CWE-20 · Improper Input Validation (page 20)
Page 20 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-40836 | Critical | 9.8 | 2025-09-25 | Ericsson Indoor Connect 8855 contains an improper input validation vulnerability which if exploited can allow an attacker to execute commands with escalated pr… |
CVE-2025-10950 | Medium | 6.3 | 2025-09-25 | A vulnerability was determined in geyang ml-logger up to acf255bade5be6ad88d90735c8367b28cbe3a743. Affected is the function log_handler of the file ml_logger/s… |
CVE-2025-52907 | High | 8.8 | 2025-09-24 | Improper Input Validation vulnerability in TOTOLINK X6000R allows Command Injection, File Manipulation.This issue affects X6000R: through V9.4.0cu.1360_B202412… |
CVE-2025-47314 | High | 7.8 | 2025-09-24 | Memory corruption while processing data sent by FE driver. |
CVE-2025-52905 | High | 7.5 | 2025-09-23 | Improper Input Validation vulnerability in TOTOLINK X6000R allows Flooding.This issue affects X6000R: through V9.4.0cu.1360_B20241207. |
CVE-2025-59535 | Medium | 6.5 | 2025-09-22 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, arbitrary themes can be… |
CVE-2025-59532 | | 2025-09-22 | Codex CLI is a coding agent from OpenAI that runs locally. In versions 0.2.0 to 0.38.0, due to a bug in the sandbox configuration logic, Codex CLI could treat… | |
CVE-2025-10771 | Medium | 6.3 | 2025-09-21 | A vulnerability was determined in jeecgboot JimuReport up to 2.1.2. Affected is an unknown function of the file /drag/onlDragDataSource/testConnection of the c… |
CVE-2025-10770 | Medium | 6.3 | 2025-09-21 | A vulnerability was found in jeecgboot JimuReport up to 2.1.2. This impacts an unknown function of the file /drag/onlDragDataSource/testConnection of the compo… |
CVE-2025-10769 | Medium | 6.3 | 2025-09-21 | A vulnerability has been found in h2oai h2o-3 up to 3.46.08. This affects an unknown function of the file /99/ImportSQLTable of the component H2 JDBC Driver. S… |
CVE-2025-10768 | Medium | 6.3 | 2025-09-21 | A flaw has been found in h2oai h2o-3 up to 3.46.08. The impacted element is an unknown function of the file /99/ImportSQLTable of the component IBMDB2 JDBC Dri… |
CVE-2025-57644 | Critical | 9.1 | 2025-09-19 | Accela Automation Platform 22.2.3.0.230103 contains multiple vulnerabilities in the Test Script feature. An authenticated administrative user can execute arbit… |
CVE-2025-57528 | High | 7.7 | 2025-09-19 | An issue was discovered in Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01 allowing attackers to cause a denial of service via the funcname, funcpara1, funcpara… |
CVE-2025-58114 | Medium | 4.8 | 2025-09-19 | Improper Input Validation vulnerability in Hallo Welt! GmbH BlueSpice (Extension:CognitiveProcessDesigner) allows Cross-Site Scripting (XSS).This issue affects… |
CVE-2025-10630 | Medium | 4.3 | 2025-09-19 | Grafana is an open-source platform for monitoring and observability. Grafana-Zabbix is a plugin for Grafana allowing to visualize monitoring data from Zabbix a… |
CVE-2025-23336 | Medium | 4.4 | 2025-09-17 | NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where an attacker could cause a denial of service by loading a misconfigured mode… |
CVE-2025-23268 | High | 8.0 | 2025-09-17 | NVIDIA Triton Inference Server contains a vulnerability in the DALI backend where an attacker may cause an improper input validation issue. A successful exploi… |
CVE-2025-10155 | High | 7.8 | 2025-09-17 | An Improper Input Validation vulnerability in the scanning logic of mmaitre314 picklescan versions up to and including 0.0.30 allows a remote attacker to bypas… |
CVE-2025-59161 | | 2025-09-16 | Element Web is a Matrix web client built using the Matrix React SDK. Element Web and Element Desktop before version 1.11.112 have insufficient validation of ro… | |
