cve.bz

CWE-20: Improper Input Validation, page 25

Filter

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

What the weakness is: CWE-20 at MITRE

Ask an AI about CWE-20

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-20: Improper Input Validation and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/20.html and https://cve.bz/cve/cwe/20?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 4.9CVE-2026-13434EPSS 0.2%

    A flaw was found in KubeVirt's network annotation generator. When a tenant creates a VirtualMachineInstance with a Multus network configuration, the supplied networkName value is written verbatim into the launcher pod's v1.multus-cni.io/de…

  2. 5.3CVE-2026-42390EPSS 0.3%

    An invalid zone might pass ZONEMD validation while it should not. This is only relevant if ZoneToCache is configured with ZONEMD validation.

  3. 5.3CVE-2026-42389EPSS 0.3%

    This fix provides extra hardening for the 5.4.x branch by doing extra validation of incoming answers from authoritative servers.

  4. 5.9CVE-2026-42388EPSS 0.5%

    Incomplete validation of the SOA record present in a catalog zone might lead to a crash.

  5. 5.9CVE-2026-42387EPSS 0.5%

    A malicious authoritative server can send a crafted zone via the ZoneToCache function that leads to a crash of the Recursor due to insuffcient input validation.

  6. 9.8CVE-2026-53221EPSS 0.6%

    In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard t…

  7. 7.2CVE-2026-12246EPSS 0.4%

    NSD version 4.14.0 introduced a bug where a specially crafted APL RR, with an adflength larger than permitted for the address family will overwrite the stack when the zone is written to disk, with a maximum of 111 attacker controlled bytes.

  8. 8.1CVE-2026-52801EPSS 0.6%

    Gogs is an open source self-hosted Git service. Prior to 0.14.3, the Gogs Mirror Settings functionality provide an alternative way from the well protected New Migration functionality for any authenticated users to import local repositories…

  9. 4.9CVE-2025-64719EPSS 0.4%

    Gogs is an open source self-hosted Git service. Prior to 0.14.3, a malicious user with rights to create a new file on a repository or wiki page can trigger a denial of service condition in which the pages containing the listing of files wi…

  10. 8.3CVE-2026-13025EPSS 0.3%

    Race in DevTools in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

  11. 4.2CVE-2026-13024EPSS 0.2%

    Insufficient validation of untrusted input in Navigation in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security sever…

  12. 8.8CVE-2026-48720EPSS 0.4%

    Warp is an agentic development environment. From 0.2025.03.05.08.02.stable_00 until 0.2026.05.06.15.42.stable_01, Warp accepts non-inline `OSC 1337;File` payloads from terminal output and materialize the decoded payload as a local file wit…

  13. 8.8CVE-2026-48704EPSS 0.4%

    Warp is an agentic development environment. From 0.2023.10.24.08.03.stable_00 until 0.2026.05.06.15.42.stable_01, Warp may open executable local files through the operating system default file handler. A malicious Markdown document or proj…

  14. 7.8CVE-2026-53031EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: bpf: Validate node_id in arena_alloc_pages() arena_alloc_pages() accepts a plain int node_id and forwards it through the entire allocation chain without any bounds check…

  15. 7.5CVE-2026-53003EPSS 0.7%

    In the Linux kernel, the following vulnerability has been resolved: pppoe: drop PFC frames RFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT RECOMMENDED for PPPoE. In practice, pppd does not support negotiating PFC f…

  16. 7.5CVE-2026-52954EPSS 0.5%

    In the Linux kernel, the following vulnerability has been resolved: libceph: handle rbtree insertion error in decode_choose_args() A message of type CEPH_MSG_OSD_MAP contains an OSD map that itself contains a CRUSH map. The received CRUS…

  17. 10.0CVE-2026-12537EPSS 0.2%

    Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI (versions prior to 0.39.1) and run-gemini-cli GitHub Action (versions prior to 0.1.22) on headless CI platforms allows an unprivileged attacker to…

  18. 7.8CVE-2026-52923EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: ipc: limit next_id allocation to the valid ID range The checkpoint/restore sysctl path can request the next SysV IPC id through ids->next_id. ipc_idr_alloc() currently …

  19. 7.0CVE-2026-13006EPSS 0.2%

    ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.36 in Java applications, allows an attacker to execute arbitrary code circumventing existing protections against CVE-202…

  20. 9.6CVE-2026-54588EPSS 0.5%

    Poweradmin is a web-based DNS administration tool for PowerDNS server. Versions prior to 4.2.4 and 4.3.3 use the attacker-controlled `HTTP_HOST` request header as the authoritative source for building callback URLs in its OIDC, SAML, and l…

  21. 8.1CVE-2026-45135EPSS 0.7%

    Caddy is an extensible server platform that uses TLS by default. From 2.7.0 until 2.11.3, the FastCGI transport's splitPos() in modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go misuses golang.org/x/text/search with search.IgnoreCase when …

  22. 7.1CVE-2026-49444EPSS 0.4%

    n8n is an open source workflow automation platform. Prior to 1.123.48, 2.21.8, and 2.22.4, an authenticated user with permission to create or modify workflows containing a Python Code Node could escape the sandbox and achieve arbitrary cod…

  23. 6.9CVE-2026-56762EPSS 0.4%

    Hono before 4.12.12 does not validate cookie names on the write path in the setCookie(), serialize(), and serializeSigned() functions, allowing invalid characters such as control characters (e.g. \r or \n) when an application passes a user…

  24. 6.5CVE-2026-10651EPSS 0.3%

    bt_sdp_parse_attribute() in subsys/bluetooth/host/classic/sdp.c validated only that the SDP record buffer held the type-marker byte plus the 2-byte attribute ID (a check of buf->len < 3) but then read a fourth byte, the data-element descri…

