# CWE-20.

Every Advisory and CVE whose sources give the weakness CWE-20, newest first.

## Records, newest first

- [SuiteCRM: Authenticated SQL Injection in AOR_Reports \`parameter_value\` (value_type=Field) allows any low-privileged user to read the full database](https://agentprime.io/advisories/CVE-2026-71548.md)
  `CVE-2026-71548` · CVE record: SuiteCRM SuiteCRM · CVSS 8.8 High · Not analysed yet · Published 5 Nov 2026 · Tags: SQL injection, CWE-20
- [ingress-nginx mirror-target self-DOS](https://agentprime.io/advisories/CVE-2026-116472.md)
  `CVE-2026-116472` · CVE record: Kubernetes ingress-nginx and 1 more · CVSS 2.7 Low · Not analysed yet · Published 5 Nov 2026 · Tags: CWE-20
- [Incorrect Authorization in Altium 365 Git Service Allows Unauthorized Repository Writes](https://agentprime.io/advisories/CVE-2026-123184.md)
  `CVE-2026-123184` · CVE record: Altium Altium 365 · CVSS 7.2 High · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control, CWE-20
- [HedgeDoc: Missing validation of incoming permission values on change](https://agentprime.io/advisories/CVE-2026-102927.md)
  `CVE-2026-102927` · CVE record: hedgedoc hedgedoc · CVSS 5.9 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control, CWE-20
- [Keycloak-services: keycloak-services: ciba sub parameter injection causes attacker authentication to issue victim tokens](https://agentprime.io/advisories/CVE-2026-97174.md)
  `CVE-2026-97174` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 6.8 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: CWE-20
- [Keycloak-services: keycloak-services: dcr protocol mapper config not validated, allowing iat holders to forge sub and aud claims in signed tokens](https://agentprime.io/advisories/CVE-2026-92857.md)
  `CVE-2026-92857` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 8.1 High · Not analysed yet · Published 5 Nov 2026 · Tags: CWE-20
- [Apache OFBiz: Improper Input Validation in Order Returns Enables Unauthorized Refund Price Manipulation](https://agentprime.io/advisories/CVE-2026-100228.md)
  `CVE-2026-100228` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: CWE-20
- [Pocket ID: Client credentials grant allows any OIDC client to obtain tokens for arbitrary audiences](https://agentprime.io/advisories/CVE-2026-62662.md)
  `CVE-2026-62662` · CVE record: pocket-id pocket-id · CVSS 7.7 High · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control, CWE-20
- [nvm evaluates a malicious mirror's index.tab version strings as shell arithmetic via stored LTS aliases](https://agentprime.io/advisories/CVE-2026-121751.md)
  `CVE-2026-121751` · CVE record: nvm-sh nvm · CVSS 2.1 Low · Not analysed yet · Published 4 Nov 2026 · Tags: Command injection, CWE-20
- [NPC-Worldwide npcpy MLX Provider response.py get_mlx_response input validation](https://agentprime.io/advisories/CVE-2026-122015.md)
  `CVE-2026-122015` · CVE record: NPC-Worldwide npcpy · CVSS 5.3 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: CWE-20
- [IBM MQ Managed File Transfer is affected by an arbitrary code execution vulnerability](https://agentprime.io/advisories/CVE-2026-11724.md)
  `CVE-2026-11724` · CVE record: IBM MQ · CVSS 8.5 High · Not analysed yet · Published 4 Nov 2026 · Tags: CWE-20
- [Apache ActiveMQ: LDAPAuthorizationMap allows authorization bypass via DN injection](https://agentprime.io/advisories/CVE-2026-108500.md)
  `CVE-2026-108500` · CVE record: Apache Software Foundation Apache ActiveMQ · No CVSS score · Not analysed yet · Published 4 Nov 2026 · Tags: CWE-20
- [Apache ActiveMQ, ActiveMQ Broker: The broker does not verify user provided connection id matches connection](https://agentprime.io/advisories/CVE-2026-108946.md)
  `CVE-2026-108946` · CVE record: Apache Software Foundation Apache ActiveMQ and 1 more · No CVSS score · Not analysed yet · Published 4 Nov 2026 · Tags: CWE-20
