CWE-20 · Improper Input Validation (page 4)
Page 4 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-56547 | Low | 3.5 | 2026-08-26 | The Apple profile generated for the Apple built-in Mail, Calendar and Contacts account to synchronize with HCL Traveler requires the Logon Name and Mail Addres… |
CVE-2026-13480 | Low | 3.1 | 2026-08-26 | The LoRaWAN TS004 Fragmented Data Block Transport handler frag_transport_package_callback() in subsys/lorawan/services/frag_transport.c parses downlink command… |
CVE-2026-77554 | Critical | 10.0 | 2026-08-26 | A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Talk Application to execute a Command Inje… |
CVE-2026-77552 | Critical | 9.8 | 2026-08-26 | A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Enterprise Audio/Video Bridge to execute a… |
CVE-2026-77548 | Critical | 9.9 | 2026-08-26 | A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to… |
CVE-2026-77547 | Critical | 9.9 | 2026-08-26 | A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to e… |
CVE-2026-77546 | Critical | 9.9 | 2026-08-26 | A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to e… |
CVE-2026-77543 | Critical | 9.9 | 2026-08-26 | A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to e… |
CVE-2026-77542 | Critical | 9.1 | 2026-08-26 | A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UID Enterprise Agent to exec… |
CVE-2026-77540 | Critical | 9.1 | 2026-08-26 | A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS Server to execute a… |
CVE-2026-77539 | Critical | 9.1 | 2026-08-26 | A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS Server to execute a… |
CVE-2026-77537 | Critical | 10.0 | 2026-08-26 | A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to execute a Command I… |
CVE-2026-77535 | Critical | 9.1 | 2026-08-26 | A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi Network Application to… |
CVE-2026-77533 | Critical | 9.9 | 2026-08-26 | A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to… |
CVE-2026-78237 | High | 7.8 | 2026-08-26 | Insufficient input validation in ABR allows a low-privileged user to inject malicious entries into the sudoers file, resulting in persistent root access that r… |
CVE-2026-18261 | Medium | 5.7 | 2026-08-25 | Vulnerability in Drupal Powerful Surveys. This issue affects Powerful Surveys versions: *.*. |
CVE-2026-18260 | Medium | 5.7 | 2026-08-25 | Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Disable Login Page allows Brute Force. This issue affects Disable Login Page… |
CVE-2026-16643 | Medium | 5.7 | 2026-08-25 | Vulnerability in Drupal Lunr exposed filters. This issue affects Lunr exposed filters versions: *.*. |
CVE-2026-16642 | Medium | 5.7 | 2026-08-25 | Vulnerability in Drupal Email Login OTP. This issue affects Email Login OTP versions: *.*. |
CVE-2026-16641 | Critical | 9.8 | 2026-08-25 | Vulnerability in Drupal Commerce Elavon. This issue affects Commerce Elavon versions: *.*. |
CVE-2026-15088 | Medium | 5.7 | 2026-08-25 | Vulnerability in Drupal Development Environment. This issue affects Development Environment versions: *.*. |
CVE-2026-65637 | Critical | 9.8 | 2026-08-25 | Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This issue affects Apache Tomcat: from 11.0.20 through 11… |
CVE-2026-79288 | Medium | 6.5 | 2026-08-25 | Improper input validation in Autofill in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a cra… |
CVE-2026-79272 | Low | 3.1 | 2026-08-25 | Improper input validation in FindInPage in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to leak cros… |
CVE-2026-79260 | Medium | 6.5 | 2026-08-25 | Improper input validation in Cookies in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web o… |
CVE-2026-79259 | Medium | 4.3 | 2026-08-25 | Improper input validation in Safebrowsing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted… |
CVE-2026-79255 | Low | 3.1 | 2026-08-25 | Improper input validation in WebRTC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web or… |
CVE-2026-79253 | Medium | 6.5 | 2026-08-25 | Improper input validation in Network in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to leak sens… |
CVE-2026-79251 | Medium | 4.3 | 2026-08-25 | Improper input validation in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially bypass web origin policy via a crafted HT… |
CVE-2026-79243 | Medium | 6.5 | 2026-08-25 | Improper input validation in ReadingList in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer proce… |
CVE-2026-79230 | High | 8.8 | 2026-08-25 | Improper input validation in ANGLE in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside th… |
CVE-2026-79214 | Medium | 4.3 | 2026-08-25 | Improper input validation in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web o… |
CVE-2026-79203 | Low | 3.1 | 2026-08-25 | Improper input validation in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site… |
CVE-2026-79192 | Medium | 4.3 | 2026-08-25 | Improper input validation in Variations in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially bypass web origin policy via crafted n… |
CVE-2026-79182 | High | 8.8 | 2026-08-25 | Improper input validation in Media in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox… |
