Advisories · Weakness
CWE-20.
Every Advisory and CVE whose sources give the weakness CWE-20, newest first.
- CVSS 8.8 High
SuiteCRM: Authenticated SQL Injection in AOR_Reports `parameter_value` (value_type=Field) allows any low-privileged user to read the full database
- SuiteCRM
- SQL injection
- CWE-20
- CVSS 2.7 Low
ingress-nginx mirror-target self-DOS
- Kubernetes ingress-nginx
- SUSE Rancher Prime RKE2 ingress-nginx
- CWE-20
- CVSS 7.2 High
Incorrect Authorization in Altium 365 Git Service Allows Unauthorized Repository Writes
- Altium 365
- Broken access control
- CWE-20
- CVSS 5.9 Medium
HedgeDoc: Missing validation of incoming permission values on change
- hedgedoc
- Broken access control
- CWE-20
- CVSS 6.8 Medium
Keycloak-services: keycloak-services: ciba sub parameter injection causes attacker authentication to issue victim tokens
- Red Hat Build of Keycloak
- Red Hat Single Sign-On 7
- CWE-20
- CVSS 8.1 High
Keycloak-services: keycloak-services: dcr protocol mapper config not validated, allowing iat holders to forge sub and aud claims in signed tokens
- Red Hat Build of Keycloak
- Red Hat Single Sign-On 7
- CWE-20
-
Apache OFBiz: Improper Input Validation in Order Returns Enables Unauthorized Refund Price Manipulation
- Apache Software Foundation Apache OFBiz
- CWE-20
- CVSS 7.7 High
Pocket ID: Client credentials grant allows any OIDC client to obtain tokens for arbitrary audiences
- pocket-id
- Broken access control
- CWE-20
- CVSS 2.1 Low
nvm evaluates a malicious mirror's index.tab version strings as shell arithmetic via stored LTS aliases
- nvm
- Command injection
- CWE-20
- CVSS 5.3 Medium
NPC-Worldwide npcpy MLX Provider response.py get_mlx_response input validation
- NPC-Worldwide npcpy
- CWE-20
- CVSS 8.5 High
IBM MQ Managed File Transfer is affected by an arbitrary code execution vulnerability
- IBM MQ
- CWE-20
-
Apache ActiveMQ: LDAPAuthorizationMap allows authorization bypass via DN injection
- Apache Software Foundation Apache ActiveMQ
- CWE-20
-
Apache ActiveMQ, ActiveMQ Broker: The broker does not verify user provided connection id matches connection
- Apache Software Foundation Apache ActiveMQ
- Apache Software Foundation ActiveMQ Broker
- CWE-20
-
Apache ActiveMQ, Apache ActiveMQ KahaDB: Oversized client identifier strings poison the KahaDB journal
- Apache Software Foundation Apache ActiveMQ
- Apache Software Foundation Apache ActiveMQ KahaDB
- CWE-20
- CVSS 7.5 High
Improper Input Validation in Modem Firmware
- Unisoc (Shanghai) Technologies Co., Ltd. Modem
- CWE-20
- CVSS 6.5 Medium
Tanium addressed an improper input validation vulnerability in Threat Response.
- Tanium Threat Response
- CWE-20
- CVSS 4.3 Medium
Tanium addressed an improper input validation vulnerability in Threat Response.
- Tanium Threat Response
- CWE-20
- CVSS 5.4 Medium
Improper input validation in Google Chrome
- Google Chrome
- CWE-20
- CVSS 7.8 High
Improper input validation in Google Chrome
- Google Chrome
- CWE-20
-
Improper input validation in Google Chrome
- Google Chrome
- CWE-20
- CVSS 8.8 High
Improper input validation in Google Chrome
- Google Chrome
- CWE-20
- CVSS 8.3 High
Improper input validation in Google Chrome
- Google Chrome
- CWE-20
-
Improper input validation in Google Chrome
- Google Chrome
- CWE-20
- CVSS 8.8 High
Improper input validation in Google Chrome
- Google Chrome
- CWE-20
-
Improper input validation in Google Chrome
- Google Chrome
- CWE-20
- CVSS 8.8 High
Improper input validation in Google Chrome
- Google Chrome
- CWE-20
- CVSS 4.3 Medium
MyTube: Visitor-Role Statistics Event Forgery Allows Analytics Data Poisoning
- franklioxygen MyTube
- CWE-20
- CVSS 7.4 High
Elo backends have code injection via unvalidated emission of programmatic AST fields
- SQL injection
- Code injection
<1.0.1 · fixed in 1.0.1
