CWE-20 · Improper Input Validation (page 15)
Page 15 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-5879 | High | 8.8 | 2026-04-08 | Insufficient validation of untrusted input in ANGLE in Google Chrome on Mac prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a… |
CVE-2026-39410 | Medium | 4.8 | 2026-04-08 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a discrepancy between browser cookie parsing and parse(… |
CVE-2026-34197 | High | 8.8 | 2026-04-07 | Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ… |
CVE-2025-57834 | High | 7.5 | 2026-04-06 | An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem (Exynos 980, 850, 990, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580… |
CVE-2025-48651 | Medium | 5.5 | 2026-04-06 | In importWrappedKey of KMKeymasterApplet.java, there is a possible way access keys that should be restricted due to improper input validation. This could lead… |
CVE-2025-57835 | High | 7.5 | 2026-04-06 | An issue was discovered in RRC in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400… |
CVE-2026-5659 | Medium | 6.3 | 2026-04-06 | A vulnerability was found in pytries datrie up to 0.8.3. The affected element is the function Trie.load/Trie.read/Trie.__setstate__ of the file src/datrie.pyx… |
CVE-2026-30078 | High | 7.5 | 2026-04-06 | OpenAirInterface V2.2.0 AMF crashes when it receives an NGAP message with invalid procedure code or invalid PDU-type. For example when the message specificatio… |
CVE-2026-5536 | High | 7.3 | 2026-04-05 | A weakness has been identified in FedML-AI FedML up to 0.8.9. Affected is the function sendMessage of the file grpc_server.py of the component gRPC server. Exe… |
CVE-2026-34773 | Medium | 4.7 | 2026-04-04 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0, o… |
CVE-2026-34980 | High | 7.5 | 2026-04-03 | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, in a network-exposed cupsd w… |
CVE-2026-28797 | High | 8.8 | 2026-04-03 | RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions 0.24.0 and prior, a Server-Side Template Injection (SSTI) vulnerability exis… |
CVE-2020-37216 | High | 7.5 | 2026-04-03 | Hirschmann HiOS devices versions prior to 08.1.00 and 07.1.01 contain a denial of service vulnerability in the EtherNet/IP stack where improper handling of pa… |
CVE-2026-5473 | Medium | 4.5 | 2026-04-03 | A vulnerability has been found in NASA cFS up to 7.0.0. The impacted element is the function pickle.load of the component Pickle Module. Such manipulation lead… |
CVE-2026-34762 | Low | 2.7 | 2026-04-02 | Ella Core is a 5G core designed for private networks. Prior to version 1.8.0, the PUT /api/v1/subscriber/{imsi} API accepts an IMSI identifier from both the UR… |
CVE-2026-34760 | Medium | 5.9 | 2026-04-02 | vLLM is an inference and serving engine for large language models (LLMs). From version 0.5.5 to before version 0.18.0, Librosa defaults to using numpy.mean for… |
CVE-2026-35038 | Medium | 6.5 | 2026-04-02 | Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0, there is an arbitrary prototype read vulnerability via `… |
CVE-2026-32629 | Medium | 6.1 | 2026-04-02 | phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, an unauthenticated attacker can submit a guest FAQ with an email address that is syntac… |
CVE-2026-29144 | Medium | 5.3 | 2026-04-02 | SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to bypass subject sanitization and forge security tags using Unicode lookalike character… |
CVE-2026-29143 | Critical | 9.1 | 2026-04-02 | SEPPmail Secure Email Gateway before version 15.0.3 does not properly authenticate the inner message of S/MIME-encrypted MIME entities, allowing an attacker to… |
CVE-2026-29141 | Medium | 5.3 | 2026-04-02 | SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to bypass subject sanitization and forge tags such as [signed OK]. |
CVE-2026-29137 | Medium | 5.3 | 2026-04-02 | SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to hide security tags from users by crafting a long subject. |
CVE-2026-29135 | High | 7.5 | 2026-04-02 | SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to craft a password-tag that bypasses subject sanitization. |
CVE-2026-29133 | Critical | 9.1 | 2026-04-02 | SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to upload PGP keys with UIDs that do not match their email address. |
CVE-2026-34525 | Medium | 5.3 | 2026-04-01 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, multiple Host headers were allowed in aiohttp. This is… |
