CWE-20 · Improper Input Validation (page 18)
Page 18 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-4613 | High | 8.8 | 2025-06-12 | Path traversal in Google Web Designer's template handling versions prior to 16.3.0.0407 on Windows allows attacker to achieve remote code execution by tricking… |
CVE-2024-1244 | | 2025-06-11 | Improper input validation in the OSSEC HIDS agent for Windows prior to version 3.8.0 allows an attacker in with control over the OSSEC server or in possession… | |
CVE-2024-1243 | High | 7.2 | 2025-06-11 | Improper input validation in the Wazuh agent for Windows prior to version 4.8.0 allows an attacker with control over the Wazuh server or agent key to configure… |
CVE-2025-47096 | Low | 3.5 | 2025-06-10 | Adobe Experience Manager versions 6.5.22 and earlier are affected by an Improper Input Validation vulnerability that could result in a security feature bypass… |
CVE-2025-0052 | | 2025-06-10 | Improper input validation performed during the authentication process of FlashBlade could lead to a system Denial of Service. | |
CVE-2025-0051 | | 2025-06-10 | Improper input validation performed during the authentication process of FlashArray could lead to a system Denial of Service. | |
CVE-2025-47968 | High | 7.8 | 2025-06-10 | Improper input validation in Microsoft AutoUpdate (MAU) allows an authorized attacker to elevate privileges locally. |
CVE-2025-47171 | Medium | 6.7 | 2025-06-10 | Improper input validation in Microsoft Office Outlook allows an authorized attacker to execute code locally. |
CVE-2025-4680 | | 2025-06-10 | Improper Input Validation vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Exploiting Incorrectly Configured Access Control Securit… | |
CVE-2025-3898 | Medium | 6.5 | 2025-06-10 | CWE-20: Improper Input Validation vulnerability exists that could cause Denial of Service when an authenticated malicious user sends HTTPS request containing i… |
CVE-2025-3116 | Medium | 6.5 | 2025-06-10 | CWE-20: Improper Input Validation vulnerability exists that could cause Denial of Service when an authenticated malicious user sends special malformed HTTPS re… |
CVE-2025-1041 | Critical | 9.9 | 2025-06-10 | An improper input validation discovered in Avaya Call Management System could allow an unauthorized remote command via a specially crafted web request. Aff… |
CVE-2025-0037 | Medium | 6.6 | 2025-06-10 | In AMD Versal Adaptive SoC devices, the lack of address validation when executing PLM runtime services through the PLM firmware can allow access to isolated or… |
CVE-2025-27242 | Low | 3.3 | 2025-06-08 | in OpenHarmony v5.0.3 and prior versions allow a local attacker cause DOS through improper input. |
CVE-2025-27131 | Medium | 6.1 | 2025-06-08 | in OpenHarmony v5.0.3 and prior versions allow a local attacker cause DOS through improper input. |
CVE-2025-5680 | Medium | 6.3 | 2025-06-05 | A vulnerability classified as critical was found in Shenzhen Dashi Tongzhou Information Technology AgileBPM up to 2.5.0. Affected by this vulnerability is the… |
CVE-2025-5679 | Medium | 6.3 | 2025-06-05 | A vulnerability classified as critical has been found in Shenzhen Dashi Tongzhou Information Technology AgileBPM up to 2.5.0. Affected is the function parseStr… |
CVE-2025-1701 | | 2025-06-04 | CVE-2025-1701 is a high-severity vulnerability in the MIM Admin service. An attacker could exploit this vulnerability by sending a specially crafted request ov… | |
CVE-2025-5552 | Medium | 6.3 | 2025-06-04 | A vulnerability was found in ChestnutCMS up to 15.1. It has been declared as critical. This vulnerability affects unknown code of the file /dev-api/groovy/exec… |
CVE-2025-5499 | High | 7.3 | 2025-06-03 | A vulnerability classified as critical has been found in slackero phpwcms up to 1.9.45/1.10.8. Affected is the function is_file/getimagesize of the file image_… |
CVE-2025-5498 | Medium | 5.5 | 2025-06-03 | A vulnerability was found in slackero phpwcms up to 1.9.45/1.10.8. It has been rated as critical. This issue affects the function file_get_contents/is_file of… |
CVE-2025-5497 | Medium | 6.3 | 2025-06-03 | A vulnerability was detected in slackero phpwcms up to 1.9.45/1.10.8. The impacted element is an unknown function of the file include/inc_module/mod_feedimport… |
CVE-2025-5455 | | 2025-06-02 | An issue was found in the private API function qDecodeDataUrl() in QtCore, which is used in QTextDocument and QNetworkReply, and, potentially, in user code. … | |
CVE-2025-48944 | Medium | 6.5 | 2025-05-30 | vLLM is an inference and serving engine for large language models (LLMs). In version 0.8.0 up to but excluding 0.9.0, the vLLM backend used with the /v1/chat/c… |
