CWE-20.

IXP Manager has authenticated non-administrator privilege escalation

• inex IXP-Manager
• Privilege escalation
• CWE-20

libriscv: Out of bounds read vuln in the ELF parser (Denial of service)

• libriscv
• Memory corruption
• CWE-20

Stirling-PDF: SVG→PDF local file read (LFI) via SVG-sanitizer and Batik same-origin bypass

• Stirling-Tools Stirling-PDF
• Path traversal
• Server-side request forgery (SSRF)

Tesseract: Crafted LSTM model (`WeightMatrix` mode byte) triggers `ASSERT_HOST` abort in `WeightMatrix::DeSerializeOld` under `FAST_FLOAT` — Denial of Service

• tesseract
• Denial of service
• CWE-20

OpenVM: MemoryMerkleAir allows below-leaf rows to alter memory roots

• openvm
• CWE-20

OpenVM's OpenVmHalo2Verifier accepts non-canonical app commitments

• openvm
• CWE-20

SNARK Verifier: Halo 2 aggregation mishandles point-at-infinity proof elements

• axiom-crypto snark-verifier
• CWE-20

SNARK Verifier: noncanonical accumulator limb decoding

• axiom-crypto snark-verifier
• CWE-20

AdminNeo: version-cache array injection causes persistent denial of service

• CWE-20

>=4.6.2, <5.5.0 · fixed in 5.5.0

Improper input validation in Dell OpenManage Enterprise

• Dell OpenManage Enterprise
• CWE-20

GroupEx PRO ( Daxko ) integration - Critical - Unsupported - SA-CONTRIB-2026-278

• Drupal GroupEx PRO ( Daxko ) integration
• CWE-20

Improper input validation in Google Chrome

• Google Chrome
• CWE-20

Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption

• digitalbazaar forge
• CWE-20
• CWE-354

Cedar: JSON template is in scope missing slot-id validation allows link panic and decision divergence

• CWE-20

>=3.0.0, <3.4.3 || >=4.0.0, <4.11.1 · fixed in 3.4.3, 4.11.1

Pre-Authentication SSH Denial of Service via Malformed Public-Key Signature in Progress WS_FTP Server

• Progress Software WS_FTP Server
• Memory corruption
• CWE-20

Improper input validation in Samsung Mobile Bixby

• Samsung Mobile Bixby
• CWE-20

Improper input validation in Apple swift-crypto

• Apple swift-crypto
• CWE-20

a2ui Image Player/Video Player/Audio Player Image.js input validation

• a2ui
• CWE-20

OpenCATS: Authenticated SQL injection in activity DataGrid date filters

• OpenCATS
• SQL injection
• CWE-20

vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE

• CWE-20
• CWE-183

<0.32.0 · fixed in 0.32.0

zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE

• CWE-20
• CWE-436

<9.0.5 · fixed in 9.0.5

Server-side expression parser denial of service

• Grafana OSS
• Grafana Enterprise
• Denial of service
• CWE-20

Azure Monitor access token disclosure via SSRF

• Grafana Enterprise
• Grafana OSS
• Hard-coded credentials
• Server-side request forgery (SSRF)

Apache Kafka: Denial of service in Kafka Streams and client deserializers via unbounded memory allocation

• Apache Software Foundation Apache Kafka
• Denial of service
• CWE-20

HCL BigFix AEX is affected by multiple security vulnerabilities.

• HCL Software BigFix AEX
• CWE-20

Request forgery via news: links

• Mozilla Thunderbird
• CWE-20

MISP Guard Incomplete Tag Validation Allows Non-Allowed Taxonomy Tags to Bypass Feed Policy Enforcement

• misp-guard
• Broken access control
• CWE-20

Fireware OS XPath Injection in SSH Authentication Allows Blind Extraction of Configuration Secrets

• WatchGuard Fireware OS
• Other injection
• CWE-20

LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`

• Path traversal
• CWE-20

<1.95.0 · fixed in 1.95.0

Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped

• CWE-20
• CWE-436

>=3.0.0, <10.0.13 · fixed in 10.0.13

Authlib: empty signatures validation in JWS JSON deserialization

• Weak cryptography or TLS
• CWE-20

<1.9.0 · fixed in 1.9.0

Other issue in the SVG component

• Mozilla Firefox
• Mozilla Thunderbird
• CWE-20

MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass)

