CWE-20 · Improper Input Validation (page 8)
Page 8 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-10968 | High | 7.4 | 2026-06-04 | Insufficient validation of untrusted input in Dawn in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the rendere… |
CVE-2026-10966 | Critical | 9.6 | 2026-06-04 | Inappropriate implementation in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted… |
CVE-2026-10942 | High | 7.8 | 2026-06-04 | Inappropriate implementation in UI in Google Chrome on Windows prior to 149.0.7827.53 allowed a local attacker to perform privilege escalation via a malicious… |
CVE-2026-10938 | Medium | 6.5 | 2026-06-04 | Inappropriate implementation in Input in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass site… |
CVE-2026-10922 | High | 8.8 | 2026-06-04 | Insufficient validation of untrusted input in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in spec… |
CVE-2026-10920 | High | 8.3 | 2026-06-04 | Insufficient validation of untrusted input in WebShare in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker who had compromised the rendere… |
CVE-2026-10917 | High | 8.3 | 2026-06-04 | Insufficient validation of untrusted input in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process… |
CVE-2026-10916 | Medium | 6.1 | 2026-06-04 | Insufficient validation of untrusted input in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer proce… |
CVE-2026-10912 | Medium | 6.5 | 2026-06-04 | Insufficient validation of untrusted input in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer pro… |
CVE-2026-10911 | High | 8.3 | 2026-06-04 | Insufficient validation of untrusted input in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process… |
CVE-2026-10904 | High | 8.8 | 2026-06-04 | Inappropriate implementation in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted H… |
CVE-2026-36175 | Medium | 6.8 | 2026-06-04 | An issue in the U-Boot component of GNCC GP5 v7.1.76 allows physically-proximate attackers to bypass authentication and gain root access via interrupting the b… |
CVE-2026-10863 | High | 8.1 | 2026-06-04 | A security issue was fixed in the correlations over-correlation endpoint where the order query parameter was accepted from user-controlled named request parame… |
CVE-2026-37460 | High | 7.5 | 2026-06-03 | Missing input validation in the rfapiRibBi2Ri() function (rfapi_rib.c) of FRRouting (FRR) stable/10.0 to stable/10.6 allows attackers to cause a Denial of Serv… |
CVE-2026-35081 | High | 8.1 | 2026-06-03 | The ugw-logstop method allows a remote attacker with user privileges to terminate arbitrary processes due to insufficient validation of user-supplied input. |
CVE-2026-47201 | High | 8.5 | 2026-06-02 | authentik is an open-source identity provider. Prior to versions 2025.12.5, 2026.2.3, and 2026.5.1, authentik's SAML Source ACS endpoint is vulnerable to XML S… |
CVE-2026-35049 | Medium | 6.5 | 2026-06-02 | wire-ios is an iOS client for the Wire secure messaging application. Prior to version 4.16.0, upon receiving a crafted malicious Proteus external message with… |
CVE-2026-45685 | High | 7.5 | 2026-06-02 | OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From version 0.1.0 to before version 0.9.0, malformed Mon… |
CVE-2026-45678 | High | 7.5 | 2026-06-02 | OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the Postgres protocol parser assu… |
CVE-2026-45676 | Medium | 5.5 | 2026-06-02 | OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, OBI's replacement ELF parser trus… |
CVE-2026-44367 | Low | 2.7 | 2026-06-02 | Klaw is a self-service Apache Kafka Topic Management/Governance tool/portal. Prior to version 2.10.4, a vulnerability exists in the user registration and login… |
CVE-2026-7195 | High | 8.8 | 2026-06-02 | CWE-20: Improper Input Validation in web services in Progress Sitefinity 14.1.x through 14.3.x, 14.4.x before 14.4.8152, 15.0.x before 15.0.8234, 15.1.x before… |
CVE-2026-3620 | Medium | 4.4 | 2026-06-02 | The Word Replacer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'replacement' parameter in all versions up to, and including, 0.4… |
CVE-2026-10566 | Medium | 5.3 | 2026-06-02 | A weakness has been identified in FoundationAgents MetaGPT up to 0.8.2. This affects the function Message.check_instruct_content of the file metagpt/schema.py… |
