CWE-20 · Improper Input Validation (page 16)
Page 16 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-23336 | Medium | 4.4 | 2025-09-17 | NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where an attacker could cause a denial of service by loading a misconfigured mode… |
CVE-2025-23268 | High | 8.0 | 2025-09-17 | NVIDIA Triton Inference Server contains a vulnerability in the DALI backend where an attacker may cause an improper input validation issue. A successful exploi… |
CVE-2025-10155 | High | 7.8 | 2025-09-17 | An Improper Input Validation vulnerability in the scanning logic of mmaitre314 picklescan versions up to and including 0.0.30 allows a remote attacker to bypas… |
CVE-2025-59161 | | 2025-09-16 | Element Web is a Matrix web client built using the Matrix React SDK. Element Web and Element Desktop before version 1.11.112 have insufficient validation of ro… | |
CVE-2025-43375 | Medium | 5.5 | 2025-09-15 | The issue was addressed with improved checks. This issue is fixed in Xcode 26. Processing an overly large path value may crash a process. |
CVE-2025-43372 | High | 7.8 | 2025-09-15 | The issue was addressed with improved input validation. This issue is fixed in iOS 26 and iPadOS 26, macOS Sonoma 14.8.2, macOS Tahoe 26, tvOS 26, visionOS 26… |
CVE-2025-43347 | Critical | 9.8 | 2025-09-15 | This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. An inp… |
CVE-2025-43342 | Critical | 9.8 | 2025-09-15 | A correctness issue was addressed with improved checks. This issue is fixed in Safari 26, iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS… |
CVE-2025-43299 | Medium | 5.5 | 2025-09-15 | A denial-of-service issue was addressed with improved validation. This issue is fixed in iOS 18.7 and iPadOS 18.7, macOS Sequoia 15.7, macOS Sonoma 14.8, macOS… |
CVE-2025-43293 | Medium | 5.5 | 2025-09-15 | The issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An app may be able to acc… |
CVE-2025-10433 | Medium | 6.3 | 2025-09-15 | A vulnerability was determined in 1Panel-dev MaxKB up to 2.0.2/2.1.0. This issue affects some unknown processing of the file /admin/api/workspace/default/tool/… |
CVE-2024-45431 | Medium | 5.3 | 2025-09-12 | OpenSynergy BlueSDK (aka Blue SDK) through 6.x has Improper Input Validation. The specific flaw exists within the BlueSDK Bluetooth stack. The issue results fr… |
CVE-2025-58364 | Medium | 6.5 | 2025-09-11 | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.12 and earlier, an unsafe deserialization… |
CVE-2025-10252 | Low | 3.1 | 2025-09-11 | A flaw has been found in SEAT Queue Ticket Kiosk up to 20250827. This affects an unknown part of the component Java RMI Registry Handler. This manipulation cau… |
CVE-2025-54123 | Critical | 9.8 | 2025-09-10 | Hoverfly is an open source API simulation tool. In versions 1.11.3 and prior, the middleware functionality in Hoverfly is vulnerable to command injection vulne… |
CVE-2025-56404 | High | 7.5 | 2025-09-10 | An issue was discovered in MariaDB MCP 0.1.0 allowing attackers to gain sensitive information via the SSE service as the SSE service lacks user validation. |
CVE-2025-58759 | Medium | 5.1 | 2025-09-09 | TinyEnv is an environment variable loader for PHP applications. In versions 1.0.9 and 1.0.10, TinyEnv did not properly strip inline comments inside .env values… |
CVE-2025-10164 | High | 7.3 | 2025-09-09 | A security flaw has been discovered in lmsys sglang 0.4.6. Affected by this vulnerability is the function main of the file /update_weights_from_tensor. The man… |
CVE-2025-54250 | Medium | 4.9 | 2025-09-09 | Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypas… |
CVE-2025-54248 | High | 7.7 | 2025-09-09 | Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypas… |
CVE-2025-54247 | Medium | 6.5 | 2025-09-09 | Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypas… |
CVE-2025-53809 | Medium | 6.5 | 2025-09-09 | Improper input validation in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to deny service over a network. |
CVE-2025-54236 | Critical | 9.1 | 2025-09-09 | Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerabilit… |
CVE-2025-8007 | Medium | 6.5 | 2025-09-09 | A security issue exists in the protected mode of 1756-EN4TR and 1756-EN2TR communication modules, where a Concurrent Forward Close operation can trigger a Majo… |
CVE-2025-10061 | Medium | 6.5 | 2025-09-05 | An authorized user can cause a crash in the MongoDB Server through a specially crafted $group query. This vulnerability is related to the incorrect handling of… |
CVE-2025-58361 | Critical | 9.3 | 2025-09-04 | Promptcraft Forge Studio is a toolkit for evaluating, optimizing, and maintaining LLM-powered applications. All versions contain an non-exhaustive URL scheme… |
