cve.bz

CWE-20: Improper Input Validation, page 14

Filter

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

What the weakness is: CWE-20 at MITRE

Ask an AI about CWE-20

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-20: Improper Input Validation and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/20.html and https://cve.bz/cve/cwe/20?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.5CVE-2026-19509EPSS 0.4%

    Improper input validation in `ajaxSet_wireless_network_configuration.jst` in RDK-B WebUI `rdkb-2025q4-kirkstone.04.10.26` allows an authenticated attacker to cause denial of service via a crafted `ssid_number` parameter.

  2. 8.8CVE-2026-17414EPSS 0.3%

    IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 Power Systems Firmware is affected by a vulnerability in partition firmware during network boot. An unauthenticated a…

  3. 5.3CVE-2026-49392EPSS 0.3%

    Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.6.0 until 4.14.6 and 5.0.0-beta3, DB::getFile() and DB::searchFile() in src/syscheckd/src/db/src/file.cpp concatenate a monitored file pat…

  4. 9.6CVE-2026-20318EPSS 0.4%

    As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that a…

  5. 6.9CVE-2026-75987EPSS 0.6%

    A vulnerability was found in SPLWare esProc up to 20260507. This affects the function ObjectInputStream.readUnshared of the file src/main/java/com/scudata/parallel/SocketData.java. Performing a manipulation results in deserialization. Remo…

  6. 8.3CVE-2026-52877EPSS 0.4%

    Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-external IPC handler in src/ipc/downloads.js passes a renderer-supplied url directly to Electron's shell.openExterna…

  7. 8.8CVE-2026-52876EPSS 0.2%

    Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-path-at-time IPC handler in src/ipc/player.js accepts a renderer-controlled filePath without validating its type or …

  8. 7.1CVE-2026-15316EPSS 0.3%

    An improper input validation vulnerability in the configuration service for processing encrypted credential data has been identified in Tapo C200 v5.  An attacker can send oversized crypted ciphertext values that may trigger exception hand…

  9. 9.6CVE-2026-76035EPSS 0.5%

    Inappropriate implementation in Media in Google Chrome on on Mac prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

  10. 4.2CVE-2026-76033EPSS 0.2%

    Inappropriate implementation in CORS in Google Chrome prior to 151.0.7922.169 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)

  11. 5.3CVE-2026-18504EPSS 0.3%

    fastify is a fast and low overhead web framework for Node.js. Versions of fastify before 5.12.1 are affected by a schema validation bypass when a request body schema targets a root primitive value. When the schema validates a top-level pri…

  12. 7.5CVE-2026-47629EPSS 0.7%

    NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause improper input validation. A successful exploit might lead to denial of service.

  13. 6.3CVE-2026-63335EPSS 0.5%

    The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.31.0, inbound AMQP command assembly in src/main/java/com/rabbitmq/client/impl/CommandAssembler.java processe…

  14. 0.0CVE-2026-61634EPSS 0.5%

    The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, the AMQP connection tuning path records the negotiated AMQP frame_max value, but src/main/java/com/rab…

  15. 8.8CVE-2026-66793EPSS 0.8%

    A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes. A user with permissions to annotate the namespaced ManagedClusterAddOn resource can override the governance-policy …

  16. 4.3CVE-2026-65340EPSS 0.6%

    This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 27. Processing maliciously crafted web content may…

  17. 4.3CVE-2026-65337EPSS 0.6%

    This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 27. Processing maliciously crafted web content may…

  18. 4.3CVE-2026-65336EPSS 0.6%

    This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 27. Processing maliciously crafted web content may…

  19. 4.3CVE-2026-64781EPSS 0.5%

    The issue was addressed with improved input validation. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 27. Processing maliciously crafted web content may lea…

  20. 7.2CVE-2026-16139EPSS 0.9%

    In Progress ShareFile Storage Zones Controller versions <= 5.12.5 and <= 6.0.2, an authenticated zone administrator can exploit improper validation in the download preparation flow, enabling attacker-controlled files to be written outside …

  21. 8.3CVE-2026-22072EPSS 0.4%

    Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens.

