CWE-1287: Improper Validation of Specified Type of Input, page 2
Filter
The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.
What the weakness is: CWE-1287 at MITRE. All weaknesses
Ask an AI about CWE-1287
Show the prompt
Explain CWE-1287: Improper Validation of Specified Type of Input and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/1287.html and https://cve.bz/cve/cwe/1287?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 7.3CVE-2026-0802EPSS 0.4%
An ACAP configuration file lacked sufficient input validation, which could allow command injection and potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the install…
- 7.5CVE-2026-29645EPSS 0.5%
NEMU (OpenXiangShan/NEMU) before v2025.12.r2 contains an improper instruction-validation flaw in its RISC-V Vector (RVV) decoder. The decoder does not correctly validate the funct3 field when decoding vsetvli/vsetivli/vsetvl, allowing cert…
- 7.5CVE-2026-33806EPSS 0.4%
Impact: Fastify applications using schema.body.content for per-content-type body validation can have validation bypassed entirely by prepending a space to the Content-Type header. The body is still parsed correctly but schema validation i…
- 7.7CVE-2026-4598EPSS 0.6%
Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation receives zero or negative inputs, allowing an attacker to hang the …
- 6.9CVE-2019-25596EPSS 0.2%
SpotAuditor 5.2.6 contains a denial of service vulnerability in the registration dialog that allows local attackers to crash the application by supplying an excessively long string in the Name field. Attackers can paste a buffer of 300 rep…
- 7.7CVE-2026-2092EPSS 0.4%
A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion…
- 8.6CVE-2026-2454EPSS 0.3%
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to handle incorrectly reported array lengths which allows malicious user to cause OOM errors and crash the server via sending corrupted msgpack frames within …
- 4.3CVE-2026-25783EPSS 0.3%
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly validate User-Agent header tokens which allows an authenticated attacker to cause a request panic via a specially crafted User-Agent header. Matte…
- 7.4CVE-2026-20074EPSS 0.2%
A vulnerability in the Intermediate System-to-Intermediate System (IS-IS) multi-instance routing feature of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause the IS-IS process to restart unexpectedly. This…
- 8.8CVE-2026-26115EPSS 1.2%
Improper validation of specified type of input in SQL Server allows an authorized attacker to elevate privileges over a network.
- 7.0CVE-2026-25179EPSS 0.4%
Improper validation of specified type of input in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
- 8.4CVE-2026-29788EPSS 0.3%
TSPortal is the WikiTide Foundation’s in-house platform used by the Trust and Safety team to manage reports, investigations, appeals, and transparency work. Prior to version 30, conversion of empty strings to null allows disguising DPA rep…
- 8.8CVE-2026-2004EPSS 1.3%
Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows an object creator to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.…
- 4.3CVE-2026-2003EPSS 0.3%
Improper validation of type "oidvector" in PostgreSQL allows a database user to disclose a few bytes of server memory. We have not ruled out viability of attacks that arrange for presence of confidential information in disclosed bytes, bu…
- 7.5CVE-2026-25639EPSS 2.8%
Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property…
- 7.5CVE-2026-20119EPSS 0.4%
A vulnerability in the text rendering subsystem of Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affecte…
- 7.5CVE-2026-24307EPSS 0.9%
Improper validation of specified type of input in M365 Copilot allows an unauthorized attacker to disclose information over a network.
- 7.4CVE-2026-21932EPSS 0.5%
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JavaFX). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0…
- 5.3CVE-2025-53627EPSS 0.2%
Meshtastic is an open source mesh networking solution. The Meshtastic firmware (starting from version 2.5) introduces asymmetric encryption (PKI) for direct messages, but when the `pki_encrypted` flag is missing, the firmware silently fall…
- 6.5CVE-2025-12689EPSS 0.3%
Mattermost versions 11.0.x <= 11.0.4, 10.12.x <= 10.12.2, 10.11.x <= 10.11.6 fail to check WebSocket request field for proper UTF-8 format, which allows attacker to crash Calls plug-in via sending malformed request.
- 3.0CVE-2025-13352EPSS 0.2%
Mattermost versions 10.11.x <= 10.11.6 and Mattermost GitHub plugin versions <=2.4.0 fail to validate plugin bot identity in reaction forwarding which allows attackers to hijack the GitHub reaction feature to make users add reactions to ar…
- 6.5CVE-2024-2105EPSS 0.2%
An unauthorised attacker within bluetooth range may use an improper validation during the BLE connection request to deadlock the affected devices.
- 4.3CVE-2025-32901EPSS 0.2%
In KDE Connect before 1.33.0 on Android, malicious device IDs (sent via broadcast UDP) could cause an application crash.
- 6.5CVE-2025-20756EPSS 0.3%
In Modem, there is a possible system crash due to a logic error. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User in…
- 6.5CVE-2025-60633EPSS 0.4%
An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via the Nudm_SubscriberDataManagement API.
