CWE-1287 · Input Validation and Logic
Improper Validation of Specified Type of Input
162CVEs
1exploited
0with a public check
1likely (EPSS 10%+)
SortMost likely exploited
162 CVEs with CWE-1287 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2024-4879In CISA KEVExploitedServiceNow UI Macros - Template InjectionServiceNow · Now Platform · CVSS 9.8 · 2024-07-10 | 9.8 | 100% | 2024-07-10 |
| CVE-2024-6298remote code executionABB · ASPECT-Enterprise · CVSS 10 · 2024-07-05 | 10.0 | 19% | 2024-07-05 |
| CVE-2024-51550Data Validation / SanitizationABB · ASPECT-Enterprise · CVSS 10 · 2024-12-05 | 10.0 | 1.8% | 2024-12-05 |
| CVE-2021-32024A remote code execution vulnerability in the BMP image codec of BlackBerry QNX SDP version(s) 6.4 to 7.1 could allow an attacker to potentially execute code in the context of the…BlackBerry · QNX Software Development Platform (SDP) · CVSS 9.8 · 2021-12-13 | 9.8 | 1.8% | 2021-12-13 |
| CVE-2025-59259Windows Local Session Manager (LSM) Denial of Service VulnerabilityMicrosoft · Windows 10 Version 1507 · CVSS 6.5 · 2025-10-14 | 6.5 | 1.5% | 2025-10-14 |
| CVE-2025-59257Windows Local Session Manager (LSM) Denial of Service VulnerabilityMicrosoft · Windows 11 Version 24H2 · CVSS 6.5 · 2025-10-14 | 6.5 | 1.5% | 2025-10-14 |
| CVE-2024-51546Credentails DisclosureABB · ASPECT-Enterprise · CVSS 7.5 · 2024-12-05 | 7.5 | 1.5% | 2024-12-05 |
| CVE-2022-20783Cisco TelePresence Collaboration Endpoint and RoomOS Software H.323 Denial of Service VulnerabilityCisco · Cisco RoomOS Software · CVSS 7.5 · 2022-04-21 | 7.5 | 1.4% | 2022-04-21 |
| CVE-2026-2004PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary codePostgresql · PostgreSQL · CVSS 8.8 · 2026-02-12 | 8.8 | 1.3% | 2026-02-12 |
| CVE-2026-26115SQL Server Elevation of Privilege VulnerabilityMicrosoft · Microsoft SQL Server 2016 Service Pack 3 (GDR) · CVSS 8.8 · 2026-03-10 | 8.8 | 1.3% | 2026-03-10 |
| CVE-2026-50524.NET Framework Denial of Service VulnerabilityMicrosoft · .NET 10.0 runtime · CVSS 7.5 · 2026-07-14 | 7.5 | 1.2% | 2026-07-14 |
| CVE-2023-4522Improper Validation of Specified Type of Input in GitLabGitLab · GitLab · CVSS 4.3 · 2023-08-30 | 4.3 | 1.2% | 2023-08-30 |
| CVE-2025-58729Windows Local Session Manager (LSM) Denial of Service VulnerabilityMicrosoft · Windows 10 Version 1507 · CVSS 6.5 · 2025-10-14 | 6.5 | 1.1% | 2025-10-14 |
| CVE-2022-43723A vulnerability has been identified in SICAM PAS/PQS (All versions < V7.0), SICAM PAS/PQS (All versions >= 7.0 < V8.06). Affected software does not properly validate the input for…Siemens · SICAM PAS/PQS · CVSS 7.5 · 2022-12-13 | 7.5 | 1.0% | 2022-12-13 |
| CVE-2021-20329Specific cstrings input may not be properly validated in the Go DriverMongoDB Inc. · MongoDB Go Driver · CVSS 6.8 · 2021-06-10 | 6.8 | 0.9% | 2021-06-10 |
| CVE-2023-3917Improper Validation of Specified Type of Input in GitLabGitLab · GitLab · CVSS 4.3 · 2023-09-29 | 4.3 | 0.9% | 2023-09-29 |
| CVE-2023-3900Improper Validation of Specified Type of Input in GitLabGitLab · GitLab · CVSS 4.3 · 2023-08-02 | 4.3 | 0.9% | 2023-08-02 |
