CWE-1288 · Input Validation and Logic
Improper Validation of Consistency within Input
43CVEs
SortMost likely exploited
43 CVEs with CWE-1288 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2022-39353xmldom allows multiple root nodes in a DOMxmldom · xmldom · CVSS 9.4 · 2022-11-02 | 9.4 | 1.6% | 2022-11-02 |
| CVE-2021-41531Invalid RPKI data could disable Route Origin Validation on RTR clients.NLnet Labs · Routinator · 2021-09-21 | – | 0.9% | 2021-09-21 |
| CVE-2023-1620WAGO: DoS in multiple products in multiple versions using CodesysWago · 750-8202/xxx-xxx · CVSS 4.9 · 2023-06-26 | 4.9 | 0.9% | 2023-06-26 |
| CVE-2024-25951A command injection vulnerability exists in local RACADM. A malicious authenticated user could gain control of the underlying operating system.Dell · Integrated Dell Remote Access Controller 8 · CVSS 8 · 2024-03-09 | 8.0 | 0.8% | 2024-03-09 |
| CVE-2026-69793Windows TCP/IP Security Feature Bypass VulnerabilityMicrosoft · Windows 10 Version 1607 · CVSS 7.5 · 2026-09-08 | 7.5 | 0.8% | 2026-09-08 |
| CVE-2023-1619WAGO: DoS in multiple versions of multiple productsWago · 750-8202/xxx-xxx · CVSS 4.9 · 2023-06-26 | 4.9 | 0.8% | 2023-06-26 |
| CVE-2024-34593Improper input validation in parsing and distributing RTCP packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to execute arbitrary code with system privil…Samsung Mobile · Samsung Mobile Devices · CVSS 7.5 · 2024-07-02 | 7.5 | 0.6% | 2024-07-02 |
| CVE-2024-8305MongoDB Server secondaries may crash due to forced index constraintsMongoDB Inc · MongoDB Server · CVSS 6.5 · 2024-10-21 | 6.5 | 0.6% | 2024-10-21 |
| CVE-2024-5953389-ds-base: malformed userpassword hash may cause denial of serviceRedhat · 389-ds-base · CVSS 5.7 · 2024-06-18 | 5.7 | 0.6% | 2024-06-18 |
| CVE-2024-31136In JetBrains TeamCity before 2024.03 2FA could be bypassed by providing a special URL parameterJetBrains · TeamCity · CVSS 7.4 · 2024-03-28 | 7.4 | 0.5% | 2024-03-28 |
| CVE-2024-12093Improper Validation of Consistency within Input in GitLabGitLab · GitLab · CVSS 6.8 · 2025-05-22 | 6.8 | 0.5% | 2025-05-22 |
| CVE-2024-34619Improper input validation in librtp.so prior to SMR Aug-2024 Release 1 allows remote attackers to execute arbitrary code with system privilege. User interaction is required for tr…Samsung Mobile · Samsung Mobile Devices · CVSS 7.5 · 2024-08-07 | 7.5 | 0.5% | 2024-08-07 |
| CVE-2024-34587Improper input validation in parsing application information from RTCP packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to execute arbitrary code with s…Samsung Mobile · Samsung Mobile Devices · CVSS 7.5 · 2024-07-02 | 7.5 | 0.5% | 2024-07-02 |
| CVE-2026-73219CVAT: Denial of service with regards to automatic annotationcvat-ai · cvat · CVSS 5.3 · 2026-08-11 | 5.3 | 0.5% | 2026-08-11 |
| CVE-2026-94200TLS 1.3 client ticket store crashed by NewSessionTicket with empty early_data extension in sslErlang · OTP · CVSS 8.2 · 2026-10-14 | 8.2 | 0.5% | 2026-10-14 |
| CVE-2024-39515Junos OS and Junos OS Evolved: With BGP traceoptions enabled, receipt of specifically malformed BGP update causes RPD crashJuniper Networks · Junos OS · CVSS 7.5 · 2024-10-09 | 7.5 | 0.5% | 2024-10-09 |
| CVE-2026-101951Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash if a malformed MCAST-TREE NLRI is received and readvertisedJuniper Networks · Junos OS · CVSS 7.5 · 2026-10-14 | 7.5 | 0.4% | 2026-10-14 |
| CVE-2024-31140In JetBrains TeamCity before 2024.03 server administrators could remove arbitrary files from the server by installing toolsJetBrains · TeamCity · CVSS 4.1 · 2024-03-28 | 4.1 | 0.4% | 2024-03-28 |
| CVE-2026-18794OpenRGB: insufficient input data checks lead to Denial-of-Service, memory overread and overwriteCalcProgrammer1 · OpenRGB · CVSS 8.2 · 2026-08-26 | 8.2 | 0.4% | 2026-08-26 |
| CVE-2026-15943Keycloak-services: keycloak-services: oidc idp update reuses masked client secret after token url changeRed Hat · Red Hat build of Keycloak 26.6 · CVSS 5.5 · 2026-07-17 | 5.5 | 0.4% | 2026-07-17 |
| CVE-2026-18209Keycloak-services: keycloak-services: oidc redirect_uri fragment bypass in http parameter pollution checkRed Hat · Red Hat build of Keycloak 26.6 · CVSS 3.4 · 2026-07-31 | 3.4 | 0.4% | 2026-07-31 |