CVE-2025-4635 | Medium | 6.6 | 2025-05-30 | A malicious user with administrative privileges in the web portal would be able to manipulate the Diagnostics module to obtain remote code execution on the loc… |
CVE-2025-48490 | | 2025-05-30 | Laravel Rest Api is an API generator. Prior to version 2.13.0, a validation bypass vulnerability was discovered where multiple validations defined for the same… | |
CVE-2025-5326 | Medium | 6.3 | 2025-05-29 | A vulnerability was found in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0 and classified as critical. Affected by this issue is some… |
CVE-2024-51392 | High | 8.8 | 2025-05-29 | An issue in OpenKnowledgeMaps Headstart v7 allows a remote attacker to escalate privileges via the url parameter of the getPDF.php component |
CVE-2025-33043 | Medium | 5.8 | 2025-05-29 | APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Input Validation locally. Successful exploitation of this vulnerability can pot… |
CVE-2025-27151 | Medium | 4.7 | 2025-05-29 | Redis is an open source, in-memory database that persists on disk. In versions starting from 7.0.0 to before 8.0.2, a stack-based buffer overflow exists in red… |
CVE-2025-5174 | Medium | 5.3 | 2025-05-26 | A vulnerability was found in erdogant pypickle up to 1.1.5 and classified as problematic. Affected by this issue is the function load of the file pypickle/pypi… |
CVE-2025-5173 | Medium | 5.3 | 2025-05-26 | A vulnerability has been found in HumanSignal label-studio-ml-backend up to 9fb7f4aa186612806af2becfb621f6ed8d9fdbaf and classified as problematic. Affected by… |
CVE-2025-5148 | Medium | 5.3 | 2025-05-25 | A vulnerability was found in FunAudioLLM InspireMusic up to bf32364bcb0d136497ca69f9db622e9216b029dd. It has been classified as critical. Affected is the funct… |
CVE-2025-5114 | Medium | 6.3 | 2025-05-23 | A vulnerability has been found in easysoft zentaopms 21.5_20250307 and classified as critical. This vulnerability affects the function Edit of the file /index… |
CVE-2025-41379 | | 2025-05-23 | The Intellian C700 web panel allows you to add firewall rules. Each of these rules has an associated ID, but there is a problem when adding a new rule, the ID… | |
CVE-2025-41378 | | 2025-05-23 | The SSID field is not parsed correctly and can be used to inject commands into the hostpad.conf file. This can be exploited by an attacker to extend his knowle… | |
CVE-2024-40458 | High | 7.8 | 2025-05-22 | An issue in Ocuco Innovation Tracking.exe v.2.10.24.51 allows a local attacker to escalate privileges via the modification of TCP packets. |
CVE-2024-25010 | High | 8.8 | 2025-05-22 | Ericsson RAN Compute and Site Controller 6610 contains in certain configurations a high severity vulnerability where improper input validation could be exploit… |
CVE-2025-3885 | Medium | 6.5 | 2025-05-22 | Harman Becker MGU21 Bluetooth Improper Input Validation Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to create a denia… |
CVE-2021-25255 | High | 7.5 | 2025-05-21 | Yandex Browser Lite for Android prior to version 21.1.0 allows remote attackers to cause a denial of service. |
CVE-2025-47283 | Critical | 9.9 | 2025-05-19 | Gardener implements the automated management and operation of Kubernetes clusters as a service. A security vulnerability was discovered in Gardener prior to ve… |
CVE-2025-47282 | Critical | 9.9 | 2025-05-19 | Gardener External DNS Management is an environment to manage external DNS entries for a kubernetes cluster. A security vulnerability was discovered in Gardener… |
CVE-2025-4905 | Medium | 5.3 | 2025-05-19 | A vulnerability was found in iop-apl-uw basestation3 up to 3.0.4 and classified as problematic. This issue affects the function load_qc_pickl of the file bases… |
CVE-2025-22233 | Low | 3.1 | 2025-05-16 | CVE-2024-38820 ensured Locale-independent, lowercase conversion for both the configured disallowedFields patterns and for request parameter names. However, the… |
CVE-2025-2305 | High | 8.6 | 2025-05-16 | A Path traversal vulnerability in the file download functionality was identified. This vulnerability allows unauthenticated users to download arbitrary files… |
CVE-2024-53827 | High | 7.5 | 2025-05-16 | Ericsson Packet Core Controller (PCC) contains a vulnerability where an attacker sending a large volume of specially crafted messages may cause service degrada… |
CVE-2025-4742 | Medium | 5.3 | 2025-05-16 | A vulnerability classified as problematic has been found in XU-YIJIE grpo-flat up to 9024b43f091e2eb9bac65802b120c0b35f9ba856. Affected is the function main of… |
CVE-2025-4740 | Medium | 5.3 | 2025-05-16 | A vulnerability was found in BeamCtrl Airiana up to 11.0. It has been declared as problematic. This vulnerability affects unknown code of the file coef. The ma… |