| CVE-2026-24307M365 Copilot Information Disclosure VulnerabilityMicrosoft · Microsoft 365 Copilot · CVSS 9.3 · 2026-01-22 | 9.3 | 0.9% | 2026-01-22 |
| CVE-2026-96044Microsoft Office SharePoint Elevation of Privilege VulnerabilityMicrosoft · Microsoft SharePoint Server Subscription Edition · CVSS 8.8 · 2026-10-13 | 8.8 | 0.8% | 2026-10-13 |
| CVE-2024-31948In FRRouting (FRR) through 9.1, an attacker using a malformed Prefix SID attribute in a BGP UPDATE packet can cause the bgpd daemon to crash.Frrouting · Frrouting · CVSS 6.5 · 2024-04-07 | 6.5 | 0.8% | 2024-04-07 |
| CVE-2024-5594OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected arbitrary data ending up in client logs.OpenVPN · OpenVPN · CVSS 9.1 · 2025-01-06 | 9.1 | 0.8% | 2025-01-06 |
| CVE-2025-46342Kyverno vulnerable to bypass of policy rules that use namespace selectors in match statementskyverno · kyverno · CVSS 8.6 · 2025-04-30 | 8.6 | 0.8% | 2025-04-30 |
| CVE-2023-3904Improper Validation of Specified Type of Input in GitLabGitLab · GitLab · CVSS 4.3 · 2023-12-15 | 4.3 | 0.8% | 2023-12-15 |
| CVE-2024-9404Denial-of-Service VulnerabilityMoxa · VPort 07-3 Series · CVSS 5.3 · 2024-12-04 | 5.3 | 0.7% | 2024-12-04 |
| CVE-2022-22228Junos OS: IPv6 OAM SRv6 network-enabled devices are vulnerable to Denial of Service (DoS) due to RPD memory leak upon receipt of specific a IPv6 packetJuniper Networks · Junos OS · CVSS 7.5 · 2022-10-18 | 7.5 | 0.7% | 2022-10-18 |
| CVE-2025-32442Fastify vulnerable to invalid content-type parsing, which could lead to validation bypassfastify · fastify · CVSS 7.5 · 2025-04-18 | 7.5 | 0.7% | 2025-04-18 |
| CVE-2026-97801.NET Framework Tampering VulnerabilityMicrosoft · Microsoft .NET Framework 3.5 · CVSS 7.5 · 2026-10-13 | 7.5 | 0.7% | 2026-10-13 |
| CVE-2024-43426Moodle: arbitrary file read risk through pdftexMoodle · Moodle · CVSS 7.5 · 2024-11-07 | 7.5 | 0.7% | 2024-11-07 |
| CVE-2024-8403Denial-of-Service Vulnerability in Ethernet port on MELSEC iQ-F Ethernet Module and EtherNet/IP ModuleMitsubishi Electric Corporation · MELSEC iQ-F Series FX5-ENET · CVSS 7.5 · 2024-11-19 | 7.5 | 0.7% | 2024-11-19 |
| CVE-2026-63282Improper shell quote escaping when processing user-controlled input, potentially allowing command injection, which could lead to privilege escalation.Axis Communications AB · AXIS OS · CVSS 6.5 · 2026-11-10 | 6.5 | 0.7% | 2026-11-10 |
| CVE-2021-44694Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a denial of service in the device.Siemens · SIMATIC Drive Controller CPU 1504D TF · CVSS 5.5 · 2022-12-13 | 5.5 | 0.7% | 2022-12-13 |
| CVE-2026-123710Quay: red hat quay: unauthenticated registry signing-key takeover via service key rotationProject Quay · quay · CVSS 9.8 · 2026-11-11 | 9.8 | 0.7% | 2026-11-11 |
| CVE-2025-20630Mobile crash via object that can't be cast to String in Attachment FieldMattermost · Mattermost · CVSS 6.5 · 2025-01-16 | 6.5 | 0.6% | 2025-01-16 |
