cve.bz

CWE-20: Improper Input Validation, page 34

Filter

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

What the weakness is: CWE-20 at MITRE

Ask an AI about CWE-20

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-20: Improper Input Validation and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/20.html and https://cve.bz/cve/cwe/20?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.6CVE-2026-33471EPSS 0.2%

    nimiq-block contains block primitives to be used in Nimiq's Rust implementation. `SkipBlockProof::verify` computes its quorum check using `BitSet.len()`, then iterates `BitSet` indices and casts each `usize` index to `u16` (`slot as u16`) …

  2. 5.5CVE-2026-35380EPSS 0.2%

    A logic error in the cut utility of uutils coreutils causes the program to incorrectly interpret the literal two-byte string '' (two single quotes) as an empty delimiter. The implementation mistakenly maps this string to the NUL character …

  3. 3.3CVE-2026-35377EPSS 0.1%

    A logic error in the env utility of uutils coreutils causes a failure to correctly parse command-line arguments when utilizing the -S (split-string) option. In GNU env, backslashes within single quotes are treated literally (with the excep…

  4. 5.5CVE-2026-35369EPSS 0.1%

    An argument parsing error in the kill utility of uutils coreutils incorrectly interprets kill -1 as a request to send the default signal (SIGTERM) to PID -1. Sending a signal to PID -1 causes the kernel to terminate all processes visible t…

  5. 4.4CVE-2026-35347EPSS 0.1%

    The comm utility in uutils coreutils incorrectly consumes data from non-regular file inputs before performing comparison operations. The are_files_identical function opens and reads from both input paths to compare content without first ve…

  6. 7.8CVE-2026-31447EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: ext4: reject mount if bigalloc with s_first_data_block != 0 bigalloc with s_first_data_block != 0 is not supported, reject mounting it.

  7. 6.5CVE-2026-31192EPSS 0.3%

    Insufficient validation of Chrome extension identifiers in Raindrop.io Bookmark Manager Web App 5.6.76.0 allows attackers to obtain sensitive user data via a crafted request.

  8. 6.5CVE-2026-22748EPSS 0.2%

    Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder  or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator<Jwt> separately, for example by calling setJwtValidator.This…

  9. 7.2CVE-2026-40871EPSS 8.6%

    mailcow: dockerized is an open source groupware/email suite based on docker. Versions prior to 2026-03b have a second-order SQL injection vulnerability in the quarantine_category field via the Mailcow API. The /api/v1/add/mailbox endpoint …

  10. 5.3CVE-2026-6779EPSS 0.2%

    Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.

  11. 5.3CVE-2026-6777EPSS 0.2%

    Other issue in the Networking: DNS component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.

  12. 8.2CVE-2025-13826EPSS 0.3%

    Zervit's portable HTTP/web server is vulnerable to remote DoS attacks when a configuration reset request is made. The vulnerability is caused by inadequate validation of user-supplied input. An attacker can exploit this vulnerability by se…

  13. 5.3CVE-2026-6675EPSS 0.3%

    The Responsive Blocks – Page Builder for Blocks & Patterns plugin for WordPress is vulnerable to Unauthenticated Open Email Relay in all versions up to, and including, 2.2.0. This is due to insufficient authorization checks and missing ser…

  14. 8.8CVE-2026-39386EPSS 0.4%

    Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC In versions 3.0.0 through 3.0.10 and 3.1.0 through 3.1.1, any authenticated user can immediately obtain full administrative control of the entire Neko instance (me…

  15. 9.9CVE-2026-32604EPSS 0.6%

    Spinnaker is an open source, multi-cloud continuous delivery platform. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, a bad actor can execute arbitrary commands very simply on the clouddriver pods. This can expose credent…

  16. 7.2CVE-2026-24505EPSS 0.4%

    Dell PowerProtect Data Domain, versions 8.5 through 8.6 contain an improper input validation vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution …

  17. 7.2CVE-2026-24504EPSS 0.4%

    Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper input validation vulnerability. A high privileged attack…

  18. 2.1CVE-2026-6626EPSS 0.2%

    A vulnerability was detected in Cockpit-HQ Cockpit up to 2.13.5. Affected by this issue is some unknown functionality of the component Asset Handler/Aggregate Handler. The manipulation results in improper neutralization of special elements…

  19. 9.3CVE-2026-40317EPSS 0.2%

    NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly. In versions prior to 0.24, Syscall 12 (JumpToUser) accepts an arbitrary entry point address from user-space registers without validation, allowing any Ring 3 user…

  20. 6.1CVE-2026-33436EPSS 0.2%

    Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. In versions prior to 2.0.0, file upload endpoints render user-supplied filenames directly into HTML using unsafe methods like innerHTML with…

  21. 7.3CVE-2026-21733EPSS 0.10%

    Software installed and run as a non-privileged user may conduct improper GPU system calls to gain write permission to read-only wrapped user-mode memory and files. This is caused by improper handling of GPU memory reservation protection…