CVE-2026-79151 | Medium | 4.3 | 2026-08-25 | Improper input validation in Safebrowsing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted… |
CVE-2026-79139 | High | 7.5 | 2026-08-25 | Improper input validation in Media in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to… |
CVE-2026-79132 | High | 8.3 | 2026-08-25 | Improper input validation in Input in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to… |
CVE-2026-79123 | Medium | 6.5 | 2026-08-25 | Improper input validation in NTP Footer in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer proces… |
CVE-2026-79121 | High | 8.3 | 2026-08-25 | Improper input validation in Chromecast in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potential… |
CVE-2026-79111 | Critical | 9.6 | 2026-08-25 | Improper input validation in Dawn in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox v… |
CVE-2026-79109 | High | 8.3 | 2026-08-25 | Improper input validation in Printing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially… |
CVE-2026-79106 | Medium | 4.3 | 2026-08-25 | Improper input validation in Input in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged soc… |
CVE-2026-79105 | Medium | 4.3 | 2026-08-25 | Improper input validation in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a craf… |
CVE-2026-79076 | Medium | 6.5 | 2026-08-25 | Improper input validation in Sync in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via crafted network traffic… |
CVE-2026-79066 | Low | 3.1 | 2026-08-25 | Improper input validation in Navigation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass si… |
CVE-2026-79065 | Medium | 4.3 | 2026-08-25 | Improper input validation in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web o… |
CVE-2026-79032 | Medium | 6.8 | 2026-08-25 | Improper input validation in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass syste… |
CVE-2026-79025 | Medium | 4.2 | 2026-08-25 | Improper input validation in Workers in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass syste… |
CVE-2026-79015 | Medium | 4.3 | 2026-08-25 | Improper input validation in ServiceWorker in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted… |
CVE-2026-79013 | Medium | 5.9 | 2026-08-25 | Improper input validation in Sync in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via crafted network traffic… |
CVE-2026-79008 | High | 8.3 | 2026-08-25 | Improper input validation in GPU in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to po… |
CVE-2026-79000 | Medium | 4.3 | 2026-08-25 | Improper input validation in DeviceBoundSessionCredentials in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to b… |
CVE-2026-78980 | Medium | 4.3 | 2026-08-25 | Improper input validation in ReaderMode in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin po… |
CVE-2026-78976 | Medium | 4.3 | 2026-08-25 | Improper input validation in StorageAccessAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to byp… |
CVE-2026-78963 | High | 8.8 | 2026-08-25 | Improper input validation in Media in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox… |
CVE-2026-78943 | Low | 3.1 | 2026-08-25 | Improper input validation in Editing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged s… |
CVE-2026-78900 | Critical | 9.6 | 2026-08-25 | Improper input validation in Media in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox… |
CVE-2026-65979 | | 2026-08-25 | OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. From version 3.4.0 through 3.4… | |
CVE-2026-76198 | Medium | 5.5 | 2026-08-25 | CAI Content Credentials is affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read. An attacker could exploit this… |
CVE-2026-71443 | High | 7.5 | 2026-08-25 | CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could expl… |
CVE-2026-19913 | High | 7.5 | 2026-08-25 | The Kaltura HTML5 player (mwEmbed / html5lib) contains a local file disclosure vulnerability due to improper validation of the ServiceUrl parameter in mwEmbedL… |
CVE-2026-19912 | Critical | 9.8 | 2026-08-25 | The Kaltura HTML5 player (mwEmbed / html5lib) contains an unauthenticated remote code execution vulnerability caused by unsafe data deserialization and unsanit… |
CVE-2026-34959 | Medium | 4.7 | 2026-08-25 | Adminer 4.6.0 before 5.5.0 prepends the client-supplied X-Forwarded-Prefix header to $_SERVER["REQUEST_URI"] with no trusted-proxy check and no validation of t… |
CVE-2026-16434 | | 2026-08-25 | Adminer 4.6.0 through 5.5.0 (fixed in 5.5.1) contains an incomplete fix for a prior X-Forwarded-Prefix vulnerability (GHSA-8478-xrj3-h9c2). The validation guar… | |
CVE-2026-55371 | | 2026-08-25 | OpenEXR is the reference implementation and specification for the EXR high-dynamic-range image file format, widely used in the motion picture industry. Version… | |
CVE-2026-76816 | Low | 3.5 | 2026-08-24 | Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.137.Final and 4.2.17.Final, MqttEncoder does not validate client id… |
CVE-2026-72711 | Medium | 6.3 | 2026-08-24 | The Lean 4 kernel does not check that the body of an opaque declaration is closed. environment::add_opaque omits the check_no_metavar_no_fvar call that the def… |
