CWE-116 · Improper Encoding or Escaping of Output (page 2)
Page 2 of 6 — CVEs classified under CWE-116, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-44311 | Medium | 5.4 | 2026-06-22 | Fabric.js is a Javascript HTML5 canvas library. Prior to 7.4.0, a potential Cross-Site Scripting (XSS) vulnerability exists in Fabric.js due to improper escapi… |
CVE-2026-54287 | Medium | 5.3 | 2026-06-22 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda, the ALB single-header response and the V… |
CVE-2026-44913 | High | 7.2 | 2026-06-22 | Improper escaping of database table names in the CaptureChangeMySQL Processor included with Apache NiFi 1.2.0 through 2.9.0 allows for injecting SQL commands u… |
CVE-2026-12048 | Critical | 9.3 | 2026-06-19 | Stored cross-site scripting in pgAdmin 4's error-rendering and plan-node-rendering paths. Text returned by a PostgreSQL server (ErrorResponse messages, includi… |
CVE-2026-12047 | Low | 3.5 | 2026-06-19 | HTML injection in pgAdmin 4's cloud deployment module. The verify_credentials, deploy, regions, and update-server endpoints under /rds/, /azure/, /google/, and… |
CVE-2026-12044 | High | 8.8 | 2026-06-19 | SQL injection in pgAdmin 4 across every dialog template that renders ``COMMENT ON ... IS '<description>'`` for a user-supplied description field. The Jinja tem… |
CVE-2026-45011 | High | 7.3 | 2026-06-12 | ApostropheCMS is an open-source Node.js content management system. Version 4.29.0 has a stored cross-site scripting vulnerability in the image widget functiona… |
CVE-2026-54133 | Critical | 9.8 | 2026-06-12 | jmespath.php allows users to use JMESPath, software for declaratively specifying how to extract elements from a JSON document, in PHP applications with PHP dat… |
CVE-2026-48485 | | 2026-06-12 | Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, the latest release suppresses mentions when creating, unbanning, unwarning, kicking, muting, an… | |
CVE-2026-47188 | | 2026-06-11 | Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.5, the latest release suppresses mentions in se… | |
CVE-2026-47175 | | 2026-06-11 | Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.4, several moderation commands echo user-contro… | |
CVE-2026-47173 | | 2026-06-11 | Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.3, a normal user can create a ticket with a rea… | |
CVE-2026-47171 | | 2026-06-11 | Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.3, a normal user can create a reminder whose me… | |
CVE-2026-42558 | High | 7.6 | 2026-06-10 | Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.2, a vulnerability chain… |
CVE-2026-53693 | | 2026-06-10 | A stored cross-site scripting vulnerability existed in MISP BSimVis tag rendering code. Several client-side rendering paths interpolated tag names, collection… | |
CVE-2026-49472 | Medium | 5.3 | 2026-06-09 | FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on… |
CVE-2026-8795 | High | 7.8 | 2026-06-09 | A YAML injection vulnerability exists in the Windows.Collectors.Remapping artifact of Rapid7 Velociraptor before version 0.76.6. The hostname field in client_i… |
CVE-2026-46496 | | 2026-06-05 | HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 26.0.0 due t… | |
CVE-2026-20245 | High | 7.8 | 2026-06-04 | A vulnerability in the CLI of Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catal… |
CVE-2026-42321 | | 2026-06-03 | GLPI is a free asset and IT management software package. Starting in version 10.0.4 and prior to version 10.0.25, a technician can store an XSS payload in the… | |
CVE-2026-48598 | Low | 3.7 | 2026-06-02 | Improper Encoding or Escaping of Output vulnerability in elixir-tesla tesla allows multipart part header injection via unescaped Content-Disposition parameter… |
CVE-2026-48209 | High | 7.1 | 2026-06-01 | An improper neutralization of user-controllable input in OTRS or ((OTRS)) Community Edition ticket handling allows authenticated attackers to perform reflected… |
CVE-2026-44713 | High | 8.8 | 2026-05-27 | pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, src/tmux.c reads the user's $TMUX environment variable, spli… |
CVE-2026-45570 | Critical | 9.6 | 2026-05-27 | go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, go-git's SSH transport constructs the remote exec com… |