CVE-2026-34445 | High | 8.6 | 2026-04-01 | Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, the ExternalDataInfo class in ONNX was… |
CVE-2026-20097 | Medium | 6.5 | 2026-04-01 | A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with admin-level privileges to execute arbitra… |
CVE-2026-20093 | Critical | 9.8 | 2026-04-01 | A vulnerability in the change password functionality of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to bypass… |
CVE-2026-30523 | Medium | 6.5 | 2026-04-01 | A Business Logic vulnerability exists in SourceCodester Loan Management System v1.0 due to the lack of proper input validation. The application allows administ… |
CVE-2026-34442 | Medium | 5.4 | 2026-03-31 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.211, host header manipulation in FreeScout version (htt… |
CVE-2026-3470 | Low | 3.8 | 2026-03-31 | A vulnerability exists in the SonicWall Email Security appliance due to improper input sanitization that may lead to data corruption, allowing a remote authent… |
CVE-2026-3469 | Low | 2.7 | 2026-03-31 | A denial-of-service (DoS) vulnerability exists due to improper input validation in the SonicWall Email Security appliance, allowing a remote authenticated atta… |
CVE-2026-34383 | Medium | 4.3 | 2026-03-31 | Admidio is an open-source user management solution. Prior to version 5.0.8, the inventory module's item_save endpoint accepts a user-controllable POST paramete… |
CVE-2025-14213 | | 2026-03-31 | Cato Networks’ Socket versions prior to 25 contain a command injection vulnerability that allows an authenticated attacker with access to the Socket web interf… | |
CVE-2026-31799 | Medium | 4.9 | 2026-03-30 | Tautulli is a Python based monitoring and tracking tool for Plex Media Server. From version 2.14.2 to before version 2.17.0 for parameters "before" and "after"… |
CVE-2026-33029 | Medium | 6.5 | 2026-03-30 | Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, an input validation vulnerability in the logrotate configuration allows an a… |
CVE-2026-30077 | High | 7.5 | 2026-03-30 | OpenAirInterface V2.2.0 AMF crashes when it fails to decode the message. Not all decode failures result in a crash. But the crash is consistent for particular… |
CVE-2026-29909 | Medium | 5.3 | 2026-03-30 | MRCMS V3.1.2 contains an unauthenticated directory enumeration vulnerability in the file management module. The /admin/file/list.do endpoint lacks authenticati… |
CVE-2026-21712 | Medium | 6.5 | 2026-03-30 | A flaw in Node.js URL processing causes an assertion failure in native code when `url.format()` is called with a malformed internationalized domain name (IDN)… |
CVE-2026-4987 | High | 7.5 | 2026-03-28 | The SureForms – Contact Form, Payment Form & Other Custom Form Builder plugin for WordPress is vulnerable to Payment Amount Bypass in all versions up to, and i… |
CVE-2026-33936 | Medium | 5.3 | 2026-03-27 | The `ecdsa` PyPI package is a pure Python implementation of ECC (Elliptic Curve Cryptography) with support for ECDSA (Elliptic Curve Digital Signature Algorith… |
CVE-2026-33894 | High | 7.5 | 2026-03-27 | Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, RSASSA PKCS#1 v1.5 signature ver… |
CVE-2026-33882 | Medium | 6.5 | 2026-03-27 | Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, the markdown preview endpoint could be manipulated… |
CVE-2026-30576 | High | 7.5 | 2026-03-27 | A Business Logic vulnerability exists in SourceCodester Pharmacy Product Management System 1.0 in the add-stock.php file. The application fails to validate the… |
CVE-2026-30575 | High | 7.5 | 2026-03-27 | A Business Logic vulnerability exists in SourceCodester Pharmacy Product Management System 1.0 in the add-stock.php file. The application fails to validate the… |
CVE-2026-33758 | Medium | 6.1 | 2026-03-27 | OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao installations that have an OIDC/JWT authentication method e… |
CVE-2026-33284 | Medium | 4.3 | 2026-03-27 | GlobaLeaks is free and open-source whistleblowing software. Prior to version 5.0.89, the /api/support endpoint of GlobaLeaks performs minimal validation on use… |
CVE-2026-30304 | Critical | 9.6 | 2026-03-27 | In its design for automatic terminal command execution, AI Code offers two options: Execute safe commands and execute all commands. The description for the for… |
CVE-2025-69986 | High | 7.2 | 2026-03-27 | A buffer overflow vulnerability exists in the ONVIF GetStreamUri function of LSC Indoor Camera V7.6.32. The application fails to validate the length of the Pro… |