- [Apache ActiveMQ, Apache ActiveMQ KahaDB: Oversized client identifier strings poison the KahaDB journal](https://agentprime.io/advisories/CVE-2026-111821.md)
  `CVE-2026-111821` · CVE record: Apache Software Foundation Apache ActiveMQ and 1 more · No CVSS score · Not analysed yet · Published 4 Nov 2026 · Tags: CWE-20
- [Improper Input Validation in Modem Firmware](https://agentprime.io/advisories/CVE-2026-79405.md)
  `CVE-2026-79405` · CVE record: Unisoc (Shanghai) Technologies Co., Ltd. Modem · CVSS 7.5 High · Not analysed yet · Published 4 Nov 2026 · Tags: CWE-20
- [Tanium addressed an improper input validation vulnerability in Threat Response.](https://agentprime.io/advisories/CVE-2026-116654.md)
  `CVE-2026-116654` · CVE record: Tanium Threat Response · CVSS 6.5 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-20
- [Tanium addressed an improper input validation vulnerability in Threat Response.](https://agentprime.io/advisories/CVE-2026-116653.md)
  `CVE-2026-116653` · CVE record: Tanium Threat Response · CVSS 4.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-20
- [Improper input validation in Google Chrome](https://agentprime.io/advisories/CVE-2026-121141.md)
  `CVE-2026-121141` · CVE record: Google Chrome · CVSS 5.4 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-20
- [Improper input validation in Google Chrome](https://agentprime.io/advisories/CVE-2026-121064.md)
  `CVE-2026-121064` · CVE record: Google Chrome · CVSS 7.8 High · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-20
- [Improper input validation in Google Chrome](https://agentprime.io/advisories/CVE-2026-121240.md)
  `CVE-2026-121240` · CVE record: Google Chrome · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-20
- [Improper input validation in Google Chrome](https://agentprime.io/advisories/CVE-2026-121236.md)
  `CVE-2026-121236` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-20
- [Improper input validation in Google Chrome](https://agentprime.io/advisories/CVE-2026-121163.md)
  `CVE-2026-121163` · CVE record: Google Chrome · CVSS 8.3 High · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-20
- [Improper input validation in Google Chrome](https://agentprime.io/advisories/CVE-2026-121115.md)
  `CVE-2026-121115` · CVE record: Google Chrome · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-20
- [Improper input validation in Google Chrome](https://agentprime.io/advisories/CVE-2026-121120.md)
  `CVE-2026-121120` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-20
- [Improper input validation in Google Chrome](https://agentprime.io/advisories/CVE-2026-121242.md)
  `CVE-2026-121242` · CVE record: Google Chrome · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-20
- [Improper input validation in Google Chrome](https://agentprime.io/advisories/CVE-2026-121087.md)
  `CVE-2026-121087` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-20
- [MyTube: Visitor-Role Statistics Event Forgery Allows Analytics Data Poisoning](https://agentprime.io/advisories/CVE-2026-63434.md)
  `CVE-2026-63434` · CVE record: franklioxygen MyTube · CVSS 4.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-20
- [Elo backends have code injection via unvalidated emission of programmatic AST fields](https://agentprime.io/advisories/GHSA-x9rp-7wh3-2rj5.md)
  `GHSA-x9rp-7wh3-2rj5`, `CVE-2026-44265` · npm `@enspirit/elo`: affected `<1.0.1`, fixed in `1.0.1` · CVSS 7.4 High · Not analysed yet · Published 3 Nov 2026 · Tags: SQL injection, Code injection, CWE-20, CWE-749
- [SolarWinds Dameware Command Injection Vulnerability](https://agentprime.io/advisories/CVE-2026-28336.md)
  `CVE-2026-28336` · CVE record: SolarWinds Dameware · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-20
- [SolarWinds Dameware Buffer Overflow Vulnerability](https://agentprime.io/advisories/CVE-2026-28335.md)
  `CVE-2026-28335` · CVE record: SolarWinds Dameware · CVSS 8.4 High · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-20