CVE-2026-44972 | Medium | 5.0 | 2026-05-27 | GuardDog is a CLI tool to identify malicious PyPI packages. From 2.6.0 to 2.9.0, GuardDog includes attacker-controlled filenames, file locations, messages, and… |
CVE-2026-9354 | Medium | 6.5 | 2026-05-24 | A vulnerability was detected in NousResearch hermes-agent up to 2026.4.16. The affected element is an unknown function of the component Slack Agent/Mattermost… |
CVE-2026-26028 | Medium | 6.1 | 2026-05-20 | CryptPad is an end-to-end encrypted collaborative office suite. In versions prior to 2026.2.0, the HTML sanitizer in Diffmarked.js can be bypassed due to incom… |
CVE-2026-34246 | Medium | 4.8 | 2026-05-19 | CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contain a Stored Cross-Site Scripting (XSS) vulnerability exists in t… |
CVE-2026-44429 | Medium | 5.4 | 2026-05-14 | The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.7, the public catalogue UI served at GET / (f… |
CVE-2026-45375 | Critical | 9.0 | 2026-05-14 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan's Bazaar (community marketplace) renders the name and version fields of a… |
CVE-2026-44588 | | 2026-05-14 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, he tooltip mouseover handler in app/src/block/popover.ts reads aria-label via g… | |
CVE-2026-44458 | Medium | 4.3 | 2026-05-13 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, the JSX renderer escapes style attribute object values… |
CVE-2026-43939 | High | 7.3 | 2026-05-12 | YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum. Prior to 4.0.5 and 3.2.12, the thread posting and reply feature accepts user-supplied content via a a post… |
CVE-2026-43938 | High | 8.1 | 2026-05-12 | YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum. Prior to 4.0.5 and 3.2.12, the application's database logger (YAFNET.Core/Logger/DbLogger.cs) captures the… |
CVE-2026-28907 | High | 8.1 | 2026-05-11 | The issue was addressed with improved input validation. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe… |
CVE-2026-39826 | Medium | 6.1 | 2026-05-07 | If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of… |
CVE-2026-42810 | Critical | 9.9 | 2026-05-04 | Apache Polaris accepts literal `*` characters in namespace and table names. When it later builds temporary S3 access policies for delegated table access, those… |
CVE-2026-41426 | Medium | 6.1 | 2026-04-24 | pretalx is a conference planning tool. Prior to 2026.1.0, an unauthenticated attacker can send arbitrary HTML-rendered emails from a pretalx instance's configu… |
CVE-2026-42040 | Low | 3.7 | 2026-04-24 | Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the encode() function in lib/helpers/AxiosURLSearchParams.js cont… |
CVE-2026-41318 | Medium | 5.4 | 2026-04-24 | AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to version 1.12.1, AnythingLL… |
CVE-2026-6019 | Medium | 6.1 | 2026-04-22 | http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sen… |
CVE-2026-33597 | Low | 3.7 | 2026-04-22 | PRSD detection denial of service |
CVE-2026-40871 | High | 7.2 | 2026-04-21 | mailcow: dockerized is an open source groupware/email suite based on docker. Versions prior to 2026-03b have a second-order SQL injection vulnerability in the… |
CVE-2026-40568 | High | 8.5 | 2026-04-21 | FreeScout is a free self-hosted help desk and shared mailbox. Versions prior to 1.8.213 have a stored cross-site scripting (XSS) vulnerability in the mailbox s… |
CVE-2026-40567 | Medium | 5.8 | 2026-04-21 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, an unauthenticated attacker can inject arbitrary HTML into outgoing ema… |
CVE-2026-6058 | Medium | 4.5 | 2026-04-21 | ** UNSUPPORTED WHEN ASSIGNED ** An improper encoding or escaping vulnerability in the CGI program of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 could al… |
CVE-2026-35582 | High | 8.8 | 2026-04-18 | Emissary is a P2P based data-driven workflow engine. In versions 8.42.0 and below, Executrix.getCommand() is vulnerable to OS command injection because it int… |
CVE-2026-40593 | Medium | 4.8 | 2026-04-18 | ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the User Editor (UserEditor.php) renders stored usernames directly into an HT… |
CVE-2026-40483 | Medium | 5.4 | 2026-04-18 | ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the Pledge Editor renders donation comment values directly into HTML input va… |
CVE-2026-40302 | Medium | 6.1 | 2026-04-17 | zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the proxyUi template engine uses Go's text/template (which per… |
