CWE-183 · Input Validation and Logic
Permissive List of Allowed Inputs
48CVEs
SortMost likely exploited
48 CVEs with CWE-183 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2020-25696A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If an interactiv…Postgresql · PostgreSQL · 2020-11-23 | – | 2.7% | 2020-11-23 |
| CVE-2026-21915JSI Virtual Lightweight Collector: Shell escape allows privilege escalation to rootJuniper Networks · JSI LWC · CVSS 6.7 · 2026-04-09 | 6.7 | 2.3% | 2026-04-09 |
| CVE-2020-1694A flaw was found in all versions of Keycloak before 10.0.0, where the NodeJS adapter did not support the verify-token-audience. This flaw results in some users having access to se…Redhat · keycloak · 2020-09-16 | – | 1.6% | 2020-09-16 |
| CVE-2024-1654Unauthorized write operations in PaperCut NG/MFPaperCut · PaperCut NG, PaperCut MF · CVSS 7.2 · 2024-03-14 | 7.2 | 1.3% | 2024-03-14 |
| CVE-2023-4399Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, Request security is a deny list that allows admins to configure Grafana in a way so tha…Grafana · Grafana Enterprise · CVSS 6.6 · 2023-10-17 | 6.6 | 1.3% | 2023-10-17 |
| CVE-2021-34787Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Identity-Based Rule Bypass VulnerabilityCisco · Cisco Adaptive Security Appliance (ASA) Software · CVSS 5.3 · 2021-10-27 | 5.3 | 1.0% | 2021-10-27 |
| CVE-2021-40128Cisco Webex Meetings Email Content Injection VulnerabilityCisco · Cisco Webex Meetings · CVSS 5.3 · 2021-11-04 | 5.3 | 1.0% | 2021-11-04 |
| CVE-2026-96229.NET Information Disclosure VulnerabilityMicrosoft · .NET 10.0 runtime · CVSS 6.5 · 2026-10-13 | 6.5 | 0.9% | 2026-10-13 |
| CVE-2023-7250Iperf3: possible denial of serviceRed Hat · Red Hat Enterprise Linux 8 · CVSS 5.3 · 2024-03-18 | 5.3 | 0.9% | 2024-03-18 |
| CVE-2025-53762Microsoft Purview Elevation of Privilege VulnerabilityMicrosoft · Microsoft Purview · CVSS 8.7 · 2025-07-18 | 8.7 | 0.9% | 2025-07-18 |
| CVE-2025-59457In JetBrains TeamCity before 2025.07.2 missing Git URL validation allowed credential leakage on WindowsJetBrains · TeamCity · CVSS 7.7 · 2025-09-17 | 7.7 | 0.8% | 2025-09-17 |
| CVE-2026-3490picklescan - Universal Blocklist Bypass via pkgutil.resolve_namepicklescan · picklescan · CVSS 10 · 2026-06-17 | 10.0 | 0.8% | 2026-06-17 |
| CVE-2026-29514NetBox 4.3.5 - 4.5.4 RCE via RenderTemplateMixinnetbox-community · netbox · CVSS 8.8 · 2026-05-04 | 8.8 | 0.8% | 2026-05-04 |
| CVE-2022-23158Wyse Device Agent version 14.6.1.4 and below contain a sensitive data exposure vulnerability. A local authenticated user with standard privilege could potentially exploit this vul…Dell · Dell Wyse Device Agent · CVSS 6 · 2022-04-01 | 6.0 | 0.7% | 2022-04-01 |
| CVE-2026-42043Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0axios · axios · CVSS 7.2 · 2026-04-24 | 7.2 | 0.7% | 2026-04-24 |
| CVE-2026-115915vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCEvllm-project · vllm · CVSS 8.1 · 2026-10-26 | 8.1 | 0.7% | 2026-10-26 |
