CWE-20 · Improper Input Validation (page 23)
Page 23 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-45577 | High | 7.8 | 2025-05-06 | Memory corruption while invoking IOCTL calls from userspace to camera kernel driver to dump request information. |
CVE-2025-46340 | High | 7.2 | 2025-05-05 | Misskey is an open source, federated social media platform. Starting in version 12.0.0 and prior to version 2025.4.1, due to an oversight in the validation per… |
CVE-2025-4260 | Medium | 4.3 | 2025-05-05 | A vulnerability was found in zhangyanbo2007 youkefu up to 4.2.0 and classified as problematic. Affected by this issue is the function impsave of the file m\web… |
CVE-2024-13943 | High | 7.8 | 2025-04-30 | Tesla Model S Iris Modem QCMAP_ConnectionManager Improper Input Validation Sandbox Escape Vulnerability. This vulnerability allows local attackers to escape th… |
CVE-2025-30391 | High | 8.1 | 2025-04-30 | Improper input validation in Microsoft Dynamics allows an unauthorized attacker to disclose information over a network. |
CVE-2025-22235 | High | 7.3 | 2025-04-28 | EndpointRequest.to() creates a matcher for null/** if the actuator endpoint, for which the EndpointRequest has been created, is disabled or not exposed. Your… |
CVE-2025-46574 | Medium | 4.1 | 2025-04-27 | There is an information disclosure vulnerability in the GoldenDB database product. Attackers can exploit error messages to obtain the system's sensitive inform… |
CVE-2025-26413 | High | 7.5 | 2025-04-22 | Improper Input Validation vulnerability in Apache Kvrocks. The SETRANGE command didn't check if the `offset` input is a positive integer and use it as an inde… |
CVE-2025-3837 | | 2025-04-21 | An improper input validation vulnerability is identified in the End of Life (EOL) OVA based connect component which is deployed for installation purposes in th… | |
CVE-2025-29784 | High | 7.5 | 2025-04-18 | NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, the s parameter in GET requests for forum sear… |
CVE-2025-27599 | Medium | 6.5 | 2025-04-18 | Element X Android is a Matrix Android Client provided by element.io. Prior to version 25.04.2, a crafted hyperlink on a webpage, or a locally installed malicio… |
CVE-2025-26477 | Medium | 4.3 | 2025-04-17 | Dell ECS version 3.8.1.4 and prior contain an Improper Input Validation vulnerability. A low privileged attacker with remote access could potentially exploit t… |
CVE-2025-3677 | Medium | 5.3 | 2025-04-16 | A vulnerability classified as critical was found in lm-sys fastchat up to 0.2.36. This vulnerability affects the function split_files/apply_delta_low_cpu_mem o… |
CVE-2025-3622 | Medium | 5.5 | 2025-04-15 | A vulnerability, which was classified as critical, has been found in Xorbits Inference up to 1.4.1. This issue affects the function load of the file xinference… |
CVE-2025-3590 | Medium | 6.3 | 2025-04-14 | A vulnerability has been found in Adianti Framework up to 8.0 and classified as critical. Affected by this vulnerability is an unknown functionality. The manip… |
CVE-2025-32079 | Medium | 6.5 | 2025-04-11 | Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments allows HTTP DoS.This issue affects Mediawiki - GrowthExperime… |
CVE-2025-32077 | | 2025-04-11 | Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Extension:SimpleCalendar allows Cross-Site Scripting (XSS).This issue affects M… | |
CVE-2025-32076 | | 2025-04-11 | Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Visual Data Extension allows HTTP DoS.This issue affects Mediawiki - Visual Dat… | |
CVE-2025-32075 | | 2025-04-11 | Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Tabs Extension allows Code Injection.This issue affects Mediawiki - Tabs Extens… | |
CVE-2025-32073 | Medium | 5.4 | 2025-04-11 | Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - HTML Tags allows Cross-Site Scripting (XSS).This issue affects Mediawiki - HTML… |
CVE-2025-32071 | Medium | 5.4 | 2025-04-11 | Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Wikidata Extension allows Cross-Site Scripting (XSS) from widthheight message v… |
CVE-2025-32070 | Medium | 5.4 | 2025-04-11 | Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - AJAX Poll Extension allows Cross-Site Scripting (XSS).This issue affects Mediaw… |
CVE-2025-32069 | Medium | 5.4 | 2025-04-11 | Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Wikibase Media Info Extension allows Cross-Site Scripting (XSS).This issue affe… |
