CWE-115 · Input Validation and Logic
Misinterpretation of Input
33CVEs
SortMost likely exploited
33 CVEs with CWE-115 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2020-27846A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML Authentication. The highest threat from this vulnerability is to confide…Saml Project · crewjam/saml · 2020-12-21 | – | 4.9% | 2020-12-21 |
| CVE-2018-12116Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option o…The Node.js Project · Node.js · 2018-11-28 | – | 4.6% | 2018-11-28 |
| CVE-2018-12123Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser for javascript protocol: If a Node.js application is using url.parse() t…The Node.js Project · Node.js · 2018-11-28 | – | 4.0% | 2018-11-28 |
| CVE-2018-7159The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such as `Content-Length: 1 2` to be interpreted as having a value…The Node.js Project · Node.js · 2018-05-17 | – | 3.5% | 2018-05-17 |
| CVE-2020-29509The encoding/xml package in Go (all versions) does not correctly preserve the semantics of attribute namespace prefixes during tokenization round-trips, which allows an attacker t…Golang · Go · CVSS 9.8 · 2020-12-14 | 9.8 | 2.1% | 2020-12-14 |
| CVE-2020-29510The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of directives during tokenization round-trips, which allows an attacker to craft…Golang · Go · CVSS 9.8 · 2020-12-14 | 9.8 | 2.1% | 2020-12-14 |
| CVE-2020-29511The encoding/xml package in Go (all versions) does not correctly preserve the semantics of element namespace prefixes during tokenization round-trips, which allows an attacker to…Golang · Go · CVSS 9.8 · 2020-12-14 | 9.8 | 2.0% | 2020-12-14 |
| CVE-2024-2004Usage of disabled protocolcurl · curl · CVSS 3.5 · 2024-03-27 | 3.5 | 1.7% | 2024-03-27 |
| CVE-2021-1587Cisco NX-OS Software VXLAN OAM (NGOAM) Denial of Service VulnerabilityCisco · Cisco NX-OS Software · CVSS 8.6 · 2021-08-25 | 8.6 | 1.7% | 2021-08-25 |
| CVE-2021-21366Misinterpretation of malicious XML inputxmldom · xmldom · CVSS 4.3 · 2021-03-12 | 4.3 | 1.3% | 2021-03-12 |
| CVE-2021-0207NFX250, NFX350, QFX5K Series, EX2300 Series, EX3400 Series, EX4300 Multigigabit, EX4600 Series: Certain genuine traffic received by the Junos OS device will be discarded instead o…Juniper Networks · Junos OS · CVSS 7.5 · 2021-01-15 | 7.5 | 1.3% | 2021-01-15 |
| CVE-2024-11169Unhandled Exception Leading to Server Crash in danny-avila/librechatdanny-avila · danny-avila/librechat · CVSS 7.5 · 2025-03-20 | 7.5 | 0.9% | 2025-03-20 |
| CVE-2022-3224Misinterpretation of Input in ionicabizau/parse-urlionicabizau · ionicabizau/parse-url · CVSS 9.4 · 2022-09-15 | 9.4 | 0.8% | 2022-09-15 |
| CVE-2025-25069Apache Kvrocks: Cross-Protocol Scripting VulnerabilityApache Software Foundation · Apache Kvrocks · CVSS 6.5 · 2025-02-07 | 6.5 | 0.8% | 2025-02-07 |
| CVE-2022-1233URL Confusion When Scheme Not Supplied in medialize/uri.jsmedialize · medialize/uri.js · CVSS 6.5 · 2022-04-04 | 6.5 | 0.8% | 2022-04-04 |
