CWE-20 · Improper Input Validation (page 16)
Page 16 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-21282 | Medium | 5.3 | 2026-03-11 | Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Improper Input Validation vulnerabilit… |
CVE-2025-20105 | | 2026-03-10 | Improper input validation in some UEFI firmware SMM module for the Intel(R) reference platforms may allow an escalation of privilege. System software adversary… | |
CVE-2025-20096 | | 2026-03-10 | Improper input validation in the UEFI firmware for some Intel Reference Platforms may allow an escalation of privilege. System software adversary with a privil… | |
CVE-2025-20068 | | 2026-03-10 | Improper input validation in the UEFI ImcErrorHandler module for some Intel(R) reference platforms may allow an escalation of privilege. System software advers… | |
CVE-2025-20064 | | 2026-03-10 | Improper input validation in the UEFI FlashUcAcmSmm module for some Intel(R) reference platforms may allow an escalation of privilege. System software adversar… | |
CVE-2025-20027 | | 2026-03-10 | Improper input validation in the UEFI WheaERST module for some Intel(R) reference platforms may allow an escalation of privilege. System software adversary wit… | |
CVE-2025-36920 | High | 8.4 | 2026-03-10 | In hyp_alloc of arch/arm64/kvm/hyp/nvhe/alloc.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation… |
CVE-2026-26310 | Medium | 5.9 | 2026-03-10 | Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, calling Utility::getAddressWithPort with a scoped IPv6 add… |
CVE-2026-26121 | High | 7.5 | 2026-03-10 | Server-side request forgery (ssrf) in Azure IoT Explorer allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-26106 | High | 8.8 | 2026-03-10 | Improper input validation in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2026-20967 | High | 8.8 | 2026-03-10 | Improper input validation in System Center Operations Manager allows an authorized attacker to elevate privileges over a network. |
CVE-2026-3288 | High | 8.8 | 2026-03-09 | A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/rewrite-target` Ingress annotation can be used to inject configuration… |
CVE-2025-14558 | High | 7.2 | 2026-03-09 | The rtsol(8) and rtsold(8) programs do not validate the domain search list options provided in router advertisement messages; the option body is passed to reso… |
CVE-2026-24713 | Critical | 9.8 | 2026-03-09 | Improper Input Validation vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 before 1.3.7, from 2.0.0 before 2.0.7. Users are recomme… |
CVE-2025-69279 | High | 7.5 | 2026-03-09 | In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privi… |
CVE-2025-69278 | High | 7.5 | 2026-03-09 | In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privi… |
CVE-2025-61616 | High | 7.5 | 2026-03-09 | In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privi… |
CVE-2025-61615 | High | 7.5 | 2026-03-09 | In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privi… |
CVE-2025-61614 | High | 7.5 | 2026-03-09 | In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privi… |
CVE-2025-61613 | High | 7.5 | 2026-03-09 | In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privi… |
CVE-2025-61612 | High | 7.5 | 2026-03-09 | In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privi… |
CVE-2025-61611 | High | 7.5 | 2026-03-09 | In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed.. |
CVE-2026-29791 | Medium | 4.9 | 2026-03-06 | Agentgateway is an open source data plane for agentic AI connectivity within or across any agent framework or environment. Prior to version 0.12.0, when conver… |
CVE-2026-29046 | High | 8.2 | 2026-03-06 | TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Prior to version 2.04, TinyWeb accepts request header values and later maps them into CGI en… |
CVE-2026-0848 | Critical | 10.0 | 2026-03-05 | NLTK versions <=3.9.2 are vulnerable to arbitrary code execution due to improper input validation in the StanfordSegmenter module. The module dynamically loads… |
CVE-2025-7375 | Medium | 6.5 | 2026-03-05 | A denial-of-service (DoS) vulnerability was identified in Omada EAP610 v3. An attacker with adjacent network access can send crafted requests to cause the dev… |
CVE-2025-11143 | Low | 3.7 | 2026-03-05 | The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using mu… |