CVE-2026-4982 | | 2026-03-27 | A user with permission "update world" in any Venueless world is able to exfiltrate chat messages from direct messages or channels in other worlds on the same s… | |
CVE-2025-59032 | High | 7.5 | 2026-03-27 | ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be used to crash ManageSieve service repeatedly, making it unava… |
CVE-2025-59028 | Medium | 5.3 | 2026-03-27 | When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentication sessions to fail. Invalid BASE64 d… |
CVE-2026-33729 | Critical | 9.8 | 2026-03-27 | OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. In versions prior to 1.13.1, u… |
CVE-2026-29905 | Medium | 6.5 | 2026-03-26 | Kirby CMS through 5.1.4 allows an authenticated user with 'Editor' permissions to cause a persistent Denial of Service (DoS) via a malformed image upload. The… |
CVE-2025-55270 | Low | 3.5 | 2026-03-26 | HCL Aftermarket DPC is affected by Improper Input Validation which allows an attacker to inject executable code and can carry out attacks such as XSS, SQL Inje… |
CVE-2026-4860 | High | 7.3 | 2026-03-26 | A security flaw has been discovered in 648540858 wvp-GB28181-pro up to 2.7.4. This affects the function GenericFastJsonRedisSerializer of the file src/main/jav… |
CVE-2026-33287 | High | 7.5 | 2026-03-26 | LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to version 10.25.1, the `replace_first` filter in LiquidJS uses JavaS… |
CVE-2026-33285 | High | 7.5 | 2026-03-26 | LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to version 10.25.1, LiquidJS's `memoryLimit` security mechanism can b… |
CVE-2026-33218 | High | 7.5 | 2026-03-25 | NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, a client which can connec… |
CVE-2026-28894 | High | 7.5 | 2026-03-25 | A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14… |
CVE-2026-28852 | Medium | 5.5 | 2026-03-25 | A stack overflow was addressed with improved input validation. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15… |
CVE-2026-28821 | High | 8.4 | 2026-03-25 | A validation issue existed in the entitlement verification. This issue was addressed with improved validation of the process entitlement. This issue is fixed i… |
CVE-2026-20686 | Medium | 5.3 | 2026-03-25 | This issue was addressed with improved input validation. This issue is fixed in iOS 26.3 and iPadOS 26.3. An app may be able to access sensitive user data. |
CVE-2026-3912 | | 2026-03-24 | Injection vulnerabilities due to validation/sanitisation of user-supplied input in ActiveMatrix BusinessWorks and Enterprise Administrator allows information d… | |
CVE-2026-33332 | High | 7.5 | 2026-03-24 | NiceGUI is a Python-based UI framework. Prior to version 3.9.0, NiceGUI's app.add_media_file() and app.add_media_files() media routes accept a user-controlled… |
CVE-2026-22559 | High | 8.8 | 2026-03-24 | An Improper Input Validation vulnerability in UniFi Network Server may allow unauthorized access to an account if the account owner is socially engineered into… |
CVE-2026-33769 | Medium | 5.3 | 2026-03-24 | Astro is a web framework. From version 2.10.10 to before version 5.18.1, this issue concerns Astro's remotePatterns path enforcement for remote URLs used by se… |
CVE-2026-4755 | Critical | 9.8 | 2026-03-24 | CWE-20 vulnerability in MolotovCherry Android-ImageMagick7.This issue affects Android-ImageMagick7: before 7.1.2-11. |
CVE-2026-33250 | High | 7.5 | 2026-03-24 | Freeciv21 is a free open source, turn-based, empire-building strategy game. Versions prior to 3.1.1 crash with a stack overflow when receiving specially-crafte… |
CVE-2025-15606 | High | 7.5 | 2026-03-23 | A Denial-of-Service (DoS) vulnerability in the httpd component of TP-Link's TD-W8961N v4.0 due to improper input sanitization, allows crafted requests to trigg… |
CVE-2026-4538 | Medium | 5.3 | 2026-03-22 | A vulnerability was identified in PyTorch 2.10.0. The affected element is an unknown function of the component pt2 Loading Handler. The manipulation leads to d… |
CVE-2026-3641 | Medium | 5.3 | 2026-03-21 | The Appmax plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 1.0.3. This is due to the plugin registering a… |
CVE-2026-3460 | Medium | 5.3 | 2026-03-21 | The REST API TO MiniProgram plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.2. This is due to… |
CVE-2026-33151 | High | 7.5 | 2026-03-20 | Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. Prior to versions 3.3.5, 3.4.4, and 4.2.6, a specially crafted Soc… |
CVE-2026-4438 | Medium | 5.4 | 2026-03-20 | Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version… |
