CWE-1289 · Input Validation and Logic
Improper Validation of Unsafe Equivalence in Input
36CVEs
SortMost likely exploited
36 CVEs with CWE-1289 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2024-45179An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01. Due to insufficient input validation, the C-MOR web interface is vulnerable to OS command inje…C-Mor · C-Mor Video Surveillance · CVSS 7.2 · 2024-10-09 | 7.2 | 2.6% | 2024-10-09 |
| CVE-2026-39821Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idnaGo standard library · net/http · CVSS 9.6 · 2026-05-22 | 9.6 | 1.8% | 2026-05-22 |
| CVE-2022-0675Puppet Firewall Module May Leave Unmanaged RulesPuppet · Firewall Module · CVSS 5.6 · 2022-03-02 | 5.6 | 0.9% | 2022-03-02 |
| CVE-2026-86831Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKSAWS · aws-network-policy-agent · CVSS 8.7 · 2026-09-16 | 8.7 | 0.6% | 2026-09-16 |
| CVE-2026-60074Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in checkNo vendor recorded · CVSS 7.5 · 2026-07-30 | 7.5 | 0.6% | 2026-07-30 |
| CVE-2024-8372AngularJS improper sanitization in 'srcset' attributeGoogle · AngularJS · CVSS 4.8 · 2024-09-09 | 4.8 | 0.6% | 2024-09-09 |
| CVE-2024-45308MySQL & free URL mode allows to hide existing notes in hedgedochedgedoc · hedgedoc · CVSS 6.5 · 2024-09-02 | 6.5 | 0.6% | 2024-09-02 |
| CVE-2026-46644symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload decodes to ASCII-only: insecure equivalencesymfony · polyfill · CVSS 6.9 · 2026-07-14 | 6.9 | 0.5% | 2026-07-14 |
| CVE-2026-88255mpp Tempo keys its pre-broadcast dedup reserve on the caller-supplied transaction encoding, so a re-encoded signed transaction reserves a second slotZenHive · mpp · CVSS 6.3 · 2026-09-16 | 6.3 | 0.5% | 2026-09-16 |
| CVE-2026-97196WordPress GiveWP plugin <= 4.16.9 - Broken Authentication vulnerabilityLiquid Web / StellarWP · GiveWP · CVSS 9.1 · 2026-09-30 | 9.1 | 0.4% | 2026-09-30 |
| CVE-2026-33496Ory Oathkeeper has an authentication bypass by cache key confusionory · oathkeeper · CVSS 8.1 · 2026-03-26 | 8.1 | 0.4% | 2026-03-26 |
| CVE-2026-3563Improper input validation in the apps and endpoints configuration in PowerShell Universal before 2026.1.4 allows an authenticated user with permissions to create or modify Apps or…Devolutions · PowerShell Universal · CVSS 5.5 · 2026-03-17 | 5.5 | 0.4% | 2026-03-17 |
| CVE-2026-27610Parse Dashboard Has a Cache Key Collision that Leaks Master Key to Read-Only Sessionsparse-community · parse-dashboard · CVSS 7 · 2026-02-25 | 7.0 | 0.4% | 2026-02-25 |
| CVE-2026-76977Clickjacking vulnerability in SAPUI5(Frame Options Allowlist)SAP_SE · SAPUI5(Frame Options Allowlist) · CVSS 4.3 · 2026-09-08 | 4.3 | 0.4% | 2026-09-08 |
| CVE-2026-100255In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password resetJetBrains · TeamCity · CVSS 8.1 · 2026-09-30 | 8.1 | 0.4% | 2026-09-30 |
| CVE-2026-39972Mercure has a Topic Selector Cache Key Collisiondunglas · mercure · CVSS 7.1 · 2026-04-09 | 7.1 | 0.3% | 2026-04-09 |
| CVE-2026-120979Security Advisory 0212Arista Networks · EOS · CVSS 8.1 · 2026-11-10 | 8.1 | 0.3% | 2026-11-10 |
| CVE-2024-422191Password 8 before 8.10.36 for macOS allows local attackers to exfiltrate vault items because XPC inter-process communication validation is insufficient.1password · 1password · CVSS 7 · 2024-08-06 | 7.0 | 0.3% | 2024-08-06 |