CVE-2025-41257 | Medium | 4.8 | 2026-03-04 | Suprema’s BioStar 2 in version 2.9.11.6 allows users to set new password without providing the current one. Exploiting this flaw combined with other vulnerabil… |
CVE-2026-3545 | Critical | 9.6 | 2026-03-04 | Insufficient data validation in Navigation in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform a sandbox escape via a cra… |
CVE-2026-20020 | Medium | 6.8 | 2026-03-04 | A vulnerability in the OSPF protocol of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an unauthenticated, adjacent attacker to c… |
CVE-2026-27443 | High | 7.5 | 2026-03-04 | SEPPmail Secure Email Gateway before version 15.0.1 does not properly sanitize the headers from S/MIME protected MIME entities, allowing an attacker to control… |
CVE-2026-3204 | Critical | 9.8 | 2026-03-03 | Improper input validation in the error message page in Devolutions Server 2025.3.16 and earlier allows remote attackers to spoof the displayed error message v… |
CVE-2026-2590 | Critical | 9.8 | 2026-03-03 | Improper enforcement of the Disable password saving in vaults setting in the connection entry component in Devolutions Remote Desktop Manager 2025.3.30 and e… |
CVE-2024-55020 | Critical | 9.8 | 2026-03-03 | A command injection vulnerability in the DHCP activation feature of Weintek cMT-3072XH2 easyweb Web Version v2.1.53, OS v20231011 allows attackers to execute a… |
CVE-2025-62816 | Medium | 5.5 | 2026-03-03 | An issue was discovered in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, and 2500. Unvalidated VS4L_VERTEXIOC_BOOTUP input leads to a den… |
CVE-2026-0034 | High | 8.4 | 2026-03-02 | In setPackageOrComponentEnabled of ManagedServices.java, there is a possible notification policy desync due to improper input validation. This could lead to lo… |
CVE-2026-0015 | Medium | 6.2 | 2026-03-02 | In multiple locations of AppOpsService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local denial… |
CVE-2026-0014 | Medium | 6.2 | 2026-03-02 | In isPackageNullOrSystem of AppOpsService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local den… |
CVE-2025-48644 | Medium | 5.5 | 2026-03-02 | In multiple locations, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no ad… |
CVE-2025-48587 | Medium | 6.2 | 2026-03-02 | In multiple functions of ProfilingService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local den… |
CVE-2025-48585 | Medium | 6.2 | 2026-03-02 | In multiple functions of ProfilingService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local den… |
CVE-2026-28421 | Medium | 5.3 | 2026-02-27 | Vim is an open source, command line text editor. Versions prior to 9.2.0077 have a heap-buffer-overflow and a segmentation fault (SEGV) exist in Vim's swap fil… |
CVE-2018-25160 | Medium | 6.5 | 2026-02-27 | HTTP::Session2 versions through 1.09 for Perl does not validate the format of user provided session ids, enabling code injection or other impact depending on s… |
CVE-2026-2880 | Critical | 9.1 | 2026-02-27 | A vulnerability in @fastify/middie versions < 9.2.0 can result in authentication/authorization bypass when using path-scoped middleware (for example, app.use('… |
CVE-2026-2750 | Critical | 9.1 | 2026-02-27 | Improper Input Validation vulnerability in Centreon Centreon Open Tickets on Central Server on Linux (Centreon Open Tickets modules).This issue affects Centreo… |
CVE-2026-26935 | Medium | 6.5 | 2026-02-26 | Improper Input Validation (CWE-20) in the internal Content Connectors search endpoint in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-1… |
CVE-2026-27959 | High | 7.5 | 2026-02-26 | Koa is middleware for Node.js using ES2017 async functions. Prior to versions 3.1.2 and 2.16.4, Koa's `ctx.hostname` API performs naive parsing of the HTTP Hos… |
CVE-2026-27818 | High | 7.5 | 2026-02-26 | TerriaJS-Server is a NodeJS Express server for TerriaJS, a library for building web-based geospatial data explorers. A validation bug in versions prior to 4.0… |
CVE-2026-25941 | Medium | 4.3 | 2026-02-25 | FreeRDP is a free implementation of the Remote Desktop Protocol. Versions on the 2.x branch prior to to 2.11.8 and on the 3.x branch prior to 3.23.0 have an ou… |
CVE-2026-27702 | Critical | 9.9 | 2026-02-25 | Budibase is a low code platform for creating internal tools, workflows, and admin panels. Prior to version 3.30.4, an unsafe `eval()` vulnerability in Budibase… |
CVE-2026-27607 | High | 8.1 | 2026-02-25 | RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.56 through 1.0.0-alpha.82, RustFS does not validate policy conditions in p… |
