CWE-1287 · 141 records

Improper Validation of Specified Type of Input

CVEs in this class

141 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
97Now	CVE-2024-4879Weaponized	Jelly Template Injection Vulnerability in ServiceNow UI Macrosservicenow · servicenow · CWE-1287 Pre-auth SSTI	Critical9.3	KEV	99.9%	Jul 10, 2024
43Plan	CVE-2024-6298Proof of concept	remote code executionabb · aspect-ent-12 firmware · CWE-1287 pre-auth RCE	Critical9.4	—	19.0%	Jul 5, 2024
40Plan	CVE-2021-32024No exploit	A remote code execution vulnerability in the BMP image codec of BlackBerry QNX SDP version(s) 6.4 to 7.1 could allow an attacker to potentiablackberry · qnx software development platform · CWE-1287 pre-auth RCE	Critical9.8	—	1.7%	Dec 13, 2021
39Monitor	CVE-2026-44935No exploit	Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployersuse · rancher fleet · CWE-1287	Critical9.9	—	0.4%	Jul 2, 2026
38Monitor	CVE-2024-51550Proof of concept	Data Validation / Sanitizationabb · aspect-ent-12 firmware · CWE-1287 Pre-auth	Critical9.3	—	1.8%	Dec 5, 2024
37Monitor	CVE-2024-51551No exploit	Default Credentail vulnerabilities in ASPECT on Linux allows access to the product using publicly available default credentials.abb · aspect-ent-2 firmware · CWE-1287 Pre-auth Hard-coded credentials	Critical9.3	—	0.4%	Dec 5, 2024
36Monitor	CVE-2024-5594No exploit	OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected aropenvpn · openvpn · CWE-1287 Pre-auth	Critical9.1	—	0.8%	Jan 6, 2025
36Monitor	CVE-2025-12977No exploit	Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins fail to sanitize tag_key inputs.treasuredata · fluent bit · CWE-1287 Pre-auth Path traversal	Critical9.1	—	0.7%	Nov 24, 2025
36Monitor	CVE-2024-35213No exploit	Vulnerability in SGI Image Codec Impacts BlackBerry QNX Software Development Platform (SDP)blackberry · qnx software development platform · CWE-1287 Pre-auth	Critical9.0	—	0.5%	Jun 11, 2024
35Monitor	CVE-2026-2004No exploit	PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary codepostgresql · postgresql · CWE-1287 RCE	High8.8	—	1.3%	Feb 12, 2026
35Monitor	CVE-2026-26115No exploit	SQL Server Elevation of Privilege Vulnerabilitymicrosoft · sql server 2016 · CWE-1287	High8.8	—	1.1%	Mar 10, 2026
35Monitor	CVE-2026-96044No exploit	Microsoft Office SharePoint Elevation of Privilege Vulnerabilitymicrosoft · sharepoint server · CWE-1287	High8.8	—	0.8%	Oct 13, 2026
35Monitor	CVE-2023-47726No exploit	IBM QRadar Suite improper input validationibm · cloud pak for security · CWE-1287	High8.8	—	0.3%	Jun 18, 2024
35Monitor	CVE-2023-29126No exploit	Insecure loose comparison in Enel X JuiceBoxenelx · waybox pro firmware · CWE-1287 Pre-auth Auth bypass	High8.8	—	0.2%	Nov 5, 2024
34Monitor	CVE-2024-51546Proof of concept	Credentails Disclosureabb · aspect-ent-12 firmware · CWE-1287 Pre-auth	High8.7	—	1.4%	Dec 5, 2024
34Monitor	CVE-2024-9404No exploit	Denial-of-Service Vulnerabilitymoxa · vport 07-3 series · CWE-1287 Pre-auth	High8.7	—	0.7%	Dec 4, 2024
34Monitor	CVE-2024-47504No exploit	Junos OS: SRX5000 Series: Receipt of a specific malformed packet will cause a flowd crashjuniper · junos · CWE-1287 Pre-auth	High8.7	—	0.6%	Oct 11, 2024
34Monitor	CVE-2024-30395No exploit	Junos OS and Junos OS Evolved: A malformed BGP tunnel encapsulation attribute will lead to an rpd crashjuniper · junos · CWE-1287 Pre-auth	High8.7	—	0.5%	Apr 12, 2024
34Monitor	CVE-2024-20494No exploit	A vulnerability in the TLS cryptography functionality of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defensecisco · adaptive security appliance software · CWE-1287 Pre-auth Denial of service	High8.6	—	0.5%	Oct 23, 2024
34Monitor	CVE-2026-18830Proof of concept	Insufficient input validation in Amazon Bedrock AgentCore harness InvokeHarness APIaws · amazon bedrock agentcore harness · CWE-1287	High8.6	—	0.5%	Aug 4, 2026
34Monitor	CVE-2025-20251No exploit	Cisco Secure Firewall Adaptive Security Appliance and Cisco Secure Firewall Threat Defense Software Authenticated Arbitrary File Deletioncisco · cisco adaptive security appliance (asa) software · CWE-1287	High8.5	—	0.4%	Aug 14, 2025
34Monitor	CVE-2025-9041No exploit	Rockwell Automation FLEX 5000 I/O - Module Faultrockwell automation · flex 5000 i/o · CWE-1287 Pre-auth	High8.7	—	0.3%	Aug 14, 2025
34Monitor	CVE-2025-9042No exploit	Rockwell Automation FLEX 5000 I/O - Module Faultrockwell automation · flex 5000 i/o · CWE-1287 Pre-auth	High8.7	—	0.3%	Aug 14, 2025
34Monitor	CVE-2026-2454No exploit	DoS in Calls plugin via malformed msgpack in websocket request.mattermost · mattermost server · CWE-1287 Pre-auth Denial of service	High8.6	—	0.2%	Mar 16, 2026
33Monitor	CVE-2026-40851No exploit	Command injection via USBmb connect line · mbnet/mbnet.rokey · CWE-1287 RCE Command injection	High8.4	—	0.1%	May 27, 2026