CVE-2025-43375 | Medium | 5.5 | 2025-09-15 | The issue was addressed with improved checks. This issue is fixed in Xcode 26. Processing an overly large path value may crash a process. |
CVE-2025-43372 | High | 7.8 | 2025-09-15 | The issue was addressed with improved input validation. This issue is fixed in iOS 26 and iPadOS 26, macOS Sonoma 14.8.2, macOS Tahoe 26, tvOS 26, visionOS 26… |
CVE-2025-43347 | Critical | 9.8 | 2025-09-15 | This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. An inp… |
CVE-2025-43342 | Critical | 9.8 | 2025-09-15 | A correctness issue was addressed with improved checks. This issue is fixed in Safari 26, iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS… |
CVE-2025-43299 | Medium | 5.5 | 2025-09-15 | A denial-of-service issue was addressed with improved validation. This issue is fixed in iOS 18.7 and iPadOS 18.7, macOS Sequoia 15.7, macOS Sonoma 14.8, macOS… |
CVE-2025-43293 | Medium | 5.5 | 2025-09-15 | The issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An app may be able to acc… |
CVE-2025-10433 | Medium | 6.3 | 2025-09-15 | A vulnerability was determined in 1Panel-dev MaxKB up to 2.0.2/2.1.0. This issue affects some unknown processing of the file /admin/api/workspace/default/tool/… |
CVE-2024-45431 | Medium | 5.3 | 2025-09-12 | OpenSynergy BlueSDK (aka Blue SDK) through 6.x has Improper Input Validation. The specific flaw exists within the BlueSDK Bluetooth stack. The issue results fr… |
CVE-2025-58364 | Medium | 6.5 | 2025-09-11 | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.12 and earlier, an unsafe deserialization… |
CVE-2025-10252 | Low | 3.1 | 2025-09-11 | A flaw has been found in SEAT Queue Ticket Kiosk up to 20250827. This affects an unknown part of the component Java RMI Registry Handler. This manipulation cau… |
CVE-2025-54123 | Critical | 9.8 | 2025-09-10 | Hoverfly is an open source API simulation tool. In versions 1.11.3 and prior, the middleware functionality in Hoverfly is vulnerable to command injection vulne… |
CVE-2025-56404 | High | 7.5 | 2025-09-10 | An issue was discovered in MariaDB MCP 0.1.0 allowing attackers to gain sensitive information via the SSE service as the SSE service lacks user validation. |
CVE-2025-58759 | Medium | 5.1 | 2025-09-09 | TinyEnv is an environment variable loader for PHP applications. In versions 1.0.9 and 1.0.10, TinyEnv did not properly strip inline comments inside .env values… |
CVE-2025-10164 | High | 7.3 | 2025-09-09 | A security flaw has been discovered in lmsys sglang 0.4.6. Affected by this vulnerability is the function main of the file /update_weights_from_tensor. The man… |
CVE-2025-54250 | Medium | 4.9 | 2025-09-09 | Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypas… |
CVE-2025-54248 | High | 7.7 | 2025-09-09 | Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypas… |
CVE-2025-54247 | Medium | 6.5 | 2025-09-09 | Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypas… |
CVE-2025-53809 | Medium | 6.5 | 2025-09-09 | Improper input validation in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to deny service over a network. |
CVE-2025-54236 | Critical | 9.1 | 2025-09-09 | Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerabilit… |
CVE-2025-8007 | Medium | 6.5 | 2025-09-09 | A security issue exists in the protected mode of 1756-EN4TR and 1756-EN2TR communication modules, where a Concurrent Forward Close operation can trigger a Majo… |
CVE-2025-10061 | Medium | 6.5 | 2025-09-05 | An authorized user can cause a crash in the MongoDB Server through a specially crafted $group query. This vulnerability is related to the incorrect handling of… |
CVE-2025-58361 | Critical | 9.3 | 2025-09-04 | Promptcraft Forge Studio is a toolkit for evaluating, optimizing, and maintaining LLM-powered applications. All versions contain an non-exhaustive URL scheme… |
