CWE-20 · Improper Input Validation (page 4)
Page 4 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-55124 | Medium | 5.5 | 2026-07-14 | Improper validation of specified type of input in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
CVE-2026-50670 | High | 8.8 | 2026-07-14 | Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-50417 | High | 7.8 | 2026-07-14 | Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally. |
CVE-2026-50370 | High | 8.8 | 2026-07-14 | Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over an adjacent network. |
CVE-2026-50328 | High | 7.5 | 2026-07-14 | Uncaught exception in Windows Server Update Service allows an unauthorized attacker to perform tampering over a network. |
CVE-2026-15757 | | 2026-07-14 | A security flaw was discovered in the NETGEAR DGND3700v1 that could allow someone on the same local WiFi network to send unauthorized commands to the device. … | |
CVE-2026-55899 | High | 7.8 | 2026-07-14 | Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2026-6790 | Medium | 5.3 | 2026-07-14 | In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host… |
CVE-2026-13699 | Medium | 4.3 | 2026-07-14 | In Eclipse KUKSA Databroker version 0.6.1, the kuksa.val.v2.VAL/PublishValue gRPC handler fails to validate the existence of the optional data_point field in P… |
CVE-2026-22102 | | 2026-07-13 | A POST request sent to a specific webserver endpoint can be used to write to arbitrary file locations. The endpoint accepts the filename parameter in the Conte… | |
CVE-2026-15535 | Medium | 6.3 | 2026-07-13 | A vulnerability was determined in AkariAsai self-rag up to 1fcdc420e48f50a7d7ab1ece5494221b93252e99. Affected by this issue is the function Indexer.deserialize… |
CVE-2026-15531 | Medium | 5.3 | 2026-07-13 | A vulnerability has been found in yashbhalgat HashNeRF-pytorch up to 82885e698295982504eb6a26d060a6b2473e3706. Affected by this issue is the function torch.loa… |
CVE-2026-15529 | Medium | 6.3 | 2026-07-13 | A vulnerability was detected in yzhao062 pyod up to 3.6.1. Affected is the function pyod.utils.persistence.load of the file pyod/utils/persistence.py. Performi… |
CVE-2026-3576 | High | 7.2 | 2026-07-11 | The Planyo Online Reservation System plugin for WordPress is vulnerable to Server-Side Request Forgery leading to Local File Inclusion in all versions up to, a… |
CVE-2026-11914 | Medium | 5.9 | 2026-07-10 | vulnerability in Drupal Composer allows . This issue affects Composer versions: *.*. |
CVE-2026-40454 | High | 7.5 | 2026-07-10 | Out-of-bounds Read, Improper Input Validation vulnerability in Apache IoTDB C++ client. Out-of-bounds reads in IoTDB C++ client TsBlock deserializer crash clie… |
CVE-2026-15288 | High | 7.5 | 2026-07-10 | The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including… |
CVE-2026-0282 | Medium | 6.5 | 2026-07-09 | A file deletion vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web interface to… |
CVE-2026-51606 | High | 7.5 | 2026-07-09 | An improper input handling vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) causes the device to abruptly terminate the TCP connection… |
CVE-2026-51599 | Critical | 9.8 | 2026-07-09 | An insufficient input validation vulnerability in the RTSP service of MERCURY MIPC252W v1.0.5 Build 230306 Rel.79931n allows an unauthenticated remote attacker… |
CVE-2026-51598 | Medium | 6.5 | 2026-07-09 | An input validation vulnerability in the RTSP service of MERCURY MIPC252W IP Camera v1.0.5 Build 230306 Rel.79931n) allows an unauthenticated, network-adjacent… |
CVE-2025-58146 | | 2026-07-09 | There are multiple issues. 1. Updates to the XAPI database sanitise input strings, but try generating the notification using the unsanitised input. This… | |
CVE-2026-15131 | Medium | 4.3 | 2026-07-08 | Inappropriate implementation in Navigation in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to bypass site isolation via a crafted HTML page… |
CVE-2026-15124 | Medium | 4.3 | 2026-07-08 | Insufficient policy enforcement in Passwords in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to bypass same origin policy via a crafted HTML… |
CVE-2026-15122 | High | 8.3 | 2026-07-08 | Insufficient validation of untrusted input in Codecs in Google Chrome on Windows prior to 150.0.7871.115 allowed a remote attacker who had compromised the rend… |
CVE-2026-15115 | Low | 3.3 | 2026-07-08 | Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.115 allowed a local attacker to bypass same origin… |
CVE-2026-10037 | High | 8.8 | 2026-07-08 | A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu. The .jar MIME handlers installed by these packages execute files marked as ex… |
CVE-2026-59724 | High | 7.5 | 2026-07-08 | Socket.IO enables bidirectional and low-latency communication for every platform. From 6.5.0 before 6.6.7, Engine.IO servers with WebTransport enabled can reso… |
CVE-2026-41042 | Critical | 9.1 | 2026-07-08 | Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT param… |
CVE-2026-54234 | High | 7.5 | 2026-07-06 | vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.0, a frontend-legal multi-request speculative decoding work… |
CVE-2026-48316 | Critical | 10.0 | 2026-07-06 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the… |
CVE-2026-49042 | High | 7.3 | 2026-07-06 | Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: from 4.8.0 through 4.18.2, from 4.19.0 through 4.20.0. Users are re… |