| CVE-2022-21672/etc/pki/tls and /etc/ssl/certs include distrusted certificates in make-calfs-book · make-ca · CVSS 6.5 · 2022-01-10 | 6.5 | 0.7% | 2022-01-10 |
| CVE-2025-32908Libsoup: denial of service on libsoup through http/2 serverRedhat · libsoup · CVSS 7.5 · 2025-04-14 | 7.5 | 0.6% | 2025-04-14 |
| CVE-2023-0880Misinterpretation of Input in thorsten/phpmyfaqthorsten · thorsten/phpmyfaq · CVSS 8.3 · 2023-02-17 | 8.3 | 0.6% | 2023-02-17 |
| CVE-2025-54584GitProxy is vulnerable to a packfile parsing exploitfinos · git-proxy · CVSS 7 · 2025-07-30 | 7.0 | 0.6% | 2025-07-30 |
| CVE-2025-47906Unexpected paths returned from LookPath in os/execGo standard library · os/exec · CVSS 6.5 · 2025-09-18 | 6.5 | 0.5% | 2025-09-18 |
| CVE-2025-68113ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replayaltcha-org · altcha-lib · CVSS 6.5 · 2025-12-16 | 6.5 | 0.5% | 2025-12-16 |
| CVE-2025-22870HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/netGo standard library · net/http · CVSS 4.4 · 2025-03-12 | 4.4 | 0.4% | 2025-03-12 |
| CVE-2023-32260A potential Misinterpretation of Input vulnerability has been identified in SMAX, AMX, and HCMX products.OpenText™ · Service Management Automation X (SMAX) · CVSS 6.5 · 2024-03-19 | 6.5 | 0.4% | 2024-03-19 |
| CVE-2025-5747WOLFBOX Level 2 EV Charger MCU Command Parsing Misinterpretation of Input Remote Code Execution VulnerabilityWOLFBOX · Level 2 EV Charger · CVSS 8 · 2025-06-06 | 8.0 | 0.4% | 2025-06-06 |
| CVE-2026-73798HPE NonStop DNS 9.2.3 Non Secure VersionHewlett Packard Enterprise · HPE NonStop DNS 9.2.3 Non Secure Version · CVSS 8.2 · 2026-10-14 | 8.2 | 0.3% | 2026-10-14 |
| CVE-2026-122299Dulwich before 1.2.20 Commit Parser Tree Header Misinterpretationjelmer · dulwich · CVSS 8.8 · 2026-11-04 | 8.8 | 0.3% | 2026-11-04 |
| CVE-2022-20915Cisco IOS XE Software IPv6 VPN over MPLS Denial of Service VulnerabilityCisco · Cisco IOS XE Software · CVSS 7.4 · 2022-10-10 | 7.4 | 0.3% | 2022-10-10 |
| CVE-2025-5826Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Misinterpretation of Input VulnerabilityAutel · Autel MaxiCharger AC Wallbox Commercial · CVSS 6.3 · 2025-06-25 | 6.3 | 0.3% | 2025-06-25 |
| CVE-2026-126619Misinterpretation of Input in hMailServerProgressive Robot Ltd · hMailServer · CVSS 4.8 · 2026-11-11 | 4.8 | 0.3% | 2026-11-11 |
| CVE-2026-12491Vllm: vllm: image exif rotation & png trns transparency not normalized, causing mismatch between model input and expectationsvllm-project · vLLM · CVSS 4.8 · 2026-06-17 | 4.8 | 0.2% | 2026-06-17 |
| CVE-2023-32228A firmware bug which may lead to misinterpretation of data in the AMC2-4WCF and AMC2-2WCF allowing an adversary to grant access to the last authorized user.Bosch · AMS · CVSS 4.6 · 2024-04-11 | 4.6 | 0.2% | 2024-04-11 |
| CVE-2026-42004EDNS options smugglingPowerDNS · DNSdist · CVSS 3.7 · 2026-06-25 | 3.7 | 0.2% | 2026-06-25 |
| CVE-2026-101170DoS vulnerability in the file parsing module. Impact: Successful exploitation of this vulnerability may affect availability.Huawei · HarmonyOS · CVSS 4 · 2026-11-02 | 4.0 | 0.1% | 2026-11-02 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.