CVE-2025-58353 | High | 8.2 | 2025-09-04 | Promptcraft Forge Studio is a toolkit for evaluating, optimizing, and maintaining LLM-powered applications. All versions of Promptcraft Forge Studio sanitize… |
CVE-2025-32322 | High | 7.8 | 2025-09-04 | In onCreate of MediaProjectionPermissionActivity.java , there is a possible way to grant a malicious app a token enabling unauthorized screen recording capabil… |
CVE-2025-48559 | Medium | 5.5 | 2025-09-04 | In multiple functions of AppOpsService.java, there is a possible add a large amount of app ops due to improper input validation. This could lead to local denia… |
CVE-2025-48556 | High | 7.3 | 2025-09-04 | In multiple methods of NotificationChannel.java, there is a possible desynchronization from persistence due to improper input validation. This could lead to lo… |
CVE-2025-48541 | High | 7.8 | 2025-09-04 | In onCreate of FaceSettings.java, there is a possible way to remove biometric unlock across user profiles due to improper input validation. This could lead to… |
CVE-2025-48538 | Medium | 5.5 | 2025-09-04 | In setApplicationHiddenSettingAsUser of PackageManagerService.java, there is a possible way to hide a system critical package due to improper input validation… |
CVE-2025-48537 | High | 7.1 | 2025-09-04 | In multiple locations, there is a possible way to persistently DoS the device due to improper input validation. This could lead to local information disclosure… |
CVE-2025-32323 | High | 7.8 | 2025-09-04 | In getCallingAppName of Shared.java, there is a possible way to trick users into granting file access via deceptive text in a permission popup due to improper… |
CVE-2025-26429 | Medium | 5.5 | 2025-09-04 | In collectOps of AppOpsService.java, there is a possible way to cause permanent DoS due to improper input validation. This could lead to local denial of servic… |
CVE-2025-26426 | Medium | 5.1 | 2025-09-04 | In BroadcastController.java of registerReceiverWithFeatureTraced, there is a possible way to receive broadcasts meant for the "android" package due to improper… |
CVE-2025-9467 | | 2025-09-04 | When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is possible to bypass the upload validation. Users of affe… | |
CVE-2024-56190 | High | 7.8 | 2025-09-04 | In wl_update_hidden_ap_ie() of wl_cfgscan.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of p… |
CVE-2024-43115 | High | 8.8 | 2025-09-03 | Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can execute any shell script server by alert script. This issue aff… |
CVE-2023-21473 | Medium | 6.8 | 2025-09-03 | Improper input validation with Exynos Fastboot USB Interface prior to SMR Apr-2023 Release 1 allows a physical attacker to execute arbitrary code in bootloader. |
CVE-2023-21472 | Medium | 6.8 | 2025-09-03 | Improper input validation with Exynos Fastboot USB Interface prior to SMR Apr-2023 Release 1 allows a physical attacker to execute arbitrary code in bootloader. |
CVE-2025-46047 | Medium | 6.5 | 2025-09-02 | A User enumeration vulnerability in the /CredentialsServlet/ForgotPassword endpoint in Silverpeas 6.4.1 and 6.4.2 allows remote attackers to determine valid us… |
CVE-2025-52547 | High | 7.5 | 2025-09-02 | E3 Site Supervisor Control (firmware version < 2.31F01) MGW contains an API call that lacks input validation. An attacker can use this command to continuously… |
CVE-2025-52544 | High | 7.5 | 2025-09-02 | E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenticated attacker to upload floor plan files. By upl… |
CVE-2025-8662 | Medium | 4.3 | 2025-09-02 | OpenAM (OpenAM Consortium Edition) contains a vulnerability that may cause it to malfunction as a SAML IdP due to a tampered request.This issue affects OpenAM… |
CVE-2025-55173 | Medium | 4.3 | 2025-08-29 | Next.js is a React framework for building full-stack web applications. In versions before 14.2.31 and from 15.0.0 to before 15.4.5, Next.js Image Optimization… |
CVE-2025-57220 | Medium | 5.3 | 2025-08-28 | An input validation flaw in the 'ate' service of Tenda AC10 v4.0 firmware v16.03.10.09_multi_TDE01 to escalate privileges to root via a crafted UDP packet. |
CVE-2025-9195 | Medium | 4.4 | 2025-08-28 | Improper input validation in firmware of some Solidigm DC Products may allow an attacker with local access to cause a Denial of Service |
CVE-2024-37777 | High | 8.8 | 2025-08-27 | O2OA v9.0.3 was discovered to contain a remote code execution (RCE) vulnerability via the mainOutput() function. |
CVE-2025-34161 | High | 8.8 | 2025-08-27 | Coolify versions prior to v4.0.0-beta.420.7 are vulnerable to a remote code execution vulnerability in the project deployment workflow. The platform allows aut… |
