CWE-20: Improper input validation
13,748 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 75 of them as exploited in the wild.
- Published CVEs
- 13,748
- Last 12 months
- 2,220
- Critical
- 1,231
- Known exploited
- 75
Critical 1,231High 5,899Medium 6,073Low 528Not scored 17
CVEs per yearBy the year they were published
- 2019237
- 201929
- 201932
- 2025530
- 2025426
- 20261,961
- 2026699
- 2026653
- 2026799
- 2026653
- 2026818
- 2026761
Known exploitedNewest addition to KEV first
- CVE-2026-88771
A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
Citrix NetScaler · ADC
ExploitedCritical9.5 - CVE-2026-93952
Security Advisory 0183
Arista Networks · VeloCloud Orchestrator (VCO) On-Prem
ExploitedCritical9.5 - CVE-2019-1068
A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server…
Microsoft · Microsoft SQL Server 2014 Service Pack 2 for 32-bit Systems (GDR)
ExploitedHigh8.8 - CVE-2026-12569
Remote Code Execution (RCE) vulnerability in Windchill PDMlink
PTC · Windchill PDMLink
ExploitedCritical9.3 - CVE-2026-34910
A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.
Ubiquiti Inc · UniFi OS Server
ExploitedCritical10.0 - CVE-2026-6973
An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with administrative access to…
Ivanti · Endpoint Manager Mobile
ExploitedHigh7.2 - CVE-2026-34197
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans
Apache Software Foundation · Apache ActiveMQ Broker
ExploitedHigh8.8 - CVE-2026-32201
Microsoft SharePoint Server Spoofing Vulnerability
Microsoft · Microsoft SharePoint Enterprise Server 2016
ExploitedMedium6.5 - CVE-2025-20393
Cisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution Vulnerability
Cisco · Cisco Secure Email
ExploitedCritical10.0 - CVE-2025-54236
Adobe Commerce | Improper Input Validation (CWE-20)
Adobe · Adobe Commerce
ExploitedCritical9.1
Newest CVEs
- CVE-2026-79405
Improper Input Validation in Modem Firmware
Unisoc (Shanghai) Technologies Co., Ltd. · Modem
High7.5 - CVE-2026-116654
Tanium addressed an improper input validation vulnerability in Threat Response.
Tanium · Threat Response
Medium6.5 - CVE-2026-116653
Tanium addressed an improper input validation vulnerability in Threat Response.
Tanium · Threat Response
Medium4.3 - CVE-2026-121141
Improper input validation in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin…
Google · Chrome
Not scored - CVE-2026-121064
Improper input validation in Performance in Google Chrome prior to 157.0.8103.38 allowed a local attacker to potentially execute arbitrary code inside the…
Google · Chrome
Not scored - CVE-2026-121240
Improper input validation in Variations in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via crafted…
Google · Chrome
Not scored - CVE-2026-121236
Improper input validation in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page.…
Google · Chrome
Not scored - CVE-2026-121163
Improper input validation in Browser in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to execute…
Google · Chrome
Not scored - CVE-2026-121115
Improper input validation in Shopping in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions into a privileged…
Google · Chrome
Not scored - CVE-2026-121120
Improper input validation in Prerender in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass web…
Google · Chrome
Not scored