CVE-2026-33436 | Low | 3.1 | 2026-04-17 | Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. In versions prior to 2.0.0, file upload endpoints render use… |
CVE-2026-35569 | High | 8.7 | 2026-04-15 | ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain a stored cross-site scripting vulnerability in SEO-related… |
CVE-2026-20136 | Medium | 6.0 | 2026-04-15 | A vulnerability in the CLI of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, local… |
CVE-2026-2404 | Medium | 5.3 | 2026-04-14 | CWE-116 Improper Encoding or Escaping of Output vulnerability exists that could cause log injection and forged log when an attacker alters the POST /j_security… |
CVE-2026-33657 | Medium | 4.6 | 2026-04-13 | EspoCRM is an open source customer relationship management application. Versions 9.3.3 and below have a stored HTML injection vulnerability that allows any aut… |
CVE-2026-40023 | Medium | 5.3 | 2026-04-10 | Apache Log4cxx's XMLLayout https://logging.apache.org/log4cxx/1.7.0/classlog4cxx_1_1xml_1_1XMLLayout.html , in versions before 1.7.0, fails to sanitize charac… |
CVE-2026-40021 | Medium | 5.3 | 2026-04-10 | Apache Log4net's XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list and XmlLayoutSchemaLog4J https://logging.apache… |
CVE-2026-34481 | High | 7.5 | 2026-04-10 | Apache Log4j's JsonTemplateLayout https://logging.apache.org/log4j/2.x/manual/json-template-layout.html , in versions up to and including 2.25.3, produces inv… |
CVE-2026-34480 | High | 7.5 | 2026-04-10 | Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize c… |
CVE-2026-34479 | High | 7.5 | 2026-04-10 | The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Con… |
CVE-2026-34483 | High | 7.5 | 2026-04-09 | Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 t… |
CVE-2026-35534 | High | 7.6 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.1.0, a stored cross-site scripting vulnerability exists in PersonView.php due to incorrect use… |
CVE-2026-35208 | Medium | 5.4 | 2026-04-06 | lichess.org is the forever free, adless and open source chess server. Any approved streamer can inject arbitrary HTML into /streamer and the homepage “Live str… |
CVE-2026-26027 | High | 7.5 | 2026-04-06 | GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, an unauthenticated user can store an XSS payload through the inventory e… |
CVE-2026-25932 | High | 7.2 | 2026-04-06 | GLPI is a Free Asset and IT Management Software package. From 0.60 to before 10.0.24, an authenticated technician user can store an XSS payload in a supplier f… |
CVE-2026-33941 | High | 8.2 | 2026-03-27 | Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the Handlebars CLI precompiler (`bin/handlebars… |
CVE-2026-33758 | Medium | 6.1 | 2026-03-27 | OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao installations that have an OIDC/JWT authentication method e… |
CVE-2026-33628 | Medium | 5.4 | 2026-03-26 | Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel. Invoice line item descriptions in Invoice Ninja v5.13.0 b… |
CVE-2026-32986 | Medium | 6.1 | 2026-03-20 | Textpattern CMS version 4.9.0 contains a second-order cross-site scripting vulnerability that allows attackers to inject malicious scripts by exploiting improp… |
CVE-2026-32811 | High | 8.2 | 2026-03-20 | Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. When using Heimdall in envoy gRPC decision API mode with versions 0.7.0-al… |
CVE-2026-29106 | Medium | 5.9 | 2026-03-19 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the value of the… |
CVE-2026-32754 | Critical | 9.3 | 2026-03-19 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Versions 1.8.208 and below are vulnerable to Stored Cross-Site Scripting (XS… |
CVE-2026-33301 | High | 8.1 | 2026-03-19 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, users with the `Notes - my encounte… |
CVE-2026-31898 | High | 8.1 | 2026-03-18 | jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of arguments of the `createAnnotation` method allows users to inject ar… |
CVE-2026-28499 | Medium | 6.1 | 2026-03-18 | LeafKit is a templating language with Swift-inspired syntax. Prior to version 1.14.2, HTML escaping doesn't work correctly when a template prints a collection… |
CVE-2026-3644 | High | 7.5 | 2026-03-16 | The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths wer… |