- [Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 Field Corruption via Null Dot Notation Key](https://agentprime.io/advisories/CVE-2026-121415.md)
  `CVE-2026-121415` · CVE record: parse-community parse-server · CVSS 6.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-20
- [FreeRDP before 3.32.2 X11 Client Abort via RDPGFX Scaled Output Geometry](https://agentprime.io/advisories/CVE-2026-121411.md)
  `CVE-2026-121411` · CVE record: FreeRDP FreeRDP · CVSS 2.3 Low · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-20
- [FreeRDP before 3.32.2 Shadow Server Denial of Service via remdesk Channel](https://agentprime.io/advisories/CVE-2026-121407.md)
  `CVE-2026-121407` · CVE record: FreeRDP FreeRDP · CVSS 7.1 High · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-20
- [Apache Oozie: workflow rerun bypasses the per-job ACL and reassigns ownership](https://agentprime.io/advisories/CVE-2026-119641.md)
  `CVE-2026-119641` · CVE record: Apache Software Foundation Apache Oozie · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-20
- [Missing length validation in Absolute Secure Access](https://agentprime.io/advisories/CVE-2026-116768.md)
  `CVE-2026-116768` · CVE record: Absolute Software Secure Access · CVSS 7.1 High · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-20
- [Improper input validation in Dell Alienware Command Center (AWCC)](https://agentprime.io/advisories/CVE-2026-86365.md)
  `CVE-2026-86365` · CVE record: Dell Alienware Command Center (AWCC) · CVSS 4.2 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-20
- [Improper input validation in Google Android](https://agentprime.io/advisories/CVE-2026-59047.md)
  `CVE-2026-59047` · CVE record: Google Android · CVSS 6.2 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-20
- [Improper input validation in Google Android](https://agentprime.io/advisories/CVE-2026-59046.md)
  `CVE-2026-59046` · CVE record: Google Android · CVSS 6.2 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-20
- [Improper input validation in Google Android](https://agentprime.io/advisories/CVE-2026-59021.md)
  `CVE-2026-59021` · CVE record: Google Android · CVSS 6.2 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-20
- [Improper input validation in Google Android](https://agentprime.io/advisories/CVE-2026-59008.md)
  `CVE-2026-59008` · CVE record: Google Android · CVSS 6.2 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-20
- [Improper input validation in Google Android](https://agentprime.io/advisories/CVE-2026-58985.md)
  `CVE-2026-58985` · CVE record: Google Android · CVSS 6.2 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-20
- [Improper input validation in Google Android](https://agentprime.io/advisories/CVE-2026-58964.md)
  `CVE-2026-58964` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-20
- [Improper input validation in Google Android](https://agentprime.io/advisories/CVE-2026-58955.md)
  `CVE-2026-58955` · CVE record: Google Android · CVSS 6.2 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-20
- [Improper input validation in Google Android](https://agentprime.io/advisories/CVE-2026-58937.md)
  `CVE-2026-58937` · CVE record: Google Android · CVSS 6.2 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-20
- [Improper input validation in Google Android](https://agentprime.io/advisories/CVE-2026-58875.md)
  `CVE-2026-58875` · CVE record: Google Android · CVSS 6.2 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-20
- [Improper input validation in Google Android](https://agentprime.io/advisories/CVE-2026-58838.md)
  `CVE-2026-58838` · CVE record: Google Android · CVSS 4.0 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-20
- [Improper input validation in Google Android](https://agentprime.io/advisories/CVE-2026-58817.md)
  `CVE-2026-58817` · CVE record: Google Android · CVSS 6.2 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-20
