CWE-20 · Improper Input Validation (page 14)
Page 14 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-7945 | Low | 3.1 | 2026-05-06 | Insufficient validation of untrusted input in COOP in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process t… |
CVE-2026-7944 | Low | 3.1 | 2026-05-06 | Insufficient validation of untrusted input in Persistent Cache in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the render… |
CVE-2026-7943 | Medium | 4.2 | 2026-05-06 | Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process… |
CVE-2026-7941 | Medium | 4.4 | 2026-05-06 | Insufficient validation of untrusted input in Mobile in Google Chrome on Android prior to 148.0.7778.96 allowed a local attacker to inject arbitrary scripts or… |
CVE-2026-7934 | Medium | 4.2 | 2026-05-06 | Insufficient validation of untrusted input in Popup Blocker in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer… |
CVE-2026-7931 | Medium | 5.4 | 2026-05-06 | Insufficient validation of untrusted input in iOS in Google Chrome on iOS prior to 148.0.7778.96 allowed a remote attacker to perform UI spoofing via a crafted… |
CVE-2026-7916 | High | 8.3 | 2026-05-06 | Insufficient data validation in InterestGroups in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to po… |
CVE-2026-7915 | Medium | 4.3 | 2026-05-06 | Insufficient data validation in DevTools in Google Chrome on Android prior to 148.0.7778.96 allowed a remote attacker to bypass navigation restrictions via a c… |
CVE-2026-7905 | High | 8.3 | 2026-05-06 | Insufficient validation of untrusted input in Media in Google Chrome on Android prior to 148.0.7778.96 allowed a remote attacker who had compromised the render… |
CVE-2026-40068 | High | 8.8 | 2026-05-05 | In versions 2.1.63 through 2.1.83 of Claude Code, the folder trust determination logic used the git worktree commondir file without validating its contents. An… |
CVE-2026-32603 | Medium | 6.5 | 2026-05-05 | Sandboxie is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, a local denial of service vulnerability exists in the… |
CVE-2026-6180 | High | 8.1 | 2026-05-05 | A race condition exists in PaperCut MF when processing badge-swipe data from certain HP multifunction devices. Under specific network conditions involving drop… |
CVE-2026-42812 | Critical | 9.9 | 2026-05-04 | In Apache Iceberg, the table's metadata files are control files: they tell readers which data files belong to the table and which table version to read. `wr… |
CVE-2026-42811 | Critical | 9.9 | 2026-05-04 | In plain terms, Apache Polaris is supposed to issue short-lived GCS credentials that only work for one table's files, but a crafted namespace or table name can… |
CVE-2026-42810 | Critical | 9.9 | 2026-05-04 | Apache Polaris accepts literal `*` characters in namespace and table names. When it later builds temporary S3 access policies for delegated table access, those… |
CVE-2026-42809 | Critical | 9.9 | 2026-05-04 | Apache Polaris can issue broad temporary ("vended") storage credentials during staged table creation before the effective table location has been validated or … |
CVE-2026-37458 | Medium | 6.5 | 2026-05-04 | Missing input validation in the MP_REACH_NLRI component of FRRouting (FRR) stable/10.0 to stable/10.6 allows authenticated attackers to cause a Denial of Servi… |
CVE-2026-7712 | Medium | 6.3 | 2026-05-04 | A security vulnerability has been detected in MindsDB up to 26.01. Affected is the function pickle.loads of the component Pickle Handler. The manipulation lead… |
CVE-2026-7597 | Medium | 6.3 | 2026-05-01 | A vulnerability was found in mem0ai mem0 up to 1.0.11. This affects the function pickle.load/pickle.dump of the file mem0/vector_stores/faiss.py. Performing a… |
CVE-2025-52347 | High | 7.8 | 2026-05-01 | An issue in the component DirectIo64.sys of PassMark BurnInTest v11.0 Build 1011, OSForensics v11.1 Build 1007, and PerformanceTest v11.1 Build 1004 allows att… |
CVE-2026-1577 | Medium | 6.5 | 2026-04-30 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a… |
CVE-2025-46115 | High | 7.5 | 2026-04-30 | An issue in open5gs v.2.7.3 allows a remote attacker to cause a denial of service via a crafted PDU Session Modification Request |
CVE-2026-5174 | High | 7.7 | 2026-04-30 | Improper input validation vulnerability in Progress Software MOVEit Automation allows Privilege Escalation. This issue affects MOVEit Automation: from 2025.1… |