CVE-2025-32067 | Medium | 5.4 | 2025-04-11 | Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Growth Experiments Extension allows Cross-Site Scripting (XSS).This issue affec… |
CVE-2023-42981 | Medium | 5.4 | 2025-04-11 | Processing a file may lead to a denial-of-service or potentially disclose memory contents. This issue is fixed in macOS 14. The issue was addressed with improv… |
CVE-2023-42977 | High | 7.8 | 2025-04-11 | A path handling issue was addressed with improved validation. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14. An app may be able to break out of… |
CVE-2025-29150 | Medium | 4.3 | 2025-04-10 | BlueCMS 1.6 suffers from Arbitrary File Deletion via the id parameter in an /publish.php?act=del request. |
CVE-2023-43037 | Medium | 6.5 | 2025-04-10 | IBM Maximo Application Suite 8.11 and 9.0 could allow an authenticated user to perform unauthorized actions due to improper input validation. |
CVE-2025-30649 | High | 7.5 | 2025-04-09 | An Improper Input Validation vulnerability in the syslog stream TCP transport of Juniper Networks Junos OS on MX240, MX480 and MX960 devices with MX-SPC3 Secur… |
CVE-2025-30648 | High | 7.4 | 2025-04-09 | An Improper Input Validation vulnerability in the Juniper DHCP Daemon (jdhcpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adj… |
CVE-2025-31672 | Medium | 5.3 | 2025-04-09 | Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files like xlsx, docx and pptx. These file formats are bas… |
CVE-2025-2223 | High | 7.8 | 2025-04-09 | CWE-20: Improper Input Validation vulnerability exists that could cause a loss of Confidentiality, Integrity and Availability of engineering workstation when a… |
CVE-2025-30294 | Medium | 6.8 | 2025-04-08 | ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a security feature byp… |
CVE-2025-30293 | Medium | 6.8 | 2025-04-08 | ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a security feature byp… |
CVE-2025-24446 | Critical | 9.1 | 2025-04-08 | ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code executi… |
CVE-2025-29821 | Medium | 5.5 | 2025-04-08 | Improper input validation in Dynamics Business Central allows an authorized attacker to disclose information locally. |
CVE-2025-29811 | High | 7.8 | 2025-04-08 | Improper input validation in Windows Mobile Broadband allows an authorized attacker to elevate privileges locally. |
CVE-2025-27737 | High | 8.6 | 2025-04-08 | Improper input validation in Windows Security Zone Mapping allows an unauthorized attacker to bypass a security feature locally. |
CVE-2025-27731 | High | 7.8 | 2025-04-08 | Improper input validation in OpenSSH for Windows allows an authorized attacker to elevate privileges locally. |
CVE-2025-27489 | High | 7.8 | 2025-04-08 | Improper input validation in Azure Local allows an authorized attacker to elevate privileges locally. |
CVE-2025-26647 | High | 8.8 | 2025-04-08 | Improper input validation in Windows Kerberos allows an authorized attacker to elevate privileges over a network. |
CVE-2025-24074 | High | 7.8 | 2025-04-08 | Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. |
CVE-2025-24073 | High | 7.8 | 2025-04-08 | Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. |
CVE-2025-24062 | High | 7.8 | 2025-04-08 | Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. |
CVE-2025-24060 | High | 7.8 | 2025-04-08 | Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. |
CVE-2025-24058 | High | 7.8 | 2025-04-08 | Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. |
CVE-2025-30151 | High | 7.5 | 2025-04-08 | Shopware is an open commerce platform. It's possible to pass long passwords that leads to Denial Of Service via forms in Storefront forms or Store-API. This vu… |
CVE-2025-3413 | Medium | 6.3 | 2025-04-08 | A vulnerability has been found in opplus springboot-admin up to a2d5310f44fd46780a8686456cf2f9001ab8f024 and classified as critical. Affected by this vulnerabi… |
CVE-2025-31488 | | 2025-04-06 | Plain Craft Launcher (PCL) is a launcher for Minecraft. PCL allows users to use homepages provided by third parties. If controls such as WebBrowser are used in… | |
CVE-2025-3250 | Medium | 4.3 | 2025-04-04 | A vulnerability, which was classified as problematic, has been found in elunez eladmin 2.7. Affected by this issue is some unknown functionality of the file /a… |
CVE-2025-3165 | Medium | 5.3 | 2025-04-03 | A vulnerability classified as critical has been found in thu-pacman chitu 0.1.0. This affects the function torch.load of the file chitu/chitu/backend.py. The m… |
