cve.bz

CWE-20: Improper Input Validation, page 4

Filter

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

What the weakness is: CWE-20 at MITRE

Ask an AI about CWE-20

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-20: Improper Input Validation and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/20.html and https://cve.bz/cve/cwe/20?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.8CVE-2026-108427EPSS 0.6%

    Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

  2. 8.3CVE-2026-77470EPSS 0.5%

    Lychee is a free, open-source photo-management tool. Prior to 7.7.1, the Supporter or Pro webshop POST /api/v2/Shop/Checkout/Process flow accepts an unrestricted additional_data array and CheckoutService::preparePurchaseParameters() merges…

  3. 8.3CVE-2026-77466EPSS 0.4%

    Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee hides the Omnipay Dummy test provider from the checkout options in production through OmnipayFactory::get_supported_providers(), but CreateSessionRequest validates…

  4. 5.3CVE-2026-100347EPSS 0.5%

    kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3filter.ValidationHandler uses the routers/legacy router, which passes an unsupported or non-canonical HTTP method for an existing static path to openapi3.Pat…

  5. 9.3CVE-2026-99999EPSS 0.8%

    In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network heade…

  6. 7.3CVE-2026-79837EPSS 0.10%

    A vulnerability in HPE NonStop SQL/MX UDR SERVER may allow a crafted message to cause process termination, service disruption or memory corruption, resulting in undefined behavior.

  7. 6.4CVE-2026-79836EPSS 0.2%

    A vulnerability HPE NonStop SQL/MX Run-Time Statistics may allow an attacker to cause memory corruption and null pointer dereference, potentially leading to process crash,  DoS or information disclosure.

  8. 2.8CVE-2026-79835EPSS 0.09%

    A crafted input message can cause a buffer overflow in HPE Nonstop KMS Server.

  9. 7.4CVE-2026-79834EPSS 0.6%

    A security vulnerability in HPE NonStop SQL/MX SQLCAT may allow an unauthenticated user to perform unauthorized command execution.

  10. 8.2CVE-2026-79829EPSS 0.3%

    A security vulnerability in HPE NonStop HTTP WEBSERVER can cause memory corruption which may result in a system halt.

  11. 8.2CVE-2026-79821EPSS 0.2%

    A security vulnerability in HPE NonStop SOAP 4.0 may cause memory corruption resulting in a system down.

  12. 7.6CVE-2026-76661EPSS 0.2%

    A vulnerability in HPE NonStop QIOMON allows an out-of-bounds write that can corrupt buffer data.

  13. 8.7CVE-2026-76660EPSS 0.1%

    A vulnerability in HPE NonStop CIPSAM allows an out-of-bounds write that can corrupt buffer data.

  14. 6.9CVE-2026-110870EPSS 0.3%

    Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a…

  15. 7.5CVE-2026-73261EPSS 0.4%

    Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TCP/IP stack enabled by MG_ENABLE_TCPIP in src/net_builtin.c does not reject a TCP option whose declared opts[1] length exceeds the remaining option bytes.…

  16. 7.7CVE-2026-53999EPSS 0.3%

    Radius is a cloud-native, portable application platform that makes app development easier for teams building cloud-native apps. Prior to 0.58.0, the Kubernetes controller deserializes the user-controlled radapp.io/status annotation on a De…

  17. 7.1CVE-2026-101992EPSS 0.3%

    An Improper Input Validation vulnerability in the routing protocol daemon (rpd) process of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP peer to cause an rpd crash via a BGP VPLS signaling update.

  18. 7.1CVE-2026-101969EPSS 0.3%

    An Improper Input Validation vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via a malformed PIM Hello message received on an IPv6-…

  19. 8.7CVE-2026-101943EPSS 0.5%

    An Improper Input Validation vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a denial of service via a crafted BGP EVPN update m…

  20. 5.3CVE-2026-67416EPSS 0.6%

    RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.24, 4.1.15, 4.2.10, and 4.3.4, the optimized AMQP 1.0 server_mode parser in deps/amqp10_common/src/amqp10_binary_parser.erl matches the textual prefixes of symbolic data, s…

  21. 8.2CVE-2026-73790EPSS 0.3%

    A vulnerability in HPE NonStop iTP WebServer can cause memory corruption and system shutdown.

  22. 8.1CVE-2026-110455EPSS 1.2%

    A malicious actor with access to the network and under certain conditions could exploit an Improper Input Validation vulnerability found in UniFi Protect AI Key to execute a Command Injection on the device.

  23. 5.3CVE-2026-48378EPSS 0.3%

    CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write…

  24. 5.3CVE-2026-48377EPSS 0.4%

    CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write…

  25. 7.5CVE-2026-104345EPSS 0.5%

    CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access.…

  26. 5.3CVE-2026-102501EPSS 0.4%

    CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write…

  27. 7.5CVE-2026-100135EPSS 0.6%

    CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access.…

  28. 5.9CVE-2026-100125EPSS 0.6%

    CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access.…

  29. 7.5CVE-2026-100124EPSS 0.6%

    CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access.…

  30. 7.5CVE-2026-100120EPSS 0.5%

    CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access.…

  31. 7.5CVE-2026-100119EPSS 0.5%

    CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access.…

  32. 7.5CVE-2026-100117EPSS 0.6%

    CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access.…

  33. 7.5CVE-2026-100113EPSS 0.6%

    CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access.…

  34. 6.7CVE-2026-88089EPSS 0.3%

    Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally.

  35. 5.3CVE-2026-85473EPSS 0.3%

    The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim (exp, nbf, iat) containing an out-of-range value. The condition occurs during token parsing, prior to signature verification. Repeated requests o…

  36. 6.0CVE-2026-78628EPSS 0.1%

    The Okta Credential Provider for Windows does not validate a serialized credential buffer before interpreting it as a Kerberos logon structure. The buffer size and packed string offsets are not checked. Processing a malformed buffer can ca…

  37. 8.4CVE-2026-75995EPSS 0.2%

    ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary c…

  38. 9.0CVE-2026-106619EPSS 0.6%

    ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploit depends …

  39. 8.8CVE-2026-106613EPSS 0.8%

    ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Ex…

  40. 7.5CVE-2026-105900EPSS 0.7%

    ColdFusion is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Ex…

  41. 9.1CVE-2026-106626EPSS 0.7%

    Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execu…

  42. 9.9CVE-2026-105895EPSS 0.7%

    Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account o…

  43. 9.8CVE-2026-97805EPSS 1.1%

    Out-of-bounds read in Windows Partition Management Driver allows an unauthorized attacker to execute code over a network.

  44. 8.8CVE-2026-97769EPSS 0.9%

    Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

  45. 8.7CVE-2026-95631EPSS 0.9%

    Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitra…

  46. 4.3CVE-2026-95630EPSS 0.5%

    Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read acc…

  47. 9.1CVE-2026-92464EPSS 0.9%

    Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitra…

  48. 7.5CVE-2026-85797EPSS 0.9%

    Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information over a network.

  49. 8.8CVE-2026-83891EPSS 0.9%

    Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

  50. 5.5CVE-2026-83798EPSS 0.2%

    Improper verification of cryptographic signature in Windows Update Stack allows an authorized attacker to perform spoofing locally.