KEV 2026.09.231,721 entries+8 in 7d8 open federal deadlinesas of / search ? keys
Telemetry

Weakness / #1

CWE-20: Improper input validation in CISA KEV

Improper Input Validation

Catalog
2026.09.23
Rank
#1 of 185
MITRE
CWE-20 definition

Answer 119 KEV entries list CWE-20 (Improper input validation) as of catalog 2026.09.23, 6.9% of the catalog and rank 1 of 185 weaknesses. The most affected vendor is Microsoft (28).

The software does not check that input has the properties it needs before using it.

KEV entries
1196.9% of catalog
Vendors
42affected
Ransomware: known
2621.8%
First added
2021-11-03
Latest added
2026-09-22

VVendors

Vendors with CWE-20 KEV entries
VendorEntriesShare
Microsoft2823.5%
Cisco2117.6%
Apple119.2%
Apache86.7%
Google54.2%
Adobe32.5%
ImageMagick21.7%
Realtek21.7%
Linux21.7%
QNAP21.7%
Citrix21.7%
VMware21.7%

TAdditions by year

CWE-20 KEV additions per yearColumn chart of KEV additions per calendar year. 2021: 34; 2022: 60; 2023: 11; 2024: 4; 2025: 4; 2026: 6.02040602021: 34 added3420212022: 60 added6020222023: 11 added1120232024: 4 added420242025: 4 added420252026: 6 added (year to date)62026
CWE-20 KEV additions by year
YearAdded
202134
202260
202311
20244
20254
20266

PProducts

Products with CWE-20 KEV entries
ProductEntriesShare
Microsoft Windows119.2%
Apple iOS and macOS32.5%
Apache Struts32.5%
Cisco IOS and IOS XE Software32.5%
Cisco IOS software32.5%
Apache ActiveMQ21.7%
ImageMagick ImageMagick21.7%
Linux Kernel21.7%