| CVE-2025-24349A vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attacker to delete the configuration of…Bosch Rexroth AG · ctrlX OS - Device Admin · CVSS 7.1 · 2025-04-30 | 7.1 | 0.7% | 2025-04-30 |
| CVE-2026-67345MaxKey 4.1.12 DefaultRedirectResolver OAuth Authorization Code Theftdromara · MaxKey · CVSS 8.1 · 2026-07-30 | 8.1 | 0.6% | 2026-07-30 |
| CVE-2026-54316Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetchanthropics · claude-code · CVSS 6 · 2026-06-23 | 6.0 | 0.5% | 2026-06-23 |
| CVE-2026-50189Appsmith: RCE via Supervisord XML-RPC Admin Interface Exposed via /supervisor Caddy Routeappsmithorg · appsmith · CVSS 8.9 · 2026-06-24 | 8.9 | 0.5% | 2026-06-24 |
| CVE-2026-106510Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.ymlbackstage · backstage · CVSS 7.7 · 2026-10-07 | 7.7 | 0.5% | 2026-10-07 |
| CVE-2026-107360Rubygem-safemode: safemode: jail allow-list bypass via op-assign expressionsRed Hat · Red Hat Satellite 6.16 for RHEL 8 · CVSS 9.6 · 2026-11-12 | 9.6 | 0.5% | 2026-11-12 |
| CVE-2026-46391HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apishaxtheweb · @haxtheweb/open-apis · CVSS 8.7 · 2026-06-05 | 8.7 | 0.5% | 2026-06-05 |
| CVE-2026-67315axios 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 NO_PROXY Bypass via 0.0.0.0axios · axios · CVSS 6.9 · 2026-08-01 | 6.9 | 0.5% | 2026-08-01 |
| CVE-2022-42469A permissive list of allowed inputs vulnerability [CWE-183] in FortiGate version 7.2.3 and below, version 7.0.9 and below Policy-based NGFW Mode may allow an authenticated SSL-VPN…Fortinet · FortiOS · CVSS 4.1 · 2023-04-11 | 4.1 | 0.4% | 2023-04-11 |
| CVE-2022-34450PowerPath Management Appliance with version 3.3 contains Privilege Escalation vulnerability. An authenticated admin user could potentially exploit this issue and gain unrestricted…Dell · PowerPath Management Appliance · CVSS 6.7 · 2023-02-10 | 6.7 | 0.4% | 2023-02-10 |
| CVE-2026-113786pypdf: Unvalidated JPEG image data loadingpy-pdf · pypdf · CVSS 2.3 · 2026-10-21 | 2.3 | 0.4% | 2026-10-21 |
| CVE-2026-32881ewe has an Overly Permissive List of Allowed Inputsvshakitskiy · ewe · CVSS 5.3 · 2026-03-20 | 5.3 | 0.4% | 2026-03-20 |
| CVE-2026-33979Express XSS Sanitizer: allowedTags/allowedAttributes bypass leads to permissive sanitization (XSS risk)AhmedAdelFahim · express-xss-sanitizer · CVSS 8.2 · 2026-03-27 | 8.2 | 0.4% | 2026-03-27 |
| CVE-2026-40899DataEase has an Arbitrary File Read Vulnerabilitydataease · dataease · CVSS 8.3 · 2026-04-16 | 8.3 | 0.4% | 2026-04-16 |
| CVE-2024-47565A vulnerability has been identified in SINEC Security Monitor (All versions < V4.9.0). The affected application does not properly validate that user input complies with a list of…Siemens · SINEC Security Monitor · CVSS 4.3 · 2024-10-08 | 4.3 | 0.4% | 2024-10-08 |
| CVE-2024-38522CSP bypass in Hush Linescidsg · hushline · CVSS 6.3 · 2024-06-28 | 6.3 | 0.3% | 2024-06-28 |
