CWE-184 · Input Validation and Logic
Incomplete List of Disallowed Inputs
216CVEs
1exploited
0with a public check
6likely (EPSS 10%+)
SortMost likely exploited
216 CVEs with CWE-184 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2024-5217In CISA KEVExploitedServiceNow - Incomplete Input ValidationServiceNow · Now Platform · CVSS 9.8 · 2024-07-10 | 9.8 | 100% | 2024-07-10 |
| CVE-2022-43396Apache Kylin: Command injection by Useless configurationApache Software Foundation · Apache Kylin · CVSS 8.8 · 2022-12-30 | 8.8 | 55% | 2022-12-30 |
| CVE-2017-7525A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by s…FasterXML · jackson-databind · 2018-02-06 | – | 38% | 2018-02-06 |
| CVE-2024-5178Incomplete Input Validation in SecurelyAccess APIServiceNow · Now Platform · CVSS 4.9 · 2024-07-10 | 4.9 | 34% | 2024-07-10 |
| CVE-2018-7489FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-…Fasterxml · Jackson-Databind · 2018-02-26 | – | 20% | 2018-02-26 |
| CVE-2018-6383Monstra CMS through 3.0.4 has an incomplete "forbidden types" list that excludes .php (and similar) file extensions but not the .pht or .phar extension, which allows remote authen…Monstra · Monstra · 2018-01-29 | – | 13% | 2018-01-29 |
| CVE-2024-32152A blocklist bypass vulnerability exists in the LaTeX functionality of Ankitects Anki 24.04. A specially crafted malicious flashcard can lead to an arbitrary file creation at a fix…Ankitects · Anki · CVSS 3.1 · 2024-07-22 | 3.1 | 12% | 2024-07-22 |
| CVE-2017-15095A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending t…FasterXML · jackson-databind · 2018-02-06 | – | 8.4% | 2018-02-06 |
| CVE-2018-5968FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-1748…Fasterxml · Jackson-Databind · 2018-01-22 | – | 7.2% | 2018-01-22 |
| CVE-2021-25631denylist of executable filename extensions possible to bypass under windowsThe Document Foundation · LibreOffice · 2021-05-03 | – | 5.0% | 2021-05-03 |
| CVE-2026-34415Xerte Online Toolkits File Upload RCE via elfinder Connectorthexerteproject · xerteonlinetoolkits · CVSS 9.8 · 2026-04-22 | 9.8 | 3.6% | 2026-04-22 |
| CVE-2024-30103Microsoft Outlook Remote Code Execution VulnerabilityMicrosoft · Microsoft 365 Apps for Enterprise · CVSS 8.8 · 2024-06-11 | 8.8 | 3.4% | 2024-06-11 |
| CVE-2023-23844SolarWinds Platform Incomplete List of Disallowed Inputs VulnerabilitySolarWinds · SolarWinds Platform · CVSS 7.2 · 2023-07-26 | 7.2 | 3.0% | 2023-07-26 |
| CVE-2019-9212SOFA-Hessian through 4.0.2 allows remote attackers to execute arbitrary commands via a crafted serialized Hessian object because blacklisting of com.caucho.naming.QName and com.su…Antfin · Sofa-Hessian · 2019-02-27 | – | 2.8% | 2019-02-27 |
| CVE-2023-40037Apache NiFi: Incomplete Validation of JDBC and JNDI Connection URLsApache Software Foundation · Apache NiFi · 2023-08-18 | – | 2.1% | 2023-08-18 |
| CVE-2023-34253Grav vulnerable to Server-side Template Injection (SSTI) via Denylist Bypassgetgrav · grav · CVSS 8.8 · 2023-06-14 | 8.8 | 2.1% | 2023-06-14 |
| CVE-2023-34252Grav Server-side Template Injection via Insufficient Validation in filterFiltergetgrav · grav · CVSS 8.8 · 2023-06-14 | 8.8 | 2.1% | 2023-06-14 |