CVE-2026-28578 | Medium | 5.5 | 2026-06-01 | In multiple functions of DevicePolicyManagerService.java, there is a possible desync from persistence due to improper input validation. This could lead to loca… |
CVE-2026-0085 | Medium | 5.5 | 2026-06-01 | In applySimpleFieldMaxSize of DataRowHandler.java, there is a possible way to insert a large contact name due to improper input validation. This could lead to… |
CVE-2026-0078 | High | 7.8 | 2026-06-01 | In setGlobalProxy of DevicePolicyManagerService.java, there is a possible desync in persistence due to improper input validation. This could lead to local esca… |
CVE-2026-0070 | Medium | 5.5 | 2026-06-01 | In multiple functions of DevicePolicyManagerService.java, there is a possible way to hide a system critical package due to improper input validation. This coul… |
CVE-2026-0051 | Medium | 6.5 | 2026-06-01 | In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause a system crash due to improper input validation. This could lead to remot… |
CVE-2026-0018 | Medium | 5.5 | 2026-06-01 | In multiple functions of AccessibilityManagerService.java, there is a possible persistent denial of service due to improper input validation. This could lead t… |
CVE-2025-22424 | High | 7.8 | 2026-06-01 | In multiple locations, there is a possible way to reveal images across users due to improper input validation. This could lead to local escalation of privilege… |
CVE-2026-30963 | Low | 3.9 | 2026-06-01 | Capsule is a multi-tenancy and policy-based framework for Kubernetes. To defend against namespace hijacking achieved through update/patch operations on namespa… |
CVE-2026-22872 | Critical | 9.1 | 2026-06-01 | Capsule is a multi-tenancy and policy-based framework for Kubernetes. The Capsule Controller runs with cluster-admin privileges. Although the TenantResource Ra… |
CVE-2026-46243 | High | 7.1 | 2026-06-01 | In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.spnego descriptions cifs.spnego key descriptions conta… |
CVE-2026-45505 | High | 8.8 | 2026-06-01 | Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache Activ… |
CVE-2026-42588 | High | 8.1 | 2026-06-01 | Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache Activ… |
CVE-2026-48188 | Critical | 9.1 | 2026-06-01 | An improper Input Validation vulnerability in OTRS or ((OTRS)) Community Edition database layer module allows an unauthenticated SQL injection which can lead t… |
CVE-2026-45352 | Medium | 5.3 | 2026-05-29 | cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.43.4, negative chunk-size in chunked Transfer-Encoding causes unbo… |
CVE-2026-44518 | Medium | 5.3 | 2026-05-29 | liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. Prior to 0.16.0, an out-of-bounds read has… |
CVE-2026-45628 | Critical | 9.6 | 2026-05-29 | Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.2 and earlier, Dokploy constructs shell commands using JavaScript template literals and… |
CVE-2026-45615 | High | 8.2 | 2026-05-29 | mouse07410/asn1c is an ASN.1 compiler. In 1.4 and earlier, a memory safety vulnerability was identified in the OER decoding skeleton files generated by asn1c (… |
CVE-2026-9987 | High | 7.8 | 2026-05-28 | Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 148.0.7778.216 allowed a local attacker to execute arbitrary… |
CVE-2026-9986 | Medium | 4.2 | 2026-05-28 | Insufficient validation of untrusted input in OptimizationGuide in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the rend… |
CVE-2026-9985 | Medium | 5.3 | 2026-05-28 | Insufficient validation of untrusted input in Media in Google Chrome on ChromeOS prior to 148.0.7778.216 allowed a remote attacker who had compromised the rend… |
CVE-2026-9982 | High | 8.3 | 2026-05-28 | Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process… |
CVE-2026-9980 | Medium | 5.0 | 2026-05-28 | Insufficient validation of untrusted input in Printing in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer proc… |
CVE-2026-9979 | Medium | 5.0 | 2026-05-28 | Insufficient validation of untrusted input in Input in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process… |
CVE-2026-9977 | High | 8.3 | 2026-05-28 | Insufficient validation of untrusted input in WebShare in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the re… |
CVE-2026-9969 | High | 8.8 | 2026-05-28 | Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a crafted… |
CVE-2026-9950 | Low | 3.1 | 2026-05-28 | Insufficient validation of untrusted input in iOS in Google Chrome on iOS prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer pr… |
