CWE-20: Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
4,572 tracked CVEs are classified under this weakness.
Highest-risk vulnerabilities
- CVE-2026-34910 — A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS
- CVE-2026-34197 — Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans
- CVE-2025-34300 — Sawtooth Software Lighthouse Studio < 9.16.14 Pre-Authentication RCE
- CVE-2025-54236 — Adobe Commerce | Improper Input Validation (CWE-20)
- CVE-2024-5276 — SQL Injection Vulnerability in FileCatalyst Workflow 5.1.6 Build 135 (and earlier)
- CVE-2025-34111 — Tiki Wiki <= 15.1 ELFinder Unauthenticated File Upload RCE
- CVE-2025-54123 — Hoverfly vulnerable to remote code execution at `/api/v2/hoverfly/middleware` endpoint due to insecure middleware implementation
- CVE-2025-34100 — BuilderEngine 3.5.0 RCE via Unauthenticated Arbitrary File Upload
- CVE-2025-34116 — IPFire < 2.19 Core Update 101 proxy.cgi RCE
- CVE-2025-34101 — Serviio Media Server Unauthenticated Command Injection via checkStreamUrl VIDEO Parameter
- CVE-2025-34118 — Linknat VOS Manager Path Traversal File Disclosure
- CVE-2025-34105 — DiskBoss Enterprise Stack-Based Buffer Overflow RCE
- CVE-2025-34102 — CryptoLog Unauthenticated RCE via SQL Injection and Command Injection
- CVE-2025-34113 — Tiki Wiki CMS Authenticated Command Injection in Calendar Module
- CVE-2024-49368 — Unchecked logrotate settings lead to arbitrary command execution
- CVE-2025-20393 — Cisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution Vulnerability
- CVE-2025-8876 — Command Injection Vulnerability
- CVE-2026-12569 — Remote Code Execution (RCE) vulnerability in Windchill PDMlink
- CVE-2025-34099 — VICIdial vicidial_sales_viewer.php Unauthenticated Command Injection via Basic Auth Password
- CVE-2025-1098 — ingress-nginx controller - configuration injection via unsanitized mirror annotations
Recently published
- CVE-2026-74761 — Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientId
- CVE-2026-73334 — Apache Parquet Hadoop: File-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation
- CVE-2025-7062 — Stored Cross-Site Scripting via file upload in H5P module (h5p-nodejs-library) of Lumi Education
- CVE-2026-12855 — H19WMIHandlerSmm: unvalidated memory boundary could result in arbitrary code execution.
- CVE-2026-87083 — tile-ai tilelang Kernel Cache kernel_cache.py KernelCache._load_kernel_from_disk deserialization
- CVE-2026-87469 — Improper input validation in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web
- CVE-2026-87568 — Improper input validation in Chromium in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromi
- CVE-2026-87510 — Improper input validation in FileAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromis
- CVE-2026-87600 — Improper input validation in Safebrowsing in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacke
- CVE-2026-87472 — Improper input validation in FedCM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised
- CVE-2026-87599 — Improper input validation in Interstitials in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to spoof UI
- CVE-2026-87573 — Improper input validation in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web ori
- CVE-2026-87590 — Improper input validation in Passwords in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially
- CVE-2026-87553 — Improper input validation in SiteIsolation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had com
- CVE-2026-75726 — Adobe Experience Manager | Improper Input Validation (CWE-20)
- CVE-2026-75999 — ColdFusion | Improper Input Validation (CWE-20)
- CVE-2026-75991 — Illustrator | Improper Input Validation (CWE-20)
- CVE-2026-62647 — A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A random number generator is used to genera
- CVE-2022-51017 — PocketMine-MP before 3.26.5 and 4.0.5 Denial of Service via Skin Data
- CVE-2022-51015 — PocketMine-MP before 4.0.6 Denial of Service via PlayerActionPacket
More specific weaknesses
- CWE-1173 — Improper Use of Validation Framework
- CWE-1284 — Improper Validation of Specified Quantity in Input
- CWE-1285 — Improper Validation of Specified Index, Position, or Offset in Input
- CWE-1286 — Improper Validation of Syntactic Correctness of Input
- CWE-1287 — Improper Validation of Specified Type of Input
- CWE-1288 — Improper Validation of Consistency within Input
- CWE-1289 — Improper Validation of Unsafe Equivalence in Input
- CWE-622 — Improper Validation of Function Hook Arguments