CWE-20 · Improper Input Validation (page 5)
Page 5 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-14083 | Medium | 6.1 | 2026-06-30 | Insufficient validation of untrusted input in HTML in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS)… |
CVE-2026-14080 | Medium | 4.3 | 2026-06-30 | Insufficient validation of untrusted input in TabSwitcher in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to bypass navigation res… |
CVE-2026-14078 | High | 8.8 | 2026-06-30 | Insufficient validation of untrusted input in WebRTC in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege escalation via a cr… |
CVE-2026-14073 | Medium | 4.3 | 2026-06-30 | Insufficient validation of untrusted input in WebXR in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a c… |
CVE-2026-14066 | Medium | 4.3 | 2026-06-30 | Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to bypass navigation rest… |
CVE-2026-14065 | Medium | 6.5 | 2026-06-30 | Insufficient validation of untrusted input in PageInfo in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer proce… |
CVE-2026-14060 | High | 7.8 | 2026-06-30 | Insufficient validation of untrusted input in Chromoting in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to perform privilege escal… |
CVE-2026-14056 | Critical | 9.6 | 2026-06-30 | Insufficient validation of untrusted input in Media in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process… |
CVE-2026-14055 | Critical | 9.6 | 2026-06-30 | Insufficient validation of untrusted input in Device Trust in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the… |
CVE-2026-14045 | Medium | 4.3 | 2026-06-30 | Insufficient validation of untrusted input in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer proces… |
CVE-2026-14038 | Critical | 9.3 | 2026-06-30 | Insufficient validation of untrusted input in New Tab Page in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer p… |
CVE-2026-14023 | Medium | 6.5 | 2026-06-30 | Insufficient validation of untrusted input in SanitizerAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a… |
CVE-2026-14022 | Medium | 6.5 | 2026-06-30 | Insufficient validation of untrusted input in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer proces… |
CVE-2026-14021 | Medium | 6.5 | 2026-06-30 | Insufficient policy enforcement in StorageAccessAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process… |
CVE-2026-14020 | Medium | 4.3 | 2026-06-30 | Insufficient validation of untrusted input in WebXR in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process… |
CVE-2026-14009 | High | 8.8 | 2026-06-30 | Inappropriate implementation in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via a crafte… |
CVE-2026-13999 | Medium | 4.3 | 2026-06-30 | Insufficient validation of untrusted input in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a maliciou… |
CVE-2026-13995 | Medium | 4.3 | 2026-06-30 | Insufficient validation of untrusted input in Autofill in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via… |
CVE-2026-13991 | Medium | 4.3 | 2026-06-30 | Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing vi… |
CVE-2026-13990 | Medium | 6.5 | 2026-06-30 | Insufficient validation of untrusted input in DataTransfer in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the… |
CVE-2026-13968 | High | 7.5 | 2026-06-30 | Insufficient validation of untrusted input in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in spec… |
CVE-2026-13962 | Medium | 6.5 | 2026-06-30 | Insufficient data validation in PDF in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass naviga… |
CVE-2026-13961 | Medium | 5.3 | 2026-06-30 | Insufficient validation of untrusted input in DevTools in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who convinced a user to eng… |
CVE-2026-13959 | Medium | 4.3 | 2026-06-30 | Insufficient validation of untrusted input in Blink in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafte… |
CVE-2026-13955 | Low | 3.3 | 2026-06-30 | Insufficient validation of untrusted input in CustomTabs in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to perform UI spoofing via… |
CVE-2026-13942 | Low | 3.3 | 2026-06-30 | Inappropriate implementation in Video Capture in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed a local attacker to perform UI spoofing via a crafted… |
CVE-2026-13939 | Low | 3.1 | 2026-06-30 | Insufficient validation of untrusted input in WebShare in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the ren… |
CVE-2026-13934 | Critical | 9.6 | 2026-06-30 | Insufficient validation of untrusted input in Dawn in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the rendere… |
CVE-2026-13929 | Medium | 5.5 | 2026-06-30 | Insufficient policy enforcement in DevTools in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to bypass navigation restrictions via a… |
CVE-2026-13928 | High | 8.8 | 2026-06-30 | Insufficient validation of untrusted input in Enterprise in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege escalation via… |
CVE-2026-13927 | High | 7.8 | 2026-06-30 | Insufficient validation of untrusted input in UI in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to perform privilege escalation vi… |
CVE-2026-13926 | Medium | 6.5 | 2026-06-30 | Insufficient validation of untrusted input in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer proces… |