  22. 9.8CVE-2026-72065EPSS 0.7%

    In the Linux kernel, the following vulnerability has been resolved: net: mana: Validate the packet length reported by the NIC Validate the packet length reported in the RX CQE before passing it to skb processing. The CQE is supplied by t…

  23. 8.2CVE-2026-72021EPSS 0.6%

    In the Linux kernel, the following vulnerability has been resolved: ipvs: use parsed transport offset in SCTP state lookup set_sctp_state() reads the SCTP chunk header again in order to drive the IPVS SCTP state table. For IPv6 it comput…

  24. 9.8CVE-2026-68477EPSS 0.7%

    In the Linux kernel, the following vulnerability has been resolved: ipvs: fix more places with wrong ipv6 transport offsets Sashiko reports for more incorrect IPv6 transport offsets. The app code for TCP was assuming IPv4 network header…

  25. 8.8CVE-2026-68470EPSS 0.4%

    In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate extension-frame layout before RX Extension frames only have the extension header at the regular 802.11 header offset. The generic RX path can st…

  26. 5.3CVE-2026-12128EPSS 0.6%

    The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to Price Manipulation via the `cart_data` parameter in all versions up to, and including, 2.9.9.6.8. This is due to the `dopbsp_woocommerce_add_to_cart` AJAX action…

  27. 5.3CVE-2026-73845EPSS 0.4%

    CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the ckan_get_mqa_quality and ckan_get_mqa_quality_details tools in src/tools/quality.ts use isValidMqaServer to validate the server_url parameter with a prefi…

  28. 5.5CVE-2026-19826EPSS 0.6%

    A vulnerability was detected in alldatacenter alldata up to 0.6.8. This affects the function Hessian2Input.readObject of the file /serialize/impl/HessianSerializer.java of the component xxl-rpc Listener. The manipulation results in deseria…

  29. 8.2CVE-2026-73658EPSS 0.4%

    Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.5, Aws4FetchClient.buildUrl() and Aws4FetchClient.presign() in apps/webapp/app/v3/objectStoreClient.server.ts assign user…

  30. 8.7CVE-2026-59109EPSS 0.4%

    SQL injection in the Zalktis accounting application via trading-partner-controlled text fields in received electronic invoices. When importing a received e-invoice (UBL/PEPPOL) or an e-commerce export, Zalktis concatenates partner-controll…

  31. 8.8CVE-2026-68454EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix handling of AIF enable without AISB When a guest seeks to register IRQs without a summary bit specified, ensure that the associated GAITE then stores…

  32. 9.8CVE-2026-49827EPSS 0.9%

    WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scan_file parameter, leading to Remote Co…

  33. 7.5CVE-2026-73418EPSS 0.9%

    NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken() helper in the next-auth/jwt and @auth/core/jwt modules can throw an uncaught exception when it rea…

  34. 6.3CVE-2026-19503EPSS 0.2%

    MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of the authorization and token endpoints returned by an OIDC issuer's discovery document. A user induced to connect to an uncontrolled MongoDB deployment u…

  35. 8.8CVE-2026-69106EPSS 0.5%

    A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted content.

  36. 4.3CVE-2026-17109EPSS 0.4%

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to add unexpected parameters to a command due to parameter injection.

  37. 7.8CVE-2026-68446EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate vmw_surface_metadata::array_size This field comes from userspace and should be validated against specific limits depending on which Shader Model (SM…

  38. 4.0CVE-2026-20901EPSS 0.10%

    Improper input validation for some Intel(R) Xeon(R) processors within firmware may allow an escalation of privilege. Startup code and smm adversary with a privileged user combined with a high complexity attack may enable data alteration. T…

  39. 4.0CVE-2026-71390EPSS 0.3%

    CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write…

  40. 5.5CVE-2026-70325EPSS 0.4%

    Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.

  41. 5.5CVE-2026-70323EPSS 0.4%

    Improper input validation in Microsoft Office allows an unauthorized attacker to disclose information locally.

  42. 5.5CVE-2026-70322EPSS 0.4%

    Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.

  43. 5.5CVE-2026-70320EPSS 0.4%

    Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.

  44. 5.5CVE-2026-70319EPSS 0.4%

    Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

  45. 5.5CVE-2026-70318EPSS 0.5%

    Improper input validation in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

  46. 5.5CVE-2026-70316EPSS 0.4%

    Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.

  47. 5.5CVE-2026-70314EPSS 0.5%

    Improper input validation in Microsoft Office allows an unauthorized attacker to disclose information locally.

  48. 7.8CVE-2026-70313EPSS 0.5%

    Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.

  49. 5.5CVE-2026-70312EPSS 0.4%

    Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.

  50. 8.8CVE-2026-65811EPSS 1.0%

    Improper input validation in Power BI allows an authorized attacker to execute code over a network.