cve.bz

CWE-20: Improper Input Validation, page 10

Filter

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

What the weakness is: CWE-20 at MITRE

Ask an AI about CWE-20

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-20: Improper Input Validation and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/20.html and https://cve.bz/cve/cwe/20?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.3CVE-2026-86768EPSS 0.3%

    Snipe-IT before 8.7.0 fails to validate soft-deleted state in API checkout endpoints, allowing authenticated users with checkout permissions to bind live inventory to trashed targets. Attackers can submit POST requests to hardware, compone…

  2. 7.1CVE-2025-71417EPSS 0.4%

    PocketMine-MP before 5.32.1 fails to validate uniqueness of pack UUIDs in ResourcePackClientResponsePacket STATUS_SEND_PACKS handling, allowing authenticated clients to trigger duplicate pack transmissions. Attackers can send multiple copi…

  3. 7.1CVE-2024-58380EPSS 0.5%

    PocketMine-MP versions before 5.11.2 contain a denial of service vulnerability in BookEditPacket handling that crashes the server when an invalid inventory slot value is provided. Attackers can send a crafted BookEditPacket with an invento…

  4. 8.7CVE-2023-54393EPSS 0.6%

    PocketMine-MP versions before 4.20.5 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper validation in the JsonMapper dependency. Attackers can send malformed JSON structures in LoginPacket to crash the se…

  5. 7.1CVE-2023-54392EPSS 0.5%

    PocketMine-MP versions >= 4.20.0 before 4.22.3 (and before 5.2.1 in the 5.x branch) fail to validate NBT tag types in BlockActorDataPacket. A player can crash the server by sending a packet containing sign NBT data with an incorrect tag ty…

  6. 7.5CVE-2026-74761EPSS 0.6%

    Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable topic subscription. This issue affects…

  7. 8.1CVE-2026-73334EPSS 0.4%

    Potential problem for users of the org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18. This package enables users to encrypt Parquet files via an envelope encryption mechanism that wraps (encrypts) data ke…

  8. 5.2CVE-2025-7062EPSS 0.5%

    A stored cross-site scripting (XSS) vulnerability has been identified in the H5P module `h5p-nodejs-library` by Lumi Education UG in versions up to and including 10.0.4. The library allows users to upload H5P content that contains maliciou…

  9. 5.1CVE-2026-21112EPSS 0.1%

    Improper input validation in Samsung Tips prior to Android 17 allows local attackers to launch arbitrary activity with Samsung Tips privilege. User interaction is required for triggering this vulnerability.

  10. 8.4CVE-2026-21101EPSS 0.2%

    Improper input validation in DualDAR driver prior to SMR Sep-2026 Release 1 allows local privileged attackers to potentially execute arbitrary code with root privilege.

  11. 6.1CVE-2026-21094EPSS 0.3%

    Improper input validation in wpa_supplicant prior to SMR Sep-2026 Release 1 allows adjacent attackers to write out-of-bounds memory.

  12. 6.9CVE-2026-21089EPSS 0.2%

    Improper input validation in removing style tag in libsubextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory.

  13. 6.9CVE-2026-21088EPSS 0.2%

    Improper input validation in loading a subtitle frame in libsubextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory.

  14. 4.8CVE-2026-21086EPSS 0.1%

    Improper authorization in ProxyHandler prior to SMR Aug-2026 Release 1 allows local attackers to access proxy configuration.

  15. 8.2CVE-2026-12855EPSS 0.2%

    Unvalidated memory boundary could result in arbitrary code execution. The vulnerability exists in the code developed specifically for HP projects.

