CWE-20: Improper input validation
13,785 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 75 of them as exploited in the wild.
- Published CVEs
- 13,785
- Last 12 months
- 2,247
- Critical
- 1,234
- Known exploited
- 75
Critical 1,234High 5,922Medium 6,087Low 530Not scored 12
CVEs per yearBy the year they were published
- 2015380
- 2016526
- 2017959
- 20181,281
- 2019930
- 2020834
- 2021682
- 2022752
- 2023822
- 2024700
- 2025681
- 20262,130
Known exploitedNewest addition to KEV first
- CVE-2026-88771
A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
Citrix NetScaler · ADC
ExploitedCritical9.5 - CVE-2026-93952
Security Advisory 0183
Arista Networks · VeloCloud Orchestrator (VCO) On-Prem
ExploitedCritical9.5 - CVE-2019-1068
A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server…
Microsoft · Microsoft SQL Server 2014 Service Pack 2 for 32-bit Systems (GDR)
ExploitedHigh8.8 - CVE-2026-12569
Remote Code Execution (RCE) vulnerability in Windchill PDMlink
PTC · Windchill PDMLink
ExploitedCritical9.3 - CVE-2026-34910
A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.
Ubiquiti Inc · UniFi OS Server
ExploitedCritical10.0 - CVE-2026-6973
An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with administrative access to…
Ivanti · Endpoint Manager Mobile
ExploitedHigh7.2 - CVE-2026-34197
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans
Apache Software Foundation · Apache ActiveMQ Broker
ExploitedHigh8.8 - CVE-2026-32201
Microsoft SharePoint Server Spoofing Vulnerability
Microsoft · Microsoft SharePoint Enterprise Server 2016
ExploitedMedium6.5 - CVE-2025-20393
Cisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution Vulnerability
Cisco · Cisco Secure Email
ExploitedCritical10.0 - CVE-2025-54236
Adobe Commerce | Improper Input Validation (CWE-20)
Adobe · Adobe Commerce
ExploitedCritical9.1
Newest CVEs
- CVE-2026-123613
Rustls 0.23.13 before 0.23.45 TLS 1.3 Handshake Encryption Level Bypass
rustls · rustls
Medium6.9 - CVE-2026-123574
Hickory DNS 0.24.0 before 0.26.2 Denial of Service via Zone File Parser
hickory-dns · hickory-dns
High8.7 - CVE-2026-123573
hickory-dns from 0.20.1 before 0.26.2 Panic in SVCB/HTTPS Zone File Parser
hickory-dns · hickory-dns
High8.7 - CVE-2026-118786
NXP MCUXpresso SDK rpmsg-lite TZM Example before 26.06.01-lts Secure Memory Disclosure via NSC Veneer Functions
NXP · MCUXpresso SDK
Medium6.8 - CVE-2026-118785
NXP MCUXpresso SDK TrustZone-M Examples before 26.06.01-lts Secure Memory Disclosure via NSC Veneer Functions
NXP · MCUXpresso SDK
Medium6.7 - CVE-2026-123791
OpenBMB Internet of Agents Agent Registry milvus_utils.py _primary_field_query data query logic injection
OpenBMB · Internet of Agents
Medium6.9 - CVE-2026-97848
Keycloak-services: keycloak-services: protocol mapper with jsontype=json bypasses token sanitization
Red Hat · Red Hat build of Keycloak 26.4
Medium6.5 - CVE-2026-48705
MONAI: MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass)
Project-MONAI · MONAI
Critical9.3 - CVE-2026-46350
dcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASS
dcmjs-org · dcmjs
Critical9.1 - CVE-2026-71548
SuiteCRM: Authenticated SQL Injection in AOR_Reports `parameter_value` (value_type=Field) allows any low-privileged user to read the full database
SuiteCRM · SuiteCRM
High8.8