CVE-2025-58353 | High | 8.2 | 2025-09-04 | Promptcraft Forge Studio is a toolkit for evaluating, optimizing, and maintaining LLM-powered applications. All versions of Promptcraft Forge Studio sanitize… |
CVE-2025-32322 | High | 7.8 | 2025-09-04 | In onCreate of MediaProjectionPermissionActivity.java , there is a possible way to grant a malicious app a token enabling unauthorized screen recording capabil… |
CVE-2025-48559 | Medium | 5.5 | 2025-09-04 | In multiple functions of AppOpsService.java, there is a possible add a large amount of app ops due to improper input validation. This could lead to local denia… |
CVE-2025-48556 | High | 7.3 | 2025-09-04 | In multiple methods of NotificationChannel.java, there is a possible desynchronization from persistence due to improper input validation. This could lead to lo… |
CVE-2025-48541 | High | 7.8 | 2025-09-04 | In onCreate of FaceSettings.java, there is a possible way to remove biometric unlock across user profiles due to improper input validation. This could lead to… |
CVE-2025-48538 | Medium | 5.5 | 2025-09-04 | In setApplicationHiddenSettingAsUser of PackageManagerService.java, there is a possible way to hide a system critical package due to improper input validation… |
CVE-2025-48537 | High | 7.1 | 2025-09-04 | In multiple locations, there is a possible way to persistently DoS the device due to improper input validation. This could lead to local information disclosure… |
CVE-2025-32323 | High | 7.8 | 2025-09-04 | In getCallingAppName of Shared.java, there is a possible way to trick users into granting file access via deceptive text in a permission popup due to improper… |
CVE-2025-26429 | Medium | 5.5 | 2025-09-04 | In collectOps of AppOpsService.java, there is a possible way to cause permanent DoS due to improper input validation. This could lead to local denial of servic… |
CVE-2025-26426 | Medium | 5.1 | 2025-09-04 | In BroadcastController.java of registerReceiverWithFeatureTraced, there is a possible way to receive broadcasts meant for the "android" package due to improper… |
CVE-2025-9467 | | 2025-09-04 | When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is possible to bypass the upload validation. Users of affe… | |
CVE-2024-56190 | High | 7.8 | 2025-09-04 | In wl_update_hidden_ap_ie() of wl_cfgscan.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of p… |
CVE-2024-43115 | High | 8.8 | 2025-09-03 | Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can execute any shell script server by alert script. This issue aff… |
CVE-2023-21473 | Medium | 6.8 | 2025-09-03 | Improper input validation with Exynos Fastboot USB Interface prior to SMR Apr-2023 Release 1 allows a physical attacker to execute arbitrary code in bootloader. |
CVE-2023-21472 | Medium | 6.8 | 2025-09-03 | Improper input validation with Exynos Fastboot USB Interface prior to SMR Apr-2023 Release 1 allows a physical attacker to execute arbitrary code in bootloader. |
CVE-2025-46047 | Medium | 6.5 | 2025-09-02 | A User enumeration vulnerability in the /CredentialsServlet/ForgotPassword endpoint in Silverpeas 6.4.1 and 6.4.2 allows remote attackers to determine valid us… |
CVE-2025-52547 | High | 7.5 | 2025-09-02 | E3 Site Supervisor Control (firmware version < 2.31F01) MGW contains an API call that lacks input validation. An attacker can use this command to continuously… |
CVE-2025-52544 | High | 7.5 | 2025-09-02 | E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenticated attacker to upload floor plan files. By upl… |
CVE-2025-8662 | Medium | 4.3 | 2025-09-02 | OpenAM (OpenAM Consortium Edition) contains a vulnerability that may cause it to malfunction as a SAML IdP due to a tampered request.This issue affects OpenAM… |