- 9.1CVE-2025-12977EPSS 0.8%
Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins fail to sanitize tag_key inputs. An attacker with network access or the ability to write records into Splunk or Elasticsearch can supply tag_key values containing special ch…
- 7.5CVE-2025-41729EPSS 0.4%
An unauthenticated remote attacker can send a specially crafted Modbus read command to the device which leads to a denial of service.
- 4.3CVE-2025-9524EPSS 0.3%
The VAPIX API port.cgi did not have sufficient input validation, which may result in process crashes and impact usability. This vulnerability can only be exploited after authenticating with a viewer- operator- or administrator-privileged s…
- 6.7CVE-2025-8108EPSS 0.1%
An ACAP configuration file has improper permissions and lacks input validation, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of un…
- 6.7CVE-2025-6298EPSS 0.1%
ACAP applications can gain elevated privileges due to improper input validation, potentially leading to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned A…
- 6.7CVE-2025-4645EPSS 0.2%
An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP application…
- 7.8CVE-2025-59278EPSS 0.3%
Improper validation of specified type of input in Windows Authentication Methods allows an authorized attacker to elevate privileges locally.
- 7.8CVE-2025-59277EPSS 0.4%
Improper validation of specified type of input in Windows Authentication Methods allows an authorized attacker to elevate privileges locally.
- 7.8CVE-2025-59275EPSS 0.3%
Improper validation of specified type of input in Windows Authentication Methods allows an authorized attacker to elevate privileges locally.
- 6.5CVE-2025-59259EPSS 1.5%
Improper validation of specified type of input in Windows Local Session Manager (LSM) allows an authorized attacker to deny service over a network.
- 6.5CVE-2025-59257EPSS 1.5%
Improper validation of specified type of input in Windows Local Session Manager (LSM) allows an authorized attacker to deny service over a network.
- 6.5CVE-2025-58729EPSS 1.1%
Improper validation of specified type of input in Windows Local Session Manager (LSM) allows an authorized attacker to deny service over a network.
- 7.8CVE-2025-55701EPSS 0.4%
Improper validation of specified type of input in Microsoft Windows allows an authorized attacker to elevate privileges locally.
- 6.5CVE-2025-58084EPSS 0.3%
Mattermost Desktop App versions <= 5.13.0 fail to validate URLs external to the configured Mattermost servers, allowing an attacker on a server the user has configured to crash the user's application by sending the user a malformed URL.
- 5.3CVE-2025-61672EPSS 0.5%
Synapse is an open source Matrix homeserver implementation. Lack of validation for device keys in Synapse before 1.138.3 and in Synapse 1.139.0 allow an attacker registered on the victim homeserver to degrade federation functionality, unpr…
- 7.7CVE-2025-20327EPSS 0.4%
A vulnerability in the web UI of Cisco IOS Software could allow an authenticated, remote attacker with low privileges to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper input valida…
- 7.5CVE-2025-10207EPSS 0.4%
Improper Validation of Specified Type of Input vulnerability in ABB FLXEON.This issue affects FLXEON: through 9.3.5.
- 7.5CVE-2024-48851EPSS 0.5%
Improper Validation of Specified Type of Input vulnerability in ABB FLXEON.A remote code execution is possible due to an improper input validation. This issue affects FLXEON: through 9.3.5.
- 8.1CVE-2025-42929EPSS 0.2%
Due to missing input validation, an attacker with high privilege access to ABAP reports could delete the content of arbitrary database tables, if the tables are not protected by an authorization group. This leads to a high impact on integr…
- 8.1CVE-2025-42916EPSS 0.3%
Due to missing input validation, an attacker with high privilege access to ABAP reports could delete the content of arbitrary database tables, if the tables are not protected by an authorization group. This leads to a high impact on integr…
- 4.9CVE-2025-8402EPSS 0.3%
Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.0, 10.9.x <= 10.9.3 fail to validate import data which allows a system admin to crash the server via the bulk import feature.
- 8.5CVE-2025-20251EPSS 0.5%
A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to create or de…
- 7.7CVE-2025-20244EPSS 0.6%
A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow a remote attacker that is authenticated as a VPN …
- 8.7CVE-2025-9042EPSS 0.4%
A security issue exists due to improper handling of CIP Class 32’s request when a module is inhibited on the 5094-IY8 device. It causes the module to enter a fault state with the Module LED flashing red. Upon un-inhibiting, the module retu…
- 8.7CVE-2025-9041EPSS 0.4%
A security issue exists due to improper handling of CIP Class 32’s request when a module is inhibited on the 5094-IF8 device. It causes the module to enter a fault state with the Module LED flashing red. Upon un-inhibiting, the module retu…