Skip to content
Noroxi

CWE-184 · 200 records

Incomplete List of Disallowed Inputs

CVEs in this class

200 records

  • CVE-2024-5217
    96Now

    Incomplete Input Validation in GlideExpression Script

    CriticalCVSS 9.2KEVWeaponizedEPSS 99%

    servicenow · servicenowJul 10, 2024

  • CVE-2026-34415
    60This week

    Xerte Online Toolkits File Upload RCE via elfinder Connector

    CriticalCVSS 9.3WeaponizedEPSS 3%

    thexerteproject · xerteonlinetoolkitsApr 22, 2026

  • CVE-2026-41264
    60This week

    Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability

    CriticalCVSS 9.2WeaponizedEPSS 1%

    flowiseai · flowiseApr 23, 2026

  • CVE-2022-43396
    52Plan

    Apache Kylin: Command injection by Useless configuration

    HighCVSS 8.8No exploitEPSS 55%

    apache · kylinDec 30, 2022

  • CVE-2017-7525
    50Plan

    A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthentica

    CriticalCVSS 9.8Proof of conceptEPSS 37%

    fasterxml · jackson-databindFeb 6, 2018

  • CVE-2018-7489
    45Plan

    FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because

    CriticalCVSS 9.8Proof of conceptEPSS 19%

    fasterxml · jackson-databindFeb 26, 2018

  • CVE-2017-15095
    42Plan

    A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user

    CriticalCVSS 9.8No exploitEPSS 8%

    fasterxml · jackson-databindFeb 6, 2018

  • CVE-2019-9212
    40Plan

    SOFA-Hessian through 4.0.2 allows remote attackers to execute arbitrary commands via a crafted serialized Hessian object because blacklistin

    CriticalCVSS 9.8No exploitEPSS 2%

    antfin · sofa-hessianFeb 27, 2019

  • CVE-2017-0909
    40Plan

    The private_address_check ruby gem before 0.4.1 is vulnerable to a bypass due to an incomplete blacklist of common private/local network add

    CriticalCVSS 9.8No exploitEPSS 2%

    private address check project · private address checkNov 16, 2017

  • CVE-2026-79696
    40Plan

    Remote Code Execution in Google ADK for Python via Incomplete Standard Library Denylist

    CriticalCVSS 10.0No exploitEPSS 0%

    google cloud · agent development kit (adk) for pythonSep 9, 2026

  • CVE-2026-87985
    40Plan

    An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using ANSI-C quoted argumen

    CriticalCVSS 10.0No exploitEPSS 0%

    mistralai · mistral-vibeSep 11, 2026

  • CVE-2026-106218
    40Plan

    In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possible

    CriticalCVSS 10.0No exploitEPSS 0%

    jetbrains · teamcityOct 6, 2026

  • CVE-2018-6383
    39Monitor

    Monstra CMS through 3.0.4 has an incomplete "forbidden types" list that excludes .php (and similar) file extensions but not the .pht or .pha

    HighCVSS 8.8Proof of conceptEPSS 13%

    monstra · monstraJan 29, 2018

  • CVE-2017-7540
    39Monitor

    rubygem-safemode, as used in Foreman, versions 1.3.2 and earlier are vulnerable to bypassing safe mode limitations via special Ruby syntax.

    CriticalCVSS 9.8No exploitEPSS 1%

    safemode project · safemodeJul 21, 2017

  • CVE-2025-48732
    39Monitor

    An incomplete blacklist exists in the .htaccess sample of WWBN AVideo 14.4 and dev master commit 8a8954ff.

    CriticalCVSS 9.8No exploitEPSS 1%

    wwbn · avideoJul 24, 2025

  • CVE-2026-47392
    39Monitor

    PraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execute_code` (subprocess mode)

    CriticalCVSS 9.9No exploitEPSS 0%

    mervinpraison · praisonaiJul 21, 2026

  • CVE-2026-65083
    39Monitor

    NVIDIA OpenShell for Linux contains a vulnerability in its sandbox provisioning API, where an attacker could cause an incomplete list of dis

    CriticalCVSS 9.9No exploitEPSS 0%

    nvidia · openshellAug 25, 2026

  • CVE-2026-57138
    39Monitor

    PraisonAI codeMode sandbox escape via Function constructor

    CriticalCVSS 9.9No exploitEPSS 0%

    mervinpraison · praisonaiSep 15, 2026

  • CVE-2023-3374
    39Monitor

    Privilege Escalation in Bookreen

    CriticalCVSS 9.8No exploitEPSS 0%

    bookreen · bookreenSep 5, 2023

  • CVE-2026-13448
    39Monitor

    Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently aut

    CriticalCVSS 9.8No exploitEPSS 0%

    langflow · langflowJul 17, 2026

  • CVE-2020-5253
    39Monitor

    Privilege escalation in NetHack

    CriticalCVSS 9.8No exploitEPSS 0%

    nethack · nethackMar 10, 2020

  • CVE-2026-70470
    38Monitor

    Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE

    CriticalCVSS 9.5No exploitEPSS 0%

    flowiseai · flowiseAug 4, 2026

  • CVE-2024-5178
    37Monitor

    Incomplete Input Validation in SecurelyAccess API

    MediumCVSS 6.9No exploitEPSS 33%

    servicenow · now platformJul 10, 2024

  • CVE-2021-25631
    37Monitor

    denylist of executable filename extensions possible to bypass under windows

    HighCVSS 8.8No exploitEPSS 5%

    libreoffice · libreofficeMay 3, 2021

  • CVE-2026-56315
    37Monitor

    picklescan - Remote Code Execution via Unblocked Standard Library Modules

    CriticalCVSS 9.3No exploitEPSS 1%

    picklescan · picklescanJun 23, 2026

All vulnerability classes