CVE-2025-14576 | High | 7.8 | 2026-04-30 | Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage co… |
CVE-2026-1858 | Medium | 4.8 | 2026-04-29 | wget2 accepts a server certificate with incorrect Key Usage (KU) or Extended Key Usage (EKU). If the attackers compromise a certificate (with the associated pr… |
CVE-2026-30769 | High | 7.8 | 2026-04-29 | An issue in the TVicPort64.sys component of EnTech Taiwan TVicPort Product v4.0, File v5.2.1.0 allows attackers to escalate privileges via sending crafted IOCT… |
CVE-2026-7360 | Low | 3.1 | 2026-04-28 | Insufficient validation of untrusted input. in Compositing in Google Chrome prior to 147.0.7727.138 allowed a remote attacker who had compromised the renderer… |
CVE-2026-7345 | High | 8.3 | 2026-04-28 | Insufficient validation of untrusted input in Feedback in Google Chrome prior to 147.0.7727.138 allowed a remote attacker who had compromised the renderer proc… |
CVE-2026-7317 | Medium | 5.0 | 2026-04-28 | A vulnerability was found in Grav CMS up to 1.7.49.5/2.0.0-beta.1. Affected by this vulnerability is the function FileCache::doGet of the file system/src/Grav/… |
CVE-2026-24204 | Medium | 6.5 | 2026-04-28 | NVIDIA Flare SDK contains a vulnerability where an Attacker may cause an Improper Input Validation by path traversing. A successful exploit of this vulnerabili… |
CVE-2024-54011 | Medium | 6.5 | 2026-04-28 | Penetration Testing engineers at Amazon have discovered a flaw where the camera system fails to properly handle data supplied in certain requests, causing a se… |
CVE-2026-5941 | High | 7.8 | 2026-04-27 | Parsing logic flaws cause non-signature data to be misidentified as valid signatures when processing malformed form field hierarchies, leading to invalid memor… |
CVE-2026-41044 | High | 8.8 | 2026-04-24 | Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ… |
CVE-2026-40466 | High | 8.8 | 2026-04-24 | Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache Activ… |
CVE-2026-41268 | Critical | 9.8 | 2026-04-23 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, Flowise is vulnerable to a critical unauthenticated re… |
CVE-2026-34066 | Medium | 5.3 | 2026-04-22 | nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. Prior to version 1.3.0, `HistoryStore::put_historic_txns` uses an `assert!`… |
CVE-2026-33471 | Critical | 9.6 | 2026-04-22 | nimiq-block contains block primitives to be used in Nimiq's Rust implementation. `SkipBlockProof::verify` computes its quorum check using `BitSet.len()`, then… |
CVE-2026-35380 | Medium | 5.5 | 2026-04-22 | A logic error in the cut utility of uutils coreutils causes the program to incorrectly interpret the literal two-byte string '' (two single quotes) as an empty… |
CVE-2026-35377 | Low | 3.3 | 2026-04-22 | A logic error in the env utility of uutils coreutils causes a failure to correctly parse command-line arguments when utilizing the -S (split-string) option. In… |
CVE-2026-35369 | Medium | 5.5 | 2026-04-22 | An argument parsing error in the kill utility of uutils coreutils incorrectly interprets kill -1 as a request to send the default signal (SIGTERM) to PID -1. S… |
CVE-2026-35347 | Medium | 4.4 | 2026-04-22 | The comm utility in uutils coreutils incorrectly consumes data from non-regular file inputs before performing comparison operations. The are_files_identical fu… |
CVE-2026-31192 | Medium | 6.5 | 2026-04-22 | Insufficient validation of Chrome extension identifiers in Raindrop.io Bookmark Manager Web App 5.6.76.0 allows attackers to obtain sensitive user data via a c… |
CVE-2026-22748 | Medium | 5.3 | 2026-04-22 | Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder, it must configure an O… |
CVE-2026-40871 | High | 7.2 | 2026-04-21 | mailcow: dockerized is an open source groupware/email suite based on docker. Versions prior to 2026-03b have a second-order SQL injection vulnerability in the… |
CVE-2026-6779 | Medium | 5.3 | 2026-04-21 | Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150 and Thunderbird 150. |
CVE-2026-6777 | Medium | 5.3 | 2026-04-21 | Other issue in the Networking: DNS component. This vulnerability was fixed in Firefox 150 and Thunderbird 150. |
CVE-2025-13826 | | 2026-04-21 | Zervit's portable HTTP/web server is vulnerable to remote DoS attacks when a configuration reset request is made. The vulnerability is caused by inadequate val… | |