CVE-2024-52880 | High | 7.9 | 2025-05-15 | An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before version 05.46.50, kernel… |
CVE-2025-4701 | Medium | 5.3 | 2025-05-15 | A vulnerability, which was classified as problematic, has been found in VITA-MLLM Freeze-Omni up to 20250421. This issue affects the function torch.load of the… |
CVE-2025-4762 | | 2025-05-15 | Insecure Direct Object Reference (IDOR) vulnerability in the eSignaViewer component in eSigna product versions 1.0 to 1.5 on all platforms allow an unauthentic… | |
CVE-2025-46836 | Medium | 6.6 | 2025-05-14 | net-tools is a collection of programs that form the base set of the NET-3 networking distribution for the Linux operating system. Inn versions up to and includ… |
CVE-2025-47888 | Medium | 5.9 | 2025-05-14 | Jenkins DingTalk Plugin 2.7.3 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections to the configured DingTalk webho… |
CVE-2025-47777 | Critical | 9.6 | 2025-05-14 | 5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. Versions prior to 0.11.1 are vulnerable to stored cross-s… |
CVE-2025-24785 | Medium | 4.3 | 2025-05-14 | iTop is an web based IT Service Management tool. In version 3.2.0, an attacker may send a URL to the server to trigger a PHP error. The next user trying to loa… |
CVE-2025-43560 | Critical | 9.1 | 2025-05-13 | ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code executi… |
CVE-2025-43559 | Critical | 9.1 | 2025-05-13 | ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code executi… |
CVE-2025-24308 | High | 7.5 | 2025-05-13 | Improper input validation in the UEFI firmware error handler for the Intel(R) Server D50DNP and M50FCP may allow a privileged user to potentially enable escala… |
CVE-2025-21094 | High | 7.5 | 2025-05-13 | Improper input validation in the UEFI firmware DXE module for the Intel(R) Server D50DNP and M50FCP boards may allow a privileged user to potentially enable es… |
CVE-2025-20034 | Medium | 5.3 | 2025-05-13 | Improper input validation in the BackupBiosUpdate UEFI firmware SmiVariable driver for the Intel(R) Server D50DNP and M50FCP boards before version R01.02.0003… |
CVE-2025-20032 | High | 7.9 | 2025-05-13 | Improper input validation for some Intel(R) PROSet/Wireless WiFi Software for Windows before version 23.100 may allow a privileged user to potentially enable d… |
CVE-2025-20031 | Medium | 6.5 | 2025-05-13 | Improper input validation for some Intel(R) Graphics Drivers may allow an authenticated user to potentially enable denial of service via local access. |
CVE-2025-20009 | Medium | 4.1 | 2025-05-13 | Improper input validation in the UEFI firmware GenerationSetup module for the Intel(R) Server D50DNP and M50FCP boards may allow a privileged user to potential… |
CVE-2025-32706 | High | 7.8 | 2025-05-13 | Improper input validation in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-29968 | Medium | 6.5 | 2025-05-13 | Improper input validation in Active Directory Certificate Services (AD CS) allows an authorized attacker to deny service over a network. |
CVE-2025-29955 | Medium | 6.2 | 2025-05-13 | Improper input validation in Windows Hyper-V allows an unauthorized attacker to deny service locally. |
CVE-2025-40556 | Medium | 6.5 | 2025-05-13 | A vulnerability has been identified in BACnet ATEC 550-440 (All versions), BACnet ATEC 550-441 (All versions), BACnet ATEC 550-445 (All versions), BACnet ATEC… |
CVE-2025-24510 | Medium | 6.5 | 2025-05-13 | A vulnerability has been identified in MS/TP Point Pickup Module (All versions). Affected devices improperly handle specific incoming BACnet MSTP messages. Thi… |
CVE-2025-31259 | High | 7.8 | 2025-05-12 | A privacy issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.5, macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An app ma… |
CVE-2025-31240 | High | 7.5 | 2025-05-12 | This issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. Mounting a maliciously cra… |
CVE-2025-31233 | Medium | 6.3 | 2025-05-12 | The issue was addressed with improved input sanitization. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7… |
CVE-2025-31217 | Medium | 6.5 | 2025-05-12 | The issue was addressed with improved input validation. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, tvOS 1… |
CVE-2025-31215 | Medium | 6.5 | 2025-05-12 | The issue was addressed with improved checks. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, tvOS 18.5, visio… |
CVE-2025-31208 | High | 7.5 | 2025-05-12 | The issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ve… |
