CWE-116 · Improper Encoding or Escaping of Output (page 3)
Page 3 of 6 — CVEs classified under CWE-116, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-22792 | Critical | 9.6 | 2026-01-21 | 5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. Prior to version 0.15.3, an unsafe HTML rendering permits… |
CVE-2026-23880 | High | 7.3 | 2026-01-19 | OnboardLite is a comprehensive membership lifecycle platform built for student organizations at the University of Central Florida. Versions of the software pri… |
CVE-2026-1011 | Medium | 6.1 | 2026-01-16 | A stored cross-site scripting (XSS) vulnerability exists in the Altium Support Center AddComment endpoint due to missing server-side input sanitization. Althou… |
CVE-2026-22712 | Medium | 4.3 | 2026-01-09 | Improper Encoding or Escaping of Output due to magic word replacement in ParserAfterTidy vulnerability in The Wikimedia Foundation Mediawiki - ApprovedRevs Ext… |
CVE-2025-59158 | High | 8.0 | 2026-01-05 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Coolify versions prior to and including v4.0.0-beta.420.6 a… |
CVE-2025-68460 | High | 7.2 | 2025-12-18 | Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a information disclosure vulnerability in the HTML style sanitizer. |
CVE-2025-12734 | Low | 3.5 | 2025-12-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.6 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allow… |
CVE-2025-8405 | High | 7.7 | 2025-12-11 | GitLab has remediated a security issue in GitLab CE/EE affecting all versions from 17.1 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could ha… |
CVE-2025-42896 | Medium | 5.4 | 2025-12-09 | SAP BusinessObjects Business Intelligence Platform lets an unauthenticated remote attacker send crafted requests through the URL parameter that controls the lo… |
CVE-2025-66548 | Low | 3.3 | 2025-12-05 | Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Prior to 1.12.7, 1… |
CVE-2025-9127 | Medium | 5.5 | 2025-12-04 | A vulnerability exists in PX Enterprise whereby sensitive information may be logged under specific conditions. |
CVE-2025-13742 | Medium | 6.1 | 2025-11-27 | Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be replac… |
CVE-2025-64325 | Critical | 9.0 | 2025-11-18 | Emby Server is a personal media server. Prior to version 4.8.1.0 and prior to Beta version 4.9.0.0-beta, a malicious user can send an authentication request wi… |
CVE-2025-40547 | Critical | 9.1 | 2025-11-18 | A logic error vulnerability exists in Serv-U which when abused could give a malicious actor with access to admin privileges the ability to execute code. This… |
CVE-2025-11085 | | 2025-11-11 | A security issue exists within DataMosaix™ Private Cloud allowing for Persistent XSS. This vulnerability can result in the execution of malicious JavaScript, a… | |
CVE-2025-63785 | Medium | 6.1 | 2025-11-07 | A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the text editor feature of the Onlook web application 0.2.32. This vulnerability occurs because… |
CVE-2025-61084 | High | 7.1 | 2025-11-05 | MDaemon Mail Server 23.5.2 validates SPF, DKIM, and DMARC using the email enclosed in angle brackets (<>) in the From: header of SMTP DATA. An attacker can cra… |
CVE-2021-47694 | Medium | 6.1 | 2025-10-30 | The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.1.4 / Nagios XI 5.8.6 contains a reflected cross-site scripting (XSS) vulnerability via the… |
CVE-2025-46583 | Medium | 5.3 | 2025-10-27 | There is a Denial of Service（DoS）vulnerability in the ZTE MC889A Pro product. Due to insufficient validation of the input parameters of the Short Message Servi… |
CVE-2025-11713 | High | 8.1 | 2025-10-14 | Insufficient escaping in the “Copy as cURL” feature could have been used to trick a user into executing unexpected code on Windows. This did not affect the app… |
CVE-2025-11712 | Medium | 6.1 | 2025-10-14 | A malicious page could have used the type attribute of an OBJECT tag to override the default browser behavior when encountering a web resource served without a… |
CVE-2025-61912 | Medium | 5.3 | 2025-10-10 | python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, ldap.dn.escape_dn_chars() escapes \x00 incorre… |
CVE-2025-55903 | High | 8.3 | 2025-10-10 | A HTML injection vulnerability exists in Perfex CRM v3.3.1. The application fails to sanitize user input in the "Bill To" address field within the estimate mod… |
CVE-2025-61773 | High | 8.1 | 2025-10-09 | pyLoad is a free and open-source download manager written in Python. In versions prior to 0.5.0b3.dev91, pyLoad web interface contained insufficient input vali… |