CVE-2026-6675 | Medium | 5.3 | 2026-04-21 | The Responsive Blocks – Page Builder for Blocks & Patterns plugin for WordPress is vulnerable to Unauthenticated Open Email Relay in all versions up to, and in… |
CVE-2026-39386 | High | 8.8 | 2026-04-21 | Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC In versions 3.0.0 through 3.0.10 and 3.1.0 through 3.1.1, any authenticated user ca… |
CVE-2026-32604 | Critical | 9.9 | 2026-04-20 | Spinnaker is an open source, multi-cloud continuous delivery platform. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, a bad actor can execute… |
CVE-2026-24505 | High | 7.2 | 2026-04-20 | Dell PowerProtect Data Domain, versions 8.5 through 8.6 contain an improper input validation vulnerability. A high privileged attacker with remote access could… |
CVE-2026-24504 | High | 7.2 | 2026-04-20 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1… |
CVE-2026-6626 | Medium | 6.3 | 2026-04-20 | A vulnerability was detected in Cockpit-HQ Cockpit up to 2.13.5. Affected by this issue is some unknown functionality of the component Asset Handler/Aggregate… |
CVE-2026-40317 | Critical | 9.3 | 2026-04-18 | NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly. In versions prior to 0.24, Syscall 12 (JumpToUser) accepts an arbitrary entry poin… |
CVE-2026-33436 | Low | 3.1 | 2026-04-17 | Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. In versions prior to 2.0.0, file upload endpoints render use… |
CVE-2026-21733 | High | 7.3 | 2026-04-17 | Software installed and run as a non-privileged user may conduct improper GPU system calls to gain write permission to read-only wrapped user-mode memory and fi… |
CVE-2026-6409 | | 2026-04-16 | A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically… | |
CVE-2026-22615 | Medium | 6.0 | 2026-04-16 | Due to improper input validation in one of the Eaton Intelligent Power Protector (IPP) XML, it is possible for an attacker with admin privileges and access to… |
CVE-2026-40261 | High | 8.8 | 2026-04-15 | Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::syncCode… |
CVE-2026-40176 | High | 7.8 | 2026-04-15 | Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::generate… |
CVE-2026-1782 | Medium | 5.3 | 2026-04-15 | The MetForm Pro plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 3.9.7 This is due to the payment integra… |
CVE-2026-6328 | | 2026-04-15 | Improper input validation, Improper verification of cryptographic signature vulnerability in XQUIC Project XQUIC xquic on Linux (QUIC protocol implementation… | |
CVE-2026-39399 | Critical | 9.6 | 2026-04-14 | NuGet Gallery is a package repository that powers nuget.org. A security vulnerability exists in the NuGetGallery backend job’s handling of .nuspec files within… |
CVE-2026-35031 | Critical | 9.9 | 2026-04-14 | Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a vulnerability chain in the subtitle upload endpoint (POST /Videos/{ite… |
CVE-2026-27299 | Medium | 6.3 | 2026-04-14 | Adobe Framemaker versions 2022.8 and earlier are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read. An attac… |
CVE-2026-27306 | High | 8.4 | 2026-04-14 | ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the… |
CVE-2026-27304 | Critical | 9.3 | 2026-04-14 | ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the… |
CVE-2026-27282 | High | 7.5 | 2026-04-14 | ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An a… |
CVE-2026-24893 | High | 8.8 | 2026-04-14 | openITCOCKPIT is an open source monitoring tool built for different monitoring engines. openITCOCKPIT Community Edition prior to version 5.5.2 contains a comma… |
CVE-2026-33826 | High | 8.0 | 2026-04-14 | Improper input validation in Windows Active Directory allows an authorized attacker to execute code over an adjacent network. |
CVE-2026-33116 | High | 7.5 | 2026-04-14 | Loop with unreachable exit condition ('infinite loop') in .NET, .NET Framework, Visual Studio allows an unauthorized attacker to deny service over a network. |
CVE-2026-32203 | High | 7.5 | 2026-04-14 | Stack-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to deny service over a network. |
CVE-2026-32201 | Medium | 6.5 | 2026-04-14 | Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-32168 | High | 7.8 | 2026-04-14 | Improper input validation in Azure Monitor Agent allows an authorized attacker to elevate privileges locally. |
CVE-2026-32149 | High | 7.3 | 2026-04-14 | Improper input validation in Windows Hyper-V allows an authorized attacker to execute code locally. |
