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally. |
CVE-2026-20856 | High | 8.1 | 2026-01-13 | Improper input validation in Windows Server Update Service allows an unauthorized attacker to execute code over a network. |
CVE-2026-20812 | Medium | 6.5 | 2026-01-13 | Improper input validation in Windows LDAP - Lightweight Directory Access Protocol allows an authorized attacker to perform tampering over a network. |
CVE-2026-0406 | High | 8.0 | 2026-01-13 | An insufficient input validation vulnerability in the NETGEAR XR1000v2 allows attackers connected to the router's LAN to execute OS command injections. |
CVE-2026-0404 | High | 8.0 | 2026-01-13 | An insufficient input validation vulnerability in NETGEAR Orbi devices' DHCPv6 functionality allows network adjacent attackers authenticated over WiFi or on… |
CVE-2026-0403 | High | 8.0 | 2026-01-13 | An insufficient input validation vulnerability in NETGEAR Orbi routers allows attackers connected to the router's LAN to execute OS command injections. |
CVE-2026-0878 | High | 8.0 | 2026-01-13 | Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thu… |
CVE-2026-22700 | High | 7.5 | 2026-01-10 | RustCrypto: Elliptic Curves is general purpose Elliptic Curve Cryptography (ECC) support, including types and traits for representing various elliptic curve fo… |
CVE-2026-22699 | High | 7.5 | 2026-01-10 | RustCrypto: Elliptic Curves is general purpose Elliptic Curve Cryptography (ECC) support, including types and traits for representing various elliptic curve fo… |
CVE-2026-22611 | Low | 3.7 | 2026-01-10 | AWS SDK for .NET works with Amazon Web Services to help build scalable solutions with Amazon S3, Amazon DynamoDB, Amazon Glacier, and more. From versions 4.0.0… |
CVE-2025-15035 | High | 7.3 | 2026-01-09 | Improper Input Validation vulnerability in TP-Link Archer AXE75 v1.6 (vpn modules) allows an authenticated adjacent attacker to delete arbitrary server file, l… |
CVE-2025-61546 | Critical | 9.1 | 2026-01-08 | There is an issue on the /PSP/appNET/Store/CartV12.aspx/GetUnitPrice endpoint in edu Business Solutions Print Shop Pro WebDesk version 18.34 (fixed in 19.69) t… |
CVE-2026-22255 | High | 8.8 | 2026-01-08 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color manage… |
CVE-2026-21858 | Critical | 10.0 | 2026-01-08 | n8n is an open source workflow automation platform. Versions starting with 1.65.0 and below 1.121.0 enable an attacker to access files on the underlying server… |
CVE-2026-22047 | High | 8.8 | 2026-01-07 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color manage… |
CVE-2026-22046 | High | 8.8 | 2026-01-07 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color manage… |
CVE-2026-21693 | High | 8.8 | 2026-01-07 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color manage… |
CVE-2026-21692 | High | 8.8 | 2026-01-07 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color manage… |
CVE-2026-21691 | Medium | 5.4 | 2026-01-07 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color manage… |
CVE-2026-21690 | Medium | 6.3 | 2026-01-07 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color manage… |
CVE-2026-21689 | Medium | 6.5 | 2026-01-07 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color manage… |
CVE-2026-21688 | High | 8.8 | 2026-01-07 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color manage… |
CVE-2026-21687 | High | 7.1 | 2026-01-07 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color manage… |
CVE-2026-21686 | High | 7.1 | 2026-01-07 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color manage… |
CVE-2026-21685 | High | 7.1 | 2026-01-07 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color manage… |
CVE-2026-21684 | High | 7.1 | 2026-01-07 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color manage… |
CVE-2026-21683 | High | 8.8 | 2026-01-07 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color manage… |
CVE-2026-21682 | High | 8.8 | 2026-01-07 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color manage… |
CVE-2026-21681 | High | 7.1 | 2026-01-07 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color manage… |
CVE-2026-21679 | High | 8.8 | 2026-01-07 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2… |
CVE-2026-21678 | High | 7.8 | 2026-01-07 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2… |
CVE-2026-21506 | Medium | 5.5 | 2026-01-07 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2… |
CVE-2026-21505 | Medium | 5.5 | 2026-01-07 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2… |
CVE-2026-21503 | Medium | 6.1 | 2026-01-07 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2… |
CVE-2026-21502 | Medium | 5.5 | 2026-01-07 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2… |
CVE-2026-21501 | Medium | 5.5 | 2026-01-07 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2… |
CVE-2026-21500 | Medium | 5.5 | 2026-01-07 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2… |
CVE-2026-21499 | Medium | 5.5 | 2026-01-07 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2… |
CVE-2026-21498 | Medium | 5.5 | 2026-01-07 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2… |
CVE-2026-21497 | Medium | 5.5 | 2026-01-07 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2… |
CVE-2026-21496 | Medium | 5.5 | 2026-01-07 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2… |
CVE-2026-21495 | Medium | 5.5 | 2026-01-07 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2… |
CVE-2025-66786 | High | 7.5 | 2026-01-07 | OpenAirInterface CN5G AMF<=v2.0.1 There is a logical error when processing JSON format requests. Unauthorized remote attackers can send malicious JSON data to… |
CVE-2025-12543 | Critical | 9.6 | 2026-01-07 | A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly val… |
CVE-2026-21677 | High | 8.8 | 2026-01-06 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below have Undefined Behavior in its CIccCLUT… |
CVE-2026-21487 | Medium | 6.1 | 2026-01-06 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below have an Out-of-bounds Read, Use of Out-… |
CVE-2026-21485 | High | 8.8 | 2026-01-06 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below are prone to have Undefined Behavior (U… |
CVE-2026-21675 | Critical | 9.8 | 2026-01-06 | iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below contain a Use After Free vulnerability in… |
CVE-2025-61916 | High | 7.9 | 2026-01-05 | Spinnaker is an open source, multi-cloud continuous delivery platform. Versions prior to 2025.1.6, 2025.2.3, and 2025.3.0 are vulnerable to server-side request… |
CVE-2025-52519 | High | 7.1 | 2026-01-05 | An issue was discovered in the Camera in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 2400, 1580, and 2500. Improper validation of… |
CVE-2025-15453 | Medium | 6.3 | 2026-01-05 | A security vulnerability has been detected in milvus up to 2.6.7. This vulnerability affects the function expr.Exec of the file pkg/util/expr/expr.go of the co… |
CVE-2025-15438 | Medium | 4.7 | 2026-01-02 | A vulnerability was determined in PluXml up to 5.8.22. Affected is the function FileCookieJar::__destruct of the file core/admin/medias.php of the component Me… |