  22. 7.1CVE-2026-6409EPSS 0.4%

    A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—specifically those containing negative varints or deep recursion—can be used to crash the app…

  23. 7.2CVE-2026-22615EPSS 0.3%

    Due to improper input validation in one of the Eaton Intelligent Power Protector (IPP) XML, it is possible for an attacker with admin privileges and access to the local system to inject malicious code resulting in arbitrary command executi…

  24. 8.8CVE-2026-40261EPSS 1.7%

    Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::syncCodeBase() method, which appends the $sourceReference parameter to a shell command w…

  25. 7.8CVE-2026-40176EPSS 1.0%

    Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::generateP4Command() method, which constructs shell commands by interpolating user-suppli…

  26. 5.3CVE-2026-1782EPSS 0.3%

    The MetForm Pro plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 3.9.7 This is due to the payment integrations (Stripe/PayPal) trusting a user-submitted calculation field value without …

  27. 8.3CVE-2026-6328EPSS 0.2%

    Improper input validation, Improper verification of cryptographic signature vulnerability in XQUIC Project XQUIC xquic on Linux (QUIC protocol implementation, packet processing module, STREAM frame handler modules) allows Protocol Manipula…

  28. 9.6CVE-2026-39399EPSS 0.5%

    NuGet Gallery is a package repository that powers nuget.org. A security vulnerability exists in the NuGetGallery backend job’s handling of .nuspec files within NuGet packages. An attacker can supply a crafted nuspec file with malicious met…

  29. 8.8CVE-2026-35031EPSS 0.8%

    Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a vulnerability chain in the subtitle upload endpoint (POST /Videos/{itemId}/Subtitles), where the Format field is not validated, allowing path traversa…

  30. 6.3CVE-2026-27299EPSS 0.2%

    Adobe Framemaker versions 2022.8 and earlier are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read. An attacker could leverage this vulnerability to access sensitive files or data on the s…

  31. 8.4CVE-2026-27306EPSS 0.3%

    ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Attacker requires elevated privileges. Exploitatio…

  32. 9.3CVE-2026-27304EPSS 3.6%

    ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user i…

  33. 7.5CVE-2026-27282EPSS 0.7%

    ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain u…

  34. 8.8CVE-2026-24893EPSS 1.4%

    openITCOCKPIT is an open source monitoring tool built for different monitoring engines. openITCOCKPIT Community Edition prior to version 5.5.2 contains a command injection vulnerability that allows an authenticated user with permission to …

  35. 8.0CVE-2026-33826EPSS 0.5%

    Improper input validation in Windows Active Directory allows an authorized attacker to execute code over an adjacent network.

  36. 7.5CVE-2026-33116EPSS 2.1%

    Loop with unreachable exit condition ('infinite loop') in .NET, .NET Framework, Visual Studio allows an unauthorized attacker to deny service over a network.

  37. 7.5CVE-2026-32203EPSS 1.9%

    Stack-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to deny service over a network.

  38. 6.5CVE-2026-32201KEVEPSS 43%

    Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

  39. 7.8CVE-2026-32168EPSS 0.3%

    Improper input validation in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.

  40. 7.3CVE-2026-32149EPSS 0.3%

    Improper input validation in Windows Hyper-V allows an authorized attacker to execute code locally.

  41. 8.7CVE-2026-27928EPSS 0.4%

    Improper input validation in Windows Hello allows an unauthorized attacker to bypass a security feature over a network.

  42. 7.7CVE-2026-27913EPSS 0.3%

    Improper input validation in Windows BitLocker allows an unauthorized attacker to bypass a security feature locally.

  43. 4.4CVE-2026-27906EPSS 0.4%

    Improper input validation in Windows Hello allows an authorized attacker to bypass a security feature locally.

  44. 7.8CVE-2026-26170EPSS 0.2%

    Improper input validation in Microsoft PowerShell allows an authorized attacker to elevate privileges locally.

  45. 7.8CVE-2026-26161EPSS 0.3%

    Untrusted pointer dereference in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally.

  46. 7.8CVE-2026-26156EPSS 0.4%

    Heap-based buffer overflow in Windows Hyper-V allows an unauthorized attacker to execute code locally.

  47. 7.5CVE-2026-26154EPSS 1.1%

    Improper input validation in Windows Server Update Service allows an unauthorized attacker to perform tampering over a network.

  48. 7.8CVE-2026-26143EPSS 0.5%

    Improper input validation in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature locally.

  49. 5.5CVE-2026-39417EPSS 0.2%

    MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain an incomplete fix for CVE-2025-53928, where a Remote Code Execution vulnerability still exists in the MCP node of the workflow engine. MaxKB only restric…

  50. 2.9CVE-2026-33948EPSS 0.3%

    jq is a command-line JSON processor. Commits before 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b contain a vulnerability where CLI input parsing allows validation bypass via embedded NUL bytes. When reading JSON from files or stdin, jq uses st…