CVE-2024-4879
97Now
Jelly Template Injection Vulnerability in ServiceNow UI Macros
CriticalCVSS 9.3KEVWeaponizedEPSS 99%
- Pre-auth
- SSTI
servicenow · servicenowJul 10, 2024
CVE-2024-6298
43Plan
remote code execution
CriticalCVSS 9.4Proof of conceptEPSS 19%
- pre-auth RCE
abb · aspect-ent-12 firmwareJul 5, 2024
CVE-2021-32024
40Plan
A remote code execution vulnerability in the BMP image codec of BlackBerry QNX SDP version(s) 6.4 to 7.1 could allow an attacker to potentia
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
blackberry · qnx software development platformDec 13, 2021
CVE-2026-44935
39Monitor
Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer
CriticalCVSS 9.9No exploitEPSS 0%
suse · rancher fleetJul 2, 2026
CVE-2024-51550
38Monitor
Data Validation / Sanitization
CriticalCVSS 9.3Proof of conceptEPSS 1%
- Pre-auth
abb · aspect-ent-12 firmwareDec 5, 2024
CVE-2024-51551
37Monitor
Default Credentail vulnerabilities in ASPECT on Linux allows access to the product using publicly available default credentials.
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
abb · aspect-ent-2 firmwareDec 5, 2024
CVE-2024-5594
36Monitor
OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected ar
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
openvpn · openvpnJan 6, 2025
CVE-2025-12977
36Monitor
Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins fail to sanitize tag_key inputs.
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Path traversal
treasuredata · fluent bitNov 24, 2025
CVE-2024-35213
36Monitor
Vulnerability in SGI Image Codec Impacts BlackBerry QNX Software Development Platform (SDP)
CriticalCVSS 9.0No exploitEPSS 0%
- Pre-auth
blackberry · qnx software development platformJun 11, 2024
CVE-2026-2004
35Monitor
PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code
HighCVSS 8.8No exploitEPSS 1%
- RCE
postgresql · postgresqlFeb 12, 2026
CVE-2026-26115
35Monitor
SQL Server Elevation of Privilege Vulnerability
HighCVSS 8.8No exploitEPSS 1%
microsoft · sql server 2016Mar 10, 2026
CVE-2026-96044
35Monitor
Microsoft Office SharePoint Elevation of Privilege Vulnerability
HighCVSS 8.8No exploitEPSS 0%
microsoft · sharepoint serverOct 13, 2026
CVE-2023-47726
35Monitor
IBM QRadar Suite improper input validation
HighCVSS 8.8No exploitEPSS 0%
ibm · cloud pak for securityJun 18, 2024
CVE-2023-29126
35Monitor
Insecure loose comparison in Enel X JuiceBox
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
enelx · waybox pro firmwareNov 5, 2024
CVE-2024-51546
34Monitor
Credentails Disclosure
HighCVSS 8.7Proof of conceptEPSS 1%
- Pre-auth
abb · aspect-ent-12 firmwareDec 5, 2024
CVE-2024-9404
34Monitor
Denial-of-Service Vulnerability
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
moxa · vport 07-3 seriesDec 4, 2024
CVE-2024-47504
34Monitor
Junos OS: SRX5000 Series: Receipt of a specific malformed packet will cause a flowd crash
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
juniper · junosOct 11, 2024
CVE-2024-30395
34Monitor
Junos OS and Junos OS Evolved: A malformed BGP tunnel encapsulation attribute will lead to an rpd crash
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
juniper · junosApr 12, 2024
CVE-2024-20494
34Monitor
A vulnerability in the TLS cryptography functionality of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- Denial of service
cisco · adaptive security appliance softwareOct 23, 2024
CVE-2026-18830
34Monitor
Insufficient input validation in Amazon Bedrock AgentCore harness InvokeHarness API
HighCVSS 8.6Proof of conceptEPSS 0%
aws · amazon bedrock agentcore harnessAug 4, 2026
CVE-2025-20251
34Monitor
Cisco Secure Firewall Adaptive Security Appliance and Cisco Secure Firewall Threat Defense Software Authenticated Arbitrary File Deletion
HighCVSS 8.5No exploitEPSS 0%
cisco · cisco adaptive security appliance (asa) softwareAug 14, 2025
CVE-2025-9041
34Monitor
Rockwell Automation FLEX 5000 I/O - Module Fault
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
rockwell automation · flex 5000 i/oAug 14, 2025
CVE-2025-9042
34Monitor
Rockwell Automation FLEX 5000 I/O - Module Fault
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
rockwell automation · flex 5000 i/oAug 14, 2025
CVE-2026-2454
34Monitor
DoS in Calls plugin via malformed msgpack in websocket request.
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- Denial of service
mattermost · mattermost serverMar 16, 2026
CVE-2026-40851
33Monitor
Command injection via USB
HighCVSS 8.4No exploitEPSS 0%
- RCE
- Command injection
mb connect line · mbnet/mbnet.rokeyMay 27, 2026

All vulnerability classes