CVE-2025-34159 | High | 8.8 | 2025-08-27 | Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a remote code execution vulnerability in the application deployment workflow. The platform allows… |
CVE-2025-34157 | Critical | 9.0 | 2025-08-27 | Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a stored cross-site scripting (XSS) attack in the project creation workflow. An authenticated use… |
CVE-2025-57810 | High | 7.5 | 2025-08-26 | jsPDF is a library to generate PDFs in JavaScript. Prior to 3.0.2, user control of the first argument of the addImage method results in CPU utilization and den… |
CVE-2025-57805 | | 2025-08-25 | The Scratch Channel is a news website. In versions 1 and 1.1, a POST request to the endpoint used to publish articles, can be used to post an article in any ca… | |
CVE-2025-55301 | Medium | 6.7 | 2025-08-25 | The Scratch Channel is a news website. In version 1, it is possible to go to application in devtools and click local storage to edit the account's username loc… |
CVE-2025-52451 | High | 8.5 | 2025-08-22 | Improper Input Validation vulnerability in Salesforce Tableau Server on Windows, Linux (tabdoc api - create-data-source-from-file-upload modules) allows Absolu… |
CVE-2025-50674 | High | 7.8 | 2025-08-22 | An issue was discovered in the changePassword method in file /usr/share/php/openmediavault/system/user.inc in OpenMediaVault 7.4.17 allowing local authenticate… |
CVE-2025-9288 | Critical | 9.1 | 2025-08-20 | Improper Input Validation vulnerability in sha.js allows Input Data Manipulation.This issue affects sha.js: through 2.4.11. |
CVE-2025-9287 | Critical | 9.1 | 2025-08-20 | Improper Input Validation vulnerability in cipher-base allows Input Data Manipulation.This issue affects cipher-base: through 1.0.4. |
CVE-2025-55444 | Critical | 9.8 | 2025-08-20 | A SQL injection vulnerability exists in the id2 parameter of the cancel_booking.php page in Online Artwork and Fine Arts MCA Project 1.0. A remote attacker can… |
CVE-2011-10020 | | 2025-08-20 | Kaillera Server version 0.86 is vulnerable to a denial-of-service condition triggered by sending a malformed UDP packet after the initial handshake. Once a cli… | |
CVE-2025-36114 | Medium | 6.5 | 2025-08-20 | IBM QRadar SOAR Plugin App 1.0.0 through 5.6.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted… |
CVE-2025-7693 | | 2025-08-18 | A security issue exists due to improper handling of malformed CIP Forward Close packets during fuzzing. The controller enters a solid red Fault LED state and b… | |
CVE-2025-6625 | High | 7.5 | 2025-08-18 | CWE-20: Improper Input Validation vulnerability exists that could cause a Denial Of Service when specific crafted FTP command is sent to the device. |
CVE-2025-52620 | Medium | 4.3 | 2025-08-15 | HCL BigFix SaaS Authentication Service is affected by a Cross-Site Scripting (XSS) vulnerability. The image upload functionality inadequately validated the su… |
CVE-2025-9060 | Critical | 9.1 | 2025-08-15 | A vulnerability has been found in the MSoft MFlash application that allows execution of arbitrary code on the server. The issue occurs in the integration… |
CVE-2025-7507 | Medium | 6.4 | 2025-08-15 | The elink – Embed Content plugin for WordPress is vulnerable to Malicious Redirect in all versions up to, and including, 1.1.0. This is due to the plugin not r… |
CVE-2025-20148 | High | 8.5 | 2025-08-14 | A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, remote attacker t… |
CVE-2025-8876 | High | 8.8 | 2025-08-14 | Improper Input Validation vulnerability in N-able N-central allows OS Command Injection.This issue affects N-central: before 2025.3.1. |
CVE-2025-7971 | | 2025-08-14 | A security issues exists within Studio 5000 Logix Designer due to unsafe handling of environment variables. If the specified path lacks a valid file, Logix Des… | |
CVE-2025-8963 | Medium | 6.3 | 2025-08-14 | A vulnerability was determined in jeecgboot JimuReport up to 2.1.1. Affected by this issue is some unknown functionality of the file /drag/onlDragDataSource/te… |
CVE-2025-27388 | | 2025-08-14 | Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens. | |
CVE-2025-4410 | High | 7.5 | 2025-08-13 | A buffer overflow vulnerability exists in the module SetupUtility. An attacker with local privileged access can exploit this vulnerability by executeing arbitr… |
CVE-2025-4277 | High | 7.5 | 2025-08-13 | Tcg2Smm has a vulnerability which can be used to write arbitrary memory inside SMRAM and execute arbitrary code at SMM level. |
CVE-2025-4276 | High | 7.5 | 2025-08-13 | UsbCoreDxe has a vulnerability which can be used to write arbitrary memory inside SMRAM and execute arbitrary code at SMM level. |
