CWE-1286 · Input Validation and Logic
Improper Validation of Syntactic Correctness of Input
94CVEs
SortMost likely exploited
94 CVEs with CWE-1286 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2024-51983Unauthenticated Denial of Service (DoS) via malformed WS-Scan request affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, Ricoh, Toshiba Tec, and…Brother Industries, Ltd · HL-L8260CDN · CVSS 7.5 · 2025-06-25 | 7.5 | 12% | 2025-06-25 |
| CVE-2024-51982Unauthenticated Denial of Service (DoS) via malformed PJL request affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, and Ricoh.Brother Industries, Ltd · HL-L8260CDN · CVSS 7.5 · 2025-06-25 | 7.5 | 11% | 2025-06-25 |
| CVE-2023-27043The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value o…Python · Python · CVSS 5.3 · 2023-04-18 | 5.3 | 2.5% | 2023-04-18 |
| CVE-2021-28812Command Injection Vulnerability in Video StationQNAP Systems Inc. · Video Station · CVSS 8.8 · 2021-06-03 | 8.8 | 1.6% | 2021-06-03 |
| CVE-2022-1941Out of Memory issue in ProtocolBuffers for cpp and pythonGoogle LLC · protobuf-cpp · CVSS 7.5 · 2022-09-22 | 7.5 | 1.5% | 2022-09-22 |
| CVE-2024-24786Infinite loop in JSON unmarshaling in google.golang.org/protobufgoogle.golang.org/protobuf · google.golang.org/protobuf/encoding/protojson · CVSS 7.5 · 2024-03-05 | 7.5 | 1.3% | 2024-03-05 |
| CVE-2024-6763Jetty URI parsing of invalid authorityEclipse Foundation · Jetty · CVSS 3.7 · 2024-10-14 | 3.7 | 1.0% | 2024-10-14 |
| CVE-2021-31988A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to add the Carriage Return and Line Feed (CRLF) control characters and…Axis Communications AB · AXIS OS · 2021-10-05 | – | 1.0% | 2021-10-05 |
| CVE-2025-25007Microsoft Exchange Server Spoofing VulnerabilityMicrosoft · Microsoft Exchange Server 2016 Cumulative Update 23 · CVSS 5.3 · 2025-08-12 | 5.3 | 0.9% | 2025-08-12 |
| CVE-2021-31987A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to bypass blocked network recipients.Axis Communications AB · AXIS OS · 2021-10-05 | – | 0.9% | 2021-10-05 |
| CVE-2024-3384PAN-OS: Firewall Denial of Service (DoS) via Malformed NTLM PacketsPalo Alto Networks · PAN-OS · CVSS 7.5 · 2024-04-10 | 7.5 | 0.9% | 2024-04-10 |
| CVE-2026-7307Keycloak: keycloak: denial of service via specially crafted saml inputRed Hat · Red Hat build of Keycloak 26.2 · CVSS 7.5 · 2026-05-19 | 7.5 | 0.9% | 2026-05-19 |
| CVE-2025-22868Unexpected memory consumption during token parsing in golang.org/x/oauth2golang.org/x/oauth2 · golang.org/x/oauth2/jws · CVSS 7.5 · 2025-02-26 | 7.5 | 0.9% | 2025-02-26 |
| CVE-2022-22192Junos OS Evolved: PTX Series: An attacker can cause a kernel panic by sending a malformed TCP packet to the deviceJuniper Networks · Junos OS Evolved · CVSS 7.5 · 2022-10-18 | 7.5 | 0.8% | 2022-10-18 |
| CVE-2026-25679Incorrect parsing of IPv6 host literals in net/urlGo standard library · net/url · CVSS 7.5 · 2026-03-06 | 7.5 | 0.8% | 2026-03-06 |
| CVE-2021-44695Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a denial of service in the device.Siemens · SIMATIC Drive Controller CPU 1504D TF · CVSS 4.9 · 2022-12-13 | 4.9 | 0.8% | 2022-12-13 |
| CVE-2023-32649DoS on IDS parsing of malformed asset fields in Guardian/CMC >= 22.6.0 before 22.6.3 and 23.1.0Nozomi Networks · Guardian · CVSS 7.5 · 2023-09-19 | 7.5 | 0.6% | 2023-09-19 |