CVE-2025-14963 | High | 7.8 | 2026-02-24 | A vulnerability identified in the HX Agent driver file fekern.sys allowed a threat actor with local user access the ability to gain elevated system privileges… |
CVE-2026-27590 | Critical | 9.8 | 2026-02-24 | Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's FastCGI path splitting logic computes the split index on a lo… |
CVE-2026-27585 | Medium | 6.5 | 2026-02-24 | Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the path sanitization routine in file matcher doesn't sanitize backsl… |
CVE-2026-27642 | High | 7.5 | 2026-02-24 | free5gc UDM provides Unified Data Management (UDM) for free5GC, an open-source project for 5th generation (5G) mobile core networks. In versions up to and incl… |
CVE-2026-21864 | Medium | 6.5 | 2026-02-24 | Valkey-Bloom is a Rust based Valkey module which brings a Bloom Filter (Module) data type into the Valkey distributed key-value database. Prior to commit a6861… |
CVE-2025-69251 | Medium | 5.3 | 2026-02-24 | free5gc UDM provides Unified Data Management (UDM) for free5GC, an open-source project for 5th generation (5G) mobile core networks. In versions up to and incl… |
CVE-2025-69250 | High | 7.5 | 2026-02-24 | free5gc UDM provides Unified Data Management (UDM) for free5GC, an open-source project for 5th generation (5G) mobile core networks. In versions up to and incl… |
CVE-2025-69232 | High | 7.5 | 2026-02-23 | free5GC is an open-source project for 5th generation (5G) mobile core networks. free5GC go-upf versions up to and including 1.2.6, corresponding to free5gc smf… |
CVE-2026-27623 | High | 7.5 | 2026-02-23 | Valkey is a distributed key-value database. Starting in version 9.0.0 and prior to version 9.0.3, a malicious actor with network access to Valkey can cause the… |
CVE-2026-22568 | Medium | 5.5 | 2026-02-23 | Improper neutralization of special elements in user-supplied input within the ZIA Admin UI could allow an authenticated administrator to access or retrieve una… |
CVE-2026-22567 | High | 7.6 | 2026-02-23 | Improper validation of user-supplied input in the ZIA Admin UI could allow an authenticated administrator to initiate backend functions through specific input… |
CVE-2026-2970 | Medium | 4.6 | 2026-02-23 | A vulnerability has been found in datapizza-labs datapizza-ai 0.0.2. Affected by this vulnerability is the function RedisCache of the file datapizza-ai-cache/r… |
CVE-2026-2898 | Medium | 5.5 | 2026-02-22 | A vulnerability was detected in funadmin up to 7.1.0-rc4. This issue affects the function getMember of the file app/common/service/AuthCloudService.php of the… |
CVE-2026-27170 | High | 7.1 | 2026-02-21 | OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. In versions 1.1.2-alpha and below, URL ingest allows ov… |
CVE-2026-26953 | Medium | 5.4 | 2026-02-19 | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. Versions 6.0 and above have a S… |
CVE-2026-26952 | Medium | 5.4 | 2026-02-19 | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. Versions 6.4 and below are vulne… |
CVE-2026-26314 | High | 7.5 | 2026-02-19 | go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. Prior to version 1.16.9, a vulnerable node can be forced to shutdown/cr… |
CVE-2026-26063 | | 2026-02-19 | CediPay is a crypto-to-fiat app for the Ghanaian market. A vulnerability in CediPay prior to version 1.2.3 allows attackers to bypass input validation in the t… | |
CVE-2025-13587 | Medium | 6.5 | 2026-02-19 | The Two Factor (2FA) Authentication via Email plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in versions up to, and including, 1.9.8. T… |
CVE-2026-24734 | High | 7.5 | 2026-02-17 | Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomc… |
CVE-2026-24733 | Low | 3.7 | 2026-02-17 | Improper Input Validation vulnerability in Apache Tomcat. Tomcat did not limit HTTP/0.9 requests to the GET method. If a security constraint was configured… |
CVE-2025-66614 | Critical | 9.1 | 2026-02-17 | Improper Input Validation vulnerability. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 throu… |
CVE-2026-2555 | Medium | 5.0 | 2026-02-16 | A weakness has been identified in JeecgBoot 3.9.1. This vulnerability affects the function importDocumentFromZip of the file org/jeecg/modules/airag/llm/contro… |