GHSA-x9rp-7wh3-2rj5 · CVE-2026-44265 - CVSS 9.9 CriticalCritical · CVSS 9+
SolarWinds Dameware Command Injection Vulnerability
- SolarWinds Dameware
- CWE-20
- CVSS 8.4 High
SolarWinds Dameware Buffer Overflow Vulnerability
- SolarWinds Dameware
- CWE-20
- CVSS 6.3 Medium
Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 Field Corruption via Null Dot Notation Key
- parse-community parse-server
- CWE-20
- CVSS 2.3 Low
FreeRDP before 3.32.2 X11 Client Abort via RDPGFX Scaled Output Geometry
- FreeRDP
- CWE-20
- CVSS 7.1 High
FreeRDP before 3.32.2 Shadow Server Denial of Service via remdesk Channel
- FreeRDP
- CWE-20
-
Apache Oozie: workflow rerun bypasses the per-job ACL and reassigns ownership
- Apache Software Foundation Apache Oozie
- CWE-20
- CVSS 7.1 High
Missing length validation in Absolute Secure Access
- Absolute Software Secure Access
- CWE-20
- CVSS 4.2 Medium
Improper input validation in Dell Alienware Command Center (AWCC)
- Dell Alienware Command Center (AWCC)
- CWE-20
- CVSS 6.2 Medium
Improper input validation in Google Android
- Google Android
- CWE-20
- CVSS 6.2 Medium
Improper input validation in Google Android
- Google Android
- CWE-20
- CVSS 6.2 Medium
Improper input validation in Google Android
- Google Android
- CWE-20
- CVSS 6.2 Medium
Improper input validation in Google Android
- Google Android
- CWE-20
- CVSS 6.2 Medium
Improper input validation in Google Android
- Google Android
- CWE-20
- CVSS 8.4 High
Improper input validation in Google Android
- Google Android
- CWE-20
- CVSS 6.2 Medium
Improper input validation in Google Android
- Google Android
- CWE-20
- CVSS 6.2 Medium
Improper input validation in Google Android
- Google Android
- CWE-20
- CVSS 6.2 Medium
Improper input validation in Google Android
- Google Android
- CWE-20
- CVSS 4.0 Medium
Improper input validation in Google Android
- Google Android
- CWE-20
- CVSS 6.2 Medium
Improper input validation in Google Android
- Google Android
- CWE-20
- CVSS 6.2 Medium
Improper input validation in Google Android
- Google Android
- CWE-20
- CVSS 8.4 High
Improper input validation in Google Android
- Google Android
- CWE-20
- CVSS 7.8 High
Improper input validation in Google Android
- Google Android
- CWE-20
- CVSS 8.4 High
Improper input validation in Google Android
- Google Android
- CWE-20
- CVSS 6.2 Medium
Improper input validation in Google Android
- Google Android
- CWE-20
- CVSS 8.4 High
Improper input validation in Google Android
- Google Android
- CWE-20
-
Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads
- Memory corruption
- CWE-20
>=33.0.0, <57.3.2 || >=58.0.0, <58.4.1 || >=59.0.0, <59.3.2 || >=60.0.0, <60.1.0 · fixed in 57.3.2, 58.4.1, 59.3.2, 60.1.0
GHSA-gqmm-qrjq-4c7h · CVE-2026-111959 - CVSS 5.1 Medium
jxxghp MoviePilot Workflow Fork Endpoint workflow.py WorkflowExecutor.restore_context deserialization
- jxxghp MoviePilot
- Insecure deserialization
- CWE-20
- CVSS 7.5 High
A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the ims_qos_npn module.
- Memory corruption
- CWE-20
- CVSS 5.3 Medium
ag-ui-protocol ag-ui Transport Decoder input validation
- ag-ui
- CWE-20
- CVSS 3.7 Low
MariaDB Connector/J: XA recover() trusted server-supplied gtrid and bqual lengths
- Denial of service
- CWE-20
>=3.0.0, <3.3.7 || >=3.4.0, <3.4.5 || >=3.5.0, <3.5.11 · fixed in 3.3.7, 3.4.5, 3.5.11
GHSA-4jq2-8v3c-97w8 · CVE-2026-119280 - CVSS 5.9 Medium
MariaDB Connector/J: LOAD DATA LOCAL INFILE file check could be satisfied by text inside quoted identifiers, letting a malicious server read client files
- Path traversal
- CWE-20
>=3.0.0, <3.3.7 || >=3.4.0, <3.4.5 || >=3.5.0, <3.5.11 · fixed in 3.3.7, 3.4.5, 3.5.11
GHSA-fhx5-2xqw-2cgm · CVE-2026-119210 - CVSS 8.2 High
AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers
- Other injection
- CWE-20
>=4.6.0, <5.5.1 · fixed in 5.5.1
GHSA-79wv-8rh2-9vp2 · CVE-2026-96631