CVE-2026-13925 | High | 7.5 | 2026-06-30 | Inappropriate implementation in Downloads in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specif… |
CVE-2026-13924 | Medium | 6.5 | 2026-06-30 | Insufficient validation of untrusted input in WebView in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the rend… |
CVE-2026-13921 | Medium | 6.5 | 2026-06-30 | Insufficient validation of untrusted input in DeviceBoundSessionCredentials in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same or… |
CVE-2026-13920 | Critical | 9.6 | 2026-06-30 | Insufficient validation of untrusted input in Media in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the render… |
CVE-2026-13917 | Medium | 6.5 | 2026-06-30 | Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to e… |
CVE-2026-13911 | Medium | 5.3 | 2026-06-30 | Insufficient policy enforcement in Spellcheck in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obt… |
CVE-2026-13908 | Medium | 6.5 | 2026-06-30 | Insufficient validation of untrusted input in Omnibox in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage i… |
CVE-2026-13901 | Critical | 9.6 | 2026-06-30 | Insufficient policy enforcement in Serial in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potenti… |
CVE-2026-13900 | Medium | 6.5 | 2026-06-30 | Inappropriate implementation in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass… |
CVE-2026-13893 | Medium | 6.5 | 2026-06-30 | Insufficient validation of untrusted input in WebUI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via malicious n… |
CVE-2026-13891 | High | 7.5 | 2026-06-30 | Insufficient validation of untrusted input in Extensions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer pro… |
CVE-2026-13889 | Medium | 6.5 | 2026-06-30 | Side-channel information leakage in WebAuthentication in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a… |
CVE-2026-13877 | Medium | 5.3 | 2026-06-30 | Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process… |
CVE-2026-13875 | Medium | 5.3 | 2026-06-30 | Insufficient validation of untrusted input in GPU in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer… |
CVE-2026-13872 | Critical | 9.1 | 2026-06-30 | Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to potentially perform… |
CVE-2026-13866 | Medium | 6.5 | 2026-06-30 | Inappropriate implementation in Input in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to… |
CVE-2026-13865 | Medium | 4.3 | 2026-06-30 | Insufficient validation of untrusted input in Enterprise in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted… |
CVE-2026-13863 | High | 7.8 | 2026-06-30 | Insufficient validation of untrusted input in CustomTabs in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to perform privilege escal… |
CVE-2026-13856 | High | 7.5 | 2026-06-30 | Insufficient validation of untrusted input in Speech in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the rende… |
CVE-2026-13852 | Critical | 9.1 | 2026-06-30 | Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to bypass discretionar… |
CVE-2026-13851 | Critical | 9.1 | 2026-06-30 | Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to bypass discretionar… |
CVE-2026-13850 | High | 8.8 | 2026-06-30 | Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a local attacker to execute arbitrary code… |
CVE-2026-13849 | High | 8.6 | 2026-06-30 | Insufficient validation of untrusted input in Chromoting in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to potentially perform a s… |
CVE-2026-13847 | Medium | 6.5 | 2026-06-30 | Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data… |
CVE-2026-13843 | Critical | 9.6 | 2026-06-30 | Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who had compromised the r… |
CVE-2026-13834 | High | 8.3 | 2026-06-30 | Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process… |
CVE-2026-13829 | High | 8.3 | 2026-06-30 | Insufficient validation of untrusted input in Settings in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the ren… |
CVE-2026-13824 | High | 7.5 | 2026-06-30 | Insufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to per… |
CVE-2026-13817 | High | 8.8 | 2026-06-30 | Insufficient validation of untrusted input in Glic in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially perform a sandbox escape vi… |
CVE-2026-13816 | Medium | 6.5 | 2026-06-30 | Insufficient validation of untrusted input in File Input in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data… |
CVE-2026-13813 | High | 8.3 | 2026-06-30 | Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer pro… |
CVE-2026-13812 | Medium | 4.7 | 2026-06-30 | Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to e… |
CVE-2026-13808 | Medium | 4.6 | 2026-06-30 | Insufficient data validation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a local attacker to obtain potentially sensitive informat… |
CVE-2026-13806 | High | 8.1 | 2026-06-30 | Insufficient validation of untrusted input in Accessibility in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer… |
CVE-2026-13797 | Critical | 9.6 | 2026-06-30 | Insufficient validation of untrusted input in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer pro… |
CVE-2026-13794 | High | 7.5 | 2026-06-30 | Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who convinced a user… |
CVE-2026-13791 | High | 8.1 | 2026-06-30 | Insufficient validation of untrusted input in Downloads in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious… |