CVE-2026-78329 | Critical | 9.8 | 2026-08-24 | Improper input validation vulnerability in Apache Camel Undertow component. This issue affects Apache Camel: from 4.11.0 before 4.14.9, from 4.15.0 before 4… |
CVE-2026-71300 | Critical | 9.8 | 2026-08-24 | Improper input validation vulnerability in Apache Camel Atmosphere Websocket component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15… |
CVE-2026-63621 | Medium | 5.3 | 2026-08-24 | Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache Camel Kna… |
CVE-2026-59230 | Medium | 6.5 | 2026-08-24 | Improper input validation vulnerability in Apache Camel. This issue affects Apache Camel: from 2.17.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0… |
CVE-2026-76840 | Critical | 9.6 | 2026-08-24 | RustDesk's Windows clipboard redirection copies a peer-supplied length into a fixed-size caller buffer without an upper bound check. When an OLE paste consumer… |
CVE-2026-59568 | Critical | 9.1 | 2026-08-24 | Multiple vulnerabilities on affected versions of Zscaler Client Connector allow remote code execution, giving an unauthenticated, unprivileged user the ability… |
CVE-2026-75975 | High | 7.5 | 2026-08-24 | fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6 grammar, so invalid trailing text in an… |
CVE-2026-78147 | High | 7.3 | 2026-08-23 | A vulnerability was found in ggml-org llama.cpp bec4772f6. The impacted element is the function deserialize_tensor of the file ggml/src/ggml-rpc/ggml-rpc.cpp o… |
CVE-2026-7808 | Critical | 9.8 | 2026-08-23 | justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dangerous content (e.g., script or style) to survive sanitizatio… |
CVE-2026-5388 | Critical | 9.8 | 2026-08-23 | justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers (clean_url_value/clean_url_in_js_string), HTML serialization, Markdown pas… |
CVE-2026-2996 | High | 7.5 | 2026-08-22 | The Advanced Product Fields (Product Addons) for WooCommerce plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and includi… |
CVE-2026-53541 | Medium | 4.3 | 2026-08-21 | OliveTin gives access to predefined shell commands from a web interface. The `filterToDefinedArgumentsOnly` function in the executor is intended to discard any… |
CVE-2026-63421 | High | 7.5 | 2026-08-21 | Keystone is a content management system for Node.js. Prior to 6.5.3, the findMany resolver in packages/core/src/lib/core/queries/resolvers.ts compares the sign… |
CVE-2026-48769 | Critical | 9.9 | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file write exists in the Incus client when a malicious image serv… |
CVE-2026-48755 | Critical | 9.9 | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to arg… |
CVE-2026-77710 | | 2026-08-21 | A vulnerability in misp-stix could allow a crafted STIX document to influence security-sensitive MISP attribute metadata during import. The STIX import logic… | |
CVE-2026-65645 | Medium | 4.3 | 2026-08-21 | Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6. 8.3.8, 8.2.8, 8.1.8, and 7.10.15, the Meteor DDP methods getThreadsList and getThreadMessages… |
CVE-2026-16520 | | 2026-08-21 | Improper input validation and Exposure of sensitive information through data queries vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, and Gen… | |
CVE-2026-77645 | | 2026-08-20 | A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deseria… | |
CVE-2026-70105 | Medium | 6.5 | 2026-08-20 | Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. |
CVE-2026-53587 | High | 7.5 | 2026-08-20 | libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your a… |
CVE-2026-43678 | Medium | 5.3 | 2026-08-20 | An unauthenticated remote peer can crash any NIOWebSocket-based server (including Vapor and Hummingbird) with a single 11-byte frame sent after a completed Web… |
CVE-2026-76387 | High | 8.1 | 2026-08-19 | In Splunk Enterprise Security versions below 8.6.1, a user who holds a Splunk Enterprise Security role that contains the mc_investigation_read capability could… |
CVE-2026-76332 | High | 7.1 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into opening a crafted link t… |
CVE-2026-76330 | High | 7.1 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into opening a crafted link t… |
CVE-2026-76323 | Medium | 6.4 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could bypass Search Proces… |
CVE-2026-61711 | | 2026-08-19 | BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, a custom frontend could… | |
CVE-2026-19509 | Medium | 6.5 | 2026-08-19 | Improper input validation in `ajaxSet_wireless_network_configuration.jst` in RDK-B WebUI `rdkb-2025q4-kirkstone.04.10.26` allows an authenticated attacker to c… |
CVE-2026-17414 | High | 8.1 | 2026-08-19 | IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 Power Systems Firmware is affected by… |
CVE-2026-49392 | Medium | 5.3 | 2026-08-19 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.6.0 until 4.14.6 and 5.0.0-beta3, DB::getFile() and DB::se… |
CVE-2026-20318 | Critical | 9.6 | 2026-08-19 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive inter… |
CVE-2026-75987 | High | 7.3 | 2026-08-19 | A vulnerability was found in SPLWare esProc up to 20260507. This affects the function ObjectInputStream.readUnshared of the file src/main/java/com/scudata/para… |