CVE-2025-55173 | Medium | 4.3 | 2025-08-29 | Next.js is a React framework for building full-stack web applications. In versions before 14.2.31 and from 15.0.0 to before 15.4.5, Next.js Image Optimization… |
CVE-2025-57220 | Medium | 5.3 | 2025-08-28 | An input validation flaw in the 'ate' service of Tenda AC10 v4.0 firmware v16.03.10.09_multi_TDE01 to escalate privileges to root via a crafted UDP packet. |
CVE-2025-9195 | Medium | 4.4 | 2025-08-28 | Improper input validation in firmware of some Solidigm DC Products may allow an attacker with local access to cause a Denial of Service |
CVE-2024-37777 | High | 8.8 | 2025-08-27 | O2OA v9.0.3 was discovered to contain a remote code execution (RCE) vulnerability via the mainOutput() function. |
CVE-2025-34161 | High | 8.8 | 2025-08-27 | Coolify versions prior to v4.0.0-beta.420.7 are vulnerable to a remote code execution vulnerability in the project deployment workflow. The platform allows aut… |
CVE-2025-34159 | High | 8.8 | 2025-08-27 | Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a remote code execution vulnerability in the application deployment workflow. The platform allows… |
CVE-2025-34157 | Critical | 9.0 | 2025-08-27 | Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a stored cross-site scripting (XSS) attack in the project creation workflow. An authenticated use… |
CVE-2025-57810 | High | 7.5 | 2025-08-26 | jsPDF is a library to generate PDFs in JavaScript. Prior to 3.0.2, user control of the first argument of the addImage method results in CPU utilization and den… |
CVE-2025-57805 | | 2025-08-25 | The Scratch Channel is a news website. In versions 1 and 1.1, a POST request to the endpoint used to publish articles, can be used to post an article in any ca… | |
CVE-2025-55301 | Medium | 6.7 | 2025-08-25 | The Scratch Channel is a news website. In version 1, it is possible to go to application in devtools and click local storage to edit the account's username loc… |
CVE-2025-52451 | High | 8.5 | 2025-08-22 | Improper Input Validation vulnerability in Salesforce Tableau Server on Windows, Linux (tabdoc api - create-data-source-from-file-upload modules) allows Absolu… |
CVE-2025-50674 | High | 7.8 | 2025-08-22 | An issue was discovered in the changePassword method in file /usr/share/php/openmediavault/system/user.inc in OpenMediaVault 7.4.17 allowing local authenticate… |
CVE-2025-9288 | Critical | 9.1 | 2025-08-20 | Improper Input Validation vulnerability in sha.js allows Input Data Manipulation.This issue affects sha.js: through 2.4.11. |
CVE-2025-9287 | Critical | 9.1 | 2025-08-20 | Improper Input Validation vulnerability in cipher-base allows Input Data Manipulation.This issue affects cipher-base: through 1.0.4. |
CVE-2025-55444 | Critical | 9.8 | 2025-08-20 | A SQL injection vulnerability exists in the id2 parameter of the cancel_booking.php page in Online Artwork and Fine Arts MCA Project 1.0. A remote attacker can… |
CVE-2011-10020 | | 2025-08-20 | Kaillera Server version 0.86 is vulnerable to a denial-of-service condition triggered by sending a malformed UDP packet after the initial handshake. Once a cli… | |
CVE-2025-36114 | Medium | 6.5 | 2025-08-20 | IBM QRadar SOAR Plugin App 1.0.0 through 5.6.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted… |
CVE-2025-7693 | | 2025-08-18 | A security issue exists due to improper handling of malformed CIP Forward Close packets during fuzzing. The controller enters a solid red Fault LED state and b… | |
CVE-2025-6625 | High | 7.5 | 2025-08-18 | CWE-20: Improper Input Validation vulnerability exists that could cause a Denial Of Service when specific crafted FTP command is sent to the device. |
