cve.bz

CWE-20: Improper Input Validation, page 21

Filter

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

What the weakness is: CWE-20 at MITRE

Ask an AI about CWE-20

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-20: Improper Input Validation and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/20.html and https://cve.bz/cve/cwe/20?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.5CVE-2026-48351EPSS 0.9%

    CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service …

  2. 9.3CVE-2026-48334EPSS 1.0%

    Illustrator is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Ex…

  3. 6.8CVE-2026-48312EPSS 0.3%

    CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access.…

  4. 6.2CVE-2026-48302EPSS 0.3%

    CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service …

  5. 7.7CVE-2026-48328EPSS 0.8%

    ColdFusion is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access.…

  6. 5.9CVE-2026-48308EPSS 0.2%

    Premiere Pro is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploit de…

  7. 9.6CVE-2026-48284EPSS 0.5%

    ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. The vulnerable component is restricted to an administrative network zone by default. Exp…

  8. 6.2CVE-2026-47470EPSS 0.2%

    NVIDIA TensorRT-LLM for any platform contains a vulnerability in the gRPC server chat API endpoint, where an attacker could cause CWE-20 by local attack. A successful exploit of this vulnerability might lead to denial of service.

  9. 6.5CVE-2026-15778EPSS 0.3%

    Insufficient validation of untrusted input in Navigation in Google Chrome prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page. (Chromium secur…

  10. 5.3CVE-2026-15771EPSS 0.3%

    Insufficient validation of untrusted input in Media in Google Chrome on Windows prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via …

  11. 8.3CVE-2026-15769EPSS 0.3%

    Insufficient validation of untrusted input in Linux Toolkit Theming in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted …

  12. 9.8CVE-2026-13001ExploitEPSS 3.8%

    The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'podlove_handle_cache_files' function in all versions up to, and including, 4.5.1. This makes it possible…

  13. 4.3CVE-2026-62659EPSS 0.2%

    A security flaw was discovered in the NETGEAR WAX333 Access Point that could allow someone already logged in and connected to the local network to make unauthorized changes to the device's settings

  14. 4.7CVE-2026-62658EPSS 0.3%

    A security flaw was discovered in certain NETGEAR Nighthawk RAX series routers that could allow someone already logged in to the device to run unauthorized commands or code on the router.

  15. 5.4CVE-2026-62656EPSS 0.3%

    A security flaw was found in certain NETGEAR RAX models that could allow a logged-in user to send specially crafted requests to the router and run unauthorized commands. This could enable the user to make unauthorized changes to the router…

  16. 5.5CVE-2026-55124EPSS 0.6%

    Improper validation of specified type of input in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

  17. 7.8CVE-2026-50670EPSS 0.3%

    Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally.

  18. 7.8CVE-2026-50417EPSS 0.3%

    Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.

  19. 8.8CVE-2026-50370EPSS 0.5%

    Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over an adjacent network.

  20. 7.5CVE-2026-50328EPSS 1.2%

    Uncaught exception in Windows Server Update Service allows an unauthorized attacker to perform tampering over a network.

  21. 6.3CVE-2026-15757EPSS 0.3%

    A security flaw was discovered in the NETGEAR DGND3700v1 that could allow someone on the same local WiFi network to send unauthorized commands to the device. This issue was identified through testing in a controlled research environment…

  22. 7.8CVE-2026-55899EPSS 0.5%

    Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  23. 5.3CVE-2026-6790EPSS 0.3%

    In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present). This was not enforced in earlier HTTP RFC (for example…

  24. 6.5CVE-2026-13699EPSS 0.4%

    In Eclipse KUKSA Databroker version 0.6.1, the kuksa.val.v2.VAL/PublishValue gRPC handler fails to validate the existence of the optional data_point field in PublishValueRequest. When a request contains a valid signal_id but omits data_poi…

  25. 9.3CVE-2026-22102EPSS 0.5%

    A POST request sent to a specific webserver endpoint can be used to write to arbitrary file locations. The endpoint accepts the filename parameter in the Content-Disposition header without verification. This can be used to cause a denial o…

  26. 2.1CVE-2026-15535EPSS 0.4%

    A vulnerability was determined in AkariAsai self-rag up to 1fcdc420e48f50a7d7ab1ece5494221b93252e99. Affected by this issue is the function Indexer.deserialize_from of the file retrieval_lm/src/index.py of the component retrieval_lm. Execu…

  27. 1.9CVE-2026-15531EPSS 0.3%

    A vulnerability has been found in yashbhalgat HashNeRF-pytorch up to 82885e698295982504eb6a26d060a6b2473e3706. Affected by this issue is the function torch.load of the file run_nerf.py of the component Checkpoint File Handler. The manipula…

  28. 5.3CVE-2026-15529EPSS 0.4%

    A vulnerability was detected in yzhao062 pyod up to 3.6.1. Affected is the function pyod.utils.persistence.load of the file pyod/utils/persistence.py. Performing a manipulation of the argument path results in deserialization. The attack ca…

  29. 7.2CVE-2026-3576ExploitEPSS 8.8%

    The Planyo Online Reservation System plugin for WordPress is vulnerable to Server-Side Request Forgery leading to Local File Inclusion in all versions up to, and including, 3.0. The ulap.php file acts as an AJAX proxy and is directly acces…

  30. 5.9CVE-2026-11914EPSS 0.3%

    vulnerability in Drupal Composer allows . This issue affects Composer versions: *.*.