CVE-2026-4519 | Low | 3.3 | 2026-03-20 | The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior reject… |
CVE-2026-33369 | Medium | 4.3 | 2026-03-20 | Zimbra Collaboration (ZCS) 10.0 and 10.1 contains an LDAP injection vulnerability in the Mailbox SOAP service within a FolderAction operation. The application… |
CVE-2026-31805 | Medium | 5.3 | 2026-03-20 | Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, an authorization bypass in the poll plugin allowe… |
CVE-2026-4451 | High | 8.8 | 2026-03-20 | Insufficient validation of untrusted input in Navigation in Google Chrome prior to 146.0.7680.153 allowed a remote attacker who had compromised the renderer pr… |
CVE-2026-4342 | High | 8.8 | 2026-03-19 | A security issue was discovered in ingress-nginx where a combination of Ingress annotations can be used to inject configuration into nginx. This can lead to ar… |
CVE-2026-3230 | Low | 2.7 | 2026-03-19 | Missing required cryptographic step in the TLS 1.3 client HelloRetryRequest handshake logic in wolfSSL could lead to a compromise in the confidentiality of TLS… |
CVE-2026-32622 | High | 8.8 | 2026-03-19 | SQLBot is an intelligent data query system based on a large language model and RAG. Versions 1.5.0 and below contain a Stored Prompt Injection vulnerability th… |
CVE-2026-27953 | High | 7.1 | 2026-03-19 | ormar is a async mini ORM for Python. Versions 0.23.0 and below are vulnerable to Pydantic validation bypass through the model constructor, allowing any unauth… |
CVE-2026-32735 | | 2026-03-18 | openapi-to-java-records-mustache-templates allows users to generate Java Records from OpenAPI specifications. Starting in version 5.1.1 and prior to version 5… | |
CVE-2026-4407 | | 2026-03-18 | Out-of-bounds array write in Xpdf 4.06 and earlier, due to incorrect validation of the "N" field in ICCBased color spaces. | |
CVE-2026-20643 | Medium | 5.4 | 2026-03-17 | A cross-origin issue in the Navigation API was addressed with improved input validation. This issue is fixed in Background Security Improvements for iOS, iPadO… |
CVE-2025-31966 | Low | 2.7 | 2026-03-17 | HCL Sametime is vulnerable to broken server-side validation. While the application performs client-side input checks, these are not enforced by the web server… |
CVE-2026-3644 | High | 7.5 | 2026-03-16 | The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths wer… |
CVE-2026-23489 | Critical | 9.1 | 2026-03-16 | Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to version 1.23.3, it is possible to execute arbitrary PHP code from… |
CVE-2025-6969 | Medium | 5.0 | 2026-03-16 | in OpenHarmony v5.1.0 and prior versions allow a local attacker cause DOS through improper input. |
CVE-2025-26474 | Low | 3.3 | 2026-03-16 | in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information improper input. This vulnerability can be exploited only in restricted scenar… |
CVE-2025-10461 | | 2026-03-16 | Global file reads caused by improper URL checks in webserver in Softing Industrial Automation GmbH smartLinks on docker (filesystem modules) allows file access… | |
CVE-2026-22204 | Low | 3.7 | 2026-03-13 | wpDiscuz before 7.6.47 contains an email header injection vulnerability that allows attackers to manipulate mail recipients by injecting malicious data into th… |
CVE-2026-1668 | Critical | 9.8 | 2026-03-13 | The web interface on multiple Omada switches does not adequately validate certain external inputs, which may lead to out-of-bound memory access when processing… |
CVE-2025-60012 | Medium | 6.3 | 2026-03-13 | Malicious configuration can lead to unauthorized file access in Apache Livy. This issue affects Apache Livy 0.7.0 and 0.8.0 when connecting to Apache Spark 3… |
CVE-2025-13462 | Low | 3.3 | 2026-03-12 | The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME… |
CVE-2026-3967 | Medium | 6.3 | 2026-03-12 | A flaw has been found in Alfresco Activiti up to 7.19/8.8.0. Affected by this issue is the function deserialize/createObjectInputStream of the file activiti-co… |
CVE-2026-31900 | Critical | 9.8 | 2026-03-11 | Black is the uncompromising Python code formatter. Black provides a GitHub action for formatting code. This action supports an option, use_pyproject: true, for… |
CVE-2026-30901 | High | 7.0 | 2026-03-11 | Improper Input Validation in Zoom Rooms for Windows before 6.6.5 in Kiosk Mode may allow an authenticated user to conduct an escalation of privilege via local… |
CVE-2026-21310 | Medium | 5.3 | 2026-03-11 | Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Improper Input Validation vulnerabilit… |