CVE-2025-0607 | Medium | 4.3 | 2025-10-06 | Improper Encoding or Escaping of Output vulnerability in Logo Software Inc. Logo Cloud allows Phishing. This issue affects Logo Cloud: before 2.57. |
CVE-2025-60787 | High | 7.2 | 2025-10-03 | MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image_file_name. Unsanitized user input is written to… |
CVE-2025-59936 | Critical | 9.4 | 2025-09-27 | get-jwks contains fetch utils for JWKS keys. In versions prior to 11.0.2, a vulnerability in get-jwks can lead to cache poisoning in the JWKS key-fetching mech… |
CVE-2025-57880 | Medium | 5.4 | 2025-09-19 | Improper Encoding or Escaping of Output vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceWhoIsOnline) allows Cross-Site Scripting (XSS). This is… |
CVE-2025-48007 | Medium | 6.4 | 2025-09-19 | Improper Encoding or Escaping of Output vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceAvatars) allows Cross-Site Scripting (XSS). This issue… |
CVE-2025-46703 | Medium | 6.4 | 2025-09-19 | Improper Encoding or Escaping of Output vulnerability in Hallo Welt! GmbH BlueSpice (Extension:AtMentions) allows Cross-Site Scripting (XSS). This issue affect… |
CVE-2025-8276 | Medium | 4.3 | 2025-09-16 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'), Improper Encoding or Escaping of Output, Improper Neutralization o… |
CVE-2025-55730 | Critical | 10.0 | 2025-09-09 | XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Starting in version 1.0 and prior to version 1.26.5… |
CVE-2025-55729 | Critical | 10.0 | 2025-09-09 | XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Starting in version 1.0 and prior to version 1.26.5… |
CVE-2025-56266 | Critical | 9.8 | 2025-09-08 | A Host Header Injection vulnerability in Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via supplying a crafted URL. |
CVE-2025-0083 | Medium | 4.0 | 2025-08-26 | In multiple locations, there is a possible way to access content across user profiles due to URI double encoding. This could lead to local information disclosu… |
CVE-2024-58266 | Low | 3.2 | 2025-07-27 | The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \xa0 characters, which may facilitate command injection. |
CVE-2025-34141 | | 2025-07-22 | A reflected cross-site scripting (XSS) vulnerability exists in ETQ Reliance CG (legacy) platform within the `SQLConverterServlet` component. This vulnerability… | |
CVE-2025-6429 | Medium | 6.5 | 2025-06-24 | Firefox could have incorrectly parsed a URL and rewritten it to the youtube.com domain when parsing the URL specified in an `embed` tag. This could have bypas… |
CVE-2025-49013 | Critical | 9.9 | 2025-06-09 | WilderForge is a Wildermyth coremodding API. A critical vulnerability has been identified in multiple projects across the WilderForge organization. The issue a… |
CVE-2025-48062 | High | 7.1 | 2025-06-09 | Discourse is an open-source discussion platform. Prior to version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.bet… |
CVE-2025-25029 | Medium | 4.9 | 2025-05-28 | IBM Security Guardium 12.0 could allow a privileged user to download any file on the system due to improper escaping of input. |
CVE-2025-5271 | Medium | 6.5 | 2025-05-27 | Previewing a response in Devtools ignored CSP headers, which could have allowed content injection attacks. This vulnerability was fixed in Firefox 139 and Thun… |
CVE-2025-3942 | Medium | 4.3 | 2025-05-22 | Improper Output Neutralization for Logs vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linu… |
CVE-2021-25262 | Medium | 5.4 | 2025-05-21 | Yandex Browser for Android prior to version 21.3.0 allows remote attackers to perform IDN homograph attack. |
CVE-2021-25254 | Medium | 5.3 | 2025-05-21 | Yandex Browser Lite for Android before 21.1.0 allows remote attackers to spoof the address bar. |
CVE-2025-1308 | | 2025-05-19 | A vulnerability exists in PX Backup whereby sensitive information may be logged under specific conditions. | |
CVE-2025-47280 | Medium | 6.1 | 2025-05-13 | Umbraco Forms is a form builder that integrates with the Umbraco content management system. Starting in the 7.x branch and prior to versions 13.4.2 and 15.1.2… |
CVE-2024-56524 | Critical | 9.1 | 2025-05-12 | Radware Cloud Web Application Firewall (WAF) before 2025-05-07 allows remote attackers to bypass firewall filters by adding a special character to the request. |
CVE-2025-46340 | High | 7.2 | 2025-05-05 | Misskey is an open source, federated social media platform. Starting in version 12.0.0 and prior to version 2025.4.1, due to an oversight in the validation per… |