  16. 5.1CVE-2026-87083EPSS 0.3%

    A weakness has been identified in tile-ai tilelang up to 0.1.14. This impacts the function KernelCache._load_kernel_from_disk of the file tilelang/cache/kernel_cache.py of the component Kernel Cache. Executing a manipulation can lead to de…

  17. 6.5CVE-2026-87600EPSS 0.3%

    Improper input validation in Safebrowsing in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severi…

  18. 5.4CVE-2026-87599EPSS 0.2%

    Improper input validation in Interstitials in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

  19. 5.9CVE-2026-87590EPSS 0.3%

    Improper input validation in Passwords in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially leak sensitive information via crafted network traffic. (Chromium security severity: Medium)

  20. 4.3CVE-2026-87573EPSS 0.3%

    Improper input validation in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

  21. 4.3CVE-2026-87568EPSS 0.2%

    Improper input validation in Chromium in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to spoof UI elements via crafted network traffic. (Chromium security severity: Low)

  22. 8.3CVE-2026-87553EPSS 0.4%

    Improper input validation in SiteIsolation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chrom…

  23. 8.3CVE-2026-87510EPSS 0.4%

    Improper input validation in FileAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium se…

  24. 4.2CVE-2026-87472EPSS 0.2%

    Improper input validation in FedCM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

  25. 4.3CVE-2026-87469EPSS 0.2%

    Improper input validation in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy into a privileged page via crafted network traffic. (Chromium security severity: Low)

  26. 8.4CVE-2026-75999EPSS 0.5%

    ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Th…

  27. 8.6CVE-2026-75991EPSS 0.3%

    Illustrator is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of…

  28. 3.5CVE-2026-75726EPSS 0.5%

    Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorize…

  29. 7.8CVE-2026-58941EPSS 0.1%

    In multiple functions of iommu.c, there is a possible out of bounds read/write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not neede…

  30. 7.8CVE-2026-55273EPSS 0.10%

    In AppendCommentLine of AnnotationProcessor.cpp, there is a possible supply chain risk due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is n…

  31. 6.5CVE-2026-55256EPSS 0.3%

    In parsePartHeaders of multiple files, there is a possible persistent denial of service due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not n…

  32. 3.3CVE-2026-45525EPSS 0.09%

    In multiple locations, there is a possible improper data sanitization due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for expl…

  33. 3.3CVE-2026-28638EPSS 0.09%

    In multiple functions of XmpDataParser.java, there is a possible improper data sanitization due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction …

  34. 7.3CVE-2026-28613EPSS 0.10%

    In initAppLinkTypeAndIntent of ChannelImpl.java, there is a possible launch an arbitrary intent due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interac…

  35. 5.5CVE-2026-81392EPSS 0.5%

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

  36. 8.8CVE-2026-78518EPSS 0.9%

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

  37. 7.8CVE-2026-73021EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  38. 7.8CVE-2026-72996EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  39. 7.8CVE-2026-72994EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  40. 6.5CVE-2026-72977EPSS 1.0%

    Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.

  41. 7.8CVE-2026-70581EPSS 0.3%

    Integer overflow or wraparound in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  42. 7.0CVE-2026-70573EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  43. 9.8CVE-2026-69845EPSS 1.0%

    Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network.

  44. 8.8CVE-2026-69614EPSS 0.9%

    Stack-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.

  45. 7.8CVE-2026-69352EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  46. 7.8CVE-2026-69295EPSS 0.3%

    Out-of-bounds read in Windows USB Driver allows an authorized attacker to elevate privileges locally.

  47. 7.8CVE-2026-69293EPSS 0.3%

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  48. 5.5CVE-2026-69286EPSS 0.4%

    Out-of-bounds read in Windows USB Audio Class driver (usbaudio.sys) allows an authorized attacker to disclose information locally.

  49. 7.8CVE-2026-69270EPSS 0.3%

    Heap-based buffer overflow in Windows USB Audio Class driver (usbaudio.sys) allows an authorized attacker to elevate privileges locally.

  50. 9.8CVE-2026-68839EPSS 1.0%

    Heap-based buffer overflow in Windows USB Mass Storage Class Driver allows an unauthorized attacker to execute code over a network.