cve.bz

CWE-20: Improper Input Validation, page 12

Filter

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

What the weakness is: CWE-20 at MITRE

Ask an AI about CWE-20

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-20: Improper Input Validation and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/20.html and https://cve.bz/cve/cwe/20?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.5CVE-2026-26452EPSS 0.5%

    ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 lcontains a vulnerability in the option parsing logic that causes a segmentation fault when processing COAP messages containing invalid option numbers.

  2. 8.6CVE-2026-81662EPSS 0.5%

    Affected versions of Flowintel improperly trust configuration keys supplied to the alerts settings update endpoint. While configuration values were normalized to Python literals, the corresponding keys were used directly when constructing …

  3. 8.8CVE-2026-59354EPSS 0.5%

    In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client Registration is explicitly enabled, the registration endpoint performs insufficient validation of certain client metadata fields s…

  4. 5.4CVE-2026-47880EPSS 0.3%

    A producer who can publish to a JMS destination consumed by any Spring Integration JMS inbound component can set String JMS properties named replyChannel, errorChannel, or json__TypeId__ which are copied verbatim into the Spring Integratio…

  5. 3.5CVE-2026-56547EPSS 0.3%

    The Apple profile generated for the Apple built-in Mail, Calendar and Contacts account to synchronize with HCL Traveler requires the Logon Name and Mail Address to be embedded in them.  The values cannot be changed later on, so the Apple p…

  6. 3.1CVE-2026-13480EPSS 0.2%

    The LoRaWAN TS004 Fragmented Data Block Transport handler frag_transport_package_callback() in subsys/lorawan/services/frag_transport.c parses downlink command bytes without validating that enough payload bytes remain before each access. T…

  7. 10.0CVE-2026-77554EPSS 1.6%

    A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Talk Application to execute a Command Injection on the host device.

  8. 9.8CVE-2026-77552EPSS 1.6%

    A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Enterprise Audio/Video Bridge to execute a Command Injection on the device.

  9. 9.9CVE-2026-77548EPSS 1.4%

    A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to execute a Command Injection on the host device.

  10. 9.9CVE-2026-77547EPSS 1.4%

    A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to execute a Command Injection on the host device.

  11. 9.9CVE-2026-77546EPSS 1.4%

    A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to execute a Command Injection on the host device.

  12. 9.9CVE-2026-77543EPSS 1.4%

    A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to execute a Command Injection on the host device.

  13. 9.1CVE-2026-77542EPSS 1.3%

    A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UID Enterprise Agent to execute a Command Injection on the host device.

  14. 9.1CVE-2026-77540EPSS 1.3%

    A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS Server to execute a Command Injection on the host device.

  15. 9.1CVE-2026-77539EPSS 1.3%

    A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS Server to execute a Command Injection on the host device.

  16. 10.0CVE-2026-77537EPSS 1.6%

    A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to execute a Command Injection on the host device.

  17. 9.1CVE-2026-77535EPSS 1.3%

    A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi Network Application to execute a Command Injection on an adopted device.

  18. 9.9CVE-2026-77533EPSS 1.4%

    A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to execute a Command Injection on the host device.

  19. 7.8CVE-2026-78237EPSS 0.2%

    Insufficient input validation in ABR allows a low-privileged user to inject malicious entries into the sudoers file, resulting in persistent root access that remained effective after the ABR session ended.

  20. 5.7CVE-2026-18261EPSS 0.3%

    Vulnerability in Drupal Powerful Surveys. This issue affects Powerful Surveys versions: *.*.

  21. 5.7CVE-2026-18260EPSS 0.4%

    Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Disable Login Page allows Brute Force. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4.

  22. 5.7CVE-2026-16643EPSS 0.3%

    Vulnerability in Drupal Lunr exposed filters. This issue affects Lunr exposed filters versions: *.*.

  23. 5.7CVE-2026-16642EPSS 0.3%

    Vulnerability in Drupal Email Login OTP. This issue affects Email Login OTP versions: *.*.

  24. 9.8CVE-2026-16641EPSS 0.5%

    Vulnerability in Drupal Commerce Elavon. This issue affects Commerce Elavon versions: *.*.

  25. 5.7CVE-2026-15088EPSS 0.3%

    Vulnerability in Drupal Development Environment. This issue affects Development Environment versions: *.*.

  26. 9.8CVE-2026-65637EPSS 0.8%

    Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120. Users are …

  27. 6.5CVE-2026-79288EPSS 0.3%

    Improper input validation in Autofill in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)

  28. 3.1CVE-2026-79272EPSS 0.2%

    Improper input validation in FindInPage in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

  29. 6.5CVE-2026-79260EPSS 0.2%

    Improper input validation in Cookies in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

  30. 4.3CVE-2026-79259EPSS 0.2%

    Improper input validation in Safebrowsing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted file. (Chromium security severity: Medium)

  31. 3.1CVE-2026-79255EPSS 0.3%

    Improper input validation in WebRTC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

  32. 6.5CVE-2026-79253EPSS 0.2%

    Improper input validation in Network in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted HTML page. (Chromium security severity: Low)

  33. 4.3CVE-2026-79251EPSS 0.3%

    Improper input validation in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

  34. 6.5CVE-2026-79243EPSS 0.3%

    Improper input validation in ReadingList in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security sever…

  35. 8.8CVE-2026-79230EPSS 0.3%

    Improper input validation in ANGLE in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

  36. 4.3CVE-2026-79214EPSS 0.3%

    Improper input validation in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

  37. 3.1CVE-2026-79203EPSS 0.3%

    Improper input validation in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

  38. 4.3CVE-2026-79192EPSS 0.2%

    Improper input validation in Variations in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially bypass web origin policy via crafted network traffic. (Chromium security severity: Medium)

  39. 8.8CVE-2026-79182EPSS 0.4%

    Improper input validation in Media in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

  40. 4.3CVE-2026-79151EPSS 0.2%

    Improper input validation in Safebrowsing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted file. (Chromium security severity: Medium)

  41. 7.5CVE-2026-79139EPSS 0.4%

    Improper input validation in Media in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. …

  42. 8.3CVE-2026-79132EPSS 0.4%

    Improper input validation in Input in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. …

  43. 6.5CVE-2026-79123EPSS 0.3%

    Improper input validation in NTP Footer in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severi…

  44. 8.3CVE-2026-79121EPSS 0.4%

    Improper input validation in Chromecast in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium…

  45. 9.6CVE-2026-79111EPSS 0.5%

    Improper input validation in Dawn in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

  46. 8.3CVE-2026-79109EPSS 0.4%

    Improper input validation in Printing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium s…

  47. 4.3CVE-2026-79106EPSS 0.3%

    Improper input validation in Input in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass web origin policy via a crafted HTML page. (Chromium s…

  48. 4.3CVE-2026-79105EPSS 0.3%

    Improper input validation in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)

  49. 6.5CVE-2026-79076EPSS 0.3%

    Improper input validation in Sync in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: Medium)

  50. 3.1CVE-2026-79066EPSS 0.3%

    Improper input validation in Navigation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)