CVE-2025-32974 | Critical | 9.0 | 2025-04-30 | XWiki is a generic wiki platform. In versions starting from 15.9-rc-1 to before 15.10.8 and from 16.0.0-rc-1 to before 16.2.0, the required rights analysis doe… |
CVE-2025-24338 | High | 7.1 | 2025-04-30 | A vulnerability in the “Manages app data” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attacker to execute ar… |
CVE-2025-46347 | Critical | 9.8 | 2025-04-29 | YesWiki is a wiki system written in PHP. Prior to version 4.5.4, YesWiki vulnerable to remote code execution. An arbitrary file write can be used to write a fi… |
CVE-2025-4084 | Medium | 5.7 | 2025-04-29 | Due to insufficient escaping of the special characters in the "copy as cURL" feature, an attacker could trick a user into using this command, potentially leadi… |
CVE-2025-31651 | Critical | 9.8 | 2025-04-28 | Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was poss… |
CVE-2025-23377 | Medium | 4.2 | 2025-04-28 | Dell PowerProtect Data Manager Reporting, version(s) 19.17, 19.18 contain(s) an Improper Encoding or Escaping of Output vulnerability. A high privileged attack… |
CVE-2025-32078 | | 2025-04-11 | Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki - Version Compare Extension allows Cross-Site Scripting (XSS).This… | |
CVE-2025-32074 | Medium | 5.4 | 2025-04-11 | Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki - Confirm Account Extension allows Cross-Site Scripting (XSS).This… |
CVE-2025-32072 | | 2025-04-11 | Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki Core - Feed Utils allows WebView Injection.This issue affects Media… | |
CVE-2025-30657 | Medium | 5.3 | 2025-04-09 | An Improper Encoding or Escaping of Output vulnerability in the Sampling Route Record Daemon (SRRD) of Juniper Networks Junos OS allows an unauthenticated, net… |
CVE-2025-30345 | Low | 3.5 | 2025-03-21 | An issue was discovered in OpenSlides before 4.2.5. When creating new chats via the chat_group.create action, the user is able to specify the name of the chat… |
CVE-2024-9606 | High | 7.5 | 2025-03-20 | In berriai/litellm before version 1.44.12, the `litellm/litellm_core_utils/litellm_logging.py` file contains a vulnerability where the API key masking code onl… |
CVE-2024-50629 | Medium | 5.3 | 2025-03-19 | Improper encoding or escaping of output vulnerability in the webapi component in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation Manager… |
CVE-2024-10441 | Critical | 9.8 | 2025-03-19 | Improper encoding or escaping of output vulnerability in the system plugin daemon in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation Man… |
CVE-2023-35894 | Medium | 5.4 | 2025-03-07 | IBM Control Center 6.2.1 through 6.3.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an… |
CVE-2025-1795 | | 2025-02-28 | During an address list folding when a separating comma ends up on a folded line and that line is to be unicode-encoded then the separator itself is also unicod… | |
CVE-2025-27109 | High | 7.3 | 2025-02-21 | solid-js is a declarative, efficient, and flexible JavaScript library for building user interfaces. In affected versions Inserts/JSX expressions inside illegal… |
CVE-2025-27108 | High | 7.3 | 2025-02-21 | dom-expressions is a Fine-Grained Runtime for Performant DOM Rendering. In affected versions the use of javascript's `.replace()` opens up to potential Cross-s… |
CVE-2024-49355 | Medium | 5.3 | 2025-02-20 | IBM OpenPages with Watson 8.3 and 9.0 may write improperly neutralized data to server log files when the tracing is enabled per the System Tracing feature. |
CVE-2024-56473 | Medium | 5.3 | 2025-02-05 | IBM Aspera Shares 1.9.0 through 1.10.0 PL6 could allow an attacker to spoof their IP address, which is written to log files, due to improper verification of '… |
CVE-2025-24025 | Medium | 6.1 | 2025-01-24 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.380, the tags page allows users… |
CVE-2024-56277 | Medium | 5.3 | 2025-01-21 | Improper Encoding or Escaping of Output vulnerability in Ays Pro Poll Maker poll-maker.This issue affects Poll Maker: from n/a through < 5.5.5. |
CVE-2025-23207 | Medium | 6.3 | 2025-01-17 | KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions with `renderToStri… |
CVE-2024-52005 | High | 8.8 | 2025-01-15 | Git is a source code management tool. When cloning from a server (or fetching, or pushing), informational or error messages are transported from the remote Git… |
CVE-2024-52006 | High | 7.5 | 2025-01-14 | Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to int… |
CVE-2024-50349 | Medium | 4.7 | 2025-01-14 | Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to int… |
CVE-2023-28362 | Medium | 4.0 | 2025-01-09 | The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for dow… |