EAll entries

KEV entries listing CWE-20
CVEVendorProductAddedRansomware
CVE-2026-93952AristaVeloCloud Orchestrator NewUnknown
CVE-2026-12569PTCWindchill and FlexPLMKnown
CVE-2026-34910UbiquitiUniFi OSUnknown
CVE-2026-6973IvantiEndpoint Manager Mobile (EPMM)Unknown
CVE-2026-34197ApacheActiveMQUnknown
CVE-2026-32201MicrosoftSharePoint ServerUnknown
CVE-2025-20393CiscoMultiple ProductsUnknown
CVE-2025-54236AdobeCommerce and MagentoUnknown
CVE-2025-6558GoogleChromiumUnknown
CVE-2024-21413MicrosoftOffice OutlookUnknown
CVE-2016-3714ImageMagickImageMagickUnknown
CVE-2024-38189MicrosoftProjectUnknown
CVE-2024-30040MicrosoftWindowsUnknown
CVE-2024-3400Palo Alto NetworksPAN-OSKnown
CVE-2023-41266QlikSenseKnown
CVE-2023-36563MicrosoftWordPadUnknown
CVE-2014-8361RealtekSDKUnknown
CVE-2021-25489SamsungMobile DevicesUnknown
CVE-2023-2868Barracuda NetworksEmail Security Gateway (ESG) ApplianceUnknown
CVE-2010-3904LinuxKernelUnknown
CVE-2022-39197FortraCobalt StrikeUnknown
CVE-2021-30900AppleiOS, iPadOS, and macOSUnknown
CVE-2015-2291IntelEthernet Diagnostics Driver for WindowsKnown
CVE-2023-22952SugarCRMMultiple ProductsUnknown
CVE-2017-11357TelerikUser Interface (UI) for ASP.NET AJAXKnown
CVE-2022-42827AppleiOS and iPadOSUnknown
CVE-2013-6282LinuxKernelUnknown
CVE-2010-2568MicrosoftWindowsUnknown
CVE-2022-37969MicrosoftWindowsKnown
CVE-2022-32917AppleiOS, iPadOS, and macOSUnknown
CVE-2022-3075GoogleChromium MojoUnknown
CVE-2021-31010AppleiOS, macOS, watchOSUnknown
CVE-2022-32894AppleiOS and macOSUnknown
CVE-2022-32893AppleiOS and macOSUnknown
CVE-2022-2856GoogleChromium IntentsUnknown
CVE-2022-29499MitelMiVoice ConnectKnown
CVE-2019-7193QNAPQTSKnown
CVE-2012-0151MicrosoftWindowsUnknown
CVE-2016-0034MicrosoftSilverlightKnown
CVE-2013-3896MicrosoftSilverlightUnknown
CVE-2018-19949QNAPNetwork Attached Storage (NAS)Known
CVE-2019-11708MozillaFirefox and ThunderbirdUnknown
CVE-2007-3010AlcatelOmniPCX EnterpriseUnknown
CVE-2021-42278MicrosoftActive DirectoryKnown
CVE-2017-0148MicrosoftSMBv1 serverKnown
CVE-2022-22675ApplemacOSUnknown
CVE-2022-22674ApplemacOSUnknown
CVE-2018-8414MicrosoftWindowsUnknown
CVE-2018-0147CiscoSecure Access Control System (ACS)Unknown
CVE-2018-0125CiscoVPN RoutersUnknown
CVE-2017-6316CitrixNetScaler SD-WAN Enterprise, CloudBridge Virtual WAN, and XenMobile ServerUnknown
CVE-2017-3881CiscoIOS and IOS XEUnknown
CVE-2017-0146MicrosoftWindowsKnown
CVE-2013-2251ApacheStrutsUnknown
CVE-2012-1823PHPPHPUnknown
CVE-2010-3035CiscoIOS XRUnknown
CVE-2009-2055CiscoIOS XRUnknown
CVE-2009-0927AdobeReader and AcrobatUnknown
CVE-2021-21973VMwarevCenter Server and Cloud FoundationUnknown
CVE-2019-1652CiscoSmall Business RV320 and RV325 Dual Gigabit WAN VPN RoutersUnknown
CVE-2018-0174CiscoIOS XE SoftwareUnknown
CVE-2018-0173CiscoIOS and IOS XE SoftwareUnknown
CVE-2018-0172CiscoIOS and IOS XE SoftwareUnknown
CVE-2018-0159CiscoIOS Software and Cisco IOS XE SoftwareUnknown
CVE-2018-0158CiscoIOS Software and Cisco IOS XE SoftwareUnknown
CVE-2017-12319CiscoIOS XE SoftwareUnknown
CVE-2017-12240CiscoIOS and IOS XE SoftwareUnknown
CVE-2017-12235CiscoIOS softwareUnknown
CVE-2017-12234CiscoIOS softwareUnknown
CVE-2017-12233CiscoIOS softwareUnknown
CVE-2016-8562SiemensSIMATIC CPUnknown
CVE-2016-7262MicrosoftExcelUnknown
CVE-2015-2545MicrosoftOfficeUnknown
CVE-2014-4114MicrosoftWindowsUnknown
CVE-2013-5065MicrosoftWindowsUnknown
CVE-2009-1123MicrosoftWindowsUnknown
CVE-2022-24086AdobeCommerce and Magento Open SourceUnknown
CVE-2017-9791ApacheStruts 1Unknown
CVE-2017-0145MicrosoftSMBv1Known
CVE-2017-0144MicrosoftSMBv1Known
CVE-2016-3088ApacheActiveMQUnknown
CVE-2022-22587AppleiOS and macOSUnknown
CVE-2021-35247SolarWindsServ-UUnknown
CVE-2012-0391ApacheStruts 2Unknown
CVE-2013-3900MicrosoftWinVerifyTrust functionUnknown
CVE-2021-44228ApacheLog4j2Known
CVE-2017-17562EmbedthisGoAheadUnknown
CVE-2010-1871Red HatJBoss Seam 2Unknown
CVE-2020-11261QualcommSnapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon WearablesUnknown
CVE-2021-38000GoogleChromium IntentsUnknown
CVE-2021-36742Trend MicroApex One, Apex One as a Service, and Worry-Free Business SecurityUnknown
CVE-2021-35395RealtekAP-Router SDKUnknown
CVE-2021-31207MicrosoftExchange ServerKnown
CVE-2021-30860AppleMultiple ProductsUnknown
CVE-2021-30663AppleMultiple ProductsUnknown
CVE-2021-27104AccellionFTAKnown
CVE-2021-27102AccellionFTAKnown
CVE-2021-22502Micro FocusOperation Bridge Reporter (OBR)Unknown
CVE-2021-22205GitLabCommunity and Enterprise EditionsKnown
CVE-2021-21985VMwarevCenter ServerKnown
CVE-2021-21220GoogleChromium V8Unknown
CVE-2020-8195CitrixApplication Delivery Controller (ADC), Gateway, and SD-WAN WANOP ApplianceUnknown
CVE-2020-3452CiscoAdaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)Unknown
CVE-2020-3161CiscoCisco IP PhonesUnknown
CVE-2020-1040MicrosoftHyper-V RemoteFXUnknown
CVE-2020-0041AndroidAndroid KernelUnknown
CVE-2019-0604MicrosoftSharePointKnown
CVE-2018-7600DrupalDrupal CoreKnown
CVE-2018-20062ThinkPHPnoneCmsUnknown
CVE-2018-11776ApacheStrutsUnknown
CVE-2018-0296CiscoAdaptive Security Appliance (ASA)Unknown
CVE-2018-0171CiscoIOS and IOS XEUnknown
CVE-2017-9822DotNetNuke (DNN)DotNetNuke (DNN)Known
CVE-2017-8759Microsoft.NET FrameworkUnknown
CVE-2017-6327SymantecSymantec Messaging GatewayUnknown
CVE-2017-5638ApacheStrutsKnown
CVE-2017-0143MicrosoftWindowsKnown
CVE-2016-3718ImageMagickImageMagickUnknown
CVE-2016-0185MicrosoftWindowsUnknown

Cite this

119 CISA KEV entries list CWE-20 (Improper input validation), 6.9% of the catalog. Source: Telemetry analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.09.23 (released 2026-09-23). https://glide-telemetry.pages.dev/cwe/cwe-20/

Source: CISA KEV catalog v2026.09.23, released 2026-09-23. Windows end 2026-09-23.

Keyboard shortcuts

Keyboard shortcuts
/Focus search
?Show this panel
EscClose panel or clear search
g dGo to Dashboard
g kGo to KEV
g vGo to Vendors
g pGo to Products
g wGo to Weaknesses
g sGo to Stats
g rGo to Regulations
g bGo to Briefings
g aGo to API