CVE-2026-31859 | Medium | 6.1 | 2026-03-11 | Craft is a content management system (CMS). The fix for CVE-2025-35939 in craftcms/cms introduced a strip_tags() call in src/web/User.php to sanitize return UR… |
CVE-2025-12697 | Low | 2.2 | 2026-03-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.5 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allow… |
CVE-2026-28350 | Medium | 6.1 | 2026-03-05 | lxml_html_clean is a project for HTML cleaning functionalities copied from `lxml.html.clean`. Prior to version 0.4.4, the <base> tag passes through the default… |
CVE-2026-28348 | Medium | 6.1 | 2026-03-05 | lxml_html_clean is a project for HTML cleaning functionalities copied from `lxml.html.clean`. Prior to version 0.4.4, the _has_sneaky_javascript() method strip… |
CVE-2026-27812 | Critical | 9.1 | 2026-02-26 | Sub2API is an AI API gateway platform designed to distribute and manage API quotas from AI product subscriptions. A vulnerability in versions prior to 0.1.85 i… |
CVE-2026-21443 | Medium | 6.1 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the `xl()` translation functio… |
CVE-2026-27512 | Medium | 6.1 | 2026-02-23 | Shenzhen Tenda F3 Wireless Router firmware V12.01.01.55_multi contains a content-type confusion vulnerability in the administrative interface. Responses omit t… |
CVE-2026-27469 | Medium | 6.1 | 2026-02-21 | Isso is a lightweight commenting server written in Python and JavaScript. In commits before 0afbfe0691ee237963e8fb0b2ee01c9e55ca2144, there is a stored Cross-S… |
CVE-2026-27169 | High | 8.9 | 2026-02-21 | OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Versions 1.1.2-alpha and below render untrusted user/mo… |
CVE-2026-27016 | Medium | 5.4 | 2026-02-20 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 24.10.0 through 26.1.1 are vulnerable to Stored XSS via the unit paramet… |
CVE-2026-26953 | Medium | 5.4 | 2026-02-19 | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. Versions 6.0 and above have a S… |
CVE-2026-26952 | Medium | 5.4 | 2026-02-19 | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. Versions 6.4 and below are vulne… |
CVE-2026-27013 | High | 7.6 | 2026-02-19 | Fabric.js is a Javascript HTML5 canvas library. Prior to version 7.2.0, Fabric.js applies `escapeXml()` to text content during SVG export (`src/shapes/Text/Tex… |
CVE-2026-25940 | High | 8.1 | 2026-02-19 | jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of properties and methods of the Acroform module allows users to inject arbitra… |
CVE-2026-25755 | High | 8.1 | 2026-02-19 | jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of the argument of the `addJS` method allows an attacker to inject arbitrary PD… |
CVE-2026-25230 | Medium | 4.6 | 2026-02-09 | FileRise is a self-hosted web file manager / WebDAV server. Prior to 3.3.0, an HTML Injection vulnerability allows an authenticated user to modify the DOM and… |
CVE-2025-15312 | Medium | 6.6 | 2026-02-05 | Tanium addressed an improper output sanitization vulnerability in Tanium Appliance. |
CVE-2026-25543 | Medium | 6.1 | 2026-02-04 | HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. Prior to versions 9.0.892 and 9.1.893-b… |
CVE-2026-24737 | High | 8.1 | 2026-02-02 | jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of properties and methods of the Acroform module allows users to inject arbitra… |
CVE-2025-66488 | Medium | 4.6 | 2026-01-28 | Discourse is an open source discussion platform. A vulnerability present in versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 affects anyone who uses… |
CVE-2026-0818 | Medium | 4.3 | 2026-01-28 | When a user explicitly requested Thunderbird to decrypt an inline OpenPGP message that was embedded in a text section of an email that was formatted and styled… |
CVE-2026-24439 | Medium | 6.5 | 2026-01-26 | Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) fail to include the X-Content-Type-Options: nosniff response header on web manag… |
CVE-2026-24127 | Medium | 5.4 | 2026-01-23 | Typemill is a flat-file, Markdown-based CMS designed for informational documentation websites. A reflected Cross-Site Scripting (XSS) exists in the login error… |
CVE-2026-23630 | Medium | 5.4 | 2026-01-21 | Docmost is open-source collaborative wiki and documentation software. In versions 0.3.0 through 0.23.2, Mermaid code block rendering is vulnerable to stored Cr… |