CVE-2025-30442 | High | 7.8 | 2025-05-12 | The issue was addressed with improved input sanitization. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. An app may be a… |
CVE-2025-24274 | High | 7.8 | 2025-05-12 | An input validation issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6… |
CVE-2025-1087 | | 2025-05-09 | Kong Insomnia Desktop Application before 11.0.2 contains a template injection vulnerability that allows attackers to execute arbitrary code. The vulnerability… | |
CVE-2025-4377 | | 2025-05-09 | Improper Limitation of a Pathname caused a Path Traversal vulnerability in Sparx Systems Pro Cloud Server. This vulnerability is present in logview.php and it… | |
CVE-2025-4376 | | 2025-05-09 | Improper Input Validation vulnerability in Sparx Systems Pro Cloud Server's WebEA model search field allows Cross-Site Scripting (XSS). This issue affects Pro… | |
CVE-2025-40846 | | 2025-05-08 | Improper Input Validation, the returnUrl parameter in Account Security Settings lacks proper input validation, allowing attackers to redirect users to maliciou… | |
CVE-2025-20197 | Medium | 6.7 | 2025-05-07 | A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with privilege level 15 to elevate privileges to root on the u… |
CVE-2025-20154 | High | 8.6 | 2025-05-07 | A vulnerability in the Two-Way Active Measurement Protocol (TWAMP) server feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticate… |
CVE-2025-21460 | High | 7.8 | 2025-05-06 | Memory corruption while processing a message, when the buffer is controlled by a Guest VM, the value can be changed continuously. |
CVE-2024-49845 | High | 7.8 | 2025-05-06 | Memory corruption during the FRS UDS generation process. |
CVE-2024-49844 | High | 7.8 | 2025-05-06 | Memory corruption while triggering commands in the PlayReady Trusted application. |
CVE-2024-45579 | High | 7.8 | 2025-05-06 | Memory corruption may occur when invoking IOCTL calls from userspace to the camera kernel driver to dump request information, due to a missing memory requireme… |
CVE-2024-45577 | High | 7.8 | 2025-05-06 | Memory corruption while invoking IOCTL calls from userspace to camera kernel driver to dump request information. |
CVE-2025-46340 | High | 7.2 | 2025-05-05 | Misskey is an open source, federated social media platform. Starting in version 12.0.0 and prior to version 2025.4.1, due to an oversight in the validation per… |
CVE-2025-4260 | Medium | 4.3 | 2025-05-05 | A vulnerability was found in zhangyanbo2007 youkefu up to 4.2.0 and classified as problematic. Affected by this issue is the function impsave of the file m\web… |
CVE-2024-13943 | High | 7.8 | 2025-04-30 | Tesla Model S Iris Modem QCMAP_ConnectionManager Improper Input Validation Sandbox Escape Vulnerability. This vulnerability allows local attackers to escape th… |
CVE-2025-30391 | High | 8.1 | 2025-04-30 | Improper input validation in Microsoft Dynamics allows an unauthorized attacker to disclose information over a network. |
CVE-2025-22235 | High | 7.3 | 2025-04-28 | EndpointRequest.to() creates a matcher for null/** if the actuator endpoint, for which the EndpointRequest has been created, is disabled or not exposed. Your… |
CVE-2025-46574 | Medium | 4.1 | 2025-04-27 | There is an information disclosure vulnerability in the GoldenDB database product. Attackers can exploit error messages to obtain the system's sensitive inform… |
CVE-2025-26413 | High | 7.5 | 2025-04-22 | Improper Input Validation vulnerability in Apache Kvrocks. The SETRANGE command didn't check if the `offset` input is a positive integer and use it as an inde… |
CVE-2025-3837 | | 2025-04-21 | An improper input validation vulnerability is identified in the End of Life (EOL) OVA based connect component which is deployed for installation purposes in th… | |
CVE-2025-29784 | High | 7.5 | 2025-04-18 | NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, the s parameter in GET requests for forum sear… |
CVE-2025-27599 | Medium | 6.5 | 2025-04-18 | Element X Android is a Matrix Android Client provided by element.io. Prior to version 25.04.2, a crafted hyperlink on a webpage, or a locally installed malicio… |
CVE-2025-26477 | Medium | 4.3 | 2025-04-17 | Dell ECS version 3.8.1.4 and prior contain an Improper Input Validation vulnerability. A low privileged attacker with remote access could potentially exploit t… |
CVE-2025-3677 | Medium | 5.3 | 2025-04-16 | A vulnerability classified as critical was found in lm-sys fastchat up to 0.2.36. This vulnerability affects the function split_files/apply_delta_low_cpu_mem o… |
CVE-2025-3622 | Medium | 5.5 | 2025-04-15 | A vulnerability, which was classified as critical, has been found in Xorbits Inference up to 1.4.1. This issue affects the function load of the file xinference… |