Sign in Sign up
JA · EN · FR
SecPulse

Cwe 20

🧬 CWE Related 2,856
slug: cwe-20

Explanation

CWE-20は「ユーザーから受け取ったデータが、想定された形式・範囲・型かをきちんとチェックせずに使ってしまう欠陥」のことです。 非常に広い概念で、SQLi・XSS・コマンドインジェクションなど多くの攻撃の前段階となります。 「入力は信用するな (Trust Boundaries の概念)」がセキュリティ設計の基本原則です。
📌 Example
多くのCISA KEV登録CVEがこのCWEに分類されており、2024年だけで100件以上の悪用事例があります。
🔗 Related links

🔖 Related tags

Cwe 798678 Cwe 894152 Cwe 8624031 Cwe 2844027 Cwe 4163896 Cwe 1193182 Cwe 2003138 Cwe 1253115 Cwe 222769 Cwe 7872517 Cwe 782021 Cwe 941870 Cwe 8631865 Cwe 1221799 Cwe 741796

🛡 Vulnerabilities tagged with this 2,857

Image ID Title
CVE-2026-49453 Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to…
CVE-2026-73547 Vulnerability in Envoyproxy (CVE-2026-73547)
CVE-2026-73552 Vulnerability in Envoyproxy (CVE-2026-73552)
CVE-2026-73513 Vulnerability in Envoyproxy (CVE-2026-73513)
CVE-2026-94383 The MISP blocklist workflow module accepted a user-supplied blocklist filename parameter without validating the file…
CVE-2026-94379 The login() function in MISP's UsersController.php contained insufficient HTTP method validation for several…
CVE-2026-94092 A vulnerability was detected in dmlc dgl up to 2.1.0. This impacts the function load_info/_read_torch_data of the file…
CVE-2026-94093 A security vulnerability has been detected in DLR-RM stable-baselines3 up to 2.9.0. This affects the function…
CVE-2026-94091 A weakness has been identified in piskvorky gensim up to 4.4.0. The impacted element is the function Load of the file…
CVE-2026-92254 Missing Authorization in the IOCTL handlers of the wsdkd.sys kernel drivers in Watchdog WatchDog Antivirus 1.8.640…
CVE-2026-81180 SysReptor is a fully customizable pentest reporting platform. Prior to 2026.61, authenticated users of SysReptor…
CVE-2026-61794 Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, the Tenant update…
CVE-2026-93567 HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled ...
CVE-2026-93568 A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or…
CVE-2026-25684 A file type attribution issue in Zscaler Internet Access File Type Control evaluation rules may allow improper…
CVE-2026-12954 Vulnerability in WordPress (CVE-2026-12954)
CVE-2026-18911 ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an agent authentication bypass, allowing…
CVE-2026-54501 Browsertrix is a high-fidelity, browser-based crawling service for web archiving that can be self-hosted or used…
CVE-2026-93295 MISP contains a vulnerability in its background job dispatch mechanism that allows remote code execution as the web…
CVE-2026-54577 mport is the MidnightBSD Package Manager. Prior to 2.7.8, the audit command in mport/mport.c computed option-adjusted…
CVE-2026-61793 Vulnerability in nuxt-og-image (CVE-2026-61793)
CVE-2026-92860 A security flaw has been discovered in rcourtman Pulse up to 6.0.4/6.1.0-rc.4. Affected by this...
CVE-2026-92581 In AVideo through 29.0, Like::__construct() performs counter arithmetic on raw request values...
CVE-2026-20237 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco...
CVE-2026-81875 HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to…
CVE-2026-81876 HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to…
CVE-2026-90999 Sentry Seer is vulnerable to a multi-stage trust-boundary violation that allows unauthenticated attacker-controlled…
CVE-2026-88064 Vulnerability in Linuxfoundation (CVE-2026-88064)
CVE-2026-77190 On affected platforms running Arista EOS, an unauthenticated attacker who is network-adjacent to...
CVE-2026-73445 On affected platforms running Arista EOS, an issue with the gRPC Network Security Interface (gNSI...

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details