| CVE-2026-63649The Windows interactive service in OpenVPN 2.4.0 through 2.6.21 and 2.7_alpha1 through 2.7.5 allows local authenticated users to bypass the trusted configuration directory constra…OpenVPN · OpenVPN · CVSS 4.1 · 2026-08-14 | 4.1 | 0.3% | 2026-08-14 |
| CVE-2026-2303Heap Out-of-Bounds Read in Go Driver GSSAPI C Wrappers enables application crash or information leakMongoDB Inc · MongoDB Go Driver · CVSS 6.5 · 2026-02-10 | 6.5 | 0.3% | 2026-02-10 |
| CVE-2026-41240DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)cure53 · DOMPurify · CVSS 6 · 2026-04-23 | 6.0 | 0.3% | 2026-04-23 |
| CVE-2026-35649OpenClaw < 2026.3.22 - Settings Reconciliation Bypass via Empty AllowlistOpenClaw · OpenClaw · CVSS 6.5 · 2026-04-10 | 6.5 | 0.3% | 2026-04-10 |
| CVE-2026-8918A permissive list of allowed inputs in ASUS Armoury Crate allows a local administrator to perform arbitrary memory read/write operations or cause a system crash (BSOD) by bypassin…ASUS · Armoury Crate · CVSS 7.1 · 2026-06-22 | 7.1 | 0.3% | 2026-06-22 |
| CVE-2026-43574OpenClaw < 2026.4.12 - Improper Authorization via Empty Approver ListsOpenClaw · OpenClaw · CVSS 6.5 · 2026-05-05 | 6.5 | 0.2% | 2026-05-05 |
| CVE-2026-117570nmap-mcp through commit 3636afa Permissive NSE Script Allowlist in scan_vulnerabilitiesVorota-ai · nmap-mcp · CVSS 5.2 · 2026-10-27 | 5.2 | 0.2% | 2026-10-27 |
| CVE-2026-41387OpenClaw < 2026.3.22 - Supply Chain Redirection via Incomplete Host Environment SanitizationOpenClaw · OpenClaw · CVSS 7.8 · 2026-04-28 | 7.8 | 0.2% | 2026-04-28 |
| CVE-2026-11525undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matchingundici · undici · CVSS 3.7 · 2026-06-17 | 3.7 | 0.2% | 2026-06-17 |
| CVE-2026-59802PasswordPusher < 2.8.1 - Redirect-Based XSS via data URI in URL Push PayloadPasswordPusher · PasswordPusher · CVSS 8.2 · 2026-07-08 | 8.2 | 0.2% | 2026-07-08 |
| CVE-2026-46341Apify MCP server: Domain Allowlist Bypass in fetch-apify-docs via String Prefix Matchingapify · apify-mcp-server · CVSS 6.1 · 2026-07-16 | 6.1 | 0.2% | 2026-07-16 |
| CVE-2026-2302Unsafe Reflection in Mongoid::Criteria.from_hashMongoDB Inc · MongoDB Ruby Driver · CVSS 6.5 · 2026-02-10 | 6.5 | 0.2% | 2026-02-10 |
| CVE-2026-44111OpenClaw < 2026.4.15 - Arbitrary Markdown File Read via QMD memory_getOpenClaw · OpenClaw · CVSS 4.3 · 2026-05-06 | 4.3 | 0.2% | 2026-05-06 |
| CVE-2026-42042Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercionaxios · axios · CVSS 5.4 · 2026-04-24 | 5.4 | 0.2% | 2026-04-24 |
| CVE-2026-16478Arbitrary Package Installation in TÜBİTAK BİLGEM's pardus-nvidia-installerTÜBİTAK BİLGEM Software Technologies Research Institute · pardus-nvidia-installer · CVSS 7 · 2026-11-10 | 7.0 | 0.2% | 2026-11-10 |
| CVE-2026-89106Cross Site Scripting (XSS) vulnerability in SAPUI5SAP_SE · SAPUI5 · CVSS 4.4 · 2026-10-13 | 4.4 | 0.1% | 2026-10-13 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.