CVE-2026-13781 | Critical | 9.6 | 2026-06-30 | Insufficient validation of untrusted input in Skia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process t… |
CVE-2026-13780 | Critical | 9.6 | 2026-06-30 | Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process… |
CVE-2026-13777 | High | 8.8 | 2026-06-30 | Insufficient validation of untrusted input in iOSWeb in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corru… |
CVE-2026-7803 | Critical | 9.8 | 2026-06-30 | IBM Langflow OSS 1.0.0 through 1.10.0 could allow arbitrary code execution due to improper validation of flow nodes with missing or empty component type fields. |
CVE-2026-48315 | Critical | 9.3 | 2026-06-30 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the… |
CVE-2026-48281 | Critical | 10.0 | 2026-06-30 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the… |
CVE-2026-48277 | Critical | 10.0 | 2026-06-30 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the… |
CVE-2026-49434 | High | 7.5 | 2026-06-30 | Improper Input Validation vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All. An attacker that has access to publish or modify entr… |
CVE-2026-49432 | High | 7.5 | 2026-06-30 | Improper Input Validation vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp. A remote unauthenticated peer that can reach an expose… |
CVE-2026-43725 | High | 7.1 | 2026-06-29 | The issue was addressed with improved input validation. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visi… |
CVE-2026-43724 | High | 7.8 | 2026-06-29 | The issue was addressed with improved input sanitization. This issue is fixed in iOS 26.5.2 and iPadOS 26.5.2, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS… |
CVE-2026-43722 | Medium | 5.5 | 2026-06-29 | The issue was addressed with improved input sanitization. This issue is fixed in iOS 26.5.2 and iPadOS 26.5.2, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS… |
CVE-2026-43708 | Medium | 4.3 | 2026-06-29 | The issue was addressed with improved input validation. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visi… |
CVE-2026-39868 | Critical | 9.1 | 2026-06-29 | This issue was addressed with improved input validation. This issue is fixed in iOS 26.5.2 and iPadOS 26.5.2, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS… |
CVE-2026-38639 | High | 7.5 | 2026-06-26 | An issue in the parse_month function (/time/strptime.rs) of relibc commit ab6a2e allows attackers to cause a Denial of Service (DoS) via parsing a crafted inpu… |
CVE-2026-52780 | Critical | 9.6 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, cache store poisoning leads to Remote Code Execution (RCE). This… |
CVE-2026-13434 | Medium | 4.9 | 2026-06-26 | A flaw was found in KubeVirt's network annotation generator. When a tenant creates a VirtualMachineInstance with a Multus network configuration, the supplied n… |
CVE-2026-42390 | Medium | 5.3 | 2026-06-25 | An invalid zone might pass ZONEMD validation while it should not. This is only relevant if ZoneToCache is configured with ZONEMD validation. |
CVE-2026-42389 | Medium | 5.3 | 2026-06-25 | This fix provides extra hardening for the 5.4.x branch by doing extra validation of incoming answers from authoritative servers. |
CVE-2026-42388 | Medium | 5.9 | 2026-06-25 | Incomplete validation of the SOA record present in a catalog zone might lead to a crash. |
CVE-2026-42387 | Medium | 5.9 | 2026-06-25 | A malicious authoritative server can send a crafted zone via the ZoneToCache function that leads to a crash of the Recursor due to insuffcient input validation. |
CVE-2026-12246 | High | 8.1 | 2026-06-25 | NSD version 4.14.0 introduced a bug where a specially crafted APL RR, with an adflength larger than permitted for the address family will overwrite the stack w… |
CVE-2026-52801 | High | 8.1 | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, the Gogs Mirror Settings functionality provide an alternative way from the well protected New… |
CVE-2025-64719 | Medium | 4.9 | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, a malicious user with rights to create a new file on a repository or wiki page can trigger a d… |
CVE-2026-13025 | High | 8.3 | 2026-06-24 | Race in DevTools in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox e… |
CVE-2026-13024 | Medium | 4.2 | 2026-06-24 | Insufficient validation of untrusted input in Navigation in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer pr… |
CVE-2026-48720 | High | 8.8 | 2026-06-24 | Warp is an agentic development environment. From 0.2025.03.05.08.02.stable_00 until 0.2026.05.06.15.42.stable_01, Warp accepts non-inline `OSC 1337;File` paylo… |
CVE-2026-48704 | High | 8.8 | 2026-06-24 | Warp is an agentic development environment. From 0.2023.10.24.08.03.stable_00 until 0.2026.05.06.15.42.stable_01, Warp may open executable local files through… |
CVE-2026-12537 | High | 7.8 | 2026-06-24 | Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI (versions prior to 0.39.1) and run-gemini-cli GitHub Action (versi… |
CVE-2026-13006 | | 2026-06-24 | ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.36 in Java applications, allows an attac… | |
CVE-2026-54588 | Critical | 9.6 | 2026-06-23 | Poweradmin is a web-based DNS administration tool for PowerDNS server. Versions prior to 4.2.4 and 4.3.3 use the attacker-controlled `HTTP_HOST` request header… |