CVE-2025-70123 | High | 7.5 | 2026-02-13 | An improper input validation and protocol compliance vulnerability in free5GC v4.0.1 allows remote attackers to cause a denial of service. The UPF incorrectly… |
CVE-2026-2391 | Low | 3.7 | 2026-02-12 | ### Summary The `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-… |
CVE-2026-20627 | Medium | 5.5 | 2026-02-11 | An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in iOS 26.3 and iPadOS 26.3… |
CVE-2026-21258 | Medium | 5.5 | 2026-02-10 | Improper input validation in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-21247 | High | 7.3 | 2026-02-10 | Improper input validation in Windows Hyper-V allows an authorized attacker to execute code locally. |
CVE-2026-21229 | High | 8.0 | 2026-02-10 | Improper input validation in Power BI allows an authorized attacker to execute code over a network. |
CVE-2025-25210 | High | 8.2 | 2026-02-10 | Improper input validation for some Server Firmware Update Utility(SysFwUpdt) before version 16.0.12 within Ring 3: User Applications may allow an escalation of… |
CVE-2025-22453 | High | 7.5 | 2026-02-10 | Improper input validation for some Server Firmware Update Utility(SysFwUpdt) before version 16.0.12 within Ring 3: User Applications may allow an escalation of… |
CVE-2026-25892 | High | 7.5 | 2026-02-09 | Adminer is open-source database management software. Adminer v5.4.1 and earlier has a version check mechanism where adminer.org sends signed version info via J… |
CVE-2026-2113 | High | 7.3 | 2026-02-07 | A security vulnerability has been detected in yuan1994 tpadmin up to 1.3.12. This affects an unknown part in the library /public/static/admin/lib/webuploader/0… |
CVE-2026-25631 | Medium | 6.5 | 2026-02-06 | n8n is an open source workflow automation platform. Prior to 1.121.0, there is a vulnerability in the HTTP Request node's credential domain validation allowed… |
CVE-2026-25723 | Medium | 6.5 | 2026-02-06 | Claude Code is an agentic coding tool. Prior to version 2.0.55, Claude Code failed to properly validate commands using piped sed operations with the echo comma… |
CVE-2026-25722 | Critical | 9.1 | 2026-02-06 | Claude Code is an agentic coding tool. Prior to version 2.0.57, Claude Code failed to properly validate directory changes when combined with write operations t… |
CVE-2025-15566 | High | 8.8 | 2026-02-06 | A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/auth-proxy-set-headers` Ingress annotation can be used to inject config… |
CVE-2025-12131 | Medium | 6.5 | 2026-02-05 | A truncated 802.15.4 packet can lead to an assert, resulting in a denial of service. |
CVE-2026-25514 | High | 8.8 | 2026-02-04 | FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a critical SQL injection… |
CVE-2026-25513 | High | 8.8 | 2026-02-04 | FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a critical SQL injection… |
CVE-2026-21893 | High | 7.2 | 2026-02-04 | n8n is an open source workflow automation platform. From version 0.187.0 to before 1.120.3, a command injection vulnerability was identified in n8n’s community… |
CVE-2026-24512 | High | 8.8 | 2026-02-03 | A security issue was discovered in ingress-nginx where the `rules.http.paths.path` Ingress field can be used to inject configuration into nginx. This can lead… |
CVE-2026-1580 | High | 8.8 | 2026-02-03 | A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/auth-method` Ingress annotation can be used to inject configuration int… |
CVE-2026-22220 | Medium | 4.5 | 2026-02-03 | A lack of proper input validation in the HTTP processing path in TP-Link Archer BE230 v1.2 (web modules) may allow a crafted request to cause the device’s web… |
CVE-2026-24936 | Critical | 9.8 | 2026-02-03 | When a specific function is enabled while joining a AD Domain from ADM, an improper input parameters validation vulnerability in a specific CGI program allowin… |
CVE-2025-67484 | Critical | 9.8 | 2026-02-03 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiFormatXml.Php. This issue affects MediaWi… |
CVE-2025-67480 | Medium | 6.5 | 2026-02-03 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiQueryRevisionsBase.Php. This issue affect… |
CVE-2025-61652 | | 2026-02-03 | Vulnerability in Wikimedia Foundation DiscussionTools.This issue affects DiscussionTools: from * before 1.43.4, 1.44.1. | |
CVE-2026-1691 | Medium | 6.3 | 2026-01-30 | A vulnerability has been found in bolo-solo up to 2.6.4. This impacts the function importMarkdownsSync of the file src/main/java/org/b3log/solo/bolo/prop/Backu… |