CVE-2026-46588 | High | 7.3 | 2026-07-06 | Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: through 4.14.7, from 4.15.0 through 4.18.2, from 4.19.0 through 4.20… |
CVE-2026-46587 | High | 7.3 | 2026-07-06 | Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: through 4.14.7, from 4.15.0 through 4.18.2, from 4.19.0 through 4.20… |
CVE-2026-56140 | Critical | 9.8 | 2026-07-06 | Improper Input Validation vulnerability in Apache Camel AWS SNS component. The camel-aws2-sns component filters Camel headers through a component-specific He… |
CVE-2026-55994 | High | 7.5 | 2026-07-06 | Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel in Iggy… |
CVE-2026-55993 | High | 7.5 | 2026-07-06 | Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel in Atmo… |
CVE-2026-49098 | Medium | 5.3 | 2026-07-06 | Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache Camel Kaf… |
CVE-2026-49097 | Medium | 6.5 | 2026-07-06 | Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache Camel IRC… |
CVE-2026-49086 | Medium | 6.5 | 2026-07-06 | Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in Apache Camel DAPR component. The camel-dapr Dapr Pub/Sub cons… |
CVE-2026-48206 | Medium | 5.3 | 2026-07-06 | Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel JIRA component. The camel-jira producers read their… |
CVE-2026-48205 | Critical | 9.1 | 2026-07-06 | Improper Input Validation, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel DNS component. The camel-dns producers read DNS operation paramete… |
CVE-2026-48204 | Critical | 9.8 | 2026-07-06 | Improper Input Validation, Improper Access Control vulnerability in Apache Camel in Camel Mongodb Gridfs component. The camel-mongodb-gridfs producer selects… |
CVE-2026-48203 | Critical | 9.1 | 2026-07-06 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Improper Input Validation, Server-Side Request Forgery (SSR… |
CVE-2026-46726 | High | 7.5 | 2026-07-06 | Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel in Vert… |
CVE-2026-46592 | High | 7.5 | 2026-07-06 | Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in Apache Camel CXF SOAP component. The camel-cxf producer selec… |
CVE-2026-46585 | High | 7.5 | 2026-07-06 | Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel Lucene Component. The camel-lucene producer reads th… |
CVE-2026-46584 | Low | 3.7 | 2026-07-06 | Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel Mail Component. The camel-mail producer (M… |
CVE-2026-46457 | High | 7.5 | 2026-07-06 | Improper Input Validation vulnerability in Apache Camel NATS component. The camel-nats component maps inbound NATS message headers into the Camel Exchange but… |
CVE-2026-46456 | Critical | 9.8 | 2026-07-06 | Improper Input Validation vulnerability in Apache Camel AWS2-SQS Component. The camel-aws2-sqs component map inbound message attributes into the Camel Exchan… |
CVE-2026-46454 | Critical | 9.8 | 2026-07-06 | Improper Input Validation vulnerability in Apache Camel Cometd Component. The camel-cometd component maps inbound Bayeux (CometD) message headers into the Cam… |
CVE-2026-46453 | Medium | 5.3 | 2026-07-06 | Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel ElasticSearch Rest Client. The camel-elasticsearch-r… |
CVE-2026-59509 | | 2026-07-05 | An unauthenticated improper input validation vulnerability in the POST /fetch_cve_data endpoint in cve-search. A remote attacker can manipulate request paramet… | |
CVE-2026-14723 | Medium | 5.3 | 2026-07-05 | A vulnerability was determined in AD-Security AD_Miner 1.9.0. Affected is the function request_a of the file ad_miner/scripts/analyse_cache.py of the component… |
CVE-2026-14637 | High | 8.2 | 2026-07-04 | A security vulnerability has been detected in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 13fd582aaf49aeab7438acc0fc3eb973a1f5e6a7. The affected element… |
CVE-2026-58292 | High | 7.5 | 2026-07-03 | Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-57985 | High | 7.6 | 2026-07-03 | Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-22547 | Critical | 9.1 | 2026-07-03 | Gitea versions before 1.25.5 lack validation constraints for repository creation fields, including length-limited template fields and trust model or object for… |
CVE-2026-14631 | Medium | 5.3 | 2026-07-03 | webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malfor… |
CVE-2026-13341 | High | 7.4 | 2026-07-03 | A vulnerability exists in the Kong Konnect Model Context Protocol (MCP) server prior to version 1.0.0, which could allow a remote attacker to perform an indire… |
CVE-2026-54405 | High | 7.5 | 2026-07-02 | A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Network Application to execute a Denial of… |
CVE-2026-54402 | Critical | 9.9 | 2026-07-02 | A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi OS to execute a Command… |
CVE-2026-50748 | Critical | 9.9 | 2026-07-02 | A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to e… |
CVE-2026-14429 | High | 8.3 | 2026-07-01 | Insufficient validation of untrusted input in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process t… |
CVE-2026-14428 | High | 8.3 | 2026-07-01 | Insufficient validation of untrusted input in Dawn in Google Chrome on Android prior to 150.0.7871.46 allowed a remote attacker who had compromised the rendere… |
CVE-2026-14414 | Medium | 5.3 | 2026-07-01 | Insufficient validation of untrusted input in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process t… |
