cve.bz

CWE-115: Misinterpretation of Input

Filter

The product misinterprets an input, whether from an attacker or another product, in a security-relevant fashion.

What the weakness is: CWE-115 at MITRE

Ask an AI about CWE-115

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-115: Misinterpretation of Input and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/115.html and https://cve.bz/cve/cwe/115?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 4.0CVE-2026-101170

    DoS vulnerability in the file parsing module. Impact: Successful exploitation of this vulnerability may affect availability.

  2. 9.4CVE-2026-116241EPSS 0.3%

    pgAdmin 4's Import/Export Data tool wraps a user's query export in a psql \copy (...) TO command and checks that the query's parentheses are balanced so that nothing can escape the wrapper. The check rejected a backslash inside a single-qu…

  3. 8.2CVE-2026-73798EPSS 0.3%

    A security vulnerability in HPE NonStop DNS 9.2.3 Non Secure Version could cause a Denial of Service.

  4. 2.0CVE-2026-63650EPSS 0.2%

    OpenVPN 2.7_alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup field

  5. 9.4CVE-2026-17566EPSS 0.7%

    pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-supplied SQL query into a Jinja template and passing the rendered line to psql via --command. To stop an attacker from breaking out of the (…

  6. 9.4CVE-2026-17351EPSS 0.5%

    The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the AI Assistant's execute_sql_query tool to parse, via sqlparse, as exactly one non-transaction-control statement before running it inside a BEGIN TRAN…

  7. 3.7CVE-2026-42004EPSS 0.2%

    An attacker can send a crafted EDNS OPT record that will be ignored by DNSdist’s filtering rules, but will be rewritten as a valid OPT record when EDNS Client Subnet is inserted, causing the backend to see the EDNS option(s) that DNSdist d…

  8. 4.8CVE-2026-12491EPSS 0.2%

    A flaw was found in vLLM, an open-source library for large language model inference. This vulnerability arises from improper handling of image metadata, specifically EXIF orientation and PNG transparency (tRNS) data, during image processin…

  9. 6.5CVE-2025-68113EPSS 0.5%

    ALTCHA is privacy-first software for captcha and bot protection. A cryptographic semantic binding flaw in ALTCHA libraries allows challenge payload splicing, which may enable replay attacks. The HMAC signature does not unambiguously bind c…

  10. 6.9CVE-2025-55303ExploitEPSS 0.6%

    Astro is a web framework for content-driven websites. In versions of astro before 5.13.2 and 4.16.18, the image optimization endpoint in projects deployed with on-demand rendering allows images from unauthorized third-party domains to be s…

  11. 7.0CVE-2025-54584EPSS 0.6%

    GitProxy is an application that stands between developers and a Git remote endpoint (e.g., github.com). In versions 1.19.1 and below, an attacker can craft a malicious Git packfile to exploit the PACK signature detection in the parsePush.t…

  12. 6.3CVE-2025-5826EPSS 0.3%

    Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Misinterpretation of Input Vulnerability. This vulnerability allows network-adjacent attackers to inject arbitrary AT commands on affected installations of Autel MaxiCharger AC …

  13. 8.0CVE-2025-5747EPSS 0.4%

    WOLFBOX Level 2 EV Charger MCU Command Parsing Misinterpretation of Input Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installatons of WOLFBOX Level 2 EV Ch…

  14. 7.5CVE-2025-32908EPSS 0.6%

    A flaw was found in libsoup. The HTTP/2 server in libsoup may not fully validate the values of pseudo-headers :scheme, :authority, and :path, which may allow a user to cause a denial of service (DoS).

  15. 7.5CVE-2024-11169EPSS 0.9%

    An unhandled exception in danny-avila/librechat version 3c94ff2 can lead to a server crash. The issue occurs when the fs module throws an exception while handling file uploads. An unauthenticated user can trigger this exception by sending …

  16. 4.4CVE-2025-22870EPSS 0.4%

    Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly m…

  17. 6.5CVE-2025-25069EPSS 0.8%

    A Cross-Protocol Scripting vulnerability is found in Apache Kvrocks. Since Kvrocks didn't detect if "Host:" or "POST" appears in RESP requests, a valid HTTP request can also be sent to Kvrocks as a valid RESP request and trigger some dat…

  18. 4.6CVE-2023-32228EPSS 0.2%

    A firmware bug which may lead to misinterpretation of data in the AMC2-4WCF and AMC2-2WCF allowing an adversary to grant access to the last authorized user.

  19. 6.5CVE-2023-32260EPSS 0.4%

    Misinterpretation of Input vulnerability in OpenText™ Service Management Automation X (SMAX), OpenText™ Asset Management X (AMX), and OpenText™ Hybrid Cloud Management X (HCMX) products. The vulnerability could allow Input data manipulatio…

  20. 4.3CVE-2023-0880EPSS 0.6%

    Misinterpretation of Input in GitHub repository thorsten/phpmyfaq prior to 3.1.11.

  21. 7.4CVE-2022-20915EPSS 0.3%

    A vulnerability in the implementation of IPv6 VPN over MPLS (6VPE) with Zone-Based Firewall (ZBFW) of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected devic…

  22. 6.1CVE-2022-3224EPSS 0.8%

    Misinterpretation of Input in GitHub repository ionicabizau/parse-url prior to 8.1.0.

  23. 6.1CVE-2022-1233EPSS 0.8%

    URL Confusion When Scheme Not Supplied in GitHub repository medialize/uri.js prior to 1.19.11.

  24. 6.5CVE-2022-21672EPSS 0.7%

    make-ca is a utility to deliver and manage a complete PKI configuration for workstations and servers. Starting with version 0.9 and prior to version 1.10, make-ca misinterprets Mozilla certdata.txt and treats explicitly untrusted certifica…

  25. 8.6CVE-2021-1587EPSS 1.7%

    A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected devi…

  26. 4.3CVE-2021-21366EPSS 1.3%

    xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.4.0 and older do not correctly preserve system identifiers, FPIs or namespaces when repeatedly parsing and serializ…

  27. 7.5CVE-2021-0207EPSS 1.3%

    An improper interpretation conflict of certain data between certain software components within the Juniper Networks Junos OS devices does not allow certain traffic to pass through the device upon receipt from an ingress interface filtering…

  28. 9.8CVE-2020-27846EPSS 4.9%

    A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML Authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

  29. 5.6CVE-2020-29511EPSS 2.0%

    The encoding/xml package in Go (all versions) does not correctly preserve the semantics of element namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during differen…

  30. 5.6CVE-2020-29510EPSS 2.1%

    The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of directives during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different sta…

  31. 5.6CVE-2020-29509EPSS 2.1%

    The encoding/xml package in Go (all versions) does not correctly preserve the semantics of attribute namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during differ…

  32. 4.3CVE-2018-12123EPSS 4.0%

    Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser for javascript protocol: If a Node.js application is using url.parse() to determine the URL hostname, that hostname can be spoofed b…

  33. 7.5CVE-2018-12116EPSS 4.6%

    Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then data can be provided which will trig…

  34. 5.3CVE-2018-7159EPSS 3.5%

    The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such as `Content-Length: 1 2` to be interpreted as having a value of `12`. The HTTP specification does not allow for spaces in…