| CVE-2024-8160Erik de Jong, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API ftptest.cgi did not have a sufficient input validation allowing for a possible command injecti…Axis Communications AB · AXIS OS · CVSS 3.8 · 2024-11-26 | 3.8 | 0.6% | 2024-11-26 |
| CVE-2023-28985SRX Series and MX Series: An FPC core is observed when IDP is enabled on the device and a specific malformed SSL packet is receivedJuniper Networks · Junos OS · CVSS 7.5 · 2023-07-14 | 7.5 | 0.6% | 2023-07-14 |
| CVE-2026-83611xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing contentxmldom · xmldom · CVSS 6.9 · 2026-09-01 | 6.9 | 0.6% | 2026-09-01 |
| CVE-2026-105660Unvalidated HTTP/1 request-target authority lets a client choose conn.host and conn.port in Banditmtrudel · bandit · CVSS 6.9 · 2026-10-15 | 6.9 | 0.6% | 2026-10-15 |
| CVE-2023-23903DoS via SAML configuration in Guardian/CMC before 22.6.2Nozomi Networks · Guardian · CVSS 4.9 · 2023-08-09 | 4.9 | 0.6% | 2023-08-09 |
| CVE-2025-13033Nodemailer: nodemailer: email to an unintended domain can occur due to interpretation conflictnodemailer · nodemailer · CVSS 7.5 · 2025-11-14 | 7.5 | 0.6% | 2025-11-14 |
| CVE-2023-43850Improper input validation in the user management function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated users to cause a partial DoS of web inter…Aten · Pe6208 Firmware · CVSS 6.5 · 2024-05-28 | 6.5 | 0.6% | 2024-05-28 |
| CVE-2024-21598Junos OS and Junos OS Evolved: A malformed BGP tunnel encapsulation attribute will lead to an rpd crashJuniper Networks · Junos OS · CVSS 7.5 · 2024-04-12 | 7.5 | 0.6% | 2024-04-12 |
| CVE-2025-41719Sauter: Improper Validation of user-controlled dataSauter · modulo 6 devices modu680-AS · CVSS 8.8 · 2025-10-22 | 8.8 | 0.6% | 2025-10-22 |
| CVE-2025-24348A vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to manipulate the wireless net…Bosch Rexroth AG · ctrlX OS - Device Admin · CVSS 5.4 · 2025-04-30 | 5.4 | 0.6% | 2025-04-30 |
| CVE-2024-0218DoS on IDS parsing of malformed Radius packets in Guardian before 23.4.1Nozomi Networks · Guardian · CVSS 7.5 · 2024-04-10 | 7.5 | 0.6% | 2024-04-10 |
| CVE-2025-24812A vulnerability has been identified in SIMATIC S7-1200 CPU 1211C AC/DC/Rly (6ES7211-1BE40-0XB0) (All versions < V4.7), SIMATIC S7-1200 CPU 1211C DC/DC/DC (6ES7211-1AE40-0XB0) (All…Siemens · SIMATIC S7-1200 CPU 1211C AC/DC/Rly · CVSS 6.5 · 2025-02-11 | 6.5 | 0.5% | 2025-02-11 |
| CVE-2023-24015Partial DoS on Reports section due to null report name in Guardian/CMC before 22.6.2Nozomi Networks · Guardian · CVSS 4.3 · 2023-08-09 | 4.3 | 0.5% | 2023-08-09 |
| CVE-2024-21595Junos OS: EX4100, EX4400, EX4600, QFX5000 Series: A high rate of specific ICMP traffic will cause the PFE to hangJuniper Networks · Junos OS · CVSS 7.5 · 2024-01-12 | 7.5 | 0.5% | 2024-01-12 |
| CVE-2025-24347A vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to manipulate the network conf…Bosch Rexroth AG · ctrlX OS - Device Admin · CVSS 6.5 · 2025-04-30 | 6.5 | 0.5% | 2025-04-30 |
| CVE-2024-21616Junos OS: MX Series and SRX Series: Processing of a specific SIP packet causes NAT IP allocation to failJuniper Networks · Junos OS · CVSS 7.5 · 2024-01-12 | 7.5 | 0.5% | 2024-01-12 |