CVE-2026-9914 | High | 8.3 | 2026-05-28 | Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process… |
CVE-2026-9903 | Medium | 5.0 | 2026-05-28 | Insufficient validation of untrusted input in Site Isolation in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the rendere… |
CVE-2026-9898 | High | 8.3 | 2026-05-28 | Insufficient validation of untrusted input in GPU in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the rendere… |
CVE-2026-9885 | High | 8.3 | 2026-05-28 | Insufficient validation of untrusted input in UI in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer pro… |
CVE-2026-9880 | High | 8.3 | 2026-05-28 | Insufficient validation of untrusted input in WebGL in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process… |
CVE-2026-10021 | High | 8.8 | 2026-05-28 | Insufficient validation of untrusted input in USB in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a crafted HT… |
CVE-2026-10020 | High | 8.3 | 2026-05-28 | Insufficient validation of untrusted input in Skia in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the render… |
CVE-2026-10004 | Medium | 6.5 | 2026-05-28 | Insufficient validation of untrusted input in Passwords in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to perform UI spoofing via a crafted… |
CVE-2026-49095 | Medium | 6.5 | 2026-05-28 | Improper Input Validation (CWE-20) in the Kibana Fleet agent policy management feature can lead to privilege escalation. An authenticated user with Fleet manag… |
CVE-2026-30760 | High | 7.3 | 2026-05-28 | An issue in SourceBans Material Admin before v.1.1.6 (3ecd95e) allows attackers to manipulate arbitrary user data in the web app via a crafted XAJAX call. |
CVE-2026-45076 | Low | 2.7 | 2026-05-28 | Synapse is an open source Matrix homeserver implementation. Prior to 1.152.1, in federated rooms, malicious homeservers can craft room events in such a way tha… |
CVE-2026-45137 | High | 8.2 | 2026-05-27 | Anchor is a framework providing several convenient developer tools for writing Solana programs. From 1.0.0 to before 1.0.2, an logic error causes anchor progra… |
CVE-2026-5509 | High | 7.2 | 2026-05-27 | An authenticated command injection vulnerability exists in the Archer BE450 v1 and BE7200 v1 router that allows an administrator to execute arbitrary system co… |
CVE-2026-42553 | | 2026-05-27 | Cinny is a Matrix client. Prior to 4.10.3, A remote authenticated attacker who shares a room with a victim and has permissions to create room emotes (for examp… | |
CVE-2026-44325 | High | 7.5 | 2026-05-27 | free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NRF root SBI endpoint POST /oauth2/token contains a parser-level typ… |
CVE-2026-44319 | High | 7.5 | 2026-05-27 | free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF terminates the entire process when a stored PFD-subscription not… |
CVE-2026-42459 | High | 7.5 | 2026-05-27 | free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, the free5GC UDM component fails to validate the supi path parameter in six GET… |
CVE-2026-48922 | High | 7.5 | 2026-05-27 | Jenkins Credentials Binding Plugin 720.v3f6decef43ea_ and earlier does not properly sanitize file names for file and zip file credentials, allowing attackers a… |
CVE-2026-24195 | High | 7.1 | 2026-05-26 | NVIDIA Display Driver for Linux contains a vulnerability in UVM, where a user could cause improper input validation. A successful exploit of this vulnerability… |
CVE-2025-33221 | Medium | 4.4 | 2026-05-26 | NVIDIA Display Driver for Windows and Linux contains a vulnerability in the kernel driver, where a user could cause an incorrect permission assignment for a cr… |
CVE-2026-45721 | Critical | 9.0 | 2026-05-26 | Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, when Algernon is asked for any URL path that resolves to a directory without an index f… |
CVE-2026-43935 | High | 8.1 | 2026-05-26 | e107 is a content management system (CMS). Prior to 2.3.4, a Host Header Injection vulnerability in the password reset page allows attackers to manipulate the… |
CVE-2026-9521 | High | 7.3 | 2026-05-26 | A security vulnerability has been detected in fraillt bitsery up to 5.2.4. Affected is the function loadFromSharedState in the library include/bitsery/ext/std_… |
CVE-2026-9497 | Medium | 6.3 | 2026-05-25 | A flaw has been found in changmingxie tcc-transaction up to 2.1.0. This issue affects the function Fastjson.parseObject of the component Fastjson AutoType REST… |