  25. 5.3CVE-2026-56306EPSS 0.3%

    Capgo before 12.128.2 contains a weak parsing vulnerability in the x-limited-key-id header that allows attackers to bypass subkey enforcement by submitting malformed values, zero, or duplicate headers that result in NaN or falsy values. Re…

  26. 6.5CVE-2026-54911EPSS 0.4%

    UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps() (or ujson.dump() or ujson.encode()) have a reject_bytes=False option. When set, they may accept malformed or trunc…

  27. 8.2CVE-2026-48109EPSS 0.5%

    MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, A vulnerability exists in the optional LZ4 decompression path used by MessagePack compression modes Lz4Block and Lz4BlockArray. The decoder implementation i…

  28. 7.5CVE-2026-54299EPSS 0.3%

    Astro is a web framework. Prior to 6.4.6, Astro SSR apps with prerendered error pages (/404 or /500 using export const prerender = true) fetch those pages over HTTP at runtime when an error occurs. The URL for this fetch is derived from re…

  29. 6.9CVE-2026-55602EPSS 0.4%

    http-proxy-middleware is node.js http-proxy middleware. From 0.16.0 until 2.0.10, 3.0.6, and 4.1.0, http-proxy-middleware documents router proxy-table entries as host, path, or host+path selectors, but the host+path implementation uses una…

  30. 5.3CVE-2026-53537EPSS 0.3%

    Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, parse_options_header parsed Content-Disposition (and Content-Type) headers with email.message.Message, which transparently applies RFC 2231/5987 decoding. The ex…

  31. 9.4CVE-2026-7165EPSS 0.5%

    The vulnerability is present in the ‘/addJugador’ endpoint: * The 'keyJugador' and 'keyJugadorObjectiu' parameters allow the modification of other users’ information without requiring prior authorization validation. This could enable a…

  32. 2.1CVE-2026-12787EPSS 0.4%

    A vulnerability was found in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0. This affects an unknown part of the component testConnection Endpoint. The manipulation of the argument jdbcUrl results in deserialization…

  33. 8.7CVE-2026-56340EPSS 0.6%

    vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal embeddings processing. Because PyTorch disables sparse tensor invariant checks by default, an attacker can submit crafted embedding requests with malfo…

  34. 2.3CVE-2026-56325EPSS 0.3%

    Capgo before 12.128.2 uses ILIKE pattern matching instead of exact matching for app_id lookup in the preview subdomain resolver, allowing underscore characters in app_id to act as SQL wildcards. Attackers can create apps with app_ids diffe…

  35. 6.9CVE-2026-56228EPSS 0.5%

    Capgo before 12.128.2 fails to enforce a maximum value on the minimum password length field in its password policy configuration. An authenticated organization administrator can set an extremely large numeric value (e.g., billions of chara…

  36. 7.5CVE-2026-48774EPSS 0.4%

    ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. In versions 3.0.0 through 3.0.8, ProxySQL's GenAI/MCP `run_sql_readonly` tool violates its documented read-only contract for MySQL targets. The tool validates only the ful…

  37. 6.3CVE-2026-21768EPSS 0.2%

    The compose-rich-editor library (v1.0.0-rc14) used in HCL Verse for Android's rich text email composition fails to properly validate all HTML input thereby allowing malicious content to be executed in certain situations.

  38. 5.8CVE-2026-39998EPSS 0.7%

    Improper Input Validation vulnerability in Apache APISIX. The attacker can take advantage of certain configuration in forward-auth plugin to spoof identity headers. This issue affects Apache APISIX: from 2.12.0 through 3.16.0. Users are …

  39. 8.2CVE-2025-58175EPSS 0.3%

    GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a GeoServer that uses `ENTITY_RESOLUTION_ALLOWLIST` may allow attacker to perform unauthenticated Server-Side Requ…

  40. 9.3CVE-2026-12569KEVEPSS 46%

    A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.  * This advisory also applies to all CPS v…

  41. 7.5CVE-2026-50196EPSS 0.4%

    Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Discovery.Eureka prior to versions 4.2.0 and 3.4.0, `DataCenterInfo.FromJson` throws `ArgumentExceptio…

  42. 10.0CVE-2026-48055EPSS 0.7%

    Streambert is a cross-platform Electron Desktop App to stream and download any video media. In versions 2.4.0 and prior, a high-severity Zip Slip vulnerability was identified in Streambert's subtitle extraction logic. The application does …

  43. 8.3CVE-2026-12465EPSS 0.2%

    Object lifecycle issue in Metrics in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Hig…

  44. 4.2CVE-2026-12456EPSS 0.1%

    Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.155 allowed an attacker who convinced a user to install a malicious extension to bypass same origin policy via a crafted Chrome Extension. (Chromium security s…

  45. 4.2CVE-2026-12453EPSS 0.2%

    Insufficient validation of untrusted input in Input in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severi…

  46. 7.8CVE-2025-48643EPSS 0.08%

    In multiple locations there is a possible provisioning bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitatio…

  47. 9.1CVE-2026-46910EPSS 0.4%

    Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows unauthent…

  48. 4.0CVE-2026-0142EPSS 0.07%

    In iavb_parse_key_data of avb_rsa.c, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed fo…

  49. 7.1CVE-2026-12191EPSS 0.1%

    A vulnerability was found in Comma AI Openpilot 0.11. This issue affects the function pickle.load/pickle.loads of the file selfdrive/modeld/modeld.py of the component Pickle Module. The manipulation results in deserialization. The attack i…

  50. 8.1CVE-2026-45013EPSS 0.3%

    ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 have a password reset flow that constructs the reset URL using `req.hostname`, which is derived directly from the attacker-controlled HT…