| CVE-2023-2017Improper Control of Generation of Code in Twig Rendered Views in ShopwareShopware AG · Shopware 6 · CVSS 8.8 · 2023-04-17 | 8.8 | 2.1% | 2023-04-17 |
| CVE-2017-0909The private_address_check ruby gem before 0.4.1 is vulnerable to a bypass due to an incomplete blacklist of common private/local network addresses used to prevent server-side requ…HackerOne · private_address_check ruby gem · 2017-11-16 | – | 2.0% | 2017-11-16 |
| CVE-2026-41264Flowise: CSV Agent Prompt Injection Remote Code Execution VulnerabilityFlowiseAI · Flowise · CVSS 9.2 · 2026-04-23 | 9.2 | 1.8% | 2026-04-23 |
| CVE-2026-63108Roo Code 3.54.0 Command Injection via Parameter Expansion ParsingRooCodeInc · Roo-Code · CVSS 8.8 · 2026-07-20 | 8.8 | 1.8% | 2026-07-20 |
| CVE-2020-14372A flaw was found in grub2 in versions prior to 2.06, where it incorrectly enables the usage of the ACPI command when Secure Boot is enabled. This flaw allows an attacker with priv…Gnu · grub2 · 2021-03-03 | – | 1.7% | 2021-03-03 |
| CVE-2025-1716picklescan - Security scanning bypass via 'pip main'mmaitre314 · picklescan · CVSS 5.3 · 2025-02-26 | 5.3 | 1.7% | 2025-02-26 |
| CVE-2015-5946Incomplete blacklist vulnerability in SuiteCRM 7.2.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension.Sugarcrm · Sugarcrm · 2017-08-07 | – | 1.7% | 2017-08-07 |
| CVE-2017-7540rubygem-safemode, as used in Foreman, versions 1.3.2 and earlier are vulnerable to bypassing safe mode limitations via special Ruby syntax. This can lead to deletion of objects fo…Red Hat, Inc. · rubygem-safemode · 2017-07-21 | – | 1.6% | 2017-07-21 |
| CVE-2017-2602jenkins before versions 2.44, 2.32.2 is vulnerable to an improper blacklisting of the Pipeline metadata files in the agent-to-master security subsystem. This could allow metadata…Jenkins · jenkins · CVSS 3.1 · 2018-05-15 | 3.1 | 1.5% | 2018-05-15 |
| CVE-2016-6189Incomplete blacklist in SOGo before 2.3.12 and 3.x before 3.1.1 allows remote authenticated users to obtain sensitive information by reading the fields in the (1) ics or (2) XML c…Alinto · Sogo · 2017-02-17 | – | 1.4% | 2017-02-17 |
| CVE-2025-48732An incomplete blacklist exists in the .htaccess sample of WWBN AVideo 14.4 and dev master commit 8a8954ff. A specially crafted HTTP request can lead to a arbitrary code execution.…WWBN · AVideo · CVSS 7.3 · 2025-07-24 | 7.3 | 1.3% | 2025-07-24 |
| CVE-2021-25737Holes in EndpointSlice Validation Enable Host Network HijackKubernetes · Kubernetes · CVSS 2.7 · 2021-09-06 | 2.7 | 1.3% | 2021-09-06 |
| CVE-2018-16863It was found that RHSA-2018:2918 did not fully fix CVE-2018-16509. An attacker could possibly exploit another variant of the flaw and bypass the -dSAFER protection to, for example…Artifex · ghostscript · CVSS 7.3 · 2018-12-03 | 7.3 | 1.2% | 2018-12-03 |
| CVE-2026-54513jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)FasterXML · jackson-databind · CVSS 8.1 · 2026-06-23 | 8.1 | 1.2% | 2026-06-23 |
| CVE-2022-32763A cross-site scripting (xss) sanitization vulnerability bypass exists in the SanitizeHtml functionality of Lansweeper lansweeper 10.1.1.0. A specially-crafted HTTP request can lea…Lansweeper · lansweeper · CVSS 9.1 · 2022-12-19 | 9.1 | 1.2% | 2022-12-19 |