| CVE-2026-123776RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting "tz" to tzset(), , so a FIFO or device path blocks the CGI processRRD-CGI-Image · CVSS 9.8 · 2026-11-07 | 9.8 | 0.6% | 2026-11-07 |
| CVE-2024-54083DoS via lack of type validation in CallsMattermost · Mattermost · CVSS 6.5 · 2024-12-16 | 6.5 | 0.6% | 2024-12-16 |
| CVE-2024-56908In Perfex Crm < 3.2.1, an authenticated attacker can send a crafted HTTP POST request to the affected upload_sales_file endpoint. By providing malicious input in the rel_id parame…No vendor recorded · CVSS 6.8 · 2025-02-13 | 6.8 | 0.6% | 2025-02-13 |
| CVE-2023-2673PHOENIX CONTACT: FL/TC MGUARD prone to Improper Input ValidationPHOENIX CONTACT · FL MGUARD 2102 · CVSS 5.3 · 2023-06-13 | 5.3 | 0.6% | 2023-06-13 |
| CVE-2024-47504Junos OS: SRX5000 Series: Receipt of a specific malformed packet will cause a flowd crashJuniper Networks · Junos OS · CVSS 7.5 · 2024-10-11 | 7.5 | 0.6% | 2024-10-11 |
| CVE-2025-20033DoS via custom post type for sysconsole plugin readersMattermost · Mattermost · CVSS 4.3 · 2025-01-09 | 4.3 | 0.6% | 2025-01-09 |
| CVE-2026-86287Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengthsNo vendor recorded · CVSS 7.5 · 2026-09-07 | 7.5 | 0.6% | 2026-09-07 |
| CVE-2024-48858Vulnerabilities in TIFF and PCX Image Codecs Impact QNX Software Development PlatformBlackBerry · QNX Software Development Platform (SDP) · CVSS 7.5 · 2025-01-14 | 7.5 | 0.6% | 2025-01-14 |
| CVE-2026-55124Microsoft Word Information Disclosure VulnerabilityMicrosoft · Microsoft 365 Apps for Enterprise · CVSS 5.5 · 2026-07-14 | 5.5 | 0.6% | 2026-07-14 |
| CVE-2025-20088Insufficient Input Validation on Post PropsMattermost · Mattermost · CVSS 6.5 · 2025-01-15 | 6.5 | 0.6% | 2025-01-15 |
| CVE-2025-8556Github.com/cloudflare/circl: circl-fourq: missing and wrong validation can lead to incorrect resultsRedhat · circl · CVSS 3.7 · 2025-08-06 | 3.7 | 0.6% | 2025-08-06 |
| CVE-2023-3906Improper Validation of Specified Type of Input in GitLabGitLab · GitLab · CVSS 3.5 · 2023-09-29 | 3.5 | 0.6% | 2023-09-29 |
| CVE-2025-20244Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access VPN Web Server Denial of Service VulnerabilityCisco · Cisco Adaptive Security Appliance (ASA) Software · CVSS 7.7 · 2025-08-14 | 7.7 | 0.6% | 2025-08-14 |
| CVE-2025-21083Insufficient Input Validation on Post PropsMattermost · Mattermost · CVSS 6.5 · 2025-01-15 | 6.5 | 0.5% | 2025-01-15 |
| CVE-2025-20036Insufficient Input Validation on Post PropsMattermost · Mattermost · CVSS 6.5 · 2025-01-15 | 6.5 | 0.5% | 2025-01-15 |
| CVE-2025-24335SOAP message input validation fault could in theory cause OAM service resource exhaustionNokia · Nokia Single RAN · CVSS 2 · 2025-07-02 | 2.0 | 0.5% | 2025-07-02 |
| CVE-2024-49420Improper handling of responses in GamingHub prior to version 6.1.04.6 in Korea, 7.1.03.7 in Global allows remote attackers to launch arbitrary activity.Samsung Mobile · GamingHub · CVSS 7.5 · 2024-12-03 | 7.5 | 0.5% | 2024-12-03 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.