CVE-2024-52891 | Medium | 5.4 | 2025-01-07 | IBM Concert Software 1.0.0, 1.0.1, 1.0.2, 1.0.2.1, and 1.0.3 could allow an authenticated user to inject malicious information or obtain information from log… |
CVE-2024-9427 | Medium | 5.4 | 2024-12-24 | A vulnerability in Koji was found. An unsanitized input allows for an XSS attack. Javascript code from a malicious link could be reflected in the resulting web… |
CVE-2024-55663 | Critical | 9.8 | 2024-12-12 | XWiki Platform is a generic wiki platform. Starting in version 6.3-milestone-2 and prior to versions 13.10.5 and 14.3-rc-1, in `getdocument.vm`; the ordering o… |
CVE-2024-46547 | High | 7.5 | 2024-12-09 | A vulnerability was found in Romain Bourdon Wampserver all versions (discovered in v3.2.3 and v3.2.6) where unauthorized users could access sensitive informati… |
CVE-2024-46901 | Low | 3.1 | 2024-12-09 | Insufficient validation of filenames against control characters in Apache Subversion repositories served via mod_dav_svn allows authenticated users with commit… |
CVE-2024-42332 | Low | 3.7 | 2024-11-27 | The researcher is showing that due to the way the SNMP trap log is parsed, an attacker can craft an SNMP trap with additional lines of information and have for… |
CVE-2018-9433 | High | 8.8 | 2024-11-19 | In ArrayConcatVisitor of builtins-array.cc, there is a possible type confusion due to improper input validation. This could lead to remote code execution with… |
CVE-2024-10006 | High | 8.3 | 2024-10-30 | A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that using Headers in L7 traffic intentions could bypass HTTP header based acces… |
CVE-2024-47549 | High | 7.4 | 2024-10-25 | Sharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, which may allow contamination of unintended data to HTTP response headers. Ac… |
CVE-2024-47224 | Medium | 6.5 | 2024-10-21 | A vulnerability in the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attac… |
CVE-2024-40088 | Medium | 5.3 | 2024-10-21 | A Directory Traversal vulnerability in the Boa webserver of Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, unauthenticated attackers to enumerate the exis… |
CVE-2024-9348 | | 2024-10-16 | Docker Desktop before v4.34.3 allows RCE via unsanitized GitHub source link in Build view. | |
CVE-2024-45219 | High | 8.5 | 2024-10-16 | Account users in Apache CloudStack by default are allowed to upload and register templates for deploying instances and volumes for attaching them as data disks… |
CVE-2023-45359 | Medium | 6.5 | 2024-10-09 | An issue was discovered in the Vector Skin component for MediaWiki before 1.39.5 and 1.40.x before 1.40.1. vector-toc-toggle-button-label is not escaped, but s… |
CVE-2024-47845 | High | 8.2 | 2024-10-05 | Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki - CSS Extension allows Code Injection.This issue affects Mediawiki… |
CVE-2024-47528 | Medium | 4.8 | 2024-10-01 | LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Stored Cross-Site Scripting (XSS) can be achieved by uploading a new Background for… |
CVE-2024-47531 | Medium | 4.6 | 2024-09-30 | Scout is a web-based visualizer for VCF-files. Due to the lack of sanitization in the filename, it is possible bypass intended file extension and make users do… |
CVE-2024-4099 | Low | 3.1 | 2024-09-26 | An issue has been discovered in GitLab EE affecting all versions starting from 16.0 prior to 17.2.8, from 17.3 prior to 17.3.4, and from 17.4 prior to 17.4.1… |
CVE-2024-45808 | Medium | 6.5 | 2024-09-20 | Envoy is a cloud-native high-performance edge/middle/service proxy. A vulnerability has been identified in Envoy that allows malicious attackers to inject unex… |
CVE-2024-7873 | | 2024-09-17 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'), Improper Encoding or Escaping of Output, CWE - 83 Improper Neutral… | |
CVE-2024-45498 | High | 8.8 | 2024-09-07 | Example DAG: example_inlet_event_extra.py shipped with Apache Airflow version 2.10.0 has a vulnerability that allows an authenticated attacker with only DAG tr… |
CVE-2024-45299 | Medium | 6.5 | 2024-09-06 | alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5, the preloaded data as json is… |
CVE-2024-8297 | Medium | 5.3 | 2024-08-29 | A vulnerability was found in kitsada8621 Digital Library Management System 1.0. It has been classified as problematic. Affected is the function JwtRefreshAuth… |
CVE-2024-34739 | High | 7.8 | 2024-08-15 | In shouldRestrictOverlayActivities of UsbProfileGroupSettingsManager.java, there is a possible escape from SUW due to a logic error in the code. This could lea… |