CWE-1289 · weakness in Input Validation and Logic
Improper Validation of Unsafe Equivalence in Input
36 CVEs
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
Every one of the 36 is a mark on the map. Named now: 1 to 26, most at risk first.
- An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01. Due to insufficient input validation, the C-MOR web interface is vulnerable to OS command inje…
- Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
- Puppet Firewall Module May Leave Unmanaged Rules
- Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS
- Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check
- AngularJS improper sanitization in 'srcset' attribute
- MySQL & free URL mode allows to hide existing notes in hedgedoc
- symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload decodes to ASCII-only: insecure equivalence
- mpp Tempo keys its pre-broadcast dedup reserve on the caller-supplied transaction encoding, so a re-encoded signed transaction reserves a second slot
- WordPress GiveWP plugin <= 4.16.9 - Broken Authentication vulnerability
- Ory Oathkeeper has an authentication bypass by cache key confusion
- Improper input validation in the apps and endpoints configuration in PowerShell Universal before 2026.1.4 allows an authenticated user with permissions to create or modify Apps or…
- Parse Dashboard Has a Cache Key Collision that Leaks Master Key to Read-Only Sessions
- Clickjacking vulnerability in SAPUI5(Frame Options Allowlist)
- In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset
- Mercure has a Topic Selector Cache Key Collision
- Security Advisory 0212
- 1Password 8 before 8.10.36 for macOS allows local attackers to exfiltrate vault items because XPC inter-process communication validation is insufficient.
- Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass
- Net::CIDR::Set versions through 0.20 for Perl did not validate network masks
- Net::CIDR::Lite versions before 0.24 for Perl does not properly consider extraneous zero characters in CIDR mask values, which may allow IP ACL bypass
- In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalatio…
- Trusted Domain Project OpenDMARC policy.c improper validation of unsafe equivalence in input
- Aqara OAuth redirect_uri validation bypass
- The Playground feature of Zilliz Attu before 3.0.0 allows SSRF (proxying of requests to private IP addresses).
- idna accepts Punycode labels that do not produce any non-ASCII when decoded
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.