CVE-2025-3162 | Medium | 5.3 | 2025-04-03 | A vulnerability was found in InternLM LMDeploy up to 0.7.1. It has been classified as critical. Affected is the function load_weight_ckpt of the file lmdeploy/… |
CVE-2025-31477 | Critical | 9.8 | 2025-04-02 | The Tauri shell plugin allows access to the system shell. Prior to 2.2.1, the Tauri shell plugin exposes functionality to execute code and open programs on the… |
CVE-2025-30080 | High | 7.5 | 2025-04-02 | Signalling in Pexip Infinity 29 through 36.2 before 37.0 has improper input validation that allows remote attackers to trigger a temporary denial of service (s… |
CVE-2024-37917 | High | 7.5 | 2025-04-02 | Pexip Infinity before 35.0 has improper input validation that allows remote attackers to trigger a denial of service (software abort) via a crafted signalling… |
CVE-2024-39780 | High | 7.8 | 2025-04-02 | A YAML deserialization vulnerability was found in the Robot Operating System (ROS) 'dynparam', a command-line tool for getting, setting, and deleting parameter… |
CVE-2025-3070 | Medium | 6.5 | 2025-04-02 | Insufficient validation of untrusted input in Extensions in Google Chrome prior to 135.0.7049.52 allowed a remote attacker to perform privilege escalation via… |
CVE-2025-3068 | High | 8.8 | 2025-04-02 | Inappropriate implementation in Intents in Google Chrome on Android prior to 135.0.7049.52 allowed a remote attacker to perform privilege escalation via a craf… |
CVE-2025-31135 | Medium | 5.3 | 2025-04-01 | Go-Guerrilla SMTP Daemon is a lightweight SMTP server written in Go. Prior to 1.6.7, when ProxyOn is enabled, the PROXY command will be accepted multiple times… |
CVE-2025-31132 | High | 8.1 | 2025-04-01 | Raven is an open-source messaging platform. A vulnerability allowed any logged in user to execute code via an API endpoint. This vulnerability is fixed in 2.1… |
CVE-2025-30471 | High | 7.5 | 2025-03-31 | A validation issue was addressed with improved logic. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5… |
CVE-2025-30452 | Critical | 9.8 | 2025-03-31 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An input validation issue w… |
CVE-2025-24255 | High | 8.4 | 2025-03-31 | A file access issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app… |
CVE-2025-24191 | Medium | 5.5 | 2025-03-31 | The issue was addressed with improved validation of environment variables. This issue is fixed in macOS Sequoia 15.4. An app may be able to modify protected pa… |
CVE-2023-0881 | High | 7.5 | 2025-03-31 | Running DDoS on tcp port 22 will trigger a kernel crash. This issue is introduced by the backport of a commit regarding nft_lookup without the subsequent fixes… |
CVE-2025-1736 | High | 7.3 | 2025-03-30 | In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when user-supplied headers are sent, the insuffic… |
CVE-2025-1734 | Medium | 5.3 | 2025-03-30 | In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when receiving headers from HTTP server, the head… |
CVE-2025-1217 | Low | 3.1 | 2025-03-29 | In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when http request module parses HTTP response obt… |
CVE-2025-2855 | Medium | 4.7 | 2025-03-27 | A vulnerability, which was classified as problematic, has been found in elunez eladmin up to 2.7. Affected by this issue is the function checkFile of the file… |
CVE-2025-30355 | High | 7.1 | 2025-03-27 | Synapse is an open source Matrix homeserver implementation. A malicious server can craft events which, when received, prevent Synapse version up to 1.127.0 fro… |
CVE-2025-20227 | Medium | 4.3 | 2025-03-26 | In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and Splunk Cloud Platform versions below 9.3.2408.107, 9.2.2406.112, 9.2.2403.115, 9.1.2312… |
CVE-2025-1440 | Medium | 5.3 | 2025-03-26 | The Advanced iFrame plugin for WordPress is vulnerable to unauthorized excessive creation of options on the aip_map_url_callback() function in all versions up… |
CVE-2025-1514 | High | 7.3 | 2025-03-26 | The Active Products Tables for WooCommerce. Use constructor to create tables plugin for WordPress is vulnerable to unauthorized filter calling due to insuffici… |
CVE-2025-30213 | High | 8.8 | 2025-03-25 | Frappe is a full-stack web application framework. Prior to versions 14.91.0 and 15.52.0, a system user was able to create certain documents in a specific way t… |
CVE-2025-24514 | High | 8.8 | 2025-03-25 | A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingress annotation can be used to inject co… |
CVE-2025-24513 | Medium | 4.8 | 2025-03-25 | A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where attacker-provided data are included in a filename by the i… |
