Skip to content
OpenAdvisories

Weakness (CWE)

CWE-184: Incomplete List of Disallowed Inputs

Base Draft

The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

How to prevent it (1 mitigation)

  1. Implementation

    Do not rely exclusively on detecting disallowed inputs. There are too many variants to encode a character, especially when different environments are used, so there is a high likelihood of missing some variants. Only use detection of disallowed inputs as a mechanism for detecting suspicious activity. Ensure that you are using other protection mechanisms that only identify "good" input - such as lists of allowed inputs - and ensure that you are properly encoding your outputs.

Source: MITRE CWE-184

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 10.0
    CVE-2026-49869 Exploited Public exploit

    Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`

    Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs") to whitelist the public configuration endpoint from Basic Auth. Because the check is a su…

    kestra-io kestra
    KEV Sep 2, 2026