Weaknesses of type CWE-670

119 results

Validação inadequada de entrada

A aplicação aceita dados do usuário sem verificar se estão no formato, tamanho ou tipo esperado, permitindo que valores malformados ou maliciosos sejam processados. Isso abre porta para injeção, estouro de buffer, lógica corrompida e outros ataques.

Example

Um formulário web que recebe um CPF sem verificar se contém apenas dígitos, ou que aceita um campo 'idade' como string sem validar se é um número positivo. Um atacante envia valores inesperados (SQL injection, scripts) que a aplicação processa como legítimos.

How to mitigate

Implemente validação em todos os pontos de entrada: whitelist de caracteres permitidos, limites de tamanho, tipagem explícita, e rejeite dados que não correspondam ao esperado. Valide tanto no cliente (UX) quanto no servidor (segurança).

CVE-2026-7656HIGHBroken IPv6 Neighbor Discovery input validation allows spoofed RA/NS/NA acceptance in Zephyr net stackEPSS 0.3%CVE-2025-24800CRITICALCritical vulnerability in `ismp-grandpa` <v15.0.1EPSS 0.3%CVE-2026-109722HIGHJIT miscompilation in the JavaScript Engine: JIT componentEPSS 0.3%CVE-2024-5659HIGHRockwell Automation Multicast Request Causes major nonrecoverable fault on Select ControllersEPSS 0.3%CVE-2026-6608MEDIUMlm-sys fastchat Arena Side-by-Side View add_text control flowEPSS 0.3%CVE-2026-40942MEDIUMDSF: Inverted Time Comparison in OIDC JWKS and Token CacheEPSS 0.3%CVE-2026-73468HIGHSecurity Advisory 0175EPSS 0.3%CVE-2026-56307MEDIUMCap-go - Broken Cursor Pagination in /private/devices EndpointEPSS 0.3%CVE-2023-20921HIGHIn onPackageRemoved of AccessibilityManagerService.java, there is a possibility to automatically grant accessibility services due to a logicEPSS 0.3%CVE-2024-30133MEDIUMHCL Traveler for Microsoft Outlook (HTMO) is susceptible to a control flow vulnerabilityEPSS 0.3%CVE-2024-47763MEDIUMWasmtime runtime crash when combining tail calls with trapping importsEPSS 0.2%CVE-2026-35387LOWOpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgoEPSS 0.2%CVE-2025-32942HIGHSSH Tectia Server before 6.6.6 sometimes allows attackers to read and alter a user's session traffic.EPSS 0.2%CVE-2026-102110MEDIUMMissing authentication on a Kiteworks appliance setup functionEPSS 0.2%CVE-2026-40394MEDIUMVarnish Cache 9 before 9.0.1 and Varnish Enterprise before 6.0.16r11 allows a "workspace overflow" denial of service (daemon panic) for certEPSS 0.2%CVE-2026-14935LOWGstreamer1-plugins-bad-free: gstreamer: webrtcbin accepts remote sdp without a=fingerprint due to inverted presence checkEPSS 0.2%CVE-2026-35414MEDIUMOpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with aEPSS 0.2%CVE-2026-44928LOWIn uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal.EPSS 0.2%CVE-2026-102124MEDIUMKiteworks Core Missing Authentication for Critical FunctionEPSS 0.2%CVE-2024-53134MEDIUMpmdomain: imx93-blk-ctrl: correct remove pathEPSS 0.2%