  31. 7.5CVE-2026-40454EPSS 0.5%

    Out-of-bounds Read, Improper Input Validation vulnerability in Apache IoTDB C++ client. Out-of-bounds reads in IoTDB C++ client TsBlock deserializer crash client process on malformed server data. This issue affects Apache IoTDB C++ clien…

  32. 7.5CVE-2026-15288EPSS 0.5%

    The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 2.2.1. This is due to the plugin accepting the payment amount directly from user…

  33. 2.7CVE-2026-0282EPSS 0.3%

    A file deletion vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web interface to delete files from a temporary directory. The security risk posed by this issue…

  34. 7.5CVE-2026-51606EPSS 0.4%

    An improper input handling vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) causes the device to abruptly terminate the TCP connection with a RST packet when a request containing an oversized field value is receive…

  35. 9.8CVE-2026-51599EPSS 0.5%

    An insufficient input validation vulnerability in the RTSP service of MERCURY MIPC252W v1.0.5 Build 230306 Rel.79931n allows an unauthenticated remote attacker to render an individual TCP connection temporarily unusable via sending an RTSP…

  36. 6.5CVE-2026-51598EPSS 0.3%

    An input validation vulnerability in the RTSP service of MERCURY MIPC252W IP Camera v1.0.5 Build 230306 Rel.79931n) allows an unauthenticated, network-adjacent attacker to cause a denial of service via a crafted DESCRIBE request with a mal…

  37. 9.4CVE-2025-58146EPSS 0.2%

    There are multiple issues. 1. Updates to the XAPI database sanitise input strings, but try generating the notification using the unsanitised input. This causes the database's event thread to terminate and cease further proce…

  38. 4.3CVE-2026-15131EPSS 0.3%

    Inappropriate implementation in Navigation in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

  39. 4.3CVE-2026-15124EPSS 0.3%

    Insufficient policy enforcement in Passwords in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)

  40. 8.3CVE-2026-15122EPSS 0.3%

    Insufficient validation of untrusted input in Codecs in Google Chrome on Windows prior to 150.0.7871.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (C…

  41. 3.3CVE-2026-15115EPSS 0.1%

    Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.115 allowed a local attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)

  42. 8.8CVE-2026-10037EPSS 0.2%

    A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu. The .jar MIME handlers installed by these packages execute files marked as executable when the mailcap package is installed. A compromised or malicious sandb…

  43. 7.5CVE-2026-59724EPSS 0.6%

    Socket.IO enables bidirectional and low-latency communication for every platform. From 6.5.0 before 6.6.7, Engine.IO servers with WebTransport enabled can resolve a crafted session ID such as __proto__ through an inherited property of the …

  44. 9.1CVE-2026-41042ExploitEPSS 1.5%

    Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameter. Vulnerability in Apache Gravitino. This issue affects Apache Gravitino: b…

  45. 7.5CVE-2026-54234EPSS 0.6%

    vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.0, a frontend-legal multi-request speculative decoding workload can cause the rejection sampler to produce a recovered token equal to the m…

  46. 10.0CVE-2026-48316EPSS 1.1%

    ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user i…

  47. 7.3CVE-2026-49042EPSS 0.7%

    Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: from 4.8.0 through 4.18.2, from 4.19.0 through 4.20.0. Users are recommended to upgrade to version 4.18.3, 4.21.0, which fixes the issue.

  48. 7.3CVE-2026-46588EPSS 0.7%

    Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: through 4.14.7, from 4.15.0 through 4.18.2, from 4.19.0 through 4.20.0. Users are recommended to upgrade to version 4.14.8, 4.18.3, 4.21.0, which f…

  49. 7.3CVE-2026-46587EPSS 0.7%

    Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: through 4.14.7, from 4.15.0 through 4.18.2, from 4.19.0 through 4.20.0. Users are recommended to upgrade to version 4.14.8, 4.18.3, 4.21.0, which f…

  50. 9.8CVE-2026-56140EPSS 0.7%

    Improper Input Validation vulnerability in Apache Camel AWS SNS component. The camel-aws2-sns component filters Camel headers through a component-specific HeaderFilterStrategy, Sns2HeaderFilterStrategy. Like the sibling Sqs2HeaderFilterS…