CVE-2026-40411 | Critical | 9.9 | 2026-05-22 | Improper input validation in Azure Virtual Network Gateway allows an authorized attacker to execute code over a network. |
CVE-2026-26147 | High | 7.7 | 2026-05-22 | Improper input validation in Azure Compute Gallery allows an authorized attacker to disclose information over a network. |
CVE-2026-3294 | High | 8.8 | 2026-05-22 | An authentication logic vulnerability in multiple TP-Link range extenders allows an unauthenticated attacker on an adjacent network to manipulate a login param… |
CVE-2026-34207 | High | 7.6 | 2026-05-22 | TypeBot is a chatbot builder tool. In versions prior to 3.16.0, SSRF protection for Webhook / HTTP Request blocks validates only the URL string, blocked hostna… |
CVE-2026-44417 | High | 7.5 | 2026-05-22 | The fix for CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE was not complete, meaning that another path in the code might lead to code… |
CVE-2026-34910 | Critical | 10.0 | 2026-05-22 | A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection. |
CVE-2026-33000 | Critical | 9.1 | 2026-05-22 | A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute… |
CVE-2026-9157 | High | 8.4 | 2026-05-21 | Improper input validation, Unrestricted upload of file with dangerous type vulnerability in Gmission Web Fax allows Remote Code Inclusion. This issue affects… |
CVE-2026-9124 | Medium | 5.3 | 2026-05-20 | Insufficient validation of untrusted input in Input in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker who had compromised the renderer proc… |
CVE-2026-39850 | High | 7.4 | 2026-05-20 | Yii 2 is a PHP application framework. Versions 2.0.54 and prior contain flawed logic in the core view rendering method View::renderPhpFile() that leads to Loca… |
CVE-2026-20240 | Medium | 6.5 | 2026-05-20 | In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.11, and 9.3.12, and Splunk Cloud Platform versions below 10.4.2603.1, 10.3.2512.9, 10.2.2510.11, 10.1.2… |
CVE-2026-5946 | High | 7.5 | 2026-05-20 | Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CHAOS` or `HESIOD`, o… |
CVE-2026-8959 | Critical | 9.6 | 2026-05-19 | Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbir… |
CVE-2026-31378 | Medium | 6.5 | 2026-05-19 | Improper Input Validation vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09… |
CVE-2026-28751 | Low | 3.3 | 2026-05-19 | in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS. |
CVE-2026-27891 | High | 7.2 | 2026-05-18 | FacturaScripts is an open source accounting and invoicing software. Versions 2026 and below contain a critical vulnerability in the Plugins::add() function. Th… |
CVE-2026-45495 | High | 8.8 | 2026-05-18 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2026-45492 | Medium | 5.4 | 2026-05-18 | Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-20685 | Medium | 6.5 | 2026-05-18 | An attacker in a privileged network position may be able to leak sensitive information. A path handling issue was addressed with improved validation. This issu… |
CVE-2026-8759 | High | 7.3 | 2026-05-17 | A vulnerability was identified in xiandafu beetl up to 3.20.2. Affected is an unknown function of the file beetl-classic-integration/beetl-spring-classic/src/m… |
CVE-2026-8751 | High | 7.3 | 2026-05-17 | A security flaw has been discovered in h2oai h2o-3 up to 7402. This affects the function importBinaryModel of the file h2o-core/src/main/java/hex/Model.java of… |
CVE-2026-8735 | Medium | 6.3 | 2026-05-17 | A vulnerability was identified in Oinone Pamirs up to 7.2.0. This affects the function JsonUtils.parseMap of the file PamirsParserConfig.java of the component… |
CVE-2026-45317 | Medium | 4.6 | 2026-05-15 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, an application-wide Cross-Site Request Forge… |
CVE-2025-29936 | | 2026-05-15 | Improper input validation within the AMD Platform Management Framework (PMF) could allow an attacker to unmap arbitrary memory pages potentially impacting inte… | |
CVE-2026-42327 | | 2026-05-14 | rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.7 to before 0.10.79, X509Ref::ocsp_responders returns OCSP responder URLs fr… | |
CVE-2026-8579 | Low | 3.1 | 2026-05-14 | Insufficient validation of untrusted input in Skia in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process… |