| CVE-2026-45190Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypassSTIGTSP · Net::CIDR::Lite · CVSS 6.5 · 2026-05-10 | 6.5 | 0.3% | 2026-05-10 |
| CVE-2026-49942Net::CIDR::Set versions through 0.20 for Perl did not validate network masksRRWO · Net::CIDR::Set · CVSS 7.3 · 2026-06-04 | 7.3 | 0.3% | 2026-06-04 |
| CVE-2026-45191Net::CIDR::Lite versions before 0.24 for Perl does not properly consider extraneous zero characters in CIDR mask values, which may allow IP ACL bypassSTIGTSP · Net::CIDR::Lite · CVSS 6.5 · 2026-05-10 | 6.5 | 0.3% | 2026-05-10 |
| CVE-2026-102478In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalatio…Octopus Deploy · Octopus Server · CVSS 8.7 · 2026-10-07 | 8.7 | 0.3% | 2026-10-07 |
| CVE-2026-101015Trusted Domain Project OpenDMARC policy.c improper validation of unsafe equivalence in inputTrusted Domain Project · OpenDMARC · CVSS 7.3 · 2026-09-28 | 7.3 | 0.3% | 2026-09-28 |
| CVE-2026-50090Aqara OAuth redirect_uri validation bypassAqara · Cloud OAuth Authorization Endpoint · CVSS 9.3 · 2026-06-12 | 9.3 | 0.2% | 2026-06-12 |
| CVE-2026-105048The Playground feature of Zilliz Attu before 3.0.0 allows SSRF (proxying of requests to private IP addresses).Zilliz · Attu · CVSS 4 · 2026-10-02 | 4.0 | 0.2% | 2026-10-02 |
| CVE-2024-12224idna accepts Punycode labels that do not produce any non-ASCII when decodedservo · rust-url · CVSS 5.1 · 2025-05-30 | 5.1 | 0.2% | 2025-05-30 |
| CVE-2026-19953URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprepNo vendor recorded · CVSS 6.5 · 2026-08-31 | 6.5 | 0.2% | 2026-08-31 |
| CVE-2026-116870In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently. This could result in a token issued from a suitably configured non legitimate is…Octopus Deploy · Octopus Server · CVSS 8.7 · 2026-10-27 | 8.7 | 0.2% | 2026-10-27 |
| CVE-2026-100837Edgeless Systems Contrast through 1.20.0 Credential Leak via Registry Suffix Matchingedgelesssys · contrast · CVSS 3.7 · 2026-09-27 | 3.7 | 0.2% | 2026-09-27 |
| CVE-2024-422181Password 8 before 8.10.38 for macOS allows local attackers to exfiltrate vault items by bypassing macOS-specific security mechanisms.1password · 1password · CVSS 6.3 · 2024-08-06 | 6.3 | 0.2% | 2024-08-06 |
| CVE-2026-1094Improper Validation of Unsafe Equivalence in Input in GitLabGitLab · GitLab · CVSS 4.6 · 2026-02-11 | 4.6 | 0.2% | 2026-02-11 |
| CVE-2026-49940Net::CIDR::Set versions through 0.20 for Perl accept non-ASCII IP addresses and netmasksRRWO · Net::CIDR::Set · CVSS 6.5 · 2026-06-04 | 6.5 | 0.2% | 2026-06-04 |
| CVE-2026-22569Incorrect startup configuration in ZCCZscaler · Zscaler Client Connector · CVSS 5.4 · 2026-03-31 | 5.4 | 0.2% | 2026-03-31 |
| CVE-2026-34080xdg-dbus-proxy has an eavesdrop filter bypass allowing message interceptionflatpak · xdg-dbus-proxy · CVSS 6.8 · 2026-04-07 | 6.8 | 0.2% | 2026-04-07 |
| CVE-2025-62620Improper validation of unsafe equivalence in input could allow an attacker with high privileges to reclaim the ring buffer queue status page, potentially resulting in loss of gues…AMD · AMD EPYC™ 9004 Series Processors · CVSS 5.9 · 2026-11-10 | 5.9 | 0.2% | 2026-11-10 |
| CVE-2026-116197Contrast 1.21.0 before 1.25.0 Credential Leak via imagepuller Wildcard Registry Selectionedgelesssys · contrast · CVSS 2.6 · 2026-10-25 | 2.6 | 0.2% | 2026-10-25 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.