| CVE-2025-24346A vulnerability in the “Proxy” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attacker to manipulate the “/etc/environment” file vi…Bosch Rexroth AG · ctrlX OS - Device Admin · CVSS 7.5 · 2025-04-30 | 7.5 | 0.5% | 2025-04-30 |
| CVE-2026-102084Junos OS: SRX Series: In an ADVPN scenario a malformed message from a peer causes Remote Code ExecutionJuniper Networks · Junos OS · CVSS 8.1 · 2026-10-14 | 8.1 | 0.5% | 2026-10-14 |
| CVE-2025-54995Asterisk remotely exploitable leak of RTP UDP ports and internal resourcesasterisk · asterisk · CVSS 6.5 · 2025-08-28 | 6.5 | 0.5% | 2025-08-28 |
| CVE-2025-0638Routinator crashes when illegal characters are present in manifest file namesNLnet Labs · Routinator · CVSS 7.5 · 2025-01-22 | 7.5 | 0.5% | 2025-01-22 |
| CVE-2024-52362IBM App Connect Enterprise Certified Container denial of serviceIBM · App Connect Enterprise Certified Container · CVSS 4.3 · 2025-03-12 | 4.3 | 0.5% | 2025-03-12 |
| CVE-2024-39542Junos OS and Junos OS Evolved: A malformed CFM packet or specific transit traffic leads to FPC crashJuniper Networks · Junos OS · CVSS 7.5 · 2024-07-11 | 7.5 | 0.5% | 2024-07-11 |
| CVE-2025-47912Insufficient validation of bracketed IPv6 hostnames in net/urlGo standard library · net/url · CVSS 5.3 · 2025-10-29 | 5.3 | 0.5% | 2025-10-29 |
| CVE-2026-57026Junos OS: MX Series with SPC3, SRX Series: Processing of a specifically malformed SIP invite causes a flowd crashJuniper Networks · Junos OS · CVSS 7.5 · 2026-07-09 | 7.5 | 0.5% | 2026-07-09 |
| CVE-2025-10954Versions of the package github.com/nyaruka/phonenumbers before 1.2.2 are vulnerable to Improper Validation of Syntactic Correctness of Input in the phonenumbers.Parse() function.…Textit · github.com/nyaruka/phonenumbers · CVSS 5.3 · 2025-09-27 | 5.3 | 0.5% | 2025-09-27 |
| CVE-2026-110675Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allow_barekey in decode_hvNo vendor recorded · CVSS 8.1 · 2026-10-19 | 8.1 | 0.5% | 2026-10-19 |
| CVE-2024-877251l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API managedoverlayimages.cgi was vulnerable to a race condition attack allowing for an attacker to bloc…Axis Communications AB · AXIS OS · CVSS 4.3 · 2024-11-26 | 4.3 | 0.4% | 2024-11-26 |
| CVE-2025-11573Denial of Service issue in Amazon.IonDotnetAmazon · Amazon.IonDotnet · CVSS 7.5 · 2025-10-09 | 7.5 | 0.4% | 2025-10-09 |
| CVE-2026-0931Denial-of-service vulnerability in M-Files ServerM-Files Corporation · M-Files Server · CVSS 6.9 · 2026-08-05 | 6.9 | 0.4% | 2026-08-05 |
| CVE-2026-21917Junos OS: SRX Series: Specifically malformed SSL packet causes FPC crashJuniper Networks · Junos OS · CVSS 7.5 · 2026-01-15 | 7.5 | 0.4% | 2026-01-15 |
| CVE-2026-110759Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parseNo vendor recorded · CVSS 9.8 · 2026-10-16 | 9.8 | 0.4% | 2026-10-16 |
| CVE-2026-0663Denial of Service condition in M-Files ServerM-Files Corporation · M-Files Server · CVSS 6.9 · 2026-01-21 | 6.9 | 0.4% | 2026-01-21 |
| CVE-2026-6442Improper Command Detection Logic Allows RCE in Cortex Code Command-Line InterfaceSnowflake · Cortex Code CLI · CVSS 8.3 · 2026-04-16 | 8.3 | 0.4% | 2026-04-16 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.