CVE-2025-52620 | Medium | 4.3 | 2025-08-15 | HCL BigFix SaaS Authentication Service is affected by a Cross-Site Scripting (XSS) vulnerability. The image upload functionality inadequately validated the su… |
CVE-2025-9060 | Critical | 9.1 | 2025-08-15 | A vulnerability has been found in the MSoft MFlash application that allows execution of arbitrary code on the server. The issue occurs in the integration… |
CVE-2025-7507 | Medium | 6.4 | 2025-08-15 | The elink – Embed Content plugin for WordPress is vulnerable to Malicious Redirect in all versions up to, and including, 1.1.0. This is due to the plugin not r… |
CVE-2025-20148 | High | 8.5 | 2025-08-14 | A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, remote attacker t… |
CVE-2025-8876 | High | 8.8 | 2025-08-14 | Improper Input Validation vulnerability in N-able N-central allows OS Command Injection.This issue affects N-central: before 2025.3.1. |
CVE-2025-7971 | | 2025-08-14 | A security issues exists within Studio 5000 Logix Designer due to unsafe handling of environment variables. If the specified path lacks a valid file, Logix Des… | |
CVE-2025-8963 | Medium | 6.3 | 2025-08-14 | A vulnerability was determined in jeecgboot JimuReport up to 2.1.1. Affected by this issue is some unknown functionality of the file /drag/onlDragDataSource/te… |
CVE-2025-27388 | | 2025-08-14 | Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens. | |
CVE-2025-4410 | High | 7.5 | 2025-08-13 | A buffer overflow vulnerability exists in the module SetupUtility. An attacker with local privileged access can exploit this vulnerability by executeing arbitr… |
CVE-2025-4277 | High | 7.5 | 2025-08-13 | Tcg2Smm has a vulnerability which can be used to write arbitrary memory inside SMRAM and execute arbitrary code at SMM level. |
CVE-2025-4276 | High | 7.5 | 2025-08-13 | UsbCoreDxe has a vulnerability which can be used to write arbitrary memory inside SMRAM and execute arbitrary code at SMM level. |
CVE-2025-49554 | High | 7.5 | 2025-08-12 | Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an Improper Input Validation vulnerabilit… |
CVE-2025-25005 | Medium | 6.5 | 2025-08-12 | Improper input validation in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network. |
CVE-2025-32004 | Low | 3.9 | 2025-08-12 | Improper input validation in the Intel Edger8r Tool for some Intel(R) SGX SDK may allow an authenticated user to potentially enable escalation of privilege via… |
CVE-2025-27537 | Medium | 5.5 | 2025-08-12 | Improper input validation for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an authenticated user to po… |
CVE-2025-24486 | High | 7.8 | 2025-08-12 | Improper input validation in the Linux kernel-mode driver for some Intel(R) 700 Series Ethernet before version 2.28.5 may allow an authenticated user to potent… |
CVE-2025-24484 | High | 7.8 | 2025-08-12 | Improper input validation in the Linux kernel-mode driver for some Intel(R) 800 Series Ethernet before version 1.17.2 may allow an authenticated user to potent… |
CVE-2025-24325 | High | 8.8 | 2025-08-12 | Improper input validation in the Linux kernel-mode driver for some Intel(R) 800 Series Ethernet before version 1.17.2 may allow an authenticated user to potent… |
CVE-2025-24296 | Medium | 6.0 | 2025-08-12 | Improper input validation in some firmware for the Intel(R) E810 Ethernet before version 4.6 may allow a privileged user to enable denial of service via local… |
CVE-2025-21086 | High | 7.5 | 2025-08-12 | Improper input validation in the Linux kernel-mode driver for some Intel(R) 700 Series Ethernet before version 2.28.5 may allow an authenticated user to potent… |
CVE-2025-40746 | Critical | 9.1 | 2025-08-12 | A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V3.2). Affected products do not properly validate input for a backup scrip… |