Sign in Sign up
JA · EN · FR
SecPulse

Cwe 20

🧬 CWE Related 2,856
slug: cwe-20

Explanation

CWE-20は「ユーザーから受け取ったデータが、想定された形式・範囲・型かをきちんとチェックせずに使ってしまう欠陥」のことです。 非常に広い概念で、SQLi・XSS・コマンドインジェクションなど多くの攻撃の前段階となります。 「入力は信用するな (Trust Boundaries の概念)」がセキュリティ設計の基本原則です。
📌 Example
多くのCISA KEV登録CVEがこのCWEに分類されており、2024年だけで100件以上の悪用事例があります。
🔗 Related links

🔖 Related tags

Cwe 798678 Cwe 894152 Cwe 8624031 Cwe 2844027 Cwe 4163896 Cwe 1193182 Cwe 2003138 Cwe 1253115 Cwe 222769 Cwe 7872517 Cwe 782021 Cwe 941870 Cwe 8631865 Cwe 1221799 Cwe 741796

🛡 Vulnerabilities tagged with this 2,857

Image ID Title
CVE-2026-28960 Vulnerability in Apple Ipados (CVE-2026-28960)
CVE-2026-19543 IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0...
CVE-2026-54529 Vulnerability in sqladmin (CVE-2026-54529)
CVE-2026-59570 On affected versions of Zscaler client connector, a pre-installed peer app can tear down the...
CVE-2026-59569 An improper input validation vulnerability in Zscaler Client Connector on Android and ChromeOS...
CVE-2026-90961 The LdapAuth and LinOTPAuth authentication plugins in MISP contain an authentication bypass...
CVE-2026-82441 Description A submitted topology carries two lists of blobstore keys, `dependency_jars` and ...
CVE-2026-90614 A weakness has been identified in FedML-AI FedML up to 0.9.6. Affected by this issue is the...
CVE-2026-90575 A weakness has been identified in PHPGurukul Small CRM 4.0. This impacts the function unserialize...
CVE-2026-90490 A security flaw has been discovered in lenve vhr 1.0-SNAPSHOT. This issue affects some unknown...
CVE-2026-85979 Affected versions of Puppet Enterprise contain a command injection vulnerability in the handling...
CVE-2026-3096 The product's web portals allow external links to be opened in a new browser tab. In certain...
CVE-2026-54694 SkillTree is a micro-learning gamification platform. Prior to version 4.4.2, two independent code flaws combine into a…
CVE-2026-39020 An issue in WIngs3D v.2.4.1 allows a local attacker to cause a denial of service via a crafted...
CVE-2025-51619 A vulnerability in the Thesycon DPC Latency Checker driver (dpc.sys) thru 1.4.0 allows local...
CVE-2026-86768 Vulnerability in Snipeitapp (CVE-2026-86768)
CVE-2025-71417 PocketMine-MP before 5.32.1 fails to validate uniqueness of pack UUIDs in...
CVE-2024-58380 PocketMine-MP versions before 5.11.2 contain a denial of service vulnerability in BookEditPacket...
CVE-2023-54392 PocketMine-MP versions >= 4.20.0 before 4.22.3 (and before 5.2.1 in the 5.x branch) fail to...
CVE-2023-54393 PocketMine-MP versions before 4.20.5 contain a denial of service vulnerability in LoginPacket...
CVE-2026-74761 Vulnerability in Apache Activemq (CVE-2026-74761)
CVE-2026-73334 Vulnerability in Apache (CVE-2026-73334)
CVE-2025-7062 A stored cross-site scripting (XSS) vulnerability has been identified in the H5P module `h5p-nodejs-library` by Lumi…
CVE-2026-21112 Vulnerability in Samsung (CVE-2026-21112)
CVE-2026-21101 Vulnerability in Samsung (CVE-2026-21101)
CVE-2026-21094 Vulnerability in Samsung (CVE-2026-21094)
CVE-2026-21086 Vulnerability in Samsung (CVE-2026-21086)
CVE-2026-21089 Vulnerability in Samsung (CVE-2026-21089)
CVE-2026-21088 Vulnerability in Samsung (CVE-2026-21088)
CVE-2026-12855 Unvalidated memory boundary could result in arbitrary code execution. The vulnerability exists in the code developed…

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details