Weaknesses of type CWE-670
119 resultsValidação inadequada de entrada
A aplicação aceita dados do usuário sem verificar se estão no formato, tamanho ou tipo esperado, permitindo que valores malformados ou maliciosos sejam processados. Isso abre porta para injeção, estouro de buffer, lógica corrompida e outros ataques.
Example
Um formulário web que recebe um CPF sem verificar se contém apenas dígitos, ou que aceita um campo 'idade' como string sem validar se é um número positivo. Um atacante envia valores inesperados (SQL injection, scripts) que a aplicação processa como legítimos.
How to mitigate
Implemente validação em todos os pontos de entrada: whitelist de caracteres permitidos, limites de tamanho, tipagem explícita, e rejeite dados que não correspondam ao esperado. Valide tanto no cliente (UX) quanto no servidor (segurança).
CVE-2026-117859MEDIUMKeycloak-services: keycloak-services: par single-use bypass via flow restartEPSS 0.2%CVE-2024-35312MEDIUMIn Tor Arti before 1.2.3, STUB circuits incorrectly have a length of 2 (with lite vanguards), aka TROVE-2024-003.EPSS 0.2%CVE-2026-41988LOWuuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID version is 3, 5, or 6. In particular, UUIDEPSS 0.2%CVE-2024-0313MEDIUMA malicious insider exploiting this vulnerability can circumvent existing security controls put in place by the organization. On the contrarEPSS 0.2%CVE-2026-72704MEDIUMRocq Prover through 9.2.0 Guard Checker Trusts Corrupted Recursive Tree After TransportEPSS 0.2%CVE-2026-72703MEDIUMRocq Prover 8.20 before 9.2.0 Guard Checker Accepts Non-Terminating Fixpoint via Unchecked Cross-CallsEPSS 0.2%CVE-2026-72705MEDIUMRocq Prover before 9.2.0 Guard Checker Accepts Fixpoint Passed as a Higher-Order ArgumentEPSS 0.2%CVE-2026-40960HIGHLuanti 5 before 5.15.2 sometimes allows unintended access to an insecure environment. If at least one mod is listed as secure.trusted_mods oEPSS 0.2%CVE-2026-40200HIGHAn issue was discovered in musl libc 0.7.10 through 1.2.6. Stack-based memory corruption can occur during qsort of very large arrays, due toEPSS 0.2%CVE-2026-12321MEDIUMJIT miscompilation in the JavaScript: WebAssembly componentEPSS 0.2%CVE-2025-33199LOWNVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause incorrect control flow behavior. A successfuEPSS 0.1%CVE-2026-73283LOWIn sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.EPSS 0.1%CVE-2023-20915HIGHIn addOrReplacePhoneAccount of PhoneAccountRegistrar.java, there is a possible way to enable a phone account without user interaction due toEPSS 0.1%CVE-2026-107284LOWAsyncHttpClient: WebSocket handshake continues after a failed Sec-WebSocket-Accept checkEPSS 0.1%CVE-2026-35343LOWuutils coreutils cut Inconsistent Output Suppression with Newline DelimitersEPSS 0.1%CVE-2026-106586LOWIn sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a EPSS 0.1%CVE-2026-41527MEDIUMKDE Kleopatra before 26.08.0 on Windows allows local users to obtain the privileges of a Kleopatra user, because there is an error in the meEPSS 0.1%CVE-2022-26461MEDIUMIn vow, there is a possible undefined behavior due to an API misuse. This could lead to local escalation of privilege with System execution EPSS 0.1%CVE-2026-20713MEDIUMAlways-incorrect control flow implementation in some firmware for some Intel(R) Xeon(R) processors may allow an escalation of privilege. SysEPSS 0.1%