CVE-2025-49554 | High | 7.5 | 2025-08-12 | Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an Improper Input Validation vulnerabilit… |
CVE-2025-25005 | Medium | 6.5 | 2025-08-12 | Improper input validation in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network. |
CVE-2025-32004 | Low | 3.9 | 2025-08-12 | Improper input validation in the Intel Edger8r Tool for some Intel(R) SGX SDK may allow an authenticated user to potentially enable escalation of privilege via… |
CVE-2025-27537 | Medium | 5.5 | 2025-08-12 | Improper input validation for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an authenticated user to po… |
CVE-2025-24486 | High | 7.8 | 2025-08-12 | Improper input validation in the Linux kernel-mode driver for some Intel(R) 700 Series Ethernet before version 2.28.5 may allow an authenticated user to potent… |
CVE-2025-24484 | High | 7.8 | 2025-08-12 | Improper input validation in the Linux kernel-mode driver for some Intel(R) 800 Series Ethernet before version 1.17.2 may allow an authenticated user to potent… |
CVE-2025-24325 | High | 8.8 | 2025-08-12 | Improper input validation in the Linux kernel-mode driver for some Intel(R) 800 Series Ethernet before version 1.17.2 may allow an authenticated user to potent… |
CVE-2025-24296 | Medium | 6.0 | 2025-08-12 | Improper input validation in some firmware for the Intel(R) E810 Ethernet before version 4.6 may allow a privileged user to enable denial of service via local… |
CVE-2025-21086 | High | 7.5 | 2025-08-12 | Improper input validation in the Linux kernel-mode driver for some Intel(R) 700 Series Ethernet before version 2.28.5 may allow an authenticated user to potent… |
CVE-2025-40746 | Critical | 9.1 | 2025-08-12 | A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V3.2). Affected products do not properly validate input for a backup scrip… |
CVE-2025-25212 | Low | 3.3 | 2025-08-11 | in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through improper input. |
CVE-2025-55006 | Medium | 4.3 | 2025-08-09 | Frappe Learning is a learning system that helps users structure their content. In versions 2.33.0 and below, the image upload functionality did not adequately… |
CVE-2025-48913 | Critical | 9.8 | 2025-08-08 | If untrusted users are allowed to configure JMS for Apache CXF, previously they could use RMI or LDAP URLs, potentially leading to code execution capabilities… |
CVE-2025-8708 | Medium | 5.0 | 2025-08-08 | A vulnerability was found in Antabot White-Jotter 0.22. It has been declared as critical. This vulnerability affects the function CookieRememberMeManager of th… |
CVE-2025-54368 | | 2025-08-08 | uv is a Python package and project manager written in Rust. In versions 0.8.5 and earlier, remote ZIP archives were handled in a streamwise fashion, and file e… | |
CVE-2025-44779 | Medium | 6.6 | 2025-08-07 | An issue in Ollama v0.1.33 allows attackers to delete arbitrary files via sending a crafted packet to the endpoint /api/pull. |
CVE-2025-8582 | Medium | 4.3 | 2025-08-07 | Insufficient validation of untrusted input in Core in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to spoof the contents of the Omnibox (URL… |
CVE-2025-54785 | High | 8.8 | 2025-08-07 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.6 and 8.8.0, user-supplied input is… |
CVE-2025-50233 | Medium | 6.5 | 2025-08-06 | A vulnerability in QCMS version 6.0.5 allows authenticated users to read arbitrary files from the server due to insufficient validation of the "Name" parameter… |
CVE-2025-21477 | High | 7.5 | 2025-08-06 | Transient DOS while processing CCCH data when NW sends data with invalid length. |
CVE-2025-54642 | Medium | 6.7 | 2025-08-06 | Issue of buffer overflow caused by insufficient data verification in the kernel gyroscope module. Impact: Successful exploitation of this vulnerability may aff… |
CVE-2025-54641 | Medium | 6.7 | 2025-08-06 | Issue of buffer overflow caused by insufficient data verification in the kernel acceleration module. Impact: Successful exploitation of this vulnerability may… |
CVE-2025-54636 | Medium | 4.4 | 2025-08-06 | Issue of buffer overflow caused by insufficient data verification in the kernel drop detection module. Impact: Successful exploitation of this vulnerability ma… |
CVE-2025-54614 | Medium | 6.2 | 2025-08-06 | Input verification vulnerability in the home screen module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-8573 | Medium | 4.8 | 2025-08-05 | Concrete CMS versions 9 through 9.4.2 are vulnerable to Stored XSS from Home Folder on Members Dashboard page. Version 8 was not affected. A rogue admin could… |