• CWE-20
• CWE-682

<1.6.1 · fixed in 1.6.1

dcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASS

• CWE-20
• CWE-1284

<0.52.0 · fixed in 0.52.0

Improper input validation in Apple iOS and iPadOS and others

• Apple iOS and iPadOS
• Apple macOS
• CWE-20

Improper input validation in Apple iOS and iPadOS and others

• Apple iOS and iPadOS
• Apple macOS
• CWE-20

Improper input validation in Apple macOS

• Apple macOS
• CWE-20

Improper input validation in Apple iOS and iPadOS and others

• Apple iOS and iPadOS
• Apple macOS
• CWE-20

Improper input validation in Apple macOS

• Apple macOS
• CWE-20

Improper input validation in Apple macOS

• Apple macOS
• CWE-20

Improper input validation in Apple Safari and others

• Apple Safari
• Apple iOS and iPadOS
• CWE-20

Improper input validation in Apple iOS and iPadOS and others

• Apple iOS and iPadOS
• Apple macOS
• CWE-20

Infinite loop in Xpdf due to missing validation in JPEG 2000 decoder

• Xpdf
• Denial of service
• CWE-20

MISP Guard Case-Sensitive Policy Bypass Allows Unauthorized Feed Data Forwarding

• misp-guard
• CWE-20
• CWE-178

MISP mispguard: Feed responses with 2xx status codes other than 200 bypass filtering rules

• misp-guard
• CWE-20

Ndemic Creations Plague Inc Evolved Workshop Scenario Loader deserialization

• Ndemic Creations Plague Inc Evolved
• Insecure deserialization
• CWE-20

GiveWP < 4.19.0.1 - Unauthenticated Donation Amount Restriction Bypass via Currency

• GiveWP
• CWE-20

SteelRaven7 Ravenfield RFL Custom Map Handler/RFLD Custom Map cacheCoverPoints deserialization

• SteelRaven7 Ravenfield
• Insecure deserialization
• CWE-20

vLLM from 0.20.0 before 0.30.0 contains a denial of service vulnerability that allows remote attackers to crash the engine by sending inconsistent multimodal metadata to the disaggregated /inferenc...

• CWE-20

>=0.20.0, <0.30.0 · fixed in 0.30.0

vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that allows remote attackers to terminate EngineCore by bypassing logprob_token_ids limits in the Rust gRPC frontend. Attac...

• CWE-20

>=0.22.0, <0.24.0 · fixed in 0.24.0

vLLM 0.22.0 before 0.24.0 Denial of Service via Rust gRPC Generate

• vllm
• CWE-20

vLLM 0.22.0 before 0.24.0 DoS via Rust gRPC CandidateTokens.top_n

• vllm
• CWE-20

Parse Server 9.0.0 before 9.10.4-alpha.3 Reserved Field Name Injection via Object Writes

• parse-community parse-server
• CWE-20

LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores

• Broken access control
• CWE-20

<3.1.3 · fixed in 3.1.3

Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient

• CWE-20
• CWE-436

>=3.0.0, <10.1.4 · fixed in 10.1.4

Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient

• CWE-20
• CWE-436

>=3.0.0, <10.1.4 · fixed in 10.1.4

Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name

• CWE-20
• CWE-436

>=3.0.0, <10.1.4 · fixed in 10.1.4

fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization

• CWE-20
• CWE-436

>=2.4.2, <2.4.8 || >=3.1.3, <3.1.9 || >=4.0.1, <4.2.3 · fixed in 2.4.8, 3.1.9, 4.2.3

Goobi viewer: Solr query injection via the legacy RSS servlet q and filterQuery parameters

• intranda goobi-viewer-core
• SQL injection
• Other injection

Goobi viewer: cleanUpQuery double-brace bypass allows arbitrary Solr local-param injection

• intranda goobi-viewer-core
• CWE-20
• CWE-116