CVE-2026-14412 | High | 8.3 | 2026-07-01 | Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process… |
CVE-2026-14411 | Critical | 9.6 | 2026-07-01 | Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape v… |
CVE-2026-14401 | High | 8.3 | 2026-07-01 | Insufficient validation of untrusted input in ANGLE in Google Chrome on Android prior to 150.0.7871.46 allowed a remote attacker who had compromised the render… |
CVE-2026-14382 | Critical | 9.6 | 2026-07-01 | Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape v… |
CVE-2026-38891 | High | 7.5 | 2026-07-01 | An improper input validation in the gazebo_ros_diff_drive.cpp component of gazebo_plugins v3.9.0 allows attackers to cause a Denial of Service (DoS) via supply… |
CVE-2026-53492 | Critical | 9.6 | 2026-07-01 | containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI implementation improperly trusts Container Device Interfac… |
CVE-2026-56151 | Medium | 6.5 | 2026-07-01 | Improper Input Validation (CWE-20) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user can submit a specia… |
CVE-2026-13706 | High | 8.8 | 2026-07-01 | Improper input validation vulnerability in Wikimedia Foundation UrlShortener. This vulnerability is associated with program files includes/UrlShortenerUtils… |
CVE-2026-13602 | | 2026-07-01 | We found a chain of combining multiple weaknesses in the product that could allow an attacker to become any user in the backend and access any data: *… | |
CVE-2026-13603 | | 2026-07-01 | The payment integration pretix-oppwa provides support for the payment providers VR Payment, Hobex, and potentially others based on Oppwa's technology. The in… | |
CVE-2026-53488 | High | 8.8 | 2026-07-01 | containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10 the CRI plugin propagates labels from an image con… |
CVE-2026-56333 | Medium | 4.3 | 2026-06-30 | Capgo before 12.128.2 contains a server-side validation bypass vulnerability in organization security settings that allows authenticated org admins to persist… |
CVE-2026-28322 | Medium | 5.6 | 2026-06-30 | SolarWinds Database Performance Analyzer was found to be affected by a stored cross-site scripting vulnerability, which when exploited, can lead to unintended… |
CVE-2026-14150 | Medium | 5.4 | 2026-06-30 | Insufficient validation of untrusted input in Speech in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process… |
CVE-2026-14140 | Medium | 4.3 | 2026-06-30 | Insufficient validation of untrusted input in Input in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a c… |
CVE-2026-14137 | Medium | 4.2 | 2026-06-30 | Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to e… |
CVE-2026-14135 | Medium | 5.4 | 2026-06-30 | Insufficient validation of untrusted input in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer proces… |
CVE-2026-14131 | Medium | 5.4 | 2026-06-30 | Insufficient validation of untrusted input in WebAppInstalls in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer… |
CVE-2026-14130 | Medium | 4.3 | 2026-06-30 | Incorrect security UI in Omnibox in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium se… |
CVE-2026-14127 | Medium | 4.3 | 2026-06-30 | Inappropriate implementation in Printing in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform… |
CVE-2026-14122 | High | 8.1 | 2026-06-30 | Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to perform arbitrary… |
CVE-2026-14120 | Critical | 9.6 | 2026-06-30 | Inappropriate implementation in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentia… |
CVE-2026-14118 | Medium | 6.5 | 2026-06-30 | Insufficient data validation in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestur… |
CVE-2026-14117 | Medium | 5.3 | 2026-06-30 | Insufficient validation of untrusted input in DevTools in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who convinced a user to eng… |
CVE-2026-14116 | Medium | 4.3 | 2026-06-30 | Insufficient validation of untrusted input in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in spec… |
CVE-2026-14115 | High | 7.5 | 2026-06-30 | Insufficient validation of untrusted input in Cast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process t… |
CVE-2026-14109 | Critical | 9.6 | 2026-06-30 | Insufficient policy enforcement in Mojo in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potential… |
CVE-2026-14106 | Critical | 9.6 | 2026-06-30 | Insufficient validation of untrusted input in Text in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the rendere… |
CVE-2026-14104 | Critical | 9.8 | 2026-06-30 | Insufficient validation of untrusted input in WebAppInstalls in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside… |
CVE-2026-14100 | Medium | 6.5 | 2026-06-30 | Insufficient data validation in NetworkCache in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML pag… |
CVE-2026-14095 | Critical | 9.6 | 2026-06-30 | Insufficient policy enforcement in Browser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potent… |
CVE-2026-14089 | Medium | 4.3 | 2026-06-30 | Insufficient validation of untrusted input in PopupBlocker in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer p… |
CVE-2026-14087 | High | 8.8 | 2026-06-30 | Heap buffer overflow in WebNN in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentia… |
CVE-2026-14084 | High | 8.8 | 2026-06-30 | Insufficient validation of untrusted input in Chromoting in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corrupti… |