CVE-2025-1098 | High | 8.8 | 2025-03-25 | A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `mirror-target` and `mirror-host` Ingress annotations… |
CVE-2025-1097 | High | 8.8 | 2025-03-25 | A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-cn` Ingress annotation can be used to… |
CVE-2025-23204 | Medium | 4.4 | 2025-03-24 | API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Starting in version 3.3.8, a security check that gets called after GraphQl res… |
CVE-2025-2690 | Medium | 6.3 | 2025-03-24 | A vulnerability, which was classified as critical, was found in yiisoft Yii2 up to 2.0.39. This affects the function Generate of the file phpunit\src\Framework… |
CVE-2025-2689 | Medium | 6.3 | 2025-03-24 | A vulnerability, which was classified as critical, has been found in yiisoft Yii2 up to 2.0.45. Affected by this issue is the function getIterator of the file… |
CVE-2025-2622 | Medium | 6.3 | 2025-03-22 | A vulnerability was found in aizuda snail-job 1.4.0. It has been classified as critical. Affected is the function getRuntime of the file /snail-job/workflow/ch… |
CVE-2024-13666 | Medium | 5.3 | 2025-03-22 | The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to IP Address Spoofing in all ver… |
CVE-2025-29814 | Critical | 9.3 | 2025-03-21 | Improper authorization in Microsoft Partner Center allows an authorized attacker to elevate privileges over a network. |
CVE-2025-29923 | Low | 3.7 | 2025-03-20 | go-redis is the official Redis client library for the Go programming language. Prior to 9.5.5, 9.6.3, and 9.7.2, go-redis potentially responds out of order whe… |
CVE-2025-1385 | | 2025-03-20 | When the library bridge feature is enabled, the clickhouse-library-bridge exposes an HTTP API on localhost. This allows clickhouse-server to dynamically load a… | |
CVE-2025-2376 | High | 7.3 | 2025-03-17 | A vulnerability has been found in viames Pair Framework up to 1.9.11 and classified as critical. Affected by this vulnerability is the function getCookieConten… |
CVE-2025-1767 | Medium | 6.5 | 2025-03-13 | This CVE only affects Kubernetes clusters that utilize the in-tree gitRepo volume to clone git repositories from other pods within the same node. Since the in-… |
CVE-2024-9042 | Medium | 5.9 | 2025-03-13 | This CVE affects only Windows worker nodes. Your worker node is vulnerable to this issue if it is running one of the affected versions listed below. |
CVE-2024-26290 | | 2025-03-12 | Improper Input Validation vulnerability in Avid Avid NEXIS E-series on Linux, Avid Avid NEXIS F-series on Linux, Avid Avid NEXIS PRO+ on Linux, Avid System Dir… | |
CVE-2025-20146 | High | 8.6 | 2025-03-12 | A vulnerability in the Layer 3 multicast feature of Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers, ASR 9902 Compact High-Perform… |
CVE-2025-20142 | High | 8.6 | 2025-03-12 | A vulnerability in the IPv4 access control list (ACL) feature and quality of service (QoS) policy feature of Cisco IOS XR Software for Cisco ASR 9000 Series Ag… |
CVE-2025-27494 | Critical | 9.1 | 2025-03-11 | A vulnerability has been identified in SiPass integrated AC5102 (ACC-G2) (All versions < V6.4.9), SiPass integrated ACC-AP (All versions < V6.4.9). Affected de… |
CVE-2025-27493 | High | 8.2 | 2025-03-11 | A vulnerability has been identified in SiPass integrated AC5102 (ACC-G2) (All versions < V6.4.9), SiPass integrated ACC-AP (All versions < V6.4.9). Affected de… |
CVE-2025-26702 | Medium | 4.9 | 2025-03-11 | Improper Input Validation vulnerability in ZTE GoldenDB allows Input Data Manipulation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.04. |
CVE-2025-0660 | Medium | 4.8 | 2025-03-10 | Concrete CMS versions 9.0.0 through 9.3.9 are affected by a stored XSS in Folder Function.The "Add Folder" functionality lacks input sanitization, allowing a r… |
CVE-2025-2043 | Medium | 4.7 | 2025-03-06 | A vulnerability was found in LinZhaoguan pb-cms 1.0.0 and classified as critical. This issue affects some unknown processing of the file /admin#themes of the c… |
CVE-2024-38311 | Medium | 6.3 | 2025-03-06 | Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2… |
CVE-2025-27517 | | 2025-03-05 | Volt is an elegantly crafted functional API for Livewire. Malicious, user-crafted request payloads could potentially lead to remote code execution within Volt… | |
CVE-2025-1080 | High | 7.8 | 2025-03-04 | LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server. An additional scheme 'vnd.libreoffice.command'… |