CVE-2026-27928 | High | 8.7 | 2026-04-14 | Improper input validation in Windows Hello allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-27913 | High | 7.7 | 2026-04-14 | Improper input validation in Windows BitLocker allows an unauthorized attacker to bypass a security feature locally. |
CVE-2026-27906 | Medium | 4.4 | 2026-04-14 | Improper input validation in Windows Hello allows an authorized attacker to bypass a security feature locally. |
CVE-2026-26170 | High | 7.8 | 2026-04-14 | Improper input validation in Microsoft PowerShell allows an authorized attacker to elevate privileges locally. |
CVE-2026-26161 | High | 7.8 | 2026-04-14 | Untrusted pointer dereference in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-26156 | High | 7.8 | 2026-04-14 | Heap-based buffer overflow in Windows Hyper-V allows an unauthorized attacker to execute code locally. |
CVE-2026-26154 | High | 7.5 | 2026-04-14 | Improper input validation in Windows Server Update Service allows an unauthorized attacker to perform tampering over a network. |
CVE-2026-26143 | High | 7.8 | 2026-04-14 | Improper input validation in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature locally. |
CVE-2026-39417 | Medium | 4.6 | 2026-04-14 | MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain an incomplete fix for CVE-2025-53928, where a Remote Code Execution vulne… |
CVE-2026-33948 | Medium | 5.3 | 2026-04-14 | jq is a command-line JSON processor. Commits before 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b contain a vulnerability where CLI input parsing allows validation… |
CVE-2026-22565 | High | 7.5 | 2026-04-13 | An Improper Input Validation vulnerability could allow a malicious actor with access to the UniFi Play network to cause the device to stop responding. Affec… |
CVE-2026-22563 | Critical | 9.8 | 2026-04-13 | A series of Improper Input Validation vulnerabilities could allow a Command Injection by a malicious actor with access to the UniFi Play network. Affected Pr… |
CVE-2026-6231 | Medium | 4.3 | 2026-04-13 | The bson_validate function may return early on specific inputs and incorrectly report success. This behavior could result in skipping validation for BSON data… |
CVE-2026-34855 | Medium | 5.7 | 2026-04-13 | Out-of-bounds write vulnerability in the kernel module. Impact: Successful exploitation of this vulnerability will affect availability and confidentiality. |
CVE-2026-40162 | High | 7.1 | 2026-04-10 | Bugsink is a self-hosted error tracking tool. In 2.1.0, an authenticated file write vulnerability was identified in Bugsink 2.1.0 in the artifact bundle assemb… |
CVE-2026-5500 | Medium | 5.9 | 2026-04-10 | wolfSSL's wc_PKCS7_DecodeAuthEnvelopedData() does not properly sanitize the AES-GCM authentication tag length received and has no lower bounds check. A man-in-… |
CVE-2026-33797 | High | 7.4 | 2026-04-09 | An Improper Input Validation vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker, sending a specific g… |
CVE-2026-32990 | Medium | 5.3 | 2026-04-09 | Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614. This issue affects Apache Tomcat: from 11.0.15 through 11… |
CVE-2026-5329 | High | 8.5 | 2026-04-09 | Rapid7 Velociraptor versions prior to 0.76.2 contain an improper input validation vulnerability in the client monitoring message handler on the Velociraptor se… |
CVE-2026-34178 | Critical | 9.1 | 2026-04-09 | In Canonical LXD before 6.8, the backup import path validates project restrictions against backup/index.yaml in the supplied tar archive but creates the instan… |
CVE-2026-5919 | Medium | 6.5 | 2026-04-08 | Insufficient validation of untrusted input in WebSockets in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer pro… |
CVE-2026-5915 | High | 8.1 | 2026-04-08 | Insufficient validation of untrusted input in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform an out of bounds memory write… |
CVE-2026-5887 | Medium | 4.3 | 2026-04-08 | Insufficient validation of untrusted input in Downloads in Google Chrome on Windows prior to 147.0.7727.55 allowed a remote attacker to bypass download restric… |
CVE-2026-5885 | Medium | 6.5 | 2026-04-08 | Insufficient validation of untrusted input in WebML in Google Chrome on Windows prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitiv… |
CVE-2026-5884 | High | 8.8 | 2026-04-08 | Insufficient validation of untrusted input in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process… |