| CVE-2026-56315picklescan - Remote Code Execution via Unblocked Standard Library Modulespicklescan · picklescan · CVSS 9.8 · 2026-06-23 | 9.8 | 1.1% | 2026-06-23 |
| CVE-2022-35962Crafted link in Zulip message can cause disclosure of credentialszulip · zulip-mobile · CVSS 8 · 2022-08-29 | 8.0 | 1.1% | 2022-08-29 |
| CVE-2021-1133Cisco Data Center Network Manager REST API VulnerabilitiesCisco · Cisco Data Center Network Manager · CVSS 4.6 · 2021-01-20 | 4.6 | 1.1% | 2021-01-20 |
| CVE-2026-54512jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiationFasterXML · jackson-databind · CVSS 8.1 · 2026-06-23 | 8.1 | 1.1% | 2026-06-23 |
| CVE-2026-121663Visual Studio Code Security Feature Bypass VulnerabilityMicrosoft · Visual Studio Code · CVSS 8.8 · 2026-11-10 | 8.8 | 1.0% | 2026-11-10 |
| CVE-2025-71323picklescan - Remote Code Execution via Unblocked ctypes Modulepicklescan · picklescan · CVSS 9.8 · 2026-06-17 | 9.8 | 1.0% | 2026-06-17 |
| CVE-2026-70470Flowise: Pyodide validator Unicode homoglyph bypass leads to RCEFlowiseAI · Flowise · CVSS 9.5 · 2026-08-04 | 9.5 | 1.0% | 2026-08-04 |
| CVE-2026-84218Org.jolokia/jolokia-core: incomplete jndi denylist in jolokia jsr-160 proxy (bypass of cve-2018-1000130 fix)Red Hat · Red Hat AMQ Broker 7 · CVSS 8.1 · 2026-09-01 | 8.1 | 0.9% | 2026-09-01 |
| CVE-2026-47392PraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execute_code` (subprocess mode)MervinPraison · PraisonAI · CVSS 9.9 · 2026-07-21 | 9.9 | 0.9% | 2026-07-21 |
| CVE-2026-129099Cudy TR3000 before 2.5.42 Root RCE via OpenVPN Configuration ImportShenzhen Cudy Technology Co., Ltd. · TR3000 1.0 · CVSS 7.2 · 2026-11-13 | 7.2 | 0.9% | 2026-11-13 |
| CVE-2026-65083NVIDIA OpenShell for Linux contains a vulnerability in its sandbox provisioning API, where an attacker could cause an incomplete list of disallowed inputs. A successful exploit of…NVIDIA · OpenShell · CVSS 9.9 · 2026-08-25 | 9.9 | 0.9% | 2026-08-25 |
| CVE-2025-29822Microsoft OneNote Security Feature Bypass VulnerabilityMicrosoft · Microsoft 365 Apps for Enterprise · CVSS 7.8 · 2025-04-08 | 7.8 | 0.8% | 2025-04-08 |
| CVE-2025-71320picklescan - Remote Code Execution via Incomplete Disallowed Inputspicklescan · picklescan · CVSS 9.8 · 2026-06-17 | 9.8 | 0.8% | 2026-06-17 |
| CVE-2026-17150Multiple Vulnerabilities in IBM API ConnectIBM · API Connect · CVSS 9.9 · 2026-11-07 | 9.9 | 0.8% | 2026-11-07 |
| CVE-2026-126370Vvveb through 1.0.8.6 Authenticated RCE via .sql Code Injection in editor/code/savegivanz · Vvveb · CVSS 8.8 · 2026-11-13 | 8.8 | 0.8% | 2026-11-13 |
| CVE-2020-3384Cisco Data Center Network Manager Command Injection VulnerabilityCisco · Cisco Data Center Network Manager · CVSS 8.2 · 2020-07-31 | 8.2 | 0.8% | 2020-07-31 |
| CVE-2026-17630Langflow is affected by security vulnerabilities in Model Context Protocol featuresIBM · Langflow OSS · CVSS 7.2 · 2026-08-05 | 7.2 | 0.8% | 2026-08-05 |
| CVE-2026-96196Microsoft Edge (Chromium-based) Security Feature Bypass VulnerabilityMicrosoft · Microsoft Edge (Chromium-based) · CVSS 8.8 · 2026-10-29 | 8.8 | 0.8% | 2026-10-29 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.