| CVE-2024-34592Improper input validation in parsing RTCP SDES packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to trigger temporary denial of service. User interaction…Samsung Mobile · Samsung Mobile Devices · CVSS 5.3 · 2024-07-02 | 5.3 | 0.4% | 2024-07-02 |
| CVE-2024-34591Improper input validation in parsing an item data from RTCP SDES packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to trigger temporary denial of service…Samsung Mobile · Samsung Mobile Devices · CVSS 5.3 · 2024-07-02 | 5.3 | 0.4% | 2024-07-02 |
| CVE-2024-34590Improper input validation혻in parsing an item type from RTCP SDES packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to trigger temporary denial of service…Samsung Mobile · Samsung Mobile Devices · CVSS 5.3 · 2024-07-02 | 5.3 | 0.4% | 2024-07-02 |
| CVE-2024-34589Improper input validation in parsing RTCP RR packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to trigger temporary denial of service. User interaction i…Samsung Mobile · Samsung Mobile Devices · CVSS 5.3 · 2024-07-02 | 5.3 | 0.4% | 2024-07-02 |
| CVE-2024-34588Improper input validation혻in parsing RTCP SR packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to trigger temporary denial of service. User interaction i…Samsung Mobile · Samsung Mobile Devices · CVSS 5.3 · 2024-07-02 | 5.3 | 0.4% | 2024-07-02 |
| CVE-2026-56744`@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction (can redirect payments when u…bsv-blockchain · @bsv/wallet-toolbox · CVSS 8.7 · 2026-09-24 | 8.7 | 0.4% | 2026-09-24 |
| CVE-2026-31709smb: client: validate the whole DACL before rewriting it in cifsaclLinux · Linux · CVSS 8.8 · 2026-05-01 | 8.8 | 0.3% | 2026-05-01 |
| CVE-2025-46722vLLM has a Weakness in MultiModalHasher Image Hashing Implementationvllm-project · vllm · CVSS 4.2 · 2025-05-29 | 4.2 | 0.3% | 2025-05-29 |
| CVE-2026-42982Windows Secure Kernel Mode Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 1607 · CVSS 7.8 · 2026-07-14 | 7.8 | 0.3% | 2026-07-14 |
| CVE-2025-2885Root metadata version not validated in toughAWS · tough · CVSS 5.7 · 2025-03-27 | 5.7 | 0.3% | 2025-03-27 |
| CVE-2026-9689Keycloak: org.keycloak.protocol.oidc: http parameter pollution in oidc redirect uri allows response parameter duplication - #ghi-604Red Hat · Red Hat build of Keycloak 26.4 · CVSS 4.2 · 2026-05-27 | 4.2 | 0.3% | 2026-05-27 |
| CVE-2025-10929Reverse Proxy Header - Less critical - Access bypass - SA-CONTRIB-2025-111Drupal · Reverse Proxy Header · CVSS 5.3 · 2025-10-29 | 5.3 | 0.3% | 2025-10-29 |
| CVE-2026-14781Keycloak-services: keycloak-services: oidc email_verified claim incorrectly applied to userinfo emailRed Hat · Red Hat Build of Keycloak · CVSS 4.8 · 2026-07-05 | 4.8 | 0.3% | 2026-07-05 |
| CVE-2026-102047Junos OS and Junos OS Evolved: An attacker causes l2cpd denial of service when MVRP is usedJuniper Networks · Junos OS · CVSS 6.5 · 2026-10-14 | 6.5 | 0.3% | 2026-10-14 |
| CVE-2023-32701Vulnerability in Networking Stack Impacts QNX Software Development Platform (SDP)BlackBerry · QNX Software Development Platform (SDP) · CVSS 7.1 · 2023-11-14 | 7.1 | 0.2% | 2023-11-14 |
| CVE-2024-27375An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_nan_followup_get_nl_params(), there is…Samsung · Exynos 980 Firmware · CVSS 6.7 · 2024-06-05 | 6.7 | 0.2% | 2024-06-05 |
| CVE-2024-27371An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_nan_followup_get_nl_params(), there is…Samsung · Exynos 980 Firmware · CVSS 6.7 · 2024-06-05 | 6.7 | 0.2% | 2024-06-05 |
| CVE-2026-18238OOBR in rpcap client in libpcap before 1.10.7The Tcpdump Group · libpcap · CVSS 5 · 2026-09-05 | 5.0 | 0.2% | 2026-09-05 |
| CVE-2022-50976Innomic VibroLine Configurator and avibia Configurator allow unintended device reset via USBInnomic · VibroLine Configurator 5.0 · CVSS 7.7 · 2026-02-02 | 7.7 | 0.2% | 2026-02-02 |
| CVE-2025-54507Improper validation of consistency within input in AMD SEV (Secure Encrypted Virtualization) firmware could allow an attacker with administrative privileges to create multiple RMP…AMD · AMD EPYC™ 9005 Series Processors · CVSS 5.9 · 2026-11-12 | 5.9 | 0.2% | 2026-11-12 |
| CVE-2026-31488drm/amd/display: Do not skip unrelated mode changes in DSC validationLinux · Linux · CVSS 7.8 · 2026-04-22 | 7.8 | 0.1% | 2026-04-22 |
| CVE-2026-46117RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()Linux · Linux · CVSS 7.8 · 2026-05-28 | 7.8 | 0.1% | 2026-05-28 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.