- [Improper input validation in Google Android](https://agentprime.io/advisories/CVE-2026-55272.md)
  `CVE-2026-55272` · CVE record: Google Android · CVSS 6.2 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-20
- [Improper input validation in Google Android](https://agentprime.io/advisories/CVE-2026-55262.md)
  `CVE-2026-55262` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-20
- [Improper input validation in Google Android](https://agentprime.io/advisories/CVE-2026-49934.md)
  `CVE-2026-49934` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-20
- [Improper input validation in Google Android](https://agentprime.io/advisories/CVE-2026-28665.md)
  `CVE-2026-28665` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-20
- [Improper input validation in Google Android](https://agentprime.io/advisories/CVE-2026-28643.md)
  `CVE-2026-28643` · CVE record: Google Android · CVSS 6.2 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-20
- [Improper input validation in Google Android](https://agentprime.io/advisories/CVE-2026-28597.md)
  `CVE-2026-28597` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-20
- [Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads](https://agentprime.io/advisories/GHSA-gqmm-qrjq-4c7h.md)
  `GHSA-gqmm-qrjq-4c7h`, `CVE-2026-111959`, `RUSTSEC-2026-0442` · crates.io `arrow-data`: affected `>=33.0.0, <57.3.2 || >=58.0.0, <58.4.1 || >=59.0.0, <59.3.2 || >=60.0.0, <60.1.0`, fixed in `57.3.2`, `58.4.1`, `59.3.2`, `60.1.0` · No CVSS score · Not analysed yet · Published 2 Nov 2026 · Tags: Memory corruption, CWE-20
- [jxxghp MoviePilot Workflow Fork Endpoint workflow.py WorkflowExecutor.restore_context deserialization](https://agentprime.io/advisories/CVE-2026-120320.md)
  `CVE-2026-120320` · CVE record: jxxghp MoviePilot · CVSS 5.1 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Insecure deserialization, CWE-20
- [A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the ims_qos_npn module.](https://agentprime.io/advisories/CVE-2026-106804.md)
  `CVE-2026-106804` · CVE record · CVSS 7.5 High · Not analysed yet · Published 2 Nov 2026 · Tags: Memory corruption, CWE-20
- [ag-ui-protocol ag-ui Transport Decoder input validation](https://agentprime.io/advisories/CVE-2026-120236.md)
  `CVE-2026-120236` · CVE record: ag-ui-protocol ag-ui · CVSS 5.3 Medium · Not analysed yet · Published 1 Nov 2026 · Tags: CWE-20
- [MariaDB Connector/J: XA recover() trusted server-supplied gtrid and bqual lengths](https://agentprime.io/advisories/GHSA-4jq2-8v3c-97w8.md)
  `GHSA-4jq2-8v3c-97w8`, `CVE-2026-119280` · Maven `org.mariadb.jdbc:mariadb-java-client`: affected `>=3.0.0, <3.3.7 || >=3.4.0, <3.4.5 || >=3.5.0, <3.5.11`, fixed in `3.3.7`, `3.4.5`, `3.5.11` · CVSS 3.7 Low · Not analysed yet · Published 30 Oct 2026 · Tags: Denial of service, CWE-20
- [MariaDB Connector/J: LOAD DATA LOCAL INFILE file check could be satisfied by text inside quoted identifiers, letting a malicious server read client files](https://agentprime.io/advisories/GHSA-fhx5-2xqw-2cgm.md)
  `GHSA-fhx5-2xqw-2cgm`, `CVE-2026-119210` · Maven `org.mariadb.jdbc:mariadb-java-client`: affected `>=3.0.0, <3.3.7 || >=3.4.0, <3.4.5 || >=3.5.0, <3.5.11`, fixed in `3.3.7`, `3.4.5`, `3.5.11` · CVSS 5.9 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Path traversal, CWE-20
- [AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers](https://agentprime.io/advisories/GHSA-79wv-8rh2-9vp2.md)
  `GHSA-79wv-8rh2-9vp2`, `CVE-2026-96631`, `PKSA-31n1-gk84-zwsg` · Packagist `adminneo-org/adminneo`: affected `>=4.6.0, <5.5.1`, fixed in `5.5.1` · CVSS 8.2 High · Not analysed yet · Published 30 Oct 2026 · Tags: Other injection, CWE-20

Older: <https://agentprime.io/advisories/tag/cwe-20.md?cursor=WyIyMDI2LTEwLTMwVDIyOjUyOjQ3LjAwMDAwMFoiLCJHSFNBLTc5d3YtOHJoMi05dnAyIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-20>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-20/>. Everything for agents: <https://agentprime.io/llms.txt>.